fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
I. I NTRODUCTION
Fig. 1. A networked AC microgrid under attack: a) Controller compromised;
Distributed cooperative control of islanded AC microgrids, b) Attack on sensors; c) Attack on communication links.
that uses a sparse communication network to exchange in-
formation among inverters as seen in Fig. 1, has recently to future cyber attacks. Massive adaptation of computation,
emerged as a superior alternative to central control struc- communication, and control will make power electronics-
tures in microgrids [1][5]. Central controllers have a fully- intensive microgrids analogous to robotic, autonomous vehi-
connected, bidirectional, one-to-all communication network cle, and other cyber-physical systems that are currently subject
where the central control entity collect information from all to cyber attacks. As predecessors to microgrids, legacy power
agents, process the information centrally, and broadcast the grids with advanced communication and control have already
control commands to all agents. Therefore, it features global been a subject of security vulnerability. Maroochy malicious
situational awareness. This feature is missing in distributed breach of supervisory control and data acquisition [6], SQL
control settings, where a sparse communication network limits slammer worm attack on the Davis Besse nuclear plant, and
node-to-node information propagation. Distributed controllers StuxNET computer worm attack on a nuclear enrichment
consists of local controllers with access to local data and par- facility [7], exemplifying the vulnerability of cyber-physical
tial neighbor data, which makes them vulnerable to malicious systems.
attacks. A malicious entity might corrupt the data exchanged Corrupt data can disrupt inverters synchrony and lead
by attacking the node, communication link, or hijacking the to a network-wide instability. The bulk of existing research
entire node. On the other hand, central controllers expose has been focused on attack detection in power systems [8]
a single point-of-failure, which is a reliability bottleneck. [13]. Synergistically, mitigation techniques shall prevent the
Central controllers also require a complex and fully-connected attacker from propagating its adverse effects throughout the
communication network, while distributed control systems microgrid. In a false-data injection attack, disturbances are
are more reliable, scalable, and flexible. The drawback of injected to the sensors and/or actuators of agents to disrupt
distributed control paradigms, vulnerability to cyber-attacks, their transmitted data. While one could identify and remove
is addressed in this paper. misbehaving agents, [8], [9], this would require knowledge
The high-volume integration of power electronic devices of the communication network, and such solutions can be
in microgrids, that leverage advanced software-intensive con- difficult to scale. Computationally-efficient techniques [14]
trollers and communication networks, makes them vulnerable detect deception attacks on the sensors, but do not mitigate
their adverse effects. Robust game-theoretic solutions [15],
This material is based upon research supported in part by the U.S. Office
of Naval Research under award numbers N00014-14-1-0718 and N00014-17- [16] lead to conservative results against sophisticated attacks.
1-2239, and by the National Science Foundation under Grant ECCS-1405173. [17] designs an output-feedback law despite attacks on sensors,
S. Abhinav, F. Lewis, and A. Davoudi are with Electrical Engineering given the full knowledge of network topology. The cooperative
Department, the University of Texas at Arlington, TX 76019 USA (e-mail:
{shankar.abhinav, lewis, davoudi}@uta.edu). economic dispatch in [18] uses an additional communication
H. Modares is with the Department of Electrical and Computer Engineering, network to observe the original networks behavior.
Missouri University of Science and Technology, Missouri, MO 19112 USA An attack can be modeled similar to noise/disturbance,
(e-mail: modaresh@mst.edu).
F. Ferrese is with the Naval Surface Warfare Center, Philadelphia, PA 19112 whose intent could be to destabilize the system. There exist
USA (e-mail: frank.ferrese@navy.mil). noise filtration techniques [19] and disturbance attenuation
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
methods [20] for multi-agent systems. Noise filtration tech- The graph Laplacian matrix, L D A, includes
niques [21] usually assume certain statistical properties, e.g., distributed system dynamics, e.g., the convergence rate. A
they mostly assume a white Gaussian noise signal with zero path from node i to node j is a sequence of edges
mean and finite variance. This is not valid for the case of an at- poi , ok q, pok , ol q, ..., pom , oj q. A graph is said to have a span-
tack that can be deliberately designed. Disturbance attenuation ning tree, if there is a root node with a path from that node
techniques aim to minimize the effect of the disturbance on the to every other node in the graph. In that case, the Laplacian
local neighborhood tracking error. However, in the presence matrix eigenvalue 1 0 is a simple eigenvalue [22]. The
of a stealthy attack, which is considered as a constant signal solution to L 0 can be written as c1, where c is a
in this paper, the attacker can deceive the agents by assuring constant. Thus, synchronization is guaranteed as long as the
that their local neighborhood tracking error is zero even in communication graph has a spanning tree.
