1

On the Impact of Measurement Errors on PowerSystem Automatic Generation Control

Jiangmeng Zhang, Student Member, IEEE, and Alejandro. D. Domínguez-García, Member, IEEE

Abstract—In this paper, we propose a framework to evaluatethe impact on power system dynamic performance of differenttypes of errors in the measurements utilized by the automaticgeneration control (AGC) system. To address the random natureof these errors, stochastic system analysis methods are utilizedto evaluate the statistics of system state variables. By examiningthe convergence properties of these statistics, errors that causeinstability are identified. A reduced-order model, obtained byusing singular perturbation arguments, is also formulated thatenables us to provide analytical expressions capturing the impactof the errors. The proposed method is illustrated and verifiedthrough several case studies with different types of errors on asimplified New England/New York system model.

Index Terms—Power system automatic generation control,measurement errors, power system stability

I. INTRODUCTION

Measurement integrity is paramount in power system opera-tions and control. However, measurement errors are inevitabledue to miscellaneous phenomena, e.g., measuring device mal-function and noise in communication channels. Furthermore,measurement data are also vulnerable to intentional cyberattacks, which can introduce engineered errors and, in turn,may significantly degrade system dynamic performance. Inthis regard, vulnerabilities due to cyber attacks in powersystem control and data acquisition systems have been ex-tensively documented (see e.g., [1]). Therefore, it is criticalto comprehensively evaluate the impact of different types ofmeasurement errors so as to identify critical ones.

In this work, we consider the impact of errors, some ofwhich can be caused by cyber attacks, in the measurementsutilized by the automatic generation control (AGC) system,which is currently the only system-level closed-loop controlsystem across both the cyber and physical layers of a powersystem [2]. As part of the supervisory control and data acqui-sition (SCADA) system, the AGC algorithms are implementedin a centralized location (typically a control center). AGC iscritical for power systems to (i) regulate frequency, and (ii)keep the power interchange between balancing authority (BA)areas at the scheduled values. To achieve these goals, the AGCsystem takes measurements of: (i) the area frequency, (ii) thegeneration output of committed units, and (iii) the tie-line

The authors are with the Department of Electrical and Computer Engi-neering, University of Illinois at Urbana-Champaign, Urbana, IL 61801 USA(e-mail: jzhang67@illinois.edu; aledan@illinois.edu).

This work was supported in part by the Trustworthy Cyber Infrastructurefor the Power Grid (TCIPG) under U.S. Department of Energy award DE-OE0000097, the National Science Foundation (NSF) under grant ECCS-CPS-1135598, and by the Consortium for Electric Reliability Technology Solutions(CERTS).

power flow between BA areas; calculates the so-called areacontrol error (ACE); and determines the generator set pointvalues so as to drive the ACE to zero. These measurements ac-quired at various points of the physical power system networkare transmitted to the control center over a cyber network.It is obvious then that measurement data quality is criticalto system performance in the sense that measurement errors(e.g., false data injection over the communication channels)may mislead the calculation involved in the AGC algorithms,and severely affect the overall system performance.

From the perspective of erroneous measurement types,measurement data can be delayed (e.g., due to excessivecommunication traffic or denial of service attacks, see [3],[4]); manipulated (e.g., due to man-in-the-middle attacks, see[5]); or even lost (e.g., through a lossy network, see [6], [7]).From the perspective of assessing the impact of erroneousmeasurements, [8] presents a class of false data injectionattacks that can modify the estimated system state in arbitraryways. The authors of [9] evaluate the effects of erroneousmeasurements on the power market. The authors of [10]investigate an integrity attack on the measurements used in theAGC system performance to mislead the operator to performinappropriate control actions, which may subsequently triggerimproper actions (e.g., load shedding, or generator isolation),and even cause cascading failures. Finally, [4] investigateswhether the system will preserve stability at all with intro-duced measurement errors.

In this paper, we classify measurement errors as determinis-tic and random. While most previous works focus on determin-istic errors, in this work, we develop an analytical evaluationframework that can capture random measurement errors aswell. Building on our previous results reported in [11], wepropose a stochastic differential equation (SDE) framework tocapture the system dynamics under random phenomena (dueto measurement errors). Then, we apply analysis techniquesproposed in [12] to evaluate the statistics of the system statevariables (such as frequency). This allows us to investigatesystem stability when measurements are corrupted with bothdeterministic and random errors, and identify a class of errorswith critical parameter values that cause unsatisfactory systemperformance and even loss of stability.

As an extension of [11], we propose an analytically tractablemethod to examine the impact of different erroneous measure-ments (e.g., errors in frequency measurements, and errors ingeneration output measurements), and to explicitly identifycritical parameter values. To this end, we utilize singularperturbation arguments to derive a reduced-order model ofthe system dynamics. To this end, we assume that the AGC

dynamics dominate the system dynamic behavior in the timescale of interest. With this model, we can analytically examinethe impact of different erroneous measurement variables. Fre-quency measurement errors are shown to be critical to systemstability. We show that although errors in generation outputmeasurements will not affect the system stability characteris-tics, they can significantly degrade system performance. Theaccuracy of the reduced-order model is verified through a casestudy, involving a 68-bus model of the New England/NewYork power system. Specifically, we consider (i) a compre-hensive model capturing the power system electromechanicaldynamics and AGC dynamics (i.e., a full-order model), and(ii) a reduced-order model obtained under the aforementionedassumption. For each of these models, we identify the rangeof error parameter values that destabilize the system. As ex-pected, the parameter value range identified using the reduced-order model is a close approximation of that identified usingthe full-order model.

The remainder of this paper is organized as follows. Sec-tion II presents the modeling framework, including the powersystem electromechanical dynamics model, the AGC sytemmodel, and the measurement model. Section III describesthe proposed assessment method. Section IV showcases theanalysis framework using the reduced-order model obtainedfrom singular perturbation arguments. Section V discussessome issues with practical AGC systems, as well as someideas for detection and mitigation. Section VI illustrates theanalysis framework on a 68-bus power system. Concludingremarks are presented in Section VII.

II. MODELING FRAMEWORK

In this section, we present the modeling framework adoptedin this work, which includes the standard power-system elec-tromechanical dynamics differential algebraic equation (DAE)model, the AGC system model, and the measurement model.

