Mingxiao Ma
email: mingxiao.ma@loria.fr

Abdelkader Lahmadi
email: abdelkader.lahmadi@loria.fr

On the Impact of Synchronization Attacks on Distributed and Cooperative Control in Microgrid Systems

Microgrids are adopted to provide distributed generation of renewable energy resources and scalable integration of loads. To ensure the reliability of their power system operations, distributed and cooperative control schemes are proposed by integrating communication networks at their control layers. However, the information exchanged at the communication channels is vulnerable to malicious attacks aiming to introduce voltage instability and blackouts. In this paper, we design and evaluate a novel type of attacks on the cooperative control and communication layers in microgrids, where the attacker targets the communication links between distributed generators (DGs) and manipulates the reference voltage data exchanged by their controllers. We analyze the control-theoretic and detectability properties of this attack to assess its impact on reference voltage synchronization at the different control layers of a microgrid. Results from numerical simulation are presented to demonstrate this attack, and the maximum voltage deviation and inaccurate reference voltage synchronization it causes in the microgrid.

I. INTRODUCTION

Modern electric power distribution networks integrate various distributed generators (DGs), including photovoltaic (PV) and wind power generation systems to address environmental concerns [START_REF] Schiffer | Conditions for stability of droop-controlled inverter-based microgrids[END_REF]. DGs are designed to support renewable energy resources by interfacing them through voltage source inverters (VSI), which provide the required control inputs. To successfully coordinate DGs, autonomous subsystems called microgrids are introduced to the power networks. A microgrid is a small-scale low-voltage electrical network, consisting of generation units, loads and storage elements, where dedicated control systems enable them to provide guaranteed power quality for local loads and have a high integration of distributed generation.

To guarantee safe and reliable operations of microgrids, power networks need to be tightly coupled with supervisory control and data acquisition (SCADA) systems. SCADA systems collect data from remote sensors and send back supervisory control commands to monitor and operate power facilities. Communication networks play an increasingly important role in this process because more information need to be collected and transmitted due to the rapidly growing of penetration of distributed generation [START_REF] Isozaki | On detection of cyber attacks against voltage control in distribution power grids[END_REF]. However, the widely use of communication networks introduces new challenges to the power infrastructure coupled with SCADA, as these systems are vulnerable to malicious cyber attacks. A power outage incident caused by the malware "BlackEnergy" in Ukraine during 2015 has proved that cyber attacks could cause a major damage on power quality and devices. Thus, it is important to study potential vulnerabilities of these systems and design mitigation or prevention schemes against their high-risk threats [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF].

In [START_REF] Giacomoni | A control and communications architecture for a secure and reconfigurable power distribution system: An analysis and case study[END_REF] and [START_REF] Kundur | Towards modelling the impact of cyber attacks on a smart grid[END_REF], the authors propose cyber security modeling frameworks including both power system and communication networks. The analysis of cyber threats of centralized voltage regulation in distribution grid and their respective detection and mitigation schemes is explored in [START_REF] Isozaki | On detection of cyber attacks against voltage control in distribution power grids[END_REF]. In particular, stealthy attacks targeting transmitted data integrity of the integrated Volt-VAR control system is studied in [START_REF] Teixeira | Security of smart distribution grids: Data integrity attacks on integrated volt/var control and countermeasures[END_REF]. Furthermore, the capability of attackers to falsify the IEC 61850 data flow controlling the inverters is studied in [START_REF] Kang | Investigating cyber-physical attacks against IEC 61850 photovoltaic inverter installations[END_REF], which could cause damage to the underlying physical system. However, none of these works give a comprehensive analysis about the consequences of cyber attacks on the power system.

Specifically, regarding cyber attacks on the voltage/frequency control systems of microgrid systems, in [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF], the authors consider two types of attack scenario, reference signal attack and measurement routing attack, and study their impact on voltage stability and deviation in the droop-controlled DGs. Risk assessment methods to quantify the impact of measurement falsification attacks on a microgrid system are studied in [START_REF] Ma | Voltage control in distributed generation under measurement falsification attacks[END_REF]. To the best of our knowledge, these previous works only consider threat models targeting primary control level of a microgrid system.

In this paper, we consider a more comprehensive control structure for a microgrid system, mainly a hierarchical control approach consisting of three control levels: primary, secondary and tertiary control [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF]. Specifically, we design a distributed cooperative hierarchical control system consisting of droop control as primary control and cooperative control as secondary control. We believe this control scheme is more realistic and reliable than the control architecture considered in [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF] and [START_REF] Ma | Voltage control in distributed generation under measurement falsification attacks[END_REF], because of its better support for scalable integration of local loads and high integration of distributed generation.

