Resilient Load Frequency Control for Gas–Electricity Coupling Systems Against Gas Pressure False Data Injection Attacks

Abstract

The coupling of power and natural gas infrastructures introduces gas-side constraints and cyberattack risks into load frequency control (LFC). This paper proposes an auxiliary Kalman filter (AKF)-based tube-based MPC (TMPC) framework for gas–electricity coupling systems under gas pressure false data injection attacks (FDIAs). A pressure-dependent gas turbine (GT) power limit is incorporated into the frequency control constraint, and an auxiliary pressure model is identified from attack-free data as a virtual pressure sensor. Residuals, normalized innovation squared statistics (NIS), and cumulative sum (CUSUM) statistics are used for attack detection, while compromised pressure measurements are reconstructed using the AKF estimates. Simulations on a two-area power system coupled with an 11-node gas network show that under attack-free operations, the integral absolute error (IAE) values of TMPC, conventional MPC, and PI control are 0.7040, 1.9626, and 2.9834 Hz·s, respectively. Thus, TMPC reduces the accumulated frequency deviation by approximately 64% and 76%, compared with conventional MPC and PI control, respectively. Under FDIAs, the IAE decreases from 1.1645 to 0.7039 Hz·s after AKF-based pressure reconstruction, corresponding to an approximately 40% reduction. Meanwhile, the mean absolute error (MAE) of gas pressure reconstruction decreases from 0.1714 to 0.0157 bar, corresponding to an approximately 91% reduction in pressure reconstruction error. Compared with the denoising autoencoder (DAE) and graph signal recovery approaches, the proposed method achieves the highest detection rate of 98.39%, effectively limiting FDIA propagation to GT constraints and frequency regulation.

1. Introduction

With the increasing penetration of renewable energy and the growing demand for low-carbon operation, integrated energy systems (IESs) have become an important approach for improving energy utilization efficiency and enhancing operational flexibility [1]. Among various multi-energy coupling forms, gas–electricity coupling systems have received increasing attention because the operations of power networks and natural gas networks are strongly interdependent [2]. In such systems, power-to-gas (P2G) units can convert surplus electrical energy into gas energy and enhance multi-energy coordination, while gas turbines (GTs) convert natural gas into electrical power and provide flexible regulation capability. The coordinated control and auxiliary frequency regulation capability of gas–steam combined cycle units have also been investigated, showing that gas turbine units can provide flexible regulation support for power system frequency control.

However, the deep interaction between power and gas infrastructures also introduces additional dynamic couplings and operational constraints. In gas–electricity coupling systems, the available output of GT is not only determined by electrical-side control commands, but also constrained by gas-side operating conditions, especially the pressure level of gas supply nodes. Therefore, variations or abnormalities in the gas network may propagate to the power system through GT power limits, further influencing the frequency regulation process. For systems with high renewable penetration and strong gas–electricity interaction, load frequency control (LFC) needs to account for power imbalance, renewable uncertainty, and gas-side physical constraints simultaneously [3].

LFC is a fundamental function for maintaining the balance between generation and load demand. Conventional LFC strategies, such as PID, sliding mode control and other control methods, have been widely applied in traditional power systems [4,5]. Nevertheless, these methods may have difficulty handling multi-area coupling, renewable fluctuations, actuator constraints, and gas-side operational limitations at the same time. Model predictive control (MPC) has been introduced into LFC because it can explicitly consider system constraints and optimize future control actions over a prediction horizon [6,7]. For interconnected multi-area systems, distributed MPC (DMPC) further improves scalability by decomposing the global control problem into local optimization problems while exchanging limited coupling information among neighboring areas [8].

In addition to constraint handling, robustness is also essential for frequency regulation in gas–electricity coupling systems. Tube-based MPC (TMPC) provides an effective framework for dealing with bounded disturbances and model uncertainties. In this framework, a nominal MPC generates the reference trajectory, while a local feedback controller compensates for deviations between the actual and nominal states. As a result, the closed-loop system can maintain acceptable frequency performance under disturbances and parameter mismatches [9,10]. This feature makes tube-based MPC suitable for LFC problems involving renewable uncertainty, multi-area coupling, and multi-energy physical constraints [11].

However, this deep physical integration relies heavily on measurement, communication, control infrastructures, and sophisticated information and communication technologies for coordinated dispatch, transforming gas–electricity coupling systems into typical cyber–physical energy systems. Cyberattacks may disturb information flows and induce physical consequences in energy infrastructures [12]. Recent studies have shown that modern energy systems and electricity markets are increasingly exposed to cyber–physical threats, and coordinated attacks may further propagate across coupled energy infrastructures [13].

Among various cyber threats, denial-of-service (DoS) attacks have been widely investigated in LFC systems, where communication blocking or packet loss may interrupt measurement transmission, control command delivery, or inter-area information exchange, thereby degrading frequency regulation performance [14,15,16]. Different from DoS attacks that mainly degrade communication availability, false data injection attacks (FDIAs) compromise data integrity by stealthily manipulating measurement values while keeping communication links apparently available. Therefore, FDIA may mislead the controller without triggering obvious communication failures.

FDIA has attracted increasing attention in LFC systems because it can directly mislead feedback control decisions and cause frequency deviations. Early studies mainly focused on revealing the potential damage of FDIA in frequency regulation loops. Ref. [17] analyzed optimal FDIA against LFC and showed that compromised sensor measurements may drive system frequency beyond acceptable limits. This work clarified the attack propagation mechanism from falsified measurements to harmful control actions. However, its main emphasis is on attack construction and impact analysis, while the corresponding online detection and mitigation problem is not fully addressed. To overcome this limitation, Ref. [18] developed a model-based attack detection and mitigation framework for LFC systems. By checking the dynamic consistency between system models and measurements, their method moved the research focus from only evaluating attack consequences to designing defense mechanisms for compromised feedback loops. Nevertheless, such model-based schemes still depend strongly on the accuracy of the system model and mainly consider attacks on conventional LFC feedback information.

To improve the practical detectability of FDIA, state estimation-based residual analysis has been further introduced into power system cyber security studies. Ref. [19] proposed a Kalman filter (KF)-based method for detecting FDIA in LFC systems. Compared with direct thresholding of raw measurements, the Kalman filter provides a one-step predicted measurement based on system dynamics, and the innovation residual can be used as an abnormality indicator. In addition, recent data-driven methods have been developed for FDIA detection and localization in smart grids. For example, Ref. [20] proposed a spatiotemporal feature-fusion deep learning method to detect and locate FDIA by exploiting both spatial and temporal correlations in grid measurements. These studies indicate that state estimation, residual analysis, and data-driven feature extraction are effective tools for identifying abnormal measurement behavior in power system control loops. However, most existing FDIA detection studies mainly focus on electrical-side variables or general grid measurements. The coupling relationship between the gas network and the power grid is not explicitly considered, and the effect of falsified gas pressure measurements on GT generation limits and frequency regulation performance has rarely been addressed.

Beyond attack detection, several resilient control methods have been developed to maintain LFC performance under FDIA. For example, observer-based control, event-triggered control, and attack compensation strategies have been investigated to suppress malicious measurement manipulation and enhance closed-loop robustness [21,22]. Moreover, recent studies have further strengthened FDIA-resilient LFC by combining attack awareness with control-side mitigation. Ref. [23] further developed an attack detection and mitigation scheme for LFC systems under FDIA. Their work combines attack detection with mitigation actions, which strengthens the link between abnormal data identification and frequency regulation. These studies indicate that FDIA resilience should not only identify abnormal measurements but also prevent falsified information from misleading control allocation or generation regulation.

Although the above studies improve FDIA-resilient LFC from different perspectives, their problem settings are still mainly centered on electrical-side feedback and control variables, such as frequency deviation, tie-line power, ACE signals, control commands, or general sensor measurements. In gas–electricity coupling systems, however, gas-side pressure measurements introduce an additional attack surface that is closely related to physical operating constraints. The pressure at GT gas supply nodes determines the available generation limit of GTs, and an FDIA on this pressure measurement may distort the controller-side estimation of GT regulation capability. Therefore, the attack does not need to directly perturb frequency measurements; instead, it can influence frequency regulation through the constraint update of gas-fired units. This attack propagation mechanism is different from conventional electrical signal FDIA and requires a dedicated pressure reconstruction and constraint-correction strategy.

To bridge these gaps, this paper proposes a tube-based MPC framework with an auxiliary Kalman filter for LFC of gas–electricity coupling systems under FDIA. The proposed method constructs an auxiliary pressure estimator as a virtual gas pressure sensor. By comparing the received gas pressure measurements with the estimated pressure, abnormal pressure data can be detected through residual-based indicators. Once an attack is detected, the compromised pressure measurement is reconstructed using the estimated pressure, and the reconstructed pressure is further embedded into the TMPC constraint update to correct the available GT power limits. In this way, the proposed framework links gas pressure attack detection, pressure reconstruction, GT constraint correction, and resilient frequency control within a unified control architecture.

From the perspective of engineering applicability, the proposed method also provides a practical controller-side mitigation mechanism. Existing studies on integrated gas–electricity and multi-energy systems have shown that cyberattacks may propagate through cyber–physical coupling links and cause practical operational risks, which motivates the development of application-oriented defense strategies [24,25,26,27,28]. Different from studies that mainly focus on attack detection, risk evaluation, or operation-level mitigation, this paper embeds the defense mechanism into the frequency control loop. Once gas pressure FDIA is detected, the compromised pressure measurement is replaced by the AKF reconstructed pressure. The reconstructed pressure is then used to update the GT available power limit and further incorporated into the tube-based MPC optimization. Therefore, the proposed framework establishes an implementable mitigation path from gas-side pressure attack detection to GT constraint correction and power-side frequency regulation recovery.

The main contributions of this paper are summarized as follows:

• A gas pressure FDIA-resilient frequency control framework is developed for gas–electricity coupling systems by incorporating pressure-dependent GT available power limits into the TMPC constraints.
• The proposed TMPC coordinates nominal optimization and local feedback compensation to improve frequency regulation under wind power fluctuations, load disturbances and gas supply constraints.
• An AKF-based pressure reconstruction strategy is proposed to detect abnormal gas pressure measurements, reconstruct the compromised pressure states, and correct the GT available power limits used by the controller.
• Comparisons with other methods, together with tests under different FDIA amplitudes, verify the detection accuracy, reconstruction performance, and robustness of the proposed method.

The remainder of this paper is organized as follows. Section 2 introduces the overall research framework. Section 3 presents the gas–electricity coupling system model and the FDIA model. Section 4 develops the auxiliary Kalman filter-based pressure estimation and reconstruction method. Section 5 presents the resilient tube-based MPC design. Section 6 provides simulation results and performance comparisons. Finally, Section 7 concludes this paper.

2. Overall Research Framework

As shown in Figure 1, this paper establishes an integrated research framework for secure frequency regulation of gas–electricity coupling systems under FDIA. The framework consists of gas–electricity coupling system modeling, gas pressure attack detection and reconstruction, tube-based MPC design, and simulation validation.

First, in the system modeling phase, a multi-area LFC model incorporating wind farms, P2G units, gas turbines, conventional thermal units, and a gas network is developed. P2G units absorb surplus wind power and inject the produced gas into the gas network, while GT units consume gas to provide frequency regulation support. The pressure at each GT supply node is used to determine its available power limit, thereby establishing the coupling path from gas network states to power system frequency dynamics. On this basis, an FDIA model is introduced to manipulate the pressure measurements received by the controller. Although the physical gas pressure remains unchanged, the falsified measurement distorts the controller-side estimation of the GT regulation capability and affects the feasible control region.

Second, an AKF-based pressure detection and reconstruction strategy is developed. A reduced-order pressure state model is identified offline using attack-free data and measurable gas–electric coupling variables. During online operation, the AKF acts as a virtual pressure sensor and independently predicts the pressures at the GT supply nodes. The consistency between the predicted and received pressures is evaluated through residual-based statistics. Once an abnormal measurement is detected, the compromised pressure is replaced by the AKF estimate and used to update the available GT power limit.

Subsequently, the reconstructed pressure is embedded into the proposed TMPC framework. The nominal MPC generates optimal control trajectories subject to frequency, unit output, ramp-rate, and gas supply constraints, while a local feedback controller compensates for deviations between the actual and nominal states caused by load variations, wind power uncertainty, and model mismatch. This design limits the propagation of pressure FDIA from the gas measurement layer to the GT constraint and frequency control layers.

Finally, simulations are conducted on a two-area power system coupled with an 11-node gas network. Comparative and sensitivity analyses are performed to evaluate frequency regulation, pressure reconstruction, attack detection, GT constraint correction, and robustness under different FDIA conditions.

3. System Modeling

This section establishes the dynamic model of the multi-area gas–electricity coupling system under gas pressure false data injection attacks, as shown in Figure 2. The studied system consists of interconnected power areas, wind farms, P2G units, gas turbines, conventional thermal units, gas network nodes, and LFC controllers. The gas-side pressure state affects the available output limit of gas turbines, while the gas turbines provide fast power support for frequency regulation. Therefore, the system model explicitly describes the coupling path from gas pressure to GT power capability and then to power system frequency dynamics.

3.1. Wind Power and P2G Model

3.1.1. Wind Power

Wind power is introduced as a renewable energy source in each control area. Due to meteorological uncertainty, the output of the wind farm exhibits stochastic fluctuations around its forecasted value. The wind power is represented as the superposition of a forecasted mean component and a stochastic disturbance component:

$$P_{\mathrm{w}}(t)={\overline{P}}_{\mathrm{w}}(t)+{P^{\prime }}_{\mathrm{w}}(t)$$

(1)

where ${\overline{P}}_{\mathrm{w}}(t)$ denotes the forecasted mean power based on meteorological data, and $P_{\mathrm{w}}^{\prime }(t)$ represents the stochastic disturbance induced by wind speed modeling errors, which is modeled as an Ornstein–Uhlenbeck process [29] and can be expressed as

$$\mathrm{d}{P}_{\mathrm{w}}^{\prime }=-{\displaystyle \frac{1}{{\lambda }_{\mathrm{w}}}}{P}_{\mathrm{w}}^{\prime }\mathrm{d}t+\sqrt{{\displaystyle \frac{2{\sigma }_{\mathrm{w}}^2}{{\lambda }_{\mathrm{w}}}}}\mathrm{dW}$$

(2)

where ${\lambda }_{\mathrm{w}}$ is the correlation time constant, ${\sigma }_{\mathrm{w}}$ is the standard deviation of power fluctuations [30], and $\mathrm{W}$ denotes a standard Wiener process. This process captures the mean reverting behavior of wind power output over short time scales.

