#  Guaranteed Privacy-Preserving $\mathcal{H}_{\infty}$-Optimal Interval
Observer Design for Bounded-Error LTI Systems

Mohammad Khajenejad and Sonia Martínez
M. Khajenejad and S. Martínez are with the Department of Mechanical and
Aerospace Engineering, University of California, San Diego, San Diego, CA, USA
(e-mail: {mkhajenejad, soniamd}@ucsd.edu).  This work is supported by the
grants ONR N00014-19-1-2471 and NSF NSF 2003517,3.

###### Abstract

This paper  furthers current research into the notion of _guaranteed privacy_
, which provides a deterministic characterization of the  privacy of output
signals of a dynamical system or mechanism. Unlike stochastic differential
privacy, guaranteed privacy offers strict bounds on the proximity between the
ranges of two sets of estimated data.  Our approach relies on synthesizing an
interval observer  for linear time-invariant (LTI) bounded-error systems. The
design procedure incorporates  a bounded noise perturbation factor computation
and an observer gain synthesis.  The observer simultaneously provides
guaranteed private and stable interval-valued estimates for the desired
variable. We demonstrate the optimality of our design by minimizing the
$\mathcal{H}_{\infty}$ norm of the observer error system. Lastly, we assess
the accuracy of our proposed mechanism by quantifying the loss incurred when
considering guaranteed privacy specifications, and illustrate our approach
outperformance to differential privacy through simulations.

##  I Introduction

The preservation of data privacy and security has become a pivotal concern in
the oversight of cyber-physical systems (CPS) and their public credibility.
Malicious actors can expand the scope of their attacks by extracting valuable
information from the numerous physical, control, and communication components
of the system; inflicting harm upon both the CPS and its users.  While this
data may initially be hidden, such information may be inferred by the
examination of other mixed data, which made available either unintentionally
or to provide a system-wide service. Consequently, a significant endeavor is
underway to develop resilient control strategies that ensure data security
within these systems [1].  This manuscript contributes to this area of
research by examining a new concept of guaranteed privacy and its application
in dynamic system estimation.

_Literature Review._ Numerous information-theoretic notions have been proposed
to measure the concept of privacy, and these definitions can be put into
practice when dealing with the analysis of real-time data streams [2]. A main
approach to this is _differential privacy_ [3], originally proposed for the
protection of databases of individual records subject to public queries. A
system handling sensitive inputs achieves differential privacy through the
randomization of its responses. This randomization is carefully designed to
ensure that the distribution of publicly disclosed outputs remains relatively
insensitive to the data contributed by any individual participant. This
concept has been broadened and applied across various domains, including
machine learning and regression [4, 5, 6], control, estimation, and
verification [7, 8], multi-agent systems (consensus, message passing) [9, 10,
11], as well as optimization and games [12, 13, 14].

Considering dynamic settings, differential privacy has been applied to
filtering, assuming either that the statistical characterizations of
uncertainties are known [15] or that there is no disturbance [16]. However,
these approaches are not applicable to bounded-error settings where
uncertainties are only assumed to be bounded (set-valued) with unknown
distributions. In such settings, interval observers [17, 18] are capable of
providing guaranteed and uniformly bounded state estimates. The work in [19]
proposed a differentially private mechanism to augment an existing interval
observer  for LTI systems. This was done via an input perturbation mechanism,
by which stochastic bounded-support noise was added to each individual’s data
prior to sending it to the observer. The existence of such initial stable
observer (i.e, a stabilizing gain) was assumed to be granted.  Moreover, after
the injection of the additional stochastic perturbation, neither the
correctnes, i.e., the framer property of the observer, nor its stability  were
re-evaluated. While [19] provide d a first design method that is inclusive of
differential privacy, the question of guaranteed- private-stable and optimal
design was left unaddressed, which this paper contributes toward.

_Contributions._ We start by refining a new notion of guaranteed privacy,
which characterizes privacy in terms of how close the ranges of two set-valued
estimates of the published data are. As opposed to stochastic differential
privacy, guaranteed privacy is deterministic, i.e., provides hard bounds for
the distance between _any_ two possible values belonging to the guaranteed set
of estimates of the published data. Then, we synthesize an interval observer
for LTI bounded-error systems, though designing  a bounded noise perturbation
factor, as well as an observer gain.  The observer simultaneously returns
guaranteed private and stable interval-valued estimates of the desired
variable. Further, we show that our design is optimal, in the sense that it
minimizes the $\mathcal{H}_{\infty}$ norm of the observer error system.
Finally we study the accuracy of our proposed mechanism by quantifying the
loss due to considering guaranteed privacy specifications.

##  II Preliminaries

In this section, we introduce basic notation, as well as preliminary concepts
and results used in the sequel.

_Notation._
$\mathbb{R}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}},\mathbb{R}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}\times
p}$, and
$\mathbb{R}^{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}_{\geq
0}$ denote the
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}$-dimensional
Euclidean space, the sets of
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}$
by $p$ matrices, and nonnegative vectors in
$\mathbb{R}^{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}$,
respectively. Also
$\mathbf{1}_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}},\mathbf{0}_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}$,
and
$\mathbf{0}_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}\times
p}$ denote the the vectors of ones and zeros in
$\mathbb{R}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}$,
and the matrix of ones in
$\mathbb{R}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}\times
p}$, respectively. Further,
$\mathbb{D}^{{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}\times{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}}_{>0}$
denotes the space of $n$ by $n$ diagonal matrices with positive diagonals.
Given
$M\in\mathbb{R}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}\times
p}$, $M^{\top}$ represents its transpose, $M_{ij}$ denotes $M$’s entry in the
$i^{\textup{th}}$ row and the $j^{\textup{th}}$ column,
$M^{\oplus}\triangleq\max(M,\mathbf{0}_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}\times
p})$, $M^{\ominus}=M^{\oplus}-M$, $|M|\triangleq M^{\oplus}+M^{\ominus}$,  and
$\sigma_{\max}(M)\triangleq\max_{x}\|Mx\|_{2}$ s.t.
$\|x\|_{2}\triangleq\sum_{i=1}^{p}x_{i}^{2}=1$ denotes the maximum singular
value of $M$. Furthermore, for $a,b\in\mathbb{R}^{n},a\leq b$ means $a_{i}\leq
b_{i},\forall
i\in\\{1,\dots,{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}\\}$,
while $\text{diag}(D^{1},\dots,D^{N})$ denotes a block diagonal matrix with
diagonal blocks $D^{1},\dots,D^{N}$.  Further, a function
$\theta:\mathbb{R}_{\geq 0}\to\mathbb{R}_{\geq 0}$ is of class $\mathcal{K}$
(resp. $\mathcal{K}_{\infty}$) if it is continuous, and strictly increasing
(resp. if is of class $\mathcal{K}$ and also unbounded). Moreover,
$\kappa:\mathbb{R}_{\geq 0}\to\mathbb{R}_{\geq 0}$ if of class $\mathcal{KL}$
if for each fixed $k\geq 0$, $\kappa(.,t)$ is of class $\mathcal{K}$ and for
each $s\geq 0$, $\kappa(s,t)$ decreases to zero as $t\to\infty$.  Finally,
given any arbitrary sequence $\\{s_{k}\\}_{k=0}^{\infty}$,
$\|s\|_{\ell_{2}}\triangleq\sqrt{\Sigma_{k=0}^{\infty}\|s_{k}\|^{2}_{2}}$ and
$\|s\|_{\ell_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\infty}}}\triangleq\sup_{k\in\mathbb{K}}\|s_{k}\|_{2}$
denote its $\ell_{2}$ and $\ell_{\infty}$ signal norms, respectively.

######  Definition 1 (Intervals).

An
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}$-dimensional
interval
$\mathcal{I}\triangleq[\underline{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z}},\overline{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z}}]\subset\mathbb{R}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}$,
is the set of all real vectors
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z\in\mathbb{R}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}}$
that satisfy
$\underline{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z}}\leq{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z}\leq\overline{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z}}$.
Moreover,
$\textstyle{\mathrm{diam}}(\mathcal{I})\triangleq\|\overline{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z}}-\underline{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}z}}\|{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}_{\infty}\triangleq\max_{i\in\\{1,\cdots,{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}\\}}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}|\overline{z}_{i}-\underline{z}_{i}|}}$
denotes the diameter or interval width of $\mathcal{I}$, while
$c\triangleq\frac{\underline{z}+\overline{z}}{2}$ is the center of
$\mathcal{I}$. Finally, $\mathbb{IR}^{n}$ denotes the space of all
$n$-dimensional intervals, also referred to as _interval vectors_.

######  Proposition 1.

[20, Lemma 1] Let
$A\in^{p\times{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}$
and $\underline{x}\leq
x\leq\overline{x}\in^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}}$.
Then, $A^{\oplus}\underline{x}-A^{\ominus}\overline{x}\leq Ax\leq
A^{\oplus}\overline{x}-A^{\ominus}\underline{x}$. As a corollary, if $A$ is
non-negative, $A\underline{x}\leq Ax\leq A\overline{x}$.

##  III Problem Formulation

###  III-A System Assumptions

Consider a set of $N$ linear time invariant discrete-time bounded-error
systems (agents) with the following dynamics:

$\displaystyle\begin{array}[]{rl}x^{i}_{k+1}&=A^{i}x^{i}_{k}+\sum_{j\neq
i}A^{ij}x^{j}_{k}+W^{i}w^{i}_{k},\\\
y^{i}_{k}&=C^{i}x^{i}_{k}+V^{i}v^{i}_{k},\end{array}$ (3)

where
$k\in\mathbb{K}\triangleq\mathbb{N}\cup\\{0\\},i\in\\{1,\dots,N\\},x^{i}_{0}\in[\underline{x}^{i}_{0},\overline{x}^{i}_{0}]$,
$x^{i}_{k}\in^{n^{i}}$ is the state vector of the agent $i$ and
$w^{i}_{k}\in\mathcal{I}^{i}_{w}\triangleq[\underline{w}^{i},\overline{w}^{i}]\subset^{n^{i}_{w}}$
is a bounded process disturbance. Furthermore, at time step $k$, every system
(agent) $i$ takes (originates) a distinct privacy-sensitive vector-valued
measurement signal $y^{i}_{k}\in^{m^{i}}$, which is affected by
$v^{i}_{k}\in\mathcal{I}_{v}^{i}\triangleq[\underline{v}^{i},\overline{v}^{i}]\subset^{n_{v}^{i}}$,
a bounded sensor (measurement) noise signal. Finally, $A^{i}\in^{n^{i}\times
n^{i}},W^{i}\in^{n^{i}\times n^{i}_{w}},C^{i}\in^{m^{i}\times n^{i}}$ and
$V^{i}\in^{m^{i}\times n^{i}_{v}}$ are known constant matrices, while
$A^{ij},j\neq i,$ represent coupling matrices that capture the influence of
the other agents on the agent $i$. Unlike to the work in [19], we do not
impose any restrictions on $W^{i}$. The global system dynamics can be
constructed by the agents and with
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}\triangleq\sum_{i=1}^{N}n^{i}$
states and
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}m}\triangleq\sum_{i=1}^{N}m^{i}$
outputs, as the following plant:

