Detection of Stealthy False Data Injection Attacks in Modular Multilevel Converters

: A modular multilevel converter (MMC) in a high-voltage direct-current (HVDC) transmission system consists of an electric-coupled physical system and a communication-coupled cyber system, leading to a cyber-physical system (CPS). Such a CPS is vulnerable to false data injection attacks (FDIA), which are the main category of cyberattacks. FDIAs can be launched by injecting false data into the control or communication system of the MMC to change the submodule (SM) capacitor voltage seen by the central controller. Consequently, the capacitor voltage of the attacked SM will deviate from its normal value and thus threaten the safe operation of the converter. Stealthy FDIAs characterized by elaborated attack sequences are more dangerous because they can deceive and bypass the attack detector presented in the existing literature for the MMC. To address this issue, this paper proposes a stealthy FDIA detection method to obtain the real SM capacitor voltages. Thus, the attacked SM can be located by comparing its real capacitor voltage with prespeciﬁed thresholds. Simulation results validate the effectiveness of the proposed detection and protection strategies.


Introduction
Compared to alternating current transmission systems, high-voltage direct-current (HVDC) electric power transmission technology offers various advantages. It is capable of high-power transfer over long distances with lower cost and higher efficiency. In the past two decades, many HVDC projects have been developed, such as the Transbay Cable project in the United States [1], the Ultranet project in Germany [2], and the Zhoushan project in China [3].
The modular multilevel converter (MMC) is the predominant topology implemented in recent voltage source converter-based HVDC (VSC-HVDC) transmission projects. It features many advantages, such as modularity, scalability, reduced voltage stress on power switches, and high-quality output waveforms [4,5]. Since Prof. R. Marquardt proposed this topology in 2001 [6], plenty of studies have been carried out to optimize the design and operation performance of the converter. Research topics on MMC include submodule (SM) capacitor voltage balancing [7,8], circulating current suppression [9], modulation methods [10,11], IGBT open-circuit fault diagnosis [12,13], model predictive control [14], and so on. However, little attention has been paid to cyberattacks in the MMC. The modern power system, including the MMC-based HVDC transmission, is a cyberphysical system (CPS), which means that the system is composed of an electric-coupled physical system and a communication-coupled cyber system. The CPS architecture is illustrated in Figure 1a [15]. Cybersystems link with physical systems through communication networks, sensors, and actuators. The CPS integrates real-world hardware, digital software, and networking elements to monitor and manage physical processes. This integration enhances interaction with physical processes; however, such a system is vulnerable to cyberattacks [16][17][18]. The architecture of the power system, including MMC-based HVDC converter stations, is shown in Figure 1b. In the HVDC converter station, the control center, or supervisory control and data acquisition (SCADA) system, monitors and manages the MMC hardware circuit through the communication infrastructure. Moreover, one converter A cyberattack is any offensive maneuver that targets communication networks, control centers, and infrastructure, which can threaten the safe operation of a CPS. Examples of cyber-physical attacks include slammer worm penetration in the control system of a nuclear plant [19], attacks on circuit breakers [20], power blackouts in Ukraine [21], and nuclear fuel enrichment facilities attacked by the Stuxnet worm [22]. To deal with cyberattacks and ensure system security, an effective diagnosis strategy must be designed for CPSs. There are several types of cyberattacks, such as random attacks, denial of service (DoS), false data injection attacks (FDIAs), jamming, and malware. Among these cyberattacks, FDIA represents an important type with widely varied types and impacts. The FDIA is realized by injecting false data into any of the compromised components in a CPS to alter the system state [23,24]. This paper mainly focuses on the impact analysis and detection of FDIA for the MMC.
The architecture of the power system, including MMC-based HVDC converter stations, is shown in Figure 1b. In the HVDC converter station, the control center, or supervisory control and data acquisition (SCADA) system, monitors and manages the MMC hardware circuit through the communication infrastructure. Moreover, one converter station also communicates with the power grid dispatching center and other converter stations through outer communication networks. The communication infrastructure based on local area networks (LAN), field area networks (FAN), and wide area networks (WAN) is vulnerable Energies 2023, 16, 6353 3 of 18 to cyberattacks. The attackers can access the communication networks and control center to inject false data to alter the system state. Ref. [25] is the first paper to discuss the cyberattack in the MMC. This paper assesses the impact of cyberattacks on the control system of the MMC-based HVDC system and shows that cyberattacks can affect system stability. Unlike the centralized control architecture analyzed in [25], ref. [26] shows the effect of the FDIA on the capacitor voltage balancing of the MMC under a distributed control structure. The real capacitor voltage of the attacked SM will deviate from the normal value after injecting the false data; however, the SM capacitor voltages seen by the controller are still wellbalanced. In follow-up studies, ref. [27] presents a reinforcement learning-based method to exploit the vulnerabilities of FDIA detectors in the MMC. The proposed method reveals the weakness of the fault detector given in [26] and provides a solution for researchers to motivate future research in this area. To the best of our knowledge, refs. [25][26][27] are all the related publications regarding the topic of cyber-attack in the MMC.
Compared to the FDIA step analyzed in [26], stealthy false data injection with a more elaborate attack sequence can deceive the protection system and bypass the fault detector [27]. This type of FDIA is more dangerous to the safe operation of CPS. However, the detection of stealthy FDIAs in MMC has not been studied in the existing literature. To fill this research gap, this paper proposes a detection method that can obtain the real capacitor voltage of the attacked SM during the modulation process. Since the real capacitor voltage of the attacked SM will be increased or decreased to deviate from the normal value, the FDIA can be detected by comparing the real SM capacitor voltage with prespecified thresholds. The attacked SM is isolated from the arm circuit after detecting FDIA. Simulation results verify the effectiveness of the proposed detection method.
The rest of the paper is organized as follows: Section 2 describes the basic structure, modulation, and capacitor voltage balancing of the MMC; Section 3 analyzes the performance of the MMC under cyberattacks; Section 4 presents the proposed detection method; Section 5 shows the simulation results; and Section 6 concludes the paper.