Accordingly, the wind power allocation strategy is formulated as

$$P_{\mathrm{w}}(t)=P_{\mathrm{w}, \mathrm{grid}}(t)+P_{\mathrm{w}, \mathrm{P}2\mathrm{G}}(t)$$

(3)

where

$$\begin{array}{l}{P}_{\mathrm{w}, \mathrm{grid}}(t)=\min (P_{\mathrm{w}}(t),P_{\mathrm{grid}}^{\max }(t))\\ P_{\mathrm{w}, \mathrm{P}2\mathrm{G}}(t)=\max (0,P_{\mathrm{w}}(t)-P_{\mathrm{grid}}^{\max }(t))\end{array}$$

(4)

where $P_{\mathrm{grid}}^{\max }(t)$ denotes the maximum wind power accommodation capacity of the grid. This complementary mechanism allows P2G to function as a flexible load, absorbing excess renewable energy, and the wind power allocation strategy is illustrated in Figure 3.

Equation (3) separates the wind power into two parts with different roles. The grid-connected part directly affects the power balance in the LFC model, while the surplus part consumed by P2G is converted into gas injection and then affects gas network pressure. Therefore, the wind power allocation model provides one of the coupling inputs between the power system and the gas network.

3.1.2. P2G Model

Through this allocation mechanism, P2G acts as a flexible load on the electrical side and as a gas injection source on the gas side. The gas produced by P2G is injected into the corresponding gas network node, thereby affecting the pressure distribution of the gas network and the available fuel supply of the GT.

The dynamic response of the P2G unit is modeled as a first-order inertial process to represent the delay in electrochemical conversion and flow regulation:

$${\tau }_{\mathrm{P}2\mathrm{G}}{\displaystyle \frac{\mathrm{d}{P}_{\mathrm{P}2\mathrm{G}}(t)}{dt}}=P_{\mathrm{w}, \mathrm{P}2\mathrm{G}}(t)-P_{\mathrm{P}2\mathrm{G}}(t)$$

(5)

where $P_{\mathrm{P}2\mathrm{G}}(t)$ denotes the actual electrical power consumed by the P2G unit at time t, and ${\tau }_{\mathrm{P}2\mathrm{G}}$ is the response time constant of the P2G unit.

After discretization with the sampling period $T_{\mathrm{s}}$, the P2G power dynamics can be written as

$$P_{\mathrm{P}2\mathrm{G}}(k+1)=P_{\mathrm{P}2\mathrm{G}}(k)+{\displaystyle \frac{T_{\mathrm{s}}}{{\tau }_{\mathrm{P}2\mathrm{G}}}}\left(P_{\mathrm{w}, \mathrm{P}2\mathrm{G}}(k)-P_{\mathrm{P}2\mathrm{G}}(k)\right)$$

(6)

This inertial model ensures smooth power transitions, mitigating potential shocks from abrupt wind fluctuations.

The gas production flow rate of the P2G unit is related to its electrical power consumption by energy conversion efficiency [31]:

$$Q_{\mathrm{P}2\mathrm{G}}(t)={\displaystyle \frac{P_{\mathrm{P}2\mathrm{G}}(t){\eta }_{\mathrm{P}2\mathrm{G}}}{L_{\mathrm{gas}}}}$$

(7)

where $Q_{\mathrm{P}2\mathrm{G}}(t)$ denotes the gas production flow rate of the P2G unit at time $t$, and ${\eta }_{\mathrm{P}2\mathrm{G}}$ is the electric-to-gas conversion efficiency during P2G operations (typically about 60%), and $L_{\mathrm{gas}}$ is the lower heating value of gas, which is taken as 12 MJ/m³.

3.2. Gas Turbine Power Regulation and Gas Consumption

Gas turbines participate in frequency regulation by responding to the secondary frequency control command generated by the LFC controller. Compared with conventional thermal units, GTs have faster response characteristics and stronger ramping capability, and therefore they can provide fast regulation support after load disturbances and renewable power fluctuations.

The gas consumption of the GT is determined by its electric power output and gas-to-electricity conversion efficiency:

$$Q_{\mathrm{GT}}(t)={\displaystyle \frac{P_{\mathrm{m}\_\mathrm{GT}}(t)}{{\eta }_{\mathrm{gas}}{L}_{\mathrm{gas}}}}$$

(8)

where $Q_{\mathrm{GT}}(t)$ is the gas consumption flow rate of the GT at time t; $P_{\mathrm{m}\_\mathrm{GT}}(t)$ is the power output of the gas turbine at time t; and ${\eta }_{\mathrm{gas}}$ is the gas-to-electricity conversion efficiency of the turbine (typically about 70%). This relation establishes the coupling from the power system to the gas network, because an increase in GT power output will lead to an increase in gas withdrawal from the corresponding gas supply node.

It should be noted that the GT output is constrained by the available gas supply from the gas network. In the LFC model, the turbine governor dynamics describe the response process from the control command to the mechanical power output, while the gas network determines whether sufficient fuel can be supplied to support the commanded generation. When the gas supply capacity or nodal pressure is insufficient, the available GT power capability is reduced. Therefore, the GT command generated by the controller must satisfy both the electrical-side regulation requirement and the gas-side fuel supply constraints.

3.3. Multi-Area LFC Dynamic Model

The power system considered in this paper consists of multiple interconnected control areas. Each area contains a conventional non-reheat thermal unit, a gas turbine unit, a wind farm, a P2G unit, local load demand, and an LFC controller. The control areas are interconnected through tie lines. A load disturbance in one area may cause frequency deviations in both local and neighboring areas through the tie-line dynamics.

For area i in Figure 2, the frequency response dynamics are governed by the swing equation:

$${\dot{f}}_i=-{\displaystyle \frac{D_i}{M_i}}{f}_i+{\displaystyle \frac{1}{M_i}}{P}_{\mathrm{m}i\_\mathrm{GT}}+{\displaystyle \frac{1}{M_i}}{P}_{\mathrm{m}i\_\mathrm{nonreheat}}-{\displaystyle \frac{1}{M_i}}{P}_{\mathrm{tie},i}-{\displaystyle \frac{1}{M_i}}(P_{\mathrm{L}i}-P_{\mathrm{w}i,\mathrm{grid}})$$

(9)

where $D_i$ and $M_i$ denote the load damping coefficient and inertia constant of the system in area i, respectively; $P_{\mathrm{L}i}$ and $P_{\mathrm{w}i,\mathrm{grid}}$ represent the load power and the change in wind power injected into the grid in area i, respectively; $P_{\mathrm{m}i\_\mathrm{GT}}$ and $P_{\mathrm{m}i\_\mathrm{nonreheat}}$ are the power output of the gas turbine and the non-reheat steam turbine in area i, respectively; $P_{\mathrm{tie},i}$ is the tie-line power deviation; and $f_i$ is the frequency deviation of area i.

The mechanical power dynamics of the gas turbine and the conventional thermal unit are described by first-order turbine models:

$$\begin{array}{l}{\dot{P}}_{\mathrm{m}i\_\mathrm{GT}}=-{\displaystyle \frac{1}{T_{\mathrm{t}i1}}}{P}_{\mathrm{m}i\_\mathrm{GT}}+{\displaystyle \frac{1}{T_{\mathrm{t}i1}}}{X}_{\mathrm{g}i\_\mathrm{GT}}\\ {\dot{P}}_{\mathrm{m}i\_\mathrm{nonreheat}}=-{\displaystyle \frac{1}{T_{\mathrm{t}i2}}}{P}_{\mathrm{m}i\_\mathrm{nonreheat}}+{\displaystyle \frac{1}{T_{\mathrm{t}i2}}}{X}_{\mathrm{g}i\_\mathrm{nonreheat}}\end{array}$$

(10)

where $T_{\mathrm{t}i1}$ and $T_{\mathrm{t}i2}$ are the turbine time constants of the gas turbine and the non-reheat steam turbine, respectively; and $X_{\mathrm{g}i\_\mathrm{GT}}$ and $X_{\mathrm{g}i\_\mathrm{nonreheat}}$ denote the valve opening variations of the gas turbine and the non-reheat steam turbine, respectively.

The corresponding governor dynamics are given by

$$\begin{array}{l}{\dot{X}}_{\mathrm{g}i\_\mathrm{gas}}=-{\displaystyle \frac{1}{T_{\mathrm{g}i1}{R}_{i1}}}{f}_i-{\displaystyle \frac{1}{T_{\mathrm{g}i1}}}{X}_{\mathrm{g}i\_\mathrm{GT}}+{\displaystyle \frac{1}{T_{\mathrm{g}i1}}}{u}_{i\_\mathrm{GT}}\\ {\dot{X}}_{\mathrm{g}i\_\mathrm{nonreheat}}=-{\displaystyle \frac{1}{T_{\mathrm{g}i2}{R}_{i2}}}{f}_i-{\displaystyle \frac{1}{T_{\mathrm{g}i2}}}{X}_{\mathrm{g}i\_\mathrm{nonreheat}}+{\displaystyle \frac{1}{T_{\mathrm{g}i2}}}{u}_{i\_\mathrm{nonrehaet}}\end{array}$$

(11)

where $R_{i1}$ and $R_{i2}$ are the primary frequency regulation coefficients of the two units; $T_{\mathrm{g}i1}$ and $T_{\mathrm{g}i2}$ are the governor time constants of the two units; and $u_{i\_\mathrm{GT}}$ and $u_{i\_\mathrm{nonrehaet}}$ are the control commands sent by the controller to the gas turbine and the non-reheat steam turbine, respectively.

The tie-line power deviation between area i and its neighboring area j is modeled as

$${\dot{P}}_{\mathrm{tie},i}={\displaystyle \sum _j{K}_{ij}(f_i-f_j)}$$

(12)

where $K_{ij}$ is the tie-line coupling gain between area i and area j, and $f_j$ denotes the frequency deviation of area j.

By assembling the frequency dynamics, turbine dynamics, governor dynamics, and tie-line dynamics, the continuous state space model of area i can be written as

$$\left\{\begin{array}{l}{\dot{\mathit{x}}}_i(t)={\mathit{A}}_i{\mathit{x}}_i(t)+{\mathit{B}}_i{\mathit{u}}_i(t)+{\mathit{F}}_i{\mathit{w}}_i(t)+{\displaystyle \sum _{j\ne i}{\mathit{A}}_{ij}{\mathit{x}}_j(t)}\\ {\mathit{y}}_i(t)={\mathit{C}}_i{\mathit{x}}_i\left(t\right)\end{array}\right.$$

(13)

where ${\mathit{u}}_i={[u_{i\_\mathrm{GT}},u_{i\_\mathrm{nonreheat}}]}^{\mathrm{T}}$ denotes the control input of area i; ${\mathit{A}}_i$, ${\mathit{B}}_i$, ${\mathit{F}}_i$, and ${\mathit{C}}_i$ are the state matrix, control input matrix, disturbance-input matrix, and output matrix of area i, respectively; and ${\mathit{A}}_{ij}$ is the state coupling matrix between areas i and j.

$$\begin{array}{ccccc}{\mathit{A}}_i=\left[\begin{array}{cccccc}-\frac{D_i}{M_i}& \frac{1}{M_i}& 0& \frac{1}{M_i}& 0& -\frac{1}{M_i}\\ 0& -\frac{1}{T_{\mathrm{t}i1}}& \frac{1}{T_{\mathrm{t}i1}}& 0& 0& 0\\ -\frac{1}{T_{\mathrm{g}i1}{R}_{i1}}& 0& -\frac{1}{T_{\mathrm{g}i1}}& 0& 0& 0\\ 0& 0& 0& -\frac{1}{T_{\mathrm{t}i2}}& \frac{1}{T_{\mathrm{t}i2}}& 0\\ -\frac{1}{T_{\mathrm{g}i2}{R}_{i2}}& 0& 0& 0& -\frac{1}{T_{\mathrm{g}i2}}& 0\\ {\displaystyle \sum _j}{K}_{ij}& 0& 0& 0& 0& 0\end{array}\right]& {\mathit{A}}_{ij}=\left[\begin{array}{cccccc}0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0\\ -K_{ij}& 0& 0& 0& 0& 0\end{array}\right]& {\mathit{C}}_i={\left[\begin{array}{c}1\\ 0\\ 0\\ 0\\ 0\\ 0\end{array}\right]}^{\mathrm{T}}& {\mathit{B}}_i=\left[\begin{array}{cc}0& 0\\ 0& 0\\ \frac{1}{T_{\mathrm{g}i1}}& 0\\ 0& 0\\ 0& \frac{1}{T_{\mathrm{g}i2}}\\ 0& 0\end{array}\right]& {\mathit{F}}_i=\left[\begin{array}{c}-\frac{1}{M_i}\\ 0\\ 0\\ 0\\ 0\\ 0\end{array}\right]\end{array}$$

(14)

The sampling period in this paper is $T_{\mathrm{s}}=1 \mathrm{s}$. After discretization, the system model is expressed as

$$\left\{\begin{array}{l}{\mathit{x}}_i(k+1)={\mathit{A}}_{\mathrm{d}i}{\mathit{x}}_i(k)+{\mathit{B}}_{\mathrm{d}i}{\mathit{u}}_i(k)+{\mathit{F}}_{\mathrm{d}i}{\mathit{w}}_i(k)+{\displaystyle \sum _{j\ne i}{\mathit{A}}_{\mathrm{d}ij}{\mathit{x}}_j(k)}\\ {\mathit{y}}_i(k)={\mathit{C}}_{\mathrm{d}i}{\mathit{x}}_i(k)\end{array}\right.$$

(15)

where ${\mathit{A}}_{\mathrm{d}i}$, ${\mathit{B}}_{\mathrm{d}i}$, ${\mathit{C}}_{\mathrm{d}i}$, ${\mathit{F}}_{\mathrm{d}i}$ and ${\mathit{A}}_{\mathrm{d}ij}$ are the corresponding discrete-time system matrices.

The state space model is used as the prediction model of the TMPC controller. The matrices describe the electrical dynamic response of each control area, while the gas pressure information is introduced through the GT output constraint rather than by changing the state matrix.

3.4. Gas Network Model

The gas network provides fuel for gas turbines and receives gas injections from P2G units. In a gas pipeline network, nodal pressures and pipeline flows are coupled through nodal balance equations and nonlinear pressure-flow relations [32]. Therefore, the gas network model is used to describe the pressure response caused by P2G gas injection, GT gas consumption, and gas load variations.

