Application of functional modeling for monitoring of WTG in a cyber-physical environment

: Decentralisation of generation and increasing utilisation of information communication systems bring challenges to present power system modelling approaches. This work applies functional modelling for monitoring and modelling of distributed energy resources, with wind turbine generator (WTG) application as a case study. First, the authors established a functional model of a generic WTG through the multilevel flow modelling approach. The model acts as basis of a state estimator (SE) for monitoring the WTG. Afterwards, the application of the SE is extended for wind power plant monitoring and control. The case study results show that the SE can efficiently limit the impact of information errors from different data integrity attacks during active power curtailment.


Introduction
The decentralisation of generation, through distributed energy resources (DERs), and higher utilisation of information and communication technology (ICT) infrastructure, drive the power system towards a cyber-physical system (CPS) [1]. DERs are vastly diverse in terms of application, technology, manufacturer and specifications, making it prohibitive to study their dynamic behaviour and consequently analyse their impact on the grid operation [2].
The diversity and quantity of DERs interacting with the electric power grid challenges current modelling approaches within power system engineering. Formulating and validating detailed models of numerous DERs is time consuming and requires considerable ICT resources, making it infeasible [2]. The approach of aggregating DERs into groups affects the accurate monitoring of individual DERs, which is necessary when considering the intermittent nature of renewable energy sources.
Therefore, new modelling methods are needed to better monitor the diverse and distributed assets within the power system. So far in the literature three different modelling approaches have been proposed and investigated; empirical, physical and functional. These approaches are compared in [3], and from a DER perspective, each has advantages and disadvantages. The empirical approach is based on pattern recognition from previous observations, and is sometimes referred to as a blackbox approach, which requires less knowledge about the system. An example of this approach is the use of artificial neural networks in different power system application [4]. However, its efficiency depends strongly on the set of training data and restricts to the specific parameters of the system and its operational conditions [5]. Therefore, the blackbox approach may fail to accurately identify and reason the performance of the system, and possibly react arbitrarily to unrecognised patterns [6].
Physical modelling is based on first principles, i.e. differential equations. The approach is used in different power system modelling applications such as small-signal or transient stability analysis [7], and can be highly detailed and even compensate for unobserved quantities. However, the low abstraction level entails high computational requirements and parametrisation challenges at different operation situations, which decrease the model's generality.
Functional modelling is based on an analysis of physical phenomenon and cause-effect relations within the system. So far, functional modelling has experienced limited application within power system modelling, as its main application has been within process control and fault diagnosis [8,9]. In the work performed by Heussen et al. [10], the functional modelling approach is used to explain how functions within power system frequency control are related in the complex control system, which helps in evaluation and integration of new technologies. The functional modelling approach is shown to be able to represent implicit control knowledge that could be missed by the limited reasoning offered by empirical modelling and the low abstraction level of physical modelling.
This paper proposes the application of functional modelling by high-level abstraction as a solution to model the operation of DERs. The approach offers a qualitative interpretation of the physical processes, while simultaneously maintaining an overview of the system. This allows generalisation within different DER technologies.
The main contribution of this paper is to propose and demonstrate the ability of the functional modelling approach for DER modelling and monitoring through the example of a wind turbine generator (WTG). Based on the WTG model, developed via the functional modelling approach, a state estimator (SE) is proposed for WTG monitoring. State estimation is a basic tool in the energy management system of grid operators, where the objective is to minimise the impact of measurement error and false data in further analysis through exploitation of measurement redundancies and physical relations [11].
SEs are traditionally only used by grid operators, but in CPS, the decentralised operation and control, and the cyber-related risks, argues for the necessity of validating measurements and data from DERs. Cyber-related risks are investigated in different current publications [12][13][14][15][16], especially with a focus on the risks and effects of data integrity attacks [14][15][16]. Furthermore, extensive effort has already been made in proposing SEs to handle false data injection attacks on the overall system operator [17][18][19][20][21]. In current literature, however, mitigation of false data injection attacks has mainly considered the entire transmission system, not attacks within wind power plants (WPPs) or other DER technologies. In [13,15], the authors have analysed the possible impact of credible cyber-attack on wind farm supervisory control and data acquisition (SCADA) systems from a theoretical perspective without proposing possible mitigation mechanisms.
