Cyber-Physical Fault Diagnosis of Three-Phase Induction Motors Under Coordinated Network Attacks Using Explainable AI

Abstract

The convergence of industrial communication networks and electric drive systems has increased the range of risks associated with induction motor operation, with abnormal motor operation potentially arising from either physical motor faults or malicious cyber operations. This study examines the impact of coordinated network attacks on a three-phase induction motor drive system in a real-time laboratory environment through a PLC–SCADA controlled environment. The following operating conditions were investigated experimentally: normal operation, stator disturbance, rotor abnormalities, false data injection attack, replay-based communication manipulation, and cyber-physical events. In the attack scenarios, significant differences were observed in motor speed, electromagnetic torque, stator current distortion, and communication latency compared with normal operating conditions. To differentiate between actual machine failures and cyber-induced anomalies, an explainable AI-based diagnostic framework was introduced that employs both electrical and network-layer features. Experimental results revealed that the proposed model achieved an overall classification accuracy of 93.17%, with precision and recall > 97% across most operating classes. When subjected to a coordinated attack, communication latency rose from 4.8 ms under normal operation to 37.6 ms, and the current THD increased from 3.2% to 14.7%. The proposed framework also successfully distinguished cyber-attack-induced abnormal behavior from genuine motor faults at a 96.9% detection rate, which is lower than that of conventional AI classifiers. Explainability analysis also showed that the top features that affect the diagnostic decision process were packet delay, stator current distortion, torque oscillation, and rotor speed deviation. The results demonstrate the necessity of incorporating cybersecurity awareness into intelligent fault diagnosis systems for modern induction motors in industrial cyber-physical environments.

1. Introduction

Three-phase induction motors are widely recognized as the workhorse of modern industry and are extensively employed in industrial processes and domestic applications. They are commonly used in equipment such as blowers, exhaust fans, pumps, and overhead cranes due to their versatility and reliable operation [1]. Their widespread adoption is attributed to several desirable characteristics, including low manufacturing cost, robust construction, high reliability, simple design, high starting torque, effective speed regulation, and good overload capability [2,3]. In addition, their durability and low maintenance requirements make them the preferred choice for continuous industrial operation. Approximately 90% of industrial equipment worldwide relies on three-phase induction motors as the primary source of mechanical power, underscoring their essential role in modern industrial systems [4].

The rapid advancement of industrial automation has significantly increased the complexity of industrial equipment and production systems. Consequently, maintaining equipment reliability and preventing unexpected failures have become major concerns for industrial facilities, as unplanned downtime often results in considerable economic losses [5]. Continuous condition monitoring and early fault diagnosis of electrical machines play a critical role in reducing maintenance costs, minimizing downtime, improving equipment performance, enhancing fault prediction accuracy, increasing system reliability, and reducing energy losses [6]. Electrical machine faults are classified into five major categories, including stator faults, improper stator winding connections, dynamic or static air-gap anomalies, short rotor field windings, and bearing or gearbox failures [4]. These faults may manifest as excessive temperature rise, abnormal vibration, acoustic noise, or variations in motor current signatures. Consequently, numerous diagnostic techniques have been developed to detect induction motor faults at different operating stages using measurements such as current, voltage, temperature, and vibration signals [7].

With the continuous evolution of industrial automation, conventional electrical drive systems are increasingly integrated with communication networks and Internet of Things (IoT) technologies to improve connectivity, monitoring capability, and operational efficiency [8]. As a result, cyber-physical systems (CPSs) have become a fundamental component of modern industrial infrastructures, smart manufacturing, smart cities, and energy systems [6]. These systems integrate physical processes with distributed sensors, actuators, embedded controllers, and communication networks to enable real-time monitoring and control [9]. In addition to improving resource utilization and energy efficiency through intelligent coordination strategies [10], the increasing connectivity of CPSs also expands their exposure to cyber threats. Cyberattacks targeting industrial electrical drive systems may compromise system integrity, availability, or confidentiality, leading to production interruptions, financial losses, and data breaches. Common attack strategies include denial-of-service (DoS), distributed denial-of-service (DDoS), man-in-the-middle, code injection, ransomware, and targeted intrusions [11]. Among these, deception attacks represent a particularly challenging threat because attackers manipulate transmitted sensor or control data through compromised communication channels while attempting to remain undetected, thereby degrading system performance and potentially causing severe operational damage [9,12]. Therefore, the timely identification and mitigation of cyberattacks are essential to ensuring the secure and reliable operation of industrial cyber-physical systems.