In this paper, the gas network model is not used for independent gas dispatch optimization. Its main role is to calculate the pressure states at the GT supply nodes, which are then used to determine the available GT power limits in the LFC controller.

Let ${\mathit{R}}_{\mathrm{g}}$ denote the set of gas nodes and ${\mathit{E}}_{\mathrm{g}}$ denote the set of gas pipelines.

Let $e$ denote a pipeline in ${\mathit{E}}_{\mathrm{g}}$, and let $e=({\mathrm{o}}_e,{\mathrm{d}}_e)$, where ${\mathrm{o}}_e$ and ${\mathrm{d}}_e$ are the inlet and outlet nodes of pipeline $e$ under the prescribed positive flow convention.

At discrete-time step $k$, ${\varphi }_r(k)$ denotes the pressure of gas node $r$ in ${\mathit{R}}_{\mathrm{g}}$, and $Q_r(k)$ denotes the net gas injection at node $r$. A positive $Q_r(k)$ represents gas injection, while a negative $Q_r(k)$ represents gas demand or gas withdrawal. For pipeline $e$, $Q_e^{\mathrm{in}}\left(k\right)$ and $Q_e^{\mathrm{out}}\left(k\right)$ denote the inlet and outlet flow rates of the pipeline, respectively, and $m_e(k)$ denotes the linepack, namely the amount of gas stored in the pipeline.

3.4.1. Nodal Balance

For each node $r$ in ${\mathit{R}}_{\mathrm{g}}$, the gas balance equation is written as

$${\displaystyle \sum _{e\in {\mathit{E}}_g{, \mathrm{d}}_e=r}{Q}_e^{\mathrm{out}}(k)}-{\displaystyle \sum _{e\in {\mathit{E}}_g,{\mathrm{o}}_e=r}{Q}_e^{\mathrm{in}}(k)}+Q_r(k)=0$$

(16)

where ${\displaystyle \sum _{e\in {\mathit{E}}_g{, \mathrm{d}}_e=r}{Q}_e^{\mathrm{out}}(k)}$ represents the total gas flow entering node $r$; and ${\displaystyle \sum _{e\in {\mathit{E}}_g,{ \mathrm{o}}_e=r}{Q}_e^{\mathrm{in}}(k)}$ represents the total gas flow leaving node $r$. $Q_r(k)$ is decomposed as

$$Q_r(k)=Q_{\mathrm{base},r}(k)+Q_{\mathrm{load},r}(k)+Q_{\mathrm{P}2\mathrm{G},r}(k)-Q_{\mathrm{GT},r}(k)$$

(17)

where $Q_{\mathrm{base},r}(k)$ denotes the base injection at node $r$; $Q_{\mathrm{load},r}(k)$ denotes the gas load disturbance at node $r$; $Q_{\mathrm{P}2\mathrm{G},r}(k)$ denotes the gas injection contributed by P2G units connected to node $r$ obtained from Equation (7); and $Q_{\mathrm{GT},r}(k)$ denotes the gas withdrawal caused by GT fuel consumption at node $r$ obtained from Equation (8).

Physically, Equation (16) represents the gas flow conservation at node $r$. The incoming and outgoing pipeline flows are balanced with the net nodal injection $Q_r(k)$. As shown in Equation (17), P2G units increase the nodal gas injection, while GT fuel consumption and gas load reduce the available gas at the node. Therefore, the nodal pressure variation is determined by the combined effects of pipeline flows, P2G injection, GT consumption, and gas load disturbance.

3.4.2. Linepack Dynamics

To describe the transient buffering capability of gas pipelines, a linepack state is introduced for each pipeline, as illustrated in Figure 4. The linepack dynamics of pipeline e are expressed as

$$m_e(k+1)=m_e(k)+\Delta t_{\mathrm{g}}\times [Q_e^{\mathrm{in}}(k)-Q_e^{\mathrm{out}}(k)]$$

(18)

where $\Delta t_{\mathrm{g}}$ is the gas network update interval.

The relationship between linepack and nodal pressure is approximated by the average pressure of the two terminal nodes:

$$m_e(k+1)={\alpha }_e\times {\displaystyle \frac{[{\varphi }_{{\mathrm{o}}_e}(k+1)+{\varphi }_{{\mathrm{d}}_e}(k+1)]}{2}}$$

(19)

where ${\alpha }_e$ is the linepack coefficient of pipeline $e$, which depends on the pipeline geometry and gas parameters.

The linepack state describes the gas stored in the pipeline and introduces temporal coupling into the gas network. Because of linepack, changes in P2G injection or GT gas consumption do not affect all nodal pressures instantaneously, but propagate through the pipeline dynamics.

3.4.3. Pressure Flow Relation

Based on the Weymouth relation between pipeline flow and squared pressure difference [32], the nonlinear gas flow equation is given by

$$Q_e^{\mathrm{avg}}(k)\left|Q_e^{\mathrm{avg}}(k)\right|={\beta }_e\left\{{\left[{\varphi }_{{\mathrm{o}}_e}(k)\right]}^2-{\left[{\varphi }_{{\mathrm{d}}_e}(k)\right]}^2\right\}$$

(20)

$$Q_e^{\mathrm{avg}}(k)={\displaystyle \frac{\left[Q_e^{\mathrm{in}}(k)+Q_e^{\mathrm{out}}(k)\right]}{2}}$$

(21)

where $Q_e^{\mathrm{avg}}(k)$ is the average gas flow rate of pipeline $e$ and ${\beta }_e$ is the pipeline flow coefficient.

3.5. GT Power Limit Constrained by Gas Pressure

The electrical output of a GT is limited by the amount of fuel gas that can be supplied from its connected gas node. This gas constraint does not replace the turbine and governor dynamics in the LFC model. Instead, it restricts the admissible GT power range according to the available fuel supply. Let $r_{\mathrm{GT}}$ denote the gas node supplying the GT and ${\varphi }_{r_{\mathrm{GT}}}(k)$ denote the gas pressure of node $r_{\mathrm{GT}}^l$.

To describe the influence of gas pressure on fuel availability, a pressure availability coefficient is introduced as

$${\chi }_{r_{\mathrm{GT}}}(k)={\displaystyle \frac{{\varphi }_{r_{\mathrm{GT}}}(k)-{\varphi }_{r_{\mathrm{GT}}}^{\min }}{{\varphi }_{r_{\mathrm{GT}}}^{\mathrm{ref}}-{\varphi }_{r_{\mathrm{GT}}}^{\min }}}$$

(22)

where ${\varphi }_{r_{\mathrm{GT}}}^{\min }$ is the minimum pressure required for the operation of the GT, and ${\varphi }_{r_{\mathrm{GT}}}^{\mathrm{ref}}$ is the reference pressure corresponding to the rated fuel supply. If ${\varphi }_{r_{\mathrm{GT}}}(k)<{\varphi }_{r_{\mathrm{GT}}}^{\min }$, then ${\chi }_{r_{\mathrm{GT}}}(k)=0$, and ${\varphi }_{r_{\mathrm{GT}}}(k)\le {\varphi }_{r_{\mathrm{GT}}}^{\mathrm{ref}}$.

The maximum gas flow that can be supplied to GT is then expressed as

$$Q_{r_{\mathrm{GT}}}^{\max }(k)={\chi }_{r_{\mathrm{GT}}}(k)\times Q_{r_{\mathrm{GT}}}^{\mathrm{rated}}(k)$$

(23)

where $Q_{r_{\mathrm{GT}}}^{\max }(k)$ is the available gas flow of node $r_{\mathrm{GT}}$; and $Q_{r_{\mathrm{GT}}}^{\mathrm{rated}}(k)$ is the rated gas flow of node $r_{\mathrm{GT}}$, which is obtained from the gas network model in Section 3.4.

According to the gas-to-electricity conversion relation in Equation (8), the corresponding GT power limit $P_{\mathrm{m}\_\mathrm{GT}}^{\max }(t)$ is obtained as

$$P_{\mathrm{m}\_\mathrm{GT}}^{\max }(t)={\eta }_{\mathrm{gas}}{L}_{\mathrm{gas}}\times Q_{r_{\mathrm{GT}}}^{\max }(k)$$

(24)

Under normal operations, this pressure-based limit reflects the actual fuel supply capability.

3.6. False Data Injection Attack Model

In the LFC system, measurements are transmitted from field sensors to the control center, while control commands are delivered from the control center to the generation units through the communication network. Such dependence on communication networks makes the system vulnerable to cyberattacks. By infiltrating the communication network, an attacker can inject false data into the measurement signals and cause the control center to receive incorrect information. Consequently, the controller may make erroneous decisions. As a result, the stable operation of the system may be compromised.

The gas pressure measurement ${\widehat{\varphi }}_{r_{\mathrm{GT}}}(k)$ received by the control center can be expressed as

$${\widehat{\varphi }}_{r_{\mathrm{GT}}}(k)={\varphi }_{r_{\mathrm{GT}}}(k)+a_{r_{\mathrm{GT}}}(k)$$

(25)

where $a_{r_{\mathrm{GT}}}(k)$ is the injected false data at node $r_{\mathrm{GT}}$. In the absence of FDIA, $a_{r_{\mathrm{GT}}}(k)=0$, and the controller receives the normal pressure measurement, namely ${\widehat{\varphi }}_{r_{\mathrm{GT}}}(k)={\varphi }_{r_{\mathrm{GT}}}(k)$.

When an FDIA occurs at node $r_{\mathrm{GT}}$, the corrupted pressure is used by the controller to evaluate the gas supply condition of the GT. As a result, the pressure availability coefficient in Section 3.5 is distorted, the available GT gas flow inferred by the controller becomes inaccurate, and the corresponding GT power limit used in the controller constraint is incorrectly updated. This error then affects the power allocation among regulation units and may finally degrade the frequency regulation performance of the gas–electricity coupling system.

4. Auxiliary Kalman Filter-Based Gas Pressure Estimation and Reconstruction

This section develops an auxiliary Kalman filter (AKF)-based pressure estimation and reconstruction scheme to protect the gas pressure measurements used for updating the GT available power limits. In line with secure state estimation methods for cyber–physical systems, the proposed AKF acts as a virtual pressure state estimator. It constructs a dynamic reduced-order model for the pressure states associated with GT gas supply nodes by using attack-free operating data and measurable coupling variables from the gas–electricity coupling system.

The basic idea is to generate an independent pressure state prediction and compare it with the gas pressure measurement received by the controller. Under normal operation, the innovation residual mainly reflects model mismatch, process disturbance, and measurement noise. Under FDIA, the manipulated pressure state component causes an abnormal deviation between the received measurement and the AKF prediction. Therefore, residual-based statistics can be used to detect whether the pressure state used by the controller has been compromised.

Once an abnormal pressure state is detected, the attacked measurement is excluded from the AKF correction step and is replaced by the AKF-estimated pressure. The reconstructed pressure is then used to update the controller-side GT power limit. In this way, the proposed method connects pressure state estimation, residual-based FDIA detection, pressure reconstruction, and TMPC constraint correction within a mitigation framework.

4.1. Data-Driven Pressure State Model Identification

The pressure state to be estimated is defined by the nodal pressures at the GT gas supply nodes. For the multi-area system considered in this paper, ${\mathit{\Phi }}_{\mathrm{GT}}(k)={\left[{\varphi }_1^{\mathrm{GT}}(k),{\varphi }_2^{\mathrm{GT}}(k),\cdots ,{\varphi }_i^{\mathrm{GT}}(k)\right]}^{\mathrm{T}}$ denotes the gas network pressure state used for GT constraint calculation, and ${\varphi }_i^{\mathrm{GT}}(k)$ denotes the GT node gas pressure in area i. The auxiliary pressure state is then constructed from the pressure state and its increment.

The pressure dynamics are affected by both gas-side and electrical-side operating conditions. Gas-side variables, such as P2G gas injection, gas load variation, and GT gas consumption directly change the nodal gas balance. Electrical-side variables, such as load disturbance, wind power variation, frequency deviation, tie-line power deviation, and LFC commands, influence GT power output and therefore indirectly change gas withdrawal. Hence, the estimator should use coupled operating information instead of relying only on the current pressure measurement.

To represent the local pressure evolution with a low-order model, the auxiliary pressure state is defined as

$${\mathit{X}}_{\mathrm{gas}}(k)=\left[{\mathit{\Phi }}_{\mathrm{GT}}{(k)}^{\mathrm{T}},\Delta {\mathit{\Phi }}_{\mathrm{GT}}{(k)}^{\mathrm{T}}\right]$$

(26)

$$\Delta {\mathit{\Phi }}_{\mathrm{GT}}(k)={\mathit{\Phi }}_{\mathrm{GT}}(k)-{\mathit{\Phi }}_{\mathrm{GT}}(k-1)$$

(27)

where $\Delta {\mathit{\Phi }}_{\mathrm{GT}}(k)$ is introduced to improve the transient tracking capability of the estimator. The pressure increment is included because the absolute pressure alone may not fully describe short-term pressure variations. By augmenting the pressure state with its increment, the estimator can better capture transient pressure changes caused by gas injection, gas withdrawal, and load variations.

The auxiliary input vector is constructed from measurable coupling variables and is written in compact form as

$${\mathit{U}}_{\mathrm{gas}}(k)={\left[{\mathit{\xi }}_{\mathrm{gas}}{(k)}^{\mathrm{T}},{\mathit{\xi }}_{\mathrm{elec}}{(k)}^{\mathrm{T}}\right]}^{\mathrm{T}}$$

(28)

where ${\mathit{\xi }}_{\mathrm{gas}}(k)$ includes P2G injection, gas load, and GT gas consumption; and ${\mathit{\xi }}_{\mathrm{elec}}(k)$ includes load disturbance, wind power variation, frequency deviation, tie line power deviation, and recent LFC commands.

It should be noted that ${\mathit{U}}_{\mathrm{gas}}(k)$ is not completely independent of the attacked control process. The GT output and the corresponding GT gas consumption included in ${\mathit{U}}_{\mathrm{gas}}(k)$ can be affected by gas pressure FDIA through the closed-loop control response. However, this influence is indirect and delayed. The AKF predicts the current pressure using the posterior estimate and auxiliary input from the previous sampling instant. Therefore, the falsified pressure measurement at the current sampling instant does not directly enter the one-step pressure prediction. Once an abnormal pressure measurement is detected, the compromised pressure is reconstructed before being used to update the GT available power constraints, which helps limit the propagation of FDIA to GT output and gas consumption.