$\displaystyle\mathcal{G}:\begin{cases}x_{k+1}&=Ax_{k}+Ww_{k},\\\
y_{k}&=Cx_{k}+Vv_{k}\end{cases},$ (4)

where $x_{0}$ is unknown, but satisfies $\underline{x}_{0}\leq
x_{0}\leq\overline{x}_{0}$. Moreover,

$\displaystyle\xi_{k}$
$\displaystyle\triangleq[(\xi^{1}_{k})^{\top},\dots(\xi^{N}_{k})^{\top}]^{\top},\
\forall\xi\in\\{x,y,w,v\\},$ $\displaystyle J$
$\displaystyle\triangleq\text{diag}(J^{1},\dots,J^{N}),\quad\forall
J\in\\{W,C,V\\},$ $\displaystyle A$
$\displaystyle\triangleq\begin{bmatrix}A^{1}&A^{1,2}&\dots&A^{1,N}\\\
A^{2,1}&A^{2}&\dots&A^{2,n}\\\ \vdots&\vdots&\ddots&\vdots\\\
A^{N,1}&A^{N,2}&\dots&A^{N}\end{bmatrix},$

and the data $\underline{x}_{0},\overline{x}_{0},A,C,W,V$ are assumed to be
public information. Furthermore, the bounded general state and measurement
noise signals satisfy
$\underline{\nu}\leq\nu_{k}\leq\overline{\nu},\forall\nu\in\\{w,v\\}$, where
$\underline{\nu}\triangleq[(\underline{\nu}^{1}_{k})^{\top},\dots(\underline{\nu}^{N}_{k})^{\top}]^{\top},\overline{\nu}\triangleq[(\overline{\nu}^{1}_{k})^{\top},\dots(\overline{\nu}^{N}_{k})^{\top}]^{\top}$.

There is  an operator, whose objective is to obtain interval-valued estimates
of $x_{k}$, i.e., $\underline{x}_{k}\leq\overline{x}_{k}$, in an optimal
manner, such that $\underline{x}_{k}\leq x_{k}\leq\overline{x}_{k}$. As a
consequence, the operator releases interval-valued estimates of the aggregated
data given by:

$z_{k}\triangleq\Gamma x_{k}=\textstyle{\sum}_{i=1}^{N}\Gamma^{i}x^{i}_{k},$

where $\Gamma^{i}$ can be any arbitrary matrices. The estimates of $x_{k}$ are
constructed from signals $y_{k}$ perturbed by some intentionally added bounded
noise (separate from the existing measurement noise). The variable $z_{k}$
represents an alternative and arbitrary output of the system, e.g., a
selection (subset) of the individual states or outputs or a linear combination
of these, the information of which is valuable for a third purpose. Because of
this, $z_{k}$ are treated differently from $y_{k}$, even though they are
related to each other via $x_{k}$.

Moreover, the operator aims to ensure that the publicly released interval
estimates of $z_{k}=\Gamma x_{k}$ ensure the privacy of the data (including
participating agents) in a guaranteed manner. The rationale behind this
concern lies in the potential for extracting fresh insights about the multi-
agent system through interval estimates of $z_{k}$. This can be accomplished,
for instance, by exploiting linkage attacks. In such scenarios, an adversary
can deduce novel information about specific individuals [21] by combining the
newly published information with additional side knowledge. To do this, the
operator aims to satisfy a deterministic notion of privacy, which ensures that
the publicly released $\underline{z}_{k},\overline{z}_{k}$ guarantee _hard
(deterministic) privacy bounds_ for each agent’s data. This is motivated by
safety-critical settings, which benefit from “hard” bounds.

The synthesis of the interval-valued estimates is being done through an
$\mathcal{H}_{\infty}$-optimal interval observer, which is formally introduced
via the following sequence of definitions.

######  Definition 2 (Interval Framer).

The sequences $\\{\underline{x}_{k},\overline{x}_{k}\\}_{k=0}^{\infty}$ are
called lower and upper framers for the states of system $\mathcal{G}$ if
$\forall w_{k}\in[\underline{w},\overline{w}],\forall
v_{k}\in[\underline{v},\overline{v}],\underline{x}_{k}\leq
x_{k}\leq\underline{x}_{k}$. Moreover, any dynamical system
$\widehat{\mathcal{G}}$ whose states are framers for the states of
$\mathcal{G}$, i.e., any (tractable) algorithm that returns upper and lower
framers for the states of (4), is called an interval framer for $\mathcal{G}$.

######  Definition 3 (Input-to-State Stability & Interval Observer).

An interval framer $\widehat{\mathcal{G}}$ is input-to-state stable (ISS), if
the framer error $e^{x}_{k}\triangleq\overline{x}_{k}-\underline{x}_{k}$ is
bounded as follows:

$\displaystyle\|e^{x}_{k}\|_{2}\leq\kappa(\|e^{x}_{0}\|_{2},k)+\theta(\|\delta_{\tilde{w}}\|_{\ell_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\infty}}})\quad\forall
k\in\mathbb{K},$ (5)

where $\delta_{\tilde{w}}\triangleq[\delta_{w}^{\top}\
\delta_{v}^{\top}]^{\top}$ is the augmented vector of noise widths,  while
$\kappa$ and $\theta$ are functions of classes $\mathcal{KL}$ and
$\mathcal{K}_{\infty}$, respectively. An ISS interval framer is called an
interval observer.

######  Definition 4 ($\mathcal{H}_{\infty}$-Optimal Interval Observer).

An interval observer $\widehat{\mathcal{G}}$ is $\mathcal{H}_{\infty}$-optimal
if the $\mathcal{H}_{\infty}$ gain of the  dynamic system in the state
estimation error
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{\mathcal{G}}}$,
i.e.,
$\|{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{\mathcal{G}}}\|_{\mathcal{H}_{\infty}}\triangleq\sup_{\delta_{\tilde{w}\neq
0}}\frac{\|e^{x}\|_{\ell_{2}}}{\|\delta_{\tilde{w}}\|_{\ell_{2}}}$, is
minimized, with its minimum value called the observer’s noise attenuation
level.

Note that we do not assume that such an observer exists, rather we want to
synthesize it while satisfying privacy specifications with deterministic
bounds. This is formalized via the notion of _guaranteed privacy_ as described
next.

###  III-B Guaranteed Privacy

To formally define guaranteed privacy, we use a  version of _adjacency
relation_. Let $\mathcal{Y}$ denote the space of measured signal sequences
$\\{y_{k}\\}_{k\geq 0}$, and $\rho>0$ be given. A symmetric binary relation on
$\mathcal{Y}$, denoted  $\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}$,
identifies the types of variations in $y$ that we aim to make hard to detect.

######  Definition 5 (Adjacency Relation).

For any $y,y^{\prime}\in\mathcal{Y}$,

$\displaystyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}}(y,y^{\prime})\
\text{if and only if}\
\|y-y^{\prime}\|_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color<EMAIL_ADDRESS>(6)

Such interpretation of adjacent datasets implies that a single participant
possibly contributes additively to each $y^{i}$ in a way that its overall
impact on the dataset $y$ is bounded in  $2$-norm by $\rho$. We are ready to
formally introduce the notion of guaranteed privacy.

######  Definition 6 (Guaranteed Privacy).

Let $\epsilon,\delta\geq 0$, and $D$ be a space equipped with the symmetric
binary relation
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}}$
given in Definition 5. A deterministic set-valued mechanism
$\mathcal{M}:D\to\mathbb{IR}^{n}$ is $(\epsilon,\delta)$-guaranteed private
w.r.t.
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}}$,
if for all $d,d^{\prime}\in D$ such that
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}}(d,d^{\prime})$,
all $q\in\mathcal{M}(d)$ and all $q^{\prime}\in\mathcal{M}(d^{\prime})$, we
have

$\displaystyle e^{\epsilon}\|q-q^{\prime}\|_{p}\leq\delta,$

where $\mathcal{M}(d)$ and $\mathcal{M}(d^{\prime})$ are the entire interval
range of $\mathcal{M}$ applying  to $d$ and $d^{\prime}$, respectively.

This notion of guaranteed privacy is stronger than the one introduced in [22,
Definition 3] for distributed nonconvex optimization. The new definition
certifies that every arbitrary $m,m^{\prime}$ that belongs to the interval
ranges of $\mathcal{M}$ when applied  to adjacent $d$ and $d^{\prime}$, remain
close to each other. Instead, the notion in [22] only guarantees that the
diameters of $\mathcal{M}(d)$ and $\mathcal{M}(d^{\prime})$ remain close to
each other. In other words, Definition 6 implies the one in [22], but not
conversely.

Further, we re-emphasize the difference between this notion with that of
differential privacy in [23, 12, 13]. Under differential privacy, the
statistics of the output of $\mathcal{M}$, i.e., the probability of the values
of $\mathcal{M}$, is allowed to change only slightly if there is a slight
perturbation of the data $y$. Instead, when guaranteed privacy is considered,
the entire range of the set-valued mechanism $\mathcal{M}$ is allowed to
change only slightly with respect to the perturbed data.

With this being said, our problem can be cast as follows:

######  Problem 1 (Guaranteed Privacy-Preserving Interval Observer Design).

Given system  $\mathcal{G}$, design a mechanism (or mapping) $\mathcal{M}$
that simultaneously

  * •

outputs framers for $z_{k}$ through a to-be-designed framer system (cf.
Definition 2),

  * •

ensures that the framer system is ISS, i.e., the framer system is an interval
observer (cf. Definition 3),

  * •

satisfies the guaranteed privacy of data $\\{y_{k}\\}_{k=0}^{\infty}$ (cf.
Definition 6), and

  * •

guarantees that the observer design is optimal in the sense of
$\mathcal{H}_{\infty}$ (cf. Definition 4).

##  IV Guaranteed Privacy-Preserving Interval Observer Design

In this section, we introduce our proposed strategy to design a guaranteed
privacy-preserving mechanism (or mapping) for interval observer design,
addressing Problem 1. Our approach consists of injecting an additional
perturbation bounded noise  on the outputs of system $\mathcal{G}$, and then
synthesiz ing stable and guaranteed privacy-preserving estimates of the
desired variable $z_{k}$. We assume that the additional bounded perturbation
noise satisfies $\alpha\underline{v}\leq
v^{a}_{k}+v_{k}\leq\alpha\overline{v}$, where $\alpha>0$ is an additional  to-
be-chosen degree of freedom,  that will be designed later along with the
observer gain to satisfy the desired properties of the mechanism. Hence, after
injecting  the controlled additional noise, the lower and upper bounds of the
output noise in the perturbed version of (4) are $\alpha\underline{v}$ and
$\alpha\overline{v}$, respectively.

###  IV-A Framer Structure

Next, we construct a dynamical system, which depends on a new, to-be-designed
gain $L$, which aims to provide interval estimates for $x_{k}$, for any
arbitrary $L$ and $\alpha>0$.