A. Power System Electromechanical Dynamics Model

We describe the electromechanical behavior of a powersystem by a set of DAEs of the form (see, e.g., [13], [14]):

x = f(x, y, u), (1a)0 = g(x, y), (1b)

where x(t) ∈ Rn contains the dynamic states of synchronousgenerators; y(t) ∈ Rm denotes the system algebraic states,including bus voltage magnitudes and angles; u(t) ∈ Rlincludes generator set points; f : Rn+m+l 7→ Rn describesthe evolution of the dynamics states; and g : Rn+m 7→ Rmdescribes the power flow equations.

B. Automatic Generation Control Model

The governor set points u, in (1a), are determined by asecondary frequency control system referred to as automaticgeneration control (AGC). The function of the AGC systemis to reduce the generation and demand mismatch so as tomaintain the system frequency at its nominal value, e.g., 60Hz in North America, and to maintain the net power flow

in tie lines across different balancing authority (BA) areasat its scheduled value. To achieve these objectives, the AGCsystem takes measurements of (i) the frequency in each BAarea, (ii) the tie-line power flow between BA areas, and (iii)the generator output, and calculates the ACE to determine thegenerator set points.

Let Pmeasaa′ denote the measured power interchange fromarea a to a neighboring area a′, P schaa′ denote the scheduledvalue, fmeasa denote the measured area frequency, and fnormdenote the nominal system frequency. Let A denote the set ofall BA areas in the interconnected power system. Then, theACE of each area a ∈ A is defined as

ACEa =∑a′∈Aa

(Pmeasaa′ −P schaa′ )+ba(fmeasa −fnorm),∀a ∈ A,

(2)where ba is the bias factor, and Aa denotes the set of BA areasthat are connected to area a through tie lines.

In this work, we adopt the AGC control logic describedin [2]. To this end, we define a state variable, za, for each areaa ∈ A, which is the sum of the set point values of participatinggenerators in area a. The evolution of za is then described by

za = −za −ACEa +∑i∈Ga

PmeasGi, (3)

where Ga is the set of generators in area a that participate inAGC, and PmeasGi

is the measured power output of generatori in Ga. For each generator i ∈ Ga, the set point P refi isproportional to za, i.e., P refi = κaiza, where the participationfactors κai ’s satisfy

∑i∈Ga κai = 1.

Then, as defined in (1), the set points form u, i.e.,u = {P refi }i∈Ga,a∈A ∈ Rl. Similarly, by stacking the AGCstate variables, we form z = {za}a∈A ∈ Rp. Let γmeas

denote the set of all measurement variables as γmeas :={fmeasa , PmeasGi

, Pmeasaa′ }a∈A,a′∈Aa,i∈Ga ∈ Rq . Then, the AGCsystem can be described compactly as follows:

z = h1(βmeas, z), (4a)u = k(z), (4b)

with h1 : Rp+q 7→ Rp and k : Rp 7→ Rl.

C. Measurement Model

Next, we present the measurement error models consideredin this paper. Two types of common deterministic errors havebeen categorized in [10]. In this paper, we generalize thesedeterministic errors and consider their corresponding randomcounterparts.

1) Deterministic errors: Two types of errors are considered.The first type of error is the one that shifts the true value ofmeasurement i by a constant value α1,i, i.e.,

βmeas1,i = βi + α1,i, (5)

where βi is the actual value. The second type is called scalingerror and is characterized as follows:

βmeas2,i = βi + α2,iβi, (6)

where α2,i ∈ R.

2) Random errors: Like the deterministic error in 5, arandom error that shifts the true value of measurement i canbe described as

βmeas3,i = βi + α3,iwi, (7)

where wi is a Wiener process and α3,i ∈ R. Note thatthis type of error essentially represents white noise becausewhite noise can be viewed as the generalized mean-squarederivative of the Wiener process [15]. Similarly, like the typeof deterministic error in 6, a random error that results in thescaling of measurement i can be described as follows:

βmeas4,i = βi + α4,iβiwi, (8)

where α4,i ∈ R.3) General model : The measurement variables that are

used as inputs to the AGC system can be expressed as afunction of the dynamic state x and the system algebraic statey. Note that although the derivative of bus voltage angles mayappear when calculating the area frequency, the derivative ofy can be expressed as an algebraic function of x and y byusing (1). Assume that there are r measurements corrupted byrandom errors as described by the models in (7) and (8). Then,the measurement model can be generalized and expressed ina compact form as

βmeas = h2(x, y) +

r∑i=1

ηi(x, y)wi, (9)

where h2 : Rn+m 7→ Rq captures the actual measurementvalues and deterministic errors, wi’s are independent Wienerprocesses, and ηi : Rn+m 7→ Rq maps to a zero vector exceptfor one nonzero element that represents the intensity of thecorresponding random error term.

Note that while in this paper we restrict the analysis to theerror models in (5)-(8), it is possible to generalize these further.For instance, as long as the errors can be formulated as con-tinuous deterministic processes or other stochastic processesdriven by Wiener processes, the same analysis method stillapplies. For example, for the errors caused by replay attacks(see, e.g., [16]), the same analysis process follows, exceptthat the system stability will be evaluated in the s-domain byusing Laplace transform due to the time delay appeared in thesystem model. Also for errors that are described by nonlinearfunctions of the measurement variables, the error can still bedescribed by the general model in (9), and the same analysisprocedure applies.

III. ASSESSING THE IMPACT OF MEASUREMENT ERRORS

In this section, we develop a method to assess the impacton power system dynamic performance of the measurementerrors discussed in Section II. In this method, the DAE modelconsisting of (1), (4) and (9) is first linearized along a nominaltrajectory to form a linear stochastic differential equation(SDE) model. Then, stochastic system analysis techniques areused to investigate the impact of random measurement errors.