Based on the above control model, we consider cyber attacks that may target the communication links between DGs, and we use risk assessment methods to quantitively analyze the impact of these attacks on voltage deviation at the primary control level and reference voltage synchronization at the secondary control level. Our impact analysis results are valuable for microgrid system designers to help them evaluate potential cyber threats targeting these systems.

The rest of the paper is organized as follows. In Section II, we present the microgrid model with a hierarchical control structure and we provide the basic settings for the power grid and the communication network. In Section III, we design a distributed cooperative control system and detail it details at the primary and secondary control levels. In Section IV, we detail the reference attack scenarios and perform its impact analysis in terms of voltage deviation and reference synchronization. In Section V, we present our simulations experiments to validate the theoretical analysis of the attack impact. Finally, we conclude the paper in Section VI.

II. SYSTEM MODEL

In this section, we describe the model of a microgrid system in terms of its hierarchical control structure and communication network.

A. Microgrid System with Hierarchical Control Structure

Microgrids are designed to work in both gird-connected and islanded operating modes, depending on whether connecting or not to the main grid. The task of the microgrid control system is to regulate voltage and frequency for different operating modes, to achieve proper load sharing among DGs, to control the power flow between the main grid and the microgrid, and to optimize the cost of its operations.

Currently, a hierarchical control structure is designed to achieve the above operating goals [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF]. As shown in Figure 1, the hierarchical control structure consists of primary, secondary and tertiary control levels. Each control level has its own control goals because of operating in different timescales. The primary control operates on a fast timescale, and is responsible for the control of transients to stabilize the voltage and frequency of the microgrid during changing of load or generation, or subsequent to an islanding event. Secondary control is designed to compensate for voltage and frequency deviations caused by primary control in terms of fault conditions. Finally, tertiary control, as the highest and slowest control level, optimizes the operations in both operating modes and manages to control the power flow between the main grid and the microgrid. Fig. 1. The hierarchical control structure of a microgrid consisting of primary, secondary and tertiary control levels as specified in [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF].

In this paper, we mainly consider the primary and secondary control levels of microgrid with balanced loads. The primary control is locally implemented at each DG, e.g., droop control for inverter-based distributed energy resources (DER). However, the secondary control usually relies on a centralized control structure. Central controllers are designed to issue global commands requiring information gathered from the whole system and thus a complex two-way communication network is also needed. This kind of communication network makes it vulnerable and may effect the system reliability. In [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF], the authors replace the existing standard centralized secondary control with an efficient distributed control structure. They consider the microgrid as a multi-agent system where each DG is an agent. A voltage source inverter (VSI) is employed to connect a DG to the microgrid. The VSIs are interconnected through the physical power network configuration.

A sparse communication network, which overlays the physical power network, is integrated in the control system. The controllers use this communication network to only communicate in a distributed way with neighboring nodes. The secondary controller also uses cooperative multi-agent control techniques to make all agents act as a one group to a common synchronization goal and follow cooperative decisions.

In this paper, we consider a distributed cooperative control structure similar to [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF]. The microgrid with N DG units is depicted in Figure 2. Each DG unit is represented by a bus. The lumped DERs and loads within one DG unit are respectively modeled as a single DER and load. We set the DG unit directly connected to main grid as DG Unit 1 . In this work, we assume that the three-phase power network under study is balanced, which means it can be represented as an equivalent single-phase system. Moreover, all N buses are inverter buses and the corresponding voltage magnitude and voltage angle of the i-th bus are respectively represented as V i and θ i for i = 1, . . . , N .

Hence we define the active and reactive power injections [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF] at bus i as:

P i = V 2 i G i - j∈Ni V i V j (G ij cos(θ ij ) + B ij sin(θij)), Q i = -V 2 i B i - j∈Ni V i V j (G ij sin(θ ij ) -B ij cos(θij)), (1)
where

G ij = R ij /(R 2 ij + X 2 ij ) ≥ 0 and B ij = -X ij /(R 2 ij + X 2
ij ) ≤ 0 are the conductance and susceptance of the transmission line between bus i and bus j, respectively. Additionally,

G i = G ii + j∈Ni G ij ≥ 0 and B i = B ii + j∈Ni B ij ≤ 0
are the self-conductance and self-susceptance, respectively [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF]. Note θ ij = θ i -θ j represents the angle difference between node i and j. We also assume that the phase-angle difference θ ij between any neighboring nodes for (i, j) ∈ V to be constant.

