Platoon Stability and Safety Analysis of Cooperative Adaptive Cruise Control under Wireless Rician Fading Channels and Jamming Attacks
Abstract
Cooperative Adaptive Cruise Control (CACC) is considered as a key enabling technology to automatically regulate the intervehicle distances in a vehicle platoon to improve traffic efficiency while maintaining safety. Although the wireless communication and physical processes in the existing CACC systems are integrated in one control framework, the coupling between wireless communication reliability and system states is not well modeled. Furthermore, the research on the impact of jamming attacks on the system stability and safety is largely open. In this paper, we conduct a comprehensive analysis on the stability and safety of the platoon under the wireless Rician fading channel model and jamming attacks. The effect of Rician fading and jamming on the communication reliability is incorporated in the modeling of string dynamics such that it captures its state dependency. Timedomain definition of string stability is utilized to delineate the impact of Rician fading and jamming on the CACC system’s functionality and string stability. Attacker’s possible locations at which it can destabilize the string is further studied based on the proposed model. From the safety perspective, reachable states (i.e., intervehicle distances) of the CACC system under unreliable wireless fading channels and jamming attacks is studied. Safety verification is investigated by examining the intervehicle distance trajectories. We propose a methodology to compute the upper and lower bounds of the trajectories of intervehicle distances between the lead vehicle and its follower. We conduct extensive simulations to evaluate the system stability and safety under jamming attacks in different scenarios. We identify that channel fading can degrade the performance of the CACC system, and the platoon’s safety is highly sensitive to jamming attacks. The best location to launch the jamming attack to destabilize the platoon is above the second vehicle in the platoon. The platoon is more vulnerable to jamming attacks when the lead vehicle is decelerating.
Cooperative Adaptive Cruise Control, VehicletoVehicle Communication, Wireless Rician Fading Channel, Jamming Attacks, Platoon Stability, Safety, Reachability Analysis
1 Introduction
\IEEEPARstartVehicular Cyberphysical systems (CPS) expand the capabilities of the vehicles through the integration of computation, communication, and control [1]. Vehicle platooning is one of the important vehicular CPS applications that operates based on tight coupling of cyber part (wireless communication) and physical processes (Vehicles dynamics response and intervehicle distances). It will be an indispensable part of intelligent transportation system (ITS) in the future [2].
Cooperative Adaptive Cruise Control (CACC) system as an extension of Adaptive Cruise Control (ACC) is proposed to improve vehicle platooning performance and efficiency [3, 4, 5]. With CACC, vehicles in a platoon adjust their intervehicle distances autonomously such that they can line up as close as possible in order to improve traffic throughput. In the CACC system, absolute relative distance and velocity information is measured by the radar and preceding vehicle’s acceleration information is sent over the wireless link to the follower vehicle. These information are fed into the feedback and feedforward controllers to compute the control command of the corresponding vehicle. CACC system alleviates traffic congestion, improves mobility and increases road safety [6]. In addition, this technology reduces fuel consumption and provides better comfortability for the passengers compared with solely human controlled vehicles [7].
Despite the tremendous benefits provided by CACC system, the wireless communication between vehicles is subject to channel fading and jamming attacks, which leads to undesirable packet loss, and in turn introduce significant disturbances in safe and efficient operation of the system [8]. However, the impact of wireless channel fading and jamming attacks on the stability and safety of CACC systems is not well modeled nor understood in the existing literature. The main challenge lies in the tight coupling of cyber (wireless communication) and physical states (intervehicle distance). In a CACC enabled vehicle platoon, the distance between vehicles may change depending on the lead vehicle’s behavior and spacing policy [9]. This variation in intervehicle distance affects the wireless channel conditions in terms of fading and path loss, which further affects the receivedsignalstrength (RSS) and packet delivery ratio. However, in the existing literature, the consideration of this coupling between the system state (intervehicle distance) and wireless channel conditions is missing [4, 5, 10, 11, 12].
In this paper, we investigate the performance of CACC system subject to channel fading and jamming attacks. Dynamic intervehicle distance variation will change the instantaneous channel quality condition established between two consecutive vehicles in the platoon. On the one hand, wireless channel state condition has a direct and effective impact on the intervehicle distance state evolution in the vehicle longitudinal modeling. On the other hand, the intervehicle distance state evolution will have a strong effect on channel state condition as well. This cyber and physical state coupling is addressed in this paper which plays an important role in analyzing CACC system’s stability and safety. We also need to mention that the words platoon and string are used interchangeably in this paper.
Furthermore, with the assumption of Rician fading channel, we study the string stability of the CACC system under a mobile jamming attack. The attacker jams the wireless channel established among the vehicles in order to prevent the receivers from decoding the packets with the purpose of destabilizing the platoon. If the attacker is successful in jamming the wireless communication, the CACC system will not work in the normal condition until the next packet is received successfully. We evaluate the impact of jamming attack on the mean string stability by employing the timedomain definition of string stability.
We summarize the main contributions of the this paper as below.

In this work, the cyberphysical state coupling in platoon with CACC is modeled. That is, the coupling between cyber (wireless communication) and physical state (intervehicle distance) is addressed.

Minimum headwaytime value is obtained in the frequency domain by nonliner programming. The timedomain string stability is validated by the frequency domain analysis.

Based on the modeling, we analyze the platoon stability considering various scenarios with different settings, including various attacker’s and vehicle’s signal transmission power. As a defending strategy against jamming attack, minimum vehicle’s signal transmission power is computed such that the mean string stability is maintained.

We study the attacker’s best locations at which it can destabilize the string when the communication channels are under jamming attacks.