A. Linearization

Assuming the power system with AGC described by(1), (4) and (9) evolves from a set of initial conditionand the measurements are error free, a nominal trajectory(x∗(t), y∗(t), z∗(t), β∗(t), u∗(t)) results. As a consequenceof measurement errors, the trajectory is perturbed from itsnominal value as follows: x(t) = x∗(t) + ∆x(t), y(t) =y∗(t) + ∆y(t), z(t) = z∗(t) + ∆z(t), β(t) = β∗(t) + ∆β(t),u(t) = u∗(t)+∆u(t). Assume that the functions f, g, h1, k, h2are continuously differentiable with respect to their arguments,and the Jacobian of g(·) in (1b) with respect to y is alwaysinvertable along the trajectories. [The implicit function theo-rem then ensures the existence of an explicit relation betweeny(t) and x(t).] For notational convenience, we drop the depen-dence on t in subsequent developments. Then, by linearizingthe model along the nominal trajectory, and substituting thealgebraic states into the differential equations, we can obtaina linear stochastic differential equation (SDE) model of theform

dX

dt= AX +

r∑i=1

Biηiwi, (10)

where X = [∆xT ,∆zT ]T ∈ Rn+p. Note that the impactof deterministic errors is captured in the matrix A. If Apossesses eigenvalues with positive real parts, it suggests thatthe considered measurement error causes the system to becomeunstable.

Note that because there are physical and logical constraintson certain variables that are not considered in the linearizedmodel, in practice, the measurement errors will not causesystem state variables to diverge without limits. However,these errors will still cause degraded system performance,which will trigger other protection mechanisms. For instance,if the system frequency keeps being outside of the threshold,load shedding or generator tripping may be triggered by under-frequency or over-frequency protection relays.

B. Statistical Moment Analysis

In order to evaluate the impact of random measurement er-rors, we can apply Dynkin’s formula (see, e.g., [12]) to obtaina set of ordinary differential equations (ODEs) describing thedynamics of statistical moments (up to arbitrary order) of thesystem state variables. In this work, we focus on the evolutionof the state mean and covariance; the explicit derivation of theequations that govern these can be found in [17].

1) The impact of random error with constant intensity: Forthe error model described in (7), since α3,i is a constant, ηimaps to a constant vector. Then, we have that the first andsecond moments of X in (10) evolve according to

dE[X]

dt= AE[X], (11a)

dΣ

dt= AΣ + ΣAT +B1η1η

T1 B

T1 , (11b)

where Σ = E[XXT ].Assume the original system without measurement errors is

stable, meaning that the real parts of the eigenvalues of Aare negative. Equation (11a) shows that the state mean is not

affected by the error term and converges to zero eventually.Letting the left-hand side of (11b) be zero results in a Lya-punov equation. Since matrix B1η1η

T1 B

T1 is symmetric and

positive definite, the Lyapunov stability theorem guaranteesthat there exists a positive definite matrix Σ satisfying thisLyapunov equation [18], meaning that the covariance matrixsteady-state value exists and is finite.

2) The impact of random error with scaling intensity:Here, we show that the random error model in (8) maycause the system state covariance matrix to become unstable,which means that the system will not converge in the meansquare sense and the realized system sample path will beunstable [19]. To this end, let ∆βi = ∆βi + α4,i∆βiwi.Through linearization and substitution of algebraic states usingthe power flow equations, we can obtain that η1 can beevaluated as:

η1 = α4,1H1X,

where H1 ∈ Rq×(n+p). Then (10) becomes

X = AX + α4,1B1H1Xw1 := AX + α4,1B1Xw1, (12)

where B1 ∈ R(n+p)×(n+p) equals B1H1.The equations governing the evolution of the first and

second moments of X are given by

dE[X]

dt= AE[X], (13a)

dΣ

dt= AΣ + ΣAT + α2

4,1B1ΣB1T. (13b)

In this case, it is possible that the system (13b) is unstabledue to α2

4,1B1ΣB1T

. In order to evaluate the effects on systemstability, we rearrange the entries of the matrix Σ into a vectorΦ. Define the ith row of Σ by Σi; then Φ = [Σ1Σ2 · · ·Σn+p]T .Thus, equation (13b) can be rewritten as

dΦ

dt= DΦ, (14)

where D = I ⊗ A + A ⊗ I + α24,1B1 ⊗ B1, I denotes a

(n+p)×(n+p) identity matrix, and ⊗ denotes the Kroneckerproduct [20]. By properly choosing α4,1, it is possible to makepositive the real part of some of the eigenvalues of D, whichwould cause the system to become unstable. Note that at thispoint, even though the system state mean is stable; the systemstate covariance becomes unstable. Eventually, this causes thedivergence of system states in a realized sample path.

3) The impact of multiple general random errors: Note thatbesides these two common types of random errors describedearlier, for any continuous error function ηi’s, the same methodapplies. For multiple measurement errors, (13b) becomes

dΣ

dt= AΣ + ΣAT +

r∑i=1

α24,iBiΣB

Ti ,

where Bi = 0 if ηi maps to a constant vector. The effects onsystem stability can be evaluated by following the aforemen-tioned procedure of constructing (14); the matrix D in (14) isdetermined based on the scaling parameters, i.e., α4,i’s.

IV. ANALYSIS WITH REDUCED-ORDER MODELS

In this section, we utilize singular perturbation arguments(see, e.g., [21], [22]) to derive a reduced-order model of thesystem dynamics. With this simplified model, we are ableto (i) explicitly investigate the impact of different erroneousmeasurements (e.g., erroneous frequency measurement, anderroneous generation output measurements); and (ii) estimatethe range of parameter values that will make the system failto perform satisfactorily.

A. Reduced-Order Dynamic Model

We assume that the time constants associated with theelectromechanical dynamics are much smaller than those as-sociated with the AGC system. Therefore, the time scales ofthese two subsystems can be decoupled, and we expect theAGC dynamics to dominate the system dynamic behavior inthe time scale of interest. [Similar argument has been utilizedin AGC system studies; see, e.g., [23].] Then, the set of DAEsthat describes the electromechanical dynamics are convertedto algebraic equations by setting the left-hand side of (1) tobe zero, and a reduced-order model is obtained. Note that onemay argue that this assumption is not totally valid due to thehigh inertia of some generators in the bulk power system.However, although there is small discrepancy between thetrajectory that results from the full-order model and the tra-jectory that results from the reduced-order model, the stabilityproperties are preserved between the full- and reduced-ordermodels given the original system (1) is stable, meaning that ifthe measurement error destabilizes the reduced-order model,it will destabilize the original system as well, and vice versa.This claim follows from the result of Theorem 5.1 in [22],which states that the difference between the full-order modeltrajectory and that of the reduced-order model is on the orderof the magnitude of the ratio of the fast and slow subsystemtime constants; therefore the difference is bounded. In addition,we assume that the transmission network is lossless, whichimplies that the total generation output is equal to the totaldemand, i.e.,

∑i∈G PGi

=∑j∈D PDj

, where G indicatesthe set of all generators, PGi

denotes the electrical outputof generator i, D indicates the set of all the loads in thepower system, and PDj denotes the demand at load j. Withthese three assumptions, a reduced-order dynamic model canbe derived.

