ECLSS Sensor Spoofing (2D): Life-Support Intrusion Detector

Attack

Spoof magnitude on Sensor 2 +4.0 kPa

Defense

Detection threshold 2.0 kPa

Sensor redundancy 3 sensors

Cabin Telemetry

Nominal — all sensors agree

True cabin pO₂

21.3 kPa

Controller believes

21.3 kPa

Detection rate

False-alarm rate

Sensor trusted / in vote Sensor flagged as spoofed Compromised sensor (ground truth)

How it works

A spacecraft's Environmental Control and Life Support System (ECLSS) keeps cabin oxygen partial pressure near a setpoint using a PI controller reading several redundant sensors:

error   = setpoint − believed_pO2
g(t)    = clamp(kp·error + ki·∫error dt, 0, g_max)
dpO2/dt = g(t) − c        (c = crew consumption)

This is a textbook false-data-injection attack (FDIA): an attacker with access to Sensor 2's telemetry link adds a constant bias to its reported reading, without touching the physical cabin. If the controller trusts a simple mean of the sensors, one poisoned reading pulls the average — the controller "believes" oxygen is higher than reality and throttles the generator down, so the true pO2 drifts toward hypoxia (below ≈16 kPa) while the believed value looks fine.

Turning on voting defense switches the estimator to the median of all readings — a robust statistic that a single outlier cannot move, as long as the other sensors still agree. A sensor is additionally flagged when its deviation from the median exceeds the detection threshold.

Spoof magnitude — constant bias (kPa) the attacker adds to Sensor 2's reported value once the attack is on.
Voting Defense — switches the controller's estimator between median (robust) and mean (vulnerable).
Detection threshold — deviation from the median (kPa) above which a sensor is flagged red. Too low and sensor noise alone trips false alarms; too high and a real spoof slips through undetected.
Sensor redundancy — how many independent sensors vote. More sensors make the median harder to move and give the detector more evidence per reading, which raises the detection rate and lowers the false-alarm rate at the same threshold.

The detection rate tracks how often the compromised sensor gets correctly flagged while the attack is running; the false-alarm rate tracks how often a healthy sensor gets incorrectly flagged. This trade-off — tightening the threshold catches attacks faster but also flags more noise — is exactly what NASA's triple-modular-redundancy avionics and ISS life-support telemetry are tuned around.