the presence of the attack. Such attacks cannot be detected A leader node can be connected to some nodes (at least to
or mitigated using existing disturbance attenuation or noise one root node) by unidirectional edges. The nodes connected
filtering techniques. to the leader node and the corresponding connecting edges are
In this paper, resilient distributed protocols for secondary called pinned nodes and pinning edges, respectively. A gain
cooperative control of islanded AC microgrids under attacks is assigned to each pinning edge, e.g., gi is the pinning gain
are studied. The vulnerability of existing distributed con- from the leader to the node i. The pinning gain is zero for an
trollers, in the presence of attacks on sensor/actuator, con- unpinned node. The pinning gain matrix is G diagtgi u.
trollers, and communication links, is evaluated. To address
sensor/actuator attacks, a distributed observer-based frame-
III. C OOPERATIVE C ONTROL OF AC M ICROGRIDS
work is presented. To mitigate attacks on communication links
and hijacking of controllers, a trust/confidence-based control A. Dynamics of the Physical Microgrid
protocol is designed. Each inverter monitors the information
The inverter model consists of a DC power source, inverter
it receives from its neighbors, updates its local confidence
bridge, power sharing controller, output filter, and voltage and
factor, and sends to its neighbors. Each inverter also updates
current controllers. Dynamics of each inverter are formulated
trust factors for all its neighboring inverters (assigned to each
in its own direct-quadrature (d-q) reference frame. The ref-
incoming communication link). Data received at each inverter
erence frame of one inverter is considered as the common
from neighbors is plugged in the distributed observer-based
reference frame. The power controller dynamics are
frequency update law, weighted by its trust factor for each
neighbor and the neighbors confidence factor. The inverters $ dP
i
ci Pi ` ci pvodi iodi ` voqi ioqi q
in close proximity to the attack source will have smaller &
dt , (1)
confidence factor and, therefore, slow down the rate at which % dQi Q ` pv i v i q
the corrupted data from compromised inverter spreads. This ci i ci oqi odi odi oqi
dt
allows neighbors of the compromised inverter to assign smaller
trust factors for their compromised neighbors and, therefore, where vodi and voqi are the direct and quadrature components
eventually discards the information received, once the trust of the output voltage of inverter i, while iodi and iodi are
value drops below a threshold. Connectivity conditions re- the corresponding current terms. Pi and Qi are the active
quired to ensure inverters synchrony are explored. and reactive powers measured at inverter i. ci is the cut-off
This paper is organized as follows: Section II provides frequency of the low-pass filter used to measure power.
preliminaries of graph theory. Conventional distributed coop- The large-signal dynamical model of an inverter, with
erative control is presented in Section III. In Section IV, attack internal control loops, is adopted from [23]
modeling and vulnerability of the conventional cooperative $
& dxi f px q ` gpx qu
control are discussed. Section V presents the attack-resilient dt
i i i i
, (2)
