Resilient Consensus Control Design for DC Microgrids against False Data Injection Attacks Using a Distributed Bank of Sliding Mode Observers

Abstract

This paper investigates the problem of false data injection attack (FDIA) detection in microgrids. The grid under study is a DC microgrid with distributed boost converters, where the false data are injected into the voltage data so as to investigate the effect of attacks. The proposed algorithm uses a bank of sliding mode observers that estimates the states of the neighbor agents. Each agent estimates the neighboring states and, according to the estimation and communication data, the detection mechanism reveals the presence of FDIA. The proposed control scheme provides resiliency to the system by replacing the conventional consensus rule with attack-resilient ones. In order to evaluate the efficiency of the proposed method, a real-time simulation with eight agents has been performed. Moreover, a verification experimental test with three boost converters has been utilized to confirm the simulation results. It is shown that the proposed algorithm is able to detect FDI attacks and it protects the consensus deviation against FDI attacks.

1. Introduction

In recent years, distributed control has received considerable attention due to its high efficiency, simplicity, and reliability. DC microgrids can be represented as a distributed system, and therefore, distributed control techniques are widely utilized to control these systems. However, due to the nature of distributed networks and also advances in cyber attack methods, these systems are vulnerable to malicious attacks. One of the positive points for these systems is the versatility of a wide range of DC sources, which allows these sources to be used simultaneously in a microgrid [1,2,3,4]. Small energy sources such as solar photovoltaics, fuel cells, batteries, and other renewable energy sources (RESes) [3] mainly have low output voltage and need to boost converters to increase the voltage levels up to the network reference. The most popular control techniques used to regulate the voltage are back stepping [5], sliding mode control (SMC) [6,7], model predictive control (MPC) [8,9], and passivity-based control [10]. These methods have the advantages of robustness, stability, optimality, and flexibility [11].

In a microgrid, for supply distributed and different types of loads, we need distributed networked RESes with two features; all must be grid-connected and operate autonomously [12]. In these cases, designing a distributed control law to reach an agreement between all nodes regarding certain constraints that depends on the state of all agents is named a consensus algorithm [13]. Decentralized and distributed controls are two main keys for consensus problems [14].

Decentralized consensus is not vulnerable at a breakdown point, and is considered as a scalable and efficient control for network management [12]. In general, the purpose of distributed control in a DC microgrid is to reach a voltage consensus and proportional current distribution [15]. In the microgrid, each RES is an agent which cooperates and communicates with the neighbors to reach a consensus. Consensus is possible if the cyber networks report the measurements correctly. Any violation of measurement or incorrect reporting will result in an incorrect voltage or current distribution. In communication-based distributed networks, one of the main threats to the network is cyber attacks [16,17,18].

Cyber attacks are very costly for distributed power systems depending on the type, time, and place of occurrence. It causes major economical and technical problems that may be irreparable [19,20]. The most important of these attacks can be categorized into replay attacks, in which transmitted data are stored and repeated periodically, denial of service attacks (DOSA) [21], false data injection attacks (FDIA), and stealth attacks, in which the attackers have sufficient knowledge about the system model, controller, and network architecture [22]. Stealth attacks can easily bypass the bad-data detection mechanisms [19]. These attacks occurs in microgrids by injecting false data to the communication packets over the communication cyber links. Due to the variety of attack categories, denial of service attacks lead to disconnection and are very easy to detect. Therefore, from the viewpoint of attackers, a false data injection attack has a better chance of winning. Therefore, one of the most important attacks is FDIA, which is studied in this article.

There are several data security methods, such as cryptography, user administration, etc.; these are necessary but not enough to protect the systems against all cyber attacks. This is because the attackers are smart and their methods and knowledge about the systems are growing. Prevention is the first step in countering attacks, and the next step is resiliency. In recent years, several strategies have been proposed to detect and reduce the disadvantageous effects of attacks in microgrids. Some approaches are Kalman-filter-based methods to estimate process variables [23], local observers for fault and field level attacks [24], resilient distributed strategies for detecting and isolating time-varying attacks [25], event-triggered strategies proposed to make the control tolerant and robust under DOSA [26], the game theory defense method for a hierarchical networked microgrid structure [27], secure distributed state estimation for the network under FDIA [28], and distributed cyber attack detection for linear large-scale systems by a bank of unknown input observers (UIO) [29]. In general, all these works can be summarized as two main categories, secure robust control, and secure state estimation.

Considering these issues, the main objective of the current work is to design a distributed consensus algorithm to be resilient against false data injection attacks in a DC microgrid. The proposed method is developed based on the distributed observer form of attack detection schemes to achieve a resilient strategy. In this structure, each agent is locally equipped with a detection mechanism and resilient consensus control that utilizes the information of neighbor agents’ states. To regulate the output voltage of each agent, the sliding mode controller is employed while the reference voltage of the controller is generated by the consensus law. Moreover, it is assumed that the converter voltage and current value can be measured. In order to achieve a resilient control structure, the consensus control is designed so as to be resilient in the presence of the FDIAs. Therefore, when an attack is detected, the corresponding agent will be neglected from the agreement process. In order to detect an FDI attack, a bank of sliding mode observers is designed in each agent in such a way that each observer is related to one of the neighbors.

