⚡ electrical engineering

Resilient Frequency Control of Low-Inertia Smart Islanded Microgrids Under FDI Attack Using Kalman Filter Observer

This paper proposes a resilient frequency control strategy for low-inertia islanded microgrids under false data injection attacks by employing an augmented-state Kalman filter observer to simultaneously estimate system states, load disturbances, and attack signals, thereby significantly reducing frequency deviations and estimation errors across various inertia levels.

Original authors: Mahmoud Mollayousefi Zadeh, Mohammadreza Toulabi, Gholamreza Farahani, Turaj Amraee

Published 2026-09-09

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Mahmoud Mollayousefi Zadeh, Mohammadreza Toulabi, Gholamreza Farahani, Turaj Amraee

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The modern electric grid is undergoing a quiet transformation. For decades, the stability of the power system relied on massive, spinning turbines in traditional power plants. These heavy machines acted as a natural buffer, a physical inertia that kept the electricity flowing smoothly even when demand suddenly changed. Today, however, the grid is increasingly powered by renewable sources like solar panels and wind turbines. These clean energy sources are excellent, but they connect to the grid through electronic switches rather than spinning metal. This means they do not provide that same heavy, stabilizing weight. When a local power network, known as a microgrid, disconnects from the main grid to operate on its own, the loss of this physical inertia makes the system incredibly fragile. A small shift in power demand can cause the frequency of the electricity to swing wildly, potentially causing a blackout.

Compounding this physical fragility is a digital vulnerability. To manage these complex, decentralized networks, engineers rely on smart sensors and communication links to coordinate power generation. This digital layer, while efficient, opens the door to cyber threats. One particularly dangerous type of attack involves an intruder secretly feeding false data into the control system. Imagine a hacker telling the system that the frequency is fine when it is actually crashing, or vice versa. The system, believing the lies, might make the wrong adjustments, accelerating the instability rather than fixing it. For a low-inertia microgrid, which already struggles to stay steady, such a deception could be catastrophic. The challenge for researchers is to create a system that can see through these lies in real-time, distinguishing between a genuine problem and a digital trick, and correcting the course before the lights go out.

In a recent study, a team of engineers from Iran tackled this dual challenge of physical fragility and digital deception. They focused on "islanded" microgrids—small, self-contained power networks that operate independently from the main grid. Their goal was to design a digital observer, a kind of smart watchdog, capable of detecting and neutralizing false data injection attacks while the system was running. The researchers built a mathematical model of a smart microgrid that included a mix of renewable energy sources, battery storage, and a few traditional generators. They then simulated a scenario where the system was under attack. The intruder in their simulation did not try to shut down the communication lines; instead, they carefully injected false numbers into the control signals, trying to trick the system into making dangerous errors without raising any alarms.

The solution the team developed relies on a sophisticated estimation tool known as a Kalman filter. Think of this filter as a highly experienced navigator who knows the rules of the road better than anyone else. In this case, the navigator knows exactly how the power system should behave under normal conditions. The filter constantly watches two key pieces of information: the actual frequency of the electricity and the power output of the generators. By comparing what it sees against what it expects to see, the filter can spot inconsistencies. If the numbers don't add up, the filter assumes something is wrong. The innovation in this work was to expand the filter's job description. Instead of just tracking the system's state, the researchers taught the filter to also track the invisible hand of the attacker. It treats the false data as a hidden variable, trying to estimate its size and shape in real-time.

The researchers tested this approach in a series of rigorous simulations, creating six different scenarios to see how the system would hold up. They introduced various types of attacks, including slow, creeping changes that were hard to spot, sudden spikes in false data, and complex, wavy patterns designed to confuse the system. They also varied the physical conditions, testing the system when it had a good amount of inertia and when it had very little, simulating a grid that was almost entirely powered by solar and wind. In every case, the filter was able to distinguish between genuine disturbances, like a sudden change in cloud cover affecting solar power, and the malicious false data injected by the attacker. It successfully estimated the size of the attack with high precision, reducing the error to a tiny fraction of a unit.

Once the filter identified the false data, the system used that information to cancel it out. It subtracted the estimated lie from the control signal, effectively neutralizing the attacker's influence before it could cause harm. The results were striking. In scenarios where the system was left unprotected, the frequency deviations were severe, often swinging by nearly two hertz, a level of instability that could trigger safety shutdowns and lead to a total blackout. With the new filter in place, those swings were dramatically reduced. In the most challenging tests, involving ultra-low inertia systems that were barely holding together, the filter reduced the frequency deviation by nearly 49 percent. It kept the system stable even when the physical inertia was at its lowest, a condition where traditional defenses would likely fail.

The study also explored how the system behaved when the physical inertia of the grid was changed. The researchers found that the filter worked well across the board, but it was most effective when the system was most vulnerable. When the grid had very little physical inertia, the filter's ability to detect and correct the attack made the difference between a stable grid and a collapsing one. The research suggests that while adding virtual inertia through software can help, it is not enough on its own to stop a determined cyber attacker. The digital defense provided by the filter is essential to complement the physical support. The team concluded that this method offers a robust way to secure the future of smart, renewable-powered microgrids, ensuring they can operate safely even when the physical world is light and the digital world is hostile. The work demonstrates that with the right mathematical tools, it is possible to build a power system that is not only smart but also resilient against the unseen threats of the modern age.

