Mitigation of Cyberattacks through Battery Storage for Stable Microgrid Operation

Distributed control schemes utilize peer-to-peer communication between neighboring nodes via sparse distributed communication networks. The communication network can be seen as a topological map represented by an undirected graph $\mathcal{G}=(\mathrm{V},\mathrm{E})$ with nodes $\mathrm{V}=\{1,\ldots,n\}$, and edges $\mathrm{E}\subseteq\mathrm{V}\times\mathrm{V}$. If $\mathrm{e}_{ij}=\mathrm{e}_{ji}=(i,j)\in\mathrm{E}$, the nodes $i$ and $j$ are adjacent, thus can exchange information through the communication network. $\mathrm{A}=\left[a_{ij}\right]\in\mathbb{R}^{n\times n}$ is the adjacency matrix with non-negative adjacency elements, i.e., $a_{ij}=0$, and $a_{ij}=1\leavevmode\nobreak\ \text{if and only if the edge}\leavevmode\nobreak\ (i,j)\in\mathrm{E}$. The neighbors of node $i$ are defined as $\mathcal{N}_{i}\triangleq\{j\in\mathrm{V}:(i,j)\in\mathrm{E}\}$.

In this work, a modified version of the Canadian urban benchmark distribution system is utilized to demonstrate the leader-follower distributed control scheme, shown in Fig. 1 with blue color. It is considered that each converter has a local controller (LC), operating under such control. The data $\left\{P,Q\right\}$ is exchanged between neighboring nodes to achieve primary control objectives, where $P,Q$ are the active and reactive power sharing values. For example, LC2 communicates and collects the data from LC1 and LC3, which can be represented as LC2 $=\left\{\xi_{12},\xi_{32}\right\}$, where $\xi_{12}=\left\{{P_{1},Q_{1}}\right\}$ and $\xi_{32}=\left\{{P_{3},Q_{3}}\right\}$ are the data collected from LC1 and LC3 and transferred to LC2, respectively. Furthermore, a mode supervisory controller (MSC) is placed close to the point of common coupling (PCC), which can exchange measurements and multicast signals to the respective LCs, realizing secondary control objectives.

DGs can be integrated into an AC MG through power converters. When the MG is connected to the main grid, known as the grid-tied mode, the converters perform as current-controlled sources. The MG voltage and frequency are mainly regulated by the main grid. Otherwise, when the MG is disconnected from the main grid, known as the grid-forming or islanded mode, it will be stabilized by the converters which can operate in voltage-source or current-source mode. The modeling of MGs operating in their autonomous mode is investigated in this work. Furthermore, we leverage BESS resources to overcome adverse deliberate scenarios. Droop control is widely utilized to share power among parallel-connected converters and improve system reliability by imitating the parallel operation behavior of synchronous generators. It is considered an independent or autonomous form of control since it maintains stability while eliminating the synchronous communication requirement between grid converters [12].

In order to model the MG system, we consider $n$ nodes consisting of loads and DGs (e.g., renewable sources or energy storage systems). The complex power delivered to the MG from the converter on node $i$ can be calculated by $S=V_{\mathrm{g}}I^{*}_{oi}$, where $V_{\mathrm{g}}\angle 0$ represents the grid voltage and $I_{o}$ is the current injected into the grid. Thus, the converter active and reactive power output can be expressed as Eq. (3), where $V_{{i}}\angle\beta_{i}$ is the converter output voltage and $Z_{i}\angle\theta_{i}$ represents the output filter and line lumped impedance between the converter and grid.

When the phase difference is small enough and impedance $Z\angle\theta$ is assumed to be purely inductive with $\theta=90^{\circ}$, the $P-\omega$ and $Q-V$ droop control characteristic, also known as primary control, can be described by Eq. (4), where $\omega$ and $V$ are the angular frequency and converter output voltage of the inverter, respectively, with $\omega_{0}$ and $V_{0}$ when there is no load, and $k_{P}$ and $k_{Q}$ are the droop coefficients.

Although the droop control can achieve independent active and reactive power control in the primary level or converter level without intercommunication between nodes, secondary level or system level control can assist in compensating the frequency and voltage deviation caused by the primary level droop control. In the distributed control scheme under investigation, the secondary level control takes the voltage ($V_{s}$) and frequency ($\omega_{s}$) of the PCC point. Ultimately, the droop control can be formulated as Eq. (5), where $\Delta\omega$ and $\Delta V$ are the secondary frequency and voltage contribution, respectively.

