Resilient Consensus of Second-Order Agent Networks: Asynchronous Update Rules with Delays

TL;DR

This paper develops algorithms for resilient consensus in multi-agent networks with second-order dynamics, accounting for delays and malicious agents, ensuring robustness under various asynchronous update scenarios.

Contribution

It introduces resilient consensus algorithms that tolerate malicious agents and delays, with new topological conditions based on graph robustness for asynchronous updates.

Findings

Algorithms achieve consensus despite malicious agents and delays.

Derived topological conditions ensure robustness in asynchronous settings.

Validated effectiveness through theoretical analysis and simulations.

Abstract

We study the problem of resilient consensus of sampled-data multi-agent networks with double-integrator dynamics. The term resilient points to algorithms considering the presence of attacks by faulty/malicious agents in the network. Each normal agent updates its state based on a predetermined control law using its neighbors' information which may be delayed while misbehaving agents make updates arbitrarily and might threaten the consensus within the network. Assuming that the maximum number of malicious agents in the system is known, we focus on algorithms where each normal agent ignores large and small position values among its neighbors to avoid being influenced by malicious agents. The malicious agents are assumed to be omniscient in that they know the updating times and delays and can collude with each other. We deal with both synchronous and partially asynchronous cases with delayed information and derive topological conditions in terms of graph robustness.

Equations

$${\color[rgb]{0,0,0}1.~{}\mathcal{X}_{\mathcal{S}_{1}}^{r}=\mathcal{S}_{1},~{}~{}~{}2.~{}\mathcal{X}_{\mathcal{S}_{2}}^{r}=\mathcal{S}_{2},~{}~{}~{}3.~{}\lvert\mathcal{X}_{\mathcal{S}_{1}}^{r}\rvert+\lvert\mathcal{X}_{\mathcal{S}_{2}}^{r}\rvert\geq s,}$$

$$\begin{array}{r}\dot{x_i}(t)=v_i(t),{\dot{v}}_i(t)=u_i(t),i=1,\dots ,n,\end{array}$$

$$\begin{array}{rl}{x}_i[k+1]& =x_i[k]+T{v}_i[k]+\frac{T^2}{2}{u}_i[k],\\ v_i[k+1]& =v_i[k]+T{u}_i[k],i=1,\dots ,n,\end{array}$$

$$u_i[k]=-\sum _{j\in {\mathcal{N}}_i}{a}_{ij}[k][(x_i[k]-{\delta }_i)-(x_j[k]-{\delta }_j)]-\alpha v_i[k],$$

$$x_i[k]-x_j[k]\to {\delta }_i-{\delta }_j,v_i[k]\to 0\text{as k→∞},\forall i,j\in \mathcal{V}.$$

$$\begin{array}{rl}\hat{x}[k+1]& =\hat{x}[k]+Tv[k]+\frac{T^2}{2}u[k],\\ v[k+1]& =v[k]+Tu[k],\end{array}$$

$$u[k]=-L[k]\hat{x}[k]-\alpha v[k],$$

$$\hat{x}[k]=\left[\begin{array}{c}{\hat{x}}^N[k]\\ {\hat{x}}^M[k]\end{array}\right],v[k]=\left[\begin{array}{c}{v}^N[k]\\ v^M[k]\end{array}\right],u[k]=\left[\begin{array}{c}{u}^N[k]\\ u^M[k]\end{array}\right],$$

$$\begin{array}{rl}{u}^N[k]& =-L^N[k]\hat{x}[k]-\alpha \left[\begin{array}{cc}{I}_{n_N}& 0\end{array}\right]v[k],\\ u^M[k]& :\text{arbitrary},\end{array}$$

$$\hat{x}[k+1]$$

$$\text{mbox}+\frac{T^2}{2}\left[\begin{array}{c}0\\ I_{n_M}\end{array}\right]u^M[k],$$

$$v[k+1]$$

$$Q=T{I}_n-\frac{\alpha T^2}{2}\left[\begin{array}{cc}{I}_{n_N}& 0\\ 0& 0\end{array}\right],R=I_n-\alpha T\left[\begin{array}{cc}{I}_{n_N}& 0\\ 0& 0\end{array}\right].$$

$$1+\frac{T^2}{2}\le \alpha T\le 2-\frac{T^2}{2}.$$

$$\hat{x}[k+1]$$

$$\displaystyle\hskip 42.67912pt\mbox{}+\frac{T^{2}}{2}\begin{bmatrix}0\\ I_{n_{M}}\end{bmatrix}\bigl{(}u^{M}[k]+u^{M}[k-1]\bigr{)},$$

$${\Phi }_{1k}$$

$${\Phi }_{2k}$$

$$\mathcal{S}$$

$$\displaystyle\hskip 17.07182pt\max\hat{x}^{N}[0]+\max\biggl{\{}0,\biggl{(}T-\frac{\alpha T^{2}}{2}\biggr{)}v^{N}[0]\biggr{\}}\biggr{]},$$

$$\hat{x}^{N}[1]=\biggl{(}\begin{bmatrix}I_{n_{N}}&0\end{bmatrix}-\frac{T^{2}}{2}L^{N}[0]\biggr{)}\hat{x}[0]+\biggl{(}T-\frac{\alpha T^{2}}{2}\biggr{)}v^{N}[0].$$

$$\begin{array}{rl}\overline{x}[k]=& \max \left({\hat{x}}^N[k],{\hat{x}}^N[k-1]\right),\\ \underline{x}[k]=& \min \left({\hat{x}}^N[k],{\hat{x}}^N[k-1]\right).\end{array}$$

$$\overline{x}[k]$$

$$\le \max \left({\hat{x}}^N[k-1],{\hat{x}}^N[k-2]\right)=\overline{x}[k-1].$$

$${\underline{x}}^{\star }+{ϵ}_0<{\overline{x}}^{\star }-{ϵ}_0,ϵ<\frac{{\beta }^{n_N}{ϵ}_0}{1-{\beta }^{n_N}}.$$

$${ϵ}_{\ell +1}=\beta {ϵ}_{\ell }-(1-\beta )ϵ,\ell =0,1,\dots ,n_N-1.$$

$$\epsilon_{n_{N}}=\beta^{n_{N}}\epsilon_{0}-\sum_{\ell=0}^{n_{N}-1}\beta^{\ell}(1-\beta)\epsilon=\beta^{n_{N}}\epsilon_{0}-\bigl{(}1-\beta^{n_{N}}\bigr{)}\epsilon>0.$$

$$\begin{array}{rl}{\mathcal{X}}_1(k_{ϵ}+\ell ,{ϵ}_{\ell })& =\{j\in \mathcal{V}:{\hat{x}}_j[k_{ϵ}+\ell ]>{\overline{x}}^{\star }-{ϵ}_{\ell }\},\\ {\mathcal{X}}_2(k_{ϵ}+\ell ,{ϵ}_{\ell })& =\{j\in \mathcal{V}:{\hat{x}}_j[k_{ϵ}+\ell ]<{\underline{x}}^{\star }+{ϵ}_{\ell }\}.\end{array}$$

$${\hat{x}}_j^N[k_{ϵ}+1]$$

$$\le (1-\beta )({\overline{x}}^{\star }+ϵ)+\beta ({\overline{x}}^{\star }-{ϵ}_0)$$

$$\le {\overline{x}}^{\star }-\beta {ϵ}_0+(1-\beta )ϵ={\overline{x}}^{\star }-{ϵ}_1.$$

$${\hat{x}}_i^N[k_{ϵ}+1]$$

$${\mathcal{X}}_1^{\prime }(k)$$

$${\mathcal{X}}_2^{\prime }(k)$$

$$\hat{x}_{i}[k+1]\leq(1-\beta^{k+1})\overline{x}[0]+\beta^{k+1}\big{[}(1-\eta)(\overline{x}[0]-x^{\star})+x^{\star}\big{]}.$$

Full text

††thanks: This work was supported in part by the Japan Science and Technology Agency under the EMS-CREST program and by JSPS under Grant-in-Aid for Scientific Research Grant No. 15H04020.

and

1 Introduction

In recent years, much attention has been devoted to the study of networked control systems with an emphasis on cyber security. Due to communications through shared networks, there are many vulnerabilities for potential attacks, which can result in irreparable damages. Conventional control approaches are often not applicable for resiliency against such unpredictable but probable misbehaviors in networks (e.g., [security_csm:15]). One of the most essential problems in networked multi-agent systems is consensus where agents interact locally to achieve the global goal of reaching a common value. Having a wide variety of applications in UAV formations, sensor networks, power systems, and so on, consensus problems have been studied extensively [mesbahi, renbook2]. Resilient consensus points to the case where some agents in the network anonymously try to mislead the others or are subject to failures. Such malicious agents do not comply with the predefined interaction rule and might even prevent the normal agents from reaching consensus. This type of problems has a rich history in distributed algorithms in the area of computer science (see, e.g., [lynch]) where the agents’ values are often discrete and finite. It is interesting that randomization sometimes play a crucial role; see also [MotRag:95, TemIsh, dibajiishiitempoACC2016].

In such problems, the non-faulty agents cooperate by interacting locally with each other to achieve agreement. There are different techniques to mitigate the effects of attacks. In some solutions, each agent has a bank of observers to identify the faulty agents within the network using their past information. Such solutions are formulated as a kind of fault detection and isolation problems [pasq, shames, sundaram]. However, identifying the malicious agents can be challenging and requires much information processing at the agents. In particular, these techniques usually necessitate each agent to know the topology of the entire network. This global information typically is not desirable in distributed algorithms. To overrule the effects of $f$ malicious agents, the network has to be at least $(2f+1)$-connected.