Let Pi denote the turbine power, and P refi denote thegenerator set point of unit i. Then, the inertia response andgovernor response of unit i is given by (see, e.g., [24]):

Midωidt

= Pi − PGi −Di(ωi − ωs), (15a)

TidPidt

= −Pi + P refi − 1

Ri(ωi − ωs), (15b)

where ωi is the machine electrical rotational speed, while ws isthe system synchronous speed; Di is the damping coefficient;Mi is the scaled machine inertia constant; Ti is the governortime constant; the gain Ri determines the slope of the governordroop characteristic; and PGi

is the power output.In steady state, the left-hand side of (15) is set to zero,

and the governor control induces a steady-state error in the

frequency, which causes all generators to rotate at the samespeed, i.e., ωi = ωo,∀i ∈ G. Then, by summing (15) overall generators, the following algebraic relationship can beobtained:

z −∑i∈G

PGi = β∆f, (16)

where ∆f = (ωo − ωs)/2/π, and β = 2π∑i∈G( 1

Ri+ Di),

which is called the frequency response characteristic [25].Then, by solving for ∆f , we obtain

∆f =z −

∑i∈G PGi

β. (17)

Without loss of generality, we focus on the case of a singleBA area and drop the subscript that indicates the BA area inthe following developments. Then, we have that ACE = b∆f ,and

z = −z − b∆f +∑i∈G

PGi. (18)

Plugging (17) into (18) and utilizing the lossless transmissionnetwork assumption, we obtain that

z = −b+ β

β(z −

∑i∈D

PDi).

If b is set to be β as suggested in [25], the AGC dynamicmodel becomes z = −2z + 2

∑i∈D PDi

, which is a stableODE.

B. Impact of Erroneous Frequency Measurement

As discussed earlier, since the errors described in (5) and(7) will not affect system stability in the mean square sense,we mainly focus on the impact of the scaling errors in (6)and (8). Assume that there is a scaling error in the frequencymeasurement, fmeas = f + α2∆f (i.e., ∆fmeas = ∆f +α2∆f ). Then, by replacing the true frequency value with theerroneous measurement in (18), we obtain that

z = −b(1 + α2) + β

β(z −

∑i∈D

PDi). (19)

Now, if α2 < −βb − 1, the system in (19) becomes unstable.Note that if b = β, then a value of α2 smaller than −2 meansthat the measured frequency deviation, ∆f , has the oppositesign to that of the correct value.

Assume the error is of random nature and can be describedby the model in (8), i.e., fmeas = f + α4∆fw. Then, byreplacing the error-free frequency measurement in (18) withthis erroneous measurement model, we obtain

z = −(b+ β)∆f − bα4∆fw

= −b+ β

β(z −

∑i∈D

PDi)−bα4

β(z −

∑i∈D

PDi)w. (20)

Referring to the analysis in Section III, we can see that if

|α4| >√

2(b+β)βb2 , the system in (20) does not converge in the

mean square sense.

C. Impact of Erroneous Generation Output Measurement

Assume that there are deterministic errors in the outputmeasurement of generator k, i.e., PmeasGk

= PGk+ α2PGk

,and the participation factor of this generator is κk. Then, from(17), we obtain that

PGk= κkz − (

1

Rk+Dk)2π∆f.

Then, the total generation output measurement is∑i∈G

PmeasGi= PmeasGk

+∑i 6=k

PGi

= z − β∆f + α2(κkz − (1

Rk+Dk)2π∆f).

Replacing the actual generation output value with that result-ing from an erroneous measurement, we have

z = (α2κk − ξ)z − ξ∑i∈D

PDi, (21)

where ξ =b+β+2πα2(

1Rk

+Dk)

β .For α2 >

b+ββκk−( 1

Rk+Dk)

, the AGC system becomes unsta-

ble. Note that if κk =1

Rk+Dk∑

i1Ri

+Di, there exists no α2 that

destabilizes the system. However, this error can make thesystem frequency converge to an unacceptable value (e.g.,below a certain threshold that triggers load shedding schemes).By setting the right-hand side of (21) to zero, the frequencydeviation in steady state is α2κk

∑PGi

b+β−α2(κkβ− 1Rk−Dk)

. Note thatthis frequency deviation value is proportional to the total valueof the demand, which can be very large. As shown in the casestudy section, this error can easily make the system frequencygo beyond the acceptable threshold.

If the error is of random nature and is described in (8), i.e.,PmeasGk

= PGk+ α4PGk

w, we have

z = −b+ β

β(z −

∑i∈D

PDi) + ζ(z)w, (22)

where ζ(z) = α4(κk −1

Rk+Dk

β )z + α4

1Rk

+Dk

β

∑i∈D PDi

.

Denote C1 = − b+ββ , C2 = α4κk − α4

1Rk

+Dk

β , and C3 =α4κk

∑i∈D PDi

β . Using the method described in Section III, weobtain that

dE[∆f ]

dt= C1E[∆f ],

dE[∆f2]

dt= (2C1 + C2

2 )E[∆f2] + +2C2C3E[∆f ] + C23 ,

from which, we can see that the frequency mean convergesto zero. If 2C1 + C2

2 > 0, the system becomes unstablein the mean square sense; otherwise, the frequency varianceconverges to a nonzero value, − C2

3

2C1+C22

, which may causeviolations of some frequency requirement standards, e.g.,CPS1 [26].

D. Two-Area System Reduced-Order Model

A similar procedure is also applicable to a two-area system.In this case, the dynamics of the AGC variables are given by:

z1 = −z1 −ACE1 +∑i∈G1

PmeasGi, (23a)

z2 = −z2 −ACE2 +∑j∈G2

PmeasGj, (23b)

where

ACE1 = Pmeas12 − P sch12 + b1(fmeas1 − fnorm),

ACE2 = Pmeas21 − P sch21 + b2(fmeas2 − fnorm).