Recent advances in sensing technologies and data acquisition systems have encouraged the widespread adoption of artificial intelligence (AI)-based approaches for industrial condition monitoring and fault diagnosis. The effectiveness of these approaches largely depends on the selection of appropriate sensors, as different sensing devices offer varying levels of sensitivity, measurement ranges, and operational characteristics. Furthermore, integrating, storing, and fusing heterogeneous data collected via multiple communication protocols remains a significant challenge and requires a unified data integration framework [13]. At the same time, operating conditions such as unbalanced supply voltage (USV) may produce symptoms similar to induction motor winding faults, making accurate fault discrimination considerably more difficult [14]. In cyber-physical environments, the challenge becomes even greater because abnormal system behavior may originate from either physical equipment faults or malicious cyberattacks. Although both conditions can disrupt normal operation, they require fundamentally different mitigation strategies. Therefore, accurately distinguishing between physical faults and cyberattacks is essential to avoid inappropriate corrective actions that may further compromise system reliability and operational safety [15].

Although considerable progress has been achieved in induction motor fault diagnosis and industrial cybersecurity, the two research directions have largely evolved independently. Most existing studies concentrate on identifying electrical or mechanical faults in induction motors, whereas cybersecurity research primarily focuses on detecting malicious network activities in industrial control systems. Consequently, the interaction between physical equipment degradation and cyber-induced anomalies remains insufficiently investigated under realistic industrial operating conditions. Moreover, only a limited number of studies have validated their approaches using real-time SCADA-based experimental platforms, and coordinated cyberattack scenarios involving Denial-of-Service (DoS), False Data Injection (FDI), and Replay attacks are rarely examined together. Another limitation is that most intelligent diagnostic models prioritize prediction accuracy while offering insufficient insight into the factors that influence their decisions, thereby reducing their practical value for industrial operators. These observations highlight the need for an integrated diagnostic framework that combines physical and communication-layer information while providing transparent and interpretable decision support for cyber-physical induction motor systems. Figure 1 shows a research gap and motivation for cyber-physical induction motor diagnosis using explainable AI.

Figure 1. Research gap, motivation, and contribution of the proposed cyber-physical induction motor diagnosis framework.

Despite recent advances in artificial intelligence and industrial cybersecurity, existing studies still treat induction motor fault diagnosis and cyberattack detection as largely independent problems. Furthermore, only a limited number of studies have validated explainable AI-based cyber-physical diagnosis using real-time SCADA environments under coordinated attack scenarios. These limitations motivate the development of the proposed unified cyber-physical diagnosis framework presented in this work.

To address the above limitations, this work proposes an integrated cyber-physical fault diagnosis framework for three-phase induction motors operating in industrial environments. The primary contributions of this study can be summarized as follows:

• A real-time experimental platform is developed by integrating a three-phase induction motor, Siemens SENTRON PAC4200 power quality meter, PLC-based control, SCADA monitoring, and Modbus TCP communication.
• Coordinated cyberattack scenarios, including DoS, False Data Injection (FDI), Replay attacks, and a combined Stator Fault + DoS condition, are experimentally implemented and evaluated under realistic operating conditions.
• A hybrid diagnostic feature space is constructed by combining electrical machine measurements with communication-network indicators, enabling simultaneous analysis of physical and cyber behaviors.
• A GRU-based explainable artificial intelligence framework is developed to distinguish normal operation, physical faults, cyberattacks, and combined cyber-physical events while maintaining interpretable diagnostic decisions.
• The proposed framework is experimentally validated using extensive laboratory measurements, and SHAP analysis is employed to identify the most influential features contributing to each diagnostic decision.

