Hybrid Control Strategy for DC Microgrid Against False Data Injection Attacks and Sensor Faults Based on Lagrange Extrapolation and Voltage Observer

Abstract

In this study, to enhance the system reliability under false data injection (FDI) attacks and DC-link voltage (DCLV) sensor failures, a hybrid control strategy for a DC microgrid (DCMG) based on the Lagrange extrapolation and voltage observer is proposed. Under normal conditions without FDI attacks or DCLV sensor failures, the DCMG system works in a distributed control scheme. To enhance the reliability of the system under the DCLV sensor failure or FDI attack, the DCMG system utilizes a hybrid control strategy that combines distributed control with decentralized control. The hybrid control strategy is achieved by the proposed detection algorithms for FDI attacks and DCLV sensor failures. The detection of FDI attacks is accomplished by comparing the predicted secondary controller output based on the Lagrange extrapolation with the actual one. When a power agent detects an FDI attack, its control mode is switched to decentralized control by using the proposed hybrid control strategy. The DCLV sensor failure detection algorithm to enhance system reliability against DCLV sensor failures is achieved by comparing the estimated DCLV with the measured one from the voltage observer. Upon detecting a DCLV sensor failure, the operation of the power agent is switched to the current control mode to sustain the system operation even under DCLV sensor failures. The proposed detection algorithms are simple, effective, and precise, operating without mutual interference that deteriorates the detection accuracy. Simulation and experiments are carried out under various uncertain test conditions to validate the reliability and effectiveness of the proposed control strategy.

1. Introduction

The increasing severity of environmental issues, such as global warming, air pollution, and resource depletion, has prompted an urgent need for reliable and efficient approaches to meet the increasing global energy demand [1]. Fossil fuels, which currently dominate global energy consumption, are not only finite resources but also significant contributors to greenhouse gas emissions [2]. To overcome these challenges, renewable energy sources (RESs) have become increasingly important. However, there exists the intermittent nature of RESs which poses substantial challenges such as reliability issues and difficulty in maintaining a stable energy supply. Due to this reason, microgrids that integrate RESs, energy storage systems (ESSs), utility grids, and local loads have gained lots of interest as a key solution to overcome such limitations and enhance reliability [3].

The substantial generation of DC power from RESs, including fuel cells, wind turbines, and photovoltaics (PV), along with the increasing demand for DC loads, has accelerated the rapid development of DCMGs [4]. In general, DCMGs can avoid the issues related to reactive power regulation and frequency synchronization. Therefore, designing control schemes for DCMGs faces fewer technical challenges as compared to doing so for AC microgrids (ACMGs) [5,6,7,8]. Nevertheless, there is still a need to achieve a power balance between the supply and demand in DCMG systems. Without proper control and power management, both renewable energy generation intermittency and load fluctuation may cause an instantaneous power imbalance, which in turn would deteriorate the DC-link voltage (DCLV) regulation performance and power quality [9].

Based on the structure of digital communication links (DCLs), various methods have been employed to achieve power management for DCMG systems, which are classified as centralized, decentralized, and distributed controls [10,11]. The centralized control method relies on a central controller that communicates with all power agents through DCLs to decide the power agent operations [12]. The centralized control scheme is effective and straightforward. However, it has limitations such as a significant communication burden, complex computations, and high system costs. In addition, the central controller not only has a high risk of a single point of failure, but also requires a modification of the control structure when a new energy source is added or the existing energy source is removed [13,14]. On the other hand, the decentralized control method determines its operation mode without using the central controller and DCLs. This method provides multiple benefits in terms of low system cost and high scalability. However, due to the absence of DCLs, there exists a system reliability issue under the agent power variation in the decentralized control method. To overcome this limitation, a distributed control method can be potentially considered as an alternative solution. In a distributed DCMG system, the power agents independently determine appropriate operation modes with a limited DCL structure without depending on a central controller [15,16,17].

Generally, a hierarchical control structure has been employed widely for power sharing as well as voltage regulation in a distributed DCMG system [18,19,20]. In the primary control, a droop control scheme is typically implemented to regulate the current of each distributed generation (DG) according to a predefined ratio. In the droop control scheme, high droop gain improves power sharing accuracy but leads to a large DCLV deviation [21,22,23]. In the secondary control layer, distributed secondary controllers are normally designed to eliminate DCLV errors [18]. In the study [20], an adaptive event-triggered control method is studied for hierarchical control to guarantee proportional load and voltage regulation even under various disturbances. Although this research effectively achieves both power balance and voltage regulation, it has not considered cyber attacks and sensor faults, which may critically affect the system’s stability and reliability.

Communication among power sources in a distributed DCMG system is quite vulnerable to cyber attacks. A false data injection (FDI) is known to be one of the most common cyber attacks. The main aim of FDI attacks is to illegally modify information such as the voltage and secondary output data during network communication [24]. To ensure the stability of a distributed DCMG system in the presence of cyber attacks, the research in [25] proposes an adaptive compensation term that effectively eliminates the FDI attack signal. An adaptive sliding mode control is also presented in [26] to enhance the resilience of DCMG systems against FDI attacks. This approach reduces the effect of FDI attacks through the design of a robust sliding surface in the secondary control layer. Although the above mentioned approaches have effectively addressed the vulnerability to cyber attacks, the issue of sensor faults in a DCMG system has not been considered.

Sensor faults are also a primary reason to reduce the reliability of a DCMG system. Due to the inherent characteristic of a distributed control scheme which heavily relies on the interactions with neighboring power agents, sensor faults negatively impact the system operation and cause a significant risk in DCMG systems [27]. To overcome the risk caused by the sensor faults, a dual-extended Kalman filter which estimates DCMG system states and faults simultaneously is proposed in [28]. Although this method effectively enhances fault tolerance for the DCMG system, the simultaneous operation of dual-extended Kalman filters increases the complexity and computational burden. The research in [29] presents sensor fault detection in a DCMG system based on an unknown input observer. Despite the effective detection of sensor faults, the unknown input observer is highly sensitive to noise and needs high computation. A hardware redundancy method by using additional sensors has been presented for a DCMG system in [27] to deal with sensor faults. Even though this approach improves the system reliability under sensor failures, the increase in the overall system cost is unavoidable.