Using the proposed attack detection algorithm, the compliance of received data from the neighboring agents will be checked with the estimated data from the corresponding observer and so the presence of the attack will be detected. The performance of this method has been validated with simulation and experimental tests to conclude that the proposed mechanism is able to detect the presence of attacks effectively and it is resilient. Compared with the existing literature, the main contributions of this article can be summarized as follows.

• Compared to previous studies such as [12,22], the proposed approach develops a bank of robust observers for each agent that makes the detection and isolation of the false data injection attacks feasible. Therefore, by eliminating the effect of the attack in the consensus law, a resilient control is achieved.
• The controller and observers are designed based on robust approaches, which is very important in practical applications. It is shown that consensus is successfully achieved even in the presence of cyber attacks, while the modeling uncertainty is considered.
• A resilient consensus law is proposed to remove the false data injection attacks from the agreement procedure.
• The practical efficiency of the proposed method is evaluated in an experimental testbed that is close to real-world applications. To this aim, a complex real-time hardware test is performed by MATLAB, Simulink real-time (XPC-Target), LAN communication, FPGA and Microblaze coding, control board design, and three DC-DC boost converters.

The remaining structure of this article is as follows. In Section 2, the basic concepts for graph theory, consensus protocol, and the microgrid model are presented. A model for the communication link attacks is provided in Section 3. Sliding mode controller and observers are designed in Section 4. The proposed resilience consensus law is developed in Section 5. Simulations and experimental validation are presented in Section 6 and Section 7. Finally, the paper is concluded in Section 8.

2. Background

2.1. Graph Theory

In this section, some basic definitions of graph theory are reviewed. A graph is a set of nodes that are connected to each other by several links. It is noted as $G=\{V,E,A\}$ that represents information flow between the nodes in the network; $V=\{v_1,\dots ,v_n\}$ is the set of network nodes, where n is the number of nodes, $E\subseteq V\times V$ is the set of network links, and $A=\left[a_{ij}\right]$ is the adjacency matrix that $a_{ii}=0$, $0<\delta \le a_{ij}<1$, where $\delta$ is a lower bound for gain of adjacency matrix links. If node i has access to the states of node j, it means there is a link between them, which is denoted by $e_{ij}=(v_i,v_j)\in E$. The neighbors of node i are denoted by $N_i=\{j\in V:(i,j)\in E,i\ne j\}$, which can communicate with node i.

$\mathbf{L}={\left[l_{ij}\right]}_{n\times n}\in {\mathbb{R}}^{n\times n}$ is the Laplacian matrix, where $l_{ii}={\sum }_{j=1,i\ne j}^n{a}_{ij}$ and $(l_{ij}=-a_{ij}$ for $i\ne j)$. The eigenvalues of the Laplacian matrix can be ordered as ${\lambda }_1<{\lambda }_2<\dots <{\lambda }_n$, where ${\lambda }_2$ is called the algebraic connectivity of the graph. A graph is connected if only its algebraic connectivity is positive: ${\lambda }_2>0$. In a connected graph, agreement will be met, if the condition $\underset{t\to \infty }{lim}\parallel x_i\left(t\right)-x_j\left(t\right)\parallel =0,\forall i,j=1,\dots ,n,$ is established [30,31].

2.2. Conventional Consensus Protocol

In a network of agents, reaching an agreement between nodes is called consensus. In general, each node is modeled as

$$\begin{array}{c}\hfill x_i\left(t\right)=f(x_i\left(t\right),u_i\left(t\right))\end{array}$$

(1)

A dynamic graph is shown by $(G,x)$, where G is the graph topology and x is agents’ states that are described by (1). The consensus problem is described by finding a way to guide agents’ states to an agreement. In a simple and ideal multi-agent system, $u_i\left(t\right)$ depends on the states of neighbors that are compared and gained. This is expressed as:

$$\begin{array}{c}\hfill u_i\left(t\right)=f_c(x_i\left(t\right),x_{j_1}\left(t\right),\dots ,x_{j_m}\left(t\right))\end{array}$$

(2)

The neighbors of node $v_i$ are denoted by $N_i=\{v_j\in V:(v_i,v_j)\in E\}$, in which m is the number of neighbors. The consensus protocol is using a function for $u_i=f_c(x_i,x_{j\in N_i})$, which causes asymptotically an stable agreement. It is the main goal in the consensus problems. In general, a consensus rule with a variable topology graph, communication time delay, and asynchronous update for agreement is

$$\begin{array}{c}\hfill u_i\left(t_i\right)=\sum _{v_j\in N_i}{a}_{ij}\left(t_i\right)[x_j(t_j-{\tau }_{ij}\left(t_i\right))-x_i\left(t_i\right)]\end{array}$$

(3)

where $a_{ij}\left(t_i\right)$ is an entry of the adjacency matrix A that may change by time and is related to the edge of $E_{ij}$, ${\tau }_{ij}<\tau$ is the bounded delay related to the edge $E_{ij}$ at time $t_i$, $t_j\le t_i$ is the update time for Agent j, which shows that the update time for any agent may be different. By (3), each agent state goes to the neighbors’ states and the graph reaches consensus ${lim}_{t\to \infty }{\sum }_{j\in N_i}\parallel x_i\left(t\right)-x_j\left(t\right)\parallel =0$.