The proposed framework differs from existing approaches by integrating real-time experimental validation, industrial SCADA monitoring, coordinated cyberattack modeling, hybrid electrical-network feature fusion, GRU-based classification, and explainable AI within a unified cyber-physical architecture. Rather than addressing motor faults and cybersecurity as separate problems, the proposed approach jointly analyzes both physical and communication-layer behaviors, enabling reliable discrimination between equipment faults, cyberattacks, and their simultaneous occurrence in practical industrial environments.

Although recent studies have investigated induction motor fault diagnosis and industrial cybersecurity independently, few studies have jointly addressed coordinated cyberattacks, physical motor faults, explainable AI, and real-time SCADA validation within a unified framework. The proposed work addresses this gap by integrating electrical and communication-layer features with GRU-based explainable diagnosis using an industrial cyber-physical testbed.

The remainder of this paper is organized as follows. Section 2 reviews recent studies related to induction motor fault diagnosis, industrial cybersecurity, and explainable artificial intelligence and identifies the existing research gap. Section 3 presents the mathematical formulation of the proposed cyber-physical diagnosis framework. Section 4 describes the experimental platform, dataset preparation, feature extraction process, and explainable AI methodology. Section 5 presents the experimental results, along with a detailed discussion of diagnostic performance under different cyber-physical operating conditions. Finally, Section 6 summarizes the main findings of this work and discusses potential directions for future research.

2. Related Works

Recent advances in artificial intelligence have significantly improved induction motor fault diagnosis and condition monitoring. In [16], a machine learning and signal processing framework based on MATLAB/Simulink R2025b was developed using Decision Tree and FFT techniques for fault diagnosis in three-phase induction motors. Although satisfactory diagnostic performance was reported, the study focused exclusively on physical motor faults and did not consider cyber-physical interactions. Similarly, the ANN-based monitoring system presented in [17] demonstrated the feasibility of intelligent fault detection; however, neither SCADA integration nor coordinated cyberattack scenarios were investigated.

The integration of cyber-physical concepts into industrial motor monitoring has also attracted increasing attention. The distributed monitoring framework proposed in [18] introduced a cyber-physical architecture for industrial motor systems. Nevertheless, the reported methodology was unable to clearly distinguish between cyber-induced anomalies and genuine motor faults. In addition, explainable artificial intelligence techniques have been explored to diagnose rotating machinery. The transfer learning and Grad-CAM-based framework presented in [19] improved model interpretability, while the survey in [18] reviewed several explainable AI approaches, including SHAP and LIME, for industrial cyber-physical systems. Despite these contributions, cybersecurity threats affecting induction motor operation were not addressed.

Several studies have focused primarily on industrial cybersecurity. The intrusion detection framework proposed in [11] investigated service disruption, command injection, and spoofing attacks in industrial electrical drive systems. Likewise, the work reported in [20] introduced a learning-based approach for detecting low-intensity cyberattacks in electric drives. Although both studies successfully identified malicious network activities, they did not incorporate physical motor fault diagnosis or explainable decision-making mechanisms.

Other researchers have concentrated on predictive maintenance and resilient control applications. The AI-assisted predictive maintenance framework presented in [21] improved induction motor condition monitoring and reliability assessment but did not address cyber-physical security issues. Similarly, the resilient distributed control strategy proposed in [22] focused on mitigating cyberattacks in grid-forming inverter systems rather than induction motor drives. Furthermore, the digital twin-based diagnostic framework developed in [23] enhanced fault-monitoring capabilities for maritime electrical systems; however, it did not consider coordinated network attacks or the integration of explainable AI.

Recent advances in cyber-physical system security have increasingly emphasized the integration of explainable artificial intelligence (XAI) with industrial fault diagnosis to improve transparency, reliability, and operator confidence. Recent surveys and research studies have highlighted the growing role of XAI techniques, particularly SHAP-based interpretation, in enhancing industrial cybersecurity and intelligent fault diagnosis [18,24,25,26,27]. Although these studies have significantly advanced AI-based attack detection and model interpretability, they primarily focus on cybersecurity analysis or industrial intrusion detection without jointly considering coordinated cyberattacks, physical induction motor faults, explainable AI, and real-time SCADA-based experimental validation within a unified framework. These limitations motivate the development of the proposed cyber-physical diagnostic approach, which integrates electrical measurements, communication-layer indicators, GRU-based classification, and SHAP explainability using a real-time industrial testbed [18,24,25,26,27].