The reduced order pressure state model is then described as

$${\mathit{X}}_{\mathrm{gas}}(k+1)={\mathit{A}}_{\mathrm{gas}}{\mathit{X}}_{\mathrm{gas}}(k)+{\mathit{B}}_{\mathrm{gas}}{\mathit{U}}_{\mathrm{gas}}(k)+{\mathrm{c}}_{\mathrm{gas}}+{\mathit{\omega }}_{\mathrm{gas}}(k)$$

(29)

$${\mathit{y}}_{\mathrm{gas}}(k)={\mathit{C}}_{\mathrm{gas}}{\mathit{X}}_{\mathrm{gas}}(k)+{\mathit{v}}_{\mathrm{gas}}(k)$$

(30)

where ${\mathit{y}}_{\mathrm{gas}}(k)$ is the measured pressure state vector used by the controller; ${\mathit{A}}_{\mathrm{gas}}$, ${\mathit{B}}_{\mathrm{gas}}$, and ${\mathit{C}}_{\mathrm{gas}}$ are the model parameters to be identified and ${\mathrm{c}}_{\mathrm{gas}}$ is the affine offset term used to represent the nonzero operating point and unmodeled constant effects; and ${\mathit{\omega }}_{\mathrm{gas}}(k)$ and ${\mathit{v}}_{\mathrm{gas}}(k)$ are process noise and measurement noise, respectively.

The output matrix ${\mathit{C}}_{\mathrm{gas}}$ is selected to extract the pressure components from ${\mathit{X}}_{\mathrm{gas}}(k)$:

$${\mathit{C}}_{\mathrm{gas}}=\left[\mathit{I},0\right]$$

(31)

The model parameters are identified offline from attack-free operating data. Let $N_{\mathrm{gas}}$ denote the number of attack-free samples used for model identification. The recorded data sequence is denoted by

$${\mathit{\Gamma }}_{\mathrm{gas}}=\{[{\mathit{X}}_{\mathrm{gas}}(1),{\mathit{U}}_{\mathrm{gas}}(1)],[{\mathit{X}}_{\mathrm{gas}}(2),{\mathit{U}}_{\mathrm{gas}}(2)],\cdots ,[{\mathit{X}}_{\mathrm{gas}}(N_{\mathrm{gas}}),{\mathit{U}}_{\mathrm{gas}}(N_{\mathrm{gas}})]\}$$

(32)

Based on this sequence, ${\mathit{X}}_{\mathrm{gas}}^{-}$, ${\mathit{X}}_{\mathrm{gas}}^{+}$ and ${\mathit{U}}_{\mathrm{gas}}^{-}$ data matrices are constructed:

$$\begin{array}{l}{\mathit{X}}_{\mathrm{gas}}^{-}=\left[{\mathit{X}}_{\mathrm{gas}}(1),{\mathit{X}}_{\mathrm{gas}}(2),\cdots {\mathit{X}}_{\mathrm{gas}}(N_{\mathrm{gas}}-1)\right]\\ {\mathit{X}}_{\mathrm{gas}}^{+}=\left[{\mathit{X}}_{\mathrm{gas}}(2),{\mathit{X}}_{\mathrm{gas}}(3),\cdots {\mathit{X}}_{\mathrm{gas}}(N_{\mathrm{gas}})\right]\\ {\mathit{U}}_{\mathrm{gas}}^{-}=\left[{\mathit{U}}_{\mathrm{gas}}(1),{\mathit{U}}_{\mathrm{gas}}(2),\cdots ,{\mathit{U}}_{\mathrm{gas}}(N_{\mathrm{gas}}-1)\right]\end{array}$$

(33)

where ${\mathit{X}}_{\mathrm{gas}}^{-}$ is the current pressure states from $k=1$ to $k=N_{\mathrm{gas}}-1$; ${\mathit{X}}_{\mathrm{gas}}^{+}$ is the next step pressure states from $k=2$ to $k=N_{\mathrm{gas}}$; and ${\mathit{U}}_{\mathrm{gas}}^{-}$ is the corresponding coupling inputs $k=1$ to $k=N_{\mathrm{gas}}-1$. In the simulation study, $N_{\mathrm{gas}}=900$.

Therefore, the regression matrix is formed as $\mathit{\Omega }={\left[{\mathit{X}}_{\mathrm{gas}}^{-},{\mathit{U}}_{\mathrm{gas}}^{-},{\mathit{I}}_{N_{\mathrm{gas}}-1}\right]}^{\mathrm{T}}$, where ${\mathit{I}}_{N_{\mathrm{gas}}-1}$ is a column vector of ones with length $N_{\mathrm{gas}}-1$. The parameter matrix is defined as ${\mathit{\Theta }}_{\mathrm{gas}}=\left[{\mathit{A}}_{\mathrm{gas}},{\mathit{B}}_{\mathrm{gas}},{\mathrm{c}}_{\mathrm{gas}}\right]$.

Using regularized least squares, the model parameters are obtained as

$${\mathit{\Theta }}_{\mathrm{gas}}={\mathit{X}}_{\mathrm{gas}}^{+}{\mathit{\Omega }}^{\mathrm{T}}{\left(\mathit{\Omega }{\mathit{\Omega }}^{\mathrm{T}}+{\lambda }_{\mathrm{g}}\mathit{I}\right)}^{-1}$$

(34)

where ${\lambda }_{\mathrm{g}}$ is the regularization coefficient used in the least squares identification. In this paper, ${\lambda }_{\mathrm{g}}$ is set to 1 × 10⁻⁶.

After the model is identified, the process noise covariance ${\mathit{\Psi }}_{\mathrm{gas}}$ used by the AKF can be calibrated from the one-step prediction residual: ${\mathit{\Psi }}_{\mathrm{gas}}=\mathrm{cov}\left({\mathit{\omega }}_{\mathrm{gas}}(k)\right)=\mathrm{cov}\left({\mathit{X}}_{\mathrm{gas}}^{+}-{\mathit{\Theta }}_{\mathrm{gas}}\mathit{\Omega }\right)$.

Similarly, the measurement noise covariance ${\mathit{H}}_{\mathrm{gas}}$ can be estimated from attack-free pressure measurement data. Let ${\mathit{Y}}_{\mathrm{gas}}^{-}=\left[{\mathit{y}}_{\mathrm{gas}}(1),{\mathit{y}}_{\mathrm{gas}}(2),\cdots ,{\mathit{y}}_{\mathrm{gas}}(N_{\mathrm{gas}}-1)\right]$, then ${\mathit{H}}_{\mathrm{gas}}=\mathrm{cov}\left({\mathit{v}}_{\mathrm{gas}}(k)\right)=\mathrm{cov}\left({\mathit{Y}}_{\mathrm{gas}}^{-}-{\mathit{C}}_{\mathrm{gas}}{\mathit{X}}_{\mathrm{gas}}^{-}\right)$.

The covariance matrix ${\mathit{\Psi }}_{\mathrm{gas}}$ is used to describe the uncertainty of the identified pressure state model, while ${\mathit{H}}_{\mathrm{gas}}$ represents the uncertainty of the pressure measurement channel.

The identified model is not intended to replace the nonlinear gas network model described in Section 3.4. Its role is to provide an independent virtual pressure sensor for the protected pressure states. Therefore, the subsequent AKF can compare the received state measurement with the model-based pressure prediction and generate residual information for FDIA detection and reconstruction.

The reliability of the identified pressure model depends on the quality of the attack-free operating data. Measurement noise, missing data, and abnormal samples may affect the accuracy of the identified pressure dynamics. Noise may enlarge the normal innovation residual, missing measurements may break the temporal consistency of the pressure sequence, and contaminated samples may bias the identified model parameters. Therefore, pressure samples with unrealistic jumps, missing measurements, or physically inconsistent values are removed or corrected before model identification. Short missing intervals can be filled by interpolation, while long missing intervals are excluded from the identification dataset. After the model parameters are obtained, an independent validation dataset is used to evaluate the one-step prediction residual. If persistent residual bias or abnormal outliers appear, the identification dataset and model parameters should be recalibrated. This preprocessing procedure helps reduce the influence of noisy or contaminated data on AKF-based pressure estimation and FDIA detection.

4.2. Online Pressure State Estimation

After the reduced-order pressure state model is identified, it is used to construct an online pressure state estimator. The purpose of this estimator is to provide an independent prediction of the pressure state at the GT gas supply nodes. This prediction is not obtained directly from the received pressure measurement, but from the identified pressure dynamics and the coupled gas–electricity inputs. Therefore, it can be used as a reference signal for residual generation and subsequent attack detection.

The online AKF follows a prediction–correction structure. In the prediction step, the pressure state is estimated using the identified pressure model and the latest coupling input. In the correction step, the received pressure measurement is used only when it is regarded as reliable.

At the $k$ th sampling instant, the AKF first predicts the pressure state according to the posterior estimate at the previous sampling instant and the latest available coupling input:

$${\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k-1)={\mathit{A}}_{\mathrm{gas}}{\widehat{\mathit{X}}}_{\mathrm{gas}}(k-1|k-1)+{\mathit{B}}_{\mathrm{gas}}{\mathit{U}}_{\mathrm{gas}}(k-1)+{\mathrm{c}}_{\mathrm{gas}}$$

(35)

where ${\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k-1)$ is the prior estimate of the auxiliary pressure state; and ${\widehat{\mathit{X}}}_{\mathrm{gas}}(k-1|k-1)$ is the posterior estimate at the previous sampling instant. The corresponding prediction error covariance ${\mathit{\Xi }}_{\mathrm{gas}}$ is updated as

$${\mathit{\Xi }}_{\mathrm{gas}}(k|k-1)={\mathit{A}}_{\mathrm{gas}}{\mathit{\Xi }}_{\mathrm{gas}}(k-1|k-1){\mathit{A}}_{\mathrm{gas}}^{\mathrm{T}}+{\mathit{\Psi }}_{\mathrm{gas}}$$

(36)

where ${\mathit{\Xi }}_{\mathrm{gas}}(k|k-1)$ represents the uncertainty of the prior estimate.

The predicted pressure measurement is obtained by

$${\widehat{\mathit{y}}}_{\mathrm{gas}}(k|k-1)={\mathit{C}}_{\mathrm{gas}}{\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k-1)$$

(37)

Let ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{c}}(k)$ denote the pressure measurement received by the controller. Under normal operation, ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{c}}(k)$ is equal to the pressure measurement ${\mathit{y}}_{\mathrm{gas}}(k)$. Under FDIA, ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{c}}(k)$ may contain the injected false data. The innovation residual is defined as ${\mathit{z}}_{\mathrm{gas}}(k)={\mathit{y}}_{\mathrm{gas}}^{\mathrm{c}}(k)-{\widehat{\mathit{y}}}_{\mathrm{gas}}(k|k-1)$.

The innovation residual measures the consistency between the received pressure measurement and the AKF prediction. A small residual indicates that the received pressure measurement is consistent with the AKF prediction. A large residual indicates that the measurement may contain abnormal information, such as FDIA, model mismatch, or excessive noise. If the pressure measurement is not attacked, this residual is mainly caused by model uncertainty and measurement noise. If the pressure state is manipulated by FDIA, the residual will contain the effect of the injected false data. The covariance of the innovation residual ${\mathit{S}}_{\mathrm{gas}}(k)$ is calculated as

$${\mathit{S}}_{\mathrm{gas}}(k)={\mathit{C}}_{\mathrm{gas}}{\mathit{\Xi }}_{\mathrm{gas}}(k|k-1){\mathit{C}}_{\mathrm{gas}}^{\mathrm{T}}+{\mathit{H}}_{\mathrm{gas}}$$

(38)

When the received pressure measurement is regarded as reliable, the Kalman gain ${\mathit{L}}_{\mathrm{gas}}(k)$ is calculated by

$${\mathit{L}}_{\mathrm{gas}}(k)={\mathit{S}}_{\mathrm{gas}}(k|k-1){\mathit{C}}_{\mathrm{gas}}^{\mathrm{T}}{\mathit{S}}_{\mathrm{gas}}^{-1}(k)$$

(39)

Then, the posterior pressure state estimate is updated as

$${\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k)={\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k-1)+{\mathit{L}}_{\mathrm{gas}}(k)z_{\mathrm{gas}}(k)$$

(40)

Therefore, the posterior estimate of the pressure vector is obtained by

$${\widehat{\mathit{y}}}_{\mathrm{gas}}(k|k)={\mathit{C}}_{\mathrm{gas}}{\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k)$$

(41)

However, when the received pressure measurement is unreliable, the ${\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k)$ is set to ${\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k)={\widehat{\mathit{X}}}_{\mathrm{gas}}(k|k-1)$.

In the simulations, the initial estimation error covariance is set as ${\mathit{\Xi }}_{\mathrm{gas}}(0|0)=1\times {10}^{-3}{\mathit{I}}_4$. The process noise covariance ${\mathit{\Psi }}_{\mathrm{gas}}$ is calibrated from the one-step prediction residual of the identified model, while the measurement noise covariance is set as ${\mathit{H}}_{\mathrm{gas}}=1\times {10}^{-5}{\mathit{I}}_2$.

4.3. Residual-Based FDIA Detection

The online pressure state estimator in Section 4.2 provides predicted pressure measurement and an innovation residual. This residual reflects the consistency between the received pressure measurement and the pressure state predicted by the AKF. Therefore, it can be used to detect whether the pressure state used by the controller has been manipulated.

The residual-based detection strategy uses three complementary indicators. The absolute residual threshold detects direct pressure deviations, the NIS statistic normalizes the residual by the AKF estimation uncertainty, and the windowed normalized innovation squared (NIS) and cumulative sum (CUSUM) statistics enhance sensitivity to slowly varying or sinusoidal attacks.

Under normal operation, the received pressure measurement can be expressed as ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{c}}(k)={\mathit{C}}_{\mathrm{gas}}{\mathit{X}}_{\mathrm{gas}}(k)+{\mathit{v}}_{\mathrm{gas}}(k)$. When FDIA occurs on the pressure state measurement, the received signal becomes ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{c}}(k)={\mathit{C}}_{\mathrm{gas}}{\mathit{X}}_{\mathrm{gas}}(k)+{\mathit{v}}_{\mathrm{gas}}(k)+{\mathit{a}}_{\mathrm{gas}}(k)$, where ${\mathit{a}}_{\mathrm{gas}}(k)$ denotes the injected false pressure data. Therefore, under attack-free operations, ${\mathit{z}}_{\mathrm{gas}}(k)$ is mainly determined by model uncertainty and measurement noise. Under FDIA, the injected false data ${\mathit{a}}_{\mathrm{gas}}(k)$ appears in the residual and changes its magnitude or statistical distribution. This provides the basis for residual-based attack detection.