Motivated by such concerns, this study proposes a hybrid control strategy for a DCMG to improve the system’s reliability under both FDI attacks and sensor faults. To guarantee both the voltage regulation and power balance under FDI attacks, an FDI detection algorithm is achieved by the Lagrange extrapolation scheme. To detect FDI attacks based on the third-order Lagrange extrapolation, power agents collect the previous outputs of the distributed secondary controller which are used to predict the next-step secondary control output. By comparing the predicted and actual secondary control outputs, FDI attacks can be detected in the proposed scheme. Once FDI attacks are clearly identified, the control modes of power agents are properly changed to continuously achieve power management. Furthermore, to improve the stability and reliability of a DCMG system under DCLV sensor failures, a DCLV sensor failure detection algorithm which is achieved by comparing estimated DCLV and measured one with the voltage observer is also proposed in this paper. FDI detection and DCLV sensor failure detection work independently and simultaneously without affecting the detection accuracy of each other.

To enhance the system’s reliability under both FDI attacks and DCLV sensor failures, this study employs a hybrid control strategy that combines distributed and decentralized control methods. In the absence of any cyber attacks and sensor faults, a distributed control strategy is utilized with a hierarchical structure consisting of primary and secondary control layers. The droop control is implemented for power sharing in the primary control layer and the distributed consensus algorithm is implemented for the DCLV regulation in the secondary control layer. As soon as an FDI attack happens in any power agent, the proposed hybrid control scheme adopts a decentralized control strategy to ensure continuous and stable power sharing by isolating the affected DCL. In this decentralized control strategy, a hierarchical control structure for DCLV regulation and power sharing is still maintained. On the other hand, when a power agent has a DCLV sensor failure, its operation is shifted to the current control mode because the power agent having DCLV sensor failures is unable to regulate the DCLV. By detecting the DCLV sensor failure and selecting proper control modes for the power agents, the proposed method can achieve a stable and reliable operation of the DCMG system under sensor fault conditions. The key contributions of this work are outlined as follows:

(i)

The proposed detection algorithm effectively identifies both sensor faults and FDI attacks independently and simultaneously without affecting the detection accuracy of each other. In the proposed scheme, third-order Lagrange extrapolation and voltage observer are utilized to monitor the abnormalities in the DCLV sensors and DCLs, respectively. The proposed approach is simple and precise without mutual interference which degrades the accuracy of other detection algorithms. As a result, the proposed identification algorithms play a critical role in enhancing a DCMG system’s reliability against potential system disruptions.

(ii)

To maintain the DCMG system stability even under FDI attacks and DCLV sensor failures, a hybrid control strategy is proposed by combining the decentralized and distributed control methods for achieving power management. Upon detecting the FDI attacks, the power agent operation is changed to the decentralized control mode to eliminate the negative impact of FDI attacks. On the other hand, when the voltage sensor fault occurs in a power agent, the corresponding power agent shifts the operation to the current control mode because the voltage control is not possible. This hybrid approach enables the DCMG system to operate continuously even under such emergency conditions by properly changing the operation modes of power agents.

(iii)

Finally, a series of simulations and experimental tests are conducted to demonstrate the feasibility of the proposed hybrid control strategy. In particular, to highlight the robustness and reliability of the proposed strategy, the proposed DCMG system has been evaluated under various conditions, including normal operation, FDI attacks in DCLs, and DCLV sensor failures. It is confirmed from these test results that the proposed scheme effectively maintains voltage regulation and power balance in the presence of FDI cyber attacks and sensor faults.

The structure of this paper is as follows: Section 2 outlines the system configuration of a DCMG system. Section 3 describes the proposed hybrid control strategy for power agents under FDI attacks and sensor faults in detail. Section 4 and Section 5 present the simulation and experimental test results under various conditions. Lastly, Section 6 gives the conclusion of this study.

2. Description of Distributed DCMG System

Figure 1 depicts the system configuration of a distributed DCMG, which includes four power agents: a battery agent, a grid agent, a wind turbine agent, and a load agent. The grid agent links the main grid to the DC-link via a bidirectional AC/DC converter. The wind turbine agent converts the mechanical energy from the wind turbine to electrical energy using a permanent magnet synchronous generator (PMSG) to interface with the DC-link via a unidirectional AC/DC converter. The battery agent is connected to the DC-link through a bidirectional DC/DC converter, enabling power exchange. The load agent comprises the DC loads that are connected to the DC-link directly.

In the DCMG, the grid and battery agents can transfer power bidirectionally, either supplying power to the DC-link or absorbing power from it. In contrast, the wind turbine agent operates with unidirectional power flow, delivering power exclusively to the DC-link. Similarly, the load agent draws power from the DC-link. In this study, positive power values indicate that a power agent draws power from the DC-link, while negative power values signify that a power agent delivers power to the DC-link. Figure 1 also shows the DCL structure among power agents to constitute the distributed control method. In this figure, the variable P denotes the power flow, u denotes the secondary control output, and the subscript ‘G’, ‘B’, ‘W’, and ‘L’ denote the grid, battery, wind turbine, and load agents. It is worth mentioning that contrary to the existing schemes, a unidirectional DCL structure is used in this study.

3. Proposed Hybrid Control Strategy Under FDI Attacks and Sensor Faults

3.1. Hybrid Control Scheme of Power Agents

Figure 2 shows the proposed hybrid control structure for agent i of the DCMG system in which i represents the power agent of the wind turbine, grid, and battery agent. In Figure 2, $u^i$ is the secondary control output of agent i, $u^j$ is secondary control output received by the DCL from adjacent agent j, and $w^i$ is the false data injected by the FDI attack. The FDI attack is a type of cyber attack in which false data $w^i$ are injected into DCLs between power agents. In particular, the attackers manipulate the secondary control output of agent j ($u^j$) when it is transmitted to the agent i. Therefore, power agent i receives an FDI attack signal $u_j^{FDI}$ from power agent j, which can lead to the instability of the entire DCMG system. The proposed control scheme combines distributed and decentralized controls to enhance the system’s reliability under FDI attacks and DCLV sensor failures. During normal operating conditions without FDI attacks or sensor faults, a distributed control strategy with primary and secondary controls is utilized. However, when the FDI attack condition occurs, the proposed hybrid control structure employs the decentralized control strategy to avoid data transfer through the DCL.