Unlike existing studies, the proposed work develops a real-time cyber-physical fault diagnosis framework using the Lucas–Nülle industrial laboratory platform. The framework combines induction motor fault diagnosis, SCADA-based monitoring, Modbus TCP communication, coordinated network attack scenarios (DoS, FDI, and Replay attacks), and explainable AI analysis within a unified architecture. In addition, the proposed system can distinguish between physical faults, cyber-induced anomalies, and combined cyber-physical events, thereby providing both an accurate diagnosis and interpretable decision support for modern industrial environments. Table 1 illustrates a summary of the related work. To facilitate a more comprehensive comparison with previous studies, Table 2 has been expanded to include the origin of the datasets employed in each reported work.

Table 1. Summary of the related work.

Ref.	Year	Main Methodology	AI/ML Technique	Motor/System	Cyberattack	Protocol/Communication	Main Limitation
[16]	2024	ML + Signal Processing fault diagnosis using MATLAB/Simulink	Decision Tree + FFT	Three-phase induction motor	No	None	Focuses only on motor faults without cyber-physical analysis
[17]	2024	ANN-based induction motor fault monitoring	Artificial Neural Network (ANN)	Induction motor	No	None	No SCADA integration or coordinated attack modeling
[18]	2024	Distributed cyber-physical motor monitoring	ANN + Signal Analysis	Industrial motor system	Partial CPS only	Distributed CPS network	Does not distinguish cyber-induced anomalies from physical faults
[19]	2024	Explainable fault diagnosis for rotating machinery	1D-CNN + Grad-CAM + Transfer Learning	Rotating machinery	No	None	Use XAI but without cybersecurity integration
[18]	2024	Industrial CPS explainability survey	Explainable AI (XAI), SHAP, LIME	Industrial CPS	General cybersecurity	Industrial IoT/CPS	Survey paper without a practical induction motor cyberattack diagnosis
[11]	2024	Industrial electrical drive intrusion detection	IDS + Threat Modeling	Induction motor drive system	DoS, DDoS, Command Injection, Spoofing	USB communication + industrial digital control	Focuses on IDS only without AI-based physical fault separation
[20]	2025	Low-intensity cyberattack detection in motor drives	CNN + Contrastive Learning + Transfer Learning	Intelligent electric drives	Low-intensity cyberattacks	CPS communication environment	Detects attacks but does not include physical motor fault diagnosis or explainable AI
[21]	2025	Predictive maintenance and condition monitoring	ML + AI-based predictive maintenance	Three-phase induction motor	No	None	Concentrates on maintenance rather than cyber-physical security
[22]	2024	Resilient distributed control under cyberattacks	Distributed resilient control	Grid-forming inverter system	FDI, DoS	Sparse communication network	Focuses on microgrids rather than induction motor drives
[23]	2024	Fault diagnosis using a digital twin framework	AI + Digital Twin	Maritime induction motor systems	No	Integrated monitoring framework	No coordinated network attack analysis or explainable AI integration

Table 2. Qualitative comparison with existing studies.

Feature	Ref. [16]	Ref. [17]	Ref. [18]	Ref. [19]	Ref. [18]	Ref. [11]	Ref. [20]	Ref. [21]	Ref. [22]	Ref. [23]	Proposed
Real-time experimental validation	✓	✗	✓	✗	✗	✓	✗	✗	✗	✓	✓
Three-phase induction motor	✓	✓	✓	✗	✗	✓	✓	✓	✗	✓	✓
SCADA-based monitoring	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✓
PLC integration	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✓
Modbus TCP communication	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✓
DoS attack analysis	✗	✗	✗	✗	✗	✓	✓	✗	✓	✗	✓
FDI attack analysis	✗	✗	✗	✗	✗	✗	✗	✗	✓	✗	✓
Replay attack analysis	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✓
Physical motor fault diagnosis	✓	✓	✓	✓	✗	✗	✗	✓	✗	✓	✓
Combined cyber-physical diagnosis	✗	✗	Partial	✗	✗	✗	✗	✗	✗	✗	✓
Explainable AI (SHAP/Grad-CAM)	✗	✗	✗	✓	✓	✗	✗	✗	✗	✗	✓
Hybrid electrical + network features	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✓
Eight operating conditions	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✓
Data Origin	Experimental	Experimental	Experimental	Experimental	Survey	Experimental	Experimental	Experimental	Experimental	Experimental	Experimental + Derived + Emulated + Hybrid