Since each control area contains one protected GT pressure measurement channel, the following detection statistics are evaluated independently for each area. To account for the uncertainty of the AKF prediction, the normalized innovation squared (NIS) statistic is constructed as

$$g(k)={\displaystyle \frac{{{\mathit{z}}^2}_{\mathrm{gas}}(k)}{{\mathit{S}}_{\mathrm{gas}}(k)}}$$

(42)

Compared with a direct residual threshold, this statistic normalizes the residual by the expected estimation uncertainty. The NIS statistics are motivated by the classical chi-square innovation test in Kalman filtering. Under ideal linear Gaussian assumptions with accurately known innovation covariance, a single-sample NIS can be interpreted through a chi-square distribution. However, the gas pressure model used in this paper is a reduced-order model identified from closed-loop gas–electricity coupling data. Load steps, wind power fluctuations, P2G operation, GT constraints, and gas network nonlinearities may cause the empirical NIS distribution to deviate from the theoretical chi-square distribution. Therefore, the chi-square relation is used only to motivate the normalized residual statistic, while the actual detection thresholds are calibrated from attack-free validation data.

However, a single-sample statistic may be insufficient for detecting slowly varying or sinusoidal FDIA. Therefore, a windowed NIS statistic is introduced to accumulate residual energy over a short detection window:

$$G(k)={\displaystyle \sum _{l=0}^{l_{\mathrm{d}}-1}g(k-l)}$$

(43)

where $l_{\mathrm{d}}$ is the detection window length.

In addition, a cumulative sum (CUSUM) statistic is adopted to track sustained residual deviations:

$$\varsigma (k)=\max (0,\rho \varsigma (k-1)+{‖{\mathit{z}}_{\mathrm{gas}}(k)‖}_2-\gamma )$$

(44)

where $\rho$ is a forgetting factor, which can reduce the influence of old residual information; and $\gamma$ is a drift parameter, which prevents normal small residuals from accumulating continuously.

The FDIA alarm is triggered when any of the following residual-based conditions is satisfied:

$${‖{\mathit{z}}_{\mathrm{gas}}(k)‖}_2>\epsilon , G(k)>\mathrm{\Gamma }, \mathit{\varsigma }(k)>h$$

(45)

where $\epsilon$, $\mathrm{\Gamma }$, and $h$ are the thresholds of the residual norm, windowed NIS, and CUSUM statistics, respectively.

The AKF model and detection thresholds are calibrated before the FDIA test cases. First, attack-free simulation trajectories are generated to represent normal operating conditions of the gas–electricity coupling system. These trajectories include electrical load changes, gas-side load variations, wind power fluctuations, P2G operation, and GT fuel-consumption variations, while no gas pressure FDIA is imposed. The pressure-state model is identified from the calibration data using regularized least squares. Then, the identified AKF is evaluated on attack-free validation data to obtain the residual-based statistics under normal operation. The thresholds are selected according to the statistical distribution of these validation statistics, with the objective of maintaining a low false-positive level under normal operating transients. Once determined, the thresholds are fixed and reused in all subsequent FDIA test cases, and no attacked test data are used for threshold selection.

The local detection flag for the considered pressure measurement channel is defined as

$$\theta (k)=\left\{\begin{array}{l}1, \mathrm{if} \mathrm{an} \mathrm{FDIA} \mathrm{alarm} \mathrm{is} \mathrm{triggerd},\\ 0, \mathrm{otherwise}.\end{array}\right.$$

(46)

It should be noted that the detection flag $\theta (k)$ is defined locally for the pressure measurement channel of the considered area.

When $\theta (k)=0$, the received pressure measurement is regarded as reliable and can be used in the normal AKF correction step. When $\theta (k)=1$, the received pressure measurement is regarded as suspicious.

Based on the above calibration procedure, the area-specific thresholds used in the simulations are obtained from attack-free validation data. In the simulations, the window length of the NIS statistic is set to $l_{\mathrm{d}}=5$. The area-specific NIS thresholds are set to $\mathrm{\Gamma }=452.632$ for Area 1 and $\mathrm{\Gamma }=382.548$ for Area 2. The absolute residual threshold is set to $\epsilon =0.15 \mathrm{bar}$ for both areas. For the CUSUM detector, the drift parameter, forgetting factor, and threshold are selected as $\gamma =0.05 \mathrm{bar}$, $\rho =0.55$, and $h=0.25 \mathrm{bar}$, respectively.

4.4. Gas Pressure Reconstruction

After the residual-based detector identifies abnormal pressure measurements, the received pressure signal should not be directly used by the controller. Otherwise, the manipulated pressure may lead to an incorrect GT power limit and mislead the controller optimization. Therefore, a gas pressure reconstruction strategy is introduced to provide a reliable pressure signal for the subsequent constraint update.

Let ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{rec}}(k)$ denote the reconstructed pressure used for control. Based on the FDIA detection flag $\theta (k)$, the reconstructed pressure is defined as

$${\mathit{y}}_{\mathrm{gas}}^{\mathrm{rec}}(k)=\left\{\begin{array}{l}{\mathit{y}}_{\mathrm{gas}}^{\mathrm{c}}(k),\theta (k)=0\\ {\widehat{\mathit{y}}}_{\mathrm{gas}}(k|k), \theta (k)=1\end{array}\right.$$

(47)

It should be noted that this reconstruction does not change the physical gas pressure of the network. It only corrects the pressure information used by the controller. The true gas pressure is still determined by the gas network dynamics, whereas ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{rec}}(k)$ is the controller-side pressure signal used to calculate the available GT power capability.

Then, ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{rec}}(k)$ is sent to the pressure-dependent GT constraint update, and ${\mathit{y}}_{\mathrm{gas}}^{\mathrm{rec}}(k)$ is expected to be closer to the true pressure state, thereby reducing the mismatch between the controller-perceived GT power limit and the actual gas supply capability.

The reconstruction is a controller-side information correction rather than a physical modification of the gas network. When the received pressure is reliable, the controller uses the measured pressure. When the received pressure is suspicious, the controller uses the AKF-estimated pressure to avoid updating the GT constraints with attacked data.

In practical gas–electricity coupling systems, the AKF-based reconstruction method can be implemented as a controller-side virtual pressure-sensing and information-correction layer between the pressure measurement system and the TMPC constraint-update module. The reconstructed pressure does not change the physical gas pressure of the network but corrects the pressure information used by the controller to update the GT available power limit. Its practical application requires available pressure measurements at GT gas supply nodes, measurable gas–electricity coupling variables, representative attack-free data for pressure model identification, and threshold calibration data covering normal operating variations. Under these conditions, the AKF-based reconstruction strategy can provide a feasible supervisory mechanism for reducing the propagation of gas pressure FDIA to GT constraints and frequency control.

Although the proposed AKF-based reconstruction method can provide an independent virtual pressure estimate for controller-side constraint correction, several practical challenges should be noted.

• The AKF relies on the reduced-order pressure state model identified from attack-free data. If the gas network parameters, operating point, or load pattern change significantly, the model prediction error may increase, which may further affect the reliability of residual generation and pressure reconstruction.
• When the injected false data has a small magnitude, the corresponding residual may be close to normal measurement noise and model uncertainty. In this case, the attack becomes more difficult to distinguish from normal pressure fluctuations, and the detection rate may decrease.
• The AKF uses measurable gas–electricity coupling variables as auxiliary inputs, such as P2G injection, GT gas consumption, load variation, wind power variation, and control commands. If these input variables are also corrupted or severely disturbed, the pressure prediction accuracy of the AKF may be degraded.

Therefore, in practical applications, the AKF-based reconstruction layer should be supported by reliable data preprocessing, proper validation data selection, and consistency checks between gas-side and electrical-side measurements.

5. Tube-Based MPC Framework

Gas–electricity coupling systems are exposed to unavoidable stochastic fluctuations and cyber-induced disturbances, which may degrade closed-loop regulation performance. To enhance system robustness, this paper develops a tube-based MPC framework composed of a nominal predictive controller and a local feedback compensator.

5.1. Nominal Model Predictive Control

For the gas–electricity coupling LFC system established in Section 3, the controller is required to regulate the system frequency while satisfying the physical constraints of generation units and the gas-side fuel supply limitation of the GT. In addition, because the available GT power limit may be distorted by gas pressure FDIA, the controller should not directly rely on the attacked pressure measurement. Therefore, the reconstructed gas pressure obtained in Section 4 is incorporated into the prediction model and constraint update of the proposed TMPC.

At sampling instant $k$, the local discrete-time model of area i is expressed as

$$\left\{\begin{array}{l}{\overline{\mathit{x}}}_i(k+n+1)={\mathit{A}}_{\mathrm{d}i}{\overline{\mathit{x}}}_i(k+n)+{\mathit{B}}_{\mathrm{d}i}{\overline{\mathit{u}}}_i(k+n)+{\mathit{F}}_{\mathrm{d}i}{\overline{\mathit{w}}}_i(k+n)+{\displaystyle \sum _{j\ne i}{\mathit{A}}_{\mathrm{d}ij}{\overline{\mathit{x}}}_j(k+n)}\\ {\overline{\mathit{y}}}_i(k+n)={\mathit{C}}_{\mathrm{d}i}{\overline{\mathit{x}}}_i(k+n)\end{array}\right.$$

(48)

where ${\overline{\mathit{x}}}_i(k+n)$ and ${\overline{\mathit{x}}}_j(k+n)$ are the nominal state predicted at time $k$ in area i and j, respectively; ${\overline{\mathit{u}}}_i(k+n)$ and ${\overline{\mathit{y}}}_i(k+n)$ are the corresponding nominal control input and nominal output, respectively; ${\overline{\mathit{w}}}_i(k+n)$ denotes the predicted disturbance; $n=0,1,2,\dots ,N_{\mathrm{ctrl}}$; and $N_{\mathrm{ctrl}}$ is the prediction horizons of TMPC.

For simplicity, the measured disturbance at the current sampling instant is used as the disturbance prediction over the finite horizon, namely, ${\overline{\mathit{w}}}_i(\left.k+n\right|k)=\mathit{w}(k)$.

The prediction model describes the electrical dynamics of each control area. The reconstructed gas pressure does not change this dynamic model directly. Instead, it updates the pressure-dependent GT power limit used in the constraint set of the nominal MPC problem.

5.2. Cost Function and Constraint Formulation

The nominal MPC problem is designed to suppress frequency deviation and avoid excessive control variations. The cost function of area i is formulated as

$$J_i(k)={\displaystyle {\displaystyle \sum _{n=1}^{N_{\mathrm{ctrl}}}}{\mathit{Q}}_{yi}}{({\overline{\mathit{y}}}_i(k+n|k)-{\mathit{r}}_i(k+n|k))}^2+{\displaystyle {\displaystyle \sum _{n=0}^{N_{\mathrm{ctrl}}-1}}{\mathit{Q}}_{ui}}{({\overline{\mathit{u}}}_i(k+n|k)-{\overline{\mathit{u}}}_i(k+n-1|k))}^2$$

(49)

where ${\mathit{Q}}_{yi}$ and ${\mathit{Q}}_{ui}$ are weighting matrices for output tracking and input variation, respectively; and ${\mathit{r}}_i(k+n|k)$ is the reference trajectory, which is set to zero for frequency regulation.

In addition to the conventional generation limits, the available output of the GT is also constrained by the gas-side fuel supply condition. According to the pressure-dependent gas-to-electricity conversion relation in Equation (24), the maximum available GT power in area i at time $k$ can be obtained as $P_{\mathrm{m}\_\mathrm{GT},i}^{\max }(k)$. Therefore, this pressure-based generation limit is embedded into the nominal MPC constraints to ensure that the predicted GT output does not exceed the capability supported by the available fuel supply.

The GT output constraint is formulated as

$$0\le {\mathit{C}}_{\mathrm{GT},i}{\overline{\mathit{x}}}_i\le P_{\mathrm{m}\_\mathrm{GT},i}^{\max }(k)$$

(50)

where ${\mathit{C}}_{\mathrm{GT},i}$ is the selection matrix used to extract the GT mechanical power state from the state vector ${\overline{\mathit{x}}}_i$; and $P_{\mathrm{m}\_\mathrm{GT},i}^{\max }(t)$ is calculated from Equation (24).

