  In this paper, we investigate joint sensor-actuator cyber attacks in discrete
event systems. We assume that attackers can attack some sensors and actuators
at the same time by altering observations and control commands. Because of the
nondeterminism in observation and control caused by cyber attacks, the behavior
of the supervised system becomes nondeterministic and may deviate from the
safety specification. We define the upper-bound on all possible languages that
can be generated by the supervised system to investigate the safety supervisory
control problem under cyber attacks. After introducing CA-controllability and
CA-observability, we prove that the supervisory control problem under cyber
attacks is solvable if and only if the given specification language is
CA-controllable and CA-observable. Furthermore, we obtain methods to calculate
the state estimates under sensor attacks and to synthesize a
state-estimate-based supervisor to achieve a given safety specification under
cyber attacks. We further show that of all the solutions, the proposed
state-estimate-based supervisor is maximally-permissive.