We study the impact of Rician fading on the reachable intervehicle distance states in the platoon.

We propose a methodology to compute the lower and upper bounds of the intervehicle distance between the lead vehicle and its follower. The impact of Rician fading and jamming attacks on the intervehicle distance trajectories are studied from the safety perspective.

We conduct extensive simulations to analyze the string stability and the intervehicle distance states evolution in the platoon under various system settings and scenarios.
Through our analysis and simulation evaluation, we make the following findings.

Channel fading can degrade the performance of the CACC system.

The platoon is highly sensitive to jamming attacks, and its stability and safety can be compromised by a jammer.

The attacker’s location being close to the second vehicle in the platoon (first vehicle following the lead vehicle) is the best location for the mobile jamming attacker to destabilize the platoon.

The platoon is more vulnerable to jamming attacks when the lead vehicle is decelerating. This finding is expected to motivate more future research on physical stateaware cyber attacks and defenses for CACC systems in specific and cyberphysical systems in general.
2 Related Work
String stability has been analyzed in the frequency domain for the massspringdamper framework of unidirectional (forwardlooking) and bidirectional (forwardandbackwardlooking) control strategies by Diana et al. [13]. Required conditions for control parameters and variable headwaytime have been derived for the constant and velocitydependent space policy. Intervehicle communication is also integrated for the constant spacing policy with unidirectional control scheme. Vehicles in the platoon receive the lead vehicle’s velocity information through wireless communication. This information flow is modeled as an additional damper, connecting each vehicle’s mass in the platoon to the lead vehicle’s mass. This work represents a fundamental analysis on string stability for different control strategies. However, in the cooperative (forwardlooking with wireless communication) framework, it does not address the impact of wireless channels’ uncertainty introduced by path loss and fading on the system performance. Wireless jamming attack is not a concern in this work.
Similarly, other existing works [4, 14, 15] consider normal operation of CACC system without any consideration of packet loss due to wireless channel fading or jamming attacks. The frequency response of the system is derived in these cases and the string stability is analyzed in a fairly nice format in the frequencydomain.
Necessary and sufficient conditions for string stability of a heterogeneous platoon are studied by Naus et al. [4]. Network delay and sampling effects are introduced in the string stability analysis by Öncü et al. [5]. The delay is assumed identical in all the communication links and string stability is investigated for various sampling intervals and headwaytimes. In [10], the robustness of a CACC system to communication delays is studied and an upper bound on the delay required for stability is derived. However, the impact of intervehicle distance on the wireless communication reliability is not considered in these works.
There are few works studying the security of vehicle platooning in terms of attacking on wireless communication or control components. In [16], an insider attacker attacks on controller gains of a vehicle in the platoon. The attacker has the capability of modifying the gains such that it can destabilize the platoon. In [17], massspringdamper follower dynamics model is considered for studying the platoon performance under attack. A new class of the attack based on vehicle misbehavior is proposed. It shows that the attacker is effective when the attacker is near the rear of the platoon. However, our work is different from [17] in terms of platoon modeling, attacker’s nature, purpose of the attack, and the evaluation method employed to measure the impact of the attack. In another work [8], various security vulnerabilities on the CACC system have been identified. Message falsification and radio jamming attack’s effect are studied through Vehicular Network Open Simulator. However, the CACC control structure and jamming attack strategies are considered as a black box in the simulation environments. The coupling between the system states and wireless communication channel condition is not well modeled.
In [18], string stability under stochastic communication delays has been studied. Packet drops introduce random delay that follows geometric distribution for each discrete time. Nonlinear controller’s gains are designed such that the string stability can be maintained while wireless communication channels among vehicles suffer from packet loss. In this work, it is assumed that packet drop distribution is independent of string’s dynamics instant states. In other words, state dependency of packet loss has been ignored. However, as we identified, physical states variation influence communication reliability and vise verse. Path loss, fading impact on packet delivery ratio, and system’s performance are missing in this work.
In our previous work [19], we considered tworay groundreflected propagation model on the channels [20]. However, in the current paper, Rician fading channel is modeled such that it takes the distance state dependency into consideration. In [19], string stability has been analyzed based on fixed setting parameters, while in this paper, we examine various system parameters and settings. Furthermore, we investigate the impact of jammer’s and vehicle’s signal power on the string stability. We propose a methodology to compute the lower and upper bounds of the intervehicle distance between the lead vehicle and its follower. The impact of Rician fading and jamming attacks on the intervehicle distance trajectories are studied from the safety perspective.
3 System Model
In this section, we describe the models of platoon with CACC, wireless channel, and a mobile jammer.
3.1 Vehicle String
We consider a platoon of vehicles consisting of () homogenous vehicles (identical longitudinal dynamic properties) shown in Figure 1. Each vehicle is equipped with a CACC system. In other words, each vehicle is equipped with a radar in front of the vehicle to measure the absolute relative distance from the vehicle ahead of it. At the same time, V2V wireless communication (e.g., using IEEE p Dedicated Short Range Communication (DSRC) technology [21]) is used to transmit each vehicle’s acceleration information to its following vehicle. Similar to the assumptions in [3], the acceleration information of each vehicle is sent every ms to the following vehicle.
3.2 Wireless Channel
Each vehicle in the platoon receives/sends the acceleration information from/to its immediately preceding/following vehicle. Therefore, a wireless channel is established between each two consecutive vehicles in the platoon.