The proposed framer has the following structure:

$\displaystyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widehat{\mathcal{G}}}:\begin{cases}\underline{x}_{k+1}&=(A-LC)^{\oplus}\underline{x}_{k}-(A-LC)^{\ominus}\overline{x}_{k}+Ly_{k}\\\
&+W^{\oplus}\underline{w}-W^{\ominus}\overline{w}+(LV)^{\ominus}\underline{v}^{\prime}-(LV)^{\oplus}\overline{v}^{\prime},\\\
\overline{x}_{k+1}&=(A-LC)^{\oplus}\overline{x}_{k}-(A-LC)^{\ominus}\underline{x}_{k}+Ly_{k}\\\
&+W^{\oplus}\overline{w}-W^{\ominus}\underline{w}+({LV})^{\ominus}\overline{v}^{\prime}-({LV})^{\oplus}\underline{v}^{\prime},\\\
\underline{z}_{k}&=\Gamma^{\oplus}\underline{x}_{k}-\Gamma^{\ominus}\overline{x}_{k},\
\overline{z}_{k}=\Gamma^{\oplus}\overline{x}_{k}-\Gamma^{\ominus}\underline{x}_{k},\end{cases}$
(7)

and is initialized at
$[\overline{x}^{\top}_{0},\underline{x}^{\top}_{0}]^{\top}$. Here,
$\overline{v}^{\prime}\triangleq\alpha\overline{v},\underline{v}^{\prime}\triangleq\alpha\underline{v}$,
and $\underline{z}_{k},\overline{z}_{k}$ can be interpreted as the “outputs”
of $\widehat{\mathcal{G}}$.

As we show below,  system $\widehat{\mathcal{G}}$ is a framer for
$\mathcal{G}$, while simultaneously satisfies stability (i.e., is an
observer), maintains guaranteed privacy of the desired variable $z_{k}=\Gamma
x_{k}$, and is optimal in the sense of $\mathcal{H}_{\infty}$ (cf. Definition
4).

First, we show that  $\widehat{\mathcal{G}}$ constructs a framer for
$\mathcal{G}$ for all values of $\alpha>0$ and $L$.

######  Proposition 2 (Framer Property).

The state trajectory of system (7), initialized at
$[\overline{x}^{\top}_{0},\underline{x}^{\top}_{0}]^{\top}$, frames the true
state of (4) at each time step $k$, i.e., $\underline{x}_{k}\leq
x_{k}\leq\overline{x}_{k},\ \forall k\geq 0$. Moreover, $\forall k\geq
0,\underline{z}_{k}\leq z_{k}=\Gamma_{k}\leq\overline{z}_{k}$, i.e.,
$z_{k}\in[\underline{z}_{k},\overline{z}_{k}]$.

###### Proof.

Starting from (4) and given that $L(y_{k}-Cx_{k}-Vv_{k})=0$ holds for any $L$
with appropriate dimensions, yields
$x_{k+1}=(A-LC)x_{k}+Ww_{k}+Ly_{k}-LVv_{k}$. The results in (7), as well as
the inequalities $\underline{z}_{k}\leq z_{k}=\Gamma_{k}\leq\overline{z}_{k}$,
follow from applying Proposition 1 to all multiplications of matrices with
uncertain vectors. ∎

###  IV-B Observer Input-to-State Stability

In this subsection, we formalize sufficient conditions to satisfy the
stability of the proposed framer (7). These conditions simultaneously satisfy
some bounds on the $\mathcal{H}_{\infty}$-norm of the observer error dynamics,
which is also required in the next subsection where we provide guaranteed
privacy-preserving conditions.

Starting from (7), and defining
$\delta_{\xi}\triangleq\overline{\xi}-\underline{\xi},\forall\xi\in\\{w,v\\}$,
it is straightforward to obtain the following dynamical system
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{\mathcal{G}}}$
for the evolution of the observer error
$e^{x}_{k}\triangleq\overline{x}_{k}-\underline{x}_{k}$ :

$\displaystyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{\mathcal{G}}}:e^{x}_{k+1}=|{A-LC}|e^{x}_{k}+\Lambda\delta_{\lambda},\
\text{where}$ (8) $\displaystyle\Lambda\triangleq[|W|\quad|LV|],\
\delta_{\lambda}\triangleq[\delta^{\top}_{w}\
\delta^{\top}_{v^{\prime}}]^{\top},\
\delta_{v^{\prime}}\triangleq\alpha\delta_{v}.$

The following lemma provides sufficient conditions  in the form of mixed-
integer semi-definite (MISDP) matrix inequalities for the stability of
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{\mathcal{G}}}$,
and derives an upper bound for its $\mathcal{H}_{\infty}$-norm,  where the
mixed-integer feature of the conditions arises from the presence of the
absolute values.

######  Lemma 1 (Observer Stability and Error Dynamics Upper Bound).

Suppose there exist
$Q\in\mathbb{D}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}\times{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}}_{>0}$,
$\gamma>0$, and
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}\in\mathbb{R}^{n\times
m}$, for which the following  MISDP matrix inequality holds:

$\displaystyle\begin{bmatrix}Q&|QA-{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}C|&\begin{bmatrix}Q|W|&|{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}V|\end{bmatrix}&0\\\
*&Q&0&I\\\ *&*&\gamma I&0\\\ *&*&*&\gamma I\end{bmatrix}\succ 0.$ (9)

Then, system
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{\mathcal{G}}}$
is stable and satisfies:

$\displaystyle\|{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{\mathcal{G}}}\|_{\mathcal{H}_{\infty}}\triangleq\sup\limits_{k\geq
0}\frac{\|e^{x}_{k}\|_{2}}{\|\delta_{\lambda}\|_{2}}\leq\gamma.$ (10)

###### Proof.

The result follows from applying [24, Lemma 2] to (8), as well as defining
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}\triangleq
QL$, and restricting the positive-definite matrix $Q\succ 0$ to be a diagonal
matrix with positive diagonal elements, so that we have
$Q|{A-LC}|=|Q{(A-LC)}|=|QA-{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}C|$
and
$Q|{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}V|=|{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}V|$.
∎

###  IV-C Guaranteed Privacy-Preserving Mechanism

We introduce a set-valued deterministic mechanism (i.e., mapping
$\mathcal{M}$) that is guaranteed privacy-preserving for the desired variable
$z_{k}=\Gamma x_{k}$ in the sense of Definition 6. First, note that given the
measurement signal $y_{k}$ and using Proposition 1, the to-be-designed
mechanism $\mathcal{M}$ outputs set-valued estimates of
$z_{k}\in[\underline{z}_{k},\overline{z}_{k}]$ as

$\displaystyle\begin{array}[]{c}\mathcal{M}(y_{k})=\mathcal{Z}_{k}\triangleq[\underline{z}_{k},\overline{z}_{k}],\text{where}\\\
\underline{z}_{k},\overline{z}_{k}\ \text{are outputted by the observer
\eqref{eq:observer}}.\end{array}$ (13)

We aim to find sufficient conditions for the design factors $\alpha$ and $L$
such that $\mathcal{M}$ is guaranteed private. To do so, we upper bound the
distance between any two arbitrary points
$z_{k}\in\mathcal{Z}_{k}=\mathcal{M}(y_{k})$ and
$z^{\prime}_{k}\in\mathcal{Z}^{\prime}_{k}=\mathcal{M}(y^{\prime}_{k})$, by
upper bounding the distance between the centers of the intervals
$\mathcal{Z}_{k}$ and $\mathcal{Z}^{\prime}_{k}$, and using the fact that the
stability of the observer (7) implies boundedness of the diameters of
$\mathcal{Z}_{k}$ and $\mathcal{Z}^{\prime}_{k}$. The procedure is formalized
through the following theorem.

######  Theorem 1 (Guaranteed Privacy-Preserving Mechanism).

Consider system (4) (after adding the bounded perturbation noise), and suppose
that all the assumptions in Lemma 1 hold (consequently system (7) is stable
and (10) holds). Let $\rho>0,\epsilon,\delta\geq 0$,
$(\gamma,Q,{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}})$
be a solution to the MISDP in (9) and let
$L=Q^{-1}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}$.
Then, the mechanism $\mathcal{M}$ defined in (13) is
$(\epsilon,\delta)$-guaranteed private w.r.t.
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}}$
given in (6), if for some $\eta,\alpha>0$, the following matrix inequalities
hold:

$\displaystyle\begin{bmatrix}Q&QA-{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}C&{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}&0\\\
*&Q&0&I\\\ *&*&\eta I&0\\\ *&*&*&\eta I\end{bmatrix}\succ 0,$ (14)
$\displaystyle\sigma_{m}(|\Gamma|)\gamma\alpha\|\delta_{\lambda}\|_{2}+\sigma_{m}(\Gamma)\eta\rho\leq
e^{-\epsilon}\delta,$ (15)

where $\delta_{\lambda}$ is defined under (8).

###### Proof.

Consider two arbitrary
$z_{k}\in\mathcal{M}(y_{k})=\mathcal{Z}_{k}=[\underline{z}_{k},\overline{z}_{k}]$
and
$z_{k}^{\prime}\in\mathcal{M}(y_{k}^{\prime})=\mathcal{Z}^{\prime}_{k}=[\underline{z}^{\prime}_{k},\overline{z}^{\prime}_{k}]$,
where $y_{k},y_{k}^{\prime}\in\mathcal{Y}$ such that
$\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}(y_{k},y_{k}^{\prime})$, i.e.,
$\|y_{k}-y^{\prime}_{k}\|_{2}\leq\rho$. Defining
$e^{z}_{k}\triangleq\overline{z}_{k}-\underline{z}_{k},e^{z^{\prime}}_{k}\triangleq\overline{z}^{\prime}_{k}-\underline{z}^{\prime}_{k}$
and using the triangle inequality we obtain:

$\displaystyle\begin{array}[]{rl}\|z_{k}-z^{\prime}_{k}\|_{2}&=\|(z_{k}-c^{z}_{k})+(c^{z^{\prime}}_{k}-z^{\prime}_{k})+(c^{z^{\prime}}_{k}-c^{z}_{k})\|_{2}\\\
&\leq\frac{1}{2}(\|e^{z}_{k}\|_{2}+\|e^{z^{\prime}}_{k}\|_{2})+\|\delta^{c_{z}}_{k}\|_{2},\end{array}$
(18)

where $\delta^{c_{z}}_{k}\triangleq c^{z}_{k}-c^{z^{\prime}}_{k}$. Moreover,
$c^{\nu}_{k}\triangleq\frac{1}{2}(\underline{\nu}_{k}+\overline{\nu}_{k}),\forall\nu\in\\{z,z^{\prime},x,x^{\prime}\\}$,
are the centers of the intervals
$\mathcal{Z}_{k},\mathcal{Z}^{\prime}_{k},\mathcal{X}_{k}\triangleq[\underline{x}_{k},\overline{x}_{k}],\mathcal{X}^{\prime}_{k}\triangleq[\underline{x}^{\prime}_{k},\overline{x}^{\prime}_{k}]$,
where $\mathcal{X}_{k},\mathcal{X}^{\prime}_{k}$ are the interval-valued state
estimates returned by the proposed observer (7) using $y_{k},y^{\prime}_{k}$,
respectively. Further, from (13) we have

