Risk Adverse Virtual Power Plant Control in Unsecure Power Systems

This paper presents a control strategy for enabling a large scale Virtual Power Plant (VPP) constituted by a traditional power plant, distributed Energy Storage Systems (ESSs) and wind turbine driven Doubly Fed Induction Generators (DFIGs) to virtual slack bus functions in electricity transmission networks. The VPP in question is in charge of covering the network losses and a portion of the day ahead generation schedule of unsecured power plants, in presence of short term notifications about possible malicious/natural adverse events affecting them. The objective is pursued by integrating a dynamic optimal power flow problem in a realtime Model Predictive Control framework, and applying a second level of control aimed at keeping the dynamics of the real nonlinear plant subject to wind turbulence in line with the dynamics of the MPC model. Simulation results provide a proof of the proposed concept, showing as the joint coordination of storage devices and wind turbines can be part of the task of providing support actions to the network traditionally delivered by expensive and pollutant legacy power plants.

Abstract-This paper presents a control strategy for enabling a large scale Virtual Power Plant (VPP) constituted by a traditional power plant, distributed Energy Storage Systems (ESSs) and wind turbine driven Doubly Fed Induction Generators (DFIGs) to virtual slack bus functions in electricity transmission networks. The VPP in question is in charge of covering the network losses and a portion of the day ahead generation schedule of unsecured power plants, in presence of short term notifications about possible malicious/natural adverse events affecting them. The objective is pursued by integrating a dynamic optimal power flow problem in a realtime Model Predictive Control framework, and applying a second level of control aimed at keeping the dynamics of the real nonlinear plant subject to wind turbulence in line with the dynamics of the MPC model. Simulation results provide a proof of the proposed concept, showing as the joint coordination of storage devices and wind turbines can be part of the task of providing support actions to the network traditionally delivered by expensive and pollutant legacy power plants. Power systems are a typical example of cyber-physical systems in which the correct provisioning of the service results from the interplay of interacting physical systems, characterized by their own constraints and dynamics, and local/global ICT systems (tipically supervisory, control and data acquisition (SCADA) systems and market plarforms) [1]. In this context, two ongoing trends motivates a gradual shift in paradigm in the operations. While, on the one hand, the widespread of distributed generation and storage technologies is increasingly challenging the operations of the physical part of the system and posing new opportunities [2], on the other hand, the increased modernization of the SCADA systems and adoption of new ICT technologies is introducing new interconnections, entry points, and vulnerabilities in previously mostly closed systems, posing new challenges to protection against cyber attacks.
In this regard the European Union H2020 ATENA Project [3] is proposing new procedures for detection, risk prediction, preventive actions and mitigation strategies against cyber attacks launched against Critical Infrastructures (CIs), previous related work can be found, for instance, in [4]- [6]; in particular in the context of the power industry, the aim is to improve the security at different levels, including generation, transmission, distribution and consumption of electricity.
This paper focuses on the secure operation of generation and transmission, and proposes a control approach for enabling a VPP constituted by a traditional generator, distributed ESSs and wind turbine driven DFIGs to virtual slack bus functions, including interventions for covering missing power generation from unsecure power plants. Such an objective is pursued by integrating a dynamic optimal power flow problem in a real-time Model Predictive Control framework.
The topic of power flow analysis was originally introduced in the context of the day-ahead scheduling of power generation, the planning of infrastructure expansion and the assessment of its pre-disturbance state for stability studies [7]. During the last decade, the problem has started to be investigated in a dynamic sense, meaning that the power flow equations related to different time periods are coupled through the dynamics of new network components and evaluated in real-time to cope with the variability of the boundary conditions. Applications of this concept can be found in the context of bulk power systema [8]- [11], distribution netwoks [12]- [15] and microgrids [16], [17].
The control strategy proposed in this work is based on the previous work [11], in which a preliminary control framework was proposed with the aim of enabling the VPP to the coverage of network losses. The present work provides an extension in several directions: • The operation of the VPP is aimed also at preventively covering a portion of the power generation schedule of unsecure power plants, with a depth of intervention which depends on the operative risk level predicted on a short term basis for those machines. • The controller embeds a control model of wind turbines which takes into account the nonlinear dependence of the mechanical power extracted from wind on the -a priori unknown -predicted evolution of rotor angular speed along the control horizon. • The controller takes the feedback from a simulation model of the wind turbines which is driven by realistic wind profiles incorporating the turbulence [18] [19]. • A second level of control acting on the ESSs and DFIGs is introduced in order guarantee stability of VPP operation while keeping the overall VPP production in line with the MPC schedule. The remainder of the paper is organized as follows. Section II discusses the reference scenario and present the problem under investigation. Section III details the mathematical formulation of the proposed approach for the VPP control. Section IV shows the second level of control, the motivations and the structure. Section V discusses the results of the work. Finally the conclusions are drawn in Section VI.

