# An Integrated Testbed for Power System Cyber-Physical Operations Training
## 4 CPS Testbed Applications
### Module 4: Wind Turbine CPS Operator Training  
The last module was developed to present the cyber vulnerabilities associated with the integration of renewable energy resources into power system networks. The testbed demonstrates the simulation of a cyber-physical wind power plant (WPP) connected to a transmission system subjected to cyberattacks. The WPP was developed with 50 equivalent wind turbines, each producing 2 MW of power. The wind turbine is modeled through an equivalent mechanical formulation considering direct-drive-based type-IV, with 425 V. The turbines are connected to the 34 kV collector system via a double-winding saturation transformer 34.5 kV/425 V. The wind farm is connected to the 230 kV transmission system through a 230 kV/34.5 kV, 125 MVA sub-station transformer. Figure 15 shows the system modeling in HYPERSIM.  
The network layer is modeled with multiple wind turbine nodes connected to the SCADA system node, as shown in Figure 16.  
Figure 16: Schematic of the wind farm and power system communication model in EXata CPS.  
Figure 15: Wind farm and power system physical model in HYPERSIM.  
A network switch is used to facilitate communication between these nodes. It is assumed that the SCADA system is connected to the controller of each wind turbine without any modification needed for the control. IEC 61850 GOOSE protocol is used to communicate between multiple IEDs and SCADA [59]. IEC 61850 is the standard communication protocol for IEDs within electrical substations. The subscriber and publisher nodes are assigned unique IP addresses, MAC addresses, and virtual ethernet ports. These virtual ethernet ports represent the common node for each device in the network and electrical layer. SCADA is responsible for polling the nodes and communicating over the site nodes. The polling consists of monitoring the wind speed measurements, voltage, current, and power measurements. The turbine starts generating when the wind speed is above the cut-in speed and follows the power curve [60] as the wind speed changes. When the wind speed measurements received by the control center exceed the cut-off value, a triggered alarm is sent to trigger the breaker to prevent defects and damage. To study and analyze the effect of cyberattacks, a malicious packet manipulation attack was used to modify the packets between the wind farm and the SCADA control room. The test scenario demonstrates the multiplication of wind speed measurements by a factor that changes the actual power generated by the wind turbines. The attack scenario is represented in state equation form, defined by Equations (15) and (16).  
\[x(t+1)=G\times x(t)+B\times[\;u(t)+\Delta u(t)] \tag{15}\]  
\[y(t)=C\times[x(t+1)+B\times\Delta u(t)]+e \tag{16}\]  
Figures 17 and 18 present the study of packet manipulation in wind speed measurement signals received at the SCADA control center with and without an attack.  
The normal operation shows that the actual wind speed matched the value received at the control center. Thus, the output power measured is the actual output power of the wind turbine. Under the operation of a packet manipulation attack, the actual wind speed measurement and the data received at the SCADA control differ by a scale of the random multiplier. By manipulating the wind speed, the SCADA control becomes based on a fictitious value, which decides to turn on and off the turbine, creating frequency  
Figure 17: Comparison of wind speed and frequency: (**a**) without attack; (**b**) with attack.  
oscillation at the point of common coupling. It is worth highlighting that the frequency reached approximately 60.2 and 59.6 Hz, values that are beyond the acceptable operational limits [61]. This also affects the actual power measured from the turbine. The false information to the controller forces it to make false decisions like curtailing the output power, increasing the load demand, shutting down the turbine, or even shutting down the entire wind farm.