In the vehicle platooning with CACC and velocitydependent spacing policy, the intervehicle distances are changing according to the control parameters’ setting and the lead vehicle’s action. Thus, because of the vehicles’ mobility and possible lineofsight and multipath signal propagation, we assume Rician fading channel model for the wireless communication channels among the vehicles. In Rician fading stochastic model, direct path signal’s power appears stronger than the signal’s power in the scattered paths. However, the received signal amplitude is subject to fading which follows the Rician fading distribution [22]. Moreover, depending on the intervehicle distances, free space path loss affects the received signal power level at the receiver of each vehicle.
3.3 Attacker
We consider a mobile jammer, which can be mounted on a drone flying over the platoon. Since the power source of the drone is limited, we assume a reactive jammer [23]. A reactive jammer has the capability of sensing channels and launching its jamming signal whenever the vehicles transmit their acceleration information through the wireless medium [23]. All the legitimate established wireless links among each pair of transmitters and receivers in the platoon are under jamming attacks.
4 CACC Control Structure and String State Space Representation
4.1 Longitudinal Vehicle Dynamics
The common linearized thirdorder state space representation used for modeling longitudinal vehicle dynamics is as follows [5]
(1) 
where , , and are absolute position, velocity, and acceleration of the th vehicle, respectively. and represent the internal actuator dynamics and the commanded acceleration of the th vehicle, respectively. The transfer function of the longitudinal vehicle dynamics is derived as follows:
(2) 
where and represent the Laplace transformation of the absolute position and the commanded acceleration of the th vehicle, respectively.
4.2 CACC Control Structure
The structure of a CACC system is shown in Figure 2. In this model, represents the spacing policy dynamics. Headwaytime constant, , indicates the time that it takes vehicle () to arrive at the same position as its preceding vehicle (). Several spacing policies have been studied in the literature [13, 4]. In this paper, we consider velocitydependent spacing policy for the control structure of the CACC system which has been used in [4, 5, 13] . This spacing policy assists each vehicle in the platoon to not only maintain a safe distance with its preceding vehicle at high speeds, but also increases the traffic throughput on the roads by reducing the intervehicle distances as much as possible. String stability requirement is highly affected by the value of headwaytime ; as a result, this parameter plays a crucial role in operating a safe and efficient CACC system. Considering velocitydependent spacing policy, the desired distance is defined as . That is, the distance between the two vehicles increases if the velocity of the preceding vehicle increases, and vice versa. Therefore, spacing error , at each time instant can be determined by the difference between the actual relative distance, , measured by the radar, and the desired distance, , as follows:
(3) 
In the CACC control structure shown in Figure 2, is a feedback (PD) controller where is the bandwidth of the controller and is chosen such that [5]. The PD controller parameters and are set up in such a way that the internal stability of the vehicle dynamics is satisfied. In [4], the feedforward controller has been designed such that the zero steady state spacing error ( as ) defined in (3) is achievable. In the CACC control structure, and represent the feedback and feedforward controllers’ output, respectively. The summation of these two outputs provide the commanded acceleration for the th vehicle.
We also use a low cost memory block in the CACC control structure which has the capacity for saving only one packet information. Each time, if the memory receives the packet successfully, it updates the information; otherwise, it keeps the last successful received information. This policy will be modeled in section V and then incorporated in state space representation of the string under wireless Rician fading channels and jamming attacks. The ZOH (Zero Order Holder) in the CACC control structure also converts the input discretetime signal to the continuoustime signal which then is fed into the feedforward controller shown in Figure 2.
4.3 CACC State Space Representation
State space representation of the CACC control structure in Figure 2 is given in [5]. For further analysis we add the intervehicle distance state to this representation as follows:
(4)  
The commanded acceleration of the th vehicle, , is transmitted through the wireless channel to the th vehicle. The received acceleration information is denoted by at the receiver of the following vehicle . From (4) we see that the output of the feedforward controller, , depends on the received commanded acceleration, , of the th vehicle. For simplicity, we omit the continuoustime domain representation in the remained article. The commanded acceleration , which is the summation of feedback and feedforward controller’ outputs, is derived as follows:
(5)  
By substituting (5) in (4), the continuoustime CACC state space representation can be expressed as
(6) 
where , for and
Since the lead vehicle does not follow any vehicles, it will not receive any information through wireless or its radar.
As a result, the lead vehicle dynamics will be different from the other vehicles’ dynamics in the platoon.
The lead vehicle dynamics is defined by as
(7) 
where
4.4 Vehicles String State Space Representation
The state space representation of the CACC control structure in a vehicle string is as follows [5]:
(8) 
where is an arbitrary commanded acceleration taken by the lead vehicle and
and represents the augmented state space variables of the vehicles’ dynamics in the string. In (8), is a vector where its elements denote the received acceleration information of vehicle (for ) in its immediately following vehicle. The first element in the vector (zero value) indicates that the lead vehicle does not receive any acceleration information.
Considering that the DSRC transmission policy is based on sending out the data every over the wireless network [21, 3], the signal at times is sampled for and , to represent the DSRC functionality. This also means that if the packets are received successfully, then the following vehicle’s receiver will get updated in a fixed periodic transmission manner. The following state space representation captures the signal sampling and holding it by the ZOH in the receiver.
4.5 String Stability
The lead vehicle’s acceleration and deceleration will produce spacing error between th and ()th vehicle in the platoon for . String stability requires spacing error attenuation along the vehicle string. In other words, a string will be stable if the generated spacing error as a result of the lead vehicle’s action does not get amplified when it propagates upstream the string. This requirement is expressed as follows [10]:
(11) 
where denotes the infinity norm which determines the maximum absolute value of the corresponding spacing error in a time horizon of . In other words, the timedomain definition of the string stability is given by
(12)  
Equation (12) indicates that string will be stable if and only if the maximum absolute value of the produced error in a time horizon of gets diminished as it propagates upstream the string.