II. REFERENCE SCENARIO AND PROBLEM DESCRIPTION
The reference scenario is the one addressed by the ATENA project and is described in the following, in a simplified version tailored for the needs of this paper. The controlled plant is a cyber-physical system in which the physical part of the process is given by the bulk power system, namely the plant constituted by the generators and the transmission network; the cyber part is given by a control system which ensures remote monitoring and control from a regional control center, operated by the transmission system operator (TSO), and the local SCADA systems of generators. The control center in question has the goal of assuring stable network operation in terms of balancing between demand and supply, with particular attention to the service resiliency and the economic performances of the power transmission process.
It is assumed that the generators active in the electricity market have their own day-ahead power schedules, whose actuation is potentially at risk due to the vulnerability of the local SCADA systems. In the ATENA project a tool for short term risk prediction in Critical Infrastructures is being developed, modeling risk propagation caused by detected cyber-physical attacks in interdependent systems. This paper proposes to take advantage of those risk predictions to let a VPP constituted by a traditional synchronous machine, ESSs and wind turbines to work as a virtual slack that, beyond covering the network losses, cooperates with a federation of market generators to actuate modified real-time schedules which minimize the overall network operational risk.
In the light of above, it is worth stressing that a fundamental aspect of the work is considering the joint coordination of storage devices and wind turbines as part of the provisioning of support actions to the network, for which the TSO traditionally purely relies on expensive legacy power plants.

A. The open loop optimal control problem
The optimization problem at the basis of the MPC scheme is formalized as follows. The objective of the VPP control is to provide a support of generation at minimum cost, while guaranteeing stability of operation during normal conditions, and to provide actions aimed at mitigating the effect of possible cyber-physical attacks. To achieve these results the cost function is split into two parts: • Normal conditions: • Cyber-physical attack detected: In normal condition the objective is to minimize the power produced by the slack generator; then, according to the literature [20], [21] a quadratic cost δ(t)P slack (t) 2 is considered. As regards the wind turbine driven DFIGs [22], the possibility to change the rotational speed of the rotor provides an useful degree of freedom; however the rotor electrical frequency ω r must be contained between bound values defined by physical limitations of the power electronics. Consequently a cost term α b (t)ω r b (t) 2 is introduced to penalize the deviation of the angular speed with respect to the synchronism. The storage has to provide power to support the power system while attempting to maintain or recover an appropriate state of charge over the time; the corresponding considered cost When the risk factor enters in the prediction window, the cost function changes in order to allow the market generators to change their power generation schedules; when a risk is predicted for the generic generator a the term ξ a (t)P a (t) 2 weights its usage and at the same time the term γ(t)(P a (t) − P ref a (t)) 2 penalizes the mismatch between the generated power and the reference value scheduled in the day-ahead market. The latter term acts also on the generators that are not under risk of an attack. The amount of power required from each market generator during the periods in which the risks enter in the prediction horizons becomes a variable instead of being an input to the problem. Consequently, market generators cooperate with the VPP in the security system and are allowed to produce not only the power scheduled to sustain the assigned demand, but also an additional power needed to lighten the power required to the generators at risk. On the other hand, under normal conditions, the market generators are forced to produce the scheduled power.
As far as concerns the ESSs, the control model used to compute the prediction of the state of charge over the control horizon is Further, the wind turbine control model is Power P s b (t) and P w b (t) represent the set-points of the ESSs and wind turbines respectively, these set-points are sent to the low-level controllers implemented on those equipment [22]. The devices are located on the same node, which is then characterized by the power As customary in power system studies, the following algebraic hybrid power flow equations [23] are included into the problem formulation to unsure the equilibrium of power over the interconnected network of buses: ∀n ∈ N, ∀t ∈ T Finally, proper box constraints are introduced to keep physical variables within their acceptable operating range. Variables related to the storage devices and wind turbines are limited as followsx while all the nodes in the network must satisfy P n ≤ P n (t) ≤P n ∀n ∈ N, ∀t ∈ Ť Q n ≤ Q n (t) ≤Q n ∀n ∈ N, ∀t ∈ Ť V n ≤ V n (t) ≤V n ∀n ∈ N, ∀t ∈ Ť δ n ≤ δ n (t) ≤δ n ∀n ∈ N, ∀t ∈ T In the light of the above, the optimization problem at the basis of the proposed MPC scheme can be stated as follows. Problem. For a given power network with known demand patterns P d (t), day-ahead generation schedules P ref subject to the storage and wind turbine dynamics (3), (4) -(6) with initial conditions x 0 b and ω r,0 b respectively, and the constraints (8) -(11) over the control horizon T .
Remark. The proposed MPC is a high level control which relies on feedback signals coming only from the ESSs and wind turbines; it provides in real-time a control signal that, if working in the time scale of minutes, acts so as to prevent network frequency deviations resulting from the imbalance between the load and the generation; as a result it preventively supports and mitigates the action of traditional frequency regulators usually implemented in the power plants, which work on a significantly shorter timescale.