2.3. DC-Microgrid Dynamic

The aim of this section is to introduce a typical model for a DC-DC boost converter in a state space approach. A typical DC-DC boost converter circuit is depicted in Figure 1.

In this figure, $V_{in}$ is the battery voltage, r is the sum of inductor resistance and battery resistor, L is an inductor, $sw$ is an ideal switch, D is an ideal diode, $C_o$ is the capacitor, and R is the load. The $i_L$ is the inductance current that is considered as a state $x_1$ and $V_c$ is the voltage of the capacitor or output voltage considered as a state $x_2$. Based on Kirchhoff’s laws for the ON and OFF states of the switch, two models are given. These two models alternate with switching frequency periods.

Due to the fact that the switching frequency is very high and the rising time and falling time of the switch is very small, the average model for the converter can be used. According to the duty cycle of switch operation (switch is ON for d and OFF for $(1-d)$ in any period), the non-linear average model of the DC-DC boost converter is presented in (4) and the linear time-variant state space is presented in (5).

$$\begin{array}{c}\hfill \left\{\begin{array}{c}{\dot{x}}_1=-{\displaystyle \frac{r}{L}}{x}_1-{\displaystyle \frac{1-d}{L}}{x}_2+{\displaystyle \frac{1}{L}}{V}_{in}\hfill \\ {\dot{x}}_2={\displaystyle \frac{-1}{R{C}_o}}{x}_2+{\displaystyle \frac{1-d}{C_o}}{x}_1\hfill \\ y=x_2\hfill \end{array}\right.\end{array}$$

(4)

$$\begin{array}{c}{A}_i=\left[\begin{array}{cc}{\displaystyle \frac{-r}{L}}& {\displaystyle \frac{-(1-d)}{L}}\\ {\displaystyle \frac{(1-d)}{C_o}}& {\displaystyle \frac{-1}{R{C}_o}}\end{array}\right],B_i=\left[\begin{array}{c}{\displaystyle \frac{1}{L}}\hfill \\ 0\hfill \end{array}\right]\hfill \\ C_i=\left[\begin{array}{cc}0& 1\end{array}\right]\hfill \end{array}$$

(5)

where $x\in {\mathbb{R}}^n$ is the state vector, $y\in {\mathbb{R}}^p$ is the output vector, $u\in {\mathbb{R}}^q$ represents the known inputs, and the r term is intended to take into account the voltage drop that is caused by the battery current. It is assumed that $A_i$, $B_i$, and $C_i$ are known matrices with appropriate dimensions. For power balance in the steady state, it is:

$$\begin{array}{c}\hfill \begin{array}{c}\left\{\begin{array}{c}sw=0\hfill \\ Q_{in}=Q_{out}\hfill \end{array}\right.\to i_L(1-d)T=I_{out}T\hfill \\ \to i_L={\displaystyle \frac{I_{out}}{(1-d)}}\to x_1={\displaystyle \frac{x_2}{R(1-d)}}\hfill \end{array}\end{array}$$

(6)

3. Cyber-Physical Attack Model

In the microgrids, two features are very important; first, a global voltage reference exists, which must be followed by all the network nodes, and the second is that all the network nodes must follow the neighboring nodes. With these two requirements, the goal of the network, which is a uniform and homogeneous voltage distribution, is achieved. Because the microgrid consensus is based on interaction and communication within the network, the microgrid consensus is always under threat. Despite all the security and encryption in communications, there are always some attacks aimed at systems by destabilizing goals; thus, the agents must be sensitive to these attacks. In this case, it is assumed that attacks are performed by injecting false data into the output voltage information that transmits between agent neighbors in the network.

For cyber-link attacks in the ith controller, the attacked value can be modeled as

$$\begin{array}{c}\hfill y_{ij}^{at}\left(t\right)=y_i\left(t\right)+k_{at}(t-T_{at}^{ij})f_{ij}^{at}\left(t\right)\end{array}$$

(7)

where $k_{at}$ indicates the attack vector that expresses the existence of an attack, $f_{ij}^{at}\left(t\right)$ denotes the attack function in communication link $ij$, $T_{at}^{ij}>0$ is the initial time of attack, $y_i$ is the real voltage output of Agent i, and $y_{ij}^{at}$ represents the attacked value that Agent j receives through the communication link about Agent i. For example, according to Figure 2, the communication data from Agent i to Agent j are attacked and the voltage data delivered to Agent j are false.

This malicious data lead to an incorrect consensus for the microgrid. For different types of attacks, the $f_{ij}^{at}\left(t\right)$ can take different functions [32]: for FDIA, $f_{ij}^{at}\left(t\right)$ can take any function of time; for a reply attack, it can be $f_{ij}^{at}\left(t\right)=-y_i\left(t\right)+y_i(t-nT)$, where T is a period of time; in a denial of service attack, it is $f_{ij}^{at}\left(t\right)=-y_i\left(t\right)$, which blocks the link by preventing some or all data transmission over the communication link, and for a stealth attack, all data vectors may be replaced with malicious data in such a way that observers cannot find any deviation compared to the system model.