3. Mathematical Model

The proposed framework combines the electrical dynamics of the induction motor with the communication-layer behavior of the industrial SCADA network to establish a unified cyber-physical diagnostic model that distinguishes physical machine faults from coordinated cyber-induced anomalies.

3.1. Dynamic Model of the Induction Motor

The induction motor is modeled in a synchronous $dq$-reference frame to accurately represent the nonlinear electromechanical dynamics under normal and abnormal operating conditions.

3.1.1. Stator Voltage Equations

$$V_{ds}=R_s{i}_{ds}+{\displaystyle \frac{d{\lambda }_{ds}}{dt}}-{\omega }_e{\lambda }_{qs}$$

(1)

$$V_{qs}=R_s{i}_{qs}+{\displaystyle \frac{d{\lambda }_{qs}}{dt}}+{\omega }_e{\lambda }_{ds}$$

(2)

where

$V_{ds},V_{qs}$: stator voltages

$i_{ds},i_{qs}$: stator currents

$R_s,R_r$: stator and rotor resistances

$\lambda$: flux linkage

${\omega }_e$: synchronous speed

${\omega }_r$: rotor speed

Rotor Voltage Equations

$$0=R_r{i}_{dr}+{\displaystyle \frac{d{\lambda }_{dr}}{dt}}-\left({\omega }_e-{\omega }_r\right){\lambda }_{qr}$$

(3)

$$0=R_r{i}_{qr}+{\displaystyle \frac{d{\lambda }_{qr}}{dt}}+\left({\omega }_e-{\omega }_r\right){\lambda }_{dr}$$

(4)

Flux Linkage Equations

$${\lambda }_{ds}=L_s{i}_{ds}+L_m{i}_{dr}$$

(5)

$${\lambda }_{qs}=L_s{i}_{qs}+L_m{i}_{qr}$$

(6)

$${\lambda }_{dr}=L_r{i}_{dr}+L_m{i}_{ds}$$

(7)

$${\lambda }_{qr}=L_r{i}_{qr}+L_m{i}_{qs}$$

(8)

where

$L_s,L_r$: stator and rotor inductances

$L_m$: mutual inductance

3.1.2. Electromagnetic Torque Equation

The generated electromagnetic torque is expressed as:

$$T_e={\displaystyle \frac{3P}{4}}{L}_m\left(i_{qs}{i}_{dr}-i_{ds}{i}_{qr}\right)$$

(9)

where

$T_e$: electromagnetic torque

$P$: number of poles

Mechanical Dynamic Equation

The rotor mechanical dynamics are modeled as:

$$J{\displaystyle \frac{d{\omega }_r}{dt}}=T_e-T_L-B{\omega }_r$$

(10)

where

$J$: rotor inertia

$T_L$: load torque

$B$: friction coefficient

Motor State-Space Representation

The induction motor dynamic states are represented as:

$$x_m\left(t\right)=\left[\begin{array}{c}{i}_{ds}\\ i_{qs}\\ {\lambda }_{dr}\\ {\lambda }_{qr}\\ {\omega }_r\end{array}\right]$$

(11)

The corresponding input vector is:

$$u_m\left(t\right)=\left[\begin{array}{c}{V}_{ds}\\ V_{qs}\end{array}\right]$$

(12)

The measured physical outputs are:

$$y_m\left(t\right)=\left[\begin{array}{c}{I}_s\\ V_s\\ T_e\\ {\omega }_r\\ THD\end{array}\right]$$

(13)

Thus, the nonlinear induction motor model is formulated as:

$${\dot{x}}_m\left(t\right)=A_m{x}_m\left(t\right)+B_m{u}_m\left(t\right)+E_f{f}_m\left(t\right)$$

(14)

$$y_m\left(t\right)=C_m{x}_m\left(t\right)+v_m\left(t\right)$$

(15)

where $f_m\left(t\right)$ represents motor-side disturbances and physical faults.