Structure of the MMC
The circuit configuration of a single-phase MMC is shown in Figure 2, where the upper and lower arms both include N ordinary half-bridge SMs and M redundant half-bridge SMs. U dc represents the dc bus voltage. i u and i l denote the upper and lower arm currents, respectively. u u and u l denote the upper and lower arm voltages, respectively. L is the arm inductance, R o is the load resistance, and L o is the load inductance. i o and u o represent the load current and load voltage, respectively. C and U C stand for the SM capacitance and the capacitor voltage, respectively. Bs is the bypass switch that is used to isolate the SM from the arm circuit.
The half-bridge SM of the MMC has two operating modes: inserted and bypassed. When the upper switch T 1 and lower switch T 2 are turned on and off, respectively, the SM output voltage is equal to the capacitor voltage U C , and the SM is inserted. In contrast, the SM is bypassed when the upper switch T 1 and lower switch T 2 are turned off and on, respectively; thus, the SM output voltage is zero. The ordinary and redundant SMs are treated identically by the control system in this paper, which means that the SMs are set to the active redundant mode [28]. The average dc value of the SM capacitor voltage is equal to U dc /N under normal operating conditions. According to Kirchhoff's circuit laws, the upper and lower arm voltages can be expressed as follows:

Modulation and SM Capacitor Voltage Balancing for the MMC
There are two widely applied modulation methods for the MMC, i.e., pulse-width modulation (PWM) and nearest-level modulation (NLM) [11]. The total harmonic distortion (THD) using the PWM method is lower for the MMC with fewer SMs. However, as the SM number per arm increases to hundreds for HVDC applications, the NLM method is preferred because of its low switching frequency characteristic and simple implementation. The arm-inserted SM number using the NLM method is obtained as follows: where u x * is the reference of the corresponding arm voltage (the upper arm and lower arm are represented by subscripts u and subscript l, respectively, i.e., x = u, l).
The waveforms of the arm-inserted SM numbers and the load voltage of the MMC using NLM with eight SMs per arm are shown in Figure 3. u o * denotes the reference of the load voltage. The arm-inserted SM number changes in a staircase manner, and the value of each step is equal to 1. It should be noted that although there are N + M SMs in each arm, the maximum value of the arm-inserted SM number using NLM in one control cycle is N [28], because the active redundant mode [28] is applied in this paper. After calculating the arm-inserted SM numbers according to the NLM principle, the reduced-switching-frequency (RSF) voltage balancing algorithm [8] is applied to balance the SM capacitor voltages. The implementation diagram is shown in Figure 4. ix represents the arm current. ΔNonx denotes the extra inserted or bypassed SM number during the following control cycle. ΔNonx is expressed as follows:

Modulation and SM Capacitor Voltage Balancing for the MMC
There are two widely applied modulation methods for the MMC, i.e., pulse-width modulation (PWM) and nearest-level modulation (NLM) [11]. The total harmonic distortion (THD) using the PWM method is lower for the MMC with fewer SMs. However, as the SM number per arm increases to hundreds for HVDC applications, the NLM method is preferred because of its low switching frequency characteristic and simple implementation. The arm-inserted SM number using the NLM method is obtained as follows: where u * x is the reference of the corresponding arm voltage (the upper arm and lower arm are represented by subscripts u and subscript l, respectively, i.e., x = u, l).
The waveforms of the arm-inserted SM numbers and the load voltage of the MMC using NLM with eight SMs per arm are shown in Figure 3. u * o denotes the reference of the load voltage. The arm-inserted SM number changes in a staircase manner, and the value of each step is equal to 1. It should be noted that although there are N + M SMs in each arm, the maximum value of the arm-inserted SM number using NLM in one control cycle is N [28], because the active redundant mode [28] is applied in this paper.
After calculating the arm-inserted SM numbers according to the NLM principle, the reduced-switching-frequency (RSF) voltage balancing algorithm [8] is applied to balance the SM capacitor voltages. The implementation diagram is shown in Figure 4. i x represents the arm current. ∆N onx denotes the extra inserted or bypassed SM number during the following control cycle. ∆N onx is expressed as follows: where N onx (k) and N onx (k − 1) are inserted SM numbers in the arm at control steps k and k − 1, respectively. For instance, if N onx (k) = 4 and N onx (k − 1) = 3, then ∆N onx = 1, which means that one extra SM needs to be inserted. In contrast, if N onx (k) = 3 and N onx (k−1) = 4, then ∆N onx = −1 and one extra SM needs to be bypassed. where Nonx(k) and Nonx(k − 1) are inserted SM numbers in the arm at control steps k and k − 1, respectively. For instance, if Nonx(k) = 4 and Nonx(k − 1) = 3, then ΔNonx = 1, which mean that one extra SM needs to be inserted. In contrast, if Nonx(k) = 3 and Nonx(k−1) = 4, then ΔNonx = −1 and one extra SM needs to be bypassed.  If extra |ΔNonx| SMs need to be inserted during control cycle k, then |ΔNonx| SMs tha are currently in the bypassed state with the lowest (highest) voltages will be inserted when the arm current is positive (negative). Those SMs currently in the inserted stat just keep their operating mode; • If extra |ΔNonx| SMs need to be bypassed during control cycle k, then |ΔNonx| SM that are currently in the inserted state with the highest (lowest) voltages will be by passed when the arm current is positive (negative). Those SMs currently in the by passed state just keep their operating mode; • If no extra SMs need to be bypassed or inserted during the following control cycl (i.e., ΔNonx = 0), then the SMs will keep their gating signals. where Nonx(k) and Nonx(k − 1) are inserted SM numbers in the arm at control steps k and k − 1, respectively. For instance, if Nonx(k) = 4 and Nonx(k − 1) = 3, then ΔNonx = 1, which means that one extra SM needs to be inserted. In contrast, if Nonx(k) = 3 and Nonx(k−1) = 4, then ΔNonx = −1 and one extra SM needs to be bypassed. If ΔNonx>0

ix>0 ix>0
Keep the gating signals Insert  If extra |ΔNonx| SMs need to be inserted during control cycle k, then |ΔNonx| SMs tha are currently in the bypassed state with the lowest (highest) voltages will be inserted when the arm current is positive (negative). Those SMs currently in the inserted state just keep their operating mode; • If extra |ΔNonx| SMs need to be bypassed during control cycle k, then |ΔNonx| SMs that are currently in the inserted state with the highest (lowest) voltages will be by passed when the arm current is positive (negative). Those SMs currently in the by passed state just keep their operating mode; • If no extra SMs need to be bypassed or inserted during the following control cycle (i.e., ΔNonx = 0), then the SMs will keep their gating signals. The basic principles of the RSF balancing algorithm are further explained as follows: • If extra |∆N onx | SMs need to be inserted during control cycle k, then |∆N onx | SMs that are currently in the bypassed state with the lowest (highest) voltages will be inserted when the arm current is positive (negative). Those SMs currently in the inserted state just keep their operating mode; • If extra |∆N onx | SMs need to be bypassed during control cycle k, then |∆N onx | SMs that are currently in the inserted state with the highest (lowest) voltages will be bypassed when the arm current is positive (negative). Those SMs currently in the bypassed state just keep their operating mode; • If no extra SMs need to be bypassed or inserted during the following control cycle (i.e., ∆N onx = 0), then the SMs will keep their gating signals.

FDIAs in the MMC
In this section, different types of MMC control architectures will be introduced. On this basis, the performance of the MMC under FDIAs will be analyzed.

Architecture of the MMC Control System
There are three main control architectures for the MMC [29,30], i.e., centralized, decentralized, and distributed, as shown in Figure 5. S xi stands for the switching function of the ith SM in arm x (I = 1, 2 . . . , N + M, x = u, l). S xi is equal to 1 and 0 when the SM is inserted and bypassed, respectively. The MP signal represents the measurement and protection signals, if needed. chitecture is shown in Figure 6. To reduce the computation burden of the central control ler, a decentralized control architecture can be used with a central controller and multipl arm-or group-level controllers. The load current and voltage controls can be executed by the central controller. Modulation and capacitor voltage balancing control are undertaken in the arm/group controllers. In the distributed control architecture, the transmission o SM capacitor voltages can be avoided to reduce the bandwidth requirement of the com munication networks. System-level controls (current and voltage controls) and modula tion can be allocated in various ways to the central and local controllers.
The distributed control architecture with the PWM method for the MMC has not been widely used in practical HVDC projects [29]. Therefore, this paper mainly focuses on cen tralized and decentralized control architectures. The analysis and detection of the FDIA in the following sections of this paper are based on the centralized control architecture however, they are also applicable to the decentralized control architecture. For both archi tectures, FDIAs can alter the SM capacitor voltages seen by the central or arm controlle and cause unbalanced capacitor voltages. The stealthy FDIA detection method for distrib uted control architectures needs to be studied in future research.  The centralized control architecture uses one central controller, which is responsible for control, modulation, and system-level protection tasks. The local controller in the SM sends the measured capacitor voltage to the central controller and receives the switching function from the central controller. A detailed illustration of the centralized control architecture is shown in Figure 6. To reduce the computation burden of the central controller, a decentralized control architecture can be used with a central controller and multiple armor group-level controllers. The load current and voltage controls can be executed by the central controller. Modulation and capacitor voltage balancing control are undertaken in the arm/group controllers. In the distributed control architecture, the transmission of SM capacitor voltages can be avoided to reduce the bandwidth requirement of the communication networks. System-level controls (current and voltage controls) and modulation can be allocated in various ways to the central and local controllers.
The distributed control architecture with the PWM method for the MMC has not been widely used in practical HVDC projects [29]. Therefore, this paper mainly focuses on centralized and decentralized control architectures. The analysis and detection of the FDIAs in the following sections of this paper are based on the centralized control architecture; however, they are also applicable to the decentralized control architecture. For both architectures, FDIAs can alter the SM capacitor voltages seen by the central or arm controller and cause unbalanced capacitor voltages. The stealthy FDIA detection method for distributed control architectures needs to be studied in future research.  Figure 6. Centralized control architecture.