$\displaystyle e^{z}_{k}=e^{z^{\prime}}_{k}=|\Gamma|e^{x}_{k},$ (19)

where the first equality follows from the facts that the error dynamics (8) is
not affected by the observation/measurement signal and  that the initial error
$e^{x}_{0}=e^{x^{\prime}}_{0}=\overline{x}_{0}-\underline{x}_{0}$ is a public
information. Combining (18) and (19) returns

$\displaystyle\|z_{k}-z^{\prime}_{k}\|_{2}\leq\sigma_{\max}(|\Gamma|)\|e^{x}_{k}\|_{2}+\|\delta^{c_{z}}_{k}\|_{2}.$
(20)

Furthermore, from (13), the definition of the interval center, and
$\Gamma^{\oplus}-\Gamma^{\ominus}=\Gamma$, we have $c^{z}_{k}=\Gamma
c^{x}_{k},c^{z^{\prime}}_{k}=\Gamma c^{x^{\prime}}_{k}$. Hence,

$\displaystyle\|\delta^{c_{z}}_{k}\|_{2}=\|c^{z}_{k}-c^{z^{\prime}}_{k}\|_{2}=\|\Gamma(c^{x}_{k}-c^{x^{\prime}}_{k})\|_{2}\leq\sigma_{\max}(\Gamma)\|\delta^{c_{x}}_{k}\|_{2},$

where $\delta^{c_{x}}_{k}\triangleq c^{x}_{k}-c^{x^{\prime}}_{k}$. This in
addition to (20) yields

$\displaystyle\|z_{k}-z^{\prime}_{k}\|_{2}$
$\displaystyle\leq\sigma_{\max}(|\Gamma|)\|e^{x}_{k}\|_{2}+\sigma_{\max}(\Gamma)\|\delta^{c_{x}}_{k}\|_{2},\text{where}$
(21) $\displaystyle\|e^{x}_{k}\|_{2}$
$\displaystyle\leq\gamma\|\delta_{\lambda}\|_{2},$ (22)

by (10) and Lemma 1.  Hence, from (21) and (22):

$\displaystyle\|z_{k}-z^{\prime}_{k}\|_{2}\leq\sigma_{\max}(|\Gamma|)\gamma\|\delta_{\lambda}\|_{2}+\sigma_{\max}(\Gamma)\|\delta^{c_{x}}_{k}\|_{2}.$
(23)

On the other hand, starting from (7), we obtain:

$\displaystyle\delta^{c_{x}}_{k+1}=\widetilde{A}\delta^{c_{x}}_{k}+L(y_{k}-y^{\prime}_{k}).$
(24)

By [24, Lemma 2], (14) implies that the system in (24) is stable and
$\|\delta^{c_{x}}_{k}\|_{2}\leq\eta\|y_{k}-y^{\prime}_{k}\|_{2}\leq\eta\rho$,
which combined with (15) returns
$\|z_{k}-z^{\prime}_{k}\|_{2}\leq\sigma_{\max}(|\Gamma|)\gamma\|\delta_{\lambda}\|_{2}+\sigma_{\max}(\Gamma)\eta\rho\leq
e^{-\epsilon}\delta$, where the last inequality holds by (23). So,
$e^{\epsilon}\|z_{k}-z^{\prime}_{k}\|_{2}\leq\delta$, i.e., the guaranteed
privacy is obtained. ∎

###  IV-D $\mathcal{H}_{\infty}$-Optimal Guaranteed Private Observer Synthesis

Finally, combining the results of Theorem 1 and Lemma 1 enables us to find
the gain and perturbation factor that simultaneously stabilize the observer,
satisfy the guaranteed privacy and minimize the $\mathcal{H}_{\infty}$-norm of
the error system.

######  Theorem 2 ($\mathcal{H}_{\infty}$-Optimal Guaranteed Private Observer
Synthesis).

Consider system  $\mathcal{G}$ and suppose all the assumptions in Lemma 1 and
Theorem 1 hold. Let $\rho>0,\epsilon,\delta\geq 0$ and
$(\gamma_{*},\beta_{*},\eta_{*},Q_{*},{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}_{*})$
be a solution to the following MISDP:

$\displaystyle\min\limits_{\\{\gamma>0,\beta>0,\eta>0,Q\in\mathbb{D}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}\times{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}}_{>0},{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}\\}}\gamma$
(25)
$\displaystyle\quad\quad\quad\quad\operatorname{s.t.}\eqref{eq:stability},\eqref{eq:privacy},\
\sigma_{m}(|\Gamma|)\beta\|\delta_{\lambda}\|_{2}+\sigma_{m}(\Gamma)\eta\rho\leq
e^{-\epsilon}\delta.$

Then, the proposed observer (7) with the gain
$L_{*}=(Q_{*})^{-1}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}_{*}$
and the perturbation factor $\alpha_{*}=\frac{\beta_{*}}{\gamma_{*}}$ is
$\mathcal{H}_{\infty}$-optimal in the sense of Definition 4, with the optimal
noise attenuation level $\gamma^{*}$. Moreover, the mechanism $\mathcal{M}$
defined in (13) is $(\epsilon,\delta)$-guaranteed private  w.r.t.
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}}$
given in (6).

###### Proof.

The proof directly follows from Lemma 1, Theorem 1, and defining the new
decision variable $\beta=\gamma\alpha$. ∎

######  Remark 1.

Note that while the MISDP in (25) involves more computational complexity
compared to a typical semi-definite program (SDP), it remains tractable for
solving using off-the-shelf solvers such as CUTSDP. Additionally, it’s
important to note that (25) is solved in an offline manner, i.e., it only
needs to be computed once for any given design. So, its computational demands
are quite minimal in contrast to online design methods. Alternatively, via
imposing supplementary linear constraints, the error dynamics can be upper
bounded by a linear comparison system. Hence, (25) can be relaxed to an SDP
with reduced computational complexity. However, this comes at the cost of
introducing more conservatism and sacrificing optimality.

##  V Accuracy Analysis

As a consequence of introducing perturbations to ensure guaranteed privacy,
the estimates of $x$ and $z$ incur into an accuracy loss. In this section, we
quantify the difference between the interval estimate widths, i.e., the
observer errors, with and without considering guaranteed privacy.

First, it is straightforward to see that in the absence of privacy
considerations, a non-private (NP) $\mathcal{H}_{\infty}$-optimal interval
observer can be designed by implementing (7) without any additional
perturbation noise, i.e, with $\alpha^{\text{NP}}=1$, and with an observer
gain
$L^{\text{NP}}=(Q^{\text{NP}})^{-1}_{*}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}^{\text{NP}}_{*}$,
where
$(Q^{\text{NP}}_{*},{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}^{\text{NP}}_{*},\gamma^{\text{NP}}_{*})$
is a solution to the following MISDP:

$\displaystyle\begin{array}[]{rl}&\min\limits_{\gamma>0,\
Q\in\mathbb{D}^{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}\times{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}}_{>0},{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}}\gamma\\\
&\quad\quad\
\operatorname{s.t.}\,\text{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}
matrix inequality} }\eqref{eq:stability}\text{
{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}
holds}}.\end{array}$ (28)

Then, the corresponding NP state framers are
$\underline{x}^{\text{NP}},\overline{x}^{\text{NP}}$.

On the other hand, and as discussed in  Section IV-D, the proposed observer
(7) outputs the guaranteed-private (GP) state framers
$\underline{x}_{k}=\underline{x}^{\text{GP}}_{k},\overline{x}_{k}=\overline{x}^{\text{GP}}_{k}$,
with $\alpha^{\text{GP}}_{*}=\beta^{\text{GP}}_{*}/\alpha^{\text{GP}}_{*}$ and
$L^{\text{GP}}=(Q^{\text{GP}})^{-1}_{*}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}^{\text{GP}}_{*}$,
where
$(\eta^{\text{GP}}_{*},\beta^{\text{GP}}_{*},Q^{\text{GP}}_{*},{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\widetilde{L}}^{\text{GP}}_{*},\gamma^{\text{GP}}_{*})$
is a solution to (25).

Consequently, for $s\in\\{\text{NP},\text{GP}\\}$, the following intervals

$\displaystyle\begin{array}[]{c}\mathcal{Z}^{s}_{k}=[\underline{z}^{s}_{k},\overline{z}^{s}_{k}],\\\
\underline{z}^{s}_{k}=\Gamma^{\oplus}\underline{x}^{s}_{k}-\Gamma^{\ominus}\overline{x}^{s}_{k},\
\overline{z}^{s}_{k}=\Gamma^{\oplus}\overline{x}^{s}_{k}-\Gamma^{\ominus}\underline{x}^{s}_{k}\end{array}$

are the corresponding non-private (if $s=\text{NP}$) and guaranteed-private
(if $s=\text{GP}$) interval estimates of $z_{k}=\Gamma x_{k}$, respectively.
This being said, we are interested in quantifying an upper bound for the
accuracy error:

$\displaystyle\varepsilon^{p}_{k}\triangleq\|e^{\text{NP}}_{k}-e^{\text{GP}}_{k}\|_{\infty}=\|(\overline{z}^{\text{GP}}_{k}-\underline{z}^{\text{GP}}_{k})-(\overline{z}^{\text{NP}}_{k}-\underline{z}^{\text{NP}}_{k})\|_{\infty},$
(29)

which measures the conservatism incurred by considering guaranteed privacy.
The following lemma formalizes this by providing a closed-from quantification
of the accuracy error and its steady state value.

######  Lemma 2.

Consider  system $\mathcal{G}$ and the proposed guaranteed private
$\mathcal{H}_{\infty}$-optimal observer (7). Suppose all the assumptions in
Theorem 2 hold. Then, the accuracy error $\varepsilon^{p}_{k}$ (cf. (29)) and
its steady state value $\varepsilon^{p}_{\infty}$ can be computed as:

$\displaystyle\begin{array}[]{rl}\varepsilon^{p}_{k}&=\||\Gamma|(\widetilde{\Delta}_{k}e^{x}_{0}+(\frac{I-\widetilde{A}_{\textup{NP}}^{k}}{I-\widetilde{A}_{\textup{NP}}}\widetilde{W}_{\textup{NP}}-\frac{I-\widetilde{A}_{\textup{GP}}^{k}}{I-\tilde{A}_{\textup{GP}}}\widetilde{W}_{\textup{GP}})\delta_{\tilde{w}})\|_{\infty},\\\
\varepsilon^{p}_{\infty}&\triangleq\lim\limits_{k\to\infty}\varepsilon^{p}_{k}=\||\Gamma|(\frac{\widetilde{W}_{\textup{NP}}}{I-\widetilde{A}_{\textup{NP}}}-\frac{\widetilde{W}_{\textup{GP}}}{I-\widetilde{A}_{\textup{GP}}})\delta_{\tilde{w}})\|_{\infty},\end{array}$

where recall that $e^{x}_{0}\triangleq\overline{x}_{0}-\underline{x}_{0}$, and
$\widetilde{\Delta}_{k}\triangleq\widetilde{A}_{\textup{NP}}^{k}-\widetilde{A}_{\textup{NP}}^{k}$,
with $\widetilde{A}_{\textup{s}}\triangleq|A-L^{\textup{s}}C|$, for
${s}\in\\{\rm{NP},\rm{GP}\\}$,
$\widetilde{W}_{\textup{NP}}\triangleq[|W|\quad|L^{\textup{NP}}V|]$,
$\widetilde{W}_{\textup{GP}}\triangleq[|W|\quad\alpha^{\textup{GP}}|L^{\textup{GP}}V|]$
and $\delta_{\tilde{w}}\triangleq[\delta_{w}^{\top}\
\delta_{v}^{\top}]^{\top}$.