$x_m\left(t\right)$: Motor-state vector

$x_n\left(t\right):$ Communication/network-state vector

$x\left(t\right):$ Combined cyber-physical state vector

$u_m\left(t\right):$ Motor control input vector

$u_c\left(t\right)$: Manipulated control input vector under attack

$y_m\left(t\right)$: Measured motor output vector

$y\left(t\right)$: Overall cyber-physical output vector

$A,B,C,D:$ State-space system matrices

$A_m$: Motor dynamic matrix

$A_n$: Network dynamic matrix

$A_{mn},A_{nm}:$ Coupling matrices between physical and cyber layers

$E,E_f,E_a:$ Fault and attack distribution matrices

$v\left(t\right):$ Measurement noise vector

3.2. Cyberattack and Communication-Layer Modeling

In this work, a coordinated cyberattack refers to the simultaneous or sequential execution of multiple attack mechanisms targeting both the communication infrastructure and the physical process to maximize operational disruption while reducing the likelihood of early detection.

The proposed framework considers coordinated cyberattacks targeting both sensor measurements and industrial control commands transmitted through the SCADA communication network.

3.2.1. False Data Injection Attack (FDIA)

$$y_{attack}\left(t\right)=y_m\left(t\right)+a_y\left(t\right)$$

(16)

where

$y_m\left(t\right)$: original sensor measurement

$a_y\left(t\right)$: maliciously injected signal

$$a_y\left(t\right)=\left[\begin{array}{c}{a}_i\left(t\right)\\ a_v\left(t\right)\\ a_T\left(t\right)\\ a_{\omega }\left(t\right)\\ a_{THD}\left(t\right)\end{array}\right]$$

(17)

where

$a_i\left(t\right):$ An injected disturbance in the current measurement

$a_v\left(t\right):$ An injected disturbance in the voltage measurement

$a_T\left(t\right):$ An injected disturbance in the torque measurement

$a_{\omega }\left(t\right):$ An injected disturbance in the speed measurement

$a_{THD}\left(t\right):$ An injected disturbance in the THD measurement

where $a_y\left(t\right)$ denotes the measurement attack vector associated with coordinated cyber intrusions targeting the industrial monitoring system. Each element represents an injected disturbance affecting a specific physical measurement acquired from the induction motor drive system.

3.2.2. Feature Extraction Model

The diagnostic feature vector is constructed as:

$$F=[I_s,V_s,T_e,{\omega }_r,THD,Latency,PacketLoss{]}^T$$

(18)

where

$I_s$: stator current

$V_s$: stator voltage

$THD$: total harmonic distortion

$Latency$: network delay

$PacketLoss$: packet loss ratio

3.2.3. Replay Attack Model

$$y_{replay}\left(t\right)=y_m\left(t-\tau \right)$$

(19)

where

$$\tau =\mathrm{Replay} \mathrm{delay} \mathrm{introduced} \mathrm{by} \mathrm{the} \mathrm{attacker}$$

Manipulated Control Command Model

$$u_c\left(t\right)=u_m\left(t\right)+a_u\left(t\right)$$

(20)

where

$$a_u\left(t\right)=\left[\begin{array}{c}{a}_{vd}\left(t\right)\\ a_{vq}\left(t\right)\end{array}\right]$$

(21)

$a_u\left(t\right):$ Manipulated control command vector

Denial-of-Service Delay Model

$$D\left(t\right)=D_0+\mathsf{\Delta }D\left(t\right)$$

(22)

$D\left(t\right):$ Communication delay during the attack

$D_0:$ Normal network delay

$\mathsf{\Delta }D\left(t\right):$ Additional delay caused by the attack

During the Replay attack, previously recorded valid communication packets were retransmitted to the SCADA monitoring system while preserving their original measurement values. Consequently, the observed system response reflects replayed communication behavior rather than newly generated measurement data.