4. Observer-Based Attack Detection

To reach a correct consensus in a DC microgrid network, the communication data between the neighboring agents must be correct. If only one piece of the communication data within the network is attacked, the network will reach a false consensus around this value. Therefore, each agent must prevent the influence of defective data. Moreover, because of model parameters’ uncertainty due to factory tolerance, derating, temperature sensitivity, and others, the model is not accurate and control needs to implement a robust strategy. In this paper, a sliding mode controller is proposed to control the converter, and a sliding mode observer (SMO) is proposed to detect the presence of the attack in the received data. To reach consensus in the proposed method, in addition to the conditions mentioned in the graph theory, each agent must be connected to the $n+1$ neighbors, where n is the maximum number of attacks in time. This is because, if n attack occurs at the same time, at least a healthy link is needed to achieve consensus.

4.1. Sliding Mode Control

The challenge for the boost converter is to design a control law for the duty cycle $u\left(t\right)\in [0,1]$ to regulate the output voltage $\underset{t\to \infty }{lim}{x}_2\left(t\right)=x_2^d$ ($x_2^d$ is the desired output voltage), while the battery voltage E is uncertain and bounded with $\Delta E<\zeta$. For this goal, a sliding mode control is designed. The boost converters represent non-linear dynamics with non-minimum phase characteristics [6]. Therefore, the voltage regulation using the switching function $S=x_2-x_2^d$ is not acceptable, though it causes the output voltage to be equal to the desired value. This voltage sliding surface results in an unstable zero dynamic in the inductor current in the sliding motion [33]. According to the relation between position and velocity control, the dynamic of the current is much faster than the output voltage.

Theorem 1.

Consider the system defined in Equation (4). For this system, there exists a distributed sliding mode controller that keeps the microgrid voltages in an asymptotically stable agreement.

Proof. 

Design the distributed sliding mode controller for each agent

$$\begin{array}{c}u=u_{eq}+u_n=u_{eq}+k\mathrm{sgn}\left(S\right)\hfill \\ \mathrm{sgn}\left(S\right)=\left\{\begin{array}{c}1\hfill \\ -1\hfill \end{array}\right.\begin{array}{c}S>0\hfill \\ S<0\hfill \end{array}\hfill \end{array}$$

(8)

where S is the sliding surface that is shown in Equation (9), sgn is the sign function, k is the gain for sign function, and $u_{eq}$ is the equal control law that is derived in Equation (11).

To improve the stability of the mentioned sliding mode control, S is the state variable trajectory and is described as

$$\begin{array}{c}\hfill S={\lambda }_1{\tilde{x}}_2+{\lambda }_2\int {\tilde{x}}_2+{\lambda }_3{x}_1\end{array}$$

(9)

where the voltage error has been defined as ${\tilde{x}}_2=x_2-x_2^d$ and ${\lambda }_1,{\lambda }_2,{\lambda }_3$ are sliding coefficients. The time derivative of the switching function is

$$\begin{array}{c}\hfill \begin{array}{c}\dot{S}={\lambda }_1{\dot{\tilde{x}}}_2+{\lambda }_2{\tilde{x}}_2+{\lambda }_3{\dot{x}}_1\hfill \\ ={\lambda }_1({\displaystyle \frac{-1}{RC}}{x}_2+{\displaystyle \frac{1-u}{C}}{x}_1-{\dot{x}}_2^d)+{\lambda }_2{\tilde{x}}_2+{\lambda }_3(-{\displaystyle \frac{1-u}{L}}{x}_2-{\displaystyle \frac{r}{L}}{x}_1+{\displaystyle \frac{1}{L}}E)\hfill \\ =(1-u)({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)+(-{\displaystyle \frac{{\lambda }_1}{RC}}{x}_2+{\lambda }_2{\tilde{x}}_2-{\displaystyle \frac{{\lambda }_{3}r}{L}}{x}_1+{\displaystyle \frac{{\lambda }_3}{L}}E)\hfill \end{array}\end{array}$$

(10)

where $x_2^d$ is assumed to be constant, which is calculated by the consensus algorithm in Equation (3). In order to attend to the dynamics of the sliding surface, the time derivative of the sliding surface is investigated. The purpose of this rule is to ensure that, for any initial values, the states will reach the sliding surface. This equation expresses that if we are not on the sliding surface, the path S is an absorbing path to the sliding surface. It is found from $\dot{S}=0$ that

$$\begin{array}{c}\hfill \begin{array}{c}(1-u_{eq})=-{\displaystyle \frac{(-{\displaystyle \frac{{\lambda }_1}{RC}}{x}_2+{\lambda }_2{\tilde{x}}_2-{\displaystyle \frac{{\lambda }_{3}r}{L}}{x}_1+{\displaystyle \frac{{\lambda }_3}{L}}E)}{({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)}}\hfill \\ u_{eq}={\displaystyle \frac{({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)+(-{\displaystyle \frac{{\lambda }_1}{RC}}{x}_2+{\lambda }_2{\tilde{x}}_2-{\displaystyle \frac{{\lambda }_{3}r}{L}}{x}_1+{\displaystyle \frac{{\lambda }_3}{L}}E)}{({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)}}\hfill \end{array}\end{array}$$