Previous research efforts within DER monitoring through state estimation include [22], where a WTG SE is based on differential equations and tested with a focus on packet loss handling. In [23], an extended Kalman filter based SE is utilised for a permanent magnet synchronous generator wind turbine, and tested in measurement noise scenarios. The work in [24] considers a doubly fed induction generator (DFIG) and Kalman filters to establish a SE connecting the collector system of the wind farm and the WTGs within. All these methods require detailed and accurate information of model specific parameters to give accurate results, which is difficult to obtain and differentiate for each manufacturer and model. Furthermore, a data-driven approach for detecting anomalies in photovoltaic plants is proposed in [25] through the formulation of an artificial neural network. A similar approach through artificial neural networks is proposed in [26] intended for WPP and WTG applications. These data-driven methods are highly dependent on the quality of the training set of data and do not require prior knowledge of the actual system. Similarly, with highly dynamic systems, such as WTGs, there is a risk of overtraining the data-driven approach to omit the inclusion of fine details.
In this work, we applied the functional modelling approach to model the energy conversion process of a WTG. The model acts as the foundation to formulate a SE for WTG monitoring. The SE is tested through simulating a WPP, during active power curtailment under normal steady-state operation, and evaluated based on the control actions in different data integrity attack scenarios. Results show that the SE helps in protecting the control system against gross measurement errors and data integrity attacks during active power control.
The rest of the paper is organised as follows. Section 2 presents the overall principle of functional modelling and introduces the multilevel flow modelling (MFM) methodology used in this work. The functional modelling approach is applied to the WTG energy conversion process in Section 3, which describes the different steps from formulating the functional model in MFM, extracting key process equations and establishing the SE. The purpose and approach of testing the SE in a WPP scenario are presented in Section 4, while the results of performing different data error and integrity attacks in a simulation environment are analysed in Section 5. Section 6 concludes the paper.

Functional modelling principle
The concept of functional modelling originates from software development, with the purpose of generalising a software application to enable implementation in different languages. The functional models of software development describe the desired functions of the application and explain what happens to objects within the software application, and can be understood as a representation of pseudo-code using flow charts and other graphical tools [27]. Later, the functional modelling approach is applied to fault diagnosis where it has been used to capture the key steps of a process. Examples include a simple water mill in [28] and a nuclear power plant in [3,8].
In order to establish a functional model of a process, knowledge about the entire process is required, which includes, but is not limited to, the functions of the process and subprocesses, performance standards, the relations among subprocesses and so on. The model is built on a high-level abstraction of an object that helps process operators in handling the complex dynamics and relations without loss of details [28].
Representing a process through functional modelling is done through a method called functional decomposition. As the name suggests, the principle is to consider the overall process and iteratively decompose its function into sub-functions [27]. In [29], the functional decomposition process is demonstrated for a power system. When decomposing the functions of a process, relations between the different functions are revealed. There are different methods for representing the relations and functions of a process; the methodology used in this paper is MFM, which relates the goals, functions and relations of a system [28].
The MFM methodology forms a visual representation of the dependencies between the different functions of a process by utilising different graphical components shown in Fig. 1b. What characterises the MFM methodology is how it separates the functions of a physical system in terms of mass or energy handling functions, and enables a meaningful way of representing advanced control processes. The functions handing mass are collected in mass flow structures (MFS) and can represent a physical transportation, separation, storage and so on within the process. Similarly, the energy flow structures (EFS) contain functions that transport, transform, convert energy. The separation helps improve the reasoning of the process functions and relations.
In fault diagnosis, MFM is used to monitor an industrial process by representing each function by a signal value and evaluate its operation according to predefined limits. If a process is equipped with control capabilities, through one or more actuators, a violation of an operational limit can be handled. In MFM, controls are represented in control flow structures (CFS), which evaluate the status on a function and can perform an actuation on a function to change the process operation.
