where *V* represents the wind velocity, *Pr* is rated power, *vci* is cut-in, *vco* represents cut-out, and *vr* is the rated wind. *a* and *b* are constant values that expressed as:

$$\begin{aligned} a &= P\_r / \left( v\_r^3 - v\_{c\dot{l}}^3 \right) \\ b &= v\_{c\dot{l}}^3 / \left( v\_r^3 - v\_{c\dot{l}}^3 \right) \end{aligned} \tag{4}$$

The rated power of wind turbine can be calculated as:

$$P\_r = \frac{1}{2} \times \rho \times A\_{wind} \times \mathbb{C}\_p \times \upsilon\_r{}^3 \tag{5}$$

where *ρ* is the air density, *Awind* represents the swept area of the wind turbine, and *Cp* is the maximum power coefficient (from 0.25 to 0.45).

### *2.3. Diesel System Modeling*

The diesel rated power can be calculated as [31]:

$$P\_{d\text{g}} = \frac{F\_{d\text{g}}\langle t\rangle - A\_{\text{g}} \times P\_{d\text{g,out}}}{B\_{\text{g}}} \tag{6}$$

where *Fdg* represents the fuel consumption, *Pdg*,*out* is the output power of the diesel generator, and *Ag* and *Bg* are two constant values represent the fuel linear consumption.

### *2.4. Battery System Modeling*

The battery capacity of the battery can be calculated as [31]:

$$\mathcal{C}\_{BESS} = \frac{E\_l \times AD}{DOD \times \eta\_i \times \eta\_b} \tag{7}$$

where *El* is the load demand, *AD* is the autonomy of the battery which can lead power to the load on rainy days, *DOD* represents the depth of discharge, and *ηi* and *ηb* represent the inverter and battery efficiency, respectively.

### **3. Objective Function and Constraints**

### *3.1. Net Present Cost*

The NPC represents an economic factor, which is considered the objective function in this study. The goal of the paper is to minimize the NPC, which is the sum of all costs during the project lifetime. The NPC is calculated as [32,33]:

$$\text{NPC} = \text{C} + \text{OM} + \text{R} + \text{FC}\_{d\text{g}} \tag{8}$$

where *C* represent the capital cost, *OM* is the operation and maintenance costs, *R* is the replacement cost, and *FCdg* is the fuel cost.

### *3.2. LCOE Index*

The LCOE represents the price of energy and is a critical factor which is calculated as [31]:

$$\text{LCOE} = \frac{\text{NPC} \times \text{CRF}}{\sum\_{t=1}^{8760} P\_{load} t} \tag{9}$$

where CRF represents the capital recovery factor (obtained by converting the initial cost to annual capital cost), and *Pload* represents the power load. The CRF is calculated as:

$$\text{CRF}(ir, N) = \frac{i\_r \times (1 + i\_r)^N}{\left(1 + i\_r\right)^R - 1} \tag{10}$$

### *3.3. LPSP Index*

The loss of power supply probability (LPSP) is a technical index that ranges from 0 to 1. It is used to indicate the reliability of the microgrid system. The LPSP is calculated as follows [31]:

$$\text{LPSP} = \frac{\sum\_{t=1}^{8760} \left( P\_{load} \langle t \rangle - P\_{pv} \langle t \rangle - P\_{wind} \langle t \rangle + P\_{\text{dg},out} \langle t \rangle + E\_{bmin} \right)}{\sum\_{t=1}^{8760} P\_{load} \langle t \rangle} \tag{11}$$

### *3.4. Renewable Energy Index*

Renewable energy (RF) is calculated to determine the renewable energy percent that is penetrated into the microgrid system. The RF is expressed as [31]:

$$\text{RF} = \left( 1 - \frac{\sum\_{t=1}^{8760} P\_{\text{g},out} \langle t \rangle}{\sum\_{t=1}^{8760} P\_{r\varepsilon} \langle t \rangle} \right) \times 100 \tag{12}$$

where *Pre* represents the sum of renewable energy powers.

### *3.5. Availability Index*

The availability factor (Av) is assumed as an index of the customer's satisfaction; it measures the ability of the microgrid to convert the total energy to load charge. The availability is calculated as [33]:

$$\text{Av} = 1 - \frac{\text{DMN}}{\sum\_{t=1}^{8760} P\_{load} \langle t \rangle} \tag{13}$$

$$DMN = P\_{bmin} \langle t \rangle - P\_b \langle t \rangle - \left( P\_{pv} \langle t \rangle + P\_{wind} \langle t \rangle + P\_{dg,out} \langle t \rangle - P\_{load} \langle t \rangle \right) \times u \langle t \rangle \tag{14}$$

where *Pbmin* represents the battery min state, *Pb* represents the battery power, and *u* is a fixed value which equals 1 when the load is not satisfied and which equals 0 otherwise.

### *3.6. Constraints*

Constraints are introduced to tune the microgrid system factors and help to improve the microgrid service quality. In this work, the constraints proposed are:

$$\begin{cases} \quad 0 \le A\_{pv} \le A\_{pv}^{max} \\ \quad 0 \le A\_{wind} \le A\_{wind}^{max} \\ \quad 0 \le P\_{dg} \le P\_{dg}^{max} \\ \quad 0 \le \mathcal{C}\_{BESS} \le \mathcal{C}\_{BESS}^{max} \\ \quad LPSP \le \mathcal{L} \text{PSP}^{max} \\ \quad \mathbb{R}\mathcal{F}^{min} \le RF \\ \quad Av^{min} \le Av \\ \quad AD^{min} \le AD \end{cases} \tag{15}$$

where LPSP*max* = 0.05, RF*min* = 70%, Av*min* = 90%, and AD*min* = 1 day. The sizing limit is different from configuration to the others. All other parameters are shown in Table A1.

### **4. Proposed Algorithm**

### *4.1. Heap-Based Optimizer (HBO)*

The heap-based optimizer algorithm (HBO) is inspired by the social behavior of human beings [34]. One sort of social interaction between human beings can be observed in organizations where people in teams are arranged in a hierarchy for achieving a specific target; this is known as corporate rank hierarchy (CRH). CRH is presented in Figure 1a. The HBO algorithm is based on CRH in a very distinctive manner. In this regard, the concept of CRH is to arrange the search agents based on their suitability in this hierarchy using a heap tree-based data structure to enact the implementation of priority queues. Figure 1b shows an example of 3 degrees (3-ary) of min-heap. Three types of employees' behaviors were used in the HBO algorithm. These types are: (i) the interaction of subordinates with their immediate head; (ii) the interaction between co-workers; and (iii) the self-contribution of individuals.

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 6 of 26

**Figure 1.** Partial examples of corporate rank hierarchy (**a**) and 3-ary min-heap (**b**). **Figure 1.** Partial examples of corporate rank hierarchy (**a**) and 3-ary min-heap (**b**). **Figure 1.** Partial examples of corporate rank hierarchy (**a**) and 3-ary min-heap (**b**).

The mapping of the heap concept is divided into four steps: The mapping of the heap concept is divided into four steps: The mapping of the heap concept is divided into four steps:

*A. Modeling the corporate rank hierarchy A. Modeling the corporate rank hierarchy A. Modeling the corporate rank hierarchy*

Figure 2 displays the procedure of CRH modeling through a heap data structure, wherein xi is the ith search agent of the population. The curve in the objective space describes the shape of the supposed objective function, and the search agents are drawn on the fitness shape according to their convenience. Figure 2 displays the procedure of CRH modeling through a heap data structure, wherein xi is the ith search agent of the population. The curve in the objective space describes the shape of the supposed objective function, and the search agents are drawn on the fitness shape according to their convenience. Figure 2 displays the procedure of CRH modeling through a heap data structure, wherein xi is the ith search agent of the population. The curve in the objective space describes the shape of the supposed objective function, and the search agents are drawn on the fitness shape according to their convenience.

**Figure 2***.* An illustration of the modeling of the CRH with min-heap. **Figure 2***.* An illustration of the modeling of the CRH with min-heap. **Figure 2.** An illustration of the modeling of the CRH with min-heap.

#### *B. Mathematically modeling the collaboration with the boss*  In a centralized organizational structure, the regulations and policies are enforced *B. Mathematically modeling the collaboration with the boss B. Mathematically modeling the collaboration with the boss*

from the upper levels, and subordinates must follow their direct manager. This can be mathematically described by updating the agent position of each search In a centralized organizational structure, the regulations and policies are enforced from the upper levels, and subordinates must follow their direct manager. In a centralized organizational structure, the regulations and policies are enforced from the upper levels, and subordinates must follow their direct manager.

as follows: This can be mathematically described by updating the agent position of each search as follows: This can be mathematically described by updating the agent position of each search as follows:

$$\mathbf{x}\_i^k(t+1) = \mathcal{B}^k + \gamma \lambda^k \left| \mathcal{B}^k - \mathbf{x}\_i^k(t) \right| \tag{16}$$

$$\gamma = \left| 2 - \frac{\left( t \bmod \frac{T}{C} \right)}{\frac{T}{4C}} \right| \tag{17}$$

$$
\dot{\lambda}^k = (2r - 1) \tag{18}
$$

 = (2 − 1) (18) where *t* is the current iteration, *k* is the *k*th component of a vector, *B* denotes the parent node, *r* is a random number from the range [0, 1], *T* is the maximum number of iterations, and *C* represents a user-defined parameter.

### *C. Mathematically modeling the interaction between the colleagues*

Colleagues cooperate and perform official tasks. It is assumed in a heap that the nodes at the same level are colleagues, and each search agent *xi* updates its location based on its randomly selected colleague *Sr* as follows:

$$\mathbf{x}\_{i}^{k}(t+1) = \begin{cases} s\_{r}^{k} + \gamma \lambda^{k} \Big| s\_{r}^{k} - \mathbf{x}\_{i}^{k}(t) \Big|\_{\prime} & f(\mathcal{S}\_{r}) < f(\mathbf{x}\_{i}(t)) \\\ \mathbf{x}\_{i}^{k} + \gamma \lambda^{k} \Big| s\_{r}^{k} - \mathbf{x}\_{i}^{k}(t) \Big|\_{\prime} & f(\mathcal{S}\_{r}) \ge f(\mathbf{x}\_{i}(t)) \end{cases} \tag{19}$$

### *D. Self-contribution of an employee to accomplish a task*

In this phase, the self-contribution of a worker is mapped as follows:

$$
\mathfrak{x}\_i^k(t+1) = \mathfrak{x}\_i^k(t) \tag{20}
$$

The following part explains how exploration can be controlled with this equation.

### *E. putting all together*

The principal challenge is determining the selection probabilities for the three equations to balance exploration and exploitation. The purpose of the roulette wheel is to achieve a balance of possibilities. The roulette wheel is divided into three parts: *p*1, *p*2, and *p*3. The value of *p*1 makes a population changes their position, and it is calculated from the following equation:

$$p\_1 = 1 - \frac{t}{T} \tag{21}$$

The selection of *p*2 is computed from the following equation:

$$p\_2 = p\_1 - \frac{1 - p\_1}{2} \tag{22}$$

Finally, the selection of *p*3 is calculated as follows:

$$p\_3 = p\_2 - \frac{1 - p\_1}{2} = 1\tag{23}$$

Accordingly, a general position-updating mechanism of the HBO algorithm is mathematically represented as follows:

$$\mathbf{x}\_{i}^{k}(t+1) = \begin{cases} \mathbf{x}\_{i}^{k}(t), p \le p\_{1} \\ \mathbf{B}^{k} + \gamma \lambda^{k} \Big| \mathbf{B}^{k} - \mathbf{x}\_{i}^{k}(t) \Big|, p > p\_{1} \text{ and } p \le p\_{2} \\ \mathbf{s}\_{r}^{k} + \gamma \lambda^{k} \Big| \mathbf{s}\_{r}^{k} - \mathbf{x}\_{i}^{k}(t), p > p\_{2} \text{ and } p \le p\_{3} \text{ and } f(\mathbf{S}\_{r}) < f(\mathbf{x}\_{i}(t)) \\ \mathbf{x}\_{i}^{k} + \gamma \lambda^{k} \Big| \mathbf{s}\_{r}^{k} - \mathbf{x}\_{i}^{k}(t) \Big|, p > p\_{2} \text{ and } p \le p\_{3} \text{ and } f(\mathbf{S}\_{r}) \ge f(\mathbf{x}\_{i}(t)) \end{cases} \tag{24}$$

where *p* is a random number in the range (0, 1).

### *4.2. Improved Heap-Based Optimizer(IHBO)*

In order to enhance the strength of the proposed IHBO algorithm for many highdimensional optimization problems, core aspects of one of the most used meta-heuristic algorithms, PSO, are utilized. The PSO algorithm is introduced by [35]. The velocity equation from the PSO algorithm is used in the proposed IHBO algorithm. This modification leads to the improvement of the ability of the global search and enhances the local search capabilities of the improved algorithm. This core equation is as follows:

$$V\_i^k(t+1) = w \cdot V\_i^k(t) + \mathsf{C}\_1 \cdot r\_1 \times (p\_{\mathrm{best}} - x\_i^k(t)) + \mathsf{C}\_2 \cdot r\_2 \times (g\_{\mathrm{best}} - x\_i^k(t))\tag{25}$$

$$\mathbf{x}\_i^k(t+1) = \mathbf{x}\_i^k(t) + V\_i^k(t+1) \tag{26}$$

where *C*1 = *C*2 = 0.5, as these values gave the best solution in [36]; *w* = 0.7; *r*1 and *r*2 are a random number in the range (0, 1); *pbest* is the best solution of an individual population, and *gbest* is the best solution so far. where ଵ = ଶ= 0.5, as these values gave the best solution in [36]; = 0.7; ଵ and ଶ are a random number in the range (0, 1); ௦௧ is the best solution of an individual population, and ௦௧ is the best solution so far.

The flow chart of the proposed IHBO algorithm is shown in Figure 3. The flow chart of the proposed IHBO algorithm is shown in Figure 3.