Performance of the MMC under FDIAs
The capacitor voltages of the MMC can be balanced using the RSF voltage balan algorithm. The steady-state waveforms of the SM capacitor voltages under normal ating conditions are shown in Figure 7. UCxi_real is the real capacitor voltage of the it in arm x, which is measured across the SM capacitor. The parameters of the studied M system are listed in Table 1. The average values of the capacitor voltages are equ Udc/N. False data can be injected into the cybersystem of the MMC to alter the SM capa voltage seen by the central controller. The SM capacitor voltage seen by the central troller can be written as follows: where UCxi_inj denotes the injected false data. w equals 1 and 0 for the SM with and wi FDIA, respectively. For the SM without FDIA, its capacitor voltage seen by the ce controller equals its real capacitor voltage. However, UCxi is not equal to UCxi_real for th with FDIA.

Performance of the MMC under FDIAs
The capacitor voltages of the MMC can be balanced using the RSF voltage balancing algorithm. The steady-state waveforms of the SM capacitor voltages under normal operating conditions are shown in Figure 7. U Cxi_real is the real capacitor voltage of the ith SM in arm x, which is measured across the SM capacitor. The parameters of the studied MMC system are listed in Table 1 In this paper, FDIAs are classified into two categories: step FDIAs a FDIAs. The step FDIA means that |UCxi_inj| in (5) suddenly changes to a larg shown in Figure 8a. The value of the step FDIA at control cycle k can be e follows: where a0 is the value of the injected false data and k0 is the number of the injec cycle. The capacitor voltage waveforms of the MMC under a step FDIA are sh ure 8b,c. It can be observed that the SM capacitor voltages seen by the centra are quickly balanced after step FDIA occurs, attributable to the RSF voltage however, the real capacitor voltage of the attacked SM is increased to a larg Figure 8, the value of the injected false data is a0 < 0, which leads to an increas If a0 > 0, UCu1_real will be reduced.  False data can be injected into the cybersystem of the MMC to alter the SM capacitor voltage seen by the central controller. The SM capacitor voltage seen by the central controller can be written as follows: where U Cxi_inj denotes the injected false data. w equals 1 and 0 for the SM with and without FDIA, respectively. For the SM without FDIA, its capacitor voltage seen by the central controller equals its real capacitor voltage. However, U Cxi is not equal to U Cxi_real for the SM with FDIA. In this paper, FDIAs are classified into two categories: step FDIAs and stealthy FDIAs. The step FDIA means that |U Cxi_inj | in (5) suddenly changes to a large value, as shown in Figure 8a. The value of the step FDIA at control cycle k can be expressed as follows: where a 0 is the value of the injected false data and k 0 is the number of the injection control cycle. The capacitor voltage waveforms of the MMC under a step FDIA are shown in Figure 8b,c. It can be observed that the SM capacitor voltages seen by the central controller are quickly balanced after step FDIA occurs, attributable to the RSF voltage balancing; however, the real capacitor voltage of the attacked SM is increased to a large value. In Figure 8, the value of the injected false data is a 0 < 0, which leads to an increase in U Cu1_real . If a 0 > 0, U Cu1_real will be reduced. In this paper, FDIAs are classified into two categories: step FDIAs and stealth FDIAs. The step FDIA means that |UCxi_inj| in (5) suddenly changes to a large value, a shown in Figure 8a. The value of the step FDIA at control cycle k can be expressed a follows: where a0 is the value of the injected false data and k0 is the number of the injection contro cycle. The capacitor voltage waveforms of the MMC under a step FDIA are shown in Fig  ure 8b,c. It can be observed that the SM capacitor voltages seen by the central controlle are quickly balanced after step FDIA occurs, attributable to the RSF voltage balancing however, the real capacitor voltage of the attacked SM is increased to a large value. I Figure 8, the value of the injected false data is a0 < 0, which leads to an increase in UCu1_rea If a0 > 0, UCu1_real will be reduced. The difference value of the injected false data between adjacent control cycles k0 − and k0 equals a0 for step FDIA, according to (6). The value of |a0| is larger than a threshold value of ∆UCth1. Specifically, ∆UCth1 is set to 0.1 kV in this paper. In contrast, the differenc value of the injected false data between any two adjacent control cycles for stealthy FDIA is much smaller than ∆UCth1. A ramp-decreased stealthy FDIA and the capacitor voltag waveforms of the MMC are shown in Figure 9. UCu1_inj gradually decreases in Figure 9a The difference value of the injected false data between adjacent control cycles k 0 − 1 and k 0 equals a 0 for step FDIA, according to (6). The value of |a 0 | is larger than a threshold value of ∆U Cth1 . Specifically, ∆U Cth1 is set to 0.1 kV in this paper. In contrast, the difference value of the injected false data between any two adjacent control cycles for stealthy FDIA is much smaller than ∆U Cth1 . A ramp-decreased stealthy FDIA and the capacitor voltage  Figure 9. U Cu1_inj gradually decreases in Figure 9a, and |U Cu1_inj (k) − U Cu1_inj (k − 1)| is always much smaller than ∆U Cth1 . Similarly, the SM capacitor voltages seen by the central controller are well balanced after stealthy FDIA; however, the real capacitor voltage of the attacked SM deviates from its normal value. It should be noted that there are many other types of stealthy FDIAs besides the ramp-change type shown in Figure 9. However, they are all in accordance with the characteristic that |U Cu1_inj (k) − U Cu1_inj (k − 1)| is always much smaller than ∆U Cth1 .
Energies 2023, 16, x FOR PEER REVIEW 9 of 1 and |UCu1_inj (k) − UCu1_inj(k − 1)| is always much smaller than ∆UCth1. Similarly, the SM ca pacitor voltages seen by the central controller are well balanced after stealthy FDIA; how ever, the real capacitor voltage of the attacked SM deviates from its normal value. I should be noted that there are many other types of stealthy FDIAs besides the ramp change type shown in Figure 9. However, they are all in accordance with the characteristi that |UCu1_inj (k) − UCu1_inj(k − 1)| is always much smaller than ∆UCth1.