What follows is a demonstration of how functional modelling can be a useful tool for CPS analysis. This is done through formulating the functional model of a generic WTG through the MFM methodology, and using the high abstraction level of the model to derive a set of generic equations representing the key steps within the WTG energy conversion process. Based on the equations, a SE is formulated with the objective to improve the data integrity of the WTG monitoring, and verified by application to WPP control scenarios using simulations.

WTG functional modelling application
The WTG model considered in this work is based on the generic model of a DFIG wind turbine described in [30]. The generic model, developed by the Western Electricity Coordinating Council, is defined with the purpose of providing an accurate, yet simplified, representation of actual systems at a time frame suitable for stability simulations [31].
An overview of the WTG energy conversion process is shown in Fig. 1a, where each of the conversion steps are separated to improve readability. One of the central functions within the WTG is the balancing between the electric power output and the mechanical power input. This behaviour is indicated in Fig. 1a by the approximate equation to represent its interaction with the entire conversion process.
In the first step of Fig. 1a, the wind intercepted by the turbine blades is characterised by its speed, v measured in meters per second. In MFM, the flow of wind is modelled as the mass flow shown in the MFS in Fig. 1c. The upstream and downstream wind is modelled as a source, So1 and a sink, Si1, respectively. The wind is transported towards and away from the turbine blades through the transport functions Tra1 and Tra2, respectively.
As the wind hits the blades in the second step of the process in Fig. 1a, the mass can be considered stored momentarily at the interception. Therefore, the blades are characterised in the MFM model through the storage function, Sto1 in Fig. 1c.
Here, a means-end relation models how the stored wind at the blades can be interpreted as a source of kinetic energy, So2, as shown in the EFS. The kinetic energy is transformed into rotational and elastic energy through the connection between the turbine hub and the shaft as indicated by the third step in Fig. 1a. In the MFM model, the energy conversion to rotational and elastic energy is represented by Tra3 and Tra4, respectively. Afterwards, the rotational energy is stored in the rotational mass, Sto2 and the elastic energy is stored in the twisted shaft, Sto3.
In Fig. 1a, the rotational energy is represented by the rotational speed, ω r measured in radians per second, while the elastic energy is included in the balancing between mechanical power, P mech , and electrical power, P elec both with the unit of kW. The rotational and elastic energy is transported towards the induction generator through Tra5 and Tra6, respectively, followed by the conversion into electric energy modelled by Con1 in Fig. 1c, and described by the active and reactive power P and Q, measured in kW and kvar, respectively, in the fourth step in Fig. 1a.
The electric energy is transported towards the grid-connected terminals, represented by the sink Si2, through the transport function Tra7. In Fig. 1a, the grid connection is indicated by the fifth step of the conversion process. The two converters, stator and grid side, of the DFIG have different responsibilities in operating the WTG. The stator side converter is responsible for controlling the current from the WTG to the grid, and the grid side converter controls the voltage to a certain degree. These control responsibilities are indicated in Fig. 1a by U and I. It is important to mention that the representation does not describe where the current and voltage are measured, as both readings are acquired through synchrophasor measurement units at the WTG terminal connection to the grid. The blade pitch angle, θ measured in degrees, in the second step of Fig. 1a can control the kinetic energy harvested by the blades. In MFM, this ability is modelled by the first CFS, CFS1, which has the objective of maintaining the rotational speed within its operational limits. This is achieved by actuating the storage of wind at the turbine blades.
The second CFS in Fig. 1c, CFS2, is used to represent how the back-to-back converters in the DFIG are responsible for maintaining appropriate interaction between the WTG and the grid. This is done through control of the conversion of rotational energy into electric energy as represented by Con1.
The MFM functional model in Fig. 1c allows a rule-based analysis of the cause-effect relations. As an example, consider a scenario where the wind speed is increasing from normal to high, which causes a large flow of mass through So1. The cause-effect relations can be evaluated through Fig. 1d, where the affected functions are marked in red.