There is another class of algorithms for resilient consensus where each normal agent disregards the most deviated agents in the updates. In this case, they simply neglect the information received from suspicious agents or those with unsafe values whether or not they are truly misbehaving. This class of algorithms has been extensively used in computer science [Azadmanesh2002, Azevedo, zohir, lynch, plunkett, Vaidya] as well as control [dibajiishiiSCL2015, dibajiishiiNecSys2015, LeBlancPaper, zhang1]; see also [Feng, khanafer] for related problems. They are often called Mean Subsequence Reduced (MSR) algorithms, which was coined in [Azadmanesh1993]. Until recently, this strategy had been studied mostly in the case where the agent networks form complete graphs. The authors of [zhang1] have given a thorough study for the non-complete case and have shown that the traditional connectivity measure is not adequate for MSR-type algorithms to achieve resilient consensus. They then introduced a new notion called graph robustness. We note that most of these works have dealt with single-integrator and synchronous agent networks.

In this paper, we consider agents having second-order dynamics, which is a common model for autonomous mobile robots and vehicles. Such applications in fact provide motivations different from those in computer science as we will see. In our previous paper [dibajiishiiSCL2015], an MSR-type algorithm has been applied to sampled-data second-order agent networks. We have considered the problem of resilient consensus when each agent is affected by at most $f$ malicious agents among its neighbors. Such a model is called $f$-local malicious. We have established a sufficient condition on the underlying graph structure to reach consensus. It is stated in terms of graph robustness and is consistent with the result in [zhang1] for the first-order agent case.

Here, the focus of our study is on the so-called $f$-total model, where the total number of faulty agents is at most $f$, which has been dealt with in, e.g., [Azadmanesh2002, zohir, Azadmanesh1993, LeBlancPaper, zhang1, lynch, Vaidya]. We derive a necessary and sufficient condition to achieve resilient consensus by an MSR-like algorithm. Again, we show that graph robustness in the network is the relevant notion. However, the $f$-total model assumes fewer malicious agents in the system, and hence, the condition will be shown to be less restrictive than that for the $f$-local case. The works [zohir, Azadmanesh1993, lynch, Vaidya] have studied this model for the first-order agents case, but based on the Byzantine malicious agents, which are allowed to send different values to their neighbors. Such attacks may be impossible, e.g., if the measurements are made by on-board sensors in mobile robots.

Under the $f$-total model, we solve the resilient consensus problem using MSR-type algorithms for two different updating rules: Synchronous and partially asynchronous111The term partially asynchronous refers to the case where agents share some level of synchrony by having the same sampling times; however, they make updates at different times based on delayed information [Bertsekas]. This is in contrast to the fully asynchronous case where agents must be facilitated with their own clocks; such settings are studied in, e.g., [JiahuHirche]. . In the synchronous case, all agents simultaneously make updates at each time step using the current information of their neighbors. By contrast, in the asynchronous case, normal agents may decide to update only occasionally and moreover, the neighbors’ data may be delayed. This is clearly a more vulnerable situation, allowing the adversaries to take advantage by quickly moving around. We consider the worst-case scenarios where the malicious agents are aware of the updating times and even the delays in the information of normal agents. The normal agents on the other hand are unaware of the updating times of their neighbors and hence cannot predict the plans of adversaries. For both cases, we develop graph robustness conditions for the overall network topologies. It will be shown that the synchronous updating rules require less connectivity than the asynchronous counterpart; see also [dibajiishiiNecSys2015] regarding corresponding results for first-order agent systems.

The main features of this work are three-fold: (i) We deal with second-order agents, which are more suitable for modeling networks of vehicles, but exhibit more complicated dynamics in comparison to the single-order case. (ii) For the malicious agents, we consider the $f$-total model, which is less stringent than the $f$-local case, but the analysis is more involved. (iii) In the asynchronous case with delayed information, we introduce a new update scheme, which is more natural in view of the current research in the area of multi-agent systems than those based on the so-called rounds, commonly employed in computer science as we discuss later.

The paper is organized as follows. Section 2 presents preliminaries for introducing the problem setting. Section 3 focuses on resilient consensus based on synchronous update rules. Section 4 is devoted to the problem of partial asynchrony with delayed information. We illustrate the results through a numerical example in Section 5. Finally, Section 6 concludes the paper. The material of this paper appears in [dibajiishiiACC2015, dibajiishiiCDC2015] in preliminary forms; here, we present improved results with full proofs and more discussions.

2 Problem Setup

2.1 Graph Theory Notions

We recall some concepts on graphs [mesbahi]. A directed graph (or digraph) with $n$ nodes $(n>1)$ is defined as $\mathcal{G}=(\mathcal{V},\mathcal{E})$ with the node set $\mathcal{V}=\{1,\ldots,n\}$ and the edge set $\mathcal{E}\subseteq\mathcal{V}\times\mathcal{V}$. The edge $(j,i)\in\mathcal{E}$ means that node $i$ has access to the information of node $j$. If $\mathcal{E}=\{(i,j):\,i,j\in\mathcal{V},~{}i\neq j\}$, the graph is said to be complete. For node $i$, the set of its neighbors, denoted by $\mathcal{N}_{i}=\{j:(j,i)\in\mathcal{E}\}$, consists of all nodes having directed edges toward $i$. The degree of node $i$ is the number of its neighbors and is denoted by ${d}_{i}=\lvert\mathcal{N}_{i}\rvert$. The adjacency matrix $A=[a_{ij}]$ is given by $a_{ij}\in[\gamma,1)$ if $(j,i)\in\mathcal{E}$ and otherwise $a_{ij}=0$, where $\gamma>0$ is a fixed lower bound. We assume that $\sum_{j=1,j\neq i}^{n}a_{ij}\leq 1$. Let $L=[{l}_{ij}]$ be the Laplacian matrix of $\mathcal{G}$, whose entries are defined as $l_{ii}=\sum_{j=1,j\neq i}^{n}a_{ij}$ and $l_{ij}=-a_{ij},~{}i\neq j$; we can see that the sum of the elements of each row of $L$ is zero.

A path from node $v_{1}$ to $v_{p}$ is a sequence $(v_{1},v_{2},\ldots,v_{p})$ in which $(v_{i},v_{i+1})\in\mathcal{E}$ for $i=1,\ldots,p-1$. If there is a path between each pair of nodes, the graph is said to be strongly connected. A directed graph is said to have a directed spanning tree if there is a node from which there is a path to every other node in the graph.

For the MSR-type resilient consensus algorithms, the critical topological notion is graph robustness, which is a connectivity measure of graphs. Robust graphs were introduced in [zhang1] for the analysis of resilient consensus of first-order multi-agent systems.

Definition 2.1**.**

The digraph $\mathcal{G}$ is $(r,s)$-robust $(r,s<n)$ if for every pair of nonempty disjoint subsets $\mathcal{S}_{1},\mathcal{S}_{2}\subset\mathcal{V}$, at least one of the following conditions is satisfied:

[TABLE]

where $\mathcal{X}^{r}_{\mathcal{S}_{\ell}}$ is the set of all nodes in ${\mathcal{S}_{\ell}}$ which have at least $r$ incoming edges from outside of ${\mathcal{S}_{\ell}}$. In particular, graphs which are $(r,1)$-robust are called $r$-robust.

The following lemma helps to have a better understanding of $(r,s)$-robust graphs [LeBlancPhD].

Lemma 2.2**.**

For an $(r,s)$-robust graph $\mathcal{G}$, the following hold:

1. (i)

$\mathcal{G}$ is $(r^{\prime},s^{\prime})$-robust, where $0\leq r^{\prime}\leq r$ and $1\leq s^{\prime}\leq s$, and in particular, it is $r$-robust. 2. (ii)

$\mathcal{G}$ is $(r-1,s+1)$-robust. 3. (iii)

$\mathcal{G}$ is at least $r$-connected, but an $r$-connected graph is not necessarily $r$-robust. 4. (iv)

$\mathcal{G}$ has a directed spanning tree. 5. (v)

$r\leq\lceil n/2\rceil$. Also, if $\mathcal{G}$ is a complete graph, then it is $(r^{\prime},s)$-robust for all $0<r^{\prime}\leq\lceil n/2\rceil$ and $1\leq s\leq n$.

Moreover, a graph is $(r,s)$-robust if it is $(r+s-1)$-robust.

It is clear that $(r,s)$-robustness is more restrictive than $r$-robustness. The graph with five nodes in Fig. 1 is $(2,2)$-robust, but not $3$-robust; further, removing any edge destroys its $(2,2)$-robustness. In general, to determine if a given graph has a robustness property is computationally difficult since the problem involves combinatorial aspects. It is known that random graphs become robust when their size tends to infinity [zhangfata].

2.2 Second-Order Consensus Protocol

Consider a network of agents whose interactions are represented by the directed graph $\mathcal{G}$. Each agent $i\in\mathcal{V}$ has a double-integrator dynamics given by

[TABLE]

where $x_{i}(t)\in{\mathbb{R}}$ and $v_{i}(t)\in{\mathbb{R}}$ are its position and velocity, respectively, and $u_{i}(t)$ is the control input. We discretize the system with sampling period $T$ as

[TABLE]

where $x_{i}[k]$, $v_{i}[k]$, and $u_{i}[k]$ are, respectively, the position, the velocity, and the control input of agent $i$ at $t=kT$ for $k\in\mathbb{Z}_{+}$. Our discretization is based on control inputs generated by zeroth order holds; other methods are employed in, e.g., [LinP, JiahuHirche].