By assuming that f1 = f2, and similar to (16), we have that:

z1 −∑i∈G1

PGi= β1∆f, (24a)

z2 −∑j∈G2

PGj = β2∆f, (24b)

where β1 =∑i∈G1( 1

Ri+Di), and β2 =

∑j∈G2( 1

Rj+Dj).

Again, assuming that the transmission network is lossless,we have that ∑

i∈G1

PGi=

∑i∈D1

PDi+ P12, (25a)∑

j∈G2

PGj =∑j∈D2

PDj + P21, (25b)

P12 = −P21. (25c)

Plugging (25) into (24), we can solve for ∆f and P12:

∆f =1

β1 + β2(z1 + z2 −

∑i∈D

PDi); (26a)

P12 =β1

β1 + β2(z1 −

∑i∈D1

PDi)−β2

β1 + β2(z2 −

∑j∈D2

PDj ).

(26b)

Then, if there are no measurement errors, by substituting(26) into (23), the dynamics of the AGC variables becomes

z1 =− β1 + β2 + b1β1 + β2

z1 −b1

β1 + β2z2

+β1 + β2 + b1β1 + β2

∑i∈D1

PDi+

b1β1 + β2

∑j∈D2

PDj+ P sch12 ,

z2 =− β1 + β2 + b2β1 + β2

z2 −b2

β1 + β2z1

+β1 + β2 + b2β1 + β2

∑j∈D2

PDj+

b2β1 + β2

∑i∈D1

PDi+ P sch21 .

Here we can see that the system is stable as the two eigenval-ues are −1 and −1− b1+b2

β1+β2.

Following the same procedure as in Sections IV.B and IV.C,we can evaluate the impact of errors in various measurements.For instance, we can show that if there are scaling errorsin the frequency measurements of both areas, fmeas1 = f +

α2,1∆f, fmeas2 = f+α2,2∆f , the dynamics of AGC variablesbecomes

z1 =− β1 + β2 + b1(1 + α2,1)

β1 + β2z1 −

b1(1 + α2,1)

β1 + β2z2

+β1 + β2 + b1(1 + α2,1)

β1 + β2

∑i∈D1

PDi

+b1(1 + α2,1)

β1 + β2

∑j∈D2

PDj + P sch12 , (27a)

z2 =− β1 + β2 + b2(1 + α2,2)

β1 + β2z2 −

b2(1 + α2,2)

β1 + β2z1

+β1 + β2 + b2(1 + α2,2)

β1 + β2

∑j∈D2

PDj

+b2(1 + α2,2)

β1 + β2

∑i∈D1

PDi+ P sch21 . (27b)

Then, if α2,1 < −1 − β1

b1and α2,2 < −1 − β2

b2, one of the

two eigenvalues becomes positive; thus, the system in (27)becomes unstable. If there is a scaling error in the frequencymeasurement of one area, fmeas1 = f + α2,1∆f , similarly,we can show that if α2,1 < −1 − β1+β2+b2

b1, one of the

two eigenvalues becomes positive; thus, the system becomesunstable.

Similarly, if there are scaling errors in the interchange powermeasurements, Pmeas12 = P12 + α2,3P12, replacing the truemeasurement with the erroneous measurement in (23), thedynamics of z1 becomes

z1 =− β1 + β2(1 + α2,3) + b1β1 + β2

z1 −b1 − α2,3β1β1 + β2

z2 (28a)

+β1 + β2(1 + α2,3) + b1

β1 + β2

∑i∈D1

PDi(28b)

+b1 − α2,3β1β1 + β2

∑j∈D2

PDj+ P sch12 . (28c)

Again by checking the values of the eigenvalues, we candetermine whether or not the measurement error destabilizesthe system. If not, we can also check whether the measurementerror makes the system frequency converge to an unacceptablevalue by setting the left-hand side of (28) to zero and solvingfor the steady-state values of z1, z2 and ∆f .

V. DISCUSSIONS WITH PRACTICAL AGC SYSTEMS

In this section, we discuss the impact of measurementerrors in the context of practical AGC systems, where AGCsuspension mechanisms are implemented. From a defensepoint of view, we also discuss the challenge of detectingmeasurement errors in SCADA systems and propose ideas toaddress this challenge by integrating the SCADA system withthe wide area measurement system (WAMS).

A. AGC with Suspension Schemes and Load Shedding

In practice, some AGC implementation guidelines are rec-ommended in order to limit the impact of erroneous measure-ments and emergency events. The western electricity coordi-nating council (WECC) suggests that AGC suspension should

be considered when the system frequency deviation is greaterthan a threshold, fagc [27]. At the same time, underfrequencyload shedding relays are commonly installed to shed load whenthe frequency is below a threshold, fld [10]. In this regard, ifthe frequency measurement used by AGC reaches the thresh-old fagc before the actual frequency falls below fld, AGC willbe suspended, and the impact on system performance willbe limited. On the other hand, if the actual frequency fallsbelow the threshold fld before AGC is suspended, the lowfrequency value will trigger load shedding. Therefore, for thedeterministic scaling attack on the frequency measurementsto cause a severe impact, it must be engineered in such away that the erroneous measurement does not trigger the AGCsuspension, i.e.,

|∆fmeas| = |∆f + α2∆f | < fagc,

when the actual frequency reaches the limit to trigger loadshedding, i.e.,

fnorm + ∆f = fld,

which gives an extra constraint on the parameter α2: α2 <−1 +

fagc

fld−fnorm.

For the case of a random attack, there is a non-zeroprobability that the erroneous frequency measurements willreach the suspension threshold fagc. However, WECC alsorecommends that the lower-than-threshold condition should beverified for a few of the AGC execution cycles before actuallysuspending it, in order to avoid frequent suspension. Takingthis into account, the probability for erroneous frequencymeasurements to be consecutively lower than the thresholdis very small. Therefore, it is still very likely that such attackswould cause serious impacts on system operations.

B. Error Detection and Mitigation

Even with the current AGC suspension protection mech-anism described above, the aforementioned potential severeimpact of erroneous measurements highlights the importanceof integrity in the measurements used by AGC systems. Thus,error detection methods are required to maintain measurementintegrity.