When the dynamic of the CACC system is deterministic as in (9), string stability is evaluated by the frequency domain definition and string will be stable if the following condition is satisfied [4]:
(13) 
where represents the Fourier transformation of the spacing error for the th vehicle.
However, when communication uncertainty is introduced into the CACC dynamics, state space variables will be stochastic variables which determine the CACC system’s behavior. For clarity, we use bold letters to denote the stochastic state space variables. In order to study the string stability while considering stochastic dynamics for the CACC systems, the concept of mean string stability is defined as
(14)  
where represents the expected value.
In the next section, we will incorporate jamming attack and wireless channel condition effects into (10) in order to analyze the mean string stability and reachable intervehicle distance states for safety verification.
5 Integrating Jamming Attack and Rician Fading into CACC Model
In this section, we model jamming attack and Rician fading impact on the state space representation of the string. The model captures the dependency of the physical states (intervehicle distances) on the cyber part (unreliable wireless channel states) and vice versa. Each packet sent by the vehicles can be lost due to Rician fading or the attacker’s destructive signal. This uncertain packet delivery affects the error propagation along the vehicle string and the intervehicle distance states evolution in the platoon.
5.1 Attack Model
Basically practical studying of behavior of vehicular platooning requires considering real scenarios. Because of the vehicles’ mobility, the jammer is considered as a mobile attacker. Recall that we assume a reactive jammer mounted on a drone flying over the platoon emits its jamming signal over the wireless network whenever it senses that the communication traffic is happening in the network [23]. The jammer’s destructive signal is considered as an additive Gaussian random variable with known and constant mean () and variance (). The jammer’s transmitted signal power is calculated as , [24]. This jamming model is a flexible model for representing a wide range of jamming signal scenarios. The ratio represents the jamming signal’s features in terms of signal’s power. For example, when or , the jamming signal becomes a zeromean Gaussian random variable which generates a very powerless noise signal rather than a strong jamming signal. Whereas, when or , jamming signal appears as a constant jamming signal with Additive White Gaussian Noise (AWGN) in the model. However, the general scenario will be the case that . In this case, there is a strong jamming signal with noise in the medium that jammer’s antenna beam covers.
The mean power of the jammer’s signal at the receiver of the th vehicle at time considering free space path loss model is obtained as
(15) 
where,
(16) 
for .
and denote the jammer and vehicles’ receiver antenna gain, respectively. indicates the path loss exponent, is the associated wavelength ( is speed of light and is the carrier frequency). denotes the drone’s vertical distance from the platoon (Figure 1). In (16), represents jammer distance from th vehicle when the jammer is located above the th vehicle in the platoon at time .
According to the velocitydependent spacing policy, if the lead vehicle’s velocity increases, the actual distance between a pair of vehicles in the platoon increases as well and vice versa. Therefore, the distance between the jammer and each vehicle in the platoon () depends on the lead vehicle’s acceleration profile. Consequently, we conclude that since is a function of , then the mean power of the jammer’s signal at the receiver of each vehicle is also influenced by the lead vehicle’s acceleration profile.
5.2 Attack and Rician Fading Model Integration
As the distance between each pair of transmitter and receiver keeps changing, received signal strength is also varying. We consider free space path loss model for the received signal’s power level variation with respect to the instant intervehicle distance. Thus, the received signal power at the receiver of the th vehicle at time is expressed as
(17) 
where and denote the transmission signal power of the th vehicle and transmitter antenna gain, respectively.
We consider the jammer’s signal as an interference signal that is added to the ambient noise. Thus, we compute signaltointerferenceplusnoise ratio (SINR) to derive the probability of successful packet delivery. Once the attacker launches its jamming signal over the platoon, average SINR of the received signal of the th vehicle at time is derived by
(18) 
where represents the mean power of ambient noise which is considered as an additive Gaussian random variable with zero mean and variance . From (18), we see that the average SINR is a function of distance states (), which indeed indicates the dependency of wireless channel quality on the system states.
As stated in the system model, each vehicle in the platoon receives its immediate preceding vehicle’s commanded acceleration information. Thus, due to the possessing lineofsight communication channel between each transmitter and receiver, Rician fading channel model is considered as a fairly good stochastic model for this class of signal transmission and environment. In this model, received signal amplitude has a Rician probability density function. With the assumption of Rician fading, the probability density function of instantaneous SINR, , is expressed as follows [25, 22]:
(19) 
where is the Rician fading parameter and represents the ratio of the received signal’s power in the LOS component to the nonLOS scattered multipath components. When , the channel is equivalent to a static additive white Gaussian noise (AWGN) channel, and with , the channel reduces to Rayleigh fading channel. is the zero order modified Bassel function of the first kind.
To decode a received packet successfully, the instantaneous SINR should be greater than an acceptable SINR () [25]. Therefore, the probability of successful packet delivery is defined as follows:
(20) 
where denotes the probability. and are the firstorder Marcum Q function and the cumulative distribution function (CDF) of the instantaneous SINR, respectively. In (20), , for , denotes the probability of successful packet delivery of the th vehicle at the th vehicle’s receiver at time . In fact, has the opposite meaning of outage probability which is defined as the probability that the instantaneous SINR () drops below the acceptable SINR (). This probability is time variable and at each time, it depends on the average SINR derived in (18), which is also an state dependent function. Other parameters such as transmitters’ power, attacker’s power and its distance from each receiver also affect the successful packet delivery probability.
Now, we define a Bernoulli random variable to indicate the packet successful delivery as follows:
(21) 
for and .