At each time step $k$, the agents update their positions and velocities based on the time-varying topology of the graph $\mathcal{G}[k]$, which is a subgraph of $\mathcal{G}$ and is specified later. In particular, the control uses the relative positions with its neighbors and its own velocity [renbook2]:

[TABLE]

where $a_{ij}[k]$ is the $(i,j)$ entry of the adjacency matrix $A[k]\in\mathbb{R}^{n\times n}$ corresponding to $\mathcal{G}[k]$, $\alpha$ is a positive scalar, and $\delta_{i}\in\mathbb{R}$ is a constant representing the desired relative position of agent $i$ in a formation.

The agents’ objective is consensus in the sense that they come to formation and then stop asymptotically:

[TABLE]

In [renbook2], it is shown that if there is some $\ell_{0}\in\mathbb{Z}_{+}$ such that for any nonnegative integer $k_{0}$, the union of $\mathcal{G}[k]$ across $k\in[k_{0},k_{0}+\ell_{0}]$ has a directed spanning tree, then consensus can be obtained under the control law (2) by properly choosing $\alpha$ and $T$.

In this paper, we study the case where some agents malfunction due to failure, disturbances, or attacks. In such circumstances, they may not follow the predefined update rule (2). In the next subsection, we introduce necessary definitions and then formulate the resilient consensus problem in the presence of malicious agents.

Finally, we represent the agent system in a vector form. Let $\hat{x}_{i}[k]=x_{i}[k]-\delta_{i}$, $\hat{x}[k]=\left[\hat{x}_{1}[k]\,\cdots\,\hat{x}_{n}[k]\right]^{T}$, and $v[k]=\left[v_{1}[k]\,\cdots\,v_{n}[k]\right]^{T}$. For the sake of simplicity, hereafter, the agents’ positions refer to $\hat{x}[k]$ and not $x[k]$. The system (1) then becomes

[TABLE]

and the control law (2) can be written as

[TABLE]

where $L[k]$ is the Laplacian matrix for the graph $\mathcal{G}[k]$.

2.3 Resilient Consensus

We introduce notions related to malicious agents and consensus in the presence of such agents [zhang1, lynch, Vaidya].

Definition 2.3**.**

Agent $i$ is called normal if it updates its state based on the predefined control (2). Otherwise, it is called malicious and may make arbitrary updates. The index set of malicious agents is denoted by $\mathcal{M}\subset\mathcal{V}$. The numbers of normal agents and malicious agents are denoted by $n_{N}$ and $n_{M}$, respectively.

We assume that an upper bound is available for the number of misbehaving agents in the entire network or at least in each normal agent’s neighborhood.

Definition 2.4**.**

The network is $f$-total malicious if the number $n_{M}$ of faulty agents is at most $f$, i.e., $n_{M}\leq f$. On the other hand, the network is $f$-local malicious if the number of malicious agents in the neighborhood of each normal agent $i$ is bounded by $f$, i.e., $\lvert\mathcal{N}_{i}\cap\mathcal{M}\rvert\leq f$.

According to the model of malicious agents considered, the difference between normal agents and malicious agents lies in their control inputs $u_{i}$: For the normal agents, it is given by (2) while for the malicious agents, it is arbitrary. On the other hand, the position and velocity dynamics for all agents remain the same as (1).

We introduce the notion of resilient consensus for the network of second-order agents [dibajiishiiSCL2015].

Definition 2.5**.**

If for any possible set of malicious agents, any initial positions and velocities, and any malicious inputs, the following conditions are met, then the network is said to reach resilient consensus:

Safety: There exists a bounded interval $\mathcal{S}$ determined by the initial positions and velocities of the normal agents such that $\hat{x}_{i}[k]\in\mathcal{S}$, $i\in\mathcal{V}\backslash\mathcal{M},k\in\mathbb{Z}_{+}$. The set $\mathcal{S}$ is called the safety interval. 2. 2.

Agreement: For some $c\in\mathcal{S}$, it holds that $\lim_{k\rightarrow\infty}\hat{x}_{i}[k]=c$ and $\lim_{k\rightarrow\infty}v_{i}[k]=0$, $i\in\mathcal{V}\backslash\mathcal{M}$.

A few remarks are in order regarding the safety interval $\mathcal{S}$. (i) The malicious agents may or may not be in $\mathcal{S}$, while the normal agents must stay inside though they may still be influenced by the malicious agents staying in $\mathcal{S}$. (ii) We impose the safety condition to ensure that the behavior of the normal agents remains close to that when no malicious agent is present. (iii) We do not have a safety interval for velocity of normal agents and hence they may even move faster than their initial speeds.

3 Synchronous Networks

3.1 DP-MSR Algorithm

We first outline the algorithm for achieving consensus in the presence of misbehaving agents in the synchronous case, where all agents make updates at every time step. The algorithm is called DP-MSR, which stands for Double-Integrator Position-Based Mean Subsequence Reduced algorithm. It was proposed in [dibajiishiiSCL2015] for the $f$-local malicious model.

The algorithm has three steps as follows:

At each time step $k$, each normal agent $i$ receives the relative position values $\hat{x}_{j}[k]-\hat{x}_{i}[k]$ of its neighbors $j\in\mathcal{N}_{i}[k]$ and sorts them in a decreasing order. 2. 2.

If there are less than $f$ agents whose relative position values are greater than or equal to zero, then the normal agent $i$ ignores the incoming edges from those agents. Otherwise, it ignores the incoming edges from $f$ agents counting from those having the largest relative position values. Similarly, if there are less than $f$ agents whose values are smaller than or equal to zero, then agent $i$ ignores the incoming edges from those agents. Otherwise, it ignores the $f$ incoming edges counting from those having the smallest relative position values. 3. 3.

Apply the control input (2) by substituting $a_{ij}[k]=0$ for edges $(j,i)$ which are ignored in step 2.

The main feature of this algorithm lies in its simplicity. Each normal agent ignores the information received from its neighbors which may be misleading. In particular, it ignores up to $f$ edges from neighbors whose positions are large, and $f$ edges from neighbors whose positions are small. The underlying graph $\mathcal{G}[k]$ at time $k$ is determined by the remaining edges. The adjacency matrix $A[k]$ and the Laplacian matrix $L[k]$ are determined accordingly.

The problem for the synchronous agent network can be stated as follows: Under the $f$-total malicious model, find a condition on the network topology such that the normal agents reach resilient consensus based on the DP-MSR algorithm.

3.2 Matrix Representation

We provide a modified system model when malicious agents are present. To simplify the notation, the agents’ indices are reordered. Let the normal agents take indices $1,\ldots,n_{N}$ and let the malicious agents be $n_{N}+1,\ldots,n$. Thus, the vectors representing the positions, velocities, and control inputs of all agents consist of two parts as

[TABLE]

where the superscript $N$ stands for normal and $M$ for malicious. Regarding the control inputs $u^{N}[k]$ and $u^{M}[k]$, the normal agents follow (2) while the malicious agents may not. Hence, they can be expressed as

[TABLE]

where $L^{N}[k]\in\mathbb{R}^{n_{N}\times n}$ is the matrix formed by the first $n_{N}$ rows of $L[k]$ associated with normal agents. The row sums of this matrix $L^{N}[k]$ are zero as in $L[k]$.

With the control inputs of (6), we obtain the model for the overall system (3) as

[TABLE]

where the partitioning in the matrices is in accordance with the vectors in (5), and $Q$ and $R$ are given by

[TABLE]

For the sampling period $T$ and the parameter $\alpha$, we assume222The condition (9) on $T$ and $\alpha$ ensures that the matrix \bigl{[}\Phi_{1k}~{}\Phi_{2k}\bigr{]} possesses the properties stated in Lemma 3.1. We may relax it, for example, by not imposing $\sum_{j=1}^{n}a_{ij}[k]$ to be less than 1. While (9) can be fulfilled by any $T$, the control law (2) may make the agents exhibit undesired oscillatory movements. This type of property is also seen in previous works on consensus of agents with second-order dynamics; see, e.g., [renjournal, renbook2]. We remark that the condition (9) is less restrictive than that in [JiahuQin2012]. In general, shortcomings due to this assumption should be further studied in future research.

[TABLE]

The following lemma from [dibajiishiiSCL2015] plays a key role in the analysis.

Lemma 3.1**.**

Under the control inputs (6), the position vector $\hat{x}[k]$ of the agents for $k\geq 1$ can be expressed as

[TABLE]

where

[TABLE]

Moreover, under (9), the matrix \bigl{[}\Phi_{1k}~{}~{}\Phi_{2k}\bigr{]} is nonnegative, and the sum of each of its first ${n_{N}}$ rows is one.

Remark 3.2**.**

It is clear from the lemma that the controls $u^{M}[k]$ and $u^{M}[k-1]$ do not directly enter the new positions $\hat{x}^{N}[k+1]$ of the normal agents. Moreover, the positions of the normal agents $\hat{x}^{N}[k+1]$ for $k\geq 1$ are obtained via the convex combination of the current positions $\hat{x}[k]$ and those from the previous time step $\hat{x}[k-1]$.

3.3 A Necessary and Sufficient Condition

We are now ready to state the main result for the synchronous case. Let the interval $\mathcal{S}$ be given by

[TABLE]

where the minimum and the maximum are taken over all entries of the vectors. Note that the interval is determined only by the initial states of the normal agents.