distributed cooperative control. Case studies, using a 34-bus %
yi hi pxi q
IEEE feeder network with six inverters, are presented in
Section VI. The conclusion is drawn in Section VII. where the state vector is
II. P RELIMINARY OF G RAPH T HEORY xi ri , Pi , Qi , di , qi , di , qi , ildi , ilqi , vodi , voqi , iodi , ioqi s .
The communication network among inverters is represented (3)
by a graph Gr pO, Eq, as shown in Fig. 1(b). O The inductive load dynamics are modeled as
to1 , o2 , ..., on u is a set of n nodes or vertices corresponding
to each inverter. E is a set of edges or arcs, where each $
diload,d
& R
Lload iload,d ` iload,q `
load 1
Lload vbd
edge from oi to oj is denoted by poi , oj q, and indicates the dt
. (4)
information flow between inverters i and j. Ni is the set of diload,q
%
dt R
Lload iload,q iload,d `
load 1
Lload vbq
inverters providing information to inverter i, also referred to as
its neighbors. The graph can be represented by an adjacency Detailed expressions for (2)-(4), and inverter parameters,
matrix A raij s, with weights aij 0 if poi , oj qE, can be found in [23]. Assuming inductive lines, the active and
otherwise aij 0. The diagonal in-degree matrix is defined reactive power injections at bus i of the power distribution
as D diagtNi u. network, due to inverter i, is given by
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
Neighbors Data
intact inverter, if it is reachable from a disrupted inverter. Factor
Distributed
Proof: Define a rp1a qT , p2a qT ...pN a T T
q s and ua Confidence
Observer
rpua1 qT , pua2 qT ...puaN qT sT as the vectors injected to sensors and Factor
actuators, respectively. Using the control protocol (8), (10),
Cyber Layer
and disturbances (12)-(14), the global synchronization error Secondary Frequency Control
dynamics, under attack, become Secondary Voltage Control
e9 c pL ` Gqe . (15)
Inv i
Define pL ` Gqea ` u, where diagpi q, and
diagpi q. i 1 and i 1 indicate the presence of
attack in inverter frequency and control input respectively. The Inv 1
solution to (15) is
Inv 2
Communication Graph
t
e ptq ec pL`Gqt e p0q ` ec pL`Gqpt q d. (16) LC Filter Output Connector
0
Energy
Source
Since pL ` Gq is positive-definite, and c is a positive
constant,
8 the first term goes to zero. Then, using eAt
m
m1 pAtq , one has Physical Layer
Primary Controller
8 t
m
e ptq pc pL ` Gqpt qq d. (17)
LC Filter Output Connector
m1 0
Energy
Source
m
If m 0 is the first integer, such that lij rpL`Gqm sij is
nonzero, then the node i is reachable from the node j, and m is
the length of the shortest directed path from j to i. Therefore,
if the inverter i is reachable from the disrupted inverter j, then Primary Controller
m
lij 0 for some 0 m N 1 making the synchronization
error for inverter i non-zero. This completes the proof. Fig. 2. Observer-based controller with trust and confidence factors.
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
illegitimate leaders state. Moreover, the local neighborhood For an inverter reached from an illegitimate leader, i does
tracking error (20) goes to zero for an intact inverter. not converge to zero but to a steady-state value. Therefore,
Proof: A leader-follower network with a single leader under even though i converges to zero, i will reach a nonzero
attack with constant frequency output signal can be considered steady-value. In the absence of an attack, all inverters syn-
as a network of inverters with one legitimate leader and chronize to the legitimate leader and, therefore, both i and
some illegitimate ones (compromised inverters). It is shown i go to zero asymptotically. Using (20), one has
in the containment problem in [32] that the agents outputs
pL ` Gq e . (27)
synchronize to a convex combination of the outputs of all
leaders. To prove that the local neighborhood in (20) converges where e reT T T T
1 , e2 , ..., eN s , with ei defined in (20).
to zero, let L be the Laplacian matrix associated with the T T T T
r1 , 2 , ..., N s with i i ref . Since pL ` Gq is
entire communication graph including the leaders. Let N and positive-definite, if e converges to zero asymptotically fast,
M specify the number of inverters and all leaders (including the global tracking error also converges to zero asymptoti-
the one legitimate leader and M 1 illegitimate ones). The cally fast. On the other hand, assuming that e is the global
leaders have no neighbor and, therefore, can be partitioned as state vector, pL ` Gq is a similarity transformation matrix
which gives as the new state vector. Since the similarity
L1 L2
L . (21) transformation does not change system eigenvalues, in the
0M pN M q 0M M
absence of an attack, e and and, consequently, i and
Then, for the observer (20), one has i have the same behavior. Thus, comparing i and i can
detect whether the corresponding inverter is reachable from
9 norm pc L1 qnorm c pL2 ql . (22)
an illegitimate leader or not.
where norm and l are the stacked states of the intact The confidence value for an intact inverter i is
inverters and the leaders, respectively. On the other hand, the C9 i ptq di ptq Ci ptq. (28)
local neighborhood tracking error, (19), can be written as
where 0 Ci 1 with
e L1 norm L2 l . (23)
i
di ptq . (29)
Taking the derivative of e , and using (22) and (23), one has i ` ||i ptq i ptq||
e9 c e . (24) 0 is used to weigh the current data against the past
data, i is a threshold value to consider other factors rather
Therefore, e goes to zero. This completes the proof. than attacks. If inverter i is not in the path of any attack, then
If the communication link from the inverter i to the inverter ||i i || 0 in steady state and, consequently, Ci 1. If
j is under a deception attack, then one can assume a virtual inverter i is effected by an attack, then ||i i || i , and
illegitimate leader connected to the inverter j. Therefore, the Ci 1 depending on the proximity of inverter i to the attacked
local neighborhood tracking error, for inverters not under node. Taking into account the confidence level received from
attack but afflicted by compromised links, cannot go to zero. neighbors, the observer dynamics in (20) become
Attacks on communication links are the same as scenar-
ios where an inverter is compromised, except that only the 9 i ptq aij Cj ptq pi ptq j ptqq
jPNi
neighbor reached by the affected communication link receives
corrupted transmission. ` gi pi ptq ref q . (30)
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
to consider other factors rather than attacks. The trust value Theorem 3. Let Assumption 2 be satisfied. The distributed
of inverter j for inverter i is defined as observer (34) for intact inverters will synchronize to the leader
state, even with z compromised inverters.