(11)

The $u_{eq}$ value is calculated for the nominal parameters of the model, and according to the uncertainties of the model, another component must be added to the input to be robust. According to Equation (8), for finding the range of k values, the stability condition of the sliding mode controller is $S\dot{S}\le -\eta \left|S\right|$. For achieving finite-time convergence,

$$\begin{array}{c}S\dot{S}\le -\eta \left|S\right|,\eta >0\to t_r={\displaystyle \frac{\left|S\right(0\left)\right|}{\eta }}\hfill \\ S\left[(-{\displaystyle \frac{{\lambda }_1}{RC}}{x}_2+{\lambda }_2{\tilde{x}}_2-{\displaystyle \frac{{\lambda }_{3}r}{L}}{x}_1+{\displaystyle \frac{{\lambda }_3}{L}}E+{\displaystyle \frac{{\lambda }_3}{L}}\Delta E)+(1-u_{eq}-k\mathrm{sgn}\left(S\right))({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)\right]=\hfill \\ S\left[{\displaystyle \frac{{\lambda }_3}{L}}\Delta E+(-k\mathrm{sgn}\left(S\right)({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)\right]\le \hfill \\ \left|S\right|\left[{\displaystyle \frac{{\lambda }_3}{L}}\zeta +-k({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)\right]\le -\eta \left|S\right|\hfill \\ {\displaystyle \frac{{\lambda }_3}{L}}\zeta -k({\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2)\le -\eta \hfill \\ k\ge \frac{\eta }{|{\displaystyle \frac{{\lambda }_1}{C}}{x}_1-{\displaystyle \frac{{\lambda }_3}{L}}{x}_2|}+{\displaystyle \frac{{\lambda }_3}{L}}\zeta \hfill \end{array}$$

(12)

 □

4.2. Sliding Mode Observer Attack Detector

Observers are dynamic systems that are used to estimate the system states based on the measurements of system inputs and outputs [34]. The estimation occurs when we do not have access to some state variables or we face a fault detection problem. In order to design an observer for the non-linear systems or with parametric uncertainty and perturbation, the sliding mode observers are proposed. It is appropriate for robust estimation, accurate tracking, limited time convergence, and fault detection. In this paper, we convert a non-linear DC-DC boost converter problem to a time-varying linear problem by the assumption that we know the duty cycle values. According to Figure 3, if we have access to the duty cycle d, the non-linear model for the boost converter can be replaced with a linear time-varying model. By this definition, nothing changes for the system dynamics, and we can use a linear sliding mode observer for this problem.

In the systems where software controls the process (usually, digital control systems execute some software), the safety of software cannot be measured and proven. In control and automation processes, due to the use of software, one of the approaches that is recommended to increase the safety of the systems is the use of different methods and algorithms for one process to increase the redundancy and security of the system. For this reason, with respect to matters of security and safety, it is recommended to use observers that have a completely different structure from the controllers in order to diagnose attacks and faults; if possible, the implementation methods for controller and observer must be different. The difference in the structure of controller and observer results in the fact that the smallest incompatibilities can be easily detected and catastrophic failures can be prevented.

For the observer, if we consider the system input as d, the system is modeled non-linearly, and if we consider the system input as $v_{in}=E$, the system becomes a linear system whose dynamic varies with time. This assumption is correct because the values of these two parameters are always available. Considering these cases, the system state equations can be written as (5).

In order to design an observer, the pairs (A,C) must be observable. Therefore, we form the visibility matrix as

$$\begin{array}{c}\hfill Q=\left[\begin{array}{c}C\hfill \\ CA\hfill \end{array}\right]=\left[\begin{array}{cc}0& 1\\ {\displaystyle \frac{1-d}{C_o}}& {\displaystyle \frac{-1}{R{C}_o}}\end{array}\right]\end{array}$$

(13)

If the matrix Q is full rank, the system is fully observable. A matrix by dimension of $2\times 2$ has full rank if its determinant is non zero. Thus,

$$\begin{array}{c}\hfill det\left(Q\right)=-{\displaystyle \frac{1-d}{C_o}}\end{array}$$

(14)

This value for $d\ne 1$ is always the opposite of zero. Given that $0<d<1$ (in the simulation and experimental tests in this paper, d is about 0.3), this assumption holds. Therefore, the system is completely observable. In the following, we will estimate the system states by using the proposed observer structure.

$$\begin{array}{c}S={\widehat{y}}_{ij}-y_{ij}\hfill \\ v=sgn\left(S\right)\hfill \\ G=\left[\begin{array}{c}\beta \hfill \\ \gamma \hfill \end{array}\right],\left\{\begin{array}{c}\beta \in {\mathbb{R}}^{\left(np\right)\times p}\hfill \\ \gamma \in {\mathbb{R}}^{p\times p}\hfill \end{array}\right.\hfill \\ {\dot{\widehat{x}}}_{ij}=A_{ij}{\widehat{x}}_{ij}+B_{ij}{u}_{ij}+Gv,\hfill \\ {\widehat{y}}_{ij}=C_{ij}{\widehat{x}}_{ij}\hfill \end{array}$$