Both the distributed and decentralized control strategies use the primary and secondary controllers as in Figure 2. The primary controllers are exactly the same in the distributed and decentralized control methods. In both approaches, droop control is employed in primary controllers using the estimated DCLV to maintain power balance. In addition, the proposed primary controller adopts a voltage observer as the study [30] to detect the DCLV sensor failures. The estimated DCLV value ${\widehat{V}}_{DC,i}$ and the secondary control output $u^i$ of agent i are used to calculate $V_{DC,i}^{\ast }$. Then, the droop control generates the reference current $I_i^{ref}$ based on $V_{DC,i}^{\ast }$. The proportional–integral (PI) control is applied for the current control loop of agent i.

On the other hand, the secondary controller has a different structure depending on the control scheme. In the distributed control method, the secondary controller is obtained from the consensus algorithm. In Figure 2, the consensus error $e_i^u$ denotes the difference between secondary control output $u^i$ of agent i and the secondary control output $u^j$ of agent j which is received by the DCL. An FDI attack injects false data $w^i$ into $u^j$ when this signal is transmitted from agent j to agent i. In addition, the error $e_i^v$ represents the difference between the nominal DCLV $V_{DC}^{nom}$ and DCLV estimate value ${\widehat{V}}_{DC,i}$ obtained through the voltage observer. Two errors $e_i^u$ and $e_i^v$ are added to generate $e_i$ which is processed by the PI controller to generate the secondary controller output $u^i$. Unlike the distributed control approach, the decentralized control scheme uses only an integral control term to produce the secondary controller output $u^i$ without using the consensus algorithm.

Figure 2 also shows the third-order Lagrange extrapolation that utilizes the secondary controller output to detect FDI attacks in the distributed control scheme. The detection of FDI attacks based on the third-order Lagrange extrapolation will be presented in the next subsection in detail.

3.2. Detection of FDI Attacks Using Lagrange Extrapolation and Hybrid Control Method

Figure 3 shows the detection of an FDI attack using the Lagrange extrapolation to select control modes in the proposed hybrid control. In this figure, variables ${\widehat{u}}_{k+p}^i$, $u_{k+p}^i$, $u_{err}^i$, and $F_i^{FDI}$ denote the estimated secondary controller output of agent i by using the Lagrange extrapolation at the pth order, the real secondary controller output of agent i at the pth order, the sum of squared errors between $u_{k+p}^i$ and ${\widehat{u}}_{k+p}^i$ for the recent 10 samples, and flag bit to confirm the existence of an FDI attack, respectively. In the proposed FDI attack detection and control mode selection, $u_{err}^i$ is compared with the threshold. If $u_{err}^i$ exceeds the threshold value, an FDI attack is confirmed, and the flag bit $F_i^{FDI}$ is set to 1. Finally, the control mode of agent i is appropriately changed.

The Lagrange extrapolation is a polynomial-based technique used to estimate unknown values by fitting a curve through a set of known data points. This method is particularly useful for predicting future values in dynamic systems by utilizing the relationships of recent samples. The general formula for the Lagrange extrapolation is expressed as follows [31]:

$${\widehat{u}}_k^i=P\left(u_k^i\right)=\sum _{\alpha =0}^n{u}_{k+\alpha }^i·L_{\alpha }(u_k^i)$$

(1)

$$L_{\alpha }\left(u_k^i\right)=\prod _{\begin{array}{c}0\le \beta \le n\\ \beta \ne \alpha \end{array}}{\displaystyle \frac{k-(k+\beta )}{\left(k+\alpha \right)-(k+\beta )}}$$

(2)

where $P\left(x\right)$, n, and $L_{\alpha }\left(x\right)$ are the interpolation polynomial that passes through all the given points, the number of Lagrange extrapolation order, and the Lagrange basis polynomial for the ${\alpha }^{th}$ point, respectively.

To predict the secondary controller output ${\widehat{u}}_{k+1}^i$ of agent i, the third-order Lagrange extrapolation is employed in this paper. From (1) and (2), to predict the secondary control output estimate ${\widehat{u}}_{k+1}^i$ based on the third-order Lagrange extrapolation, the previous three sample data and current sample data for the secondary controller output are necessary as follows:

$${\widehat{u}}_{k+1}^i=-1·u_{k-3}^i+4·u_{k-2}^i-6·u_{k-1}^i+4·u_k^i$$

(3)

To detect an FDI attack in the proposed scheme, the sum of squared errors $u_{err}^i$ is calculated by using the predicted secondary controller output and actual secondary controller output for 10 samples as follows:

$$u_{err}^i=\sum _{p=1}^{10}{\left(u_{k+p}^i-{\widehat{u}}_{k+p}^i\right)}^2$$

(4)

This sum of squared error $u_{err}^i$ is used to detect FDI attacks by comparing it with the threshold value as depicted in Figure 4.

Figure 4 shows the detection algorithm of the FDI attack for the control mode selection of agent i. In this algorithm, the variables $C_i^{FDI}$, $C_{i,max}^{FDI}$, and $u_{i,FDI}^{TH}$ represent the counter value for the detection algorithm of an FDI attack, the maximum value of the counter, and the threshold value for the detection algorithm of an FDI attack, respectively. Also, the variable ${\delta }_i$ is used for the purpose of notifying the existence of an FDI attack in agent i to other power agents by DCL.