###### Proof.

Defining $e^{x,s}_{k}\triangleq\overline{x}^{s}_{k}-\underline{x}^{s}_{k},$
for $s\in\\{\text{NP},\text{GP}\\}$, and computing the error dynamics of the
observer (7) for each of the two NP and GP cases yields:

$\displaystyle
e^{x,s}_{k+1}=\widetilde{A}_{s}e^{x,s}_{k}+\widetilde{W}_{s}\delta_{\tilde{w}},\quad
s\in\\{\text{NP},\text{GP}\\}.$ (30)

Solving (30) using simple induction returns:

$\displaystyle\begin{array}[]{rl}e^{x,s}_{k}&=\widetilde{A}^{k}_{s}e^{x}_{0}+(\sum_{i=1}^{k}\widetilde{A}_{s}^{k-i})\widetilde{W}_{s}\delta_{\tilde{w}}\\\
&=\widetilde{A}^{k}_{s}e^{x}_{0}+(\frac{I-\widetilde{A}^{k}_{s}}{I-\widetilde{A}_{s}})\widetilde{W}_{s}\delta_{\tilde{w}},\quad
s\in\\{\text{NP},\text{GP}\\}.\end{array}$

The closed-form expression for the accuracy error follows from this and the
fact that $e^{s}_{k}\triangleq|\Gamma|e^{x,s}_{k},\forall
s\in\\{\text{NP},\text{GP}\\}$. Finally, $\varepsilon^{p}_{\infty}$ is
computed by taking the limit of $\varepsilon^{p}_{k}$ when time goes to
infinity and given that
$\lim_{k\to\infty}\widetilde{A}^{k}_{s}=\mathbf{0}_{{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}\times{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n}},\forall
s\in\\{\text{NP},\text{GP}\\}$ by the observer stability. ∎

##  VI Illustrative Example

To illustrate the effectiveness of our approach, we consider a slightly
modified version of a dynamic market,  i.e., a Lëontief model, with $N=5$
firms that supply the same product [25, 19], where a linear system models the
production dynamics of each firm, which is affected by its neighbor firms, as
follows:

$\displaystyle
x^{i}_{k+1}=(1-a)x^{i}_{k}+w^{i}_{k}+\frac{a}{|\mathcal{N}_{i}|}\textstyle{\sum}_{j\in\mathcal{N}_{i}}x^{j}_{k},\quad
k\in\mathbb{K}.$

Here, $x^{i}_{k}$ and $\mathcal{N}_{i}$ represent the production output of the
firm $i$ and the set of its neighbors, respectively. Moreover,
$w^{i}_{k}\in[-0.5,0.5]$ is assumed to be an individual firm production
disturbance. Furthermore, similar to [25], we set $a=0.16$,
$\mathcal{N}_{i}=\\{i+1\\},\forall i\in\\{1,\dots,N-1\\}$ and
$\mathcal{N}_{N}=\\{1\\}$aaa In other words, the firm _influence graph_ is a
ring graph where all connected nodes are labeled by consecutive integers..
Each firm $i$, has an uncertain initial production $x^{i}_{0}\in[185,215]$ and
shares a noisy measurement of its highly sensitive production output
$y^{i}_{k}=x^{i}_{k}+v^{i}_{k}$, where $v^{i}_{k}\in[0,1]$.  So, we obtain
global state and measurement equations in the form of (4), with
$\overline{x}_{0}=215\mathbf{1}_{5},\underline{x}_{0}=185\mathbf{1}_{5},\overline{w}_{0}=-\underline{w}_{0}=0.5\mathbf{1}_{5},\overline{v}_{0}=\mathbf{0}_{5},\underline{v}_{0}=\mathbf{1}_{5},V=W=I$,
and

$\displaystyle A=\begin{bmatrix}1-a&a&0&0&0\\\ 0&1-a&a&0&0\\\ 0&0&1-a&a&a\\\
0&0&0&1-a&a\\\ a&0&0&0&1-a\end{bmatrix}.$

Furthermore, $\Gamma=\mathbf{1}^{\top}_{5}$, i.e., there is a data aggregator
planning to release the total production output
$z_{k}=\sum_{i=1}^{5}x^{i}_{k}$ at each time step (day) from the data of the
$N=5$ firms, in a way that the $(\epsilon,\delta)$-guaranteed privacy of the
data is preserved  w.r.t.
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\operatorname{\textstyle{\mathrm{Adj}}}_{\rho}}$,
with $\epsilon=\ln(3),\delta=.1$ and $\rho=1$. By applying Theorem 2 and
solving the MISDP in (25) using the solver CUTSDP  implemented in YALMIP [26],
we obtain the corresponding noise perturbation factor $\alpha_{*}=1.364$,
observer gain  $L_{*}=\begin{bmatrix}l_{1}&l_{2}&l_{0}&l_{0}&l_{0}\\\
l_{0}&l_{1}&l_{2}&l_{0}&l_{0}\\\ l_{0}&l_{0}&l_{1}&l_{2}&l_{2}\\\
l_{0}&l_{0}&l_{0}&l_{1}&l_{2}\\\ l_{2}&l_{0}&l_{0}&l_{0}&l_{1}\end{bmatrix}$
and noise attenuation level $\gamma_{*}=0.865$, where
$l_{0}=-.005,l_{1}=0.425$ and $l_{2}=0.076$. The red plots in Figure 1
indicate the guaranteed private (GP) upper and lower framers (left) and the
estimate interval widths (right)  of $z_{k}$, obtained by observer
$\widetilde{\mathcal{G}}$ with the computed $L_{*}$ and $\alpha_{*}$. As can
be seen, the plotted framers contain the actual state trajectory (the green
plot). Moreover, as expected, the non-private (NP) interval estimates (black
plots) are tighter than the GP ones due to the additional required guaranteed
privacy-preserving constraints (14) and (15), as well as the additional
perturbation noise.

Finally, for the sake of comparison, we implemented a slightly modified
version of the differentially private (DP) interval observer in [19], using
our computed gain ${L}_{*}$, by perturbing the input data $y_{k}$ with
additional stochastic noise as described in [19]. As can be seen in Figure 1,
our proposed GP interval estimates (red) outperforms the DP ones (blue).

Figure 1: Left: actual value of $z_{k}$ (green), as well as its upper and
lower framers obtained by applying a non-private (NP) interval observer
(black), a guaranteed private (GP) interval observer (red), and a
differentially private (DP) interval observer (blue). Right: comparison of the
no-private (NP), the guaranteed private (GP) and differentially private
(DP)[19] interval estimate widths (errors).

##  VII Conclusion and  Future Work

A novel generalization of guaranteed privacy was proposed in this paper,
affording a deterministic portrayal of privacy. In contrast to stochastic
differential privacy, guaranteed privacy was found to impose precise
constraints on the proximity between the ranges of two sets of estimated data.
To do so, an interval observer was designed  for bounded-error LTI systems,
incorporating  a bounded noise perturbation factor and an observer gain.  The
observer simultaneously  outputted guaranteed private and stable interval-
valued estimates for the desired variable. The optimality of the design was
demonstrated, and the accuracy of the mechanism was assessed by quantifying
the loss incurred when considering guaranteed privacy specifications. Future
work will consider nonlinear systems and combination of privacy and attack
resilience.

## References

  * [1] J. Cortés, G.E. Dullerud, S. Han, J. Le Ny, S. Mitra, and G.J. Pappas.  Differential privacy in control and network systems.  In 2016 IEEE 55th Conference on Decision and Control (CDC), pages 4252–4272.
  * [2] L. Sankar, W. Trappe, K. Ramchandran, H.V. Poor, and M. Debbah.  The role of signal processing in meeting privacy challenges: An overview.  IEEE Signal Processing Magazine, 30(5):95–106, 2013.
  * [3] C. Dwork, F. McSherry, K. Nissim, and A. Smith.  Calibrating noise to sensitivity in private data analysis.  In Theory of cryptography conference, pages 265–284. Springer, 2006\.
  * [4] K. Chaudhuri, C. Monteleoni, and A.D. Sarwate.  Differentially private empirical risk minimization.  Journal of Machine Learning Research, 12(3), 2011.
  * [5] J. Zhang, Z. Zhang, X. Xiao, Y. Yang, and M. Winslett.  Functional mechanism: regression analysis under differential privacy.  Proceedings of the VLDB Endowment, 5(11), 2012.
  * [6] R. Hall, A. Rinaldo, and L. Wasserman.  Differential privacy for functions and functional data.  The Journal of Machine Learning Research, 14(1):703–727, 2013.
  * [7] Y. Wang, Z. Huang, S. Mitra, and G.E. Dullerud.  Differential privacy in linear distributed control systems: Entropy minimizing mechanisms and performance tradeoffs.  IEEE Transactions on Control of Network Systems, 4(1):118–130, 2017\.
  * [8] Y. Han and S. Martínez.  A numerical verification framework for differential privacy in estimation.  IEEE Control Systems Letters, 6:1712–1717, 2021.
  * [9] Z. Huang, S. Mitra, and N. Vaidya.  Differentially private distributed optimization.  In Proceedings of the 2015 international conference on distributed computing and networking, pages 1–10, 2015.
  * [10] S. Han, U. Topcu, and G.J. Pappas.  Differentially private distributed constrained optimization.  IEEE Transactions on Automatic Control, 62(1):50–64, 2016.
  * [11] M.T. Hale and M. Egerstedty.  Differentially private cloud-based multi-agent optimization with constraints.  In 2015 American Control Conference (ACC), pages 1235–1240. IEEE, 2015.
  * [12] T. Ding, S. Zhu, J. He, C. Chen, and X. Guan.  Differentially private distributed optimization via state and direction perturbation in multiagent systems.  IEEE Transactions on Automatic Control, 67(2):722–737, 2021.
  * [13] Q. Li, R. Heusdens, and M.G. Christensen.  Privacy-preserving distributed optimization via subspace perturbation: A general framework.  IEEE Transactions on Signal Processing, 68:5983–5996, 2020.
  * [14] M. Ye, G. Hu, L. Xie, and S. Xu.  Differentially private distributed Nash equilibrium seeking for aggregative games.  IEEE Transactions on Automatic Control, 67(5):2451–2458, 2021.
  * [15] J. Le Ny and G.J. Pappas.  Differentially private filtering.  IEEE Transactions on Automatic Control, 59(2):341–354, 2013.
  * [16] J. Le Ny.  Differentially private nonlinear observer design using contraction analysis.  International Journal of Robust and Nonlinear Control, 30(11):4225–4243, 2020.
  * [17] G. Zheng, D. Efimov, and W. Perruquetti.  Design of interval observer for a class of uncertain unobservable nonlinear systems.  Automatica, 63:167–174, 2016.
  * [18] M. Khajenejad and S.Z. Yong.  $\mathcal{H}_{\infty}$-optimal interval observer synthesis for uncertain nonlinear dynamical systems via mixed-monotone decompositions.  IEEE Control Systems Letters, 6:3008–3013, 2022.
  * [19] K.H. Degue and J. Le Ny.  Differentially private interval observer design with bounded input perturbation.  In 2020 American Control Conference (ACC), pages 1465–1470. IEEE, 2020.
  * [20] D. Efimov, T. Raïssi, S. Chebotarev, and A. Zolghadri.  Interval state observer for nonlinear time varying systems.  Automatica, 49(1):200–205, 2013.
  * [21] L. Sweeney.  Achieving k-anonymity privacy protection using generalization and suppression.  International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(05):571–588, 2002.
  * [22] M. Khajenejad and S. Martínez.  Guaranteed privacy of distributed nonconvex optimization via mixed-monotone functional perturbations.  IEEE Control Systems Letters, 7:1081–1086, 2022.
  * [23] E. Nozari, P. Tallapragada, and J. Cortés.  Differentially private distributed convex optimization via functional perturbation.  IEEE Transactions on Control of Network Systems, 5(1):395–408, 2016\.
  * [24] M.C. De Oliveira, J.C. Geromel, and J. Bernussou.  Extended $\mathcal{H}_{2}$ and $\mathcal{H}_{\infty}$ norm characterizations and controller parameterizations for discrete-time systems.  International journal of control, 75(9):666–679, 2002.
  * [25] Q. Zhang and J.F. Zhang.  Adaptive tracking games for coupled stochastic linear multi-agent systems: stability, optimality and robustness.  IEEE Transactions on Automatic Control, 58(11):2862–2877, 2013\.
  * [26] J. Löfberg.  YALMIP : A toolbox for modeling and optimization in MATLAB.  In 2004 IEEE International Symposium on Computer-Aided Control, Taipei, Taiwan.