Considering that each receiver has a memory unit (memory unit keeps the last successfully decoded acceleration information received from the immediate preceding vehicle and feeds it to the ZOH), and its values backward in time are defined as follows:
(22)  
for and .
Note that in (22), indicates the acceleration information of the ()th vehicle before transmission whereas, denotes the output of the memory unit in the CACC control structure.
Considering the recursive format of (22), can be expressed as
(23) 
Therefore, state space representation of the platoon under Rician fading channel and jamming attacks is derived as follows:
(24) 
where
and is an arbitrary commanded acceleration taken by the lead vehicle.
Equation (24) shows that except for the lead vehicle commanded acceleration , other vehicles commanded acceleration value will be a random variable and are computed recursively with respect to time.
We will use the stochastic dynamical system of the CACC system presented in (24) to study the wireless communication uncertainty and jamming attacks impact on the string stability and safety.
6 String Stability Analysis
Existing string stability analysis are based on frequencydomain techniques [4, 13, 18, 15]. However, for the stochastic dynamical system obtained in (24), frequencydomain analysis method cannot be employed because of timevarying probabilistic packet successful delivery at each receiver. In order to tackle this challenge, we employ timedomain method for analysis of string stability and distance states evolution of CACC system under Rician fading channel and jamming attacks. Next, first we validate the timedomain method through comparing it with frequencydomain method for the case of perfect channel condition (No fading, No attack), and normal operation of the platoon. Then, for the remained subsections, timedomain analysis is utilized to evaluate the impact of Rician fading channel and jamming attacks on the CACC performance and functionality.
Number of vehicles following the lead vehicle  

Internal actuator dynamics  
Derivative constant  
Proportional constant  
Carrier frequency  [GHz] 
6.1 CACC System Settings
We consider a platoon constructed with vehicles plus the lead vehicle. The lead vehicle’s index is zero and the rest of the vehicles are ordered from one to ten moving down the platoon. We assume that the vehicles are homogenous and the internal actuator dynamics are identical for all vehicles in the platoon ( for ). Also, and for are chosen to satisfy the internal stability of the vehicle dynamics. A summary of simulation configuration are listed in Table 1. The simulation set up parameters’ value mentioned in Table 1 are fixed through out all the remained sections. Simulation computations are performed with Matlab software.
6.2 String Stability Analysis and Headwaytime Optimization (No Fading and No Attack)
We assume perfect channel condition, no fading and no attack scenarios, for all the V2V wireless communication channels in the platoon. In other words, all the packets are delivered and decoded at each receiver without being delayed or dropped. To analyze the string stability in the frequency domain, we derive transfer function of string stability for the CACC and ACC (CACC without V2V communication) modes using the control structure shown in Figure 2. By solving the following nonlinear deterministic optimization problem, the minimum headwaytime is obtained by which string stability is guaranteed.
minimize  
subject to  
where,
(25) 
and,
(26) 
are string stability transfer functions for the ACC and CACC modes, respectively. Optimization problem is solved via GAMS software [26]. Minimum headwaytime for the ACC and CACC modes are obtained as seconds and seconds, respectively. Figures 3(a) and 3(c) illustrate the string stability analysis of ACC and CACC systems in the frequency domain. These results, show the string stability transfer function’s absolute magnitude for various headwaytimes against the wide range of frequencies (). Using the string stability definition in (13), in Figures 3(a) and 3(c), for the headway times for which the absolute value of exceeds the value of , string becomes unstable. To demonstrate the performance of ACC and CACC systems under equal settings, a video of full demo is displayed at https://youtu.be/B1ls0HaGULs.
Now, we analyze the string stability in the timedomain and validate the results by comparing them with the results of the frequency domain analysis. We generate commanded acceleration profiles for the lead vehicle using the random phase multisine signal generation method [27, 28]. This method has been used in [5] to generate velocity profile for the lead vehicle. Produced acceleration profiles model the lead vehicle’s realworld actions. One sample of the lead vehicle’s acceleration and the corresponding velocity profile up to seconds are shown in Figures 4(a) and 4(b), respectively.
In the timedomain, maximum spacing error produced at each vehicle in a time horizon of seconds is computed for the ACC and CACC modes for various headwaytimes. The results are illustrated in Figures 3(b) and 3(d).
For the case of ACC system, by comparing the results in both frequency and time domains, Figures 3(a) and 3(b), we observe that when the headwaytime is below 1.5 seconds the string gets unstable. However, string is stable for both domains when the headwaytime is set to 2.2 seconds and 3 seconds. For the case of CACC system, Figures 3(c) and 3(d) show that in both domains for the headwaytime of 0.2 seconds, string is unstable. However, string is stable for the headway times of 0.5 seconds, 1 second and 2 seconds. The results are consistent with the solutions obtained from the optimization problem in (6.2). Through on the comparison of the analysis, we conclude that string stability analysis of both frequencydomain and timedomain are highly consistent and endorse each other. Based on the time and frequency domains consistency, next we aim to analyze the mean string stability and reachable intervehicle distance states in the timedomain when V2V wireless communication is subject to Rician fading channel and jamming attacks.