(15)

where S is the sliding surface, ${\widehat{x}}_{ij}$ is an estimation for $x_{ij}$, $A_{ij},B_{ij},C_{ij}$ are the observer matrix, $u_{ij}$ is the input voltage for the boost converters ($V_{in}$). It describes the input voltage of the $ith$ converter, which is used in the observer of Agent i, where this observer is located in Agent j, and $Gv$ is a term for robustness. In this problem and for a new matrix definition, we have

$$\begin{array}{c}\hfill y=Cx,C=\left[01\right]\Rightarrow \left[\begin{array}{c}{x}_1\\ x_2\end{array}\right]=\left[\begin{array}{c}{x}_1\\ y\end{array}\right]\end{array}$$

(16)

and so

$$\begin{array}{c}\hfill {\dot{x}}_i=A_i{x}_i+B_i{u}_i\Rightarrow \left\{\begin{array}{c}{\dot{x}}_1=A_{11}{x}_1+A_{12}y+B_{1}u\hfill \\ \dot{y}=A_{21}{x}_1+A_{22}y+B_{2}u\hfill \end{array}\right.\end{array}$$

(17)

According to (15), for the observer, we have

$$\begin{array}{c}\hfill Observe{r}_{ij}:\left\{\begin{array}{c}{\dot{\widehat{x}}}_{1_{ij}}=A_{{11}_{ij}}{\widehat{x}}_1+A_{{12}_{ij}}{\widehat{y}}_{ij}+B_{1_{ij}}{u}_{ij}+\beta v\hfill \\ {\dot{\widehat{y}}}_{ij}=A_{{21}_{ij}}{\widehat{x}}_1+A_{{22}_{ij}}{\widehat{y}}_{ij}+B_{2_{ij}}{u}_{ij}+\gamma v\hfill \end{array}\right.\end{array}$$

(18)

By calculation of estimation error as follows, we have

$$\begin{array}{c}e\left(t\right)=\left[\begin{array}{c}{e}_1\left(t\right)\hfill \\ e_y\left(t\right)\hfill \end{array}\right]\hfill \\ \dot{e}=\left[\begin{array}{c}{\dot{e}}_1\hfill \\ {\dot{e}}_y\hfill \end{array}\right]=\left[\begin{array}{c}{\dot{\widehat{x}}}_{1_{ij}}-{\dot{x}}_1\hfill \\ {\dot{\widehat{y}}}_{ij}-{\dot{y}}_{ij}\hfill \end{array}\right],{\dot{y}}_{ij}={\dot{y}}_i+k_{at}{\dot{f}}_{ij}^{at}\hfill \\ =\left[\begin{array}{c}{A}_{{11}_{ij}}{\widehat{x}}_{1_{ij}}+A_{{12}_{ij}}{\widehat{y}}_{ij}+B_{1_{ij}}{u}_{ij}+\beta v\hfill \\ A_{{21}_{ij}}{\widehat{x}}_{1_{ij}}+A_{{22}_{ij}}{\widehat{y}}_{ij}+B_{2_{ij}}{u}_{ij}+\gamma v\hfill \end{array}\right]-\hfill \\ \left[\begin{array}{c}(A_{{11}_{ij}}{x}_1+A_{{12}_{ij}}{y}_{ij}+B_{1_{ij}}{u}_{ij})\hfill \\ (A_{{21}_{ij}}{x}_1+A_{{22}_{ij}}{y}_{ij}+B_{2_{ij}}{u}_{ij})-k_{at}{\dot{f}}_{ij}^{at}\hfill \end{array}\right]\hfill \end{array}$$

(19)

Thus, we have

$$\begin{array}{c}\hfill \begin{array}{c}{\dot{e}}_1=A_{{11}_{ij}}{e}_1+A_{{12}_{ij}}{e}_y+\beta v\hfill \\ {\dot{e}}_y=A_{{21}_{ij}}{e}_1+A_{{22}_{ij}}{e}_y+\gamma v+k_{at}{\dot{f}}_{ij}^{at}\hfill \end{array}\end{array}$$

(20)

There are two constraints for sliding mode control: first ${\dot{e}}_y=0$ to stabilize the error dynamic, and when we are on the sliding surface, $e_y=0$ must hold, so:

$$\begin{array}{c}\hfill \begin{array}{c}{\dot{e}}_y=A_{{21}_{ij}}{e}_1+A_{{22}_{ij}}{e}_y+\gamma v+k_{at}{\dot{f}}_{ij}^{at}=0\hfill \\ v={\displaystyle \frac{-1}{\gamma }}{A}_{{21}_{ij}}{e}_1-{\displaystyle \frac{k_{at}}{\gamma }}{\dot{f}}_{ij}^{at}\hfill \end{array}\end{array}$$

(21)

and

$$\begin{array}{c}\hfill \begin{array}{c}{\dot{e}}_1=A_{{11}_{ij}}{e}_1+{\displaystyle \frac{-\beta }{\gamma }}{A}_{{21}_{ij}}{e}_1-{\displaystyle \frac{\beta k_{at}}{\gamma }}{\dot{f}}_{ij}^{at}\hfill \\ {\dot{e}}_1=(A_{{11}_{ij}}-{\displaystyle \frac{\beta }{\gamma }}{A}_{{21}_{ij}})e_1-{\displaystyle \frac{\beta k_{at}}{\gamma }}{\dot{f}}_{ij}^{at}\hfill \\ {\dot{e}}_1=F_{ij}{e}_1+{\dot{F}}_{ij}^{at}\hfill \end{array}\end{array}$$