When an FDI attack occurs in the DCL, the flag bit $F_i^{FDI}$ is set to one in the proposed FDI attack detection algorithm. As soon as $F_i^{FDI}$ is equal to zero and $u^j$ is not equal to ${\delta }_i$, the detection algorithm compares $u_{err}^i$ with $u_{i,FDI}^{TH}$. If $u_{err}^i$ exceeds $u_{i,FDI}^{TH}$, the algorithm further compares $C_i^{FDI}$ with $C_{i,max}^{FDI}$ to detect the FDI attack. When $C_i^{FDI}$ is larger than $C_{i,max}^{FDI}$, the detection algorithm confirms the occurrence of an FDI attack in agent i. Once the FDI attack is detected, the agent i sets $F_i^{FDI}$ to one and $C_i^{FDI}$ to zero. Also, $u^i$ is assigned to the specific value ${\delta }_i$ to inform the other power agents that the agent i has an FDI attack. At the same time, the control mode of agent i is switched to the decentralized mode. If another power agent receives ${\delta }_i$ as the secondary controller output by DCL, this power agent recognizes the occurrence of an FDI attack in agent i. Then, this power agent changes its operation to the decentralized mode, while propagating the existence of the FDI attack in agent i, to other power agents by using the DCL configuration as shown in Figure 1. As a result, all the power agents within DCMG acknowledge the existence of an FDI attack in agent i by DCL, and change the operation to the decentralized mode in turn to eliminate the effect of the FDI attack.

When the counter value $C_i^{FDI}$ is smaller than $C_{i,max}^{FDI}$, the counter $C_i^{FDI}$ is increased by one to count this event ($u_{err}^i$ > $u_{i,FDI}^{TH}$) by maintaining the operation of agent i in the distributed control mode. If $u_{err}^i$ is smaller than $u_{i,FDI}^{TH}$, the detection algorithm recognizes that the FDI attack does not exist in DCL. Then, the DCMG system maintains the previous operation of distributed control by setting both $F_i^{FDI}$ and $C_i^{FDI}$ to zero. Consequently, by detecting the FDI attack accurately and changing the operation to the appropriate control mode under the FDI attack, the proposed hybrid control scheme achieves a power management scheme of the DCMG system stably and reliably. In addition, the proposed scheme can effectively regulate the DCLV even under FDI attacks.

It is worth mentioning that there exists a trade-off in selecting the detection threshold value between the detection sensitivity and detection accuracy of the FDI attack. With the threshold value selected too small, the proposed control scheme detects the FDI attack even if the FDI attack signal is small. However, in this case, the detection of an FDI attack is quite influenced by a DCMG operation mode change or some uncertainty. In extreme cases, even if there exists no cyber attack, the FDI attack may falsely be detected. Conversely, if the threshold is selected too large, the detection of an FDI attack is not influenced by a DCMG operation mode change or some uncertainty. However, actual small FDI attacks may be undetected or detected late. In this study, extensive simulations are conducted to optimize the threshold between reducing false detections and minimizing detection failures.

Without the proposed detection method, it can be seen that the DCMG system fails to maintain the power balance and cannot regulate the DCLV to the nominal value. This degradation is caused by the absence of the proposed hybrid control with the FDI attack detection method.

3.3. Detection of DCLV Sensor Failure and Hybrid Control Method

Figure 5 shows the detection algorithm of the DCLV sensor failure using the voltage observer to select the control modes of agent i in the proposed hybrid control. In Figure 5, the variables $F_i^{sen}$, $u_{i,sen}^{TH}$, $C_i^{sen}$, and $C_{i,max}^{sen}$ denote the flag bit to indicate the DCLV sensor failure, the threshold value for the DCLV sensor failure detection algorithm, the counter value for the detection algorithm of the DCLV sensor failure, and the maximum value of the counter, respectively. If the power agent i has a DCLV sensor failure, flag bit $F_i^{sen}$ is set to one.

The estimated DCLV ${\widehat{V}}_{DC,i}$ is obtained by the dynamic model of power agent as follows [30]:

$${\dot{\widehat{V}}}_{DC,i}={\displaystyle \frac{I_i^{out}}{C_i}}-{\displaystyle \frac{{\widehat{V}}_{DC,i}}{C_i{R}_{Li}}}+N_i\left(V_{DC,i}-{\widehat{V}}_{DC,i}\right)$$

(5)

where $I_i^{out}$, $C_i$, $R_{Li}$, and $N_i$ represent the converter output current of agent i, capacitance of agent i, virtual resistance of agent i, and observer gain, respectively. In order to improve the reliability of the system even in the presence of sensor faults, the DCLV sensor failure is identified by using estimated DCLV ${\widehat{V}}_{DC,i}$.

In the proposed DCLV sensor failure detection algorithm, when $F_i^{sen}$ is equal to zero, the detection algorithm compares the difference $\left|{\widehat{V}}_{DC,i}-V_{DC,i}\right|$ with $u_{i,sen}^{TH}$ to detect the abnormality of the DCLV sensor. When $\left|{\widehat{V}}_{DC,i}-V_{DC,i}\right|$ is smaller than $u_{i,sen}^{TH}$, the detection algorithm recognizes that the sensor fault does not occur. Then, agent i maintains the previous control mode, and sets both $F_i^{sen}$ and $C_i^{sen}$ to zero. As the difference $\left|{\widehat{V}}_{DC,i}-V_{DC,i}\right|$ becomes larger than $u_{i,sen}^{TH}$, the proposed DCLV sensor failure detection algorithm compares $C_i^{sen}$ with $C_{i,max}^{sen}$ to detect the DCLV sensor failure. When the counter value $C_i^{sen}$ is larger than $C_{i,max}^{sen}$, the detection algorithm confirms the occurrence of the DCLV sensor failure. Then, agent i changes control mode to the current control in which the current reference is set to that of the previous distributed control mode. In this case, the agent i sets $F_i^{sen}$ to one and $C_i^{sen}$ to zero. In addition, the secondary controller output in the power agent having the DCLV sensor failure, $u^i$, is set to $u^j$, which is received from the other power agent by the DCL. This is performed because the other power agents without the DCLV sensor failure should operate in distributed control even though the power agent i having the DCLV sensor failure operates in the current control mode. To achieve this, the power agent i having the DCLV sensor failure receives $u^j$ from the other power agent, and transmits this value to another power agent as shown in the DCL configuration of Figure 1.