B. Communication Network

In the microgrid system, DG units are considered as the nodes of the communication graph and the corresponding communication links represent its edges. Figure 2 describes a line network, however a generic network topology of a microgrid system is usually characterized by a directed graph (digraph) G = (V, E, A G ) with a nonempty finite set of N nodes V = {v 1 , v 2 , . . . , v N }, a set of edges E ⊆ V × V, and the associated adjacency matrix A G . The set N i = {j ∈ V : (i, j) ∈ E} denotes the neighbor set of node i. The weight is represented by a ij for the edge from node j to node i, and a ij = 0 if there is no data transfer from node j to node i. Considering N nodes on the graph, the adjacency matrix is defined as

A G = [a ij ] ∈ R N ×N .
We define the diagonal in-degree matrix D = diag {d i } ∈ R N ×N , where d i is the sum of communication weights from neighbors of node i,

d i = j∈Ni a ij .
The Laplacian matrix of the graph is defined as L = D -A G . One property of the Laplacian matrix L is that the row sums of L are all zero, because the row sums of D and A G are equal.

A directed path from node i to node j is a sequence of edges depicted as {(v i , v k ), (v k , v l ), . . . , (v m , v j )}. A graph is considered to have a spanning tree if there exists a root node with a directed path from that node to every other node in this graph. A graph is strongly connected if there exists a directed path between every two nodes, i.e., there exists a spanning tree where every is a root node [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF] [START_REF] Moayedi | Distributed tertiary control of dc microgrid clusters[END_REF].

III. DISTRIBUTED COOPERATIVE CONTROL SYSTEM

In this section, we rely on existing control models to propose a distributed cooperative control scheme for voltage dynamics. We give a detailed description of both the primary and secondary control of the microgrid system under study.

A. Primary Control

Figure 2 illustrates how the reference signals and measurements are available to each controller. Making use of the capabilities of inverter-based DERs, each DG unit is controlled by a droop controller. The droop controller receives reference signal through synchronization process between neighboring nodes and voltage measurements from local meters. Let V * be the reference voltage sent from the secondary controller and V j and θ j , be the voltage magnitude and voltage angle of the j-th bus, respectively.

The voltage dynamics of each DG unit is modeled as a single integrator [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF], and we choose the voltage quadratic droop controller developed in [START_REF] Simpson-Porco | Synchronization and power sharing for droop-controlled inverters in islanded microgrids[END_REF] to compute the voltage control output signals. The primary droop control law is described as:

τ i Vi (t) = -κ i V c i (t)(V c i (t) -V c * i (t)) -Q c i (t), (2)
where τ i > 0 is the inverter's time-constant, κ i > 0 is the control gain of the droop controller, V c i (t) and Q c i (t) respectively represent the received voltage measurement and reactive power injection measurement with respect to bus i, and V c * i (t) is the received voltage reference signal determined by the secondary controller. For nominal operations, these signals match the corresponding physical variables and reference signals, i.e.,

V c i (t) = V i (t), Q c i (t) = Q i (t), and V c * i (t) = V * i (t).
Nominally, the closed-loop dynamics of the i-th DG unit are given by the differential equations

τ i Vi = -κ i V i (V i -V * i ) -Q i = -V i (κ i V i -κ i V * i + j∈V l ij (θ)V j ), ∀i = 1, . . . , N, (3)
with the time argument omitted. Assume the studied transmission line impedances have the same ratio R ij /X ij = -G ij /B ij = ρ ≥ 0 for all lines (i, j) ∈ E, where R ij and X ij are respectively the resistance and reactance of bus i and bus j. Under this assumption, the parameter l ij (θ) is written as:

l ij (θ) = B ij (ρ sin(θ ij ) + cos(θ ij )), i = j -B i , i = j. ( 4
) Denote V = [V 1 . . . V N ] , τ = [τ 1 . . . τ N ] , κ = [κ 1 . . . κ N ]
, and [V ] = diag {V } as the diagonal matrix with V i as the i-th diagonal entry, and similarly we have [τ ] = diag {τ }, [κ] = diag {κ}. We can obtain the voltage dynamics under the quadratic droop control in a vector form:

[τ ] V = [V ]([κ]V * i -([κ] + L(θ))V ), (5)
where the matrix L(θ) is defined as

[L(θ)] ij = l ij (θ).
Linearization of the voltage dynamics. For convenience of theoretic analysis, we consider the Jacobian linearization of the power system (5) around an equilibrium point

( V , V c * ) such that -([κ] + L(θ)) V + [κ] V * = 0. Denote x(t) = V (t) - V and u(t) = V c * (t) -V c *
as the voltage and reference deviations, respectively. The corresponding linearized system is described by

ẋ(t) = Ax(t) + Bu(t), (6)
where

A = -[ V ][τ ] -1 ([κ] + L(θ)) and B = [ V ][τ ] -1 [κ].
For the sake of simplicity, we suppose that V = 1pu subsequently, where 1 represents a vector with all entries equal to 1.

B. Secondary Control

In this work, the goal of the secondary controller is to generate the voltage reference signal for the primary controller at each DG unit. We employ the distributed cooperative control of multi-agent systems [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF] to design the secondary voltage controller for our microgrid system.

DGs are assumed to be able to communicate with each other through the communication network G. We assume that only one leader DG node i has access to the reference V * by a weight factor called the pinning gain g i . The pinning matrix G is defined to carry all the pinning gains of the graph G = diag {g i } ∈ R N ×N . The computation of the global reference voltage V * is based on the load deferences between loads in this microgrid and its neighbors, as specified in [START_REF] Moayedi | Distributed tertiary control of dc microgrid clusters[END_REF].

The synchronization of reference values of DGs in a communication network G can be modeled as a tracking problem in cooperative control. The consensus all DG nodes need to reach is determined by the leader node.

Note that V * i is the voltage reference set point for DG i, and denote

V ref = [V * 1 . . . V * N ]
. The DGs synchronize their references to hold

Vref = -(L + G)(V ref -1 • V * ) (7)
at the steady state. Note that all eigenvalues of L + G have positive real values, so equation ( 7) leads to the desired tracking performance at the steady state. For each DG unit in the microgrid, the voltage reference set point is written as

V * i = j∈Ni a ij (V * j -V * i ) + g i (V * -V * i ) (8)

IV. CYBER ATTACKS ON VOLTAGE CONTROL AND IMPACT ANALYSIS

In this section we consider the model of the microgrid system described in section II and we study the possible adversary actions on the reference signal transmitted by the communication network at the primary and secondary control levels.

It is natural to consider a naive attack where an attacker simply falsifies the reference voltage value V * i for DG i. However, it is easy to be detected by simple detection algorithms [START_REF] Isozaki | On detection of cyber attacks against voltage control in distribution power grids[END_REF] considering the admissible range

V * min ≤ V * i ≤ V * max , (9)
where V * min and V * max are respectively the lower and upper limit for the reference value.

In this work, we identify a novel type of of attack scenarios: "measurement as reference " attack. Under the assumption that the attacker has knowledge about the hierarchical control structure, it targets the communication link between DG units and maliciously replaces the reference signal with the measurement of the previous node. Since the two signals have very close values and follow the same dynamic changes, this attack is "naturally stealthy", and is possible to cause a serious impact without being detected by traditional intrusion detection algorithms.

First we describe the considered attack scenario and we give its mathematical definition. Then we describe how the attack influences the voltage control systems. We characterize the attack impact by the maximum voltage magnitude deviation and inaccurate reference voltage synchronization it causes.

A. measurement as reference attack

Without loss of generality, we assume the attacker replaces the reference signal V * i+1 for node i + 1 with the voltage measurement V s i of node i when defining the attack. The goal of measurement as reference attack is set to cause voltage fluctuations and irregular regulations to harm the loads without violating the admissible range [START_REF] Schiffer | Conditions for stability of droop-controlled inverter-based microgrids[END_REF]. For convenience of analysis, we assume only one communication link is under attack. The definition of measurement as reference attack is given as follows.