**Figure 3.** Flowchart of the proposed IHBO technique. **Figure 3.** Flowchart of the proposed IHBO technique.

Performance of the Proposed IHBO Algorithm The proposed IHBO algorithm's efficiency and performance are evaluated on differ-

Performance of the Proposed IHBO Algorithm

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 9 of 26

The proposed IHBO algorithm's efficiency and performance are evaluated on different benchmark functions, including statistical measurements, such as minimum values, mean values, maximum values, and standard deviation (STD) for best solutions obtained by the proposed IHBO algorithm and the other recent optimization algorithms. The results obtained with the proposed IHBO technique is compared with three well-known optimization algorithms, including the sine cosine algorithm (SCA) [37], salp swarm algorithm (SSA) [38], movable damped wave algorithm (MDWA) [39], and the original heap-based optimizer (HBO). Table 1 shows the parameters of all compared algorithms (SSA, MDWA, SCA, IHBO, and HBO). Qualitative metrics on F1, F4, F7, F9, F11, F12, F15, and F18, including 2D views of the functions, search history, average fitness history, and convergence curve, are presented in Figure 4. ent benchmark functions, including statistical measurements, such as minimum values, mean values, maximum values, and standard deviation (STD) for best solutions obtained by the proposed IHBO algorithm and the other recent optimization algorithms. The results obtained with the proposed IHBO technique is compared with three well-known optimization algorithms, including the sine cosine algorithm (SCA) [37], salp swarm algorithm (SSA) [38], movable damped wave algorithm (MDWA) [39], and the original heap-based optimizer (HBO). Table 1 shows the parameters of all compared algorithms (SSA, MDWA, SCA, IHBO, and HBO). Qualitative metrics on F1, F4, F7, F9, F11, F12, F15, and F18, including 2D views of the functions, search history, average fitness history, and convergence curve, are presented in Figure 4.

**Figure 4.** *Cont*.

**Figure 4.** Qualitative metrics on F1, F4, F7, F9, F11, F12, F15 and F18: 2D views of the functions, search history, average fitness history, and convergence curve. **Figure 4.** Qualitative metrics on F1, F4, F7, F9, F11, F12, F15 and F18: 2D views of the functions, search history, average fitness history, and convergence curve.

HBO sv = 100; degree = 3 Tables 2–4 tabulate the statistical results of the proposed IHBO algorithm and other well-known algorithms when applied for unimodal benchmark functions, named F1 to F7, multimodal benchmark functions, named F8 to F13, and composite benchmark functions, named F14 to F23, respectively. The best values, shown in bold, were achieved with the proposed IHBO algorithm, as well as MDWA and SCA, but the proposed IHBO technique achieves the best results for most of the benchmark functions. The convergence curves of all algorithms for the unimodal benchmark functions are shown in Figure 5 while Figure 6 shows the boxplots of each algorithm for these unimodal benchmark functions. Figure 7 displays the convergence characteristics curves of all algorithms for the multi-modal benchmark functions. The boxplots for each algorithm for these types of benchmark functions are presented in Figure 8. The convergence curves of all algorithms for the composite benchmark functions are displayed in Figure 9 while Figure 10 illus-Tables 2–4 tabulate the statistical results of the proposed IHBO algorithm and other well-known algorithms when applied for unimodal benchmark functions, named F1 to F7, multimodal benchmark functions, named F8 to F13, and composite benchmark functions, named F14 to F23, respectively. The best values, shown in bold, were achieved with the proposed IHBO algorithm, as well as MDWA and SCA, but the proposed IHBO technique achieves the best results for most of the benchmark functions. The convergence curves of all algorithms for the unimodal benchmark functions are shown in Figure 5 while Figure 6 shows the boxplots of each algorithm for these unimodal benchmark functions. Figure 7 displays the convergence characteristics curves of all algorithms for the multimodal benchmark functions. The boxplots for each algorithm for these types of benchmark functions are presented in Figure 8. The convergence curves of all algorithms for the composite benchmark functions are displayed in Figure 9 while Figure 10 illustrates the boxplots for each algorithm for these benchmark functions. The proposed algorithm reached a stable point for all functions. Also, the boxplots of the proposed IHBO technique are very narrow for most functions compared to the other algorithms.

The best values obtained are in bold.

**Function HBO IHBO SCA MDWA SSA** F13 Best **1.35** × **10**−**32 1.35** × **10**−**32** 5.71 × 10−02 2.48 × 10−06 1.51 × 10−11 Worst 1.84 × 10−32 **1.35** × **10**−**32** 3.59 × 10−01 3.70 × 10−04 1.10 × 10−02 Mean 1.37 × 10−32 **1.35** × **10**−**32** 2.16 × 10−01 4.53 × 10−05 1.65 × 10−03 std 1.10 × 10−33 **2.81** × **10**−**48** 7.48 × 10−02 8.66 × 10−05 4.03 × 10−03 The best values obtained are in bold.

**Table 3.** *Cont.*

**Table 4.** Results of composite benchmark functions.

The best values obtained are in bold.

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 11 of 26

trates the boxplots for each algorithm for these benchmark functions. The proposed algorithm reached a stable point for all functions. Also, the boxplots of the proposed IHBO

trates the boxplots for each algorithm for these benchmark functions. The proposed algorithm reached a stable point for all functions. Also, the boxplots of the proposed IHBO

technique are very narrow for most functions compared to the other algorithms.

**Figure 5.** The convergence curves of all algorithms for unimodal benchmark functions (**a**) F1, (**b**) F2, (**c**) F3, (**d**) F4, (**e**) F5, (**f**) F6, and (**g**) F7. **Figure 5.** The convergence curves of all algorithms for unimodal benchmark functions (**a**) F1, (**b**) F2, (**c**) F3, (**d**) F4, (**e**) F5, (**f**) F6, and (**g**) F7. **Figure 5.** The convergence curves of all algorithms for unimodal benchmark functions (**a**) F1, (**b**) F2, (**c**) F3, (**d**) F4, (**e**) F5, (**f**) F6, and (**g**) F7.

**Figure 6.** Boxplots for all algorithms for unimodal benchmark functions (**a**) F1, (**b**) F2, (**c**) F3, (**d**) F4, (**e**) F5, (**f**) F6, and (**g**) F7.

F7.

F7.

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 12 of 26

**Figure 7.** The convergence curves of all algorithms for multi-modal benchmark functions (**a**) F8, (**b**) F9, (**c**) F10, (**d**) F11, (**e**) F12 and (**f**) F13. **Figure 7.** The convergence curves of all algorithms for multi-modal benchmark functions (**a**) F8, (**b**) F9, (**c**) F10, (**d**) F11, (**e**) F12 and (**f**) F13. **Figure 7.** The convergence curves of all algorithms for multi-modal benchmark functions (**a**) F8, (**b**) F9, (**c**) F10, (**d**) F11, (**e**) F12 and (**f**) F13.

**Figure 8.** Boxplots for all algorithms for multi-modal benchmark functions (**a**) F8, (**b**) F9, (**c**) F10, (**d**) F11, (**e**) F12 and (**f**) F13.

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 13 of 26

F11, (**e**) F12 and (**f**) F13.

F11, (**e**) F12 and (**f**) F13.

**Figure 8.** Boxplots for all algorithms for multi-modal benchmark functions (**a**) F8, (**b**) F9, (**c**) F10, (**d**)

**Figure 8.** Boxplots for all algorithms for multi-modal benchmark functions (**a**) F8, (**b**) F9, (**c**) F10, (**d**)

**Figure 9.** The convergence curves of all algorithms for composite benchmark functions (**a**) F14, (**b**) F15, (**c**) F16, (**d**) F17, (**e**) F18, (**f**) F19, (**g**) F20, (**h**) F21, (**i**) F22, and (**j**) F23. **Figure 9.** The convergence curves of all algorithms for composite benchmark functions (**a**) F14, (**b**) F15, (**c**) F16, (**d**) F17, (**e**) F18, (**f**) F19, (**g**) F20, (**h**) F21, (**i**) F22, and (**j**) F23. **Figure 9.** The convergence curves of all algorithms for composite benchmark functions (**a**) F14, (**b**) F15, (**c**) F16, (**d**) F17, (**e**) F18, (**f**) F19, (**g**) F20, (**h**) F21, (**i**) F22, and (**j**) F23.

**Figure 10.** *Cont*.

#### **Table 2.** Results of unimodal benchmark functions. **5. Project Implementation Location**

**Function HBO IHBO SCA MDWA SSA**  Best 8.81 × 10−65 **3.11 × 10−86** 5.61 × 10−41 1.34 × 10−44 2.21 × 10−10 The project was implemented in a small region in the west of Morocco called Terfaya, at coordinating latitude 27.932 and longitude −12.935.

#### F1 Worst 7.28 × 10−59 **3.81 × 10−81** 1.24 × 10−28 3 × 10−39 8.48 × 10−10 **6. Results and Discussion**

Mean 4 × 10−60 **3.72 × 10−82** 8.72 × 10−30 3.01 × 10−40 5.63 × 10−10 std 1.63 × 10−59 **8.56 × 10−82** 2.92 × 10−29 8.19 × 10−40 1.99 × 10−10 F2 Best 1.24 × 10−39 **4.59 × 10−53** 6.81 × 10−27 1.14 × 10−22 2.69 × 10−06 Worst 4.86 × 10−37 **1.2 × 10−49** 1.84 × 10−19 2.86 × 10−22 1.54 × 10−05 In this paper, the Terfaya region of Morocco is selected as the case study to implement an HRES platform based on an improved optimization algorithm called IHBO. The maps for the project location, the load charge, the annual ambient radiation, temperature, wind speed, and pressure are presented in Figures 11–15, respectively. *Sustainability* **2021**, *13*, x FOR PEER REVIEW 17 of 26

Mean 1.23 × 10−33 **0.00** 3.12 × 10−01 2.93 × 10−05 5.74 × 10−10 std 3.79 × 10−33 **0.00** 1.35 × 10−01 2.67 × 10−05 1.60 × 10−10 **Figure 11.** Load power. **Figure 11.** Load power.

**Figure 12.** Solar radiation.

**Figure 12. Figure 12.** Solar radiation. Solar radiation.

**Figure 11.** Load power.

**Figure 13.** Temperature. **Figure 13.** Temperature.

**Figure 14. Figure 14.** Wind speed. Wind speed.

**Figure 14.** Wind speed.

**Figure 15.** Pressure. **Figure 15.** Pressure.

The proposed HRES includes two renewable sources (PV and wind turbines), a diesel generator, and a battery storage system. According to the mathematical modeling of the mentioned systems, the PV output can be affected by the solar radiation data; otherwise, the output power of the wind is influenced by the wind speed data. The decision variables in this study are dedicated to the size of the HRES where: x(1) is the PV area (௩,), x(2) is the wind swept area (௪ௗ), x(3) represents the battery capacity (ாௌௌ) and x(4) is the rated power of the diesel generator (ௗ). In this paper, an analysis of fuel price variation is carried out. The proposed HRES includes two renewable sources (PV and wind turbines), a diesel generator, and a battery storage system. According to the mathematical modeling of the mentioned systems, the PV output can be affected by the solar radiation data; otherwise, the output power of the wind is influenced by the wind speed data. The decision variables in this study are dedicated to the size of the HRES where: x(1) is the PV area (*Apv*,), x(2) is the wind swept area (*Awind*), x(3) represents the battery capacity (*CBESS*) and x(4) is the rated power of the diesel generator (*Pdg*). In this paper, an analysis of fuel price variation is carried out.

### *6.1. Optimal HRES Design of PV/Diesel/Battery and PV/Wind/Diesel/Battery*  6.1.1. PV/Diesel/Battery HRES *6.1. Optimal HRES Design of PV/Diesel/Battery and PV/Wind/Diesel/Battery* 6.1.1. PV/Diesel/Battery HRES

The results of the optimal HRES design for the case study concerning the PV/diesel/battery HRES are summarized in Table 5. The table presents all used algorithms concerning the predefined constraints, including the LPSP, RF, and the availability. The algorithms are arranged as GWO, HBO, AEFA, HHO, and IHBO, with a net present cost of MAD 191,661, MAD 175,321, MAD 169,142, MAD 147,527, and MAD 120,463, respectively. The optimal system needs MAD 120,463, equivalent to an LCOE of MAD 0.13/kWh. The system designed respected the constraints very well, with a reliability (LPSP) of 3%, a renewable fraction of 95%, and power availability of 98%. Table 6 presents the optimal size of each algorithm; the best solution is then obtained by IHBO, with 1,673,864 m2 and 38,860 kW of diesel generator capacity. Table 7 presents the convergence time of all simu-The results of the optimal HRES design for the case study concerning the PV/diesel/ battery HRES are summarized in Table 5. The table presents all used algorithms concerning the predefined constraints, including the LPSP, RF, and the availability. The algorithms are arranged as GWO, HBO, AEFA, HHO, and IHBO, with a net present cost of MAD 191,661, MAD 175,321, MAD 169,142, MAD 147,527, and MAD 120,463, respectively. The optimal system needs MAD 120,463, equivalent to an LCOE of MAD 0.13/kWh. The system designed respected the constraints very well, with a reliability (LPSP) of 3%, a renewable fraction of 95%, and power availability of 98%. Table 6 presents the optimal size of each algorithm; the best solution is then obtained by IHBO, with 1,673,864 m2 and 38,860 kW of diesel generator capacity. Table 7 presents the convergence time of all simulations.

HHO 147527 0.1187 0.0269 99.7289 98.5725 HBO 175321 0.1411 0.0383 95.5051 98.9342 IHBO 120463 0.1384 0.0389 95.3802 98.8665

lations. **Table 5.** Results of the PV/diesel/battery HRES.

**Table 6.** Sizing results of the PV/diesel/battery HRES.

**Table 7.** Convergence time of algorithms. IHBO 167.4 0 3.88

The convergence curve results for all scenarios are presented in Figure 16, in which the IHBO proves its efficacy to reach the optimal solution. IHBO 14,017

**Figure 16.** PV/diesel/battery. **Figure 16.** PV/diesel/battery.

6.1.2. PV/Wind/Diesel/Battery HRES

6.1.2. PV/Wind/Diesel/Battery HRES The second configuration used in this paper concerns the PV/wind/diesel/battery HRES. From Table 8, the results respect the constraints; then, the best algorithms results The second configuration used in this paper concerns the PV/wind/diesel/battery HRES. From Table 8, the results respect the constraints; then, the best algorithms results converge as HBO, GWO, AEFA, HHO, and IHBO, with an investment cost of MAD 461,233, MAD 226,559, MAD 221,694, MAD 215,371, and MAD 100,337, respectively. The best cost

1.0762 kW of diesel. Table 10 presents the convergence time of all simulations.

