Unstable plant transfer function identification
See the image (found in this article).

Inject a signal into the loop somewhere (I show it below as going between the controller and the plant).  Then measure the input to the plant and the output from the plant.  Note that the image is a bit confusing -- it assumes that the normal command to the loop is 0 or some constant.  It would be better to actually measure right at the output of the plant.

Then use the input to and output from the plant to estimate the plant response.

You can do this for swept sine, impulses, random noise, and steps.  If you're concerned about noise, you can take long samples -- when I do swept-sine measurements using this technique, I set things up so that I can take arbitrarily long measurements at each frequency, to make sure I can capture the real signal in the presence of noise.  If you're doing steps, you can get the response to an arbitrarily high number of steps, average, and then do ARMA or whatever method you wish to extract the plant transfer function.  Ditto random data or impulses.