Vehicles initial velocity  [mph] for 

Vehicles initial commanded acceleration  
Vehicle initial spacing error  
Headway time  1 second 
Jamming signal mean  
Jamming signal variance  
Noise power  [dBm] 
Constant Vehicle’s transmission power  [dbm]for 
Threshold SINR  dB 
Transmitter and aeceiver antenna gains  [dBi] 
Jammer anntenna gain  [dBi] 
path loss component  
Vertical distance of drone from platoon  m 
Rician fading parameter 
6.3 Impact of Jamming Attack
In this subsection, we study the impact of jamming signal power and the attacker’s location on the string stability. We assume that the jammer is mounted on a drone, flying over the platoon. The attacker emits its jamming signal over the platoon wireless communication network in the whole time horizon. We assume that the attacker (i.e. drone) has been equipped with an appropriate adaptive velocity controller such that it has the capability of maintaining the same speed as the vehicles in the platoon. The drone also maintains a fixed altitude from the platoon. We also assume that the signal transmission power for all the vehicles () is fixed () and identical on all the time for all the scenarios considered in this subsection. The mobile jammer’s signal power is also fixed, , all the time for all scenarios in this subsection. We also set the headway time to second ( second) in the control structure of CACC system. Table 2, summarizes the simulation parameters’ value complementary to the Table 1.
We generate acceleration profiles to cover as many as possible actions that the lead vehicle can take. The profiles are generated using the random phase multisine signal generation method [27, 28] with profile duration of seconds. For each acceleration profile, we run the simulations times for each scenario. Finally, the mean maximum spacing error for the th vehicle is computed as follows:
(27) 
where and are the number of commanded acceleration profiles and iterations, respectively. denotes the spacing error generated for the th profile at iteration for the th vehicle in a time horizon of seconds. After computing for , we use (14) to study the mean string stability.
Figure 5(a) demonstrates the jammer’s capability of destabilizing the platoon. As the results show in Figure 5(a), when the attacker is above the second vehicle (), not only the mean maximum error oscillates upstream the string, but also the magnitude of the errors are larger in comparison to the no attack scenarios shown in Figure 3(d). The results in Figure 5(a) show that, as the attacker moves upstream in the platoon, its ability to destabilize the platoon diminishes. This is because as the attacker moves far away from the lead vehicle, produced spacing error at the front vehicles are decreased since the packet delivery ratio increases. As a result, the more the attacker moves away from the lead vehicle, the more spacing error is corrected by the CACC controllers such that when the attacker is above the forth vehicle in the platoon, the string becomes stable. Therefore, we conclude that the closer the attacker gets to the second vehicle ( or first vehicle following the lead vehicle), the more effective it will be in terms of destabilizing the platoon.
6.4 Minimum Transmission Power to Maintain Mean String Stability
After finding the best location (above ) for the attacker in the previous part, in this subsection, we aim to study the jammer’s and the vehicles’ transmission powers impacted by the headwaytime variation on the mean string stability. Therefore, as a defending strategy against the jamming signal, we find the vehicles minimum required transmission power such that for a jammer with fixed power and location (above ), the platoon maintains the mean stability. Minimum transmission power is obtained as follows:
(28)  
This problem is solved by simulation under the same system setting parameters used in mean string stability analysis. The results in Figure 5(b) illustrates that for a fixed headwaytime, as the jamming signal power increases, the vehicles minimum transmission power need to be increased as well to stabilize the string. In addition, assuming a fixed signal power for the jammer, as the headwaytime increases, a higher transmission power is required for the vehicles to maintain the mean string stability. This is because, based on the velocity dependent spacing policy, with a bigger headwaytime, vehicles are moving with larger intervehicle distance compared to the one with smaller headwaytime.
7 Safety Evaluation Under Channel Faiding and Jamming Attacks
In this section, to examine the reachable intervehicle distance states at each time instant, we define a vector , where and is obtained from (24). is a matrix with dimension of with all elements equal to zero except the elements in for , which are equal to 1.
7.1 Impact of Rician Fading Channel on InterVehicle Distances
In this subsection, we study the reachable intervehicle distance states in the platoon when V2V wireless communication channels suffer from Rician fading. We assume that there is no attacker in the system model.
As a result, in (18) the attacker’s impact on the average SINR is removed (i.e., ). Then the model only includes the Rician fading channel impact on the CACC performance. Lead vehicle as an excitation input signal, takes the commended acceleration profile shown in Figure 6.
Due to the stochastic nature of Rician fading channel model, for the given excitation input in Figure 6, we conduct simulation runs and record the intervehicle distance trajectories in the platoon. Therefore, for each intervehicle distance in the platoon, trajectories are recorded. To observer the impact of Rician fading channel on each intervehicle distance in the platoon, two trajectories are selected uniformly at random.
Each subfigure in Figure 7 shows the reachable states for the two adjacent intervehicle distances in the platoon. The two selected trajectories are different from each other in each subfigure. This shows that Rician fading channel affects the reachable intervehicle distance states in the platoon and deviates the platoon’s behavior from normal operation.
The results also show that the difference between the two adjacent intervehicle distances is reduced as it goes upstream in the platoon. For instance, comparison between Figure 7(a) and Figure 7(i) shows that intervehicle distance differences between the two pairs of and is smaller than the two pairs of and . This means that, CACC system can reduce the intervehicle distance differences as it goes upstream in the platoon. This behavior also implies having an stable platoon.
7.2 Rician Fading Channel and Jamming Attack Impact on the InterVehicle Distance Between Lead Vehicle and its Follower
In this subsection, we study the reachable intervehicle distance states between the lead vehicle and its follower () in the presence of both the attacker and Rician fading channel. In fact, we aim to evaluate the performance of the CACC system under Rician fading channel and jamming attacks from the safety perspective, considering coupling impact of the cyber and physical states, as formulated in (18,20 and 24). To do so, for the stochastic dynamical system derived in (24), stochastic reachability analysis as a safety verification method is employed by conducting extensive simulations.