HRES; the curve shows that the IHBO algorithm gives better convergence results.

converge as HBO, GWO, AEFA, HHO, and IHBO, with an investment cost of MAD 461,233, MAD 226,559, MAD 221,694, MAD 215,371, and MAD 100,337, respectively. The

about 4%, the renewable fraction is near 100%, and the power availability is more than 99%. Table 9 presents the size results, which show that the best project needs 261.3031 m2 of PV area, 102.7114 m2 of swept area of the wind turbines, 23.2177 kWh of battery, and

Figure 17 presents the convergence curve of the NPC for the PV/wind/diesel/battery

needs MAD 100,337, equivalent to MAD 0.08/kWh; in this situation, the LPSP is about 4%, the renewable fraction is near 100%, and the power availability is more than 99%. Table 9 presents the size results, which show that the best project needs 261.3031 m2 of PV area, 102.7114 m2 of swept area of the wind turbines, 23.2177 kWh of battery, and 1.0762 kW of diesel. Table 10 presents the convergence time of all simulations.

**Table 8.** Results of the PV/wind/diesel/battery HRES.

**Table 9.** Sizing results of the PV/wind/diesel/battery HRES.

**Table 10.** Convergence time of the algorithms.

Figure 17 presents the convergence curve of the NPC for the PV/wind/diesel/battery HRES; the curve shows that the IHBO algorithm gives better convergence results.

### *6.2. Impact of Fuel Price Variation*

In the paper, if we suppose that the price of fuel is about MAD 0.41/L, then we can compare the total investment cost with the previous study that used the actual price, which is MAD 0.96/L.

From Table 11, it is clearly shown that the NPC of the HRES is reduced strongly while it is passed from MAD 120,463. Table 12 presents the optimal HRES size using all optimization algorithms. Figure 18 presents the convergence curve of the NPC for the PV/diesel/battery HRES, with a fuel price of MAD 0.54/L. This figure shows that the IHBO algorithm gives the better convergence results.

**Figure 17.** Convergence curve for the PV/wind/diesel/battery HRES. **Figure 17.** Convergence curve for the PV/wind/diesel/battery HRES.

**Table 8.** Results of the PV/wind/diesel/battery HRES.

**Table 9.** Sizing results of the PV/wind/diesel/battery HRES.

 Convergence time of the algorithms.

**Table 12.** Sizing results of the PV/diesel/battery HRES.

In the paper, if we suppose that the price of fuel is about MAD 0.41/L, then we can compare the total investment cost with the previous study that used the actual price,

From Table 11, it is clearly shown that the NPC of the HRES is reduced strongly while it is passed from MAD 120,463. Table 12 presents the optimal HRES size using all optimization algorithms. Figure 18 presents the convergence curve of the NPC for the PV/diesel/battery HRES, with a fuel price of MAD 0.54/L. This figure shows that the IHBO algo-

AEFA 166303 0.1339 0.0324 96.1598 99.4268 GWO 107532 0.0865 0.0483 97.0846 98.0032 HHO 87394 0.0703 0.0496 99.6090 96.1823 HBO 125791 0.1012 0.0296 97.7468 98.8978 IHBO 68121 0.0548 0.1119 99.9999 88.8055

**Algorithm PV (m2) Battery (kWh) Diesel (kW)**  AEFA 216.7 3.7 6 GWO 163.7 0.4 2.24 HHO 161.8 0.7 0.29 HBO 194 0 2.79 IHBO 124.9 0 0

**(MAD/kWh) LPSP RF (%) Availability**

**(%)**

**Figure 18.** Convergence PV/diesel/battery with a fuel price of 0.54. **Figure 18.** Convergence PV/diesel/battery with a fuel price of 0.54.

### **7. Conclusions**

*6.2. Impact of Fuel Price Variation*

rithm gives the better convergence results.

**Algorithm NPC (MAD) LCOE**

**Table 12.** Sizing results of the PV/diesel/battery HRES.

**Table 11.** Results of the PV/diesel/battery HRES with fuel prices.

which is MAD 0.96/L.

This paper proposed a platform to design an HRES microgrid system based on two configurations, PV/diesel/battery, and PV/wind/diesel/battery. The platform is based on modeling, power management, and a cost optimization study using an improved IHBO algorithm. The proposed IHBO algorithm proved its efficacy in finding the optimal solution compared with many algorithms, including AEFA, GWO, HHO, and the original HBO. In the paper, we discussed the case of reducing fuel prices and its impact on the investment cost. The results show that the NPC is highly reduced when the use of diesel is small. Several systems, such as hydrogen storage and biomass systems, can be integrated in the microgrid. Future work will focus on developing configurations considering the degradation of battery characteristics.

**Author Contributions:** Conceptualization, M.K. and S.K.; methodology, S.K.E., M.H.H. and I.B.M.T.; software, M.K., S.K. and M.H.H.; validation, S.K.E. and I.B.M.T.; formal analysis, M.K., S.K. and M.H.H.; investigation, S.K.E. and I.B.M.T.; resources, M.K., S.K. and M.H.H.; data curation, S.K.E. and I.B.M.T.; writing original draft preparation, M.K., S.K. and M.H.H.; writing on characteristic, S.K.E. and I.B.M.T.; visualization, S.K.E. and I.B.M.T.; supervision, S.K.; project administration, M.K. All authors have read and agreed to the published version of the manuscript.

**Funding:** This study was funded by Taif University Researchers Supporting Project Number (TURSP-2020/61), Taif University, Taif, Saudi Arabia.

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Data Availability Statement:** Not applicable.

**Acknowledgments:** The authors would like to acknowledge the financial support received from Taif University Researchers Supporting Project Number (TURSP-2020/61), Taif University, Taif, Saudi Arabia.

**Conflicts of Interest:** The authors declare no conflict of interest.

### **Nomenclature**

### **Appendix A**

**Table A1.** Summary of the HRES parameters.

### **References**

## *Article* **Design, Modeling, and Differential Flatness Based Control of Permanent Magnet-Assisted Synchronous Reluctance Motor for e-Vehicle Applications**

**Songklod Sriprang 1,2 , Nitchamon Poonnoy 2,\*, Damien Guilbert 1 , Babak Nahid-Mobarakeh 3 , Noureddine Takorabet 1 , Nicu Bizon 4 and Phatiphat Thounthong 2,\***

**Abstract:** This paper presents the utilization of differential flatness techniques from nonlinear control theory to permanent magnet assisted (PMa) synchronous reluctance motor (SynRM). The significant advantage of the proposed control approach is the potentiality to establish the behavior of the state variable system during the steady-state and transients operations as well. The mathematical models of PMa-SynRM are initially proved by the nonlinear case to show the flatness property. Then, the intelligent proportional-integral (iPI) is utilized as a control law to deal with some inevitable modeling errors and uncertainties for the torque and speed of the motor. Finally, a MicroLab Box dSPACE has been employed to implement the proposed control scheme. A small-scale test bench 1-KW relying on the PMa-SynRM has been designed and developed in the laboratory to approve the proposed control algorithm. The experimental results reflect that the proposed control effectively performs high performance during dynamic operating conditions for the inner torque loop control and outer speed loop control of the motor drive compared to the traditional PI control.

**Keywords:** electric vehicle; inverter; permanent magnet assisted synchronous reluctance motor; differential flatness-based control; parameter observers; traction drive

### **1. Introduction**

Permanent magnet synchronous motors (PMSMs) are the most widespread motor technologies in transportation applications including more electric aircraft (MEA), electric vehicles (EVs or e-vehicle), and hybrid electric vehicles (HEVs) [1–5]. Indeed, this technology enables offering high torque, power density, and high efficiency; while providing an extensive speed range. Besides, due to their design, they are extremely versatile and can also be employed for low-power applications, offering high performance [1]. On the other side, these motors require the use of rare-earth metals to make permanent magnets (PMs) such as Nd-Fe-B (neodymium-iron-boron), located on the rotor. Due to the growing development of electric vehicles, the interest in rare-earth metals has been increasing; leading up consequently to high cost and environmental consequences for the extraction and refining of rare-earth elements.

As a result, to cope with these important issues, a new permanent magnet-assisted (PMa) synchronous reluctance motor (SynRM) has been conceived to reduce the size of PMs

**Citation:** Sriprang, S.; Poonnoy, N.; Guilbert, D.; Nahid-Mobarakeh, B.; Takorabet, N.; Bizon, N.; Thounthong, P. Design, Modeling, and Differential Flatness Based Control of Permanent Magnet-Assisted Synchronous Reluctance Motor for e-Vehicle Applications. *Sustainability* **2021**, *13*, 9502. https://doi.org/10.3390/ su13179502

Academic Editors: Marc A. Rosen and Lin Li

Received: 29 June 2021 Accepted: 18 August 2021 Published: 24 August 2021

**Publisher's Note:** MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Copyright:** © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/).

and to increase the use of ferrite magnet materials in the rotor part. Besides, the modern PMa-SynRM is more advantageous than the classic SynRM [6–8]. Its cost is reduced compared to the usual PMSM since ferrite magnets are cost-effective over rare-earth PMs. In summary, the PMa-SynRM is an emerging and attractive motor for the dissemination of the next generations of electric cars. The constitution of the proposed four-pole PMa-SynRM prototype relying on ferrite magnets, and the d-axis and q-axis are shown in Figure 1. It can be noted that the permanent magnets are positioned in the flux barriers of the rotor part. Hence, magnetization takes place along the negative q-axis. Given that the PMa-SynRM is relatively new, the achievement of high performance for large functioning conditions by controlling it remains a technical barrier. Indeed, its nonlinear features, parameter mismatch, and also parametric uncertainty make its control challenging.

**Figure 1.** The rotor's structure of the proposed PMa-SynRM.

To face this technical barrier from the control point of view, various control approaches have been reported and analyzed recently in the literature. First and foremost, Ion Boldea et al. [9] have studied a direct torque and flux control with space vector modulation (DTFC-SVM) drive control of PM-assisted reluctance synchronous motor/generator employed for mild hybrid vehicles applications. Peyman Niazi et al. [10] have conceived a maximum torque per ampere (MTPA) control strategy coupled with a parameter observer applied to a PMa-SynRM to face the change of motor parameters (inductances and PM flux density) and saturation effect due to the internal temperature. However, the tests have been performed when the PMa-SynRM operates under a constant torque region. By comparison, Elena Trancho et al. [11] have designed a robust torque-based control scheme addressed to the PM-Assisted Synchronous Reluctance Machine in EVs and HEVs. In this work, the authors have employed an arrangement of a second-order-based sliding mode control for inner current regulation and a look-up table/voltage restriction pursuit-based hybrid field weakening operation to cope with parameters deviation during operation. Despite these relevant works introducing and designing robust controllers, the achievement of high performance is still a challenging barrier. As emphasized in these works, this barrier is due to the variation of machine electrical parameters and the nonlinear properties. To meet these technical issues for the control of the PMa-SynRM, a nonlinear control named "Differential Flatness" is elaborated and has recently been suggested to reach the expected performances in controlling PMSM [12]. It has been demonstrated that differential flatness control presents higher performance than traditional control systems. Besides, adding the nonlinear observation for motor parameters estimating makes the control system more robust. This novel control approach has been applied in various nonlinear systems; for instance, for the energy management of a hybrid power plant (including a fuel cell and supercapacitors) [13], and the command of double fed inductor motor [14].

This paper presents the differential flatness control to control PMa-SynRM. As a result of this introduction reviewing the main issues for the control of PMa-SynRM and the current state-of-the-art, the mathematical models of PMa-SynRM are developed to prove the differential flat property in Section 2. Then, in Section 3, the intelligent proportional-integral (*i*PI) [15,16] controller is conceived as a control law to compensate for the torque and speed of the motor. A nonlinear estimator is introduced to estimate external torque disturbance. Finally, in Section 4, the comparison between differential flatness and conventional PI control is discussed to demonstrate the benefits of the proposed control algorithm. A small-scale test bench 1-KW relying on the PMa-SynRM with ferrite magnets has been realized to attest to the performance of the designed control scheme in the laboratory [17].

### **2. FEM-Based Magnetic Model**

Given that the inductances *L*d and *L*q play major roles in the overload capacity, the field-weakening operation has been enhanced, and an accurate regulation has been determined to make their calculation easier. The inductances in the d–q axis have been computed considering a nonlinear case where the saturation of the stator teeth and rotor ribs have been taken into account. Due to the effect of the internal temperature, the inductances can be saturated as emphasized in [10]. Hence, the saturation effects of the inductances *L*d and *L*q can be computed relying on the link between the flux linkage change and the small rise in the current of the d–q axis, as provided by the Equations (1)–(3) [18,19]. Furthermore, the cross-coupling effects due to saturation have been investigated as well for the PMa-SynRM. The parameters have been assessed in the d–q axis. The operating constraints of the current supply have been reproduced, and the flux linkages have been assessed by incorporating the magnetic vector potential. The d-q flux linkages linked to the d- and q-axes currents are illustrated in Figure 2. The d- and q-flux linkages related to based on FEM analysis are represented in Figure 2. Figure 2a depicts the lookup table of d-axis flux linkage Ψd(id,iq) (LUT1); while Figure 2b exhibits the lookup q-axis flux linkage Ψq(id,iq) (LUT2). In addition, Table 1 shows the given flux linkages of the PMs and d–q axes inductances of the control network design.