To ensure the constraint satisfaction of the actual system under bounded disturbance mismatch, the original physical constraints are imposed on the nominal variables in tightened forms. For area i, ${\mathit{K}}_i$ denotes the local feedback gain used for tube-based constraint tightening, and its design is presented in Section 5.3. ${\mathit{Z}}_i$ denotes the robust invariant error set, whose construction is further discussed in Remark 1. It should be noted that ${\mathit{K}}_i$ and ${\mathit{Z}}_i$ are designed offline according to the local closed-loop error dynamics and the prescribed bounded disturbance mismatch set. Based on ${\mathit{K}}_i$ and ${\mathit{Z}}_i$, the nominal input, output, and ramp-rate constraint sets are tightened to reserve adequate margins for the local feedback term. Based on the above cost function and by further incorporating unit power, frequency deviation, and ramp-rate constraints, the nominal MPC optimization problem for each area is formulated as follows:

$$\underset{{\overline{\mathit{u}}}_i(k+m|k)}{\min }{J}_i(k)$$

$$\mathrm{s}.\mathrm{t}. {\overline{\mathit{x}}}_i(k+1)={\mathit{A}}_{\mathrm{d}i}{\overline{\mathit{x}}}_i(k)+{\mathit{B}}_{\mathrm{d}i}{\overline{\mathit{u}}}_i(k)+{\mathit{F}}_{\mathrm{d}i}{\overline{\mathit{w}}}_i(k)$$

$${\overline{\mathit{x}}}_i(k+N|k)=0$$

$${\mathit{x}}_i(k)-{\overline{\mathit{x}}}_i(k)\in {\mathit{Z}}_i$$

(51)

$${\overline{\mathit{u}}}_i(k+m|k)\in {\mathit{U}}_i\ominus {\mathit{K}}_i{\mathit{Z}}_i$$

$${\overline{\mathit{y}}}_i(k+m|k)\in {\mathit{Y}}_i\ominus {\mathit{C}}_{\mathrm{d}i}{\mathit{Z}}_i$$

$$\Delta {\overline{\mathit{u}}}_i={\overline{\mathit{u}}}_i(k+m|k)-{\overline{\mathit{u}}}_i(k+m-1|k)\in \Delta {\mathit{U}}_i\ominus {\mathit{K}}_i\left({\mathit{Z}}_i\oplus \left(-{\mathit{Z}}_i\right)\right)$$

$$0\le {\mathit{C}}_{\mathrm{GT},i}{\overline{\mathit{x}}}_i\le P_{\mathrm{m}\_\mathrm{GT},i}^{\max }(t)$$

where ${\mathit{y}}_{\max }$ and ${\mathit{y}}_{\min }$ denote the upper and lower bounds of the system output, ensuring that the frequency deviation in each area remains within the allowable range; ${\mathit{u}}_i^{\max }$ and ${\mathit{u}}_i^{\min }$ are the upper and lower limits of each unit’s power output; $\Delta {\mathit{u}}_i^{\mathrm{up}}$ and $\Delta {\mathit{u}}_i^{\mathrm{down}}$ represent the ramp-up and ramp-down limits of each unit, which prevent excessively fast power changes; and ${\mathit{U}}_i=\left\{\left.{\mathit{u}}_i\right|{\mathit{u}}_i^{\min }\le {\mathit{u}}_i\le {\mathit{u}}_i^{\max }\right\}$, ${\mathit{Y}}_i=\left\{\left.{\mathit{y}}_i\right|{\mathit{y}}_{\min }\le {\mathit{y}}_i\le {\mathit{y}}_{\max }\right\}$, $\Delta {\mathit{U}}_i=\left\{\left.\Delta {\mathit{u}}_i\right|\Delta {\mathit{u}}_i^{\mathrm{down}}\le \Delta {\mathit{u}}_i\le \Delta {\mathit{u}}_i^{\mathrm{up}}\right\}$, and $\Delta {\mathit{u}}_i={\mathit{u}}_i(k+m|k)-{\mathit{u}}_i(k+m-1|k)$.

By solving the optimization problem (51), the nominal control input sequence ${\overline{\mathit{u}}}_i(k)$ can be obtained, and the nominal state ${\overline{\mathit{x}}}_i(k)$ can be computed from the state space Equation (48).

5.3. Robust Feedback Control

The nominal MPC trajectory is generated based on the predicted model. However, the actual system may deviate from the nominal trajectory because of wind power uncertainty, load disturbance, and model mismatch. To compensate for this deviation, a local feedback term is introduced into the control law.

The actual control input applied to area i is defined as

$${\mathit{u}}_i(k)={\overline{\mathit{u}}}_i(k)+{\mathit{K}}_i{\mathit{z}}_i(k)$$

(52)

where ${\mathit{z}}_i(k)={\mathit{x}}_i(k)-{\overline{\mathit{x}}}_i(k)$ is the deviation between the actual state and the nominal state; and ${\mathit{K}}_i$ is the feedback gain.

The feedback gain ${\mathit{K}}_i$ is selected such that the local closed-loop error dynamics are stable. It can be obtained by solving an LQR problem [33]:

$${\mathit{K}}_i=-{({\mathit{Q}}_{ui}+{{\mathit{B}}_{\mathrm{d}i}}^{\mathrm{T}}{\mathit{P}}_i{\mathit{B}}_{\mathrm{d}i})}^{-1}{{\mathit{B}}_{\mathrm{d}i}}^{\mathrm{T}}{\mathit{P}}_i{\mathit{A}}_{\mathrm{d}i}$$

(53)

where ${\mathit{P}}_i$ is the solution of the corresponding discrete Riccati equation:

$$-{{\mathit{A}}_{\mathrm{d}i}}^{\mathrm{T}}{\mathit{P}}_i{\mathit{B}}_{\mathrm{d}i}{({\mathit{Q}}_{ui}+{{\mathit{B}}_{\mathrm{d}i}}^{\mathrm{T}}{\mathit{P}}_i{\mathit{B}}_{\mathrm{d}i})}^{-1}{{\mathit{B}}_{\mathrm{d}i}}^{\mathrm{T}}{\mathit{P}}_i{\mathit{A}}_{\mathrm{d}i}+{{\mathit{A}}_{\mathrm{d}i}}^{\mathrm{T}}{\mathit{P}}_i{\mathit{A}}_{\mathrm{d}i}+{\mathit{Q}}_{yi}={\mathit{P}}_i$$

(54)

Based on the invariant error set ${\mathit{Z}}_i$ and the feedback law (52), the nominal constraints are tightened to reserve margins for feedback compensation. If ${\mathit{z}}_i(k)\in {\mathit{Z}}_i$, then the feedback correction satisfies ${\mathit{K}}_i{\mathit{z}}_i(k)\in {\mathit{K}}_i{\mathit{Z}}_i$. Therefore, the nominal input constraint is tightened as ${\overline{\mathit{u}}}_i(k+m|k)\in {\mathit{U}}_i\ominus {\mathit{K}}_i{\mathit{Z}}_i$, which ensures that the actual input ${\mathit{u}}_i(k)$ remains within the original admissible set ${\mathit{U}}_i$. Similarly, the nominal output is constrained by ${\overline{\mathit{y}}}_i(k+m|k)\in {\mathit{Y}}_i\ominus {\mathit{C}}_{\mathrm{d}i}{\mathit{Z}}_i$. For the ramp-rate constraint, the change of the feedback term is also considered, and the tightened constraint is written as $\Delta {\overline{\mathit{u}}}_i(k+m|k)\in \Delta {\mathit{U}}_i\ominus {\mathit{K}}_i\left({\mathit{Z}}_i\oplus \left(-{\mathit{Z}}_i\right)\right)$. Thus, the original input, output, and ramp-rate constraints of the actual system can be satisfied through the combination of the invariant error set and tightened nominal constraints.

The nominal MPC provides the planned control action, while the feedback term corrects the deviation between the actual and nominal states. This structure allows the controller to maintain robustness without repeatedly redesigning the optimization problem online.

Remark 1.

For area i, the local error dynamics can be expressed as  ${\mathit{z}}_i(k+1)={\mathit{A}}_{\mathrm{c}i}{\mathit{e}}_i(k)+{\mathit{F}}_{\mathrm{d}i}{\mathit{d}}_i(k)$, where  ${\mathit{A}}_{\mathrm{c}i}=A_{\mathrm{d}i}+{\mathit{B}}_{\mathrm{d}i}{\mathit{K}}_i$,  ${\mathit{d}}_i(k)={\mathit{w}}_i(k)-{\overline{\mathit{w}}}_i(k)$, and  ${\mathit{d}}_i(k)$  denote the mismatch between the actual disturbance and the predicted disturbance. Define the equivalent disturbance set as  ${\mathit{W}}_i=\left\{\left.{\mathit{F}}_{\mathrm{d}i}{\mathit{d}}_i(k)\right|{\mathit{d}}_i(k)\in {\mathit{D}}_i\right\}$  , where  ${\mathit{D}}_i$  is the bounded disturbance mismatch set. If there exists a set  ${\mathit{Z}}_i$  satisfying  ${\mathit{A}}_{\mathrm{c}i}{\mathit{Z}}_i\oplus {\mathit{W}}_i\subseteq {\mathit{Z}}_i$  , then  ${\mathit{Z}}_i$  is a robust invariant set for the local error system. In this case, once  ${\mathit{z}}_i(k)\in {\mathit{Z}}_i$  , the next-step state satisfies  ${\mathit{x}}_i(k+1)\in {\overline{\mathit{x}}}_i(k+1)\oplus {\mathit{Z}}_i$  for all admissible  ${\mathit{d}}_i(k)\in {\mathit{D}}_i$  . In this paper,  ${\mathit{D}}_i$  is selected to cover the considered disturbance prediction error while maintaining the feasibility of the tightened MPC problem. A larger  ${\mathit{D}}_i$  leads to a larger invariant set  ${\mathit{Z}}_i$, which further tightens the nominal constraints and may increase conservativeness or even cause problem infeasibility.

6. Simulation Results and Discussion

To validate the effectiveness of the proposed auxiliary Kalman filter-based pressure reconstruction and tube-based MPC framework, simulations are carried out on a gas–electricity coupling LFC system in MATLAB 2021b, as shown in Figure 5. The studied system consists of two interconnected power control areas and an 11-node gas network, and each power area includes a non-reheat thermal unit, a gas turbine, a wind farm, a P2G unit, and a TMPC controller. The two areas are connected through a tie line, and the gas network provides fuel supply constraints for the gas turbines while receiving gas injections from the P2G units.

The sampling period of the power system is set to $T_{\mathrm{s}}=1 \mathrm{s}$, and the update interval of the gas network is set to $\Delta t_{\mathrm{g}}=10 \mathrm{s}$. The prediction horizon of the tube-based MPC is set to $N_{\mathrm{ctrl}}=40$, and the simulation duration is $T=900 \mathrm{s}$.

The main parameters of the two-area power system are listed in

Table 1. Parameters of the two-area electricity system.

Parameter	Value	Parameter	Value
Tg11	0.06 s	Tg21	0.08 s
Tt11	0.35 s	Tt21	0.30 s
Tg12	0.05 s	Tg22	0.05 s
Tt12	0.30 s	Tt22	0.31 s
M1	18.00 s	D1	0.03 p.u./Hz
M2	18.60 s	D2	2.80 × 10−2 p.u./Hz
R11	0.42 Hz/p.u.	R12	0.33 Hz/p.u.
R21	0.45 Hz/p.u.	R22	0.30 Hz/p.u.
K12	0.20 p.u./Hz	K21	0.20 p.u./Hz

. The generation limits of the units in the two areas are ${\mathit{u}}_1^{\max }=[0.40;0.25]$ p.u., ${\mathit{u}}_1^{\min }=[0.00;0.00]$ p.u.; ${\mathit{u}}_2^{\max }=[0.38;0.25]$ p.u., and ${\mathit{u}}_2^{\min }=[0.00;0.00]$ p.u. The ramp-rate limits of the generators in both areas are $\Delta {\mathit{u}}_i^{\mathrm{up}}=[0.01;0.02]$ p.u./s and $\Delta {\mathit{u}}_i^{\mathrm{down}}=[0.01;0.02]$ p.u./s. The maximum grid-connected wind power in the two areas is $P_{\mathrm{grid}, 1}^{\max }=0.20$ p.u. and $P_{\mathrm{grid}, 2}^{\max }=0.15$ p.u., respectively.

For the gas network, the P2G units in the two areas are assumed to have identical parameters; thus, ${\tau }_{\mathrm{P}2\mathrm{G}}=50$. The 11-node gas network contains 12 pipelines, as shown in Figure 5. Node 1 is selected as the reference pressure node, with a reference pressure ${\varphi }_{r_{\mathrm{GT}}}^{\mathrm{ref}}=42 \mathrm{bar}$. The minimum allowable pressure for GT gas supply is set to ${\varphi }_{r_{\mathrm{GT}}}^{\min }=39.2 \mathrm{bar}$. In Area 1, the GT is supplied by gas node 4, and the P2G unit injects gas into node 3. In Area 2, the GT is supplied by gas node 9, and the P2G unit injects gas into node 11. The gas load disturbances are mainly applied to nodes 4, 7, and 11. The main parameters of the 11-node gas network used in the simulations are listed in

Table 2. Parameters of the 11-node gas network.

Pipeline $({\mathbf{o}}_{\mathit{e}},{\mathbf{d}}_{\mathit{e}})$	Diameter (mm)	Length (km)
(1, 2)	280	4
(2, 3)	220	2
(3, 4)	220	2
(4, 5)	160	3
(5, 6)	160	2
(6, 7)	160	4
(7, 8)	160	3
(8, 9)	160	2
(9, 10)	160	2
(10, 11)	220	3
(11, 2)	220	3
(4, 10)	180	5

.

The load demand of the electricity system and wind power outputs of the interconnected system are shown in Figure 6, and the gas load demand is illustrated in Figure 7. The power base in this paper is 500 MW, and the rated system frequency is 50 Hz.

Three control methods are compared in this study, namely tube-based MPC (TMPC), conventional MPC, and PI. To ensure the fairness and reproducibility of the comparative simulations, the main tuning parameters of the compared controllers are summarized in

Table 3. Tuning parameters of the three controllers.

Controller	Parameters
TMPC	$Q_{y1}=Q_{y2}=\mathrm{diag}(25,1,1,1,1,1,1),$ $Q_{u1}=Q_{u2}=\mathrm{diag}(1,1),$ $N_{\mathrm{ctrl}}=40$
MPC	$Q_{y1}=Q_{y2}=\mathrm{diag}(25,1,1,1,1,1,1),$ $Q_{u1}=Q_{u2}=\mathrm{diag}(1,1),$ $N_{\mathrm{ctrl}}=40$
PI	$K_{\mathrm{P}1}=K_{\mathrm{P}2}=10,$ $K_{\mathrm{I}1}=K_{\mathrm{I}2}=2$

. The PI controller is implemented using fixed proportional and integral gains $K_{\mathrm{P}i}$ and $K_{\mathrm{I}i}$ for each control area i.

The control performance is evaluated by the integral absolute error (IAE), the integral of time-weighted squared error (ITSE), and the mean value (Mean) of frequency deviation, defined as

$$\begin{array}{l}\mathrm{IAE}={\displaystyle {\int }_{t=0}^T\left|f_1(t)\right|+\left|f_2(t)\right|}dt\\ \mathrm{ITSE}={\displaystyle {\int }_{t=0}^T(f_1^2}+f_2^2)tdt\end{array}$$

(55)

To evaluate the system level pressure reconstruction accuracy, the mean absolute error of gas pressure is adopted [34], defined as

$$\mathrm{MAE}={\displaystyle \frac{1}{\left|{\sigma }_{\mathrm{g}}\right|}}{\displaystyle \underset{{\sigma }_{\mathrm{g}}}{\int }{‖{\mathit{y}}_{\mathrm{gas}}^{\mathrm{rec}}(k)-{\mathit{y}}_{\mathrm{gas}}(k)‖}_1}$$

(56)

where ${\sigma }_{\mathrm{g}}$ is the evaluated time interval. For FDIA cases, ${\sigma }_{\mathrm{g}}$ is selected as the attack interval set.