The integrity of power measurements can be protected bybad data detection mechanisms implemented in the SCADAsystem state estimation process; this has been extensivelystudied (see, e.g., [28]). However, it is difficult to ensure theintegrity of frequency measurements because the frequencyvariable is not included in the SCADA steady-state estimationprocess. One way to address this issue, implied by the steady-state study on AGC attacks in [23], is to utilize the steady-staterelationship between the power mismatch and the frequency in(17). However, since this is based on the reduced-order modelobtained via singular perturbation, this method may not beaccurate when system dynamics are considered.

Another method is to incorporate synchrophasor measure-ments, provided by phasor measurement units (PMUs) in thewide-area measurement system (WAMS), into the SCADAsystem. One intuitive way is to compare frequency mea-surements from the SCADA system with those measured byPMUs. But when there is a discrepancy, it is difficult to

determine which ones should be trusted. To address this issue,we utilize the fact that PMUs measure frequencies based onthe derivative of phase angles, the integrity of which canbe detected via state estimation in the SCADA system. Inother words, PMU relates the frequency measurements withthe variables that are used in the SCADA state estimator.If the frequency measurement from a PMU is offset, thephasor angle measurement will also be inaccurate. This canbe directly detected through the bad data detection algorithmsin the state estimator. Consider an error ε is introduced tothe PMU frequency measurement. It will cause an error of360Tε degrees in the angle measurement for a short periodof time T , which will be well beyond the tolerance margin ofthe bad data detection algorithm. Therefore, the errors addedto the frequency measurements can be detected by integratingSCADA and WAMS systems.

VI. CASE STUDIES

In this section, we demonstrate the impact of the aforemen-tioned measurement errors on a 68-bus 16-machine system,which is a representative model of the New England/New Yorkinterconnected power system. Its one-line diagram and detaileddescription can be found in [29]. Each of the 16 generatorunits is modeled by a combination of a synchronous machinemodel, an exciter model, a power system stabilizer model,and a turbine/governor model. We utilized the MATLAB-based Power System Toolbox (PST) to implement the AGCalgorithms and simulate the system dynamics. The data ofthis system is part of the PST suite and can be found in[30]. The linearized system is also obtained by making useof the the small-signal analysis function provided in PST. Theeigenvalue corresponding to the AGC system is −0.001, whilethe largest one of the rest eigenvalues that correspond to thesystem electromechanical dynamics is −0.1004. The high ratioof these two eigenvalues supports the singular perturbationargument utilized in Section IV to derive a reduced-ordermodel. In addition, we also validate the resulting reduced-order model by comparing the critical error parameter valuesobtained using the full- and reduced-order models respectively.

A. Accuracy of the Linearized ModelBefore proceeding with the impact analysis, we first verify

the accuracy of our linearization procedure when utilized tostudy the New England/New York system model with AGC.To this end, we consider two scenarios and compare thetrajectories obtained by simulating the nonlinear system modelwith those obtained through the linearized model.

First, we assume that there is a 0.1 p.u. variation from thenominal value in each load. We plot the resulting trajectoriesof the frequency deviation obtained with the nonlinear and lin-earized models in Fig. 1(a). In the second scenario, we assumethat there are random errors in the frequency measurements.The measurement error is assumed to be white noise. Theresults are shown in Fig. 1(b), where we plot one sample pathof the resulting frequency deviation trajectories obtained withthe nonlinear model and linearized models. As one can see, inboth cases the linearized system trajectory approximates thenonlinear system trajectory closely.

t [s]0 5 10 15 20fr

eq.deviation

[p.u.]

×10-5

-20

-10

0

Nonliear model with AGCLinear model with AGC

(a) Frequency deviation with load vari-ation.

t [s]0 5 10 15 20fr

eq.deviation

[p.u.]

×10-7

-4

-2

0

2

Nonlinear modelLinearized model

(b) Frequency deviation with whitenoise errors.

Figure 1: Validation of linearization process.

B. Impact of Deterministic Errors

1) Impact of erroneous frequency measurement: We focuson the impact of the scaling errors discussed in Section IV-B.First from the reduced-order model in (18), we obtain thatthe error parameter α2 should be less than −2 in order forthe system to become unstable. With the full-order modeldescribed in (1), (4) and (9), after linearization and checkingthe eigenvalues of the matrix in (10), we find that with theerror parameter being less than −1.98, the system becomesunstable. The small mismatch may come from the losslessnetwork assumption. The relationship between the maximumreal part of the eigenvalues and the error parameter is de-picted in Fig. 2(a). Note that due to the fact that there isalways a theoretical zero eigenvalue (a result of choosing oneangle variable as the reference angle in PST), the maximumeigenvalue is zero when the system is stable. We also varythe system operating point by randomly changing the loadand generation values 100 times. At each time, the load andgeneration values at each bus are multiplied by a independentrandom variable, which is uniformly distributed between 0.5and 1.2. Except for the cases that are not feasible (i.e., nopower flow solutions), the critical point stays at −1.98 for allthe other cases as shown in Fig. 2(b). Choose α2 = 2.1, andthe full-order model is used in the simulation. The resultingsystem frequency and the AGC variable z (i.e., the sum of thegenerators’ set points) are depicted by the red dashed line inFig. 3, which illustrates that the system becomes unstable.

Note that in practice, the AGC is implemented in discretetime; thus we also simulate the system performance with adiscrete implementation of the AGC model with a sample-and-hold period of 2s, and the results are plotted by theblue solid line in Fig. 3 as well, which shows that thesystem is unstable and the system variables even diverge moreseverely. In the remainder, we simulate the AGC dynamicsaccording to a discrete-time implementation of a continuous-time model, which makes the system response faster than thatof the conventional sample-and-hold based AGC implementa-tion. However, the stability characteristics hold the same forsystems with AGC operated in continuous time and discretetime.

2) Impact of erroneous generation output measurement:Deterministic errors are added to the generation output mea-surement. The results of our experiments are consistent withthe analysis on the generation measurement errors in Sec-tion IV-C. This type of error does not destabilize the systemwhen described by the linear model or the full-order model.

attack parameter-3 -2 -1 0

eigvalue

0

0.2

0.4

(a) Eigenvalues for base case.case #

0 20 40 60

parametercriticalpoint

0

1

2

3

(b) Critical points for various cases.