Tij max pCi ptq, bij ptqq . (33)
Proof. If z neighbors of the inverter i are attacked, and they
where 0 Tij 1. collude to send the same information to the inverter i, there
In the absence of an attack, ||j hNi || 0 when still exists z ` 1 intact neighbors that have different values
the network is synchronized in steady state, where hNi from the compromised ones. The compromised inverters can
1
|Ni | kPNi k and, consequently, Tij 1 @j. When inverter
detect the attack and recover from it as long as Assumption
i receives different observer outputs form its neighbors, i.e., 2 is satisfied. There still exists a spanning tree associated
||j hNi || is nonzero, Tij 1 @j as Ci is close to one, with intact inverters, as the compromised inverters are not
since the difference is caused by a change in the leader state. disconnected from the communication graph. It is shown in
If inverter i is attacked, then Ci is small, and the trust of [33] that if Tij i 0, and there exists a spanning tree,
inverter j for inverter i depends on ||j hNi ||. The greater then synchronization of intact agents is guaranteed.
the difference between j and hNi , the more likely inverter j If Assumption 2 is violated for the compromised inverter j,
is the attack source, or in close proximity to the attack, and it deceptively trusts most neighbors. However, its immediate
the less credible is its transmitted information. We assume that intact neighbors will have small confidence values as they
the immediate neighbors of the leader always trust the leader. receive different values from their intact neighbors and the
If the trust value for a neighboring inverter j drops below compromised neighbor j. Therefore, the inverter j will be
a threshold Tij i , then it is identified as a compromised isolated by its neighbors to avoid spreading the attack.
inverter, and its transmitted information are discarded. This
can happen if inverter j is the attack source or in its close
proximity. The selection of the trust factor is done empirically, VI. C ASE S TUDIES
as it would depend on several factors like network connectiv- System Setup: The proposed controller is evaluated for an
ity, speed of convergence of the consensus algorithm and, in islanded microgrid. Figure 3 illustrates a single-line diagram of
turn, other gains in the consensus algorithm. [18], [33][35] a modified IEEE 34-bus balanced test feeder [36] by averaging
have used similar thresholds in trust factors. The purpose of the line parameters provided in [36], augmented with six
threshold selection is to improve the algorithm performance inverters. The specifications of the inverters connected to the
by disregarding potentially corrupt data when the trust factor test feeder are given in the Table I. The load impedances are
is low. Taking into account the confidence level received from load 1 : 1.5 ` j1 , load 2 : 0.5 ` j0.5 , load 3 : 1 ` j1 ,
neighbors, and the trust values calculated for neighbors, the and load 4 : 0.8 ` j0.8 modeled using (4). The test feeder
observer dynamics in (20) become is islanded from the main grid at bus 800 at t 0 s. The
inverter specifications are given in the Table I and modeled
9 i ptq aij Cj ptqTij ptq pi ptq j ptqq
jPNi
using (2) and (3). The nominal frequency and line-to-line
voltage are 60 Hz and 24.9 kV, respectively. The inverters are
` gi pi ptq ref q . (34)
connected to the feeder through Y-Y 480V/24.9 kV, 400 kVA
The overall observer-based cooperative controller, with trust transformers with a series impedance of 0.03 ` j0.12 p.u.
factors, is presented in Fig. 2, and detailed in Algorithm 1. A Each inverter communicates its observer frequency, observer
similar control algorithm can be used for inverter voltages. voltage, confidence factors, and trust factors with its neighbors
through the communication graph (Fig. 3(b)). Inverter 1 is
Algorithm 1 Secondary control of frequency using observer- pinned (receive reference signal) with pinning gain g1 1.
based cooperative control with trust factors at inverter i We consider three cases to evaluate the controller performance.
Tij 1 and initialize Ci . Conventional secondary control is achieved by implementing
for t 0, 1... do (9) and (10) for frequency and equivalent voltage control, as
If Tij i , discard j , and set Tij 0 in [24].