Initially, the wind speed in the MFS is indicated high by the red source function So1 in Fig. 1d, which subsequently increase the mass flow from the up wind stream and past the WTG, indicated by the red transport and storage functions in Fig. 1d. In theory, the mass of wind will likewise increase in the down stream sink, although the scale of this increase depends on the aerodynamic efficiency of the blades and their capability of absorbing the increased mass flow.
Following the increased wind mass passing the blades as a result of the increased wind speed, the kinetic energy, So2 in the EFS of Fig. 1d increases as indicated by the red marking. With a higher kinetic energy, the rotation of the WTG shaft increases, and this acceleration twists the shaft, resulting in an increase in both elastic and rotational energy as indicated in red in Fig. 1d. As Sto2 gets high, the pitch angle control in CFS1 evaluates the rotational speed, and if the rotational speed exceeds its limit, the pitch angle is increased to lower the wind mass stored in Sto1. This control completes the control loop indicated in red in Fig. 1d.
This example demonstrates how the functional model can be used to analyse WTG behaviour due to its intuitive representation of cause-effect relations. In the following, the formulated functional model is analysed with the objective of deriving a state estimation model to demonstrate the application of functional modelling in the CPS.

SE for WTG
The SE for removal of gross measurement error is based on the concept of state estimation, capable of estimating the value of measurements from state variables and state-space equations [11]. Before formulating the state equations linking the state-space variables and the measurements, the latter are identified. From the  Fig. 1c, ten quantities characterising the mechanical and electrical systems are identified, which form the set of measurements z. In Table 1, each measurement is represented by the corresponding MFM function in Fig. 1c based on the analysis in Section 3.
The combination of measurements chosen from the MFM model in Fig. 1c captures the key steps in the energy conversion process starting from the effects of the free wind speed and finishing at the delivery of current at the grid terminals. The set of measurements, z, is shown in the following equation: where U rms and I rms are the root mean square (rms) line to ground voltage in volts and line current in ampere, respectively, U and I are the instantaneous phase sine wave voltage in volts and current in ampere and Δω r is a pseudo-measurement of the change in rotational speed in radians per seconds squared between two time instances, with an assumed time resolution of 1 s. From the functional relations identified in Fig. 1c, the pseudomeasurement Δω r can be related through the power balancing function in the shaft. The acceleration of the rotating shaft is defined in the following equation: where H is the WTG's moment of inertia, and T mech and T elec are the mechanical and electric torque, respectively. The right-hand side of (2) is expanded further in (3)-(5) through physical relations where P wind v is the kinetic energy in the wind, ϕ is the power factor and C p λ, θ is the power coefficient as a function of the tip speed ratio, λ and blade pitch angle, θ, respectively. From (4) and (5), the power coefficient dependency is changed by (i) utilising that λ is defined by the dimensions of the WTG blades, ω r and v, and (ii) assuming the blade pitch angle controller operate close to the optimal pitch angle. This assumption enables an analysis of the WTG power coefficient curves with the objective of defining an expression of θ as a function of ω r and v.
The expression in (5) only uses four of the parameters in Fig. 1a to calculate the shaft acceleration. This observation means that the set of measurements in (1) can be determined through a set of independent variables x and a set of state equations. The latter now has to be identified to finish the establishment of the state estimation model. These equations are identified through the consideration of the defined set of independent variables in (6) and the relations within the WTG represented by the functional model in Fig. 1c x = v, ω r , U rms , I rms With the set of variables in (6) of size n = 4, and the set of measurements in (1) of size m = 10, the redundancies used for estimating the state variables in the model are calculated as the degree of freedom df = m − n = 6. The objective of the SE is to exploit such an overdetermined non-linear system through an iterative process of estimating independent state variables based on equations and measurements. This way, the knowledge about the physical system can help to reduce the inclusion of measurement error in later analysis. The process of state estimation is built around the non-linear measurement model in (7), where the set of measurements, z, is defined as a sum of state equations h x and a measurement error vector e of zero mean and σ 2 variance Traditionally, state estimation is performed by solving the weighted least squares (WLS) problem through an iterative process of minimising the weighted sum of square residuals, J x , defined in the following equation: where r j is the residual z j − h j x and σ j 2 is the variance of the jth measurement. The WLS method has been proven efficient in multiple works since its introduction in [11,32]. Therefore, the WLS is used in this work to minimise the residuals in the proposed state estimation model.