FDIA Detection Methods
Since the detection method given in [26] is the only FDIA detection method proposed in the existing literature for the MMC, this section will first explain the mechanism of thi method and disclose the issue of this method. It is found that the detection method given in [26] can fail to detect stealthy FDIA. In order to address this issue, Section 4.2 present the implementation details of the proposed detection method. [26] Ref. [26] proposes an FDIA detection method for the MMC based on the dynami equation of the SM capacitor voltage [14], which is expressed as follows:

FDIA Detection Method Given in
The SM capacitor voltage under NLM can be predicted according to the discretiza tion of (7) (the Euler discretization method is used to discretize (7)), which is obtained a follows: (8 where UCxi_pre(k) and UCxi_pre(k − 1) are the predicted capacitor voltages of the ith SM in arm x at control steps k and k − 1, respectively. Ts denotes the control period. ix(k − 1) and Sxi(

FDIA Detection Methods
Since the detection method given in [26] is the only FDIA detection method proposed in the existing literature for the MMC, this section will first explain the mechanism of this method and disclose the issue of this method. It is found that the detection method given in [26] can fail to detect stealthy FDIA. In order to address this issue, Section 4.2 presents the implementation details of the proposed detection method.

FDIA Detection Method Given in [26]
Ref. [26] proposes an FDIA detection method for the MMC based on the dynamic equation of the SM capacitor voltage [14], which is expressed as follows: The SM capacitor voltage under NLM can be predicted according to the discretization of (7) (the Euler discretization method is used to discretize (7)), which is obtained as follows: where U Cxi_pre (k) and U Cxi_pre (k − 1) are the predicted capacitor voltages of the ith SM in arm x at control steps k and k − 1, respectively. T s denotes the control period. i x (k − 1) and S xi (k − 1) are the arm current and SM switching functions, respectively, at the control step k − 1.
If there is no FDIA and the injected false data U Cxi_inj is zero, as shown in Figure 10a, the SM capacitor voltage seen by the central controller at control step k should approximate U Cxi_pre (k), i.e., U Cxi (k) ≈ U Cxi_pre (k). Otherwise, there will be a significant difference between U Cxi (k) and U Cxi_pre (k), as shown in Figure 10b. Based on this phenomenon, a detection principle is proposed in [26]: if the difference between U Cxi (k) and U Cxi_pre (k) exceeds a prespecified threshold, i.e., |U Cxi (k) − U Cxi_pre (k)| > ∆U Cth2 , FDIA on ith SM in arm x is detected. ∆U Cth2 is set to 0.1 kV in this paper.