Update i using (34), Case A: The attack on sensor/actuator of inverter 2 is
Update ui using (18), modeled using (12) to produce an output frequency of f2
Update ni using (11), 60.2 Hz at t 1 s. Figures 4(a) and 4(b) show the performance
Update Ci using (28), of the conventional cooperative controller, clearly leading to a
Update Tij using (33), loss of synchrony. Distributed observer-based secondary con-
Transmits i ptq and Ci ptq to neighbors Ni . trol of frequency is achieved by implementing (18) and (19) for
end for frequency control. Figures 4(c) and 4(d) show the controller
performance with distributed observers. Frequency at all in-
Conditions for which the observer outputs for intact invert- verters, except inverter 2 (under attack), remains synchronized
ers synchronize to the leader are discussed. at f 60 Hz, and voltages of the intact inverters are much
Assumption 2. (z-local connectivity). The network connec- closer (but not synchronized). From Fig. 5(a), it can be seen
tivity is at least p2z ` 1q, i.e., at least half of the neighbors, that even if the frequency remain synchronized, the voltage
for each inverter, are intact [9], [33], where z is the number exhibits an oscillatory behavior. This is expected as inverter 2
of neighbors under attack. is operating at a different frequency of f2 60.2Hz. Although
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
Energy
Source
solution from the distributed control perspective. It can provide 812
time for remedial actions from operator/higher control level,
e.g., disconnecting the inverter under attack (inverter 2). The 814
voltage performance until t 10sec is shown in 5(a) with no Case A
850
mitigating action, and in 5(b) when inverter 2 is disconnected 6 5
at t 5sec. It can be seen that the system performs as desired 816 (2)
once inverter 2 is disconnected. The proposed algorithm, in 818 820 822 1 4
with confidence factors. Here, intact inverters almost reach (5) 836 848
synchrony. Inverter 3, which receives false information, has 1 4
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
Voltage (pu)
60.2 1
60.1 0.95
60 0.9
Voltage (pu)
60.2 1
60.1 0.95
60 0.9
Fig. 4. Inverter 2 sensor/actuator attacked with f2 60.2 Hz: (a),(b) Conventional cooperative control; (c),(d) Distributed observer-based cooperative control.
1.2 1.2
Voltage (pu)
Voltage (pu)
1.1 1.1
1 1
0.9 0.9
(a) (b)
0 2 4 6 8 10 0 2 4 6 8 10
Time (s) Time (s)
Fig. 5. Inverter 2 sensor/actuator attacked with f2 60.2 Hz: (a) Distributed observer-based cooperative control; (b) Distributed observer-based cooperative
control with inverter 2 taken offline at t 5 s.
60.2 1.05
Frequency (Hz)
Voltage (pu)
60.15
1
60.1
60.05 0.95
60
0.9
59.95
(a) 59.9 (b) 0.85
60.2 1.05
Frequency (Hz)
60.15
Voltage (pu)
1
60.1
60.05 0.95
60
0.9
59.95
59.9
(c) (d) 0.85
60.1 1.05
Frequency (Hz)
Voltage (pu)
60.05 1
60 0.95
59.95 0.9
Fig. 6. The outgoing communication link from inverter 2 is attacked with f2 60.2 Hz: (a),(b) Distributed observer-based cooperative control; (c),(d)
Distributed observer-based cooperative control with confidence factors; (e),(f) Distributed observer-based cooperative control with trust factor.
10(a), inverter 6 is only receiving information from inverters 5 and 1, that does not satisfy the assumption. Figures 11(c)
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
Voltage (pu)
60.2 1
60.1 0.95
60 0.9
Voltage (pu)
60.2 1
60.1 0.95
60 0.9
59.9 0.85
(c) (d)
60.3 1.05
Frequency (Hz)
Voltage (pu)
60.2 1
60.1 0.95
60 0.9
Fig. 7. Inverter 2 controller is compromised between t 1 s and t 2.5 s with f2 60.2 Hz: (a),(b) Distributed observer-based cooperative control;
(c),(d) Distributed observer-based cooperative control with confidence factors; (e),(f) Distributed observer-based cooperative control with trust factor.
1.2
Confidence Value
1
6 5 6 5
0.8
0.6
1 4 1 4
0.4
0.2
0 2 3 2 3
0 1 2 3 4 5
(a) (b)
Time (s)
Fig. 8. Confidence levels, Ci , when the inverter 2 controller is compromised Fig. 10. Topology of the communication network among inverters during
between t 1 s and t 2.5 s, with f2 60.2 Hz. multiple attacks on communication links: (a) Network with assumption 2
p2z ` 1q not satisfied at inverter 6; (b) Network with assumption 2 p2z ` 1q
satisfied (Communication link between inverter 3 and inverter 6 is made
1.2 bidirectional).