B. Solving method
The MPC requires the solution in real-time of the considered optimization problem to allow the usage of the receding horizon strategy. The presence of the nonlinear equations (8)-(9), as well as the function C P (λ(t), β(t)), makes the computational time required to find the optimal solution unreasonable to be applied in a real-time control. To speed up the optimization, an approximation on the power flow equations is performed: instead of the real equations, their linear approximation is computed on the operating point, considering the system to be in normal operation conditions without the renewable sources. For each t ∈ T we have: The reader may notice how the optimization problem continues to be nonlinear due to the wind turbine dynamics. To overcome this issue, and obtain a problem that can be managed in real-time, a local optimization method was used with appropriate initial guess. Such initial guess is set to be the current state of the system, measured at each control instant, hence finding a local minimum solution in the neighborhood of the operating point. This approach does not guarantee the optimality of the solution, but the experimental results reported show that the behavior of the system has the desired shape.

IV. INNER CONTROL ON RENEWABLE NODES
The presence of turbulences produces uncertainties in terms of power extracted from the wind turbines: the control model is led by the predicted mean value of the wind in the time sampling interval, while the simulation model is driven by the real wind profile on the site. The presence of two different signals for wind, and therefore the mismatching  between the corresponding predicted and actual power profiles, causes different evolutions in the two models. Due to this mismatch, controlling the simulation model based only on its simulation counterpart could drive the system to not feasible configurations, that in some cases may correspond to the breaking point of some network elements. The MPC controller produces as result of the optimization also the power profiles that shall be injected into the renewable nodes w.r.t. the requirement of the network, according to the power flow equations. In principle, the power component requested to the wind turbines may not be obtainable due the limitations on the electrical rotor and the current wind's speed. Hence, to avoid this situation, an intermediate controller is located between the MPC and the real set-points sent to the wind turbines and the ESSs. This controller has to distribute the required powers on the renewable nodes over the available devices, with the aim to satisfy the requirements on ω r and the requested powers profiles on the various nodes. To obtain these results, instead of using the the output of the MPC P w as the set-point for the wind turbine power, the problem is relocated to follow the predicted ω r ref .
Using this approach the desired electrical rotor speed is reached, and then a suitable configuration of the wind turbine is maintained. All the power lost in this process is then compensated by the ESSs. The intermediate controller has the following structure: Where P w (t) and P s (t) are the distorted inputs respectively for the wind turbines and ESSs. The gain K needs to assure the stability of the system, as the system is asymptotically stable iff |1 − K|< 1. At each sampling time the wind speed and the electric rotor speed are measured, and hence it is possible to known the mechanical power absorbed by the wind turbine and obtain the new power set-point. To avoid spikes of power, due to the change of the desired rotational speed, a smooth interpolation between the current rotational speed and the next one has to be performed. As a result, the power on the node seen by the grid is the same of the MPC profile.
) (16) It worth remarking that the intermediate controllers are distributed only on the renewable nodes, as each controllers effects only the renewable bus on which it is located. The control law of each controller is composed by two equations: (14) is responsible for maintaining the wind turbines in a feasible configuration, while (15) ensures the transparency of this control to the others nodes of the network.