# Reconfigurable Intelligent Surface for Industrial Automation: mmWave
Propagation Measurement, Simulation, and Control Algorithm Requirements

Hamed Radpour∗, Markus Hofer∗, David Löschenbrand∗, Lukas Walter Mayer†,
Andreas Hofmann†,
Martin Schiefer† and Thomas Zemen∗
∗AIT Austrian Institute of Technology, Vienna, Austria
†Siemens Aktiengesellschaft Oesterreich, Vienna, Austria
Email<EMAIL_ADDRESS>
###### Abstract

Reconfigurable intelligent surfaces (RISs) can provide a reliable and low-
latency millimeter wave (mmWave) communication link in cases of a blocked
line-of-sight (LoS) between the base station (BS) and the user equipment (UE).
In such cases, the RIS mounted on a wall or ceiling can act as a bypass for
the radio communication link. We present an active RIS with 127 patch antenna
elements arranged in a hexagonal grid. The RIS operates at a center frequency
of 23.8 GHz and each RIS element uses an orthogonal polarization
transformation to enable amplification using a field-effect transistor (FET).
The source and drain voltages of each FET are controlled using two bits. We
consider that the RIS control unit is aware of the UE coordinates within the
measurement area, relevant to the industrial control scenarios. We measure the
received power on a 2D grid of 60 cm$\times$90 cm using an $xy$-positioning
table, with the RIS working in reflective and active mode. The results
demonstrate the ability of the RIS to effectively focus the radio signal on
the desired target points. We characterize the half-power beam width in
azimuth and radial directions with respect to the RIS position, enabling us to
obtain a practical RIS configuration update criterion for a mobile UE. These
results clearly show that RISs are prominent solutions for enabling reliable
wireless communication in indoor industrial scenarios.

###### Index Terms:

Reconfigurable Intelligent Surface (RIS), 6G, mmWave, active RIS, wireless
channel measurement

3GPP

    3rd Generation Partnership Project
ACF

    auto correlation function
ADC

    analog-to-digital converter
BEM

    basis-expansion model
CDF

    cumulative distribution function
CE

    complex exponential
CIR

    channel impulse response
CP

    cyclic prefix
CTF

    channel transfer function
D2D

    device-to-device
DAC

    digital-to-analog converter
DC

    direct current
DOD

    direction of departure
DOA

    direction of arrival
DPS

    discrete prolate spheroidal
DPSWF

    discrete prolate spheroidal wave function
DSD

    Doppler spectral density
DSP

    digital signal processor
DR

    dynamic range
ETSI

    European Telecommunications Standards Institute
FIFO

    first-input first-output
FFT

    fast Fourier transform
FP

    fixed-point
FPGA

    field programmable gate array
GSCM

    geometry-based stochastic channel model
GSM

    global system for mobile communications
GPS

    global positioning system
HPBW

    half power beam width
ICI

    inter-carrier interference
IDFT

    inverse discrete Fourier transform
IF

    intermediate frequency
IFFT

    inverse fast Fourier transform
ISI

    inter-symbol interference
ITS

    intelligent transportation system
MEC

    mobile edge computing
MSE

    mean square error
LLR

    log-likelihood ratio
LO

    local oscillator
LOS

    line-of-sight
LMMSE

    linear minimum mean squared error
LNA

    low noise amplifier
LSF

    local scattering function
LTE

    long term evolution
LUT

    look-up table
LTV

    linear time-variant
MIMO

    multiple-input multiple-output
MPC

    multi-path component
MC

    Monte Carlo
NI

    National Instruments
LoS

    line-of-sight
NLOS

    non-line of sight
OFDM

    orthogonal frequency division multiplexing
OTA

    over-the-air
PA

    power amplifier
PC

    personal computer
PDP

    power delay profile
PER

    packet error rate
PPS

    pulse per second
QAM

    quadrature ampltiude modulation
QPSK

    quadrature phase shift keying
RB

    resource block
RBP

    resource block pair
RIS

    reflective intelligent surface
RF

    radio frequency
RMS

    root mean square
RSSI

    receive signal strength indicator
RT

    ray tracing
RX

    receiver
SCME

    spatial channel model extended
SDR

    software defined radio
SISO

    single-input single-output
SoCE

    sum of complex exponentials
SNR

    signal-to-noise ratio
SUT

    system-under test
SSD

    soft sphere decoder
TBWP

    time-bandwidth product
TDL

    tap delay line
TX

    transmitter
UMTS

    universal mobile telecommunications systems
UDP

    user datagram protocol
URLLC

    ultra-reliable and low latency communication
US

    uncorrelated-scattering
USRP

    universal software radio peripheral
VNA

    vector network analyzer
ViL

    vehicle-in-the-loop
V2I

    vehicle-to-infrastructure
V2V

    vehicle-to-vehicle
V2X

    vehicle-to-everything
VST

    vector signal transceiver
VTD

    Virtual Test Drive
WF

    Wiener filter
WSS

    wide-sense-stationary
WSSUS

    wide-sense-stationary uncorrelated-scattering

##  I Introduction

In this paper, we are specifically interested in using a reconfigurable
intelligent surface (RIS) in an indoor automation and control scenario with
high-reliability and low-latency requirements for a mmWave communication link.
The RIS shall provide a bypass for the radio signal in case the line-of-sight
(LoS) is blocked between the base station (BS) and the user equipment (UE).

The authors of [1, 2] show that an active RIS outperforms a passive RIS under
the same power budget. Hence, active RIS elements can either increase the
signal-to-noise ratio (SNR) at the UE when the number of RIS elements is kept
constant, or the number of RIS elements can be reduced for a constant SNR
target, helping to reduce the cost and size of the RIS. Moreover, a RIS with a
smaller number of elements can quickly update its element configuration to
track a mobile UE. This feature is particularly advantageous for time-
sensitive automation and control applications, which are the main focus of
this research paper.

In [2] an active RIS for the mmWave frequency band is presented using a
polarization transformation to enhance the isolation between incoming and
reflected waves. Numerical simulations and measurements for the received power
show a good match for the radiation pattern in an anechoic chamber. However,
validation and testing of RISs in indoor non-LoS (NLoS) scenarios with mobile
user equipment (UE) is necessary for industrial automation to ensure a
reliable link between the base station (BS) and UE.

The authors of [3] investigate a RIS-assisted indoor scenario with moving
robots. For this work, they assumed to have either a large number of small
RISs or a small number of large RISs. In [4], a mobile target tracking
scenario is considered by estimating motion parameters. However, these two
studies are theoretical and need to be verified with measurements in practical
environments. The authors in [5] studied a RIS grouping approach using an
iterative algorithm and performed measurement for sub-6 GHz.

### Scientific Contributions

  * •

We present an enhanced version of the RIS described in [2] containing $127$
patch antenna elements for the mmWave band with optimized reflection
coefficients. We evaluate the ability of the RIS to focus the radio signal on
the mobile UE location, analyzing a 2D measurement area of 60 cm$\times$90 cm
using a $xy$-positioning table. We compare the measurement results with a
numerical simulation, achieving an excellent qualitative and quantitative
match.

  * •

The obtained received power pattern reveals how often we need to update the
RIS configuration to maintain the received power at the mobile UE location
above a certain threshold. We compare the results of the RIS in active and
reflective mode.

  * •

Results show that the proposed RIS can effectively focus the radio signal on a
mobile UE in a NLoS scenario.

##  II RIS System Model

For our system model, we consider that there is no direct link between BS and
UE and there is a line-of-sight (LoS) channel for the BS-RIS and the RIS-UE
link. The BS is located at ${\mathchoice{\mbox{\boldmath$\displaystyle
a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle
a$}}{\mbox{\boldmath$\scriptscriptstyle
a$}}}=(a_{\text{x}},a_{\text{y}},a_{\text{z}})$ in Cartesian coordinates. We
also use spherical coordinates
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle
a$}}{\mbox{\boldmath$\scriptscriptstyle a$}}}}=(a_{r},a_{\varphi},a_{\theta})$
depending on the context. We measure azimuth $a_{\varphi}$ between the x-axis
and the projection of the vector
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle
a$}}{\mbox{\boldmath$\scriptscriptstyle a$}}}}$ onto the $xy$-plane and
elevation $a_{\theta}$ between the projection in the $xy$-plane and the vector
itself; see Fig. 1.