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
10
Voltage (pu)
60.1 1
60 0.95
59.9
0.9
59.8
(a) (b) 0.85
1.05
Frequency (Hz)
60.2
Voltage (pu)
60.1 1
60 0.95
59.9 0.9
59.8
(c) (d) 0.85
0 1 2 3 4 5 0 1 2 3 4 5
Time (s) Time (s)
Fig. 11. The outgoing communication links from inverter 2 and 5 are attacked with f2 60.2 Hz: (a),(b) Distributed observer-based cooperative control
with trust factors using communication topology in Fig. 10(a); (c),(d) Distributed observer-based cooperative control with trust factor using communication
topology in Fig. 10(b).
1.2 1.2
1 1
0.8 0.8
Trust Value
Trust Value
0.6 0.6
0.4 0.4
0.2 0.2
0 0
0 1 2 3 4 5 0 1 2 3 4 5
(a) Time (s) (b) Time (s)
Fig. 12. Trust levels when the outgoing communication links from inverter 2 and 5 are attacked with f2 60.2 Hz, using distributed observers with trust
factors: (a) Using communication topology in Fig. 10(a); (b) Using communication topology in Fig. 10(b).
control techniques is evaluated for a modified 34-bus IEEE [8] F. Pasqualetti, A. Bicchi, and F. Bullo, Consensus computation in
feeder system for different types of attacks. unreliable networks: A system theoretic approach, IEEE Trans. Autom.
Control, vol. 57, no. 1, pp. 90104, Jan 2012.
[9] F. Pasqualetti, F. Dorfler, and F. Bullo, Attack detection and identifica-
R EFERENCES tion in cyber-physical systems, IEEE Trans. Autom. Control, vol. 58,
no. 11, pp. 27152729, Nov 2013.
[1] A. Bidram, A. Davoudi, F. Lewis, and J. Guerrero, Distributed coop- [10] K. Manandhar, X. Cao, F. Hu, and Y. Liu, Detection of faults and
erative secondary control of microgrids using feedback linearization, attacks including false data injection attack in smart grid using kalman
IEEE Trans. Power Syst., vol. 28, no. 3, pp. 34623470, Aug 2013. filter, IEEE Trans. Control Netw. Syst., vol. 1, no. 4, pp. 370379, Dec
[2] J. Simpson-Porco, Q. Shafiee, F. Dorfler, J. Vasquez, J. Guerrero, and 2014.
F. Bullo, Secondary frequency and voltage control of islanded micro- [11] Y. Huang, J. Tang, Y. Cheng, H. Li, K. A. Campbell, and Z. Han, Real-
grids via distributed averaging, IEEE Trans. Ind. Electron., vol. 62, time detection of false data injection in smart grid networks: An adaptive
no. 11, pp. 70257038, Nov 2015. cusum method and analysis, IEEE Syst. J., vol. 10, no. 2, pp. 532543,
[3] J. Schiffer, T. Seel, J. Raisch, and T. Sezi, Voltage stability and June 2016.
reactive power sharing in inverter-based microgrids with consensus- [12] S. Bi and Y. J. Zhang, Graphical methods for defense against false-data
based distributed voltage control, IEEE Trans. Control Syst. Technol., injection attacks on power system state estimation, IEEE Trans. Smart
vol. 24, no. 1, pp. 96109, Jan 2016. Grid, vol. 5, no. 3, pp. 12161227, May 2014.
[4] F. Guo, C. Wen, J. Mao, J. Chen, and Y.-D. Song, Distributed
[13] L. Liu, M. Esmalifalak, Q. Ding, V. A. Emesih, and Z. Han, Detecting
cooperative secondary control for voltage unbalance compensation in
false data injection attacks on power grid by sparse optimization, IEEE
an islanded microgrid, IEEE Trans. Ind. Informat., vol. 11, no. 5, pp.
Trans. Smart Grid, vol. 5, no. 2, pp. 612621, March 2014.
10781088, Oct 2015.
[5] M. Tahir and S. Mazumder, Self-triggered communication enabled [14] Y. Mo, R. Chabukswar, and B. Sinopoli, Detecting integrity attacks on
control of distributed generation in microgrids, IEEE Trans. Ind. scada systems, IEEE Trans. Control Syst. Technol., vol. 22, no. 4, pp.
Informat., vol. 11, no. 2, pp. 441449, April 2015. 13961407, July 2014.
[6] J. Slay and M. Miller, Lessons Learned from the Maroochy Water [15] T. Alpcan and T. Basar, A game theoretic approach to decision and
Breach. Boston, MA: Springer US, 2008, pp. 7382. analysis in network intrusion detection, in Proc. 42nd IEEE Conference
[7] J. P. Farwell and R. Rohozinski, Stuxnet and the future of cyber war, on Decision and Control, vol. 3, Dec 2003, pp. 25952600.