**Figure 2.** *Cont.*

**Figure 2.** The flux linkages Ψd and Ψq in the function of *i*d and *i*q. (**a**) Ψd(*i*d,*i*q). (**b**) Ψq(*i*d,*i*q).

$$L\_{\rm d} = \frac{\partial \Psi\_{\rm d}(i\_{\rm d}, i\_{\rm q})}{\partial i\_{\rm d}} = \left. \frac{\Delta \Psi\_{\rm d}(i\_{\rm d}, i\_{\rm q})}{\Delta i\_{\rm d}} \right|\_{i\_{\rm q} = \text{constant}} \tag{1}$$

$$L\_{\mathbf{q}} = \frac{\partial \Psi\_{\mathbf{q}}(i\_{\mathbf{d}\prime}i\_{\mathbf{q}})}{\partial i\_{\mathbf{q}}} = \left. \frac{\Delta \Psi\_{\mathbf{q}}(i\_{\mathbf{d}\prime}i\_{\mathbf{q}})}{\Delta i\_{\mathbf{q}}} \right|\_{i\_{\mathbf{d}} = \text{constant}} \tag{2}$$

$$L\_{\rm dq} = \frac{\partial \Psi\_{\rm d}(i\_{\rm d}, i\_{\rm q})}{\partial i\_{\rm q}} = \left. \frac{\Delta \Psi\_{\rm d}(i\_{\rm d}, i\_{\rm q})}{\Delta i\_{\rm q}} \right|\_{i\_{\rm d} = \text{constant}} \tag{3}$$

**Table 1.** Properties of the PMa-SynRM parameters relying on FEM analysis.

### **3. A Shot Briefly Differential Flatness Control and Control Law**

### *3.1. Differential Flatness Briefly*

The differential flatness-based control approach is crucial to control different types of systems [2,13,14]. A summary of differential flatness control theory is provided below. Considering a nonlinear system expressed by the following state-variable:

.

$$
\dot{\mathfrak{x}} = f(\mathfrak{x}, \mathfrak{u}).\tag{4}
$$

The system (4) is said to be "differentially flat" if a set of flat output equal to the number of inputs can be found. More precisely, the control output variable must be written as the function of the flat output and their derivatives as follow:

$$\mathbf{x} = \phi(y, \dot{y}, \dots, y^{(\beta)}),\tag{5a}$$

$$u = \psi(y, \dot{y}, \dots, y^{(\beta + 1)}),\tag{5b}$$

where *β* is the finite number of derivatives.

### *3.2. Control Law*

The control law's block diagram is provided in Figure 3. The trajectory planning, the feedback control (relying on two controller gains *Ki* and *Kp*), the controller output *λ*, and the inverse dynamic equations are detailed below.

**Figure 3.** Control law's block diagram.

As shown in Figure 3, a controller output, *λ* can be defined as follow:

$$
\lambda = \mathfrak{u}\_{\text{ref}} + \mathfrak{u}\_{\text{feedback}}(\varepsilon), \tag{6}
$$

with

$$
\mu\_{\rm ref} = \psi(y\_{\rm ref}, \dot{y}\_{\rm ref}, \ddot{y}\_{\rm ref}, \dots, y\_{\rm ref}^{(\notin +1)}), \tag{7}
$$

$$
\varepsilon = y\_{ref} - y.\tag{8}
$$

As will be seen later, thank to "Inverse Dynamic Equation" (IDE), we will obtain.

$$
\dot{y} = \lambda.\tag{9}
$$

According to the control law's block diagram, combining (6)–(8) yields.

.

$$
\dot{y} = \dot{y}\_{ref} + \mathcal{K}\_p \varepsilon + \mathcal{K}\_i \int \varepsilon dt = 0. \tag{10}
$$

Taking time derivative (10) obtains.

$$
\ddot{y}\_{ref} + \mathcal{K}\_p \dot{\varepsilon} + \mathcal{K}\_i \varepsilon = 0. \tag{11}
$$

By comparing to the standard second-order equation, parameters *Kp* and *Ki* can define as follow:

$$
\ddot{q}(s) + 2\zeta\omega\_n\dot{q}(s) + \omega\_n^2 q(s) = 0,\tag{12}
$$

Consequently, the controller gains define as follow:

$$\begin{aligned} \mathbf{K}\_p &= \mathfrak{L}\widetilde{\zeta}\omega\_n\\ \mathbf{K}\_i &= \omega\_n^2 \end{aligned} \tag{13}$$

### **4. PMa-SynRM Modeling and Development of the Proposed Control Scheme**

*4.1. Mathematic Model of PMa-SynRM/Inverter*

The inverter shown in Figure 4 provides a symmetric sinusoidal three-phase AC voltage source for supplying to PMa-SynRM. In Figure 4, *VBUS*, *iBUS*, and *iA*, *iC* are respectively the input DC grid voltage, the inverter current, and the load motor phase current. According to Figure 2a,b, The electrical modeling equations of PMa-SynRM are discussed

by the nonlinear case. In Figure 2, the flux linkage of direct and quadrature axes may be defined according to d- and q-axes current id and iq as in the following equations.

$$\mathbf{Y\_d} = \mathbf{Y\_d}(i\_{\mathbf{d}\prime} i\_{\mathbf{q}}) \,\tag{14}$$

$$\Psi\_{\mathbf{q}} = \Psi\_{\mathbf{q}}(i\_{\mathbf{d}\prime} i\_{\mathbf{q}}).\tag{15}$$

**Figure 4.** A three-phase inverter to control the PMa-SynRM prototype.

By considering Equations (14) and (15) as well, as mentioned above, the rotating electrical modeling of PMa-SynRM is given by the following equations [10,17]:

$$v\_{\rm d} = R\_{\rm s} \cdot i\_{\rm d} + \frac{d\Psi\_{\rm d}(i\_{\rm d}, i\_{\rm q})}{dt} - \omega\_{\rm e} \cdot \Psi\_{\rm q}(i\_{\rm d}, i\_{\rm q}) \,, \tag{16}$$

$$v\_{\mathbf{q}} = \mathbf{R}\_{\mathbf{s}} \cdot i\_{\mathbf{q}} + \frac{d\Psi\_{\mathbf{q}}(i\_{\mathbf{d}\prime}i\_{\mathbf{q}})}{dt} + \omega\_{\mathbf{e}} \cdot \Psi\_{\mathbf{d}}(i\_{\mathbf{d}\prime}i\_{\mathbf{q}})\_{\prime} \tag{17}$$

where

$$
\omega\_{\mathbf{e}} = n\_p \cdot \omega\_{m\nu} \tag{18}
$$

where *vd* is the *d*-axis voltage, *vq* is the *q*-axis voltage, *ω*e is the electrical angular frequency, *np* is the number of pole pairs, and *ωm* is the mechanical angular frequency. The important electromagnetic torque of the machine composed of torque produced with the interactivity between the magnet and the reluctance torque is expressed as follows.

$$T\_{\varepsilon} = n\_p \left( \Psi\_d i\_q - \Psi\_q i\_d \right). \tag{19}$$

The mechanical equation in the rotation moving is:

$$J\frac{d\omega\_{\rm m}}{dt} = T\_{\rm e} - B\_{\rm f}\omega\_{\rm m} - T\_{\rm L} \tag{20}$$

where *J* is the moment of inertia, *B*f is the viscosity, and *T*L is the load torque.

### *4.2. Differential Flatness Control of Current (or Torque) Loop Development*

By referring to Equations (5), (16) and (17), the Ψd and Ψq are determined as the state variables (*x*). The *v*d and *v*q are control variables (*u*). The flat output (*y*) candidates are the measured parameters, which are *i*d and *i*q. The systems can be seen as differentially flat if the control output variable must be noted according to the flat output, which are

$$w\_d = \mu\_1 = \mathbb{R}\_\delta y\_1 - \omega\_\ell \mathbb{1}\_\emptyset (y\_1, y\_2) + \frac{\partial \mathbb{1}\_d (y\_1, y\_2)}{\partial y\_1} \cdot \dot{y}\_1 + \frac{\partial \mathbb{1}\_d (y\_1, y\_2)}{\partial y\_1} \cdot \dot{y}\_2 = \psi\_1 (y\_1, y\_2, \dot{y}\_1, \dot{y}\_2), \tag{21}$$

$$w\_q = \mu\_2 = \mathbb{R}\_8 y\_2 + \omega\_\ell \mathbb{1}\_d(y\_1, y\_2) + \frac{\partial \mathbb{1}\_q(y\_1, y\_2)}{\partial y\_1} \cdot \dot{y}\_1 + \frac{\partial \mathbb{1}\_q(y\_1, y\_2)}{\partial y\_2} \cdot \dot{y}\_2 = \psi\_2(y\_1, y\_2, \dot{y}\_1, \dot{y}\_2). \tag{22}$$

The control scheme mentioned in Section 3.2 is applied to deal with some inevitable modeling errors and uncertainties. By referring to Equation (6), the control laws of current control can express as follow:

$$
\dot{y}\_1 = \dot{\Psi}\_{dref} + \mathcal{K}\_p \varepsilon\_d + \mathcal{K}\_i \int \varepsilon\_d dt \,\tag{23}
$$

$$
\dot{y}\_2 = \dot{\Psi}\_{qref} + \mathcal{K}\_p \varepsilon\_q + \mathcal{K}\_i \int \varepsilon\_q dt. \tag{24}
$$

Consequently, the output control variables yield as follow:

$$
\mu\_1 = v\_d = \dot{y}\_1 + IDE\_{d\nu} \tag{25}
$$

$$
\mu\_2 = v\_q = \dot{y}\_2 + IDE\_{q\prime} \tag{26}
$$

where the Inverse Dynamic Equations (IDEs) are

$$IDE\_d = -R\_s i\_d + \omega\_\varepsilon \Psi\_{q\prime} \tag{27}$$

$$IDE\_q = -R\_s i\_q + \omega\_\varepsilon \Psi\_d.\tag{28}$$

The controller parameters are

$$K\_{pd} = K\_{pq} = \mathcal{Z}\_1 \omega\_{n1\prime} \tag{29}$$

and

$$K\_{\rm id} = K\_{\rm iq} = \omega\_{\rm n1\prime}^2 \tag{30}$$

where *ζ*1 and *ω*n1 are respectively the desirated governing damping ratio and natural frequency.

### *4.3. Differential Flatness Control of Speed Control Loop Development*

Figure 5 shows the proposed control diagram. The outer speed loop enables evaluating the torque reference value of the MPTA, which generates the current command for the inner current loop.

**Figure 5.** Schematic drawing of the designed control scheme.

For the MTPA algorithm, it has been proposed in [20]. So, the *Te* is defined as a command variable *u*3, and the flat output *y*3 is *ω*m (or measured angular speed). The system is flat if the control variable is a function of flat output that is

$$\mathfrak{u}\_{\mathfrak{3}} = T\_{\mathfrak{e}} = \mathfrak{f} \cdot \dot{\mathfrak{y}}\_{\mathfrak{3}} + \mathfrak{B}\_{\mathfrak{f}} \mathfrak{y}\_{\mathfrak{3}} + T\_{\mathrm{L}} = \psi\_{\mathfrak{3}}(\mathfrak{y}\_{\mathfrak{3}}, \dot{\mathfrak{y}}\_{\mathfrak{3}}).\tag{31}$$

The control strategy of the speed control loop is

$$
\dot{y}\_3 = \dot{\omega}\_{ref} + \mathcal{K}\_{p\omega} \varepsilon\_\omega + \mathcal{K}\_{i\omega} \int \varepsilon\_\omega dt. \tag{32}
$$

The control variable of the speed loop can be express as follow:

$$
\mu\_3 = \mathbf{J} \cdot \dot{\mathbf{y}}\_3 + \mathbf{J} \cdot \text{IDE}\_{\omega\nu} \tag{33}
$$

where the inverse dynamic equation of the speed control loop (IDEω) is

$$IDE\_{\omega} = \frac{1}{J}(\mathcal{B}\_{\mathbf{f}} \cdot \mathcal{y}\_{\mathbf{3}} + T\_{\mathbf{L}}).\tag{34}$$

The controller parameters are defined as the following equation.

$$K\_{p\omega} = 2\mathbb{Z}\_2\omega\_{n2\omega} \tag{35}$$

and

$$K\_{i\omega} = \omega\_{n2\prime}^2\tag{36}$$

where *ζ*2 and *ωn*2 are, respectively, the desirated governing damping ratio and the natural frequency of the outer speed regulation loop.

Based on the current and speed control law development, the natural frequency setting of the designed controller is depicted in Figure 6. The switching frequency *fs* of the inverter shown in Figure 4 is equal to 16 kHz (*ωs* = 105 rad.s−1 ) and it is reported in Figure 6. According to Figure 5, the speed control loop must be faster than the current control loop given that the outer speed loop enables assessing the torque reference value, and consequently the current. Considering the Nyquist-Shannon Theorem, the natural frequency *ωn*1 must be chosen lower than a frequency equal to 102 rad.s−1 (namely two times lower than the switching frequency *ωs*). Therefore, the natural frequency *ωn*1 for the current control loop has been tuned at 2000 rad.s−1 ; while for the speed control loop, a natural frequency *ωn*2 has been set at 20 rad.s−1 (100 times lower than *ωn*1). Both values have been reported in Figure 6, allowing defining the stable region included between these two values; whereas the unstable region is outside the natural frequency *ωn*1. Regarding the tuning of the damping ratios *ζ*1 and *ζ*2, to guarantee underdamped transient behaviors with low overshoot and fast response, both parameters have been set at 0.7.

**Figure 6.** The natural frequency setting of the designed controller.

Note that the stability and response of the differential flatness-based control are easy to set compared to the traditional PI controller. By defining and selecting the governing damping and natural frequency [21,22], as shown in Figure 6, the controller parameters of current and speed loop control may be calculated by Equations (29), (30), (35) and (36).

### *4.4. Trajectory Planning*

The trajectory planning enables restricting the derivative terms. The reference inputs have been defined by trajectory planning utilized by the second-order low-pass filter. The trajectory planning of the current control loops are

$$\frac{y\_{1REF}(s)}{y\_{1COM}(s)} = \frac{y\_{2REF}(s)}{y\_{2COM}(s)} = 1 \Big/ \left( \left(\frac{s}{\omega\_{n3}}\right)^2 + \frac{2\zeta\_3}{\omega\_{n3}} + 1 \right). \tag{37}$$

In the speed control loop, the trajectory planning has been determined by the following equation.

$$\frac{y\_{3REF}(s)}{y\_{3COM}(s)} = 1 \left/ \left( \left( \frac{s}{\omega\_{n4}} \right)^2 + \frac{2\zeta\_4}{\omega\_{n4}} + 1 \right) \right. \tag{38}$$

where *ζ*3, *ω*3, *ζ*4, and *ω*4 are the governing damping and natural frequencies of the secondorder low-pass filters, respectively.