OR PEER REVIEW 10 of 17
If there is no FDIA and the injected false data UCxi_inj is zero, as shown in Figure 10a, the SM capacitor voltage seen by the central controller at control step k should approximate UCxi_pre(k), i.e., UCxi(k) ≈ UCxi_pre(k). Otherwise, there will be a significant difference between UCxi(k) and UCxi_pre(k), as shown in Figure 10b. Based on this phenomenon, a detection principle is proposed in [26]: if the difference between UCxi(k) and UCxi_pre(k) exceeds a prespecified threshold, i.e., |UCxi(k) − UCxi_pre(k)| > ∆UCth2, FDIA on ith SM in arm x is detected. ∆UCth2 is set to 0.1 kV in this paper. As explained in Section 3.2, the difference value of the injected false data between adjacent control cycles k0 − 1 and k0 equals a0 for step FDIA. |a0| is large enough to trigger the detection principle |UCxi(k) − UCxi_pre(k)| > ∆UCth2 given in [26]. In this case, the detection method proposed in [26] can detect the step FDIA for the MMC. However, for stealthy FDIA, the difference value of the injected false data between any two adjacent control cycles is much smaller than ∆UCth1, i.e., |UCxi_inj(k) − UCxi_inj(k−1)| << ∆UCth1. So the detection principle given in [26] cannot be satisfied, i.e., |UCxi(k) − UCxi_pre(k)| is always smaller than ∆UCth2. That means this detection method can fail to detect the stealthy FDIA for the MMC.

Proposed FDIA Detection Method
It can be seen in Figures 8 and 10 that no matter which type of FDIA occurs, the real capacitor voltage of the attacked SM will deviate from its normal value. If the real SM capacitor voltage can be obtained for the central controller, both step and stealthy FDIAs can be detected by comparing the real capacitor voltage UCxi_real with prespecified thresholds. In order to obtain the real capacitor voltage of an SM, the difference value of the arm voltages between adjacent control steps should be calculated for the proposed detection method. A detailed explanation is given below.
By applying the RSF voltage balancing algorithm and NLM principle, the SMs in each arm of the MMC will be inserted or bypassed one by one. As shown in Figure 11a, if SM1 is inserted at control step k − 1, the arm voltage ux(k − 1) can be expressed as follows: where uSMs is the voltage of the cascaded SMs (SM2~SMN+M), as shown in Figure 11a. When As explained in Section 3.2, the difference value of the injected false data between adjacent control cycles k 0 − 1 and k 0 equals a 0 for step FDIA. |a 0 | is large enough to trigger the detection principle |U Cxi (k) − U Cxi_pre (k)| > ∆U Cth2 given in [26]. In this case, the detection method proposed in [26] can detect the step FDIA for the MMC. However, for stealthy FDIA, the difference value of the injected false data between any two adjacent control cycles is much smaller than ∆U Cth1 , i.e., |U Cxi_inj (k) − U Cxi_inj (k−1)| << ∆U Cth1 . So the detection principle given in [26] cannot be satisfied, i.e., |U Cxi (k) − U Cxi_pre (k)| is always smaller than ∆U Cth2 . That means this detection method can fail to detect the stealthy FDIA for the MMC.

