Cyber-attack investigations on GFL and GFM inverters of a mi crogrid (CAILIM)

This research investigates the impact of cyberattacks on inverter-based microgrids through two 
distinct access periods, each focusing on different microgrid topologies and control layers. A 
structured test plan, including preparatory modeling and proof-of-concept validation, ensured a 
safe and effective transition to the experimental phase. 
The research considered two microgrid topologies to assess the effects of cyberattacks. The first 
access period involved a microgrid comprising Grid-Forming (GFM) and Grid-Following (GFL) 
inverters, with attacks targeting the Phase-Locked Loop (PLL) of the GFL inverter at the primary 
control level. The cyberattack in this phase involved the malicious reduction of the PLL’s PI gains 
in the GFL inverter, impairing frequency tracking performance. The second access period in
volved a microgrid consisting solely of GFM inverters, with attacks introducing False Data Injec
tion (FDI) to the secondary control of one inverter. The cyberattack in this phase involved an 
adversary manipulating the sensor/metering device of one GFM inverter, introducing a constant 
disturbance to the reference frequency of the distributed secondary controller. In both cases, 
inverters were droop-controlled with d-axis priority current limitation. Both experimental phases 
were validated using Power Hardware-in-the-Loop (PHIL) setups.  
In conclusion, this research successfully validated the two initial hypotheses, demonstrating that 
cyberattacks at different control levels can significantly impact microgrid performance. The find
ings emphasize the critical role of control strategies and highlight how proper selection of droop 
gains can enhance cyber resilience, serving as a passive defence mechanism. These insights 
contribute to the development of more secure and reliable inverter-dominated microgrids.