Definition 1 (measurement as reference attack): In a measurement as reference attack on the communication link between DG unit i and i + 1, the attacker manipulates the exchanged data by replacing the reference signal V * i+1 (t) for DG unit i + 1 with the voltage measurement V s i (t) of DG unit i , so that

V * i+1 (t) = V s i (t), (10)
Furthermore, the droop control signal at DG unit i + 1 under attack is given by

τ i Vi+1 (t) = -κ i+1 V c i+1 (t)(V c i+1 (t) -V s i (t)) -Q c i+1 (t) (11)

B. Attack Impact on Voltage Deviation

One impact of the measurement as reference attack is voltage magnitude deviations . Consider the resulting changes to the voltage magnitude at DG j in the network, i.e., V j . The resulting linearized system under attack can be written as

ẋ(t) = Ax(t) + τ -1 i+1 κ i+1 e i+1 u(t) y j (t) = e j x(t) u(t) = e i x(t), (12)
where A = -[τ ] -1 (κ + L(θ)) and e i ∈ R N is the i-th column of the N -dimensional identify matrix. The attack impact can be quantified as the maximum deviation of y j (t) caused by a corrupted input u(t) = e i x(t), which is bounded by |u(t)| ≤ δ, where V * min ≤ δ ≤ V * max . Computation of maximum voltage deviation. We use sup t≥0 |y j (t)| to represent the maximum voltage magnitude of DG j under a measurement as reference attack [START_REF] Simpson-Porco | Synchronization and power sharing for droop-controlled inverters in islanded microgrids[END_REF] on the link between DG i and i + 1. We know that the linearized system [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF] under attack is a positive system [START_REF] Rantzer | Scalable control of positive systems[END_REF] since A is a Metzler matrix with non-negative off-diagonal entries and τ -1 i+1 κ i+1 e i+1 , e j are non-negative [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF]. Let's define the transfer function of the system (12) as H(s) = Y (s)/U (s) = L {y(t)} /L {u(t)}, where L means Laplace transform. Thus we can compute

H(s) = τ -1 i+1 κ i+1 e j (sI -A) -1 e i+1 . (13)
According to the properties of positive systems [START_REF] Rantzer | Scalable control of positive systems[END_REF], we know that the L ∞ -induced norm of system ( 12) is given as

H L∞-ind = sup u L∞ <∞ y L∞ u L∞ = H(0), (14)
which characterizes the maximum amplitude of the output signal y j (t) which can be achieved by an input u(t) with bounded amplitude

u L∞ := sup t≥0 |u(t)| ≤ δ. (15)
So we can compute

sup t≥0 |y j (t)| = H L∞-ind • u L∞ ≤ H(0) • δ = -τ -1 i+1 κ i+1 δe j A -1 e i+1 = τ -1 i+1 κ i+1 δ[-A -1 ] j,i+1 , (16)
where

[-A -1 ] j,i+1 is the element of row j column i + 1 from matrix -A -1 . So τ -1 i+1 κ i+1 δ[-A -1 ] j,i+1
gives the upper bound of the voltage deviation caused by the attack. Since the δ value in (15) is determined by the system state, the the upper bound in ( 16) is tight because the maximum is reachable. Therefore, we find that the impact on voltage deviation of each node depends on the structure of matrix A, which reflects the power system topology.

C. Impact on Reference Voltage Synchronization

Besides the voltage deviation, the attack also affects the reference synchronization regarding the secondary control level. Note that the reference of each DG unit will follow the differential equation ( 7) under nominal operations. So the problem of studying what is the attack impact on reference synchronization is mapped to seeking for the initial conditions of differential equation [START_REF] Moayedi | Distributed tertiary control of dc microgrid clusters[END_REF] caused by the attack.

Since the primary control is operating much faster than the secondary control, the voltage state of each DG node would become stable again very quickly and reaches a new equilibrium point when the secondary controller regulates the reference signals. To compute this equilibrium point, we let V = 0 in [START_REF] Kundur | Towards modelling the impact of cyber attacks on a smart grid[END_REF]

, i.e., [κ]V * i -([κ] + L(θ))V = 0.
According to the definition of measurement as reference attack V * i+1 (t) = V s i (t), we have

V * i+1 = V i = e i ([κ] + L(θ)) -1 [κ]V ref . (17)
So we can get the initial conditions of differential equation ( 7) under attack as

(e i ([κ] + L(θ)) -1 [κ] -e i+1 )V ref = 0. (18)
The differential equation (17) with initial condition (18) describes the reference signal synchronization process under attack for each node. When the secondary controller regulates the set point V * , all references of the nodes relying on communication with node i + 1 for synchronization, are not able to reach the consensus V * .

V. SIMULATION

In this section, we use simulation tools to validate the theoretical analysis of the measurement as reference attack and its impact proposed in the previous section.

A. Simulation Settings

We use Matlab and Simulink tools to build the microgrid control system described in Figure 2 and model the measurement as reference attack provided in Definition 1.