Theorem 3.3**.**

Under the $f$-total malicious model, the network of agents with second-order dynamics using the control in (6) and the DP-MSR algorithm reaches resilient consensus if and only if the underlying graph is $(f+1,f+1)$-robust. The safety interval is given by (3.3).

Proof.

(Necessity) We prove by contradiction. Suppose that the network is not $(f+1,f+1)$-robust. Then, there are nonempty disjoint sets $\mathcal{V}_{1},\mathcal{V}_{2}\subset\mathcal{V}$ such that none of the conditions 1–3 in Definition 2.1 holds. Suppose all agents in $\mathcal{V}_{1}$ have initial positions at $a$ and all agents in $\mathcal{V}_{2}$ have initial positions at $b$ with $a<b$. Let all other agents have initial positions taken from the interval $(a,b)$ and every agent has 0 as initial velocity. From condition 3, we have that $\lvert\mathcal{X}_{\mathcal{V}_{1}}^{f+1}\rvert+\lvert\mathcal{X}_{\mathcal{V}_{2}}^{f+1}\rvert\leq f$. Suppose that all agents in $\mathcal{X}_{\mathcal{V}_{1}}^{f+1}$ and $\mathcal{X}_{\mathcal{V}_{2}}^{f+1}$ are malicious and keep their values constant. There is at least one normal agent in $\mathcal{V}_{1}$ and one normal agent in $\mathcal{V}_{2}$ by $\lvert\mathcal{X}_{\mathcal{V}_{1}}^{f+1}\rvert<\lvert\mathcal{V}_{1}\rvert$ and $\lvert\mathcal{X}_{\mathcal{V}_{2}}^{f+1}\rvert<\lvert\mathcal{V}_{2}\rvert$ because conditions 1 and 2 do not hold. These normal agents have $f$ or fewer neighbors outside of their own sets because they are not in ${\mathcal{X}_{\mathcal{V}_{1}}^{f+1}}$ or ${\mathcal{X}_{\mathcal{V}_{2}}^{f+1}}$. As a result, all normal agents in $\mathcal{V}_{1}$ and $\mathcal{V}_{2}$ update based only on the values inside $\mathcal{V}_{1}$ and $\mathcal{V}_{2}$ by removing the values received from outside of their sets. This makes their positions at $a$ and $b$ unchanged. Hence, there will be no agreement among the normal agents.

(Sufficiency)  We first establish the safety condition with $\mathcal{S}$ given in (3.3), i.e., $\hat{x}_{i}[k]\in\mathcal{S}$ for all $k$ and $i\in\mathcal{V}\setminus\mathcal{M}$. For $k=0$, it is obvious that the condition holds. For $k=1$, the positions of normal agents are given by (7) as

[TABLE]

While the initial velocities of the malicious agents do not appear in $\hat{x}^{N}$ at this time, their initial positions may have influences. However, for a normal agent, if some of its neighbors are malicious and are outside the interval $[\min\hat{x}^{N}[0],\max\hat{x}^{N}[0]]$, then they will be ignored by step 2 in DP-MSR because there are at most $f$ such agents. The matrix $[I_{n_{N}}0]-(T^{2}/2)L^{N}[0]$ in (11) is nonnegative and its row sums are one because $L^{N}[0]$ consists of the first $n_{N}$ rows of the Laplacian $L[0]$. As a result, the first term on the right-hand side of (11) is a vector whose entries are convex combinations of values within $[\min\hat{x}^{N}[0],\max\hat{x}^{N}[0]]$. Thus, for each normal agent $i\in\mathcal{V}\setminus\mathcal{M}$, it holds that $\hat{x}_{i}[1]\in\mathcal{S}$.

Next, to further analyze the normal agents, let

[TABLE]

In what follows, we show that $\overline{x}[k]$ is a nonincreasing function of $k\geq 1$. For $k\geq 2$, Lemma 3.1 and Remark 3.2 indicate that the positions of normal agents are convex combinations of those of its neighbors from time $k-1$ and $k-2$. If any neighbors of the normal agents at those time steps are malicious and are outside the range of the normal agents’ position values, they are ignored by step 2 in DP-MSR. Hence, we have $\max\hat{x}^{N}[k]\leq\max\left(\hat{x}^{N}[k-1],\hat{x}^{N}[k-2]\right)$. It also easily follows that \max\hat{x}^{N}[k-1]\leq\max\bigl{(}\hat{x}^{N}[k-1], \hat{x}^{N}[k-2]\bigr{)}. Thus, we arrive at

[TABLE]

Similarly, $\underline{x}[k]$ is a nondecreasing function of time. Thus, we have that for $k\geq 2$, normal agents satisfy $\hat{x}_{i}[k]\in\mathcal{S}$, $i\in\mathcal{V}\setminus\mathcal{M}$. The safety condition has now been proven.

It remains to establish the agreement condition. We start with the proof of agreement in the position values. Because $\overline{x}[k]$ and $\underline{x}[k]$ are bounded and monotone, their limits exist, which are denoted by $\overline{x}^{\star}$ and $\underline{x}^{\star}$, respectively. If $\overline{x}^{\star}=\underline{x}^{\star}$, then resilient consensus follows. We prove by contradiction, and thus assume $\overline{x}^{\star}>\underline{x}^{\star}$.

Denote by $\beta$ the minimum nonzero entry of the matrix \bigl{[}\Phi_{1k}~{}\Phi_{2k}\bigr{]} over all $k$. This matrix is determined by the structure of the graph $\mathcal{G}[k]$ and thus can vary over a finite number of candidates; by (9), we have $\beta\in(0,1)$. Let $\epsilon_{0}>0$ and $\epsilon>0$ be sufficiently small that

[TABLE]

We introduce the sequence $\{\epsilon_{\ell}\}$ defined by

[TABLE]

It is easy to see that $\epsilon_{\ell+1}<\epsilon_{\ell}$ for $i=0,1,\ldots,n_{N}-1$. Moreover, by (13), they are positive because

[TABLE]

We also take $k_{\epsilon}\in\mathbb{Z}_{+}$ such that for $k\geq k_{\epsilon}$, it holds that $\overline{x}[k]<\overline{x}^{\star}+\epsilon$, $\underline{x}[k]>\underline{x}^{\star}-\epsilon$. Due to convergence of $\overline{x}[k]$ and $\underline{x}[k]$, such $k_{\epsilon}$ exists. For the sequence $\{\epsilon_{\ell}\}$, let

[TABLE]

For each fixed $\ell$, these sets are disjoint by (13) and $\epsilon_{{\ell}+1}<\epsilon_{{\ell}}$. Here, we claim that in a finite number of steps, one of these sets will contain no normal agent. Note that this contradicts the assumption of $\overline{x}^{\star}$ and $\underline{x}^{\star}$ being limits.

We start by considering $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ (see Fig. 2). Because of the limit $\overline{x}^{\star}$, one or more normal agents are contained in this set or the set $\mathcal{X}_{1}(k_{\epsilon}+1,\epsilon_{1})$ from the next step. In what follows, we prove that $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ is nonempty. We can in fact show that each normal agent $j$ outside of $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ at time $k_{\epsilon}$ will remain outside of $\mathcal{X}_{1}(k_{\epsilon}+1,\epsilon_{1})$. Here, agent $j$ satisfies $\hat{x}_{j}^{N}[k_{\epsilon}]\leq\overline{x}^{\star}-\epsilon_{0}$. From Remark 3.2, each normal agent updates its position by taking a convex combination of the neighbors’ positions at the current and previous time steps. Thus, by the choice of $\beta$, the position of agent $j$ is bounded as

[TABLE]

Hence, agent $j$ is not in $\mathcal{X}_{1}(k_{\epsilon}+1,\epsilon_{1})$. Similarly, we can show that $\mathcal{X}_{2}(k_{\epsilon},\epsilon_{0})$ is nonempty.

Since the graph is $(f+1,f+1)$-robust, one of the conditions 1–3 from Definition 2.1 holds:

All agents in $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ have $f+1$ neighbors from outside of $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$. 2. 2.

All agents in $\mathcal{X}_{2}(k_{\epsilon},\epsilon_{0})$ have $f+1$ neighbors from outside of $\mathcal{X}_{2}(k_{\epsilon},\epsilon_{0})$. 3. 3.

In the two sets in total, there are $f+1$ agents having at least $f+1$ neighbors from outside their own sets.

In the first case, based on the definition of $\overline{x}^{\star}$ and $\overline{x}[k]$ there exists at least one normal agent inside the set $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ having $f+1$ incoming links from outside of $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$. Similarly, in the second case, there exists one normal agent having $f+1$ incoming links from outside $\mathcal{X}_{2}(k_{\epsilon},\epsilon_{0})$. In the third case, because the maximum number of malicious agents is $f$, there is one normal agent in $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ or $\mathcal{X}_{2}(k_{\epsilon},\epsilon_{0})$ which has $f+1$ neighbors from outside the set it belongs to.