Figure 1: RIS coordinate system for a hexagonal RIS element placement in the
$yz$-plane. The BS horn antenna radiates from position $\textstyle a$ towards
the center of the RIS at ${\mathchoice{\mbox{\boldmath$\displaystyle
0$}}{\mbox{\boldmath$\textstyle 0$}}{\mbox{\boldmath$\scriptstyle
0$}}{\mbox{\boldmath$\scriptscriptstyle 0$}}}=(0,0,0)$ over a distance of
$|{\mathchoice{\mbox{\boldmath$\displaystyle a$}}{\mbox{\boldmath$\textstyle
a$}}{\mbox{\boldmath$\scriptstyle a$}}{\mbox{\boldmath$\scriptscriptstyle
a$}}}|$. The UE monopole antenna at position $\textstyle b$ is within a
distance of $|{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}|$ moving on a $xy$-positioning
table. The LoS is blocked between the BS and the UE. The picture is not to
scale to improve clarity.

The UE is located at $\textstyle b$ and the $M$ RIS element center points at
${\mathchoice{\mbox{\boldmath$\displaystyle u$}}{\mbox{\boldmath$\textstyle
u$}}{\mbox{\boldmath$\scriptstyle u$}}{\mbox{\boldmath$\scriptscriptstyle
u$}}}_{m}$ with $m\in\\{1,\ldots,M\\}$. The received power at the UE position
is given as

$P_{\text{UE}}={P_{\text{BS}}\frac{G_{\text{BS}}G_{\text{UE}}(d_{\text{y}}d_{\text{z}})^{2}}{16\pi^{2}}}\\\
\times\left|\sum_{m=1}^{M}\Gamma_{m}{\frac{\sqrt{F_{m}^{\text{c}}}e^{-j2\pi(|{\mathchoice{\mbox{\boldmath$\displaystyle
a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle
a$}}{\mbox{\boldmath$\scriptscriptstyle
a$}}}-{\mathchoice{\mbox{\boldmath$\displaystyle
u$}}{\mbox{\boldmath$\textstyle u$}}{\mbox{\boldmath$\scriptstyle
u$}}{\mbox{\boldmath$\scriptscriptstyle
u$}}}_{m}|+|{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}-{\mathchoice{\mbox{\boldmath$\displaystyle
u$}}{\mbox{\boldmath$\textstyle u$}}{\mbox{\boldmath$\scriptstyle
u$}}{\mbox{\boldmath$\scriptscriptstyle
u$}}}_{m}|)/\lambda}}{|{\mathchoice{\mbox{\boldmath$\displaystyle
a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle
a$}}{\mbox{\boldmath$\scriptscriptstyle
a$}}}-{\mathchoice{\mbox{\boldmath$\displaystyle
u$}}{\mbox{\boldmath$\textstyle u$}}{\mbox{\boldmath$\scriptstyle
u$}}{\mbox{\boldmath$\scriptscriptstyle
u$}}}_{m}||{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}-{\mathchoice{\mbox{\boldmath$\displaystyle
u$}}{\mbox{\boldmath$\textstyle u$}}{\mbox{\boldmath$\scriptstyle
u$}}{\mbox{\boldmath$\scriptscriptstyle u$}}}_{m}|}}\right|^{{}^{2}}.$ (1)

where $P_{\text{BS}}$, $G_{\text{BS}}$, $G_{\text{UE}}$, $d_{\text{y}}$, and
$d_{\text{z}}$ are the transmit power of the BS, the BS and UE antenna gain as
well as the effective RIS element dimension in $y$ and $z$ direction,
respectively [6, 7, 2]. The complex reflection coefficient of each RIS element
$m$ is denoted by $\Gamma_{m}$. The wavelength $\lambda=c_{0}/f$, where $f$
denotes the center frequency and $c_{0}$ the speed of light. The combined
antenna pattern of the BS antenna, the RIS element $m$ for receive and
transmit operation, as well as the UE antenna is described by
$F^{\text{c}}_{m}$, please see [2, (2)] for details.

##  III RIS Design

The RIS PCB, depicted in Fig. 2, has been improved compared to the version
presented in [2] where 37 elements were used. In the current version, the RIS
consists of $M=127$ elements arranged in five hexagonal rings with an
additional element positioned at the center. The RIS operates at a center
frequency of 23.8 GHz. Table I provides a summary of the RIS parameters and
the measurement setup. The origin of the coordinate system is considered to be
the RIS center.

Figure 2: Closeup of the RIS printed circuit board with 127 RIS elements. TABLE I: Active RIS Parameters and Measurement Setup. Parameter | Definition
---|---
$f=23.8$ GHz | center frequency
$M=127$ | number of RIS elements
$d_{z}$, $d_{y}=6.6$ mm | effective RIS element size
$d=8.7$ mm | smallest RIS element distance
$P_{\text{BS}}=10$ dBm | BS transmit power
$G_{\text{BS}}=19$ dB | BS horn antenna gain
$G_{\text{UE}}=3.2$ dB | UE vert. pol. monopole antenna gain
$|{\mathchoice{\mbox{\boldmath$\displaystyle a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle a$}}{\mbox{\boldmath$\scriptscriptstyle a$}}}|=1.86$ m, $|{\mathchoice{\mbox{\boldmath$\displaystyle b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}|=1.4$ m | distance RIS-BS and RIS-UE
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle a$}}{\mbox{\boldmath$\scriptscriptstyle a$}}}}=(1.86\,\text{m},-36^{\circ},0^{\circ})$ | BS location
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}}_{P_{1}}=(1.4\,\text{m},40^{\circ},-16^{\circ})$ | UE location at point $P_{1}$
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}}_{P_{2}}=(1.4\,\text{m},10^{\circ},-16^{\circ})$ | UE location at point $P_{2}$

The matching network in [2, Fig. 4] has been modified such, that we can use
the following reflection coefficient alphabet for the reflective mode

$\mathcal{A}_{\text{R}}=\\{(0.3,\angle-15^{\circ}),(0.3,\angle
165^{\circ})\\}.$

Hence, the phase difference between both states is now $180^{\circ}$, allowing
to cancel the specular reflection, cf. [2, Sec. III]. In active mode the RIS
hardware achieves

$\mathcal{A}_{\text{A}}=\\{(1.25,\angle 0^{\circ}),(0,\angle 0^{\circ})\\}.$

Hence, in active mode the reflected signal of an element is $1.25/0.3\simeq
4.2\simeq 6.2\,\text{dB}$ stronger than in reflective mode.

The reflection coefficients for each of the RIS elements are chosen to
maximize the power at a desired UE position through a coherent superposition
of all RIS elements contribution, cf. [2, Algorithm 1].

##  IV RIS Power Pattern Evaluation

To evaluate the performance of the RIS in an industrial scenario, we evaluate
the received power pattern $P_{\text{UE}}$, with an $xy$-positioning table
measuring the received power
$P_{\text{UE}}(\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}})$. We configure the RIS
elements to maintain the received signal power at defined coordinates
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}\in\left\\{\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}_{P_{1}},\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}}_{P_{2}}\right\\}$. A schematic
representation of the measurement setup is shown in Fig. 3.

Figure 3: RIS testbed top view

The transmitter (TX) horn antenna, mounted on a tripod is pointing to the
center of the RIS that focuses the signal on the desired UE position. For this
measurement setup, the UE is a vertically polarized omnidirectional antenna,
that is mounted on the $xy$-positioning table and can move to defined
positions. An absorber blocks the direct LoS between TX and RX, simulating a
NLoS industrial scenario. A picture of the actual measurement setup in the
laboratory is shown in Fig. 4.

(a) RIS measurement testbed with LoS blockage.

(b) RIS Measurement testbed without blockage.

Figure 4: Measurement testbed with (a) and without (b) the LoS blockage
object.

While the TX location is fixed, the UE is moving on the $xy$-positioning table
with the sampling steps of 2 cm in the measurement area of $0.92\leq x\leq
1.52$ m and $0.02\leq y\leq 0.92$ m. This means that we have 1380 sampling
points in the measurement area. For the numerical simulation with (1), we
modeled the schematic measurement setup and calculated the received power at
the same positions as the measurement.

We consider two target points $P_{1}$ and $P_{2}$, with coordinates
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}_{P_{1}}=(1.4\,\text{m},40^{\circ},-16^{\circ})$ and
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}_{P_{2}}=(1.4\,\text{m},10^{\circ},-16^{\circ})$, respectively. We chose
the points $P_{1}$ and $P_{2}$ such that they have the same distance from the
RIS and the only difference is their azimuth angle. This is because we want to
know often we need to reconfigure the RIS to maintain $P_{\text{UE}}$ above a
desired minimum power threshold. In Section V we will present and compare the
simulation and measurement results for the RIS, focusing the signal on the
points $P_{1}$ and $P_{2}$. Furthermore, we show the results for the RIS
working in reflective and active mode.

###  IV-A Numerical Power Pattern Simulation

We simulate the power pattern at a given coordinate $\textstyle b$ using the
formula in (1). We obtain the configuration of the RIS elements using the
optimization algorithm presented in [2, Algorithm 1]. For the simulation, we
evaluate the receive power with a resolution of 2 cm in $x$ and $y$
directions.

###  IV-B Empirical Power Pattern Measurement

We perform a measurement of the impulse response (IR) $h_{x,y}[n]$ vs. $x$ and
$y$ coordinates on the $xy$-table. We perform the measurement such that the
mobile UE moves from one point to the next adjacent point in the
$y$-direction. Then we insert a pause time of $\Delta t=200\,\text{msec}$ to
let the possible UE vibrations fade away after the movement. Next, we perform
$Q$ repetitive measurements to record the channel sounder data. Then we take
the average of the recorded IRs and calculate the received power as

$P_{\text{UE}}(x,y)=\frac{P_{\text{BS}}}{Q}\left|\sum_{n=n_{1}}^{n_{2}}\sum_{q=1}^{Q}h_{x,y}^{q}[n]\right|^{2}.$
(2)

to obtain the RIS power pattern, we set $Q=50$ from which we calculate the
average of the 50 recorded measurements, $n_{1}$ and $n_{2}$ define the
support of the impulse response above the noise floor to suppress measurement
noise as much as possible. The impulse response measurements in this paper
have a support in the interval $n_{1}\leq n\leq n_{2}$ with $n_{1}=7$ and
$n_{2}=13$.

##  V Simulation and Measurement Result Analysis

Initially, we carefully calibrated the RIS orientation in 3D space such that
the RIS surface norm in the center matches the $x$-axis in a positive
direction. This is important to achieve a good alignment of the received power
pattern between measurement and numerical simulation. Then we performed the
experiment in four steps:

###  V-A Validating non-Line-of-Sight Scenario

To evaluate the received power at the UE without RIS in a NLoS scenario, we
physically removed the RIS from the testbed shown in Fig. 4a. In Fig. 5a we
observe that the received power at most $(x,y)$ positions is as low as
$P_{\text{UE}}^{\text{meas}}=-100\,$dBm. This is because the absorber blocks
the majority of the transmitted power. Hence, we will use a RIS to circumvent
the blocking obstacle and obtain a higher received power. The measurement
noise power is well inline with the theoretical value

$P_{\text{UE}}^{\text{meas}}=-100\,\text{dBm}\approx 10\log
10\left(\frac{kTB}{1\text{mW}\cdot Q}\right)+N_{\text{F}}$ (3)

with the Boltzmann constant $k=1.38\cdot
10^{-23}\frac{\text{m}^{2}\text{kg}}{\text{s}^{2}\text{K}}$, temperature
$T=293\,\text{K}$, bandwidth $B=155\,$MHz and a combined noise figure of the
TX and RX amplifier of $N_{\text{F}}=9\,$dB.