Designing the SE for DER application argues for implementation on an embedded system, which entails special requirements for the estimation algorithm. It must (i) be convergence robust to avoid an infinite loop of calculations, and (ii) have appropriately fast computational speed to avoid indeterminism. Compliance with the first requirement is obtained through orthogonal factorisation due to its robustness advantage described in [33]. The latter requirement is satisfied through the high abstraction level analysis through functional modelling, limiting the number of measurements, equations and variables included in the SE, and choosing an appropriate stopping criterion of the iterative estimation algorithm. The earlier work described in [34] analysed the computational speed of the SE while implemented on an embedded system, showing adequate performance.
For the SE based on the functional model of a WTG in Fig. 1c, the set of state equations h x are defined through the state variables chosen in (6), and are presented in the following equations: The function, f v, ω r , in (10) is defined by the power coefficient curves supplied in [30], and represented by a four-term Gaussian numerical expression identified in [34]. Equations (16) and (17) include the voltage and current angles, α and β, respectively. These angles are assumed accurately acquired through the use of synchrophasor measurement units at the WTGs. From this assumption, the calculation of the power factor of each WTG is done through the following equation: Since the voltage and current angles are assumed accurately acquired according to international standards [35], these angles and the power factor are assumed available in the establishment of the state estimation model. As the WTG in this research is investigated as part of a WPP, the expressions in (5) and (10) need to consider the possibility of suboptimal blade pitch angle due to control signals from the main controller. The suboptimal position of θ is defined by the WPP main controller active power setpoint P set WTG communicated to each WTG within its control area [36]. Using the active power setpoint as input, the correctional coefficients K θ and K C p are defined by finetuning (10) and (18), respectively. Including the correction coefficients changes the state equations in (10) and (18)-(20) and (21), respectively

Bad data detector (BDD):
In a SE, a valuable tool for removal of gross measurement error is a BDD. The BDD objective is removing gross measurement error, defined as 5σ < e j < 20σ in [37], from z. In the WTG SE, the BDD is executed after each iteration of the state estimation algorithm, starting from the detection process based on hypothesis testing of J x -test described in [11]. If bad data is detected, the weighted residuals are sorted in a descending order and the first measurement b, is assumed to contain gross measurement error, completing the identification process. Next, b is eliminated through (22) as described in [34] where h b x is the estimated value of the identified bad measurement b from the state variables and equations, a is a normal distributed random number with zero mean and standard deviation of σ = 0.01. The elimination process pushes the measurement towards the estimated value, h b x , which is assumed as a more accurate representation of the correct value than the received measurement.

WPP test system
The current practice of monitoring operation of individual WTGs through standard SCADA systems is done by averaging the incoming measurements across 10 min of operation [38]. This approach efficiently removes gross measurement error, but limits the visibility of the dynamics in the system. The aim of the SE proposed in the previous section is to improve the monitoring of a single WTG operation by actively removing gross measurement errors before broadcasting measurement at normal SCADA resolution of 1 Hz. The SE is intended for implementation on an embedded system, and located between the acquisition and communication of data between the individual WTG and a WPP control centre. The purpose of the test scenario investigated in this paper is to indicate how the implementation of the SE at the individual WTGs in a small WPP improves monitoring through higher time resolution data acquisition as well as limiting the impact of cyber vulnerability exploitation through active removal of gross measurement error.
The removal of gross measurement error becomes important when utilising the measurements of individual WTGs in performing WPP controls. In the recent decades, DERs have been required to actively participate in grid operation through active and reactive power controls [36]. One of these control strategies commands the WPP to limit its active power output to a portion of its rated capacity thereby deloading the operation of the WTGs [39].