### **5. Simulation and Experimental Validation**

### *5.1. Experimental Setup*

A small-scale test bench 1-KW relying on the PMa-SynRM has been conceived in the laboratory, as shown in Figure 7. Table 2 sums up the principal parameters of the studied machine. Table 3 outlines the controller parameters. The motor is supplied by

a 3-kW 3-phase inverter (DC/AC) operating at a switching frequency of 16 kHz. Besides, the input DC grid voltage of the inverter is fed by a 3-phase variable power supply combined with a 3-phase diode rectifier. The PMa-SynRM is mechanically coupled with an IPMSM (interior permanent magnet synchronous motor) feeding a resistive load (see Figures 4 and 7). Regarding the measurements both for the speed and rotor angle, they have been acquired by a resolver placed on the rotor shaft. The developed control scheme (see Figure 5) relying on the differential flatness controller has been modeled in the Matlab/Simulink software, and then it has been incorporated in the dSPACE 1202 MicroLabBox real-time interface to generate the gate control signals applied to the VSI.

**Figure 7.** The experimental setup.

**Table 2.** Specification and parameters of the motor/inverter.

**Table 3.** Current/torque and speed regulation parameters.

*5.2. Simulation and Test-Bench Results of the Speed Reversal Employing the Differential Flatness Controller*

For the first scenario, Figure 8 reports the obtained simulation results; whereas, Figure 9 exhibits the performed experimental tests to assess the dynamic performance of the designed controller when forcing the motor to reverse direction. In Figure 8, Ch1–10 are the command signal of the speed *n*COM, the reference signal of the speed *n*REF, the measured speed *n*, the command of q-axis current *i*qCOM, the reference of q-axis current *i*qREF, the q-axis current *i*q, the command of d-axis current *i*dCOM, the reference of d-axis current *i*dREF, and the d-axis current *i*d, respectively. In comparison, in Figure 9, Ch1–8 are the speed command *n*COM, the speed reference *n*REF, the measured speed *n*, the current *i*q, the current reference *i*dREF, the current *i*d, and the current reference *i*qREF, respectively. Firstly, the PMa-SynRM model has been tested by using Matlab/Simulink to support that the elaborated control system is appropriately conceived. Simulations and experimental tests have demonstrated that both simulation and experimental results are similar. Thus, the PMa-SynRM model is fit, and the controller parameters are suitably designed by choosing desired parameters. The experimental results indicate that the PMa-SynRM behaves in a good way when operating under the regenerative mode up to the speed the reference gets positive. Furthermore, it can be emphasized that the measured speed through the resolver enables tracking adequately the speed reference value. Afterward, the operation of the PMa-SynRM is shifted to the motoring mode up to the rotor speed comes to the speed command. The *d*-and *q*-axes currents reveal an appropriate behavior without surpassing the imposed limits. The dominant parameters of the PMa-SynRM enable being ensured, and the elaborated control offers worthwhile dynamic performance.

**Figure 8.** Simulation results: motor speed reversal.

**Figure 9.** Experimental results: motor speed reversal.

*5.3. Experimental Results of the Comparison between the Conventional PI Control and Differential Flatness Control*

For the second scenario, the performance of the system when the torque/current loop employs traditional PI control and differential flatness is compared to assess the benefits of the elaborated control scheme. Figure 10a represents the experimental results of the conventional PI control, and Figure 10b illustrates the experimental results of differential flatness control. In Figure 10a, Ch1 is the current *i*dCOM, Ch3 is the measured current *i*d, Ch4 is the measured current *i*q, and Ch5 is the measured speed *n*. In Figure 10b, Ch1 is the current *i*dCOM, Ch3 is the measured current *i*d, Ch4 is the measured current *i*q, and Ch5 is the measured speed *n*. As shown in Figure 10a,b, in a transitory operation, the *i*d of PI control exhibits a small overshoot, compared to the differential flatness controller, and the *i*q of the PI control shows oscillations.

**Figure 10.** Experimental results: (**a**) the traditional PI control, (**b**) the differential flatness control.

Although the PI controller has used decoupling and back-emf compensation, it demonstrates that the proposed nonlinear controller has a better transient current performance than the traditional linear controller. Furthermore, the speed response (Ch5 of Figure 10a) of the linear cascaded PI controller includes fluctuations, unlike the proposed nonlinear controller (Ch5 of Figure 10b).

For the third scenario, Figure 11a confirms the experimental results of the conventional PI controller, and Figure 11b indicates the experimental validation results of the differential flatness controller when the motor is forced to reverse direction from −1000 rpm to 1000 rpm. In Figure 11a, Ch1 is the speed command *n*COM, Ch2 is the speed *n*, Ch3 is the current command *i*qCOM, Ch4 is the measured current *i*q, Ch5 is the current command *i*dCOM, and Ch6 is the measured current *i*d. In Figure 11b, Ch1 is the speed command *n*COM, and Ch2 is the acquired speed *n*, Ch3 is the current command *i*qCOM, Ch4 is the measured current *i*q, Ch5 is the current command *i*dCOM, and Ch6 is the measured current *i*d. On one hand, as demonstrated in Figure 11a, during a transient process, the acquired speed *n* of the PI controller shows an overshoot, and the settling time is approximately 0.45 s. On the other hand, the differential flatness controller (Figure 11b), approximate time is around 0.15 s, as well as the measured *i*q of the PI controller, which fluctuates sharply (Ch4 of Figure 11a) in a transient process. The experimental results reflect that differential flatness has a better dynamic speed performance than the traditional PI controller.

**Figure 11.** *Cont.*

**Figure 11.** Experimental results: (**a**) the traditional PI control, (**b**) the differential flatness control.

For the fourth scenario, Figure 12a shows the test-bench results of the conventional PI controller; while, Figure 12b depicts the preliminary results of the differential flatness control when suddenly adding an external torque disturbance. In Figure 12a, Ch2 is the measured *d*-axis current *i*d, Ch3 is the measured *q*-axis current *i*q, Ch4 is the measured speed *n*, Ch5 is the measured phase-A current *i*a, and the trajectories of the transient stator current. In Figure 12b, Ch2 is the measured *d*-axis current *i*d, Ch3 is the measured *q*-axis current *i*q, Ch4 is the measured speed *n*, Ch5 is the phase-A current *i*a, and the path of the transient stator current. The experimental results are shown in Figure 12b, validating that differential flatness speed oscillation is roughly 113 rpm; whereas that for the PI controller is 221 rpm. The recuperation time of speed with the elaborated controller is also shorter than that with conventional PI control. These results corroborate that differential flatness control has better dynamic performance both for the torque/current and speed loop control and the external rejection ability.

**Figure 12.** Experimental results: (**a**) the traditional PI control (**b**) the differential flatness control.

### **6. Conclusions**

To cope with the control issues met in a permanent magnet-assisted synchronous reluctance motor (PMa-SynRM), various control approaches have been previously investigated. Nonetheless, the achievement of high performance is still a challenging barrier due to the nonlinear characteristics and parameter uncertainty conditions of this motor. In this work, a differential flatness control law has been elaborated and designed to control both current/torque and the speed of the PMa-SynRM. Furthermore, an intelligent proportionalintegral (*i*PI) has been combined with the nonlinear differential flatness controller to face unavoidable modeling errors and uncertainties for the torque and speed of the motor. This model-based approach requires an accurate model. In case the model is not perfectly known, the estimation of the unknown part is necessary to achieve the expected high performance. Through simulations and experimental tests performed on a small-scale test bench 1-KW including the PMa-SynRM, the dynamic performances of the system have been validated; while demonstrating the performance superiority of the differential flatness controller over the conventional PI controller from the overshoot and oscillation point of view. Furthermore, the results reflect that the dynamic recovery time response is faster using intelligent PI control than the field-oriented control (FOC) based on PI controller with approximately 0.15 s.

In the future work, another control approach will be tentatively applied to the control of PMa-SynRM. This approach, called the model-free control, does not require an accurate model. Indeed, only very limited knowledge of the controlled system is enough to regenerate the control action. Advantages and drawbacks of this controller will be discussed and its performance will be compared to the flatness-based controller in the next work.

**Author Contributions:** Conceptualization, B.N.-M. and N.T.; methodology, S.S., N.P., D.G. and P.T.; validation, S.S., N.P., D.G. and P.T.; formal analysis, N.B.; writing—original draft preparation, P.T.; writing—review and editing, S.S., D.G. and N.B.; visualization, N.B.; supervision, B.N.-M. and N.T. All authors have read and agreed to the published version of the manuscript.

**Funding:** This work was partially supported by the International Research Partnerships: Electrical Engineering Thai-French Research Center (EE-TFRC) between Université de Lorraine (UL) and King Mongkut's University of Technology North Bangkok (KMUTNB) and Framework Agreement between the University of Pitesti and King Mongkut's University of Technology North Bangkok through the Research Program Cooperation under Grant KMUTNB–61–GOV–01–67. Besides, this work was supported partly by the French PIA project «Lorraine Université d'Excellence», reference ANR-15-IDEX-04-LUE.

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Data Availability Statement:** The data presented in this study are available on request from the corresponding authors. The data are not publicly available due to their current utilization for future works involving the authors of this paper.

**Acknowledgments:** The authors would like to express their gratitude to the GREEN laboratory at the University of Lorraine and King Mongkut's University of Technology North Bangkok (KMUTNB) for their constant support in boosting collaborations between France and Thailand.

**Conflicts of Interest:** The authors declare no conflict of interest.

### **References**

## *Review* **State-of-the-Art Review on IoT Threats and Attacks: Taxonomy, Challenges and Solutions**

**Ritika Raj Krishna 1 , Aanchal Priyadarshini 1 , Amitkumar V. Jha 1 , Bhargav Appasani 1 , Avireni Srinivasulu 2 and Nicu Bizon 3,4,\***

**Abstract:** The Internet of Things (IoT) plays a vital role in interconnecting physical and virtual objects that are embedded with sensors, software, and other technologies intending to connect and exchange data with devices and systems around the globe over the Internet. With a multitude of features to offer, IoT is a boon to mankind, but just as two sides of a coin, the technology, with its lack of securing information, may result in a big bane. It is estimated that by the year 2030, there will be nearly 25.44 billion IoT devices connected worldwide. Due to the unprecedented growth, IoT is endangered by numerous attacks, impairments, and misuses due to challenges such as resource limitations, heterogeneity, lack of standardization, architecture, etc. It is known that almost 98% of IoT traffic is not encrypted, exposing confidential and personal information on the network. To implement such a technology in the near future, a comprehensive implementation of security, privacy, authentication, and recovery is required. Therefore, in this paper, the comprehensive taxonomy of security and threats within the IoT paradigm is discussed. We also provide insightful findings, presumptions, and outcomes of the challenges to assist IoT developers to address risks and security flaws for better protection. A five-layer and a seven-layer IoT architecture are presented in addition to the existing three-layer architecture. The communication standards and the protocols, along with the threats and attacks corresponding to these three architectures, are discussed. In addition, the impact of different threats and attacks along with their detection, mitigation, and prevention are comprehensively presented. The state-of-the-art solutions to enhance security features in IoT devices are proposed based on Blockchain (BC) technology, Fog Computing (FC), Edge Computing (EC), and Machine Learning (ML), along with some open research problems.

**Keywords:** Internet of Things; security; threats; privacy; vulnerabilities; Blockchain

## **1. Introduction**

We live in a time when technology is an essential requirement for all humans, and the evidence is the increased dependence on technology in almost every aspect of our lives. Today's world is evolving with the rapidly growing Internet of Things (IoT)-based application [1]. The rise of the IoT has been a glorious phenomenon in recent years. The physical and virtual objects implanted with sensors, software, and other technologies are interlinked together in IoT [2]. It envisages communicating and sharing data with other devices and systems worldwide over the Internet. Further, IoT is like an array of network-enabled devices that exclude traditional computers such as laptops and servers.

IoT has sprawled everywhere, starting from the healthcare sector to the big industries. It is now implantable, wearable, and portable, resulting in a pervasive and interactive

**Citation:** Krishna, R.R.;

Priyadarshini, A.; Jha, A.V.; Appasani, B.; Srinivasulu, A.; Bizon, N. State-of-the-Art Review on IoT Threats and Attacks: Taxonomy, Challenges and Solutions. *Sustainability* **2021**, *13*, 9463. https:// doi.org/10.3390/su13169463

Academic Editor: Zubair Baig

Received: 30 May 2021 Accepted: 18 August 2021 Published: 23 August 2021

**Publisher's Note:** MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Copyright:** © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/).

world [3]. It modifies the physical objects around us into smart objects, creating an information environment that increasingly changes human living standards. For instance, IoT devices track and collect essential measurements (such as blood pressure, blood sugar level, pulse rate, etc.) in real time, allowing emergency alerts to improve the odds of a patient's survival [4]. Moreover, autonomous and self-driving vehicles prevent drivers from deviating from paths or accidents while providing them assistance to reach their destinations. In addition, those definitions are expanded to provide automatic emergency alerts of the closest road and medical assistance in the event of an accident. IoT also covers many aspects of modern industries, including manufacturing, assembly, packing, logistics, smart cities, and aviation industries [5]. Some of the essential IoT-based application domains in health, commerce, communication, and entertainment are shown in Figure 1. information environment that increasingly changes human living standards. For instance, IoT devices track and collect essential measurements (such as blood pressure, blood sugar level, pulse rate, etc.) in real time, allowing emergency alerts to improve the odds of a patient's survival [4]. Moreover, autonomous and self-driving vehicles prevent drivers from deviating from paths or accidents while providing them assistance to reach their destinations. In addition, those definitions are expanded to provide automatic emergency alerts of the closest road and medical assistance in the event of an accident. IoT also covers many aspects of modern industries, including manufacturing, assembly, packing, logistics, smart cities, and aviation industries [5]. Some of the essential IoT-based application domains in health, commerce, communication, and entertainment are shown in Figure 1.

devices and systems worldwide over the Internet. Further, IoT is like an array of network-

IoT has sprawled everywhere, starting from the healthcare sector to the big industries. It is now implantable, wearable, and portable, resulting in a pervasive and interactive world [3]. It modifies the physical objects around us into smart objects, creating an

enabled devices that exclude traditional computers such as laptops and servers.