Suppose that the set $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ has this normal agent; denote its index by $i$. Because at each time, each normal agent ignores at most $f$ smallest neighbors and all of these $f+1$ neighbors are upper bounded by $\overline{x}^{\star}-\epsilon_{0}$, at least one of the agents affecting $i$ has a value smaller than or equal to $\overline{x}^{\star}-\epsilon_{0}$. From Remark 3.2, every normal agent updates by a convex combination of position values of current and previous time steps. By (9) and the choice of $\beta$, one of the normal neighbors must be used in the update with DP-MSR. Thus, for agent $i$,

[TABLE]

By (15), $\hat{x}_{i}^{N}[k_{\epsilon}+1]$ is upper bounded by $\overline{x}^{\star}-\epsilon_{1}$. Thus, at least, one of the normal agents in $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ has decreased to $\overline{x}^{\star}-\epsilon_{1}$, and the number of normal agents in $\mathcal{X}_{1}(k_{\epsilon}+1,\epsilon_{1})$ is less than $\mathcal{X}_{1}(k_{\epsilon},\epsilon_{0})$ (see Fig. 2). The same argument holds for $\mathcal{X}_{2}(k_{\epsilon},\epsilon_{0})$. Hence, it follows that the number of normal agents in $\mathcal{X}_{1}(k_{\epsilon}+\ell,\epsilon_{\ell})$ is less than that in $\mathcal{X}_{1}(k_{\epsilon}+\ell-1,\epsilon_{\ell-1})$ and/or the number of normal agents in $\mathcal{X}_{2}(k_{\epsilon}+\ell,\epsilon_{\ell})$ is less than that in $\mathcal{X}_{2}(k_{\epsilon}+\ell-1,\epsilon_{\ell-1})$. Because the number of normal agents is finite, there is a time $\ell^{\star}\leq n_{N}$ where the set of normal agents in $\mathcal{X}_{1}(k_{\epsilon}+\ell,\epsilon_{\ell})$ and/or that in $\mathcal{X}_{2}(k_{\epsilon}+\ell,\epsilon_{\ell})$ is empty for $\ell\geq\ell^{\star}$. This fact contradicts the existence of the two limits $\overline{x}^{\star}$ and $\underline{x}^{\star}$. Thus, we conclude that $\overline{x}^{\star}=\underline{x}^{\star}$, i.e., all normal agents reach position consensus.

It is finally shown that all normal agents stop asymptotically, which is agreement in the velocity values. When the normal agents reach agreement in their positions, the controls (2) become $u_{i}^{N}[k]\to-\alpha v_{i}^{N}[k]$ as $k\to\infty$. By the dynamics (1) of the agents, it holds that $\hat{x}_{i}^{N}[k+1]\to\hat{x}_{i}^{N}[k]+T\left(1-\alpha T/2\right)v_{i}^{N}[k]$ as $k\to\infty$. Noting (9), we arrive at $v_{i}^{N}[k]\to 0$ as $k\to\infty$. ∎

In [dibajiishiiSCL2015], we have studied the $f$-local model, where each normal agent has at most $f$ malicious agents as neighbors. Clearly, there may be more malicious agents overall than the $f$-total case. There, a sufficient condition for resilient consensus is that the network is $(2f+1)$-robust. From Lemma 2.2, such graphs require more edges than $(f+1,f+1)$-robust graphs, as given in the theorem above.

The result is consistent with that for the first-order agent case in [zhang1]. More from the technical side, difficulties in dealing with second-order agent dynamics can be described as follows: In the proof above, an important step is to establish that $\overline{x}[k]$ and $\underline{x}[k]$ defined in (12) are monotonically nonincreasing and nondecreasing, respectively. These properties do not hold for the maximum position $\max\,\hat{x}^{N}[k]$ and the minimum position $\min\,\hat{x}^{N}[k]$ as in the first-order case. Furthermore, as a consequence of this fact, it is more involved to show that the sets $\mathcal{X}_{1}(k_{\epsilon}+{\ell},\epsilon_{\ell})$ and $\mathcal{X}_{2}(k_{\epsilon}+{\ell},\epsilon_{\ell})$ in (14) become smaller as ${\ell}$ increases.

As a corollary to Theorem 3.3, we show that the convergence rate to achieve consensus is exponential.

Corollary 3.4**.**

Under the assumptions in Theorem 3.3, the network of agents with second-order dynamics reaches resilient consensus with an exponential convergence rate.

Proof.

We outline the proof which follows a similar line of argument to that of Theorem 3.3, but with the knowledge that the agents come to agreement. Let $V(k)=\overline{x}[k]-\underline{x}[k]$. We show that this function decreases to zero exponentially fast as $k\rightarrow\infty$.

Take an arbitrary constant $\eta\in(0,1)$. We introduce two sets as follows: For $k=0,1,\ldots,n_{N}$, let

[TABLE]

Clearly, for each $k$, the sets $\mathcal{X}^{\prime}_{1}(k)$ and $\mathcal{X}^{\prime}_{2}(k)$ are disjoint, so by $(f+1,f+1)$ robustness, there is one normal agent $i$ in one of the sets having $f+1$ incoming links from outside the set to which it belongs. If agent $i$ is in $\mathcal{X}^{\prime}_{1}(k)$, then, similar to (15), we can upper bound its position as

[TABLE]

Hence, in this case, agent $i$ is not in $\mathcal{X}^{\prime}_{1}(k+1)$ at time $k+1$. On the other hand, if agent $i$ is in $\mathcal{X}^{\prime}_{2}(k)$, then

[TABLE]

implying that $\hat{x}_{i}[k+1]$ is outside of $\mathcal{X}^{\prime}_{2}(k+1)$. Since the number of normal agents is $n_{N}$, at time $k=n_{N}$, both of the sets $\mathcal{X}^{\prime}_{1}(n_{N})$ and $\mathcal{X}^{\prime}_{2}(n_{N})$ do not contain any normal agent. Hence, we can conclude that the maximum position $\overline{x}[k]$ and the minimum position $\underline{x}[k]$ of normal agents, respectively, decreased and increased since time 0. More concretely, we have $V(n_{N})\leq(1-\beta^{n_{N}}\eta)V(0)$. By repeating this argument, we can establish that $V(kn_{N})\leq(1-\beta^{n_{N}}\eta)^{k}V(0)$. ∎

This corollary also indicates that conventional consensus algorithms without malicious agents in the network have exponential convergence rate. In the proposed MSR-type algorithm, the rate of convergence is affected by two factors. One is that a number of edges are ignored and not used for the updates, which will reduce the convergence rate. The other is that if malicious agents stay together with some of the normal agents, they can still influence the rate to achieve consensus and slow it down.

4 Networks with Partial Asynchrony and Delay

So far, the underlying assumption in the model has been that all agents exchange their states at the same time instants. Moreover, they make updates based on the relative locations of their neighbors without any time delay in the model. In practice, however, the agents might not be synchronized nor have access to the current data of all neighbors simultaneously. In this section, we extend the setup so that the agents are allowed to update at different times with delayed information.

We would like to emphasize the difference in the partially asynchronous agent model employed here from those in the resilient consensus literature. In particular, we follow the approach generally assumed in asynchronous consensus for the case without malicious agents; see, e.g., [mesbahi, Yangfeng, Xiao2006] for single-integrator networks and [LinP, Cheng-Lin, JiahuQin2012, JiahuHirche] for the double-integrator case. That is, at the time for an update, each agent uses the most recently received positions of its neighbors. This is a natural setting especially for autonomous mobile robots or vehicles using sensors to locate their neighbors in real time.

In contrast, the works [Azadmanesh2002, Azadmanesh1993, LeBlancPaper, Vaidya] from the area of computer science consider asynchronous MSR-type algorithms based on the notion of rounds (for the case with first-order agents). There, when each agent makes a transmission, it broadcasts its state together with its round $r$, representing the number of transmissions made so far. The agent makes an update to obtain the new state corresponding to round $r+1$ by using the states of neighbors, but only when a sufficient number of those labeled with the same round $r$ are received. Due to delays in communication, the states labeled with round $r$ may be received at various times, causing potentially large delays in making the $(r+1)$th update for some agents.

Compared to the results in the previous section, the analysis in the partially asynchronous model studied here becomes more complicated. Moreover, the derived condition is more restrictive because there are additional ways for the malicious agents to deceive the normal ones. For example, they may quickly move so that they appear to be at different positions for different normal agents, which may prevent them from coming together.

4.1 Asynchronous DP-MSR Algorithm

Here, we employ the control input taking account of possible delays in the position values from the neighbors as

[TABLE]

where $\tau_{ij}[k]\in\mathbb{Z}_{+}$ denotes the delay in the edge $(j,i)$ at time $k$. From the viewpoint of agent $i$, the most recent information regarding agent $j$ at time $k$ is the position at time $k-\tau_{ij}[k]$ relative to its own current position. The delays are time varying and may be different at each edge, but we assume the common upper bound $\tau$ as

[TABLE]

Hence, each normal agent becomes aware of the position of each of its neighbors at least once in $\tau$ time steps, but possibly at different time instants. In other words, normal agents must update and transmit their information often enough to meet (17). It is also assumed in (16) that agent $i$ uses its own current velocity. We emphasize that the value of $\tau$ in (17) can be arbitrary and moreover need not be known to the agents since this information is not used in the update rule. In [Gao, Cheng-Lin, JiahuHirche], time delays for partially asynchronous cases have been studied for agents with second-order dynamics.

As in the synchronous case, the malicious agents are assumed to be omniscient. Here, it means that they have prior knowledge of update times and $\tau_{ij}[k]$ for all links and $k\geq 0$. The malicious agents might take advantage of this knowledge to decide how they should make updates to confuse and mislead the normal agents.

To achieve resilient consensus, we employ a modified version of the algorithm in Section 3, called the asynchronous DP-MSR, outlined below.