(22)

In order for $e_1$ to be stable, $F_{ij}=A_{{11}_{ij}}-{\displaystyle \frac{\beta }{\gamma }}{A}_{{21}_{ij}}={\displaystyle \frac{-r}{L}}-{\displaystyle \frac{\beta }{\gamma }}{\displaystyle \frac{(1-d_i)}{C_o}}$ must be stable, and then the error tends to zero. Therefore, by selection of $\beta$ and $\gamma$, the error dynamics will be stable. The effect of an attack is $F_{ij}^{at}=-{\displaystyle \frac{\beta k_{at}}{\gamma }}{f}_{ij}^{at}$, where the derivation of it appears in the derivation error of state estimation.

5. Resilience Consensus Law

In order to achieve consensus when the system is faced with cyber attacks, the consensus law must be revised. The consensus law that is proposed in Equation (3) will be changed to the following equation. The outcomes of the attack observers are now incorporated into the consensus law as a result of this modification. Therefore, the attacked channels will be removed from the consensus protocol.

$$\begin{array}{c}\hfill \begin{array}{c}{\tilde{a}}_{ij}=a_{ij}Tr\left(F_{ij}^{at}\right),Tr\left(x\right)=\left\{\begin{array}{c}0\left|x\right|>threshold\hfill \\ 1else\hfill \end{array}\right.\hfill \\ x_{2i}^d=u_i\left(t_i\right)=\sum _{v_j\in N_i}{\tilde{a}}_{ij}\left(t_i\right)[x_j(t_j-{\tau }_{ij}\left(t_i\right))-x_i\left(t_i\right)]\hfill \end{array}\end{array}$$

(23)

where $x_{2i}^d$ is the desired output voltage for Agent i and $Tr\left(x\right)$ is a threshold function.

6. Simulation and Results

In this section, the efficiency of the proposed method has been validated via Simulink real-time (SLRT) simulations. The case study is a network of eight DC-DC boost converters with the non-linear dynamics that are linked as shown in Figure 4A. In this simulation, an attempt is made to choose a graph that considers different modes of connection. In general, the consensus is achieved faster if there are few links between agents; however, it leads to lower reliability as well as more vulnerability to cyber attacks. The coordinating algorithm to achieve consensus becomes more complicated when a large number of communication links is devoted to the agreement process—that is, when the connectivity order of the graph is high, even though it results in greater reliability. Moreover, when the number of participating agents increases, a more complex coordinating algorithm is required. Different components, i.e., sensors and communication links, may be targeted by attackers. The speed of the attack propagation and the scale of the impact will differ; for example, aiming at agents with more connections will result in a faster and greater deviating effect on neighbors. To address this issue, in the proposed algorithm, the communication link that has been attacked is detected, and neglected from the agreement process. On the other hand, aiming at the input communication link of the agent with more neighbors has less effect on the overall graph since it has been removed from the agreement and there are still more inputs to achieve the goal. From a security viewpoint, a large number of connections is desirable because the attack impact is less and the attack is more likely detected. Therefore, for the proposed method, which is based on neglecting malicious input links, a large number of connections is more appropriate. To show the ability of the proposed method, a proper scenario is considered in which agents communicate with a maximum of four neighbor agents.

The goal of this paper is to achieve consensus in the output voltage of decentralized converters in the presence of FDIA. In the simulations, the parameters of converters are $E=200$ V, $r=1\Omega$, $C=2.2$ mF, $L=2.2$ mH, the load resistance $R=60\Omega$ and the voltage reference is $V_{ref}=315$ V. The parameters of the sliding mode controller are ${\lambda }_1=1$, ${\lambda }_2=2000$, ${\lambda }_3=0.5$ and the parameters of the observer are $\gamma =1$ and the error pole is $-600$. To draw a comparison between conventional controllers and the proposed algorithm, two simulation scenarios are performed as follows.

First scenario: All the agents and communication links are healthy. The communication links are with [1, 2, 3, 1, 1, 2, 1, 2] sample delay and they are synchronous. In the time stamp of $0.5$ s, an FDIA occurs over the communication link from Agent 2 to Agent 3. As shown in Figure 5, the output voltage of Agent 2 which is delivered to Agent 3 is different from the real output voltage of Agent 2 due to a cyber attack that injects a false datum into the communication link $L_{23}$. Thus, the observer which is located in Agent 3, and estimates the states of Agent 2, follows the attacked voltage, which is different from the real output voltage of Agent 2. Figure 5 is shown for a better understanding of what is happening. This figure explains the attack effect on the communication data, which shows that when the output voltage of Agent 2 is at the steady state (blue color), an attack occurs at 0.5 s and the reported voltage over the communication link deviates from the output voltage of Agent 2 (red color). Therefore, the observer of Agent 2 that is located in Agent 3 follows the attacked value.