Technical Summary: Resilient Frequency Control of Low-Inertia Smart Islanded Microgrids Under FDI Attack Using Kalman Filter Observer

Problem Statement
The increasing penetration of inverter-based renewable energy resources in microgrids (MGs) has led to a significant reduction in system effective inertia. While islanded MGs rely on internal means for frequency stability, low inertia makes them highly susceptible to disturbances, characterized by high rates of change of frequency (RoCoF) and deep frequency nadirs. Concurrently, the digitization of MGs introduces cyber vulnerabilities, particularly in the secondary frequency control loop, which depends on communication networks. False Data Injection (FDI) attacks pose a critical threat in this context; unlike Denial-of-Service (DoS) attacks, FDI attacks covertly manipulate control setpoints and measurements without disrupting communication, potentially driving the system toward instability. The challenge is compounded by the fact that low-inertia systems offer minimal time for detection and defense, and measurement data in MGs is often limited (typically frequency and power), making it difficult to distinguish between legitimate load disturbances, system dynamics, and malicious FDI signals.

Methodology
The paper proposes a resilient frequency control strategy utilizing an Augmented-State Kalman Filter (KF) observer. The methodology involves the following key components:

System Modeling: The MG frequency dynamics are modeled as a linear time-invariant state-space system. The state vector includes frequency deviation ( $\Delta\omega$ ), governor output power ( $\Delta P_m$ ), and the integral state of the secondary controller ( $\Delta P_c$ ). The model incorporates virtual inertia emulation at the primary control level and accounts for load disturbances and FDI attacks as exogenous inputs.
Augmented State Formulation: To estimate the FDI attack and load disturbances simultaneously with system states, the state vector is augmented. The attack signal ( $FDI$ ) and load disturbance ( $\Delta P_L$ ) are treated as additional states with slow-varying dynamics modeled by first-order processes driven by white noise.
Observer Design: A discrete-time KF is designed using the augmented state-space model. The observer utilizes only two measurable outputs: frequency deviation and governor power output. The KF operates via standard prediction-correction recursions to estimate the augmented state vector.
Mitigation Strategy: The estimated FDI signal is extracted from the augmented state and subtracted from the secondary control input. This compensation effectively neutralizes the attack's impact on the governor dynamics, allowing the controller to respond only to legitimate system disturbances.
Observability Analysis: The paper conducts a rigorous observability analysis of the augmented system. It reveals that with only two measurements, the system is partially observable. Specifically, the integral state of the secondary controller and the FDI attack signal are coupled in the unobservable subspace. The KF relies on the known dynamics of the attack signal (modeled by the parameter $\alpha_{fdi}$ ) and process noise covariance to discriminate between slow changes in the integral control output and slow changes in the attack signal.

Key Contributions

Focus on Low-Inertia Islanded Operation: The study specifically addresses the critical scenario of islanded MGs with low inertia and no grid support, where frequency stability margins are minimal.
Augmented-State KF for Simultaneous Estimation: The paper develops a fully fledged augmented state-space approach capable of jointly estimating system states, load disturbances, and FDI attack signals using limited measurements (frequency and power).
Integration of Virtual Inertia: The observer design explicitly accounts for the effects of virtual inertia emulation at the primary control level, ensuring accurate state estimation under low-inertia conditions.
Comprehensive Evaluation: The proposed method is validated across six distinct scenarios, including various attack patterns (step, ramp, sinusoidal, and multi-component), renewable fluctuations, and a spectrum of inertia conditions ranging from high to ultra-low.

Results
Simulation results using MATLAB/Simulink demonstrate the efficacy of the proposed KF observer:

FDI Estimation Accuracy: The KF successfully estimates FDI signals with a Mean Squared Error (MSE) on the order of $10^{-3}$ to $10^{-2}$ , even in the presence of renewable fluctuations and complex, multi-component attacks.
Frequency Deviation Reduction: The compensation strategy significantly reduces frequency deviations. Across the tested scenarios, frequency deviation reductions ranged from 33.3% to 48.9%.
- In a stealthy ramp attack scenario, deviation was reduced by 47.5%.
- In a step attack with simultaneous disturbances, deviation was reduced by 45.5%.
- In a sinusoidal attack scenario, deviation was reduced by 50.0%.
Inertia Sensitivity: The performance improvement is inversely proportional to the system inertia. The KF provides the greatest benefit in ultra-low inertia scenarios ( $H_{eff} = 1$ s), where it reduced the frequency nadir from 3.5 Hz to 1.6 Hz (a 54.3% improvement) and the RoCoF from 4.5 Hz/s to 2.3 Hz/s (a 48.9% improvement). This shift prevents the system from entering an unstable regime that would otherwise trigger load shedding or blackouts.
Robustness: The observer effectively decouples load disturbances from FDI attacks, maintaining estimation accuracy even when load steps and renewable fluctuations occur simultaneously with attacks.

Significance and Claims
The paper claims that the proposed KF-based observer offers a robust solution for maintaining frequency stability in low-inertia smart islanded microgrids under FDI attacks. The significance of the work lies in its ability to operate with limited measurement data while simultaneously estimating system states and malicious signals. The authors highlight that the method is particularly effective when the system is most vulnerable (i.e., under ultra-low inertia conditions), where traditional detection methods might fail due to the speed of frequency dynamics. By compensating for FDI attacks in real-time, the approach prevents the artificial destabilization of the microgrid, ensuring that the system remains within safe operating limits even when the secondary control loop is compromised. The study concludes that while virtual inertia provides necessary initial support, the KF observer is essential for neutralizing the specific threat of FDI attacks that exploit the communication-dependent secondary control layer.

Technical Summary: Resilient Frequency Control of Low-Inertia Smart Islanded Microgrids Under FDI Attack Using Kalman Filter Observer

More like this