# An Integrated Testbed for Power System Cyber-Physical Operations Training
## 4 CPS Testbed Applications
### Module 3: Wide-Area Monitoring System (WAMS) CPS Training  
For the third module, a software-in-the-loop (SIL) testbed was developed to perform a co-simulation of the electrical layer and network layer in the real-time simulator. The general architecture of the testbed using EXata CPS as the network emulation software and HYPERSIM for the electric power network simulation are shown in Figure 12.  
In this module, the control architecture for the WAN in a power system network is simulated. It consists of generation units, distribution and transmission sub-stations, transmission transformers, and phasor measurement units (PMUs) in multiple locations within the power grid. PMUs are responsible for measuring phasor signals like the voltage, current, frequency, and frequency rate of change (ROC) and sending them to the phasor data concentrator (PDC) located at the control center [58]. The PDC receives time-synchronized phasor data (voltage, current, frequency) from multiple PMUs to produce a real-time data stream using the IEEE C37.118 master/slave protocol. C37.118 is a standard communication protocol in a power system that defines synchro-phasors, frequency, and frequency ROC under all operating conditions. The super PDC at the control center is configured to be C37 master and the PMUs at the microgrid are configured to be C37.118 slaves. The phasor information at multiple buses is transmitted to the control center using slave nodes. These PDC and PMU blocks in the electrical model are emulated with unique device nodes and are mapped to the virtual ethernet ports within the simulator. These ports are assigned IP addresses and the port number configured for each master and slave. The analog points were mapped between master and slave, the co-simulation between the electrical and network model was conducted in the OPAL-RT simulator, and the real-time results were observed.  
Figure 11: Quantity of messages: (**a**) sent; (**b**) received with the jamming attack.  
The impact of the delayed attack is shown in Figure 13, where the PMU and PDC phase angles are compared with and without the attack. The red waveform is the actual signal sent by the PMU, whereas the blue waveform is the signal received by the PDC. As the power system parameters are critically dependent on the synchronization of the transmitted signal, even a millisecond delay of the phasor signal will hugely impact the stability and operation of the system.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Property** & **Attack 1** & **Attack 2** \\ \hline Attack type & Packet multiply attack & Delay attack \\ Attack node & Node 2 (PDC node) & Node 2 (PDC node) \\ Layer type & Network & Network \\ Destination port & 7200 & 7200 \\ MODP attack type & Multiply & Delay \\ Value & 2 & 100 ms \\ Number of bytes & 2 & - \\ Start byte & 112 & - \\ \hline \hline \end{tabular}
\end{table}
Table 4: General configuration for packet multiplication and delay attacks.  
Figure 12: The co-simulation testbed architecture of the cyber-physical system.  
Another scenario was created to modify the packets by multiplying the signals transmitted between these two nodes. The setup follows the data presented in Table 3. This attack scenario intends to feed the PDC node with a random manipulated value. The results are presented in Figure 14, where it is possible to observe that the phasor signal received by the PDC node was considerably distorted with random values, which can critically affect the power system's operation.  
Figure 14: Comparison of the phase angle between PDC and PMU: (**a**) without multiplication attack; (**b**) with multiplication attack.  
Figure 13: Comparison of the phase angle between PDC and PMU: (**a**) without delay attack; (**b**) with delay attack.