Survival, vol. 53, no. 1, pp. 2340, 2011. [16] P. Srikantha and D. Kundur, A der attack-mitigation differential game
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2017.2721382, IEEE
Transactions on Smart Grid
11
for smart grid security analysis, IEEE Trans. Smart Grid, vol. 7, no. 3, Hamidreza Modares (M15) received the B.S. de-
pp. 14761485, May 2016. gree from the University of Tehran, Tehran, Iran,
[17] H. Fawzi, P. Tabuada, and S. Diggavi, Secure estimation and control for in 2004, the M.S. degree from the Shahrood Uni-
cyber-physical systems under adversarial attacks, IEEE Trans. Autom. versity of Technology, Shahrood, Iran, in 2006, and
Control, vol. 59, no. 6, pp. 14541467, June 2014. the Ph.D. degree from The University of Texas
[18] Y. Liu, H. Xin, Z. Qu, and D. Gan, An attack-resilient cooperative con- at Arlington, Arlington, TX, USA, in 2015, all in
trol strategy of multiple distributed generators in distribution networks, electrical engineering. He was a Senior Lecturer
IEEE Trans. on Smart Grid, vol. 7, no. 6, pp. 29232932, Nov 2016. with the Shahrood University of Technology, from
[19] M. Basseville, I. V. Nikiforov et al., Detection of abrupt changes: theory 2006 to 2009, and a Faculty Research Associate
and application. Prentice Hall Englewood Cliffs, 1993, vol. 104. with the University of Texas at Arlington, from 2015
[20] Q. Jiao, H. Modares, F. L. Lewis, S. Xu, and L. Xie, Distributed l2 -gain to 2016. He is currently an Assistant Professor in
output-feedback control of homogeneous and heterogeneous systems, the Electrical and Computer Engineering Department, Missouri University
Automatica, vol. 71, pp. 361 368, 2016. of Science and Technology, Rolla, MO, USA. His current research interests
[21] S. Abhinav, I. Schizas, F. Lewis, and A. Davoudi, Distributed noise- include cyber-physical systems, reinforcement learning, distributed control,
resilient networked synchrony of active distribution systems, IEEE robotics, and machine learning. Dr. Modares is an Associate Editor for the
Trans. Smart Grid, 2016, to be published. IEEE TRANSACTIONS ON NEURAL NETWORKS AND LEARNING
[22] R. Olfati-Saber and R. Murray, Consensus problems in networks of SYSTEMS. He has received best paper award from the 2015 IEEE Inter-
agents with switching topology and time-delays, IEEE Trans. Autom. national Symposium on Resilient Control Systems.
Control, vol. 49, no. 9, pp. 15201533, Sept 2004.
Frank L. Lewis (S78-M81-SM86-F94) received
[23] A. Bidram, F. Lewis, and A. Davoudi, Distributed control systems
the B.S. degree in physics/electrical engineering and
for small-scale power networks: Using multiagent cooperative control
the M.S.E.E. degree from Rice University, Houston,
theory, IEEE Control Syst., vol. 34, no. 6, pp. 5677, Dec 2014.
TX, USA, the M.S. degree in aeronautical engineer-
[24] A. Bidram, A. Davoudi, F. Lewis, and Z. Qu, Secondary control
ing from the University of West Florida, Pensacola,
of microgrids based on distributed cooperative control of multi-agent
FL, USA, and the Ph.D. degree from Georgia In-
systems, IET Gener. Transmiss. Distrib., vol. 7, no. 8, pp. 822831,
stitute of Technology, Atlanta, GA, USA. He is a
Aug 2013.
member of the National Academy of Inventors. He
[25] V. Nasirian, Q. Shafiee, J. M. Guerrero, F. L. Lewis, and A. Davoudi,
is a Fellow of the International Federation of Auto-
Droop-free distributed control for ac microgrids, IEEE Trans. Power
matic control, the U.K. Institute of Measurement and
Electron., vol. 31, no. 2, pp. 16001617, Feb 2016.