(a) Measurement result with the RIS removed from the measurement setup.

(b) Measurement result with the RIS switched off.

Figure 5: Received power $P_{\text{UE}}(x,y)$ over measurement area of
$xy$-positioning table. We illustrate the empirical measurement data for (a)
without RIS and (b) RIS switched off

###  V-B Validating Limited Reflection of RIS when Switched Off

In order to assess the effect of the RIS while it is switched off, we mounted
the RIS but turned off its power supply. Figure 5b shows that due to the
structural reflectivity of the RIS elements, we get a small amount of received
power within the measurement area. According to Fig. 5b, the maximum received
power is $P_{\text{UE}}^{\text{meas}}=-80\,$dBm around the position of the
specular reflection.

###  V-C RIS Operating in Reflective Mode

In reflective mode, the RIS elements are set to have a phase shift of either
$-15^{\circ}$ or $+165^{\circ}$. This ability to have a phase shift difference
of $180^{\circ}$ improves the RIS performance in the reflective mode compared
to the results in [2], allowing to suppress the specular reflection. In Figs.
6a and 6b both the simulation and the measurement result show that the RIS can
focus the radio signal on point $P_{1}$ and the received power for simulation
and measurement are $P_{\text{UE}}^{\text{sim}}=-57\,$dBm and
$P_{\text{UE}}^{\text{meas}}=-60\,$dBm, respectively. In Figs. 6c and 6d the
RIS is focusing the radio signal on the target point $P_{2}$. The mobile UE in
simulation and measurement has a receive power of
$P_{\text{UE}}^{\text{sim}}=-56\,$dBm and
$P_{\text{UE}}^{\text{meas}}=-57\,$dBm, respectively. These results show that
the reflective RIS can provide an SNR of more than 40 dB at the intended
target point. The comparison between the simulation and measurement results
illustrates not only a high quantitative match but also the power levels of
the simulation and measurement match with high accuracy.

(a) Sim. result for reflective RIS, focusing signal on point $P_{1}$.

(b) Meas. result for reflective RIS, focusing signal on point $P_{1}$.

(c) Sim. result for reflective RIS, focusing signal on point $P_{2}$.

(d) Meas. result for reflective RIS, focusing signal on point $P_{2}$.

Figure 6: Received power $P_{\text{UE}}(x,y)$ over measurement area of
$xy$-positioning table. We compare the numerical simulation results with
empirical measurement data for the RIS in reflective mode. The BS is located
at $\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle
a$}}{\mbox{\boldmath$\scriptscriptstyle
a$}}}}=(1.86\,\text{m},-36^{\circ},0^{\circ})$ and the signal shall be focused
on the UE positions $\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}_{P_{1}}=(1.4\,\text{m},40^{\circ},-16^{\circ})$ and
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}_{P_{2}}=(1.4\,\text{m},10^{\circ},-16^{\circ})$.

###  V-D RIS Operating in Active Mode

In active mode, the RIS elements are either turned off or they amplify the
received signal with a gain of 1.25. Figures 7a and 7b show the power patterns
of the RIS working in active mode while focusing the radio signal on the
target point $P_{1}$. The power level at the mobile UE in simulation and
measurement is $P_{\text{UE}}^{\text{sim}}=-52\,$dBm and
$P_{\text{UE}}^{\text{meas}}=-56\,$dBm, respectively. Finally, Figs. 7c and 7d
show the results while the RIS is focusing the radio signal on point $P_{2}$
with a received power of $P_{\text{UE}}^{\text{sim}}=-52\,$dBm and
$P_{\text{UE}}^{\text{meas}}=-53\,$dBm in simulation and measurement,
respectively. Therefore, using an active RIS in this NLoS scenario provides an
SNR level of at least 44 dB at the desired point. Finally, a comparison
between the received power levels in the reflective and active results
indicates that the active RIS outperforms the reflective RIS by a gain of at
least 4 dB.

(a) Sim. result for active RIS, focusing radio signal on point $P_{1}$.

(b) Meas. result for active RIS, focusing radio signal on point $P_{1}$.

(c) Sim. result for active RIS, focusing radio signal on point $P_{2}$.

(d) Meas. result for active RIS, focusing radio signal on point $P_{2}$.

Figure 7: Received power $P_{\text{UE}}(x,y)$ over measurement area of
$xy$-positioning table. We compare the numerical simulation results and
empirical measurement data for the RIS in active mode. The BS is located at
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle
a$}}{\mbox{\boldmath$\scriptscriptstyle
a$}}}}=(1.86\,\text{m},-36^{\circ},0^{\circ})$ and the signal is focused on
the UE position $\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}_{P_{1}}=(1.4\,\text{m},40^{\circ},-16^{\circ})$ and
$\tilde{{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle
b$}}}}_{P_{2}}=(1.4\,\text{m},10^{\circ},-16^{\circ})$.

##  VI Update Requirement for RIS Configuration in Industrial Automation and
Control Scenario

For a RIS-assisted wireless communication system with a mobile UE in an
industrial environment, we need to know how often the RIS needs to be
reconfigured. This is crucial for the mobile UE to maintain received power
above a certain threshold. We calculate the coverage for a mobile UE, moving
radially (motion along the RIS) or moving in azimuth direction (motion by
changing azimuth angle but keeping the same distance from the RIS); please see
Fig. 3 for more details. Here, we set the threshold to be the half power
beamwidth (HPBW) and calculate the RIS focusing area as

$\rho^{r}=\frac{1}{2}\left(\frac{h_{\textup{RIS}}-h_{\textup{UE}}}{\tan(\theta_{\textup{UE}}-\beta/2)}-\frac{h_{\textup{RIS}}-h_{\textup{UE}}}{\tan(\theta_{\textup{UE}}+\beta/2)}\right)$
(4) $\rho^{a}=|{\mathchoice{\mbox{\boldmath$\displaystyle
b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle
b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}|\tan(\alpha/2)$ (5)

where $\rho^{\text{a}}$ and $\rho^{\text{r}}$ are corresponding to the azimuth
and radial motion and define the minor and major axis of an ellipse that
specifies the RIS HPBW focusing area on the $xy$-positioning table,
$h_{\textup{RIS}}$ and $h_{\textup{UE}}$ are the RIS and UE heights,
$\theta_{\textup{UE}}$ is the UE elevation angle, and $\beta$ and $\alpha$ are
the vertical and horizontal HPBW angles, respectfully, (please see Fig.3).

Considering the RIS center as the origin of the coordinate system, for our
setup we have
$(h_{\textup{RIS}},h_{\textup{UE}})=(0\,\textup{cm},-39\,\textup{cm})$ and
$\theta_{\textup{UE}}=-16^{\circ}$. Applying (4) and (5) to the results shows
that $(\alpha,\beta)\simeq(8^{\circ},7^{\circ})$ and the dimension of the
focus area in the radial and azimuth directions are $\rho^{\text{a}}\simeq
9\,\textup{cm}$ and $\rho^{\text{r}}\simeq 40\,\textup{cm}$, i.e., the size of
the focusing area is smaller in the azimuth direction than in the radial
direction. Therefore, for a mobile UE that moves in the azimuth direction, the
RIS requires more configuration updates than for radial motion. It is
important to mention that the HPBW angles are variable and depend on the RIS
configuration. For a mobile robot located at point $P_{2}$ moving in an
azimuth direction with a speed of $v=1\,\textup{m/sec}$ towards the point
$P_{1}$, we need to update the RIS setting every
$\rho^{\text{a}}/v=90\,\textup{msec}$ to be in the RIS focus area. However, if
the robot moves with the same speed towards the point $P_{3}$, we need to
update the RIS setting every $\rho^{\text{r}}/v=400\,\textup{msec}$.

##  VII Conclusion

We tested the capability of a RIS proof-of-concept (PoC) that allows
establishing a reliable link in mmWave frequencies for a mobile UE in an
indoor NLoS scenario. We measured the received power for a mobile UE moving on
an $xy$-positioning table. We evaluated the received power at the UE for the
RIS working in reflective or active mode. We have analyzed the control
algorithm requirements for the RIS to serve a mobile UE in a NLoS industrial
environment, ensuring that the received power at the UE location exceeded a
specified threshold. Our analysis of the received power pattern, based on both
simulations and measurements, revealed that the RIS update rate must be four
times higher for a mobile UE moving in the azimuth direction compared to
radial movement. The results from both simulations and measurements
demonstrated that RIS effectively focused the radio signal on the desired
targets and that the active RIS provides 4 dB higher received power compared
to the optimized reflective RIS.

## Acknowledgment

This work is funded through the Vienna Business Agency in the project RISING
and by the Principal Scientist grant at the AIT Austrian Institute of
Technology within the project DEDICATE.

## References

  * [1] K. Zhi, C. Pan, H. Ren, K. K. Chai, and M. Elkashlan, “Active RIS versus passive RIS: Which is superior with the same power budget?” _IEEE Communications Letters_ , vol. 26, no. 5, pp. 1150–1154, 2022.
  * [2] H. Radpour, M. Hofer, L. W. Mayer, A. Hofmann, M. Schiefer, and T. Zemen, “Active reconfigurable intelligent surfaces for the millimeter-wave frequency band: System design and measurement,” _WCNC 2024, to be presented, April 2024_ , Available online: https://doi.org/10.48550/arXiv.2306.04515.
  * [3] Z. Liu, Y. Liu, and X. Chu, “Reconfigurable-intelligent-surface-assisted indoor millimeter-wave communications for mobile robots,” _IEEE Internet of Things Journal_ , vol. 11, no. 1, pp. 1548–1557, 2024.
  * [4] M. Bian, Y. Shi, and X.-L. Huang, “Reconfigurable intelligent surface assisted mobile target tracking with agile phase control,” _IEEE Transactions on Vehicular Technology_ , pp. 1–14, 2023.
  * [5] S. Kayraklık, I. Yildirim, Y. Gevez, E. Basar, and A. Görçin, “Indoor coverage enhancement for ris-assisted communication systems: Practical measurements and efficient grouping,” in _ICC 2023 - IEEE International Conference on Communications_ , 2023, pp. 485–490.
  * [6] W. Tang, M. Z. Chen, X. Chen, J. Y. Dai, Y. Han, M. Di Renzo, Y. Zeng, S. Jin, Q. Cheng, and T. J. Cui, “Wireless communications with reconfigurable intelligent surface: Path loss modeling and experimental measurement,” _IEEE Transactions on Wireless Communications_ , vol. 20, no. 1, pp. 421–439, 2021.
  * [7] W. Tang, X. Chen, M. Z. Chen, J. Y. Dai, Y. Han, M. D. Renzo, S. Jin, Q. Cheng, and T. J. Cui, “Path loss modeling and measurements for reconfigurable intelligent surfaces in the millimeter-wave frequency band,” _IEEE Transactions on Communications_ , vol. 70, no. 9, pp. 6259–6276, 2022.