Proposed FDIA Detection Method
It can be seen in Figures 8 and 10 that no matter which type of FDIA occurs, the real capacitor voltage of the attacked SM will deviate from its normal value. If the real SM capacitor voltage can be obtained for the central controller, both step and stealthy FDIAs can be detected by comparing the real capacitor voltage U Cxi_real with prespecified thresholds. In order to obtain the real capacitor voltage of an SM, the difference value of the arm voltages between adjacent control steps should be calculated for the proposed detection method. A detailed explanation is given below.
By applying the RSF voltage balancing algorithm and NLM principle, the SMs in each arm of the MMC will be inserted or bypassed one by one. As shown in Figure 11a, if SM 1 is inserted at control step k − 1, the arm voltage u x (k − 1) can be expressed as follows: where u SMs is the voltage of the cascaded SMs (SM 2~S M N+M ), as shown in Figure 11a. When SM 1 is bypassed at the next control step k, the arm voltage u x (k) = u SMs . The change of the SM state leads to the change of the arm voltage, and the real capacitor voltage of SM 1 can be obtained as follows: Similarly, when SM1 is bypassed and inserted at control steps k − 1 and k, respectively, as shown in Figure 11b, the real capacitor voltage can also be calculated according to (10). As the SMs in the arm are bypassed or inserted one by one, the real capacitor voltages of the other SMs can be obtained in a similar method.
ux(k 1)=uSMs uSMs uSMs . Figure 11. Arm voltages at two adjacent control steps: (a) the state of SM1 changes from inserted to bypassed; and (b) the state of SM1 changes from bypassed to inserted.
One technique to derive the arm voltage of the MMC in (10) is to install an arm voltage sensor, as shown in Figure 12. However, this method will increase the cost of the whole MMC system. To avoid using extra voltage sensors or hardware circuits, the arm voltages can be estimated according to the discretization results of Equations (1) and (2) (the Euler discretization method is used to discretize (1) and (2)), which are expressed as follows: Similarly, when SM 1 is bypassed and inserted at control steps k − 1 and k, respectively, as shown in Figure 11b, the real capacitor voltage can also be calculated according to (10). As the SMs in the arm are bypassed or inserted one by one, the real capacitor voltages of the other SMs can be obtained in a similar method.
One technique to derive the arm voltage of the MMC in (10) is to install an arm voltage sensor, as shown in Figure 12. However, this method will increase the cost of the whole Energies 2023, 16, 6353 12 of 18 MMC system. To avoid using extra voltage sensors or hardware circuits, the arm voltages can be estimated according to the discretization results of Equations (1) and (2) (the Euler discretization method is used to discretize (1) and (2)), which are expressed as follows: , and i o (k) are the measured voltages and currents. After obtaining the arm voltages of the MMC according to (11) and (12), the real SM capacitor voltage can be calculated according to (10).
, and io(k) are the measured volta currents. After obtaining the arm voltages of the MMC according to (11) and (12) SM capacitor voltage can be calculated according to (10).  Figure 13 shows an example of deriving the real SM capacitor voltage. The sw function of SM1 in the upper arm changes from 1 to 0 in Figure 13a, indicating tha is bypassed during the modulation process. After one control cycle delay, the rea itor voltage UCu1_real is obtained according to (10), as shown in Figure 13b. The fl shown in Figure 13c illustrates the process of determining the capacitor voltage.  Figure 13 shows an example of deriving the real SM capacitor voltage. The switching function of SM 1 in the upper arm changes from 1 to 0 in Figure 13a, indicating that the SM is bypassed during the modulation process. After one control cycle delay, the real capacitor voltage U Cu1_real is obtained according to (10), as shown in Figure 13b. The flowchart shown in Figure 13c illustrates the process of determining the capacitor voltage.
Generally, the principle of the proposed detection method can be summarized as follows: when the SM of the MMC is bypassed or inserted, its real capacitor voltage can be obtained according to the changing arm voltage. If U Cxi_real > U Cth1 or U Cxi_real < U Cth2 , this SM is detected as an attacked SM and can be isolated from the arm circuit. U Cth1 and U Cth2 in this paper are set to 1.2U dc /N and 0.8U dc /N, respectively. The proposed detection method can detect both step and stealthy FDIAs for the MMC, and the effectiveness of the method will be validated in the next section.
Energies 2023, 16,6353 13 of 18 Figure 13 shows an example of deriving the real SM capacitor voltage. The switching function of SM1 in the upper arm changes from 1 to 0 in Figure 13a, indicating that the SM is bypassed during the modulation process. After one control cycle delay, the real capacitor voltage UCu1_real is obtained according to (10), as shown in Figure 13b. The flowchart shown in Figure 13c illustrates the process of determining the capacitor voltage. Generally, the principle of the proposed detection method can be summarized as follows: when the SM of the MMC is bypassed or inserted, its real capacitor voltage can be obtained according to the changing arm voltage. If UCxi_real > UCth1 or UCxi_real < UCth2, this SM is detected as an attacked SM and can be isolated from the arm circuit. UCth1 and UCth2 in this paper are set to 1.2Udc/N and 0.8Udc/N, respectively. The proposed detection method