Control, and a Professional Engineer at Texas. He is
[26] Q. Shafiee, V. Nasirian, J. C. Vasquez, J. M. Guerrero, and A. Davoudi,
Moncrief-ODonnell Chair at the University of Texas at Arlington Research
A multi-functional fully distributed control framework for ac micro-
Institute as well as Qian Ren Thousand Talents Consulting Professor, North-
grids, IEEE Trans. Smart Grid, 2016, to be published.
eastern University, Shenyang, China. He is Distinguished Visiting Professor
[27] Q. Shafiee, C. Stefanovic, T. Dragicevic, P. Popovski, J. C. Vasquez,
at Nanjing University of Science and Technology and Project 111 Professor
and J. M. Guerrero, Robust networked control scheme for distributed
at Northeastern University in Shenyang, China.
secondary control of islanded microgrids, IEEE Trans. Ind. Electron.,
He works in feedback control, intelligent systems, cooperative control
vol. 61, no. 10, pp. 53635374, Oct 2014.
systems, and nonlinear systems. He is author of 7 U.S. patents, numerous
[28] Q. Shafiee, J. M. Guerrero, and J. C. Vasquez, Distributed secondary
journal special issues, journal papers, and 20 books. He received the Fulbright
control for islanded microgrids: A novel approach, IEEE Trans. Power
Research Award, NSF Research Initiation Grant, ASEE Terman Award, Int.
Electron., vol. 29, no. 2, pp. 10181031, Feb 2014.
Neural Network Soc. Gabor Award, U.K. Inst Measurement and Control Hon-
[29] S. Amin, G. A. Schwartz, and S. S. Sastry, Security of interdependent
eywell Field Engineering Medal, IEEE Computational Intelligence Society
and identical networked control systems, Automatica, vol. 49, no. 1,
Neural Networks Pioneer Award, AIAA Intelligent Systems Award, and the
pp. 186 192, 2013.
Texas Regents Outstanding Teaching Award.
[30] X. Liu and Z. Li, Local load redistribution attacks in power systems
with incomplete network information, IEEE Trans. Smart Grid, vol. 5,
no. 4, pp. 16651676, July 2014. Frank Ferrese (SM17) is a lead research engineer
[31] , False data attacks against ac state estimation with incomplete at Naval Surface Warfare Center, Philadelphia. He
network information, IEEE Trans. Smart Grid, 2016, to be published. has a BS in Drexel University in Electrical Engi-
[32] Z. Li, W. Ren, X. Liu, and M. Fu, Distributed containment control neering (1995), and an MS (2006) and PhD (2013) in
of multi-agent systems with general linear dynamics in the presence Engineering from Villanova University. His research
of multiple leaders, International Journal of Robust and Nonlinear interests include control theory and optimization
Control, vol. 23, no. 5, pp. 534547, 2013. theory.
[33] H. J. LeBlanc, H. Zhang, X. Koutsoukos, and S. Sundaram, Resilient
asymptotic consensus in robust networks, IEEE J. Sel. Areas Commun.,
vol. 31, no. 4, pp. 766781, April 2013.
[34] J. Duan, W. Zeng, and M. Y. Chow, Resilient distributed dc optimal
power flow against data integrity attack, IEEE Trans. Smart Grid, 2016, Ali Davoudi (S04-M11-SM15) received his Ph.D.
to be published. in Electrical and Computer Engineering from the
[35] W. Zeng and M. Y. Chow, Resilient distributed control in the presence University of Illinois, Urbana-Champaign, IL, USA,
of misbehaving agents in networked control systems, IEEE Trans. in 2010. He is currently an Associate Professor
Cybern., vol. 44, no. 11, pp. 20382049, Nov 2014. in the Electrical Engineering Department, Univer-
[36] N. Mwakabuta and A. Sekar, Comparative study of the IEEE 34 node sity of Texas, Arlington, TX, USA. He is an
test feeder under practical simplifications, in Proc. 39th North Amer. Associate Editor for the IEEE TRANSACTIONS
Power Symp., Las Cruces, NM, USA, 2007, pp. 484491. ON TRANSPORTATION ELECTRIFICATION, the
IEEE TRANSACTIONS ON ENERGY CONVER-
SION, and the IEEE POWER LETTERS. He has
received 2014 Ralph H. Lee Prize paper award from
IEEE Transactions on Industry Applications, best paper award from 2015
IEEE International Symposium on Resilient Control Systems, 2014-2015 best
Shankar Abhinav (GS13) received the B.E. de-
paper award from IEEE Transactions on Energy Conversion, and 2016 Prize
gree in Electrical and Electronics Engineering from
Paper Award from the IEEE Power and Energy Society, and 2017 IEEE
Visvesvaraya Technological University, Karnataka,
Richard M. Bass Outstanding Young Power Electronics Engineer Award.
India, in 2011. He is currently working toward the
Ph.D. degree at the University of Texas at Arling-
ton, USA. His research interests include modeling
and control of power electronics, microgrid control,
distributed control systems, and renewable energy
resources.
1949-3053 (c) 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.