Figure 2: Eigenvalue.

t [s]0 20 40 60 80

freq.deviation

[Hz]

-0.15

-0.1

-0.05

0

Discrete timeContinuous time

(a) System frequency.

t [s]0 20 40 60 80

AGC

sign

alz[p.u.]

150

160

170

180

Discrete timeContinuous time

(b) AGC variable z.

Figure 3: Deterministic error in frequency measurement.

But the error will drive the system frequency beyond thesatisfactory region (here we consider frequency deviationbeing smaller than 0.05 Hz as satisfactory performance). Forthis system, if the scaling error with α2 being 0.061 isintroduced in the generation output measurement of generationunit 16, the dynamics of the system variables (i.e., the systemfrequency and the AGC variable z) are depicted in Fig. 4,where one can see that the system converges to a steady state.However, the absolute value of the system frequency deviationstays larger than 0.05 Hz. Also note that the critical value ofα2 depends on the total value of demand. Therefore, if thepower demand in this system is doubled, α2 = 0.03 will drivethe system frequency beyond the safety region.

t [s]0 10 20 30 40

freq.deviation

[Hz]

-0.06

-0.04

-0.02

0

(a) System frequency.

t [s]0 10 20 30 40

AGC

sign

alz[p.u.]

182.5

183

183.5

184

184.5

(b) AGC variable z.

Figure 4: Deterministic error in generation measurement.

C. Impact of Random Errors

1) Impact of erroneous frequency measurement: Considerthe scaling random error model in (8). First, by using (20),we obtain that the error parameter α4 should be larger than 2in order to drive the system to be unstable in the mean squaresense. Then, with the full-order model as described in (1),(4) and (9), after linearization and checking the eigenvaluesof the matrix in (10), we find that for the error parameterbeing larger than 2.3, the system becomes unstable in themean square sense. In order to get the statistics of the systemstate variables, one can numerically solve the ODEs in (13b)that govern the evolution of state variables’ first and secondmoments. An alternative is to run a Monte Carlo simulation10, 000 times and estimate the statistics using the resulting10, 000 sample paths. For α4 = 2.4, the mean and variance ofthe frequency deviation when using both methods are plottedin Figs. 5(a) and 5(b). The closeness of the results obtainedfrom both methods verifies the accuracy of our stochasticsystem analysis procedure. The figure also shows that althoughthe mean stays stable, the variance diverges. Thus, the systembecomes unstable in the mean square sense. One unstablesample path of the system frequency is depicted in Fig. 5(c).

2) Impact of erroneous generation output measurement:The results of our experiment are consistent with the analysiswith the reduced-order model in (22). This type of measure-ment error does not destabilize the system with either thelinear system or the full-order system model in the meansquare sense. Following the same Monte Carlo and ODEsimulation procedure described above, the mean and varianceof the frequency deviation are obtained. The mean convergesto zero. Fig. 6(a) depicts the variance when the scaling randomerror with α4 = 0.061 is injected into the generation outputmeasurement of unit 16. This figure confirms that unlike theimpact of random errors in frequency measurements that maydestabilize the system, in this case the variance will convergebut not zero. One sample path of the frequency deviation isplotted in Fig. 6(b), from which we can observe that althoughthe system converges in the mean square sense, the frequencydeviation is still very likely to go beyond the safety region(e.g., smaller than −0.05 Hz) due to the large variance.

VII. CONCLUDING REMARKS

This paper proposed a method to assess the impact onpower system dynamic performance of various errors in the

t [s]0 5 10 15 20fr

eq.dev.var[H

z2]

×10-3

0

1

2

3

(a) Variance of frequency deviation.

t [s]0 10 20 30 40

freq.deviation

[Hz]

-0.1

-0.05

0

0.05

(b) Sample path of frequency deviation.

Figure 6: Case with random error in generation measurement.

measurements utilized by the AGC system. With this method,not only can we evaluate the impact of deterministic errorsbut also that of random errors. We can also identify the crit-ical measurement errors that significantly degrade the systemperformance and cause the system to become unstable.

We have observed that although AGC is robust to constantintensity (white noise) errors, a class of random error withscaling intensity will cause the system to become unstable inthe mean square sense (i.e., divergence of the system state forrealized sample paths). Also with the reduced-order systemmodel derived, we have observed that scaling (deterministicand random) errors in the frequency measurements can causethe system to become unstable, while errors in the generationoutput measurements can drive the system to converge to astate that is not satisfactory in terms of performance. Themethod was applied to a 68-bus New England/New Yorkpower system to numerically verify the above statements.

REFERENCES

[1] “Vulnerability analysis of energy delivery control systems,” IdahoNational Laboratory, Sep. 2011. [Online]. Available: http://energy.gov/

[2] A. Wood and B. Wollenberg, Power Generation, Operation, and Control.New York, NY: Wiley, 1996.

[3] S. Wang, X. Meng, and T. Chen, “Wide-area control of power systemsthrough delayed network communication,” IEEE Transactions on Con-trol Systems Technology, vol. 20, no. 2, pp. 495–503, Mar. 2012.

[4] J. Zhang and A. D. Domínguez-García, “On the impact of communica-tion delays on power system automatic generation control performance,”in Proc. of North American Power Symposium, Sep. 2014.

[5] F. Pasqualetti, F. Dorfler, and F. Bullo, “Attack detection and identi-fication in cyber-physical systems,” IEEE Transactions on AutomaticControl, vol. 58, no. 11, pp. 2715–2729, Nov. 2013.

[6] S. Amin, A. A. Cárdenas, and S. S. Sastry, “Safe and secure networkedcontrol systems under denial-of-service attacks,” in Proc. of Interna-tional Conference on Hybrid Systems: Computation and Control, 2009.

[7] L. Schenato, B. Sinopoli, M. Franceschetti, K. Poolla, and S. Sastry,“Foundations of control and estimation over lossy networks,” Proceed-ings of the IEEE, vol. 95, no. 1, pp. 163–187, Jan. 2007.

t [s]0 5 10 15 20fr

eq.dev.mean[H

z]

×10-3

-3

-2

-1

0

1

Monte Carlo simulationDynkin's Formula

(a) Frequency deviation mean.

t [s]0 5 10 15 20fr

eq.dev.var[H

z2]

×10-5

0

2

4Monte Carlo simulationDynkin's formula

(b) Frequency deviation variance.

t [s]0 20 40 60 80

freq.deviation

[Hz]

-0.2

0

0.2

0.4

0.6

(c) Sample path of frequency deviation.