When the counter value $C_i^{sen}$ is smaller than $C_{i,max}^{sen}$, counter $C_i^{sen}$ is increased to count this event ($\left|{\widehat{V}}_{DC,i}-V_{DC,i}\right|$ > $u_{i,sen}^{TH}$) by maintaining the operation mode of agent i in the distributed control mode. By detecting the DCLV sensor failure accurately and changing DCMG operation to the appropriate mode under this condition, the proposed hybrid control scheme ensures a robust operation of the DCMG system.

The proposed detection algorithms such as the FDI attack detection based on the Lagrange extrapolation and the DCLV sensor failure detection based on the voltage observer can operate independently and reliably. The accuracy of the detection algorithm does not affect that of the other algorithm.

Although the proposed hybrid control strategy has robustness against both FDI attacks and sensor faults, it is weak to detect stealthy FDI attacks or slowly varying malicious data injection.

4. Simulation Results

The reliability and usefulness of the proposed hybrid control based on the detection algorithm for the FDI attack and the DCLV sensor failure are validated through comprehensive simulations for the DCMG system by using the PSIM 9.1.1.4 version software. The simulations consider various uncertain operating conditions, including FDI attacks, DCLV sensor failures, grid faults, minimum or maximum state-of-charge (SOC) levels of battery, and agent power fluctuations. The DCMG system parameters are summarized in

Table 1. DCMG system parameters.

Power Agents	Parameters	Value
DC-link	Nominal DCLV	400 V
	Capacitance	4 mF
Grid agent	Transformer Y/Δ	380/220 V
	Grid voltage	220 V
	Grid frequency	60 Hz
	Maximum absorbing power	2000 W
	Maximum supporting power	−2000 W
Wind turbine agent	PMSG number of poles	6
	PMSG inertia	0.111 kgm2
	PMSG flux linkage	0.18 Wb
	Converter filter inductance	7 mH
	Maximum power	−1500 W
Battery agent	Minimum level of SOC	20%
	Maximum level of SOC	90%
	Maximum voltage	180 V
	Rated capacity	25 Ah
	Limitation level of charging power	540 W
	Limitation level of discharging power	−540 W
	Maximum input voltage	300 V
	Maximum input current	6 A
	Maximum input power	800 W
Load agent	Load 1	200 W
	Load 2	200 W
	Load 3	200 W

.

4.1. Power Variation in Wind Turbine Agent Under FDI Attack

Figure 6 depicts the simulation test results under the FDI attack in the DCL by which the wind turbine agent transmits the secondary controller output $u_W$ to the battery agent. In this simulation test, the wind power variation is also considered. In this figure, $P_i$, $V_{DC}$, ${\widehat{V}}_{DC,i}$, $u^i$, $F_i^{FDI}$, and $u_{err}^i$ denote the power of agent i, the actual value of DCLV, the estimated DCLV value of agent i, the secondary controller output of agent i, the flag bit of FDI attack in agent i, and the sum of squared errors between $u_{k+p}^i$ and ${\widehat{u}}_{k+p}^i$ for the recent 10 samples which are defined in Section 3.2, respectively. In the fourth plot, $u_W^{FDI}$ denotes the FDI attack in the DCL between the wind turbine and battery agents. In the beginning, the DCMG system operates in distributed control without an FDI attack or DCLV sensor fault. At t = 0.4 s, the FDI attack occurs in DCL between the wind turbine and battery agents. Due to the FDI attack, the value $u_{err}^B$ increases and exceeds the threshold value $u_{B,FDI}^{TH}$. Then, the battery agent detects the FDI attack and sets its flag bit to one by the proposed FDI attack detection algorithm.

Following the proposed hybrid control method, the battery agent replaces its secondary controller output with the specific value ${\delta }_i$ which is used to inform that the DCL between the wind turbine and battery agents is affected by the FDI attack. This specific value ${\delta }_i$ is propagated to the other power agents by the DCL structure as shown in Figure 1. According to the DCL structure, the value ${\delta }_i$ is first transmitted to the grid agent, and then, it is delivered to the wind turbine agent. This is clearly shown in the fourth plot of Figure 6 in which the secondary controller output values are changed to ${\delta }_i$ in sequence of $u^B,u^G$, and $u^W$. After the power agents transmit the specific value ${\delta }_i$ to adjacent agents, their operations are switched to the decentralized control mode to remove the influence of the FDI attack. The third plot of Figure 6 represents the DCLV regulation performance. By virtue of the proposed FDI attack detection and hybrid control scheme, the DCLV is stably restored to the nominal value even under an FDI attack.

At t = 0.7 s, a wind power variation occurs in the wind turbine agent. In this condition, the DCMG system still maintains voltage regulation and power balance with the decentralized control scheme. As a result, it can be validated through this simulation test that the proposed control can maintain DCLV regulation and power balance even under an FDI attack and wind power variation owing to an effective FDI attack detection based on the Lagrange extrapolation and the use of a hybrid control method.

It is worth mentioning that the proposed FDI attack detection algorithm has a similar structure to the study [32] which uses the third-order Lagrange extrapolation based on 10 samples of square error to detect the FDI of the DCMG system. However, the study [32] does not consider the FDI attack in the DCLs as in this study. In addition, the sensor failure which normally affects the detection algorithm accuracy is also not considered. The proposed FDI attack detection and the method in [32] exhibit equivalent performance in terms of accuracy and computational efficiency. Both approaches effectively detect the FDI attacks and achieve zero steady-state error. Additionally, since both methods utilize 10 samples for computation, the computational efficiency remains the same. However, in terms of real-time applicability, the proposed method has the advantage since it can achieve the mode transition within 1.1 ms, whereas the method in [32] takes 9–20 ms for mode transition as reported.

4.2. Case of Maximum Battery SOC Level Under DCLV Sensor Failure

Figure 7 shows the simulation results under a DCLV sensor failure in the wind turbine agent when the battery SOC level reaches the maximum value. In this figure, $V_{DC,i}^{sensor}$, $SO{C}_B$, and $F_i^{sen}$ denote the measured DCLV by the sensor in agent i, SOC level of the battery agent, and the flag bit to indicate the DCLV sensor failure, respectively. Initially, the DCMG system operates in distributed control without any FDI attack or sensor fault. It is also assumed that the wind turbine agent has a DCLV sensor failure at t = 0.4 s.