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 2 of 47

Smart Transportation

**Figure 1.** Important IoT application domains. **Figure 1.** Important IoT application domains.

To implement IoT, the traditional technology had to undergo some major modifications. For example, to convert an isolated device into a transmitting device, there is a need to increase small computing devices' memory and processing capacity while dramatically reducing their size [6]. Further, the creation of various lightweight, secure protocols for communication between different IoT devices is equally important. The improvements to the conventional networks to help the operation of the IoT ecosystem have their own set To implement IoT, the traditional technology had to undergo some major modifications. For example, to convert an isolated device into a transmitting device, there is a need to increase small computing devices' memory and processing capacity while dramatically reducing their size [6]. Further, the creation of various lightweight, secure protocols for communication between different IoT devices is equally important. The improvements to the conventional networks to help the operation of the IoT ecosystem have their own set of consequences. However, the unprecedented growth of interconnected devices has crippled the IoT ecosystem. Consequently, there exists enough scope for threats and attacks in IoT-based applications.

In-flight services

The Global Vice President at New Net Technologies (NNT), Dirk Schrader, stated that IoT-based computers have become the crown jewels of cybercriminals. He also said that less than 42% of businesses can detect insecure IoT devices. Hence, for researchers to develop well-grounded solutions to trace and avert these threats, they must first understand the threats and attacks to make the IoT environment safe, secure, and reliable. There are three significant aspects to consider while examining the IoT from a security perspective. To begin with, there are a massive number of smart devices, possibly billions. This suggests that the IoT would be the most complex man-made system ever in terms of the number of entities involved [7]. Second, they are essentially heterogeneous, with respect to the functionality, protocol stacks, radios, operating systems (some objects do not even have one), energy sources, identities, and so on [8]. Third, each smart object is owned by a company or a person, and it is managed by the same or a different company or individual. Millions of businesses and individuals are in control of a subset of the smart objects in their management domains. From the standpoint of protection, privacy, and trust, how this control is technically upheld is a critical issue.

The attack surface in the IoT domain has increased significantly, as have the possible threats to the protection of these entities in the domain [9]. For example, the security threats to the autonomous and self-driving industry may lead to disastrous consequences. Autonomous vehicles are vulnerable to sensor-based attacks. By manipulating the sensors (e.g., linear acceleration sensor, magnetic sensor, etc.), attackers may collect data, transfer malware to it, or trigger a malicious activity [10]. Furthermore, smartphones and embedded systems contribute to a digital ecosystem for global communication that simplifies lives by being sensitive, flexible, and responsive to human needs. However, on the other hand, security cannot be assured due to vulnerabilities in IoT. When a user's signal is disrupted or intercepted, their privacy may be jeopardized, and their information may be leaked.

The state-of-the-art survey on various aspects of IoT, including security, privacy, and robustness, has been presented in [11] by Chen et al. The authors focused on specific issues of IoT interface positioning and localization. The development of lightweight block cipher algorithms has been proposed to be used in devices for data encryption and decryption [12]. A desktop review and qualitative analysis have been performed by Gamudani et al. in [13] to compute performance analysis of attacks. Cryptographic approaches have been discussed in [14] as a method of ensuring long-term security approaches. Different layer architectures of IoT and security issues associated with them have been discussed with possible countermeasures using Blockchain (BC) in [15]. The survey on security aspects of IoT has been presented by Alaba et al. in [16], covering the scope of security countermeasures in some other allied paradigms, including Machine-to-Machine (M2M), Cyber-Physical System (CPS), and Wireless Sensor Networks (WSNs). In [17], Abomhara et al. discussed various applications of IoT and the security threats related to them, including vulnerabilities, intruders, and some other attacks. The threats concerning security and privacy in IoT architecture have been presented without counter measuring techniques by Kozlov et al. in [18].

The organization of the paper is as follows. The state-of-the-art motivation and contributions of this research are presented in Section 2. The background of the IoT as the foundation to the security threats and attacks is presented in Section 3. Section 4 deals with the IoT reference model and the protocol stack. The state-of-the-art review on the vulnerabilities with threats and attacks taxonomy in the IoT paradigm is presented in Section 5. Security goals and a roadmap in IoT are presented in Section 6. Section 7 deals with the state-of-the-art security solution for IoT framework using ubiquitous technologies, such as BC, FC, EC, and ML. Some of the open research problems are discussed in Section 8. The last section deals with the conclusion of the article with future scope for research.

#### **2. State-of-the-Art, Motivation, and Contributions of This Research 2. State-of-the-Art, Motivation, and Contributions of this Research**

### *2.1. Trends in Literature and Motivation 2.1. Trends in Literature and Motivation*

There is an ample amount of work in literature focusing on the IoT from various perspectives. Particularly, aspects such as applications, architecture, protocols, and standards are extensively covered in the literature. However, threats and attacks in IoT are comparatively less explored. The analysis from one of the world's largest databases, i.e., SCOPUS, can be used to understand the relevance of the particular aspects of IoT. If we search the number of articles in the SCOPUS database that focus on IoT architecture, IoT architecture and threats, and IoT architecture and attacks, then it can be corroborated from the search results that the threats and attacks analysis of IoT architecture is sparsely explored in the literature, which can be validated from the SCOPUS statistics seen in Figure 2. Further, there is rapid growth in the interest of the researchers towards threats and attacks analysis in the IoT architecture. This can be corroborated from the number of articles pertaining to the threats and attacks analysis in IoT architecture, which was four and zero, respectively, in 2010, and rapidly increased to 73 and 157, respectively, up to the third quarter of the year 2021 (approximately). There is an ample amount of work in literature focusing on the IoT from various perspectives. Particularly, aspects such as applications, architecture, protocols, and standards are extensively covered in the literature. However, threats and attacks in IoT are comparatively less explored. The analysis from one of the world's largest databases, i.e., SCO-PUS, can be used to understand the relevance of the particular aspects of IoT. If we search the number of articles in the SCOPUS database that focus on IoT architecture, IoT architecture and threats, and IoT architecture and attacks, then it can be corroborated from the search results that the threats and attacks analysis of IoT architecture is sparsely explored in the literature, which can be validated from the SCOPUS statistics seen in Figure 2. Further, there is rapid growth in the interest of the researchers towards threats and attacks analysis in the IoT architecture. This can be corroborated from the number of articles pertaining to the threats and attacks analysis in IoT architecture, which was four and zero, respectively, in 2010, and rapidly increased to 73 and 157, respectively, up to the third quarter of the year 2021 (approximately).

**Figure 2.** Literature statistics on IoT architecture, IoT architecture and threats, and IoT architecture and attacks. **Figure 2.** Literature statistics on IoT architecture, IoT architecture and threats, and IoT architecture and attacks.

A similar trend can be seen with respect to the protocols and standards in the IoT paradigm. The publication statistics obtained from the SCOPUS database for the articles on IoT protocols, IoT protocols and threats, and IoT protocols and attacks are shown in Figure 3. The plotted statistics reveal that the threats and attacks analysis in IoT protocols were sparsely explored in the past 10 years. Nevertheless, these aspects are gaining rapid momentum, which can be corroborated from the published articles on threats and attacks analysis in IoT protocols, which were six and five, respectively, in 2010, and have increased to 160 and 254, respectively, by the third quarter of 2021 (approximately). In a nutshell, the increasing interests of the researchers in the paradigm of IoT architecture and A similar trend can be seen with respect to the protocols and standards in the IoT paradigm. The publication statistics obtained from the SCOPUS database for the articles on IoT protocols, IoT protocols and threats, and IoT protocols and attacks are shown in Figure 3. The plotted statistics reveal that the threats and attacks analysis in IoT protocols were sparsely explored in the past 10 years. Nevertheless, these aspects are gaining rapid momentum, which can be corroborated from the published articles on threats and attacks analysis in IoT protocols, which were six and five, respectively, in 2010, and have increased to 160 and 254, respectively, by the third quarter of 2021 (approximately). In a nutshell, the increasing interests of the researchers in the paradigm of IoT architecture and protocols,

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 5 of 47

tivating factor for the present work.

attacks.

which are sparsely explored from threats and attacks point-of-view, is the motivating factor for the present work. protocols, which are sparsely explored from threats and attacks point-of-view, is the motivating factor for the present work.

protocols, which are sparsely explored from threats and attacks point-of-view, is the mo-

**Figure 3.** Literature statistics on IoT protocols, IoT protocols and threats, and IoT protocols and **Figure 3.** Literature statistics on IoT protocols, IoT protocols and threats, and IoT protocols and attacks. attacks.

The other motivating factor for the present work is the threats and attacks analysis and possible solutions using ubiquitous technologies, such as BC, Fog Computing (FC), Edge Computing (EC), and Machine Learning (ML). The threats and attacks analysis and possible solutions in architecture, protocols, and standards have gained significant momentum in the past few years, corroborating the upwards trend in the published articles The other motivating factor for the present work is the threats and attacks analysis and possible solutions using ubiquitous technologies, such as BC, Fog Computing (FC), Edge Computing (EC), and Machine Learning (ML). The threats and attacks analysis and possible solutions in architecture, protocols, and standards have gained significant momentum in the past few years, corroborating the upwards trend in the published articles as per the SCOPUS database statistics shown in Figure 4. The other motivating factor for the present work is the threats and attacks analysis and possible solutions using ubiquitous technologies, such as BC, Fog Computing (FC), Edge Computing (EC), and Machine Learning (ML). The threats and attacks analysis and possible solutions in architecture, protocols, and standards have gained significant momentum in the past few years, corroborating the upwards trend in the published articles as per the SCOPUS database statistics shown in Figure 4.

as per the SCOPUS database statistics shown in Figure 4.

**Figure 4.** Literature statistics on IoT and BC, IoT and FC, IoT and EC, and IoT and ML from SCOPUS database. **Figure 4.** Literature statistics on IoT and BC, IoT and FC, IoT and EC, and IoT and ML from SCOPUS database. **Figure 4.** Literature statistics on IoT and BC, IoT and FC, IoT and EC, and IoT and ML from SCOPUS database.

IoT is far behind in realizing its true potential due to the lack of interoperability. The most comprehensive review on security standards and interoperability goals is presented by Lee et al. [19]. To comprehensively review the existing architectures, protocols, and standards is one of the promising means to address the interoperability issues in IoT and other challenges. If we look at the trend of the type of documents in the SCOPUS database, it can be seen that researchers are significantly contributing with Review articles (12.2%) being the third most in number behind Articles (50.8%) and Conference papers (29.1%). These statistics obtained from the SCOPUS database are shown in Figure 5. Conclusively, the present work is a review that comprehensively surveys the existing work and presents the possible solution in the context of threats and attacks pertaining to the architecture, protocols, and standards in the IoT paradigm. most comprehensive review on security standards and interoperability goals is presented by Lee et al. [19]. To comprehensively review the existing architectures, protocols, and standards is one of the promising means to address the interoperability issues in IoT and other challenges. If we look at the trend of the type of documents in the SCOPUS database, it can be seen that researchers are significantly contributing with Review articles (12.2%) being the third most in number behind Articles (50.8%) and Conference papers (29.1%). These statistics obtained from the SCOPUS database are shown in Figure 5. Conclusively, the present work is a review that comprehensively surveys the existing work and presents the possible solution in the context of threats and attacks pertaining to the architecture, protocols, and standards in the IoT paradigm.

IoT is far behind in realizing its true potential due to the lack of interoperability. The

*Sustainability* **2021**, *13*, x FOR PEER REVIEW 6 of 47

**Figure 5.** Literature trends from SCOPUS database. **Figure 5.** Literature trends from SCOPUS database.

*2.2. Comparison with Existing Surveys*

*2.2. Comparison with Existing Surveys* Several works have surveyed IoT, its architecture, its reference model, communication protocols, etc., from the perspective of security, threats, and vulnerabilities with possible countermeasure methodologies. In this section, some of the existing surveys are dis-Several works have surveyed IoT, its architecture, its reference model, communication protocols, etc., from the perspective of security, threats, and vulnerabilities with possible countermeasure methodologies. In this section, some of the existing surveys are discussed and compared with the present work.

cussed and compared with the present work. Many works in the literature cover the various aspects of the threats and attacks in IoT. Authors in [20–26] cover the taxonomy of the threats and attacks pertaining to the IoT. These works mainly focus on two broad categories: the architecture of IoT and protocols/standards in IoT. Despite covering the threats and attacks taxonomy, only a few of these works present the possible countermeasures. However, none of these works present countermeasures of threats and attacks based on ubiquitous technology such as BC, FC, EC, and ML. Such ubiquitous technologies in analyzing the threats and attacks have been Many works in the literature cover the various aspects of the threats and attacks in IoT. Authors in [20–26] cover the taxonomy of the threats and attacks pertaining to the IoT. These works mainly focus on two broad categories: the architecture of IoT and protocols/standards in IoT. Despite covering the threats and attacks taxonomy, only a few of these works present the possible countermeasures. However, none of these works present countermeasures of threats and attacks based on ubiquitous technology such as BC, FC, EC, and ML. Such ubiquitous technologies in analyzing the threats and attacks have been surveyed in scattered ways by the authors in [27–37]. A comprehensive review of all these technologies to combat IoT threats and attacks is not available.