V. SIMULATION RESULTS AND DISCUSSION
The simulation results reported in this paper are aimed at showing the validity of the proposed approach. The network controlled is the standard 14-bus IEEE transmission network, reported in figure 2 with the addition of a market generator on node 13, two groups of turbines characterized by a maximum power of 2 MW, and a 12 MW h/6 MW ESS on nodes 4 and 11. Additionally, the generator on Node 1 is picked to be in the VPP. The first simulation is aimed at showing the effect of the MPC during normal operation conditions. No risk of attack is hence present, and the power loads have been set constant for the sake of simplicity. The wind profile in figure  3 is characterized by a drop in its speed mean value of about 30% between hours 3 and 4, and a mean value of ≈ 9 m s −1 .
When the wind drop enters in the prediction horizon, the VPP starts to change its configuration in order to mitigate the its negative effect. Only one renewable node is reported in figure 4, as the behavior of the two nodes is almost identical. In the same figure, it can be noticed how the wind turbines change their speed in order to minimize the power losses due to the tip speed ratio, and at the same time the ESSs begin to accumulate energy to be able to release it during the wind drop. Figure 5 shows the powers of the various elements of the VPP. From this figure it is evident the effect of the intermediate controller (14), (15), as it produces the jagged power profiles on the wind turbines and ESSs. In this simulation, the effect of the wind drop on the slack was mitigated by the combined actions of the wind turbines and the ESSs: with the change of the slip the loss of power is decreased w.r.t. the loss that would have been obtained without it, as the power injected by the storages covers part of the drop. Finally, it can be observed that during the wind drop the power provided by the ESSs is less jagged due to the relation between the variance of the wind and its mean value. The second simulation shows the reaction of the control system in response to the presence of a risk prediction. For the sake of simplicity, and to obtain clearer results, a constant wind speed profile with mean value of approximately 7 m s −1 , as well as constant load profiles have been considered. The risk prediction is present only on the market generators, as reported in figure 6. Before the risk on the market generators enters into the prediction horizon, the control system behaves as before: the VPP provides power in order to find a trade-off between the use of the slack generator and the deviation to the other controller quantities from their references values. During this period of normal operation, the market generators inject in the network the power established by the previous market negotiations. When the risk enters into the horizon, the cost function changes from (1) to (2), and the effect of this change is reflected immediately on the market generators' behavior. In figure 7 the set-points of the power sent by the control system are reported. Two separate risks are present: the first one on the node 2 and the second on the node 13, with peak values distanced by approximately 1.5h. Figure 7 also shows how the controller lowers the set-point of power in the node under risk of attack. This lost power is compensated mostly by the VPP, and in minor part also by the other, risk-free, market generator (figures 7,9). The power spike on the slack generator is lower and smoother than the production losses, and looking at figure 9 it is clear that this behavior is due to the presence of the ESS, whose operation, due the chosen weights in the target function, is preferred. Once again, the predictive component of the control emerges clearly from the SOC profile, as the ESSs start to react before the generators start to be effected by the risk. The two ESSs share once again a very similar profile, and hence only the one of node 4 is reported. Finally, from the analysis of figure 8 it is clear that the storages also work to maintain the power generated on their node constant over the control time step, as modeled by the control logic presented in (14), (15). An additional interesting contribution is given by the wind turbines, and is clear in figure 8: during the period in which the market generators were subject to risk, the machines change their slip value, in order to maximize the portion of power extracted from the wind at the expense of the divergence from the synchronous speed.

VI. CONCLUSIONS
A risk adverse virtual power plant control in unsecured power systems based on the MPC has been presented. The work addressed the presence of nonlinearities in wind turbines dynamics and network equations, providing an approach to overcame the complexity of the formulated optimization problem, which was needed to be implemented and solved in a real-time MPC strategy. Additionally a secondary, lower level, control law was provided for the sake of making the MPC control suitable to deal with real, turbulent, wind profiles. The control approach has been tested in two different scenarios: the first one reported was characterized by a drop in wind speed, showing that the wind turbines and ESSs mitigate the negative effect that the drop would have caused on the slack generator and the rest of the network. The second scenario was aimed at showing the behavior of the control strategy proposed in presence of risk predictions over the market generators, and highlighted how a trade-off between service resiliency and economic performances was found. The control proposed is designed as an additional layer between the real-time low level control of the generators and network elements, and their day-ahead scheduling. The open points to be treated in future works are manifold: one important future work is to design a systematic way to evaluate the weight present in (1) and (2), in order to guarantee a proper behavior of the components in the transmission system. Another point of interest for future improvements may be the analysis of the dimensioning of the system, in particular the relation between the wind profile, the turbulence present on the site of interest, the dimension of the associated wind farm, and the consequent dimensioning in power and capacity of the ESSs. Another interesting aspect that may be worth considering is the concept of delays related to the propagation of control signals and the sampled measurements [24] on which the MPC presented is built, a problem that that could be taken in to account by additional, lower lever, control elements.
Further promising future work is expected in the perspective of coping with the problems dealt with in this paper by adopting more advanced feedback control and machine learning methodologies also able to exploit, in real-time, the information embedded in historical data collected in the SCADA system, as SAIFI and SAIDI [25] indicators history, and/or the real-time feedbacks provided by the network users or their smart meters; this way it could be possible to perform dynamic, personalized, context-aware control actions, tightly tailored to each specific operational situation; in this respect, mutatis mutandis, approaches similar to the ones which are being adopted in the fields of Energy Control [26], [27], Traffic Control [28], [29], Resource Management [30], [31], personalized Quality of Experience Control [32], [33], and Transportation Systems [34], can be used.