3.2.4. Communication-State Vector

The network-side dynamic variables are represented by:

$$x_n\left(t\right)=\left[\begin{array}{c}Latency\\ PacketLoss\\ Jitter\\ TrafficRate\end{array}\right]$$

(23)

$Latency:$ Network communication latency

$PacketLoss:$ Packet loss ratio

$Jitter:$ Delay variation in communication

$TrafficRate:$ Network traffic rate

3.3. Integrated Cyber-Physical State-Space Model

To establish a unified representation of the physical motor behavior and cyber communication dynamics, the motor and network states are merged into a combined cyber-physical system.

Combined State Vector

$$x\left(t\right)=\left[\begin{array}{c}{x}_m\left(t\right)\\ x_n\left(t\right)\end{array}\right]$$

(24)

Combined Fault-Attack Vector

$$\mathsf{\Psi }\left(t\right)=\left[\begin{array}{c}{f}_m\left(t\right)\\ a_y\left(t\right)\\ a_u\left(t\right)\end{array}\right]$$

(25)

$f_m\left(t\right):$ Physical motor fault vector

$f_{stator}\left(t\right):$ Stator-related fault

$f_{rotor}\left(t\right):$ Rotor-related fault

$f_{bearing}\left(t\right):$ Bearing fault

$r\left(t\right):$ Residual signal

Unified Cyber-Physical Dynamic Model

$$\dot{x}\left(t\right)=Ax\left(t\right)+Bu\left(t\right)+EPsi\left(t\right)$$

(26)

$$y\left(t\right)=Cx\left(t\right)+DPsi\left(t\right)+v\left(t\right)$$

(27)

where $A$, $B$, $C$, and $D$ denote the state, input, output, and feedthrough matrices of the coupled cyber-physical model, respectively. Their dimensions are summarized as follows:

$$A\in R^{n\times n},B\in R^{n\times m},C\in R^{p\times n},D\in R^{p\times m}$$

where

$$A=\left[\begin{array}{cc}{A}_m& A_{mn}\\ A_{nm}& A_n\end{array}\right]$$

(28)

$$B=\left[\begin{array}{c}{B}_m\\ B_n\end{array}\right]$$

(29)

The matrix $A_{mn}$ represents the influence of the communication network on physical motor dynamics through communication delay, packet loss, and cyber-induced disturbances. Conversely, $A_{nm}$ models the feedback from the physical process to the communication layer by transmitting sensor measurements and system states through the SCADA network.

3.3.1. Residual Generation Model

The residual signal used for cyber-physical diagnosis is calculated as:

$$r\left(t\right)=y\left(t\right)-\widehat{y}\left(t\right)$$

(30)

$$\widehat{y}\left(t\right)\mathrm{E}\mathrm{s}\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{a}\mathrm{t}\mathrm{e}\mathrm{d} \mathrm{s}\mathrm{y}\mathrm{s}\mathrm{t}\mathrm{e}\mathrm{m} \mathrm{o}\mathrm{u}\mathrm{t}\mathrm{p}\mathrm{u}\mathrm{t}$$

$$J\left(t\right)\mathrm{R}\mathrm{e}\mathrm{s}\mathrm{i}\mathrm{d}\mathrm{u}\mathrm{a}\mathrm{l} \mathrm{e}\mathrm{v}\mathrm{a}\mathrm{l}\mathrm{u}\mathrm{a}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n} \mathrm{i}\mathrm{n}\mathrm{d}\mathrm{e}\mathrm{x}$$

Residual Evaluation Function

$$J\left(t\right)=r^T\left(t\right)Wr\left(t\right)$$

(31)

where

$$W=\left[\begin{array}{cccc}{w}_1& 0& 0& 0\\ 0& w_2& 0& 0\\ 0& 0& w_3& 0\\ 0& 0& 0& w_4\end{array}\right]$$