Such a control command can be handled in different ways. One option is stopping the current injection of WTGs one by one until the active power limit is satisfied, however, due to the fluctuations of the wind, this crude method is not desirable. Instead, each WTG is controlled to lower their power production to a value decided by the WPP controller dispatch function. The dispatch function of the controller is supported by a feedback loop that evaluates whether the WPP satisfies its setpoint P set WPP [36].
The active power setpoint, P set WTG , can be equal for all WTGs.
However, P set WTG usually varies according to the available power of each individual WTG. Calculating the available power of each WTG, P avail WTG can be done through different techniques, as described in [40]. Most of the methods rely on observations from the physical system to estimate the available power for each WTG, making them vulnerable to gross measurement error and data integrity attacks. In this research, the adjusted power curve distribution function is used, where the power is estimated through the power curve of the WTG and the free wind speed in front of the WTG [40]. The individual WTG power setpoint is then calculated by a percentage of the available power, making it capable of delivering the WPP power setpoint during wind fluctuations. The SE based on the functional model in Fig. 1c is evaluated through implementation in a numerical WPP simulation model, defined by the single line diagram in the Physical system part of Fig. 2.
The WPP, composed of six DFIG WTGs each with a rated power of 1.5 MW, is assumed located perpendicular to the wind direction to neglect wake effects. Each WTG is experiencing a wind speed with equal average value with different local fluctuations to represent turbulence. These assumptions are included to emphasise the effects of gross measurement error and are not limiting the independence of the SE in practice. The WTGs are modelled using the parameters given in [30]. The WPP collector system is modelled by assuming an onshore radial topology with the grid equipment parameters shown in Table 2 [30,41,42] and a system frequency of 60 Hz.
The cyber system of the WPP illustrated in Fig. 2 includes the wind turbine control panels (WTCP), from where measurements and control signals are communicated. The WTCP is located at the bottom of the WTG tower, and can be used by maintenance crews to acquire data and control the WTG [15]. To emulate measurement noise in the simulation of the WPP, a normal distributed random noise with zero mean and standard deviation of σ = 0.01 is added to each measurement before it is acquired.
In this research, the application of the DER SE is investigated in a scenario where the embedded system is connected directly to the WTCP as shown in Fig. 2 and evaluated in a distributed control application through test cases with large disturbances on the free wind speed signal. The disturbances are assumed added to the free wind speed signal at the WTCP of one of the WTGs. The WPP controller will be evaluated based on its reaction when raw measurements are received directly through the SCADA system, and when measurements have been through the embedded SE before being broadcast. Four different disturbances are investigated based on current literature in false data injection attacks and their impact on power system controls described in [14], where different attack templates from [43] are used to evaluate the effect of false data injection on automatic generation control. The four disturbances considered in our work are similarly based on attack templates from [43] as follows.

Gross measurement error 2. Random data injection attack 3. Pulse data injection attack 4. Ramping data injection attack
For each of the test scenarios, the average wind speed will be 10 m/s for all WTGs and the WPP controller is commanded by the transmission system operator to curtail 60% of its active power generation. Such a scenario emulates a situation where the power system has over-production and requires down-regulation.
The test cases simulate situations where the cyber system of one WTG experience errors or attacks by adversaries with the objective to disturb the operation of the WTG. In test case 2, the adversaries acquire the free wind speed, adds a normal distributed random number of zero mean and standard deviation of σ = 0.1. In the third test case, the adversaries add an impulse of, a pulse = − 0.1 pu on the free wind speed every 5 s. The last data injection attack simulates a scenario where the adversaries distort the free wind speed signal through ramping with a slope equal to a ramp = − 0.001 pu [14].

Results
In this section, the results of the four test cases are presented and analysed with the purpose of evaluating the utilisation of the SE derived from the functional model in Fig. 1c.

Test 1: gross measurement error
In the first test case, a single occasion of gross measurement error, equal to ε = − 0.1σ, on the free wind speed signal for WTG1 is simulated and investigated in a situation where the WTG SE is deactivated. The reason for deactivating the SE is to illustrate how harmful gross measurement error can be to the plant controller.