At each time step $k$, each normal agent $i$ decides whether to make an update or not. 2. 2.

If it decides to do so, then it uses the relative position values of its neighbors $j\in\mathcal{N}_{i}$ based on the most recent values in the form of $\hat{x}_{j}[k-\tau_{ij}[k]]-\hat{x}_{i}[k]$ and then follows step 2 of the DP-MSR algorithm based on these values. Afterwards, it applies the control input (16) by substituting $a_{ij}[k]=0$ for edges $(j,i)$ which are ignored in step 2 of DP-MSR. 3. 3.

Otherwise, it applies the control (16) where the first term of position values of its neighbors remains the same as the previous time step, and for the second term, its own current velocity is used.

The asynchronous version of the resilient consensus problem is stated as follows: Under the $f$-total malicious model, find a condition on the network topology so that the normal agents reach resilient consensus using the asynchronous DP-MSR algorithm.

4.2 Matrix Representation

Before presenting the main result of this section, we introduce some notation to represent the equations in the matrix form. Define the matrices $A_{\ell}[k]$, $0\leq\ell\leq\tau$, by

[TABLE]

Then, let $D[k]$ be a diagonal matrix whose $i$th entry is given by $d_{i}[k]=\sum_{j=1}^{n}a_{ij}[k]$. Now, the $n\times(\tau+1)n$ matrix $L_{\tau}[k]$ is defined as

[TABLE]

It is clear that the summation of each row is zero as in the Laplacian matrix $L[k]$.

Now, the control input (16) can be expressed as

[TABLE]

where $z[k]=[\hat{x}[k]^{T}\hat{x}[k-1]^{T}\cdots\hat{x}[k-\tau]^{T}]^{T}$ is a $(\tau+1)n$-dimensional vector for $k\geq 0$ and $L^{N}_{\tau}[k]$ is a matrix formed by the first $n_{N}$ rows of $L_{\tau}[k]$. Here, $z[0]$ is the given initial position values of the agents and can be chosen arbitrarily. By (3) and (18), the agent dynamics can be written as

[TABLE]

where $\Gamma[k]$ is an $n\times(\tau+1)n$ matrix given by

[TABLE]

and $Q$ and $R$ are given in (8). Based on the expression (4.2), we can derive a result corresponding to Lemma 3.1 for the partially asynchronous and delayed protocol. The proof is omitted since it is by direct calculation similar to Lemma 3.1 shown in [dibajiishiiSCL2015].

Lemma 4.1**.**

Under the control inputs (18), the position vector $\hat{x}[k]$ of the agents for $k\geq 1$ can be expressed as

[TABLE]

where

[TABLE]

Furthermore, the matrix \bigl{[}\Lambda_{1k}~{}~{}\Lambda_{2k}\bigr{]} is nonnegative and the sum of each of its first $n_{N}$ rows is one.

4.3 Resilient Consensus Analysis

The following theorem is the main result of the paper, addressing resilient consensus via the asynchronous DP-MSR in the presence of delayed information. The safety interval differs from the previous case and is given by

[TABLE]

Theorem 4.2**.**

Under the $f$-total malicious model, the network of agents with second-order dynamics using the control in (18) and the asynchronous DP-MSR algorithm reaches resilient consensus only if the underlying graph $(f+1,f+1)$-robust. Moreover, if the underlying graph is $(2f+1)$-robust, then resilient consensus is attained with a safety interval given by (4.3).

The proof of this theorem given below follows an argument similar to that of Theorem 3.3. However, the problem is more general with the delay bound $\tau\geq 0$ in (17). This in turn results in more involved analysis with subtle differences. We provide further discussions later.

Proof.

(Necessity) The synchronous network is a special case of partially asynchronous ones with $\tau=0$. Thus, the necessary condition in Theorem 3.3 is valid.

(Sufficiency) We first show that the safety condition holds. For $k=0$, by (4.3), we have $\hat{x}_{i}[0]\in\mathcal{S}_{\tau}$ for $i\in\mathcal{V}\setminus\mathcal{M}$. For $k=1$, by (4.2), the positions of normal agents can be expressed as

[TABLE]

This vector may be affected by the malicious agents through their initial positions. However, by step 2 in DP-MSR, for any normal agent, if some neighbors are malicious and are outside of $[\min z^{N}[0],\max z^{N}[0]]$, then they will be ignored. In (21), the matrix $[I_{n_{N}}0]-(T^{2}/2)L_{\tau}^{N}[0]$ is nonnegative and its row sums are one. Hence, the first term on the right-hand side of (21) becomes convex combinations of values in the interval $[\min z^{N}[0],\max z^{N}[0]]$. Thus, we have $\hat{x}_{i}[1]\in\mathcal{S_{\tau}}$ for $i\in\mathcal{V}\setminus\mathcal{M}$.

Next, for $k\geq 1$, define two variables by

[TABLE]

Here, we claim that $\overline{x}_{\tau}[k]$ is a nonincreasing function of $k\geq 1$. By Lemma 4.1, at time $k\geq 2$, each normal agent updates its position based on a convex combination of the neighbors’ positions from $k-1$ to $k-\tau-1$. If some neighbors are malicious and stay outside of the interval determined by the normal agents’ positions, then they are ignored in step 2 of DP-MSR. Hence, we obtain $\hat{x}_{i}[k+1]\leq\max\left(\hat{x}^{N}[k],\hat{x}^{N}[k-1],\ldots,\hat{x}^{N}[k-\tau-1]\right)$ for $i\in\mathcal{V}\setminus\mathcal{M}$. It also follows that

[TABLE]

for $i\in\mathcal{V}\setminus\mathcal{M}$. Hence, we have

[TABLE]

We can similarly prove that $\underline{x}_{\tau}[k]$ is nondecreasing in time. This indicates that for $k\geq 2$, we have $\hat{x}_{i}[k]\in\mathcal{S_{\tau}}$ for $i\in\mathcal{V}\backslash\mathcal{M}$. Thus, we have shown the safety condition.

In the rest of the proof, we must show the agreement condition. As $\overline{x}_{\tau}[k]$ and $\underline{x}_{\tau}[k]$ are monotone functions and contained in $[\underline{x}_{\tau}[1],\overline{x}_{\tau}[1]]$, both of their limits exist, which are denoted by $\overline{x}^{\star}_{\tau}$ and $\underline{x}^{\star}_{\tau}$, respectively. We claim that the limits in fact satisfy $\overline{x}^{\star}_{\tau}=\underline{x}^{\star}_{\tau}$, i.e., the positions of the normal agents come to consensus. The proof is by contradiction, so we assume that $\overline{x}^{\star}_{\tau}>\underline{x}^{\star}_{\tau}$.

First, let $\beta$ be the minimum nonzero element over all possible cases of \bigl{[}\Lambda_{1k}~{}\Lambda_{2k}\bigr{]}. From (9) and the bound $\gamma$ on $a_{ij}[k]$, it holds that $\beta\in(0,1)$. Choose $\epsilon_{0}>0$ and $\epsilon>0$ small enough that

[TABLE]

We next take the sequence $\{\epsilon_{\ell}\}$ via

[TABLE]

It can be shown that $0<\epsilon_{\ell+1}<\epsilon_{\ell}$ for all $\ell$. In particular, they are positive because by (23), it holds that

[TABLE]

We also take $k_{\epsilon}\in\mathbb{Z}_{+}$ such that $\overline{x}_{\tau}[k]<\overline{x}^{\star}_{\tau}+\epsilon$ and $\underline{x}_{\tau}[k]>\underline{x}^{\star}_{\tau}-\epsilon$ for $k\geq k_{\epsilon}$. Due to convergence of $\overline{x}_{\tau}[k]$ and $\underline{x}_{\tau}[k]$, such $k_{\epsilon}$ exists. For the sequence $\{\epsilon_{\ell}\}$, let

[TABLE]

These two sets are disjoint by (23) and $0<\epsilon_{\ell+1}<\epsilon_{\ell}$.

Next, we must show that one of the two sets becomes empty in a finite number of steps. This clearly contradicts the assumption on $\overline{x}^{\star}_{\tau}$ and $\underline{x}^{\star}_{\tau}$ being the limits. Consider the set $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$. Due to the definition of $\overline{x}_{\tau}[k]$ in (22) and its limit $\overline{x}_{\tau}^{\star}$, one or more normal agents are contained in the union of the sets $\mathcal{X}_{1\tau}(k_{\epsilon}+\ell,\epsilon_{\ell})$ for $0\leq\ell\leq\tau+1$. We claim that $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$ is in fact nonempty. To prove this, it is sufficient to show that if a normal agent $j$ is not in $\mathcal{X}_{1\tau}(k_{\epsilon}+\ell,\epsilon_{\ell})$, then it is not in $\mathcal{X}_{1\tau}(k_{\epsilon}+\ell+1,\epsilon_{\ell+1})$ for $\ell=0,\ldots,\tau$.

Suppose agent $j$ satisfies $\hat{x}_{j}[k_{\epsilon}+\ell]\leq\overline{x}_{\tau}^{\star}-\epsilon_{\ell}$. From Lemma 4.1, every normal agent updates its position to a convex combination of the neighbors’ position values at the current or previous times. Though the neighbors may be malicious here, the ones at positions greater than $\overline{x}_{\tau}[k_{\epsilon}+\ell]$ are ignored in step 2 of DP-MSR. Hence, the position of agent $j$ at the next time step is bounded as

[TABLE]

It thus follows that agent $j$ is not in $\mathcal{X}_{1\tau}(k_{\epsilon}+\ell+1,\epsilon_{\ell+1})$. This means that the cardinality of the set $\mathcal{X}_{1\tau}(k_{\epsilon}+\ell,\epsilon_{\ell})$ is nonincreasing for $\ell=0,\ldots,\tau+1$. The same holds for $\mathcal{X}_{2\tau}(k_{\epsilon}+\ell,\epsilon_{\ell})$.