To evaluate the effectiveness of FDIA detection, the detection rate is adopted, which represents the proportion of actual attacked samples that are correctly identified by the detection mechanism. It is defined as

$$\mathrm{Detection} \mathrm{Rate}={\displaystyle \frac{N_{\mathrm{TP}}}{N_{\mathrm{TP}}+N_{\mathrm{FN}}}}\times 100\%$$

(57)

where $N_{\mathrm{TP}}$ denotes the number of true positive samples, namely the samples under FDIA that are correctly detected as attacks, and $N_{\mathrm{FN}}$ denotes the number of false negative samples, namely the samples under FDIA that are not detected by the detection mechanism.

In addition, to evaluate whether the proposed AKF-based detector incorrectly triggers alarms under attack-free operation, the false-positive rate is defined as

$$\mathrm{False}-\mathrm{positive} \mathrm{Rate}={\displaystyle \frac{N_{\mathrm{FP}}}{N_{\mathrm{FP}}+N_{\mathrm{TN}}}}\times 100\%$$

(58)

where $N_{\mathrm{FP}}$ denotes the number of normal samples incorrectly identified as attacked samples, and $N_{\mathrm{TN}}$ denotes the number of normal samples correctly identified as normal samples.

6.1. Frequency Regulation Performance Under the No-Attack Condition

In this case, three control methods, including the proposed TMPC, conventional MPC, and PI control, are employed to regulate the frequency of the gas–electricity coupling system under the no-attack condition. The same load disturbances, wind power fluctuations, and system parameters are adopted for all methods to ensure a fair comparison.

As shown in Figure 6b, wind power is introduced into the interconnected system, and the corresponding P2G power consumption is presented in Figure 8. By dynamically absorbing surplus wind energy, the P2G units attenuate short-term wind power fluctuations and provide a smoother power input for subsequent frequency regulation.

The frequency responses and tie-line power deviations are shown in Figure 9 and Figure 10, respectively, and the corresponding performance indices are summarized in

Table 4. Performance of the three control methods under the no-attack condition.

	IAE ($\mathbf{Hz}·\mathbf{s}$)	ITSE (${\mathbf{Hz}}^2·{\mathbf{s}}^2$)	Mean ($\mathbf{Hz}$)
TMPC	0.7040	4.3723	0.0008
MPC	1.9626	5.5841	0.0022
PI	2.9834	9.3452	0.0033

.

For the power system, Figure 9a,b present the frequency responses of the two areas under the three control methods. Under TMPC, the frequency deviations caused by load changes are rapidly suppressed, and the frequency returns to the steady state with limited subsequent oscillations. Although several instantaneous deviations are comparable to those under MPC, TMPC produces less persistent fluctuation over the entire simulation period. Conventional MPC exhibits slightly larger accumulated deviations. In contrast, the PI controller produces larger frequency peaks and more noticeable fluctuations, indicating weaker disturbance rejection capability.

Table 4 summarizes the performance indices of the three control methods. The IAE of TMPC is 0.7040 Hz·s, which is reduced by approximately 64% and 76% compared with MPC and PI control, respectively, indicating the smallest accumulated frequency deviation. In terms of ITSE, TMPC achieves reductions of approximately 22% and 53% compared with MPC and PI control, respectively, demonstrating faster attenuation of sustained frequency deviations. The mean frequency deviation under TMPC is 0.0008 Hz, which is approximately 64% and 76% lower than those of MPC and PI control, respectively, showing better steady-state frequency accuracy.

Figure 10a,b show the tie-line power deviations between the two areas. TMPC effectively limits the tie-line power fluctuations and restores the scheduled interchange power rapidly after each disturbance. MPC exhibits larger transient oscillations, whereas the PI controller presents the largest deviations and the slowest recovery, particularly near the major load-changing instants.

Overall, the proposed TMPC provides the best comprehensive frequency regulation performance under the no-attack condition. It reduces the accumulated frequency deviation, accelerates disturbance recovery, and suppresses tie-line power fluctuations more effectively than the other two control methods, thereby establishing a reliable control baseline for the subsequent gas pressure FDIA and reconstruction studies.

It should be noted that, under this condition, the proposed detector produces 18 false alarms among 1800 monitored pressure samples, resulting in a false-positive rate of 1.00%. For the two monitored gas pressure nodes, the false-positive rate values are both 1.00%. This result indicates that the proposed detector maintains a low false-positive rate under normal operating transients and does not frequently misclassify load variations as attacks.

6.2. Effectiveness of the Proposed AKF-Based Pressure Reconstruction Under Gas Pressure FDIA

To evaluate the impact of gas pressure FDIA, the pressure measurements used by the controller are manipulated by the attack signals shown in Figure 11, and the FDIA amplitude is set to 0.30 bar. Since the attack does not directly alter the physical gas network states, it affects the power system by corrupting the pressure information used to update the GT available power limits.

For the power system, Figure 12a,b present the frequency responses of the two areas with and without pressure reconstruction. Without reconstruction, noticeable frequency deviations occur near the load-changing and attack-switching instants because the corrupted pressure measurements lead to inaccurate estimates of the available GT regulation capability. After AKF reconstruction, the frequency fluctuations in both areas are significantly reduced and rapidly decay after each disturbance.

Table 5. Frequency regulation and pressure reconstruction performance under gas pressure FDIA.

	IAE ($\mathbf{Hz}·\mathbf{s}$)	ITSE (${\mathbf{Hz}}^2·{\mathbf{s}}^2$)	Mean ($\mathbf{Hz}$)	MAE ($\mathbf{bar}$)
No attack	0.7040	4.3723	0.0008	N/A
No reconstruction (rec)	1.1645	13.4836	0.0013	0.1714
AKF reconstruction	0.7039	4.3533	0.0008	0.0157

summarizes the corresponding performance indices. The IAE decreases from 1.1645 to 0.7039 Hz·s, representing a reduction of approximately 40%. The ITSE decreases from 13.4836 to 4.3533 Hz²·s², corresponding to a reduction of approximately 68%, while the mean frequency deviation decreases from 0.0013 to 0.0008 Hz. These results indicate that the proposed reconstruction strategy effectively reduces accumulated frequency deviation and improves disturbance-recovery performance.

For the gas network, Figure 13a,b show the pressure trajectories under the different cases. Without reconstruction, the attacked measurements deviate considerably from the actual pressure. After AKF reconstruction, the estimated pressure closely follows the true trajectory, and the pressure MAE decreases from 0.1714 to 0.0157 bar, corresponding to a reduction of approximately 91%. Only small transient errors remain at the attack activation and removal instants because the estimator requires a short adjustment period.

Figure 14a,b further present the GT available power limits. The falsified pressure measurements produce inaccurate GT limits without reconstruction, whereas the limits obtained from the reconstructed pressure remain close to those under the no-attack condition.

Overall, the proposed AKF-based strategy effectively prevents gas pressure FDIA from propagating to the GT constraint and frequency control layers.

6.3. Comparison of Different Pressure Reconstruction Strategies

To further evaluate the effectiveness of the proposed AKF-based pressure reconstruction method, two representative reconstruction strategies are introduced as comparison baselines. The first is a denoising autoencoder (DAE)-based method inspired by [35], in which an encoder–decoder network is trained using attack-free measurements to recover corrupted pressure data. The second is a graph signal recovery method motivated by [36], which exploits the smoothness of system states over the network topology to reconstruct abnormal or unavailable measurements. Both methods are adapted to detection and gas pressure reconstruction under the same FDIA scenario.

For a fair comparison of detection and reconstruction performance, each baseline method is equipped with its own residual-based detection rule. For the DAE-based method, the detection residual is defined as the absolute difference between the received pressure measurement and the reconstructed pressure. For the graph signal recovery method, the detection residual is defined as the absolute difference between the received pressure measurement and the pressure predicted from neighboring gas nodes. In both baselines, an abnormal pressure measurement is detected when the corresponding residual exceeds its method-specific threshold calibrated from attack-free data.

Since effective pressure reconstruction restores the controller inputs close to their no-attack values, comparing different controllers would largely reproduce the performance trends already observed in Section 6.1 and obscure the specific contribution of the reconstruction method. Therefore, the TMPC controller is kept unchanged for all cases, while the DAE, graph signal recovery, and proposed AKF methods are compared in terms of pressure estimation accuracy, reconstructed GT available power limits, and frequency regulation performance. The corresponding results are presented in Figure 15, Figure 16 and Figure 17 and

Table 6. Performance comparison of different pressure reconstruction strategies under gas pressure FDIA.

	IAE ($\mathbf{Hz}·\mathbf{s}$)	ITSE (${\mathbf{Hz}}^2·{\mathbf{s}}^2$)	Mean ($\mathbf{Hz}$)	MAE ($\mathbf{bar}$)	Detection Rate
No attack	0.7040	4.3723	0.0008	N/A	N/A
DAE reconstruction	1.1706	12.9860	0.0013	0.1139	33.87%
Graph reconstruction	0.6966	4.3397	0.0008	0.0316	75.16%
AKF reconstruction	0.7039	4.3533	0.0008	0.0157	98.39%

.

For the power system, Figure 15a,b show the frequency responses of the two areas under the three reconstruction methods. The DAE method produces relatively large frequency deviations because some attacked measurements are not effectively detected and reconstructed. Graph signal recovery and the proposed AKF significantly suppress the frequency fluctuations, and their frequency responses are nearly identical.

Table 6 summarizes the corresponding performance indices. Compared with DAE reconstruction, the proposed AKF reduces the IAE from 1.1706 to 0.7039 Hz·s and the ITSE from 12.9860 to 4.3533 Hz²·s², corresponding to reductions of approximately 40% and 66%, respectively. The mean frequency deviation is also reduced from 0.0013 to 0.0008 Hz. Although graph signal recovery achieves slightly lower IAE and ITSE values, the differences are only 0.0073 Hz·s and 0.0136 Hz²·s², indicating that the two methods provide almost the same frequency regulation performance.

For the gas network, Figure 16a,b present the reconstructed pressure trajectories. The DAE method exhibits noticeable residual errors and fluctuations, while graph signal recovery provides more accurate pressure estimates. The proposed AKF remains closest to the no-attack trajectory, with the pressure MAE reduced to 0.0157 bar and the detection rate increased to 98.39%. Compared with graph signal recovery, the proposed method reduces the MAE by approximately 50% and improves the detection rate from 75.16% to 98.39%.

Figure 17a,b further show the GT available power limits obtained from the reconstructed pressures. The limits under DAE reconstruction deviate considerably from the normal trajectories, whereas those obtained by graph signal recovery and the proposed AKF remain closer to the no-attack condition. More importantly, the proposed method does not rely solely on historical data distributions or static spatial correlations. Its innovation lies in integrating the gas pressure dynamic model, residual-based attack detection, and online recursive reconstruction into the TMPC framework, thereby providing higher reconstruction accuracy, stronger physical interpretability, and more reliable mitigation of gas pressure FDIA.

Overall, the proposed AKF achieves the highest detection rate and the lowest pressure reconstruction error, while maintaining frequency regulation performance close to that of graph signal recovery. By integrating the gas pressure dynamic model, residual-based attack detection, and online recursive estimation, the proposed method provides a more accurate, physically interpretable, and reliable solution for mitigating gas pressure FDIA in gas–electricity coupling systems.

6.4. Robustness Under Different FDIA Amplitudes

To further examine the robustness of the proposed framework to variations in attack intensity, additional simulations are conducted under different gas pressure FDIA amplitudes. The detailed frequency responses, pressure reconstruction results, GT available power limits, and quantitative indices are provided in Appendix A. Overall, the proposed framework maintains stable frequency regulation across the tested cases. Larger attacks are detected and reconstructed more accurately, whereas attacks with low amplitudes are more difficult to distinguish from normal pressure fluctuations but cause only limited degradation in frequency regulation.

It should be noted that low-amplitude FDIA reflects a tradeoff between detection sensitivity and false-positive suppression. For the 0.20 bar and 0.25 bar cases, the residuals are close to normal pressure fluctuations, so some attacked samples are not detected by the fixed threshold. However, these weak attacks cause limited distortion of GT power limits and have only minor influence on frequency regulation. Future work will further improve low amplitude FDIA detection through adaptive threshold updating and multi-source gas–electricity measurement fusion.

6.5. Applicability Verification in an Extended IEEE 30-Bus Gas-Electricity Coupling System

6.5.1. Extended Test System and Operating Profiles

To further verify the applicability of the proposed AKF-TMPC framework in a larger benchmark system, an extended gas–electricity coupling simulation system is constructed in this section. Following the benchmark-system construction practice in [37], where a modified IEEE 30-bus power network is coupled with a natural gas network for integrated energy system resilience analysis, this paper builds an extended test system by combining the IEEE 30-bus power network with the 11-node looped gas network used in this study, as shown in Figure 18. The purpose of this case is to examine whether the proposed pressure reconstruction and frequency control strategy remains effective when multiple generators, transmission network constraints, gas pressure dynamics, pressure-dependent GT generation limits, wind power fluctuations, and P2G operation are considered simultaneously.

The power network is based on the IEEE 30-bus benchmark system, which contains 30 buses, six synchronous generators, and 41 transmission branches. The bus, generator, and branch data are adopted from the IEEE 30-bus power-flow benchmark. The six generators are connected to buses 1, 2, 13, 22, 23, and 27. Among them, the generators connected to buses 2 and 22 are modeled as gas turbines, because their available generation limits are directly affected by gas pressure. The static generation upper limits of these two GT units are 80 MW and 50 MW, respectively. The remaining four generators are modeled as conventional non-GT synchronous generators. Specifically, the generator at bus 1 has a static upper limit of 80 MW, the generator at bus 13 has a static upper limit of 40 MW, the generator at bus 23 has a static upper limit of 30 MW, and the generator at bus 27 has a static upper limit of 55 MW.

The gas network used in this extended case is the same 11-node looped gas system described in the previous section; therefore, the internal gas network topology and pipeline model are not repeated here. The GT connected to power bus 2 is supplied by gas node 4, while the GT connected to power bus 22 is supplied by gas node 9. Accordingly, gas nodes 4 and 9 are selected as the pressure measurement nodes exposed to FDIA. When the pressure measurements at these two nodes are corrupted, the controller obtains incorrect pressure-dependent GT generation limits, which further affects the frequency regulation performance.

In the IEEE 30-bus benchmark, the load demand is distributed over multiple buses rather than concentrated at a single node. In this extended case, the load buses are defined as the buses with nonzero active power demand in the original IEEE 30-bus data, including buses 2, 3, 4, 5, 7, 8, 10, 12, 14, 15, 16, 17, 18, 19, 20, 21, 23, 24, 26, 29, and 30. The total load variation of the system is shown in Figure 19.