The plots in Fig. 3 represent the results of simulating the system during steady-state operation while being subject to an injection of gross measurement error. For each plot, the signals from all six WTGs in the WPP are included, and as WTG1 is the one being subject to gross measurement error, its response is highlighted by the dashed line.
The occurrence of gross measurement error is clearly visible in Fig. 3a, where the free wind speed signal of WTG1 is around 1 m/s lower than the other WTGs. In both Figs. 3a and b, the value of the signal changes once every second due to the assumption of 1 Hz SCADA data acquisition frequency.
In Fig. 3b, the active power setpoint decided by the WPP controller is shown for each WTG, where wind turbine 1 has a considerably lower setpoint than the rest of the turbines. This happens as the WPP calculates the expected available power for each WTG using the power curve characteristics as explained in Section 4, the results of which are presented in Table 3. Here the available power calculated for WTG1 is around 0.25 pu less than for the other wind turbines due to the lower free wind speed observed by the WPP controller.
In Table 3, a comparison is made between two scenarios, where the SE of WTG1 is deactivated and activated. From the P avail WTG , the available active power for all wind turbines, except the first, in both scenarios are equal, clearly indicating that the only difference between the two scenarios is the status of the SE. From the v signal received by the controller, it is apparent that when the SE is active, the free wind speed is closer to the average speed of 10 m/s. The difference is due to the SE having removed a part of the gross measurement error and estimated the signal value with higher accuracy than using the raw measurement directly. Table 3 indicates the capability of limiting measurement error through utilising the functional modelling based SE presented in Section 3. The motivation behind removing the error is clearly visible when observing the blade pitch angle and rotational speed signals taken directly from the simulation model and presented in Figs. 3c and d, respectively. In both figures, the dotted line is the results of WTG1 from simulating the system with the SE activated.
The results in Fig. 3c show how the change in active power setpoint forces the blade pitch angle of WTG1 to increase rapidly. This is mainly due to the mismatch between the wind speed measurement received by the WPP controller and the actual wind speed experienced by WTG1. This mismatch is a result of the added gross measurement error and assumed noise in the communication channel. The distribution function in the WPP controller believes the first wind turbine is experiencing lower wind speeds than the other WTGs and as a result asks WTG1 to decrease its active power generation seen in Fig. 3b. As WTG1 experience higher wind speeds than believed by the WPP controller, it has to rapidly increase the blade pitch angle, shown in Fig. 3c, to meet the active power setpoint set by the WPP controller. As the pitch angle increases from 8.8 ∘ to 9.5 ∘ , the aerodynamic efficiency of the blades decreases which slow down the rotational speed of the shaft, as shown in Fig. 3d. In comparison, with the SE activated the changes in blade pitch angle and rotational speed of WTG1 are similar to those observed for the remaining five wind turbines. This is because the SE improves the accuracy of the physical system observability by reducing the mismatch between the wind speed perceived by the plant controller and experienced by WTG1. From a mechanical and maintenance perspective, the gross measurement errors cause additional stress on the rotating parts. In this test case, only a single instance of gross measurement error is investigated. In the two following tests, the mechanical system is stressed further through injection of higher than normal measurement error and pulse injection of gross measurement error, respectively.

Test 2 and 3: random and pulse data injection attack
The analysis of the test cases with the injection of large measurement error through random and pulse data injection starts by observing how the free wind speed signal received by the plant controller propagates with the SE deactivated and activated. The wind speed signals of the two test cases are shown in Figs. 4a and b.
From the free wind speed signal in Fig. 4a, the measurement error is rather large compared to the average wind speed of 10 m/s, if the raw measurement is used for calculating the available active power in the WPP controller, it will affect the active power setpoint of WTG1, as observed in the previous test case.
The large deviations in active power setpoint affect how the rotational speed of WTG changes. In Fig. 4c, the rotational acceleration between each second of operation is calculated through the time derivative and shown for the two scenarios of SE status. The results clearly show how the large measurement error causes more violent changes in rotational speed, which ultimately affects the lifetime of the rotating shaft. This kind of cyber-attack objective has previously been used in the famous Stuxnet attack on the Iranian nuclear program where centrifuges were controlled to run faster than rated speed causing their lifetime to decrease.
