A spacecraft's Environmental Control and Life Support System (ECLSS) keeps cabin oxygen partial pressure near a setpoint using a PI controller reading three redundant sensors:
error = setpoint − believed_pO2
g(t) = clamp(kp·error + ki·∫error dt, 0, g_max)
dpO2/dt = g(t) − c (c = crew consumption)
This is a textbook false-data-injection attack (FDIA): an attacker with access to Sensor 2's telemetry link adds a constant bias to its reported reading, without touching the physical cabin. If the controller trusts a simple mean of the three sensors, one poisoned reading pulls the average — the controller "believes" oxygen is higher than reality and throttles the generator down, so the true pO2 drifts toward hypoxia (below ≈16 kPa) while the believed value looks fine.
Turning on voting defense switches the estimator to the median of the three readings — a robust statistic that a single outlier cannot move, by definition, as long as the other two sensors still agree. A sensor is additionally flagged when its deviation from the median exceeds the detection threshold, exposing the attack even though the median already neutralizes its effect on control.
- Spoof magnitude — constant bias (kPa) the attacker adds to Sensor 2's reported value once the attack is on.
- Attack ON/OFF — toggles the false-data injection.
- Voting Defense ON/OFF — switches the controller's estimator between median-of-3 (robust) and mean-of-3 (vulnerable).
- Detection threshold — deviation from the median (kPa) above which a sensor is flagged red.
Real-world relevance: this median/majority-voting pattern is exactly what triple-modular-redundancy avionics and spacecraft ECLSS controllers use to stay correct in the presence of a single faulty or compromised sensor — the same principle NASA uses for ISS life-support telemetry and flight computers.