Wind power is connected to buses 5 and 27. The P2G units are connected to power buses 7 and 30, and inject gas into gas nodes 3 and 11, respectively. The corresponding wind power outputs and P2G power consumption are shown in Figure 20 and Figure 21.

The FDIA is imposed on the gas pressure measurements at gas nodes 4 and 9, which supply the two GT units connected to power buses 2 and 22, respectively. A sinusoidal FDIA with an amplitude of 0.3 bar is considered. The injected FDIA signals are shown in Figure 22, where Figure 22a and Figure 22b correspond to gas nodes 4 and 9, respectively. A negative half-cycle sinusoidal FDIA is adopted because negative pressure falsification has a stronger adverse effect on the frequency regulation performance in the studied system. Since GT available power limits are calculated from gas pressure measurements, negative FDIA may mislead the controller and distort the GT constraints. This attack setting is therefore used to test whether the proposed AKF-TMPC framework can recover the corrupted pressure information in the extended IEEE 30-bus power network.

The frequency control, pressure reconstruction, GT generation limit reconstruction, and detection performance are evaluated using the same indices as in the previous sections. Since the IEEE 30-bus network constraints are further considered in this extended case, the line loading and voltage angle spread are also recorded to describe the network operating condition.

6.5.2. Results and Discussion Under Gas Pressure FDIA

As shown in Figure 23, when gas pressure FDIA is imposed without reconstruction, the frequency deviation becomes much larger than that under AKF reconstruction. This degradation is particularly evident during the attack intervals, because the falsified gas pressure measurements directly affect the pressure-dependent GT available power limits used in the controller. Once AKF reconstruction is enabled, the frequency response is effectively recovered and remains close to the no-attack case. The quantitative results in

Table 7. Frequency regulation and pressure reconstruction performance in the extended IEEE 30-bus power network.

	IAE ($\mathbf{Hz}·\mathbf{s}$)	ITSE (${\mathbf{Hz}}^2·{\mathbf{s}}^2$)	Mean ($\mathbf{Hz}$)	MAE ($\mathbf{bar}$)
No attack	0.5710	0.5894	0.0006	N/A
No reconstruction	1.0488	1.9909	0.0012	0.2521
AKF reconstruction	0.5762	0.5798	0.0006	0.0365

further verify this observation. The IAE decreases from 1.0488 Hz·s to 0.5762 Hz·s, corresponding to a reduction of approximately 45.06%. The ITSE decreases from 1.9909 Hz²·s² to 0.5798 Hz²·s², with a reduction of approximately 70.88%. The mean frequency deviation is also reduced from 0.0012 Hz to 0.0006 Hz. These results indicate that the proposed AKF-TMPC framework can effectively suppress the adverse influence of gas pressure FDIA on frequency regulation in the extended IEEE 30-bus coupling system.

Figure 24 and Figure 25 explain the physical reason for this improvement. As shown in Figure 24, the gas pressure trajectories received by the controller deviate from the no-attack case when reconstruction is not activated. Such corrupted pressure information is further extended to the GT available power limits, as shown in Figure 25. In this case, the controller optimizes the frequency regulation commands under distorted GT constraints, which leads to degraded dynamic performance. After AKF reconstruction is introduced, the reconstructed gas pressure trajectories at nodes 4 and 9 become much closer to the no-attack trajectories. Consequently, the corresponding GT available power limits at buses 2 and 22 are also corrected. Therefore, the proposed method does not directly compensate for the frequency deviation itself; instead, it reconstructs the attacked gas-side pressure information and restores the pressure-dependent GT constraints used by TMPC.

The network-level indices in

Table 8. Transmission line loading performance in the extended IEEE 30-bus power network.

	Max Line Loading (%)	Mean Line Loading (%)	Max Line Flow (MW)	Max Angle Spread (deg)
No attack	80.24	78.70	93.4768	1.9845
No reconstruction	93.03	79.86	120.9326	2.8599
AKF reconstruction	80.24	78.69	93.4745	1.9845

further show the influence of the proposed method on transmission network operation. Under FDIA without reconstruction, the maximum line loading increases to 93.03%, and the maximum line flow reaches 120.9326 MW, indicating that the corrupted GT constraints also change power redistribution in the IEEE 30-bus network. With AKF reconstruction, the maximum line loading decreases to 80.24%, which is almost identical to the no-attack case. The maximum line flow is also reduced to 93.4745 MW, and the maximum voltage angle spread decreases from 2.8599° to 1.9845°. These results demonstrate that the proposed AKF-TMPC framework can not only improve frequency regulation performance but also maintain a network operating condition close to the normal case when transmission constraints are considered.

It should be noted that large-scale implementation may introduce additional computational and communication challenges. The computational burden mainly comes from the increased number of prediction states, optimization variables, transmission constraints, and monitored gas pressure nodes. The communication burden mainly comes from the real-time exchange of gas pressure measurements, pressure-dependent GT limits, P2G/GT coupling information, and power-side control signals. In practical systems, communication delay, packet loss, and asynchronous measurements may further affect residual generation and constraint updating. Therefore, distributed or hierarchical TMPC, localized AKF reconstruction for critical GT supply nodes, and delay-aware communication mechanisms will be investigated in future work.

6.6. Robustness Verification Under Different Wind Power Realizations

To further verify the robustness of the proposed AKF-TMPC framework under wind power uncertainty, four different wind power realizations are tested under the same gas pressure FDIA scenario. In this case, the load disturbance, FDIA signal, controller parameters, and AKF detection thresholds are kept identical to those in Section 6.2.

The wind power profiles used in the four cases are shown in Figure 26. The four profiles have similar overall amplitude levels, while their peak and valley periods occur at different time instants. It should also be noted that wind power fluctuations have a relatively limited influence on the system frequency in this study. This is because part of the wind power is absorbed by the P2G units and converted into gas injection, rather than being fully injected into the electrical grid. As a result, compared with load disturbances, wind power variations introduce smaller direct disturbances to the electrical power balance.

The quantitative results are summarized in

Table 9. Frequency regulation and detection performance under different wind power realizations.

	IAE ($\mathbf{Hz}·\mathbf{s}$)	ITSE (${\mathbf{Hz}}^2·{\mathbf{s}}^2$)	MAE ($\mathbf{bar}$)	Detection Rate
Wind case 1	0.6827	4.6173	0.0183	97.42%
Wind case 2	0.6975	4.8504	0.0190	97.10%
Wind case 3	0.6950	4.7811	0.0196	96.77%
Wind case 4	0.6721	4.2991	0.0194	97.10%

. Under the four wind power realizations, the IAE remains within 0.6721–0.6975 Hz·s, and the ITSE remains within 4.2991–4.8504 Hz²·s². These results indicate that the proposed AKF-TMPC framework can maintain stable frequency regulation performance under different wind power fluctuation patterns.

Moreover, Table 9 also shows that the detection rate remains higher than 96.77% in all cases, demonstrating that the AKF-based detection and reconstruction strategy is not sensitive to a single wind power realization. Although the frequency difference caused by wind power variation is not as significant as that caused by load disturbance or gas pressure FDIA, the results still verify that the proposed method can preserve stable detection and control performance under different renewable power profiles.

Overall, the results in Table 9 show that the proposed AKF-TMPC framework maintains stable performance under different wind power realizations. This indicates that the proposed method is not dependent on a specific wind power trajectory. In addition, since part of the wind power fluctuation is absorbed by the P2G units, the direct impact of wind uncertainty on frequency regulation is relatively weaker than that of load disturbance and gas pressure FDIA. Therefore, the proposed method shows good robustness under renewable power fluctuation while preserving the main FDIA detection and mitigation capability.

6.7. Robustness Verification Under Step FDIA

To further evaluate the robustness of the proposed method under sustained FDIA, a staggered step attack is imposed on the gas pressure measurements. As shown in Figure 27, the injected false data has an amplitude of −0.3 bar.

The quantitative results are summarized in

Table 10. Frequency regulation, pressure reconstruction, and detection performance under step FDIA.

	IAE ($\mathbf{Hz}·\mathbf{s}$)	ITSE (${\mathbf{Hz}}^2·{\mathbf{s}}^2$)	Mean ($\mathbf{Hz}$)	MAE ($\mathbf{bar}$)	Detection Rate
No attack	0.7040	4.3723	0.0008	N/A	N/A
No reconstruction	2.7333 × 1012	2.9079 × 1026	3.0370 × 109	0.4340	100%
AKF reconstruction	0.7207	4.5253	0.0008	0.0126	100%

. Under the step FDIA without reconstruction, the IAE and ITSE increase dramatically, indicating that the corrupted pressure measurements can severely degrade frequency regulation and even lead to unstable responses. With the proposed AKF reconstruction, the IAE is reduced to 0.7207 Hz·s, and the ITSE is reduced to 4.5253 Hz²·s², which are close to the no-attack values of 0.7040 Hz·s and 4.3723 Hz²·s², respectively. In addition, the pressure MAE decreases from 0.4340 bar to 0.0126 bar, while the detection rate remains 100%. These results demonstrate that the proposed AKF-based reconstruction method can effectively suppress the influence of sustained pressure FDIA and maintain the frequency regulation performance of the gas–electricity coupling system.

The gas pressure responses at the GT supply nodes are shown in Figure 28. Under the attack without reconstruction, the pressure measurements received by the controller deviate significantly from the no-attack trajectories, which directly distort the pressure-dependent GT constraints. After applying the proposed AKF-based reconstruction, the reconstructed pressure trajectories become much closer to the no-attack case at both gas node 4 and gas node 9. Correspondingly, Figure 29 shows that the available GT power limits are also effectively corrected by the proposed reconstruction method. Without reconstruction, the attacked pressure measurements lead to erroneous GT power limits, whereas the AKF reconstruction prevents the false pressure data from being directly propagated to the control constraint layer.

Overall, the results in Figure 27, Figure 28 and Figure 29 and Table 10 verify the effectiveness of the proposed AKF-based reconstruction strategy under step FDIA. The proposed method can accurately identify abnormal pressure measurements, reconstruct the corrupted gas pressure states, and correct the pressure-dependent GT power limits. As a result, the severe frequency deterioration caused by unreconstructed FDIA is effectively mitigated, and the closed-loop performance is restored close to the no-attack condition. This confirms that the proposed method is not limited to sinusoidal FDIA scenarios but also remains effective against sustained step-type pressure manipulation.

7. Conclusions and Future Work

7.1. Conclusions

This paper proposes an AKF-based tube-based control framework for secure frequency regulation in gas–electricity coupling systems under gas pressure FDIA. By integrating pressure-dependent GT power constraints, residual-based attack detection, online pressure reconstruction, and TMPC, the proposed framework provides an implementable controller-side mitigation strategy for gas–electricity coupling systems, where gas pressure FDIA is detected, reconstructed, and further translated into corrected GT constraints for frequency regulation recovery.

The main conclusions of this study are summarized as follows:

• FDIA-resilient frequency control framework: A secure control framework is developed for gas–electricity coupling systems by incorporating pressure-dependent GT available power limits into the TMPC constraints.
• Coordinated robustness of TMPC: By combining nominal prediction with local feedback compensation, TMPC maintains stable frequency recovery under wind fluctuations, load disturbances, and gas supply limitations. In the attack-free case, TMPC achieves an IAE of 0.7040 Hz·s, while MPC and PI obtain IAE values of 1.9626 and 2.9834 Hz·s, respectively. This corresponds to reductions of approximately 64% and 76%. The mean frequency deviation is also reduced from 0.0022 Hz and 0.0033 Hz to 0.0008 Hz, demonstrating the advantage of TMPC in constrained gas–electricity coupling frequency regulation.
• Effective mitigation of FDIA: Gas pressure FDIA misleads the controller’s assessment of GT regulation capability. AKF reconstruction corrects this information mismatch and blocks attack propagation from the gas measurement layer to frequency control. After applying AKF reconstruction, the IAE decreases from 1.1645 to 0.7039 Hz·s, corresponding to a reduction of approximately 39.55%. Meanwhile, the ITSE decreases from 13.4836 to 4.3533 Hz²·s², and the pressure MAE decreases from 0.1714 bar to 0.0157 bar. These results show that the proposed reconstruction strategy can restore both frequency regulation performance and gas pressure information accuracy.
• Accurate and robust pressure reconstruction: Larger attacks generate clearer residual characteristics and are reconstructed more reliably, whereas weaker attacks are harder to detect but exert limited influence on frequency regulation. The AKF achieves more consistent reconstruction by exploiting pressure dynamics and gas–electricity coupling information. Compared with DAE and graph-based reconstruction, the proposed AKF achieves a higher detection rate of 98.39%, while the detection rates of DAE and graph-based reconstruction are 33.87% and 75.16%, respectively. The pressure MAE of AKF is 0.0157 bar, which is lower than 0.1139 bar for DAE and 0.0316 bar for graph-based reconstruction.

7.2. Future Work

Future research will focus on the following aspects:

• Improvement of AKF robustness: Adaptive threshold updating, online pressure model correction, and multi-source gas–electricity measurement fusion will be investigated to enhance the reliability of AKF-based detection and reconstruction under operating point changes, parameter drift, noisy data, and low-amplitude stealthy FDIA.
• Extension to coordinated cyberattack scenarios: More complex attacks, including combined FDIA and DoS attacks, multiple compromised gas nodes, and time-varying attack patterns, will be considered. Multi-node pressure FDIA will be investigated to analyze the influence of coordinated false data on gas pressure distribution, GT available generation limits, and frequency regulation performance, while hybrid FDIA-DoS scenarios will be studied to address both falsified measurements and unavailable communication data.
• Consideration of system and communication uncertainties: Gas network model errors, parameter uncertainties, measurement noise, communication delays, and packet losses will be incorporated into the reconstruction and control framework. Online pressure model correction, adaptive covariance updating, and delay-aware estimation will also be investigated to improve the robustness of AKF under practical modeling and communication uncertainties.
• Large-scale and real-time validation: The proposed method will be extended to larger gas–electricity coupling systems with more generators, gas nodes, coupling devices, and network constraints. Distributed or hierarchical TMPC and localized AKF reconstruction will be investigated to reduce computational and communication burdens. Real-time simulation will also be conducted to evaluate the effects of computation time, communication delay, packet loss, and asynchronous measurements.