surveyed in scattered ways by the authors in [27–37]. A comprehensive review of all these technologies to combat IoT threats and attacks is not available. The comprehensive survey on security and attacks with possible countermeasures solutions has been presented by Abosata et al. in [20], where authors consider the application-specific IoT architecture belonging to industrial IoT. Mann et al. in [21] presented the classification of attacks pertaining to the IoT environment. For attack classification, authors have considered a three-layer architecture comprising devices, gateway, and cloud with respect to the possible attack type. The countermeasures have also been discussed. Ogonji has comprehensively presented a threat taxonomy for the IoT environment in [22], including two broad categories: security threat and privacy threat. The authors of this survey presented taxonomy and countermeasures for the three-layer domain-specific IoT architecture. The state-of-the-art survey on intrusion detection for mitigating the impact of threats and attacks on IoT systems has been presented by Zarpelão et al. [23]. The The comprehensive survey on security and attacks with possible countermeasures solutions has been presented by Abosata et al. in [20], where authors consider the applicationspecific IoT architecture belonging to industrial IoT. Mann et al. in [21] presented the classification of attacks pertaining to the IoT environment. For attack classification, authors have considered a three-layer architecture comprising devices, gateway, and cloud with respect to the possible attack type. The countermeasures have also been discussed. Ogonji has comprehensively presented a threat taxonomy for the IoT environment in [22], including two broad categories: security threat and privacy threat. The authors of this survey presented taxonomy and countermeasures for the three-layer domain-specific IoT architecture. The state-of-the-art survey on intrusion detection for mitigating the impact of threats and attacks on IoT systems has been presented by Zarpelão et al. [23]. The authors proposed four attributes in the survey: intrusion detection placement strategy, detection method, security threats, and validation. A similar extensive survey by Hajiheidari et al. discusses the state-of-the-art intrusion detection system for IoT environment with a detailed

authors proposed four attributes in the survey: intrusion detection placement strategy,

dari et al. discusses the state-of-the-art intrusion detection system for IoT environment

taxonomy of the attacks responsible for intrusion in IoT at various layers [24]. The seminal survey using the top-down approach on various aspects of security in the IoT environment from application-specific IoT architecture has been presented by Kouicem et al. [25]. The authors have also presented the detailed taxonomy of security solutions covering several application-specific IoT architectures, and they also proposed software-defined networkingbased solutions to the security in IoT. Sun et al., in [26], focused on the physical layer of the IoT and presented a rich survey covering various security aspects of the protocols and standards, including the countermeasure methodologies. All these surveys are rich in content covering various aspects of threats and attacks in the context of IoT architectures or protocols. Despite presenting the possible countermeasures of threats and attacks, the countermeasures based on rapidly evolving technologies such as BC, FC, EC, ML, etc., have not been discussed to the authors' best knowledge. However, the concluding remarks of all these surveys identified some of the research gaps and provided a hint towards utilizing these technologies.

Elazhary [27] has presented an extensive survey on such computing technologies in the paradigm of IoT. Despite handling various aspects of IoT, particularly computation, processing, and analysis of voluminous IoT data, the security aspects of these data from the architecture point of view are not extensively covered in this survey. Taylor, P.J. et al., in [28], presents a seminal survey of using BC technology for providing the security countermeasures in IoT environment with some open challenges to incorporate other such technologies in the IoT for improving cybersecurity. BC as an infrastructure for IoT architecture with enhanced performance and security has been proposed by Memon et al. in [29]. In this survey, the authors have presented a comparative survey on cloud-based vs BC-based IoT architecture and identified some research gaps with some other similar technologies such as EC and FC. From the point of design objectives, a systematic survey on BC envisioning secure IoT infrastructure has been presented by Tran et al. in [30].

Fersi et al. developed a comprehensive survey in [31] about the scope of FC from the various aspects of the IoT, including enhanced data computing, network management, interoperability issues, security, etc. A similar review on FC from several perspectives, including threats and attacks countermeasures, has been presented by Atlam et al. [32]. Hamdan et al., in [33], comprehensively review the architecture of IoT based on EC. The survey is very rich from the architectural point of view; however, the threats and attacks analysis of such EC-based architecture is narrowly covered in this survey. Another pragmatic survey with EC-based architecture in IoT covering physical layer aspects is presented by Capra et al. in [34]. In this survey, the authors also cover the security aspects of hardware-based IoT architecture. Knowing the extraordinary effectiveness of the EC in IoT, the most seminal survey on the various simulator that can be used to validate the IoT model has been presented by Ashouri et al. in [35]. This survey is one of the best in its field, covering the EC-based simulation tools in IoT, which can even be exploited for modeling and analysis of threats and attacks in the IoT environment.

One of the most comprehensive surveys in the paradigm of ML to enable security and privacy in the IoT data ecosystem has been presented by Amiri et al. in [36]. This survey considers an ML-based approach for enhancing privacy in the IoT data ecosystem where a three-layer architecture comprising perception, network, and application layers of IoT has been considered. The authors also propose a similar approach of using BC with ML to enhance security on the IoT data ecosystem. The state-of-the-art review on the application of ML for intrusion detection in IoT environment has been presented by Adnan in [37]. The authors consider the three dominant attributes, namely, computational complexity, concept drift, and dimensionality, which are mitigated by integrating ML in IoT, envisioning the security of the IoT-based applications.

Some of the other seminal surveys in this context are summarized in Table 1.

**Table 1.** Some of the key literature surveys and research papers, and their scope.

These surveys are classified based on: (1) scope of threats and attacks analysis in IoT—architecture, protocols/standards, and general; and (2) possible technology adopted as a solution to the threats and attacks in IoT. The last entry of this table presents the scope of the present survey to highlight a clear comparative picture of the contributions of this survey.

### *2.3. Scope of the Present Survey and Contributions*

As discussed in the previous sections, the threats and attacks analysis in IoT is scattered and none of the surveys so far, to the best knowledge of the authors, covers the threats and attacks taxonomy covering architecture, protocols, and standards of IoT with possible countermeasures using rapidly evolving ubiquitous technologies, such as BC, FC, EC, and

ML, simultaneously. The threats and attacks were discussed in general without focusing on architecture and protocols [38–40]. Security concerns were addressed in [38] using EC and in [40] using BC. The research gaps were identified, and some open research problems were proposed in [38,40]. The analysis on threats and attacks based on protocols and standards without addressing security solutions was shown in [41]. On the other hand, [42] neither covers the architecture nor protocols for analyzing the threats and attacks. However, security countermeasures were discussed using BC with open research problems in [42]. In [43], threats and attacks were analyzed based on architecture without any security countermeasures. In [44], threats and attacks were discussed based on architectures with possible security countermeasures using FC and EC, but it does not identify the research gaps. Similar observations can be made throughout the seminal existing surveys discussed in Table 1. A comparative analysis reveals that none of these surveys analyze the threats and attacks covering all aspects, i.e., architecture as well as protocols and standards. In addition, the security countermeasures have not been discussed in any one of the existing surveys using all four ubiquitous technologies, i.e., BC, FC, EC, and ML, simultaneously. An extensive survey on threats and attacks analysis in the context of IoT, its challenges, taxonomy, and possible technological solutions covering the most important aspects of the IoT, such as architecture, protocols, and standards, is presented in this work. The vital contributions of the paper are highlighted below:

### **3. Elementary Overview of an IoT System**

The IoT is an evolving notion as a vast network of interconnected devices and services that store, share, and process data to dynamically adapt to the environment. IoT offers an ocean of opportunities, and so, many organizations aim to have IoT services integrated into their business processes. Before discussing the security threats, vulnerabilities, attacks, etc., it is pertinent to have a keen understanding of the layout of IoT. The emerging IoT technology typically consists of three levels of hardware which are integrated using software [76]. IoT devices, controllers, and peripherals constitute the first level of IoT, gateways and networks are associated with the second level, whereas cloud servers and control devices are part of the third level of IoT. Such a typical IoT system is depicted in Figure 6, followed by a brief discussion of each level.

**Figure 6.** Elementary overview of an IoT system. **Figure 6.** Elementary overview of an IoT system.

### *3.1. IoT Devices, Controllers, and Peripherals*

*3.1. IoT Devices, Controllers, and Peripherals* The first level consists of IoT devices, controllers, and peripherals consisting of sensors, actuators, transducers, etc. Their basic function is to capture real-time data of the outer world and convert them into information for further analysis. These devices can be connected to or implanted in any device that needs to be tracked or mounted in the envi-The first level consists of IoT devices, controllers, and peripherals consisting of sensors, actuators, transducers, etc. Their basic function is to capture real-time data of the outer world and convert them into information for further analysis. These devices can be connected to or implanted in any device that needs to be tracked or mounted in the environment to control the device indirectly.

ronment to control the device indirectly. The IoT devices are embedded devices capable of transmitting information across a network to improve interactions with people and with other smart objects. These smart devices make up the bottom layer of the basic IoT architecture. One of the most important features of IoT devices is their ability to use multiple sensors for different applications. Sensors in IoT gadgets are generally coordinated through the sensor hubs. A sensor hub is a single point of connection that gathers and sends data from multiple sensors to the system processing unit. Gathering data is the foremost step [77]. A sensor hub uses various transport mechanisms such as Inter-Integrated Circuit (I2C) or Serial Peripheral Interface (SPI) to transfer data between the sensors and the applications. A communication channel between sensors and applications is established by these transmitting mecha-The IoT devices are embedded devices capable of transmitting information across a network to improve interactions with people and with other smart objects. These smart devices make up the bottom layer of the basic IoT architecture. One of the most important features of IoT devices is their ability to use multiple sensors for different applications. Sensors in IoT gadgets are generally coordinated through the sensor hubs. A sensor hub is a single point of connection that gathers and sends data from multiple sensors to the system processing unit. Gathering data is the foremost step [77]. A sensor hub uses various transport mechanisms such as Inter-Integrated Circuit (I2C) or Serial Peripheral Interface (SPI) to transfer data between the sensors and the applications. A communication channel between sensors and applications is established by these transmitting mechanisms that accumulate sensor data through IoT devices [78].

nisms that accumulate sensor data through IoT devices [78]. The vulnerabilities associated with some of the sensors in the IoT paradigm are de-The vulnerabilities associated with some of the sensors in the IoT paradigm are described in Table 2.

scribed in Table 2. **Table 2.** A few sensor types and their vulnerabilities.

Position Sensors GPS Location Inference Eavesdropping False Data Injection Magnetic Sensor Sensors are vulnerable to numerous security attacks and threats which might be internal or external depending upon their features [79]. To name a few, information tampering, Man-In-The-Middle Attack (MITM), Distributed Denial of Service (DDoS), jamming, etc., are some of the notable threats to the IoT sensors.

### *3.2. Gateways and Networks*

A gateway for IoT is a system or software program that connects the cloud to controller development boards, actuators, and smart devices [80]. It builds a bridge between the cloud and IoT devices. It systematically connects the field to the cloud. An IoT gateway, either a software application or a hardware appliance, is responsible for transmitting data between the cloud and IoT devices. It serves as a network router, connecting IoT devices to the cloud. It is capable of handling both inbound and outbound traffic. Inbound traffic is used for system management tasks, including upgrading device firmware, while outbound traffic is used to transfer IoT data to the cloud. The IoT gateway provides services to safely accumulate, operate, and filter data for analysis. It aids in the secure and safe transport of confederated data produced by the systems and the devices from the edge to the cloud. Ethernet, Wi-Fi, or a 4G/3G modem are used to link the IoT gateway to the cloud [81]. For data exchange and command transfer, a two-way communication channel is developed with the cloud. In an IoT environment, sensors and devices must logically communicate with other devices through the gateway or redirect the necessary data to the cloud. Some of the key functionalities of the IoT gateway are enumerated below.

Glancing over the number of functions and responsibilities of the IoT gateway, one can easily quote that it is essential to have a secure gateway network to carry out all the enlisted functions safely and efficiently. The gateway is prone to several different kinds of attacks which can be classified into five categories [82]:

The state-of-the-art discussion on these attacks is comprehensively discussed later in this article.

## *3.3. Cloud Servers and Control Device*

Smart devices of the IoT are being deployed at a rapid rate. However, the amount of data they produce makes it difficult to store and process in the local platforms. The unstructured IoT data can be easily stored in a public cloud infrastructure [83]. The scalability provided by cloud computing offers a solution to this problem. Cloud computing provides flexible computing and storage tools that can be used to assist in data management. As a result, this technology can be used to analyze data generated by sensors and IoT devices. Many of the major cloud providers use object storage technology to offer low-cost, scalable storage systems. Cloud computing allows businesses to store and analyze data easily and in real time, enabling them to get the most out of their data. According to a survey conducted by Information Week [84], 65% of respondents said that "the opportunity to satisfy business demands easily" was one of the most significant factors for a company to migrate to the cloud. Since they have high-speed networks with no data ingress fees, the public cloud is an excellent place to store the vast quantities of IoT data generated by

businesses. However, the public cloud has plenty to do. Big data analysis applications that consume and process vast amounts of unstructured content have been added to the product offerings of cloud service providers. This enables companies that can potentially process data more efficiently than a private data center to build highly scalable IoT applications. Depending on the device's networking features, devices can connect to the cloud in a variety of ways. Some of these are cellular, satellite, Wi-Fi, Low Power Wide Area Networks (LPWAN) such as NB-IoT, and direct access to the Internet through Ethernet.

While the cloud has acquired universal popularity, and most IoT applications use cloud services for data storage and retrieval. However, questions about whether cloud technologies are genuinely safe and reliable are continuing to be debated. Nevertheless, cloud risks should also be addressed. The cloud is a public platform used by many people, and there could be malicious users on the cloud who pose a risk to IoT data. The cloud is vulnerable to several attacks such as SQL injection, DDoS, weak authentication, malicious applications, back doors, exploits, etc. [85]. An extensive survey on these aspects is discussed later in this survey.

### **4. IoT Reference Model and Protocol Stack**

### *4.1. Three-Layer Reference Model*

The mitigation of security threats and attacks in IoT can be achieved by understanding the IoT reference model and protocol stack in-depth. There is no widely agreed-upon framework for the IoT [86]. However, different architectures have been suggested by different researchers [87]. The most basic architecture being followed widely is the threelayer reference model consisting of perception layer, network layer, and the application layer, which is illustrated in Figure 7a. The functionality of each of these layers is briefly summarized below.

translation, fortune, medical, environmental monitoring, and global management for all intelligent applications.