First, we derive the upper and lower bound of the trajectories of the intervehicle distance between the lead vehicle and its follower as follows:
Stochastic random variable is given by,
(29) 
where is a deterministic function defined by the timeinvariant matrices listed in (10), and
(30) 
There are several factors that define the intervehicle distance states evolution including initial states and , packets delivery probabilities which according to (18, 19 and 20) depend on , and the lead vehicle’s commanded acceleration profile (). In addition, Equations (29 and 30) show that the distance value at time also depends on the entire history of the distance value and the lead vehicle commanded acceleration (). From (29 and 30), maximum value of from time till time determines the lower bound value of intervehicle distance at time . Similarly, minimum value of from time till time determines the upper bound value of the intervehicle distance value at time . Note that is a deterministic acceleration profile taken by the lead vehicle.
Therefore, the reachable intervehicle distance states set at time is defined as follows:
(31) 
Figure 8(a) shows the lead vehicle’s commanded acceleration (), and its corresponding two other acceleration profiles that generate upper and lower bound for the intervehicle distance trajectories. The upper and lower bound distance trajectories for the lead vehicle’s commanded acceleration in Figure 8(a), are shown in Figure 8(b).
First Scenario
We study the impact of Rician fading channel without the presence of the attacker (). Figure 8(b) shows possible intervehicle distance trajectories which are upper and lower bounded by the corresponding commanded acceleration shown in Figure 8(a).
We see that, although the lower bound distance trajectory hits the zero (unsafe state), intervehicle distance trajectories are relatively overlapping with each other and the following vehicle maintains a safe distance from the lead vehicle.
Second Scenario
In this scenario, we assume that in addition to the Racian fading channel assumption, the jammer also emites its jamming signal over the wireless channel established between the lead vehicle and its follower. Figure 9(a) illustrates possible intervehicle distance trajectories when the attacker jams the signal for the whole time horizon of seconds. As shown in Figure 9(a), distance trajectories almost cover all the distance states set between the lower and upper bound and some trajectories hit the zero distance (unsafe states).
Third Scenario
In this part, we describe an attacking strategy that is occurring only partially in the time horizon. From the safety perspective this attacker makes the same impact on the distance trajectories as attacking in the whole time horizon.
To find the best time to attack, we use the fact that according to the velocitydependent spacing policy, when the lead vehicle decelerates/accelerates, the intervehicle distance decreases/increases as well. Therefore, intuitively from the safety point of view, the best times for the attacker to launch its jamming signal are the times at which the lead vehicle decelerates.
Thus, to implement this attacking strategy, we assume that the attacker knows when the lead vehicle decelerates. This capability for the attacker is obtained by considering that the drone also has been equipped with ACC system with velocitydependent spacing policy. Whenever the ACC system senses that the drone’s distance from the lead vehicle decreases, it means that the lead vehicle decelerates. Therefore, the drone’s ACC system triggers the jammer signal when it finds that the lead vehicle decelerates.
We also assume that, at the times that the attacker is silent (i.e., , this happens when the lead vehicle accelerates), wireless channel still suffers from Rician fading.
Figure 9(b) shows the distance trajectories for the proposed attacking strategy. As the results show, distance trajectories are dense and closer to the lower bound to make the safety critical situations instead of being distributed within the bound and being closer to the upper bound. Some trajectories also hit the zero distance (unsafe state). Also, at the moments when there is no jamming signal (when the lead vehicle accelerates), only the impact of Rician fading channel appears in the intervehicle distance trajectories. Finally, comparing the distance trajectories in Figure 9(a) (attacking within the whole time horizon) and Figure 9(b) (attacking at the times the lead vehicle decelerates), the results show that the partially attacking strategy is effective from the attacker’s perspective to make the safety critical situations.
8 Conclusions and Future Work
In this paper, we have modeled the coupling between cyber (wireless communication) and physical states (intervehicle distances) in the vehicle platooning with CACC system and studied the jamming attack impact on the platoon stability and safety in the presence of Racian fading in the channels. Based on our analysis, we identified that the best location to launch the jamming attack to destabilize the platoon is above the second vehicle in the platoon. As the attacker moves upstream in the platoon, its impact in terms of destabilizing the platoon is diminished. Considering various settings for the headwaytime in the CACC control structure, we studied the impact of vehicles’ and jammer’s transmission signal powers on the mean string stability. We then analyzed the intervehicle distance trajectories between the lead vehicle and its follower in the platoon from the safety perspective when the wireless channel is under jamming attacks. We computed the upper and lower bound for the first intervehicle distance trajectories in the platoon. Our analysis show the jamming attacks are more effective in terms of pushing the intervehicle distance trajectories to the unsafe states when the lead vehicle decelerates.
As of future work, we believe that our study highlights many research directions in this area. How to defend against a jamming attacker in a realtime manner such that the platoon maintains the stability? Studying upper and lower bound intervehicle distance trajectories for all the intervehicle distances in the platoon will be a promising direction. One other interesting problem is to study the cyberphysical coattacks. The attacker can jam the wireless communication while cooperating with a malicious vehicle in the platoon that does not follow the CACC rules and takes disturbing acceleration commands. Cyberphysical codefense strategies to avoid safety critical situation is also an interesting research direction.
References
 D. B. Rawat, C. Bajracharya, and G. Yan. Towards intelligent transportation cyberphysical systems: Realtime computing and communications perspectives. In SoutheastCon 2015, pages 1–6, April 2015.
 C. Hendrickson A. Biehler and Y. Mashayekh. Connected and autonomous vehicles 2040 vision. 2014.
 S. E. Shladover, C. Nowakowski, X. Y. Lu, and R. Ferlis. Cooperative adaptive cruise control (cacc) definitions and operating concepts. Nov 2014.