We next show that one of these two sets in fact becomes empty in finite time. By $(2f+1)$-robustness, between the two nonempty disjoint sets $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$ and $\mathcal{X}_{2\tau}(k_{\epsilon},\epsilon_{0})$, one of them has an agent with $2f+1$ incoming links from outside the set. Suppose that $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$ has this property and let $i$ be the agent in this set which has $2f+1$ neighbors outside $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$. Since there are at most $f$ malicious neighbors for this normal agent, there are at least $f+1$ normal neighbors outside $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$; by the argument above, these normal agents will not be in $\mathcal{X}_{1\tau}(k_{\epsilon}+\ell,\epsilon_{\ell})$ for $0\leq\ell\leq\tau$. By step 2 of DP-MSR, one of these normal neighbors must be used in the updates of agent $i$ at any time. In particular, when agent $i$ makes an update at time $k_{\epsilon}+\tau$, a normal agent’s delayed position is used, upper bounded by $\overline{x}^{\star}_{\tau}-\epsilon_{\tau}$. It thus follows that, at time $k_{\epsilon}+\tau$, when agent $i$ makes an update, its position can be bounded as

[TABLE]

By (24), we have $\hat{x}_{i}[k_{\epsilon}+\tau+1]\leq\overline{x}^{\star}_{\tau}-\epsilon_{\tau+1}$. We can conclude that if agent $i$ in $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$ has $2f+1$ incoming links from outside the set, then it goes outside of $\mathcal{X}_{1\tau}(k_{\epsilon}+\tau+1,\epsilon_{\tau+1})$ after $\tau+1$ steps. Consequently, $\mathcal{X}_{1\tau}(k_{\epsilon}+\tau+1,\epsilon_{\tau+1})$ has the cardinality smaller than that of $\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})$, that is, $\lvert\mathcal{X}_{1\tau}(k_{\epsilon}+\tau+1,\epsilon_{\tau+1})\rvert<\lvert\mathcal{X}_{1\tau}(k_{\epsilon},\epsilon_{0})\rvert$. Likewise, it follows that if $\mathcal{X}_{2\tau}(k_{\epsilon},\epsilon_{0})$ has an agent with $2f+1$ incoming links from the rest, then $\lvert\mathcal{X}_{2\tau}(k_{\epsilon}+\tau+1,\epsilon_{\tau+1})\rvert<\lvert\mathcal{X}_{2\tau}(k_{\epsilon},\epsilon_{0})\rvert$.

Since there are only a finite number $n_{N}$ of normal agents, we can repeat the steps above until one of the sets $\mathcal{X}_{1\tau}(k_{\epsilon}+\tau+1,\epsilon_{\tau+1})$ and $\mathcal{X}_{2\tau}(k_{\epsilon}+\tau+1,\epsilon_{\tau+1})$ becomes empty; it takes no more than $(\tau+1)n_{N}$ steps. Once the set becomes empty, it will remain so indefinitely. This contradicts the assumption that $\overline{x}^{\star}_{\tau}$ and $\underline{x}^{\star}_{\tau}$ are the limits. Therefore, we obtain $\overline{x}^{\star}_{\tau}=\underline{x}^{\star}_{\tau}$. ∎

It is interesting to note that the bound $\tau$ on the delay time in (17) can be arbitrary and moreover need not be known to any of the agents. Hence, in this respect, the condition (17) is not restrictive. A trade-off concerning delay is that longer delays will result in slower convergence. This property can be explained in the proof above as follows. We observe from the monotonicity of $\overline{x}_{\tau}[k]$ and $\underline{x}_{\tau}[k]$ in (22) that the normal agents come together if we look at the $\tau+1$ time step horizon in the past. Finally, note that the convergence rate of the asynchronous update case can be shown to be exponential as in the synchronous case.

Theorem 4.2 demonstrates that to achieve resilient consensus in the partially asynchronous delayed setting requires a more dense graph than that in the synchronous setting in Theorem 3.3. Indeed, from Lemma 2.2, a graph that is $(2f+1)$-robust is also $(f+1,f+1)$-robust. On the other hand, the difference in graph robustness appearing in the two theorems have certain effects on the proofs. For Theorem 4.2, the sets $\mathcal{X}_{1\tau}[k]$ and $\mathcal{X}_{2\tau}[k]$ do not include the malicious agents, while the sets $\mathcal{X}_{1}[k]$ and $\mathcal{X}_{2}[k]$ in the proof of Theorem 3.3 involve both normal and malicious agents. This difference originates from the definitions of $(2f+1)$- and $(f+1,f+1)$-robust graphs. In fact, in the $f$-total model, we see that the second $f+1$ in $(f+1,f+1)$ guarantees that at least one of the agents in $\mathcal{X}_{1}[k]$ or $\mathcal{X}_{2}[k]$ is normal and has enough number of incoming links for convergence. However, $(2f+1)$-robustness is a more local notion. Since the worst-case behavior of the malicious agents happens in the neighborhood of each normal agent, the sets $\mathcal{X}_{1\tau}[k]$ and $\mathcal{X}_{2\tau}[k]$ are defined in this way.

In the above result, we observe that there is a gap between the sufficient condition and the necessary condition. However, this gap may be essential to the problem.

To illustrate this point, we present a $2f$-robust graph in Fig. 3, which is not resilient to $f$ totally bounded faults as we show formally.

This graph is composed of four subgraphs $\mathcal{G}_{i}$, $i=1,\ldots,4$, and each of them is a complete graph. The graph $\mathcal{G}_{1}$ consists of $4f$ agents and the rest have $f$ agents. Each agent in $\mathcal{G}_{2}$ has incoming links from $2f$ agents of $\mathcal{G}_{1}$. Every agent in $\mathcal{G}_{3}$ has $f$ links from $\mathcal{G}_{1}$ and $f$ links from $\mathcal{G}_{2}$. Likewise, each agent of $\mathcal{G}_{4}$ has a link from every agent in $\mathcal{G}_{1}$ and $f$ incoming links from $\mathcal{G}_{2}$. Note that the minimum degree for a $2f$-robust graph is $2f$. However for this graph, the minimum degree of the agents is $2f+1$ or greater. This is an important point for the following reason. If a normal agent has only $2f$ neighbors, it might ignore all of them under the asynchronous DP-MSR algorithm, which in turn means that the agent will remain at its current position. It is clear that if this happens for more than two agents in the network, consensus can not take place. The next proposition is based on this graph.

Proposition 4.3**.**

There exists a 2$f$-robust network with the minimum degree $2f+1$ under which normal agents may not achieve resilient consensus by the asynchronous DP-MSR algorithm.

Proof.

We claim that the graph in Fig. 3 is $2f$-robust and $(f+1,f+1)$-robust at the same time, but resilient consensus cannot be reached under the asynchronous DP-MSR. Suppose that all agents in $\mathcal{G}_{2}$ are malicious. We show a scenario in which by the DP-MSR algorithm, the values of the agents in $\mathcal{G}_{3}$ and $\mathcal{G}_{4}$ never agree. Note that $\mathcal{G}_{1}$ is 2$f$-robust because of Lemma 2.2 (v). By (iv) of this lemma, the graph obtained by adding $\mathcal{G}_{2}$ is still 2$f$-robust, since there are 2$f$ edges from $\mathcal{G}_{1}$. Similarly, adding $\mathcal{G}_{3}$ and $\mathcal{G}_{4}$ and the required edges also keeps the graph to be 2$f$-robust.

We assume that all agents start from stationary positions. Assign $(a,0)$ as the initial position and velocity (for $k=0$ and the prior $\tau$ steps) of the agents in $\mathcal{G}_{3}$ and $(b,0)$ as those of $\mathcal{G}_{4}$. All agents in $\mathcal{G}_{1}$ are given $(c,0)$ as their initial positions and velocities, where $a<c<b$. The malicious agents in $\mathcal{G}_{2}$ take $a$ at even time steps and $b$ at odd time steps. The time delays are chosen by the following scenario: $\tau_{ij}[2m]=0$ and $\tau_{ij}[2m+1]=1$ for $(j,i)\in\mathcal{E},j\in\mathcal{V}_{2}$, $i\in\mathcal{V}_{3}$, and $m\in\mathbb{Z}_{+}$. Also, $\tau_{ij}[2m]=1$ and $\tau_{ij}[2m+1]=0$ for $(j,i)\in\mathcal{E}$, $j\in\mathcal{V}_{2}$, $i\in\mathcal{V}_{4}$, and $m\in\mathbb{Z}_{+}$. All other links have no delay. Then, to the agents in $\mathcal{G}_{3}$, the malicious agents appear to be stationary at $a$ and to the agents in $\mathcal{G}_{4}$ at $b$.