As soon as the DCLV sensor failure occurs, the wind turbine agent effectively detects DCLV sensor failure by the proposed sensor fault detection algorithm based on voltage observer and sets the flag bit $F_W^{sen}$ to one. Then, the wind turbine agent operation is shifted to the current control. At the same time, the secondary controller output of the wind turbine agent $u^W$ is replaced with that from the grid $u^G$, which is transmitted to the battery agent according to the DCL structure of Figure 1.

By using this scheme, even though the wind turbine agent operation is changed to the current control, the other power agents (the grid agent and battery agent) can still operate in distributed control without changing operation modes. In addition, the power of the wind turbine is maintained at the same level before the sensor fault instant. Moreover, the third plot of Figure 7 clearly shows that the DCLV regulation is achieved stably in the presence of the DCLV sensor failure.

As the battery SOC level reaches its maximum level at t = 0.7 s, the battery agent is not able to operate in distributed control. Even in this condition, the grid agent effectively adjusts the power by using the proposed hybrid control. This test obviously demonstrates that the DCMG system continuously regulates the DCLV and maintains the power balance even under the maximum battery SOC level and DCLV sensor failure in the wind turbine agent.

4.3. Case of DCLV Sensor Failure and FDI Attack

Figure 8 shows the simulation results under a DCLV sensor failure in the battery agent as well as an FDI attack in the DCL between the battery and grid agents. In the fourth plot, $u_B^{FDI}$ denotes the FDI attack in the DCL between the battery and grid agents. The DCMG initially starts in distributed control without an FDI attack or sensor fault. At t = 0.4 s, the battery agent has a DCLV sensor failure. Using the proposed sensor fault detection algorithm based on the voltage observer, the battery agent effectively identifies this fault. After that, the battery agent transits the operation to the current control. At the same time, the secondary controller output of the battery agent $u^B$ is replaced with $u^W$ which is received from the wind turbine agent. By using this scheme, the grid and wind turbine agents still work in distributed control without changing the operation modes, even though the battery agent operation changed to the current control mode. Also, it is shown in the third plot of Figure 8 that the DCLV measurement by a sensor in the battery agent, $V_{DC,B}^{sensor}$, has different and inaccurate values due to a sensor fault. However, in spite of this sensor fault, waveforms of the estimated and real DCLV values coincide well, which proves a reliable DCLV regulation performance of the proposed scheme.

At t = 0.7 s, the FDI attack occurs in the DCL between the battery and grid agents. Due to the FDI attack, the value $u_{err}^G$ increases and exceeds the threshold value $u_{G,FDI}^{TH}$. Then, the grid agent detects the FDI attack and sets its flag bit $F_G^{FDI}$ to one by the proposed detection algorithm of FDI attack. According to the proposed hybrid control method, the grid agent replaces its secondary controller output with the specific value ${\delta }_i$ which is used to inform that the DCL between the battery and grid agents is affected by the FDI attack. This value ${\delta }_i$ is propagated to the other power agents by the DCL structure as shown in Figure 1, in which ${\delta }_i$ is first transmitted to the wind turbine agent, and then, it is transmitted to the battery agent. The fourth plot of Figure 8 clearly shows that the secondary controller output values are changed to ${\delta }_i$ in sequence of $u^G,u^W$, and $u^B$.

Since the battery agent was already changed to the current control mode at t = 0.4 s due to the DCLV sensor failure, only the grid and wind turbine power agents are switched to the decentralized control mode to remove the influence of the FDI attack. The third plot of Figure 8 represents the DCLV regulation performance. Even under both the DCLV sensor failure and FDI attack, the proposed hybrid control scheme stably regulates the DCLV to the nominal value and achieves effective power management. This simulation highlights the robustness of the proposed control and demonstrates the ability to maintain the system’s reliability and stability.

4.4. Mode Transition Under FDI Attack

Figure 9 shows the test results for the transition from grid-connected mode to islanded mode under an FDI attack in the DCL between the grid and wind turbine agents. In the fourth plot, $u_G^{FDI}$ denotes the FDI attack in the DCL between the grid and wind turbine agents. Initially, the DCMG system works in distributed control without an FDI attack or sensor failure in DCLV. At t = 0.4 s, the DCMG system operating in distributed control is shifted from the grid-connected mode to islanded mode.

At t = 0.9 s, an FDI attack occurs in the DCL between the grid and wind turbine agents. The wind turbine agent detects the FDI attack and sets its flag bit $F_W^{FDI}$ to one with the proposed FDI attack detection algorithm. Following the proposed hybrid control method, the wind turbine agent replaces its secondary controller output $u^W$ to ${\delta }_i$ which informs the existence of the FDI attack in the DCL between the grid and wind turbine agents. The DCL first transmits ${\delta }_i$ to the battery agent, and then to the grid agent. This is clearly observed in the fourth plot of Figure 9 in which the secondary controller output values are changed to ${\delta }_i$ in sequence of $u^W,u^B$, and $u^G$. After all the power agents transmit ${\delta }_i$ to the adjacent agents, their operations are switched to the decentralized control mode to eliminate the negative influence caused by FDI attacks. The DCLV regulation performance in the third plot of Figure 9 clearly validates the usefulness of the FDI attack detection and hybrid control scheme.

4.5. Simultaneous FDI Attack and DCLV Sensor Fault

To prove that the FDI attack detection and the sensor fault detection algorithms operate independently in the proposed scheme even when they occur simultaneously, Figure 10 shows the simulation tests for simultaneous FDI attacks in the DCL between the grid and wind turbine agents, and DCLV sensor failure in the battery agent. In this test, the proposed detection algorithms can identify both the FDI attack and sensor fault even when they occur simultaneously at t = 0.4 s. Since the mode change due to the sensor fault has priority, the battery agent first switches to the current control mode due to the sensor failure. After that, the remaining power agents change the operation into the decentralized mode caused by the FDI attack. This simulation test clearly validates that the proposed FDI attack and sensor fault detection algorithms work properly even when both the FDI attack and sensor fault occur simultaneously.