### *4.2. Five-Layer Reference Model*

The architecture of IoT has been further improved by decomposing the responsibilities and functionalities of the existing three-layer architecture, resulting in a five-layer architecture [91]. A five-layer architecture consisting of a perception layer, network layer, service layer, operation layer, and application layer is proposed, which is different from that proposed by [92]. The pictorial representation of the five-layer reference model is as shown in Figure 7b. It is worthy to note that the application layer is segregated into three layers, namely, service layer, operation layer, and application layer. The functionalities of the service, operation, and application layers are briefly summarized below, whereas the perception layer and network layer hold the same responsibilities.

	- Operation layer: This is an important layer, especially from the business point of view in IoT. The supervision of services offered by IoT, creating business models, visualization of the data, decision-making, etc., are some of the key responsibilities of this layer. Ensuring QoS across all layers is one of the vital responsibilities associated with this layer. This layer is also responsible for real-time monitoring, control, and evaluation of various application-specific parameters in an IoT environment. plication layer is liable for offering types of assistance and decides a bunch of conventions for message passing at the application level. The application layer serves as a bridge between applications and end clients, allowing them to communicate. It defines the allocation of resources and computation in data production, processing, screening, and feature selection. The application layer is a client-driven layer that
	- Application layer: This layer is primarily responsible for providing service to the end-users related to particular applications. There exists a wide range of applications envisaged using IoT, viz., smart city, smart home, smart agriculture, industry 4.0, healthcare, environmental monitoring, etc. This is the layer through which end users usually interact and pay for the service provided to them. performs various tasks for the clients and offers customized assistance as per a client's pertinent requirements [90]. This IoT layer brings together the industries to create high-level intelligent application solutions such as disaster monitoring, health monitoring, translation, fortune, medical, environmental monitoring, and global management for all intelligent applications.

(**a**) Three-Layer Architecture. (**b**) Five-Layer Architecture.

**Figure 7.** Three-layer vs proposed five-layer architecture of IoT. **Figure 7.** Three-layer vs proposed five-layer architecture of IoT.

### *4.2. Five-Layer Reference Model 4.3. Seven-Layer Reference Model*

The architecture of IoT has been further improved by decomposing the responsibilities and functionalities of the existing three-layer architecture, resulting in a five-layer architecture [91]. A five-layer architecture consisting of a perception layer, network layer, service layer, operation layer, and application layer is proposed, which is different from that proposed by [92]. The pictorial representation of the five-layer reference model is as Even though the architectures of IoT are either application-specific or domain-specific, we propose a more generic IoT architecture that comprises seven layers. The seven-layer generic IoT reference model comprises a perception layer, abstraction layer, network layer, transport layer, computing layer, operation layer, and application layer. The representation of the seven-layer reference model is as shown in Figure 8. Further, the functionality of each of the layers is briefly described below.

shown in Figure 7b. It is worthy to note that the application layer is segregated into three layers, namely, service layer, operation layer, and application layer. The functionalities of the service, operation, and application layers are briefly summarized below, whereas the

• Service layer: This layer envisages facilitating the use of heterogeneous IoT devices, tools, testbeds, platforms, etc., for a wide range of IoT applications. The processing of the data from the network layers is also its responsibility. Generally, the data at this layer are voluminous, for which processing, computing, and analyzing are some

• Operation layer: This is an important layer, especially from the business point of view in IoT. The supervision of services offered by IoT, creating business models, visualization of the data, decision-making, etc., are some of the key responsibilities of this layer. Ensuring QoS across all layers is one of the vital responsibilities associated with this layer. This layer is also responsible for real-time monitoring, control, and evalu-

• Application layer: This layer is primarily responsible for providing service to the endusers related to particular applications. There exists a wide range of applications envisaged using IoT, viz., smart city, smart home, smart agriculture, industry 4.0, healthcare, environmental monitoring, etc. This is the layer through which end users

ation of various application-specific parameters in an IoT environment.

usually interact and pay for the service provided to them.

key challenges to be handled by this layer.

**Figure 8.** The proposed seven-layer architecture of IoT. **Figure 8.** The proposed seven-layer architecture of IoT.

ing for service discovery

Service discovery protocol mDNS, DNS-SD Domain name resolution, client pair-

with this layer. This layer is also responsible for real-time monitoring, control, and evaluation of various application-specific parameters in an IoT environment.

• Application layer: This layer is primarily responsible for providing service to the end-users related to particular applications. There exists a wide range of applications envisaged using IoT, viz., smart city, smart home, smart agriculture, industry 4.0, healthcare, environmental monitoring, etc. This is the layer through which end users usually interact and pay for the service provided to them.

### *4.4. IoT Protocols and Standards*

In the Internet of Things, the communication protocol is a bunch of rules set down for exchanging information between electronic gadgets. Since IoT devices are more resourcelimited/dependent than traditional network devices, the protocol stack in an IoT network must be different from the traditional OSI model. IoT protocols are supposed to be small and compact. The IoT protocol stack can be considered as an augmented version of the layered TCP/IP protocol stack [93]. In recent times, many standardization efforts have been seen to reduce the efforts of all stakeholders of the burgeoning IoT, such as service providers, developers, manufacturers, programmers, operators, etc. To this extent, although there are numerous players, some of the prominent organizations involved are EPC global, the European Telecommunications Standards Institute (ETSI), Internet Engineering Task Force (IETF), World Wide Web Consortium (W3C), and Institute of Electrical and Electronics Engineers (IEEE). The protocols can be broadly grouped into four categories: application protocol, service discovery protocol, connectivity and networking protocol, and other dominant protocols [94]. Some of the widely explored protocols under these categories are summarized in Table 3, whereas a detailed discussion can be found in the seminal work carried out in [41,57], of which we briefly describe some of the key protocols in the following subsections.

**Table 3.** Protocols at various layers of IoT architecture with key functionality.

• EXI: Efficient XML Interchange is abbreviated as EXI. This is an XML representation in a small package. To support XML applications on resource-constrained devices, EXI is described as a technique that uses less bandwidth and improves encoding/decoding efficiency. EXI compression aids in the reduction of document content by creating small tags internally based on the current XML schema, processing level, and context. It assures the tags are optimized for data representation. The document is in binary format, with all of the document's data tags encoded using event codes. Event codes are binary tags that keep their value only in the EXI stream where they are allocated.

### **5. IoT Vulnerabilities, Security Threats, and Attacks**

With the unprecedented growth in IoT devices with rapidly evolving technologies, the new generation IoT-based applications are at risk. Nevertheless, there is an increasing consciousness that the new age of cell phones, computers, and other gadgets might be powerless against malware and assault. Thus, the vulnerabilities, security, and attacks must be comprehensively analyzed to make envisioned IoT a reality.

### *5.1. Vulnerability*

Vulnerabilities are the defects in a framework's design or usefulness that permits the attacker to execute orders, access unapproved information, and launch distributed denial-of-service (DDoS) attack [107]. Attackers can utilize IoT gadgets with existing issues to infiltrate the networks. DNS rebinding attacks, which allow for the processing and ex-filtration of data from internal networks to new side-channel attacks, such as infrared laser inducted attacks against smart devices in homes and workplaces, are among the risks. In IoT systems, vulnerabilities can be found in several places [108].

Hardware and software systems are two central components of IoT frameworks, vulnerable to design flaws. Regardless of whether bugs are identified due to compatibility and interoperability of the equipment or efforts to remedy them, hardware flaws are very difficult to detect and even more difficult to repair. Computer bugs may exist in operating systems, programming software, and control software. Human elements and programming complexity are two factors that contribute to software configuration defects. Human flaws are normally the source of technical vulnerabilities [109]. Miscommunication between the developer and clients, lack of resources, skills, and experience, and a failure to manage and monitor the system can result from a poor understanding of the specifications introducing vulnerabilities in the IoT framework. Thus, vulnerability poses indispensable threats and attacks in the IoT environment. What follows next is the taxonomy of threats and attacks in IoT.

### *5.2. Taxonomy of Threats and Attacks in IoT*

A threat is an activity that exploits a system's security flaws and has a negative effect on it. Humans and the environment are the two main sources of security threats [110,111]. As an example, seismic tremors, typhoons, floods, and fires are all natural hazards that can cause serious damage to computer systems. Few shields can be used to protect against traumatic events since these naturally occurring events cannot be prevented. Backup and contingency planning, for example, are the best ways to protect stable infrastructures from common threats. Human threats are those that humans create, such as malicious threats that are either internal (someone has allowed access) or external (individuals or organizations operating outside the network) in nature and seek to damage or disrupt a system. Following are the different types of human threats:

from high-value information in industries such as manufacturing, banking, and national defense [112].

A taxonomy of threats posing a big concern from a security perspective in the IoT environment is shown in Figure 9.

Compared to the threat that can be intentional or unintentional, the attack is always intentional and malicious to cause damage. Several security attacks persist in the IoT framework, which can be analyzed with respect to the proposed IoT reference model. A taxonomy of attacks in IoT has been presented in Figure 10. These threats and attacks pose severe challenges to the IoT environment from a security perspective. The security concern due to various threats and attacks are categorically described in the following subsections.

### *5.3. Security Concern Due to Threats and Attacks at Different Layers*

### 5.3.1. Security Concern at Perception Layer

Since current sensor management systems and protection schemes are insufficient to protect the sensors, an attacker may use them in various ways. In general, sensor-based threats refer to passive and active malicious actions that are attempted by the manipulation of sensors for their malicious purposes. Different kinds of threats and attacks which cause serious security challenges at the perception layer are eavesdropping, battery drainages, hardware failure, malicious data injection, Sybil threat, disclosure of critical information, device compromise, node cloning, node capture, side-channel attack (SCA), tag cloning, Radio Frequency (RF) jamming, node injection, exhaustion, node outage, etc. Some of these security threats and attacks are briefly discussed below. Further, a detailed discussion on these threats and attacks is comprehensively covered in [49,57,65,67].

of the chronicle [114].

• Sybil Attack: The malicious nodes in this can have multiple identities of a genuine node by either impersonating it or with a fake identity through duplication. One such malicious node may have several identities simultaneously or at different instances. • Disclosure of Critical Information: Sensors used in IoT gadgets can disclose sensitive information such as passwords, secret keys, credit card credentials, and so on. These details may be used to violate user privacy or to build a database for future attacks. One such example of this attack is eavesdropping. It is a kind of attack where a pernicious application records a discussion subtly by misusing sound sensors and extracts data from the discussion. An attacker can save the recorded discussion on a gadget or tune in to the discussion continuously. Soundcomber is one of the current instances of eavesdropping over the receiver of a cell phone. In this model, a pernicious application secretively records when a discussion is initiated from the gadget. Since the recording is carried out behind the scenes, a client is completely unaware

**Figure 9. Figure 9.**  Taxonomy of threats in IoT. Taxonomy of threats in IoT.

**Figure 10**. Taxonomy of attacks in IoT. **Figure 10.** Taxonomy of attacks in IoT.

be directed.

placement attacks.

afar.

• Side-Channel Attacks: The assailant gathers information and performs the reverse

• Malicious Data Injection: Attackers take advantage of flaws in communication protocols to insert data into the network [115]. The intruder will tamper with the information required to control the device if the protocol does not verify the integrity of the data. The injection attack may result in code execution or system control from

• Node cloning: In most cases, IoT devices such as sensor nodes and CCTV cameras are developed without hardware defects, given the lack of standardization of the IoT device design. Therefore, for unauthorized purposes, these devices can be easily forged and replicated. This is also known as the cloning of nodes. It can take place in either of the two phases, i.e., production and during operations. An internal attacker can replace an original device with an unauthorized, pre-programmed object in the former case. A node can be captured and cloned during the operational phase. Capturing nodes could further remove security parameters and substitute firmware re-

• Exhaustion attack: Jamming or DoS attacks that have been mentioned before could lead to attacks of exhaustion. In particular, energy consumption can affect the battery-operated devices if an assailant attacks the network continuously. Repeated retransmission attempts could cause collisions with IoT MAC protocols leading to

or ciphertext during the encryption process, but from the encryption devices. Sidechannel attacks the use of certain or all data to acquire the key the device uses. Some instances of such attacks include timing attacks, power or failure analysis, and electromagnetic attacks. The opponent uses data leaks and collects block cipher keys. In the event of the attacks, an intrusion prevention system such as Boolean masking can

### 5.3.2. Security Concern at Abstraction Layer

Different kinds of threats and attacks which cause serious security challenges at the abstraction layer are node replication, illegal access, device compromise, MITM, eavesdropping, spoofing, insertion of rogue devices, information theft, a threat to the communication protocols, data manipulation, device tampering, tag cloning, DoS, DDoS, SCA, traffic analysis, and sleep deprivation. Some of these security threats and attacks are briefly discussed below. Further, a detailed discussion on these threats and attacks is comprehensively covered in [49,57,65,67].

the communication presents additional issues in IoT/CPS security design. Cellular technologies such as UMTS, GSM, and LTE, on the other hand, have their own set of security challenges. Because radio baseband stacks are implemented openly, mobile networks are vulnerable to hacking and cyber-attacks. Furthermore, aggressive attackers can use "IMSI Catching" to compromise GSM and UMTS networks.

## 5.3.3. Security Concern at Network Layer

Gateways and networking systems assist in the routing and networking of data packets to their intended destinations. If the gateway communicates using wireless protocols, the attacker will use wireless attacks to link to the gateway or internal network. As a result, the attacker will be able to carry out further attacks, such as ARP poisoning, MITM, packet injection, and sniffing. Different kinds of threats and attacks which cause serious security challenges at the network layer are illegal access, MITM, eavesdropping, spoofing, fragmentation, hello flood, network intrusion, device compromise, node replication, insertion of rogue devices, sinkhole attack, Sybil attack, clone ID attack, selective forwarding attack, blackhole attack, wormhole attack, traffic attack, and RPL exploits. Some of these security threats and attacks are briefly discussed below. Further, a detailed discussion on these threats and attacks is presented in [49,57,65,67].

more likely to cause a major incident than a tempering attack, which involves a few affected nodes. As a result of sinkhole attacks, the whole infrastructure base could be controlled.

## 5.3.4. Security Concern at Transport Layer