In terms of Eqs. (3) – (5), a converter can be linearized as the following state-space model in Eq. (6) with $a$ inputs, $b$ states, and $c$ outputs [13]. The state derivatives $\dot{\mathbf{x}}\in\mathbb{R}^{b}$ are calculated using the state variables $\mathbf{x}\in\mathbb{R}^{b}$ at time $t$ and system control input $\mathbf{u}\in\mathbb{R}^{a}$. $\mathbf{y}\in\mathbb{R}^{c}$ is the system output (sensor measurements). $\mathrm{A}\in\mathbb{R}^{b\times b}$, $\mathrm{B}\in\mathbb{R}^{b\times a}$, $\mathrm{C}\in\mathbb{R}^{c\times b}$ are the state, control, and output matrices of the physical system and $\mathbf{e}$ denotes the noise vector of sensed measurements.

The state variable $\mathbf{x}_{t}$ and control input $\mathbf{u}_{t}$ are expressed as: where $i_{\mathrm{od}}$, $i_{\mathrm{oq}}$, $v_{\mathrm{od}}$, $v_{\mathrm{oq}}$, $i_{\mathrm{d}}$, $i_{\mathrm{q}}$ are the $d$- and $q$-axis output currents, output voltages, and currents of the converter.

We consider an adversary capable of attacking the cyber/communication layer by sending incorrect measurements to deceive the surrounding nodes. The actual measurement $\mathbf{y}$ – forwarded to the $\mathcal{N}_{i}$ nodes – changes to $\mathbf{y}^{a}$ once the vulnerability of the communication channel between these neighboring nodes is exploited, where $\alpha$ denotes an attacked channel. Since the relationship between the received measurements ($\widetilde{\mathbf{y}}$) and the control signals ($\mathbf{u}$) can generally be expressed as in Eq. (7), where $\mathrm{H}$ is a feedback control gain [14], when the controller takes the malicious measurement $\mathbf{y}^{a}$ instead of the true measurement $\mathbf{y}$, where $\widetilde{\mathbf{y}}=\mathbf{y}^{a}$, the control scheme is misled by the attacker.

To establish such attacks targeting measurement signals, several models can be utilized [15]. The attack measurement can be described by $\mathbf{y}^{a}_{t}$, where $\mathbf{y}_{t}$ is the true measurement, and $[t_{a},t_{a^{\prime}}]$ is the attack duration between $t_{a}$ and $t_{a^{\prime}}$.

Leveraging the cyber modeling (Section II-A), we opted for a leader-follower consensus scheme to harden the control of MG agents in the presence of adversaries [10]. Fig. 2 depicts the communication architecture of the leader-follower scheme under nominal operation (Fig. 2a), unexpected conditions (Fig. 2b), where the malicious agent is removed from the distributed consensus set, and after agent restoration (Fig. 2c). In Fig. 2, the blue arrows represent the communication links between neighboring agents (exchanging information for their distributed primary control objectives), while the dashed arrows illustrate the information exchanged between MSC and DG agents (e.g., secondary control objectives, BESS coordination, MG restoration commands, etc.). Access to every agent is maintained at all times by the MSC leader (dashed arrows). In such a distributed control system, the agents’ (i.e., DGs) objective is to track the state of the leader. The control goal at time $t$ for the $i^{th}$ agent is described by Eq. (17) [10].

where $x_{i}(t)$, $u_{i}(t)$, and $\alpha_{ij}(t)$ are the state information, the control input, and the element of the adjacency matrix $\mathrm{A}$ for the $i^{th}$ agent at time $t$. Agent $0$ is the leader and its corresponding state that the rest of the agents need to track is $x_{0}(t)$. $h_{i}(t)$ is the local control gain and $b_{i}$ is equal to $1$ if the control information originates from the leader, else it is $0$. In leader-follower distributed control schemes, the DG LCs are responsible to track the operational system state as indicated by the leader. As a result, to attain consensus between all system nodes Eq. (18) needs to be satisfied.

In our case, the leader of the system is MSC. The MSC monitors and supervises the nominal operation of the system by issuing control commands to the DG agents, enforcing the economic operation, managing the BESS resources (at the PCC), and providing remediation actions in case of adverse events. For instance, after the detection of a misbehaving agent [4], the leader will issue a disconnect command to the circuit breaker (CB) of that agent and at the same time instruct the remaining DG agents to remove the node from their consensus set. Recovery of the compromised agent will then be initiated with coordination between the affected node and the MSC. Leveraging the BESS reserves, the MSC will attempt the recovery of the maloperating DGs. The process is performed according to the secondary frequency control mechanism (Eq. (5)). The automatic recovery of the abnormally operating DGs can be performed granted that Eqs. (19) – (21) are satisfied. However, if BESS storage cannot meet the power demand, MSC will enforce incremental load shedding to maintain critical loads online until the agent recovery.

where $P_{BESS}^{min}$ and $P_{BESS}^{max}$ are the minimum and maximum limits of power that the BESS can supply, respectively, and $SOC_{limit}^{min}$ and $SOC_{limit}^{max}$ describe the state-of-charge (SOC) range within which the BESS should be operated.