4.6. Grid Reconnection Under DCLV Sensor Failure

Figure 11a shows the test results for grid reconnection under sensor failure in the DCLV of the wind turbine agent. The DCMG system operates in the islanded mode with distributed control at the start. At t = 0.5 s, a sensor failure of DCLV occurs in the wind turbine agent. The wind turbine agent effectively detects this fault by using the proposed detection scheme based on the voltage observer. Then, the wind turbine agent transits the operation to the current control. At the same time, the secondary controller output of the wind turbine agent $u^W$ is replaced with $u^G$ which is received from the grid agent. Even though the wind turbine agent operation is changed to the current control, the battery agent still operates in distributed control without changing the operation mode.

Because of the sensor failure in the DCLV of the wind turbine agent, the DCLV measurement by the sensor in the wind turbine agent $V_{DC,W}^{sensor}$ has incorrect value as is shown in the third plot of Figure 11. Nevertheless, the proposed hybrid control strategy regulates well the DCLV to the nominal value. As the grid is reconnected at t = 1.0 s, the DCMG system operation is shifted from islanded mode to grid-connected mode. Even after the grid reconnection, the proposed hybrid control ensures a good power balance and DCLV regulation.

Figure 11b shows the simulation results of the control scheme in [30] for the transition from the islanded mode to the grid-connected mode under the DCLV sensor failure of the wind turbine agent. The simulation scenario of this test is exactly the same as in Figure 11a. It can be seen that when the grid reconnection happens at t = 1.0 s under the DCLV sensor failure of the wind turbine agent, the DCLV deviation is quite increased as compared to the proposed control scheme. It is confirmed from this comparison that the proposed scheme shows a smooth transient behavior for the operation mode change even under DCLV sensor failure, which significantly improves the reliability of the DCMG system.

Table 2. Comparison between proposed schemes and conventional schemes.

	Distributed Control [26]	Distributed Control [27,28]	Decentralized Control [30]	Proposed Scheme
FDI attack	Considered	Not considered	Not considered	Considered
Sensor fault	Not considered	Considered	Considered	Considered

shows the comparison between the proposed scheme and conventional schemes. It can be seen from Table 2 that the proposed hybrid control scheme guarantees the stability of the DCMG system under both FDI attack and sensor fault while the previous control schemes in [26,27,28,30] only consider either an FDI attack or sensor fault.

5. Experimental Results

An experimental hardware setup, depicted in Figure 12, was utilized to evaluate the reliability and effectiveness of the proposed hybrid control. The hardware setup consisted of four power agents: wind turbine, battery, grid, and load agents with parameters given in Table 1. In all the power agents, a digital signal processor (DSP) TMS320F28335 was utilized to realize the proposed hybrid control scheme. The DSP TMS320F28335 performance parameters are shown in

Table 3. Performance parameters of DSM TMS320F28335.

Performance Parameter	Specification
Clock frequency	150 MHz
Cycle time	6.67 ns
Floating-point precision	IEEE 754 single precision
ADC resolution	12-bit
Conversion rate	80 ns

.

The experimental tests were performed by using the DSP-based hybrid control scheme and experimental hardware setup as shown in Figure 12 under various test conditions such as an FDI attack, a transition to islanded mode, and a DCLV sensor failure. The experiments were conducted in a controlled laboratory environment with a temperature maintained at approximately 20 °C. The relative humidity was kept at an appropriate level for standard laboratory conditions. The experimental equipment was operated under a stable power supply of 220 V, 60 Hz, ensuring a consistent performance without voltage fluctuations. Additionally, the laboratory environment was free from significant electromagnetic interference (EMI).

5.1. Islanded Mode Under FDI Attack

Figure 13 shows the experimental tests for the islanded mode under an FDI attack in the DCL between the wind turbine and battery agents. Figure 13a represents the experimental result without employing the proposed hybrid control. Initially, the DCMG operates in the islanded mode with distributed control. In this test, only the proposed FDI attack detection algorithm is used without the proposed hybrid control. When an FDI attack occurs in the DCL between the wind turbine and battery agents, the proposed algorithm effectively detects the FDI attack and sets the flag bit of the battery agent $F_B^{FDI}$ to one. However, without using the proposed hybrid control, the DCMG system fails to maintain power balance and cannot regulate DCLV as clearly shown in DCLV oscillations and deviation in Figure 13a.

Figure 13b shows the experimental result for the islanded mode under the same FDI attack when the proposed FDI attack detection algorithm and hybrid scheme are employed at the same time. The DCMG system also operates initially in the islanded mode with distributed control. When an FDI attack occurs in the DCL between the wind turbine and battery agents, the battery agent effectively detects it by using the proposed FDI attack detection algorithm. Furthermore, due to the proposed hybrid scheme, the operation of the battery and wind turbine agents can be changed to the decentralized control mode, which successfully eliminates the negative effect of FDI attacks in the DCMG system. Consequently, the power balance and DCLV regulation can be achieved by the proposed strategy even under FDI attacks.

This experimental test highlights the effectiveness of both the proposed FDI attack detection and hybrid control schemes in ensuring the system stability and reliability under FDI attacks in the islanded mode.

5.2. Transition from Grid-Connected Mode to Islanded Mode

Figure 14 shows the experimental result for the transition from the grid-connected mode to the islanded mode. In this test, the DCMG initially operates in the grid-connected mode with distributed control. When a grid fault occurs, the DCMG operation is changed to the islanded mode. Despite the grid disconnection and operation shift, the DCMG system stably maintains the distributed control by regulating the DCLV and ensuring the power balance during mode transition.