 G. J. L. Naus, R. P. A. Vugts, J. Ploeg, M. J. G. van de Molengraft, and M. Steinbuch. Stringstable cacc design and experimental validation: A frequencydomain approach. IEEE Transactions on Vehicular Technology, 59(9):4268–4279, Nov 2010.
 S. Öncü, J. Ploeg, N. van de Wouw, and H. Nijmeijer. Cooperative adaptive cruise control: Networkaware analysis of string stability. IEEE Transactions on ITS, 15(4):1527–1537, 2014.
 B. van Arem, C. J. G. van Driel, and R. Visser. The impact of cooperative adaptive cruise control on trafficflow characteristics. IEEE Transactions on Intelligent Transportation Systems, 7(4):429–436, Dec 2006.
 Dominik Lang, Thomas Stanger, Roman Schmied, and Luigi del Re. Predictive Cooperative Adaptive Cruise Control: Fuel Consumption Benefits and Implementability, pages 163–178. Springer International Publishing, Cham, 2014.
 M. Amoozadeh, A. Raghuramu, C. n. Chuah, D. Ghosal, H. M. Zhang, J. Rowe, and K. Levitt. Security vulnerabilities of connected vehicle streams and their impact on cooperative driving. IEEE Communications Magazine, 53(6):126–132, June 2015.
 V. Milanés, S. E. Shladover, J. Spring, C. Nowakowski, H. Kawazoe, and M. Nakamura. Cooperative adaptive cruise control in real traffic situations. IEEE Transactions on ITS, 15(1):296–305, Feb 2014.
 Xiangheng Liu, A. Goldsmith, S. S. Mahal, and J. K. Hedrick. Effects of communication delay on string stability in vehicle platoons. In Intelligent Transportation Systems, IEEE, pages 625–630, 2001.
 J. Ploeg, D. P. Shukla, N. van de Wouw, and H. Nijmeijer. Controller synthesis for string stability of vehicle platoons. IEEE Transactions on Intelligent Transportation Systems, 15(2):854–865, April 2014.
 W. B. Qin, M. M. Gomez, and G. Orosz. Stability analysis of connected cruise control with stochastic delays. In 2014 American Control Conference, pages 4624–4629, June 2014.
 Diana Yanakiev and Ioannis Kanellakopoulos. A simplified framework for string stability analysis in ahs. In IN PROCEEDINGS OF THE 13TH IFAC WORLD CONGRESS, pages 177–182, 1996.
 J. Ploeg, B. T. M. Scheepers, E. van Nunen, N. van de Wouw, and H. Nijmeijer. Design and experimental evaluation of cooperative adaptive cruise control. In 2011 14th International IEEE Conference on Intelligent Transportation Systems (ITSC), pages 260–265, Oct 2011.
 E. Shaw and J. K. Hedrick. String stability analysis for heterogeneous vehicle strings. In 2007 American Control Conference (ACC).
 Soodeh Dadras, Ryan M. Gerdes, and Rajnikant Sharma. Vehicular platooning in an adversarial environment. In Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ’15, pages 167–178, New York, NY, USA, 2015.
 Ryan M. Gerdes, Chris Winstead, and Kevin Heaslip. Cps: An efficiencymotivated attack against autonomous vehicular transportation. In Proceedings of the 29th, ACSAC ’13, pages 99–108, New York, NY, USA, 2013. ACM.
 W. B. Qin, M. M. Gomez, and G. Orosz. Stability and frequency response under stochastic communication delays with applications to connected cruise control design. IEEE Transactions on Intelligent Transportation Systems, 18(2):388–403, Feb 2017.
 A. AlipourFanid, M. Dabaghchian, H. Zhang, and K. Zeng. String stability analysis of cooperative adaptive cruise control under jamming attacks. In 2017 IEEE 18th International Symposium on High Assurance Systems Engineering (HASE), pages 157–162, Jan 2017.
 C. Sommer, S. Joerer, and F. Dressler. On the applicability of tworay path loss models for vehicular network simulation. In Vehicular Networking Conference (VNC), 2012 IEEE, pages 64–69, Nov 2012.
 Yunxin (Jeff) Li. An Overview of the DSRC/WAVE Technology, pages 544–558. Springer Berlin Heidelberg, Berlin, Heidelberg, 2012.
 L. C. Wang, W. C. Liu, and Y. H. Cheng. Statistical analysis of a mobiletomobile rician fading channel model. IEEE Transactions on Vehicular Technology, 58(1):32–38, Jan 2009.
 Wenyuan Xu, Wade Trappe, Yanyong Zhang, and Timothy Wood. The feasibility of launching and detecting jamming attacks in wireless networks. In Proceedings of the 6th ACM International Symposium on MobiHoc, MobiHoc ’05, pages 46–57, NY, USA, 2005. ACM.
 Lun Li, Gang Wang, Xin Tian, Dan Shen, Khanh Pham, Erik Blasch, and Genshe Chen. Sinr estimation for satcom in the environment with jamming signals. volume 9838, pages 98380P–98380P–7, 2016.
 A. A. AbuDayya and N. C. Beaulieu. Switched diversity on microcellular ricean channels. IEEE Transactions on Vehicular Technology, 43(4):970–976, Nov 1994.
 GAMS Development Corporation. General Algebraic Modeling System (GAMS) Release 24.2.1. Washington, DC, USA, 2013.
 Jarosław Figwer. Multisine transformation — properties and applications. Nonlinear Dynamics, 35(4):331–346, 2004.
 Rik Pintelon and Johan Schoukens. System identification: A frequency domain approach. In System Identification: A Frequency Domain Approach. John Wiley and Sons, Inc., 2005.