Furthermore, the frequency of the DG when supported by BESS ($\omega_{BESS}(t)$) should be regulated to the reference frequency $\omega_{ref}$ within the system settling timing constraint $t_{lim}$.

In the event of a cyberattack or an arbitrary adverse fault condition, one or more agents might start operating erroneously. Fault conditions are efficiently detected as they violate the system semantics in a congruent way, and automated mitigations to overcome such diverse effects are built-in within critical systems such as power grids. On the other hand, a cyberattack will manipulate an agent’s operation in an “indistinguishable from normal” manner, by poisoning the information it shares with other agents, causing communication delays, blocking the data exchanged between agents, corrupting the control inputs to the underlying LC devices (within the DG), etc. By propagating the compromised information to the rest of the agents, the distributed control scheme can also be corrupted, hence jeopardizing the efficient operation of the whole MG. For instance, the state information of the compromised $i^{th}$ agent can be described using Eq. (17).

where $u_{i}(t)$ follows Eq. (7), and includes the attacked measurement components under attack models of Eqs. (10) – (16).

It is crucial for the MG system operation to detect and mitigate the effects of maliciously operating agents before their propagation to the system. For the detection of such conditions, different approaches have been pursued in the literature. Related work leverages acknowledgment-based messages exchanged between nodes that should arrive within predefined time limits to verify the nominal agent behavior [11, 10]. Other approaches utilize anomaly detection or reputation-based schemes to detect misbehaving agents [16].

Our methodology is based on the leader-follower control mechanism and leverages the information exchanged between DG agents and the MSC (e.g., system states) to identify suspicious behavior. Namely, conventional state estimation algorithms, targeted at transmission systems, cannot be applied to distribution systems as in our case. System state observability is limited in DGs due to the lack of temporal granularity, accuracy, and synchronization in the system measurements (contrary to the measurements provided by phasor measurement units in transmission systems). As a result, to improve the fidelity of the DG system models, synthetic or other data (from microPMUs, smart meters, DER assets, etc.) are used to enhance the accuracy of state estimation [17].

Physics-informed methodologies considering the dynamics of power system assets, and their response (in attack-free cases and/or during different perturbations) have been explored in literature for the attack detection [18, 4]. In this work, we utilize a threshold-based approach where the cyber-physical properties of the system, i.e., state information $\mathbf{x}_{t}$ in Eq. (LABEL:eq:xandu), are supplemented with the DG inverter’s controller dynamics, i.e., settling time, total harmonic distortion (THD), etc., and can signal abnormal operation. To maintain stable operation, acceptable levels for such properties in the attack-free case are defined by the system operators and device vendors [19]. The data collected during the DG operation account for measurement noise and other transient events that could occur during the system operation. As a result, custom-built system-specific models are developed for each DG (in the attack-free case). However, during malicious operations, including additive, scaling, or ramp attacks, the behavior of compromised agents can diverge from their expected values, as can be seen in Fig. 3. Leveraging the custom-built data-driven DG models, cyberattacks can be distinguished from nominal behavior and/or other anomalous conditions (e.g., faults).

Once abnormal agent behavior is identified, the MSC immediately issues an islanding command disconnecting the attacked DG from the system detaining the attack propagation to the rest of the DGs. Furthermore, the local communication links between the compromised agent and its neighbors are disconnected, as can be seen in Fig. 2b, to limit the spread of untrustworthy false data (e.g., active, reactive power information). In the event that multiple DG agents are compromised simultaneously, the detection and isolation steps remain the same. However, the restoration process will differ since resources will have to be optimally allocated based on different criteria, e.g., load criticality, dispatchable BESS units, etc.

After the DG isolation, i.e., while operating in autonomous mode, the MSC will attempt the recovery of the compromised DG. The self-healing process can be performed either in coordination with the DG unit (if the controller has the ability to overcome the attack) or in a supervisory mode. In the latter case, which is presented in this work, the MSC (leader) will decouple the compromised unit (e.g., the inverter within the DG), and utilize the available BESS resources to supply the power demand of the DG. Granted that the BESS can support the corresponding demand (Eqs. (19)–(21) are satisfied), the agent will be seamlessly reconnected with the rest of the system (plug-and-play capability). Once agent reconnection has succeeded, the MSC will attempt a black-start, that is, rebooting and restoring the DG inverter controller to a safe operational mode [20]. Contrary to transmission systems, the radial nature of distribution systems, i.e., low connectivity index, allows the concurrent restoration of multiple DGs with minimal impact on the stability of the rest of the system nodes. The algorithm delineating the steps of the BESS-assisted MG self-healing process is outlined in Alg. 1.