Validation and Comparisons
The circuit of the MMC shown in Figure 2 was developed based on PSCAD/EMTDC. The corresponding parameters are listed in Table 1. There are 40 ordinary SMs and two redundant SMs in each arm of the MMC. The control period is set to 50 µs. Figure 14 shows the waveforms of the MMC under a step FDIA. The detection method proposed in [26] is used in Figure 14. Before the false data is injected, the SM capacitor voltages seen by the central controller are identical with the real SM capacitor voltages. The detection flag is set to 0. When the step FDIA occurs, the false data U Cu1_inj jumps to −0.5 as shown in Figure 14a, and the capacitor voltage U Cu1 seen by the central controller is suddenly reduced as shown in Figure 14b. The step FDIA is detected according to the principle given in Section 4.1, and the detection flag is set to 1 to indicate there is an attacked SM in the arm. SM 1 is then isolated from the arm circuit by enabling the bypass switch, and the capacitor in SM 1 will be gradually discharged through a parallel-connected resistor. Figure 15 shows the waveforms of the MMC using the proposed detection method under a step FDIA. The injected false data U Cu1_inj is smaller than 0, which will reduce the capacitor voltage of SM 1 seen by the central controller. In this case, the capacitor voltage balancing algorithm will tend to increase the charging priority of SM 1 according to the principles presented in Section 2.2. Although the capacitor voltages seen by the central controller are gradually balanced, the real capacitor voltage of SM 1 is increased. After U Cu1_real exceeds the threshold, SM 1 can be detected when its operating mode is changed according to the detection principle proposed in Section 4.2.
capacitor voltages seen by the central controller are identical with the real SM capacitor voltages. The detection flag is set to 0. When the step FDIA occurs, the false data UCu1_inj jumps to −0.5 as shown in Figure 14a, and the capacitor voltage UCu1 seen by the central controller is suddenly reduced as shown in Figure 14b. The step FDIA is detected according to the principle given in Section 4.1, and the detection flag is set to 1 to indicate there is an attacked SM in the arm. SM1 is then isolated from the arm circuit by enabling the bypass switch, and the capacitor in SM1 will be gradually discharged through a parallel-  Figure 15 shows the waveforms of the MMC using the proposed detection method under a step FDIA. The injected false data UCu1_inj is smaller than 0, which will reduce the capacitor voltage of SM1 seen by the central controller. In this case, the capacitor voltage balancing algorithm will tend to increase the charging priority of SM1 according to the principles presented in Section 2.2. Although the capacitor voltages seen by the central controller are gradually balanced, the real capacitor voltage of SM1 is increased. After UCu1_real exceeds the threshold, SM1 can be detected when its operating mode is changed according to the detection principle proposed in Section 4.2.
The simulation results shown in Figures 14 and 15 verify that the detection methods proposed in [26] and this paper can both detect the step FDIA for the MMC. The waveforms of the MMC using the detection method proposed in [26] under a stealthy FDIA are shown in Figure 16. It can be observed that the real SM capacitor voltage, UCu1_real, increases to a large value, which can threaten the safe operation of the MMC. The cyberattack detector given in [26] fails to detect the stealthy FDIA, and the detection flag is always 0. It should be noted that various stealthy FDIAs other than the type shown in Figure 16 can be injected. Although the forms of stealthy FDIAs are different, they all The simulation results shown in Figures 14 and 15 verify that the detection methods proposed in [26] and this paper can both detect the step FDIA for the MMC.
The waveforms of the MMC using the detection method proposed in [26] under a stealthy FDIA are shown in Figure 16. It can be observed that the real SM capacitor voltage, U Cu1_real , increases to a large value, which can threaten the safe operation of the MMC. The cyberattack detector given in [26] fails to detect the stealthy FDIA, and the detection flag is always 0. It should be noted that various stealthy FDIAs other than the type shown in Figure 16 can be injected. Although the forms of stealthy FDIAs are different, they all can bypass the cyberattack detector proposed in [26].  Figure 17 shows the waveforms of the MMC using the proposed detection method. The performance is similar to the results shown in Figure 15. The stealthy FDIA can be successfully detected when the real capacitor voltage and operating mode transition of SM 1 satisfy the detection principles. SM 1 in the upper arm is isolated after the detection flag is set to 1.

Conclusions
The MMC is the state-of-the-art topology used in recent VSC-HVDC systems. A cyberattack occurring in MMC can affect the normal operation of the converter system and even lead to damage to the components. FDIA represents a typical cyberattack with widely varied types and impacts. The stealthy FDIA with a more elaborate attack sequence can deceive and bypass the fault detector of the MMC proposed in the existing literature. In this case, although the capacitor voltages seen by the central controller of the MMC are well-balanced, the real capacitor voltage of the attacked SM will deviate from the normal value. To address this issue, this paper proposes a detection method to obtain the real SM capacitor voltages during the modulation process. The real capacitor voltage can be calculated according to the difference value of the arm voltage between two adjacent control steps. The FDIA on an SM is detected if the real SM capacitor voltage exceeds the prespecified thresholds. The proposed detection method is applicable to both centralized and decentralized control architectures for the MMC. The calculations given in (10)(11)(12)(13)(14)(15) are realized in the central controller for the centralized control architecture. Instead, the calculations can be realized in the arm controller for the decentralized control architecture. Moreover, the proposed method can detect different FDIA forms (such as step data attack, ramp-changed data attack, and impulse data attack) once the real capacitor voltage of the attacked SM exceeds the threshold values. Simulation results verified the effectiveness of the proposed detection method.
Author Contributions: Methodology implementation and manuscript-writing, X.C.; document preparation and manuscript-writing, S.S. All authors have read and agreed to the published version of the manuscript.

Conclusions
The MMC is the state-of-the-art topology used in recent VSC-HVDC systems. A cyberattack occurring in MMC can affect the normal operation of the converter system and even lead to damage to the components. FDIA represents a typical cyberattack with widely varied types and impacts. The stealthy FDIA with a more elaborate attack sequence can deceive and bypass the fault detector of the MMC proposed in the existing literature. In this case, although the capacitor voltages seen by the central controller of the MMC are well-balanced, the real capacitor voltage of the attacked SM will deviate from the normal value. To address this issue, this paper proposes a detection method to obtain the real SM capacitor voltages during the modulation process. The real capacitor voltage can be calculated according to the difference value of the arm voltage between two adjacent control steps. The FDIA on an SM is detected if the real SM capacitor voltage exceeds the prespecified thresholds. The proposed detection method is applicable to both centralized and decentralized control architectures for the MMC. The calculations given in (10)(11)(12)(13)(14)(15) are realized in the central controller for the centralized control architecture. Instead, the calculations can be realized in the arm controller for the decentralized control architecture. Moreover, the proposed method can detect different FDIA forms (such as step data attack, ramp-changed data attack, and impulse data attack) once the real capacitor voltage of the attacked SM exceeds the threshold values. Simulation results verified the effectiveness of the proposed detection method.
Author Contributions: Methodology implementation and manuscript-writing, X.C.; document preparation and manuscript-writing, S.S. All authors have read and agreed to the published version of the manuscript.