5.3. Grid-Connected Mode Under DCLV Sensor Failure

Figure 15 shows the experimental test of the proposed hybrid control for the grid-connected mode under a sensor failure in the DCLV of the wind turbine agent. Initially, the DCMG operates in the grid-connected mode with distributed control. When a DCLV sensor failure occurs in the wind turbine agent, it can be correctly detected by the proposed DCLV sensor failure detection algorithm based on the voltage observer. Then, the flag bit $F_W^{sen}$ is set to one. According to the proposed hybrid control strategy, the wind turbine agent shifts the operation to the current control. At the same time, the secondary controller output $u^W$ is set to $u^G$ to continuously maintain the operation of the other power agents even in this condition, which is also demonstrated in the simulation result in Figure 7. As a result, even though the DCLV measured by the sensor in the wind turbine agent $V_{DC,W}^{sensor}$ is not correct, the DCLV measured in the grid agent $V_{DC,G}^{sensor}$ coincides well with the estimated DCLV value ${\widehat{V}}_{DC,G}$ and is effectively regulated to the nominal value. This experimental result also proves the effectiveness of the proposed hybrid control in sustaining the overall system operation.

5.4. Islanded Mode Under DCLV Sensor Failure

Figure 16 shows the experimental test of the proposed hybrid control for the islanded mode under a sensor failure in the DCLV of the wind turbine agent. The DCMG starts in islanded mode with distributed control. When a DCLV sensor failure occurs in the wind turbine agent, the wind turbine agent detects it and sets $F_W^{sen}$ to one by using the proposed DCLV sensor failure detection algorithm. Then, the wind turbine agent operation is shifted to the current control, and the secondary controller output $u^W$ is set to $u^G$. Even though the DCLV measured by the sensor in wind turbine agent $V_{DC,W}^{sensor}$ is not correct, the DCLV measured in the battery agent $V_{DC,B}^{sensor}$ is effectively regulated to the nominal value. This experimental test also demonstrates the usefulness of the proposed control under DCLV sensor failure in the islanded mode.

5.5. Gird-Connected Mode Under FDI Attack

Figure 17 shows the comparative experimental tests for the grid-connected mode under an FDI attack in the DCL between the grid and wind turbine agents. In Figure 17a, the proposed FDI attack detection algorithm is used without the proposed hybrid control scheme. The DCMG starts in the grid-connected mode with distributed control. When an FDI attack occurs in the DCL between the grid and wind turbine agents, the flag bit of the wind turbine agent $F_W^{FDI}$ is set to one based on the proposed detection algorithm of FDI attack. However, without using the proposed hybrid control, the DCMG system fails to maintain power balance and cannot regulate DCLV as is observed in DCLV oscillations and deviation in Figure 17a. This degradation is caused by the absence of the proposed hybrid control.

Figure 17b shows the experimental result for the grid-connected mode under the same FDI attack when the proposed FDI attack detection algorithm and hybrid scheme are employed at the same time. In this figure, $u_G^{FDI}$ denotes the secondary controller output of the grid agent affected by the FDI attack. The DCMG system also operates initially in the grid-connected mode with distributed control. When an FDI attack occurs in the DCL between the grid and wind turbine agents, the wind turbine agent detects it by using the proposed FDI attack detection algorithm and sets $F_W^{FDI}$ to one. According to the proposed hybrid control, the wind turbine agent replaces its secondary controller output to the specific value ${\delta }_i$ which is used to inform that the DCL between the grid and wind turbine agents is affected by the FDI attack. This value ${\delta }_i$ is transmitted to the other power agents by the DCL structure as shown in Figure 1. According to the DCL structure, the value ${\delta }_i$ is first transmitted to the battery agent and subsequently to the grid agent. This process is clearly shown in the bottom of Figure 17b in which the secondary controller output values are changed to ${\delta }_i$ in sequence of $u^W,u^B$, and $u^G$. After the power agents transmit the value ${\delta }_i$ to adjacent agents, their operations are shifted to the decentralized control mode to remove the influence of the FDI attack. Due to the proposed FDI attack detection algorithm and hybrid control, the DCLV can be stably controlled to the nominal value even under FDI attacks.

These comparative experimental results highlight the effectiveness of the proposed hybrid control in ensuring system stability and reliability under FDI attacks in the grid-connected mode.

6. Conclusions

This study has proposed a hybrid control strategy for a DCMG based on the Lagrange extrapolation and voltage observer to enhance the system reliability under both FDI attacks and DCLV sensor failures. The key innovations and contributions of this study are summarized as follows:

Firstly, the proposed detection algorithm effectively identifies both sensor faults and FDI attacks independently and simultaneously without affecting the detection accuracy of each other. While third-order Lagrange extrapolation is utilized to identify FDI attacks in DCLs, a voltage observer is employed to monitor the abnormalities in the DCLV sensors. The proposed approach is simple and precise without mutual interference which degrades the accuracy of other detection algorithms. As a result, the DCMG system reliability is significantly improved under potential system disruptions.

Secondly, a hybrid control strategy that integrates the decentralized and distributed control methods has been proposed to achieve both power management and voltage stabilization for the DCMG system under abnormalities. In particular, as soon as FDI attacks are detected, the power agent operation is changed to the decentralized control mode to eliminate the false data by the attackers through DCLs. On the other hand, when the voltage sensor fault occurs in a power agent, the corresponding power agent shifts the operation to the current control mode to prevent DCMG system disruptions. This hybrid approach enables the DCMG system to operate continuously even under such emergency conditions by properly changing the operation modes of the power agents.

Finally, the feasibility and reliability of the proposed hybrid control strategy are demonstrated by various simulations and experimental tests under both FDI attacks in DCLs and DCLV sensor failures. These test results clearly confirm that the proposed scheme effectively maintains the voltage regulation and power balance in the presence of FDI cyber attacks and sensor faults.

Although the proposed hybrid control strategy has demonstrated robustness against both FDI attacks and sensor faults, there still exist several promising future studies. One of the promising studies is the enhancement of the detection algorithms to handle more complex attack scenarios, such as various coordinated cyber attacks targeting multiple nodes in the DCMG system, stealthy FDI attacks, or slowly varying malicious data injections. Additionally, integrating machine learning to detect complex attacks could further improve the adaptability and accuracy of fault identification. Moreover, the experimental validation in larger-scale DC microgrid systems with diverse renewable energy sources would provide deeper insights into the real-world applicability of the proposed approach.