As shown in Figure 6, by the conventional consensus control law, agreement deviates from the normal condition and the FDIA cyber attack is successful. According to this figure, the output voltages of all agents will deviate because all of them are connected to each other by the communication links. In this scenario, when Agent 3 receives the wrong data, the controller regulates its output voltage to a false value, and this false value is sent to the other agents over the communication links.

Second scenario: This scenario is the same as the first one, except that the consensus algorithm that is used to detect the attack is based on the developed algorithm in this paper. As shown in Figure 7, the voltages will reach consensus again immediately after the attack has occurred. Therefore, according to Figure 7, it is clear that the consensus will not deviate from FDIA cyber attacks and the consensus process will be performed properly in the presence of this type of attack. As shown in this figure, the attack at Agent 3 affects the other agents. The proposed algorithm detects the source of the attack using residuals from the observer banks, and removes the attacked communication links from the consensus process. Therefore, it is shown that the proposed algorithm has resiliency or attack-tolerant control abilities.

7. Experimental Results

In order to validate the results, an experimental prototype with three agents is prepared according to the graph shown in Figure 4B and the hardware shown in Figure 8. Due to limited laboratory equipment, the number of agents is reduced to three, and the main reason is that the control board does not support more than three channels. However, a different control board with more channels can be utilized for practical implementation. Moreover, due to the fact that the laboratory power supplies have limited output voltages which are less than 30 volts, the operating voltage is reduced. However, it is worth noting that the nature of the experimental test is not different from the simulations.

This test-bench consists of: a development computer for FPGA and Microblaze programming by Xilinx-ISE and Xilinx-SDK softwares with a JTAG Xilinx programmer; a host computer to generate MATLAB codes, boot the target computer over the network, set-up and logging data from the target computer; a target computer that is booted by the Simulink real-time kernel and runs the tolerant consensus algorithm in real-time and communicates (Ethernet-UDP) with FPGA; a Spartan 6-based FPGA control board that is a controller and logger for the boost converters in an independent and very fast structure; three boost converters that are placed at the graph nodes and supply the hmic loads; three boost power supplies to supply the converters; three ohmic loads for three agents; three transmission ohmic loads between the agents to simulate the transmission power losses and a 100 Mbps Ethernet switch for connection between agents, host computer, and the target computer. In general, this testbed consists of three boost converters that are tied in a physical ring-bus network and a communication network. In order to implement three independent control loops for three agents, an FPGA Spartan 6 based board is used. This processor is connected to the target computer via a LAN-UDP connection link. For ease of programming and debugging, some local control loops are implemented in the Microblaze Xilinx-SDK environment. Boost converters are a 150 watt commercial type with a maximum operating voltage of 36 volts. Each agent consists of an ohmic load of 23 $\Omega$, a boost converter with an efficiency of about $90\%$, a power supply with a voltage output about 17 volts, and 5 $\Omega$ transmission lines. The consensus control algorithm is implemented in the MATLAB software using Simulink real-time. Simulink and FPGA data are exchanging via the LAN connection link with 1 and 10 kHz times updates.

According to Figure 9, the false data injection attack is aimed at the communication link $L_{23}$ between $t=1$ and $t=2$ s. It is shown that for the conventional consensus algorithm, the output voltages of the converters deviate and consequently the consensus mechanism also is violated. Therefore, the conventional consensus algorithms are vulnerable in the presence of attacks. The attack occurs by injection of a fast ramp voltage from 24 to 28 volts into the $L_{23}$ communication channel. Due to the fact that the converters are connected to each other through the 5 $\Omega$ power transmission lines, in practical applications, and in this experimental test, the output voltage measurement for each agent is affected by the other agents, and the voltage distribution is not ideally distorted. According to this figure, the maximum deviation is related to Agent 3, which is directly attacked. It is observed that after the end of the attack time, the consensus returned to its normal behavior.

Figure 10 also shows that with the proposed algorithm, the effect of the attack is eliminated and the consensus for the graph will occur correctly. This figure shows that the proposed tolerant consensus is resilient in the presence of the FDI attacks. It is shown that using the proposed algorithm after the attack has occurred, the attack is successfully detected and isolated, and then the attacked channel is removed from the consensus process to achieve the agreement. This amount of deviation at the start of the attack is shown in Figure 10, which is actually due to the fact that the detection process and the control loops are running in parallel. The cost that this method imposes on the system is the requirement of a larger computational burden compared to the conventional method, and also this method needs to know the model of each agent. It is worth noting that these costs are not comparable with the damages that may result due to cyber attacks.

8. Conclusions

In this study, an observer-based resilient control method was proposed to reach the consensus in a DC microgrid. In this microgrid, each agent is a battery-based boost converter and, at an unknown time, a false data injection attack appears. In order to control the voltage for each agent, the sliding mode control method has been used. To estimate the states of the neighboring agents, a bank of sliding mode observers has been proposed, which is organized to detect the attacks. If the states of the observers are not compatible with the communication data, the adjacency matrix will be modified with the correction values applied by the observers. The efficiency of the proposed method has been investigated by using simulations and experimental results. As a suggestion and continuation of the work in this paper, it is recommended that this method be extended for resiliency against stealth attacks. According to the results, it has been shown that by using the proposed method, the DC microgrid network will be resilient against false data injection attacks and the consensus will not deviate.