By executing the asynchronous DP-MSR at $k=0$, the agents in $\mathcal{G}_{3}$ will ignore every neighbor in $\mathcal{G}_{1}$ since $a<c$. Thus, for $i\in\mathcal{V}_{3}$, $\hat{x}_{i}[1]=a$. At $k=1$, the same happens for the agents $j\in\mathcal{V}_{4}$ and they stay at $b$. Since the agents in $\mathcal{G}_{3}$ are not affected by any agents with position values larger than $a$, they remain at their positions for all $k\geq 0$. The same holds among the normal agents in the network, and therefore $\hat{x}_{i}[k]=a$ and $\hat{x}_{j}[k]=b$ for all $i\in\mathcal{V}_{3}$ and $j\in\mathcal{V}_{4}$. This shows failure in position agreement. ∎

4.4 Further Results and Discussions

Here, we provide some discussions related to the results of the paper and their potential extensions.

First, it is noteworthy that the result of Theorem 4.2 holds for the $f$-local malicious model as well, which is now stated as a corollary. This follows since in the proof of the theorem, only the number of malicious agents in each normal agent’s neighborhood plays a role.

Corollary 4.4**.**

Under the $f$-local malicious model, the network of agents with second-order dynamics using the control in (18) and the asynchronous DP-MSR algorithm reaches resilient consensus if the underlying graph is $(2f+1)$-robust. The safety interval is given by (4.3).

The underlying graph $\mathcal{G}$ in the results thus far has been fixed, that is, the edge set $\mathcal{E}$ is time invariant. This clearly limits application of our results to, e.g., multi-vehicle systems. We now present an extension for a partially asynchronous time-varying network $\mathcal{G}_{0}[k]=(\mathcal{V},\mathcal{E}[k])$, where the graph $\mathcal{G}_{0}[k]$ plays a role of the original graph $\mathcal{G}$ in the previous discussions. The following definition is the important for the development:

Definition 4.5**.**

The time-varying graph $\mathcal{G}_{0}[k]=(\mathcal{V},\mathcal{E}[k])$ is said to be jointly $(2f+1)$-robust if there exists a fixed $h$ such that the union of $\mathcal{G}_{0}[k]$ over each consecutive $h$ steps is $(2f+1)$-robust.

It is again assumed that time delays are upper bounded by $\tau$ as in (17) and moreover that $\tau$ is no less than the horizon parameter $h$ of $\mathcal{G}_{0}[k]$ as

[TABLE]

We now state the extension for time-varying networks.

Corollary 4.6**.**

Under the $f$-total/$f$-local malicious model, the time-varying network $\mathcal{G}_{0}[k]$ of agents with second-order dynamics using the control in (18) and the asynchronous DP-MSR algorithm reaches resilient consensus if $\mathcal{G}_{0}[k]$ is jointly $(2f+1)$-robust with the condition (25). The safety interval is given by (4.3).

The result follows from Theorem 4.2 since in the proof there, the time-invariant nature of the original graph $\mathcal{G}$ is not used. We also note that similar development is made in [LeBlancPaper] for the first-order agent networks; there, the assumption is that $\mathcal{G}_{0}[k]$ is $(f+1,f+1)$-robust at every time $k$, which is obviously more conservative than that in the above theorem.

Next, we relate the graph properties that have appeared in the resilient consensus problem considered here to those in standard consensus problems without attacks [CaoMorseAnderson, JiahuQin2012, JiahuHirche, Xiao2006]. In this paper, we have assumed that the maximum number of faulty agents is at most $f$. In the case of $f=0$, all conditions in both synchronous and partially asynchronous networks reduce to that of 1-robust graphs. By Lemma 2.2 (iv), such a graph is equivalent to having a directed spanning tree. It is well known that under such a graph, consensus can be achieved.

It is further noted that in the works [Azadmanesh2002, khanafer, Azadmanesh1993, LeBlancPaper, plunkett, Vaidya], malicious agents are allowed not to make any transmissions, which is often called omissive faults. Hence, the normal agent $i$ would wait to receive at least $d_{i}-f$ values from its neighbors before making an update. The necessary and sufficient condition derived in [LeBlancPaper] on the network is $(2f+1,f+1)$-robustness. Compared to the synchronous case, an extra $f$ is needed because of the omissive faults, but the analysis remains mostly the same. It should be noted that omissive faults can also be tolerated by the MSR-type algorithms of the paper. The malicious agents knowing that the normal agents apply the DP-MSR algorithm might attempt to make this kind of attack to cause lack of information in step 2. In such cases, if agent $i$ does not receive the information of $m_{i}[k]$ incoming links at time $k$, then the parameter of the asynchronous DP-MSR for that agent can be changed from $2f$ to $2(f-m_{i}[k])$.

Furthermore, the DP-MSR algorithms for $f$-total malicious models are resilient against another type of attacks studied in [Feng]. There, the attackers can create extra links in the networks, but adding links does not change the value of $f$ of the networks. In contrast, in the case with the $f$-local model, the situation is slightly different. Adding a link might increase the number of malicious neighbors for some normal agents. Accordingly, the agents must be aware of the created links so as to remove them along with the edges ignored in step 2 of DP-MSR.

Finally, we discuss the two versions of consensus problems for second-order agent networks. In this paper, we have considered the case where all normal agents agree on their positions and then stop. The other version is where normal agents aim at agreeing on both their positions and velocities, so they may be moving together at the end [Cheng-Lin, renbook2, YU]. This can be realized via the control law

[TABLE]

This version of consensus is difficult to deal with based on MSR-type algorithms when malicious agents are present. We may extend them so that not only the positions but also the velocities of extreme values are ignored at the time of updates. It is however hard to prevent situations, for example, where the normal agents follow a malicious agent which moves away from them at a “gentle” speed within the normal range; it seems unreasonable to call such a situation to be resilient.

5 Numerical Example

Consider the network of five agents in Fig. 1. As mentioned earlier, this graph is $(2,2)$-robust. One of the agents is set to be malicious. The bound on the number of malicious agents is fixed at $f=1$. We use the sampling period as $T=0.3$ and the parameter as $\alpha=3.67$.

Synchronous Network. First, we carried out simulations for the synchronous case. The initial states were chosen as \left[\hat{x}^{T}[0]~{}v^{T}[0]\right]=\big{[}10~{}4~{}2.5~{}1~{}8~{}0~{}{-6}~{}{-5}~{}1~{}4\big{]}. Agent 1 is set to be malicious and stays at its initial position 10. By (3.3), the safety interval is $\mathcal{S}=[0.19,8.54]$. Fig. 4 shows the time responses of their positions with the conventional control from [renbook2] where in (2), all $a_{ij}[k]$ are constant based on the original graph $\mathcal{G}$. The normal agents achieve agreement, but by following the malicious agent. Thus, the safety condition is not met.

Next, we applied the DP-MSR algorithm and the results are given in Fig. 6. This time, the normal agents are not affected by the malicious agent 1 and achieve consensus inside the safety region $\mathcal{S}$, confirming Theorem 3.3. In the third simulation, we modified the network in Fig. 1 by removing the edge $(2,5)$ and ran the DP-MSR algorithm. The graph is in fact no longer $(2,2)$-robust. We see from Fig. 6 that consensus is not attained. In fact, agent 5 cannot make any updates because it has only two neighbors after the removal of the edge.

Asynchronous Delayed Network. Next, we examined the partially asynchronous delayed version of the protocol. This time, agent 4 is chosen to be malicious. Here, the normal agents make updates periodically with period 12, but at different timings: Agents 1, 2, 3, and 5 update at time steps $k=12\ell+6,12\ell+9,12\ell+11,12\ell+4$ for $\ell\in\mathbb{Z}_{+}$, respectively. We assume that at these time steps, there is no delay for their updates. Since the normal agents do not receive new data at other times, we have $\tau=11$. By this setting, each agent deals with nonuniform time-varying delays. The initial states of the agents are given by \left[\hat{x}^{T}[0]~{}v^{T}[0]\right]=\big{[}4~{}10~{}8~{}9~{}1~{}0~{}{-1}~{}{-1}~{}4~{}3\big{]}. The safety interval in (4.3) becomes $\mathcal{S}_{\tau}=[0.865,10.54]$. In this case, the malicious agent 4 can move so that each normal agent sees it at different locations. We set its control as $u_{4}[k]=({(-1)^{k}}/{T^{2}})\left(-40T+14(2k+1)\right)$, which makes agent 4 oscillate as $\hat{x}_{4}[2k]=2$ and $\hat{x}_{4}[2k+1]=9$, $k\geq 0$.

In Fig. 8, the time responses of the positions of normal agents are presented. Though the underlying network is $(2,2)$-robust, as the necessary condition in Theorem 4.2, the normal agents do not come to consensus. This is an interesting situation since the asynchronous DP-MSR cannot prevent the normal agents from being deceived by the malicious agent. Fig. 8 indicates that in fact agents 2 and 3 stay around $\hat{x}_{i}=9$ while agents 1 and 5 remain around $\hat{x}_{i}=3.7$. So the agents are divided into two groups and settled at different positions because of the malicious behavior of agent 4, appearing at two different positions. Finally, we modified the graph to be complete, which is the only $3$-robust graph with 5 nodes. The responses in Fig. 8 verify the sufficient condition of Theorem 4.2 for the partially asynchronous setting.

6 Conclusion

We have studied resilient consensus problems for a network of agents with second-order dynamics, where the maximum number of faulty agents in the network is known. We have proposed MSR-type algorithms for the normal agents to reach consensus under both synchronous updates and partially asynchronous updates with bounded delays. Topological conditions in terms of robust graphs have been developed. Various comparisons have been made with related results in the literature of computer science. In future research, we will consider using randomization in updates to relax the robustness conditions (see [dibajiishiitempoACC2016]).