Figure 5: Case with random error in frequency measurement.

[8] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks againststate estimation in electric power grids,” in Proc. of ACM Conferenceon Computer and Communications Security, 2009, pp. 21–32.

[9] L. Xie, Y. Mo, and B. Sinopoli, “False data injection attacks in electricitymarkets,” in Proc. of IEEE International Conference on Smart GridCommunications, Oct. 2010, pp. 226–231.

[10] S. Sridhar and G. Manimaran, “Data integrity attacks and their impactson scada control system,” in Proc. of IEEE Power and Energy SocietyGeneral Meeting, Jul. 2010.

[11] J. Zhang and A. D. Domínguez-García, “On the failure of power systemautomatic generation control due to measurement noise,” in Proc. ofIEEE Power and Energy Society General Meeting, Jul. 2014.

[12] J. Hespanha, “Modeling and analysis of stochastic hybrid systems,” IEEProceedings - Control Theory and Applications, vol. 153, no. 5, pp. 520– 535, Sep. 2006.

[13] P. Sauer and M. Pai, Power System Dynamics and Stability. Prentice-Hall, 1998.

[14] Y. Chen and A. Domínguez-García, “A method to study the effectof renewable resource variability on power system dynamics,” IEEETransactions on Power Systems, vol. 27, no. 4, pp. 1978–1989, 2012.

[15] B. Øksendal, Stochastic Differential Equations: An Introduction withApplications. Springer, 2010.

[16] Y. Mo and B. Sinopoli, “Secure control against replay attacks,” in Proc.of the Allerton Conference on Communication, Control, and Computing,Sep. 2009, pp. 911–918.

[17] F. Schweppe, Uncertain dynamic systems. Prentice-Hall, 1973.[18] H. Khalil, Nonlinear Systems. Prentice-Hall, 2002.[19] B. Hajek, An Exploration of Random Processes for Engineers. [Online]

http://www.ifp.illinois.edu/ hajek/Papers/randomprocJan14.pdf, 2014.[20] R. Horn and C. Johnson, Topics in Matrix Analysis. New York, NY:

Cambridge University Press, 1991.[21] R. E. O’Malley and L. R. Anderson, “Time-scale decoupling and order

reduction for linear time-varying systems,” Optimal Control Applicationsand Methods, vol. 3, no. 2, pp. 133–153, 1982.

[22] P. Kokotovic, H. Khalil, and J. O’Reilly, Singular Perturbation Methodsin Control: Analysis and Design. Academic Press, 1986.

[23] S. Sridhar and M. Govindarasu, “Model-based attack detection andmitigation for automatic generation control,” IEEE Transactions onSmart Grid, vol. 5, no. 2, pp. 580–591, Mar. 2014.

[24] A. D. Domínguez-García, “Models for impact assessment of wind-basedpower generation on frequency control,” in Control and OptimizationMethods for Electric Smart Grids, Power Electronics and Power Sys-tems. Springer-Verlag, 2012.

[25] J. Glover, M. Sama, and T. Overbye, Power Systems Analysis andDesign. Upper Saddle Rever, NJ: Thompson-Engineering, 2008.

[26] L. Wang and D. Chen, “Extended term dynamic simulation for agcwith smart grids,” in Proc. of IEEE Power and Energy Society GeneralMeeting, Jul. 2011.

[27] “Western electricity coordinating council guidelines for suspendingautomatic generation control,” WECC Operations Committee. [On-line]. Available: https://www.wecc.biz/Reliability/Guidelines\%20For\%20Monitoring\%20and\%20scheduling\%20remote\%20generation.pdf

[28] E. Handschin, F. Schweppe, J. Kohlas, and A. Fiechter, “Bad dataanalysis for power system state estimation,” IEEE Transactions on PowerApparatus and Systems, vol. 94, no. 2, pp. 329–337, 1975.

[29] G. Rogers, Power system oscillations. Kluwer Academic Publishers,2000.

[30] Power system toolbox. [Online]. Available: http://www.eps.ee.kth.se/personal/vanfretti/pst

Jiangmeng Zhang (S’10) received the B.S. degreein automatic control from Xi’an Jiaotong University,Xi’an, Shaanxi, China, in 2010, and the M.S. andPh.D. degrees in electrical engineering from theUniversity of Illinois at Urbana-Champaign, Urbana,IL, USA in 2012 and 2016, respectively.

Her research interests include power systemanalysis, uncertainty impact evaluation, and cyber-physical security. She is currently a quantitativeresearcher at Citadel with a focus on the uncertaintyimpact on power and energy markets.

Alejandro D. Domínguez-García (S’02, M’07)received the degree of “Ingeniero Industrial" fromthe University of Oviedo (Spain) in 2001 and thePh.D. degree in electrical engineering and computerscience from the Massachusetts Institute of Technol-ogy, Cambridge, MA, in 2007.

He is an Associate Professor in the Electrical andComputer Engineering Department at the Universityof Illinois at Urbana-Champaign, where he is affili-ated with the Power and Energy Systems area; healso has been a Grainger Associate since August

2011. He is also an Associate Research Professor in the Coordinated ScienceLaboratory and in the Information Trust Institute, both at the University ofIllinois at Urbana-Champaign.

His research interests are in the areas of system reliability theory andcontrol, and their applications to electric power systems, power electronics,and embedded electronic systems for safety-critical/fault-tolerant aircraft,aerospace, and automotive applications.

Dr. Domínguez-García received the National Science Foundation CAREERAward in 2010, and the Young Engineer Award from the IEEE Power andEnergy Society in 2012. In 2014, he was invited by the National Academyof Engineering to attend the U.S. Frontiers of Engineering Symposium, andselected by the University of Illinois at Urbana-Champaign Provost to receivea Distinguished Promotion Award. In 2015, he received the U of I College ofEngineering DeanÕs Award for Excellence in Research.

He is an editor of the IEEE TRANSACTIONS ON POWER SYSTEMSand the IEEE POWER ENGINEERING LETTERS.