For the third test case, the free wind speed signal is subject to a 0.2 Hz pulsating measurement error as seen in Fig. 4b. The pulsating injection of bad data is included in the WPP calculations of the active power setpoint of WTG1, and can be observed affecting the acceleration of the rotating shaft in Fig. 4d. For both these test cases, utilising the SE can limit the higher mechanical stress entailed by data integrity attacks.
Lowering the lifetime and increasing maintenance cost is one way of attacking WTGs, another more direct approach would be to try and stall the turbine by ramping down the free wind speed signal until the rotational speed decreases beyond its tripping limit.

Test 4: ramping data injection attack
This test case is used to demonstrate whether the SE is able to prevent WTG1 from tripping during a ramping attack. First of all, the severity of ramping attacks is evaluated by observing the free wind speed measurement for all wind turbines in the WPP as shown in Fig. 5a. Comparing the measurements of the different WTGs in Fig. 5a, a clear difference is visible between the wind speed of WTG1 and the remaining five WTGs. This is due to the data integrity attack that tries to mimic a situation where the wind speed is slowly decreasing. The consequence of the decreasing wind speed is visible in Fig. 5b, where the blade pitch angle of WTG1, highlighted by the dashed blue line, is slowly increasing compared to the other wind turbines. The pitch angle increases due to the mismatch between observed free wind speed from the WTG and the WPP controller perspectives. As the central plant controller receives information of lower than actual free wind speed, it calculates a lower than actual P avail WTG1 . As the WPP controller uses a dispatch function for deloading operation, P set WTG1 is lower than necessary. Therefore, the local controls of WTG1 need to increase the pitch blade angle considerably more than the other wind turbines in the WPP. Around the 400th second of simulation time, the pitch angle starts decreasing drastically. The reason can be observed in Fig. 5c, where the rotational speed of WTG1, highlighted by the dashed line, slowly decreases proportionally to the free wind speed signal. After ∼400 s, the rotational speed exceeds the lower tripping limit, assumed equal to 0.7 pu. From the results in Fig. 5c, a visible difference is also observed in the rotational speed of the normal operating wind turbines around the 300th second of simulation. As the power production of WTG1 decreases, the other WTGs needs to compensate for the missing active power causing them to increase their rotational speed.
The effects of the ramping attack means one of the WTGs shut down, increasing the share of generation responsibility for the remaining generators. This affects the plant owner as fluctuations in the wind can cause dips in production and thereby decrease the economic benefits of the WPP.
The system is simulated once again, now with the SE activated. In Figs. 5b and c, the blade pitch angle and rotational speed of  WTG1 in this scenario are illustrated by the dotted line. Clearly, the SE improves the operational situation of the WPP as it helps avoiding a tripping of WTG1. In Fig. 5b, the blade pitch angle of WTG1, in this scenario, is observed slightly higher than the other WTGs, consequently, the rotational speed is slightly lower for WTG1 in Fig. 5c. The reason for these differences is the limited accuracy of the state estimation model based on the functional modelling approach. If substituted by a SE based on physical modelling, it could be more accurate, however, it would entail a higher computational requirement as well as necessary detailed parametrisation for different models.

Conclusion
This paper proposes functional modelling for power system analysis as it transits towards a cyber-physical system, specifically monitoring of DERs through state estimation. The benefits of using functional modelling compared to other approaches are discussed in terms of generality. Through the SE formulated from the functional modelling analysis, this paper demonstrates the value of considering monitoring DERs due to the distribution of control and necessity of considering cyber vulnerabilities.
Through testing the SE in different data integrity attack scenarios, capability of limiting the effects of attacks on the lifetime and maintenance of the mechanical assets in a wind turbine can be evaluated. Furthermore, it has been demonstrated how the SE prevents wind turbine tripping while subject to a ramping attack.
While the benefits of using the SE are clear, the proposed system can be improved further with regards to the estimation method. Other potential directions of future research include testing the system with real wind turbine data and using the functional modelling approach on different technologies and applications.