For the power system simulation settings, we consider a microgrid system with 4 DG units in Figure 2, i.e., N = 4. We follow the model settings proposed in [START_REF] Teixeira | Voltage control for interconnected microgrids under adversarial actions[END_REF] and [START_REF] Ma | Voltage control in distributed generation under measurement falsification attacks[END_REF], where all power lines, DERs and loads are identical. The power system is characterized by [START_REF] Bidram | Distributed control systems for small-scale power networks: Using multiagent cooperative control theory[END_REF] with parameters: ρ = 0.5, B ij = -0.2, and G ij = -ρB ij for all edges (i, j) ∈ E and B ij = -0.2 and G ii = -ρ |B ii | for all buses.

For the primary control, we set the parameters θ 12 = -0.01rad, θ 23 = -0.045rad, and θ 34 = -0.01rad, to make sure that the phase-angle differences between any neighboring nodes are constant. The quadratic droop control modeled by ( 5) and ( 2) is characterized by parameters τ i = 10 -4 , τ θi = 10 -2 , and κ i = 0.2 for all buses.

The voltage dynamics under primary control are defined by the nonlinear differential equations [START_REF] Kundur | Towards modelling the impact of cyber attacks on a smart grid[END_REF]. Through Jacobian linearization, the corresponding linearized dynamics characterized by ( 6) is given as Clearly the above system is positive and the properties of positive systems [START_REF] Rantzer | Scalable control of positive systems[END_REF] are applicable. Finally, we choose typical parameters for the secondary control. As depicted in Figure 2, the network is a 4-node line topology and DG 1 is the only pinned root node. Considering the communication network topology and a proper synchronization rate, we set the adjacency matrix A G = [a ij ] carrying the communication weights of a 21 = 12, a 32 = 11, a 41 = 10 and all other weights equal to zero, and the pinning matrix G = diag {g i } carrying all pinning gains of g 1 = 10, g 2 = g 3 = g 4 = 0.

A = 10 -4 •     -4.

B. Simulation Results

Considering the above simulation settings, the voltage of each DG is in stable state and the global reference set point V * = 1pu. At time t = 2 × 10 -3 s, the attacker introduces the measurement as reference attack by replacing the reference signal V * 2 at node 2 with the voltage measurement V 1 at node 1.

As shown in Figure 3, the attack cause voltage deviation at each DG unit, which is a short-term impact on the primary control. We can see the voltages reach a stable state again very quickly. Comparing the voltage deviation of the simulated non-linear system under attack with the linearization analysis in Section IV, we can find that the voltage deviation caused by the attack is within boundary computed in (16). Comparison result shows that the voltage deviation of the simulated nonlinear system under attack is the same to the linearized system, which shows our linearization analysis in Section IV is valid. How the attack influences the reference synchronization is shown in Figure 4. At time t = 0.1s, the secondary controller regulates the reference set point from V * = 1pu to V * = 1.05pu. After about 0.5s, the reference signals finish the synchronization process. We find that DG 2 and DG 3 no longer reach the consensus V * , which could lead to a heavy impact on voltage regulation in a microgrid system.

VI. CONCLUSIONS AND FUTURE WORK

In this paper, we develop and design measurement as reference cyber-attack targeting both primary and secondary control levels of a distributed cooperative control scheme for a microgrid. We analyze the impact of this attack where the goal of the attacker is to introduce a reference voltage deviation by manipulating the synchronization data exchanged between the distributed controllers. We use control-theoretic tools to derive the maximum voltage deviation introduced by this attack where the system will not synchronize to the correct setting point provided by the secondary controller. Moreover, the theoretical analysis results of the impact are validated by simulation. As a future work, the impact of this attack on frequency synchronization and attack detection algorithms will be investigated.

Fig. 2 .

 2 Fig. 2. A microgrid control system with primary and secondary controllers. Sparse communication networks are employed for data exchange between neighboring DG units, e.g., transmitting reference signals and measurements (denoted by the superscript s).

Fig. 3 .

 3 Fig. 3. The impact of the measurement as reference attack on voltage deviation.

Fig. 4 .

 4 Fig. 4. The impact of the measurement as reference attack on reference synchronization.

ACKNOWLEDGMENT

This work has been funded by the French Government under grant FUI 23 PACLIDO (Protocoles et Algorithmes Cryptographiques Légers pour l'Internet Des Objets). We would like to thank Prof. Babak Nahid-Mobarakeh for his valuable feedback on the power system model.