(32)

$$W is \mathrm{R}\mathrm{e}\mathrm{s}\mathrm{i}\mathrm{d}\mathrm{u}\mathrm{a}\mathrm{l} \mathrm{w}\mathrm{e}\mathrm{i}\mathrm{g}\mathrm{h}\mathrm{t}\mathrm{i}\mathrm{n}\mathrm{g} \mathrm{m}\mathrm{a}\mathrm{t}\mathrm{r}\mathrm{i}\mathrm{x}$$

$$\gamma is \mathrm{D}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n} \mathrm{t}\mathrm{h}\mathrm{r}\mathrm{e}\mathrm{s}\mathrm{h}\mathrm{o}\mathrm{l}\mathrm{d}$$

3.3.2. Decision Conditions

$$\begin{array}{ll}J\left(t\right)\le \gamma & \Rightarrow \mathrm{Normal} \mathrm{Operation} J\left(t\right)>\gamma , D\left(t\right)\approx D_0\\ & \Rightarrow \mathrm{Physical} \mathrm{Motor} \mathrm{Fault} J\left(t\right)>\gamma , D\left(t\right)>D_0\\ & \Rightarrow \mathrm{Cyber-Induced} \mathrm{Anomaly}\end{array}$$

$$J\left(t\right)\gg \gamma , D\left(t\right)\gg D_0\Rightarrow \mathrm{Combined} \mathrm{Cyber-Physical} \mathrm{Event}$$

The residual generation model provides a physics-based analytical representation of abnormal motor and communication behavior. It establishes the theoretical foundation of the proposed cyber-physical diagnosis framework by characterizing deviations from normal operation. In contrast, the GRU classifier performs data-driven diagnosis using the extracted electrical and communication features. Therefore, the analytical residual model and the AI classifier play complementary roles within the proposed framework rather than operating as independent diagnostic modules.

3.4. Explainable AI-Based Diagnostic Formulation

The proposed AI framework combines electrical-machine measurements and network-security indicators into a unified diagnostic feature space.

Cyber-Physical Feature Vector

$$F={\left[\begin{array}{ccccccccc}{I}_s& V_s& T_e& {\omega }_r& THD& Latency& PacketLoss& Jitter& TrafficRate\end{array}\right]}^T$$

(33)

Feature Matrix

$$X=\left[\begin{array}{c}{F}_1\\ F_2\\ F_3\\ ⋮\\ F_N\end{array}\right]$$

(34)

or equivalently:

$$X=\left[\begin{array}{ccccccc}{I}_s^{\left(1\right)}& V_s^{\left(1\right)}& T_e^{\left(1\right)}& {\omega }_r^{\left(1\right)}& TH{D}^{\left(1\right)}& L^{\left(1\right)}& P_L^{\left(1\right)}\\ I_s^{\left(2\right)}& V_s^{\left(2\right)}& T_e^{\left(2\right)}& {\omega }_r^{\left(2\right)}& TH{D}^{\left(2\right)}& L^{\left(2\right)}& P_L^{\left(2\right)}\\ ⋮& ⋮& ⋮& ⋮& ⋮& ⋮& ⋮\\ I_s^{\left(N\right)}& V_s^{\left(N\right)}& T_e^{\left(N\right)}& {\omega }_r^{\left(N\right)}& TH{D}^{\left(N\right)}& L^{\left(N\right)}& P_L^{\left(N\right)}\end{array}\right]$$

(35)

AI-Based Classification Model

$$P\left(C_k∣X\right)={\displaystyle \frac{e^{z_k}}{{\sum }_{j=1}^N{e}^{z_j}}}$$

(36)

where

$$C_1=\mathrm{Normal}$$

$$C_2=\mathrm{Physical} \mathrm{Fault}$$

$$C_3=\mathrm{Cyberattack}$$

$$C_4=\mathrm{Combined} \mathrm{Cyber-Physical} \mathrm{Fault}$$

$F:$ Cyber-physical feature vector

$X:$ Feature matrix used for AI training

$C_k:$ Operating condition class

Final Decision Function

$$\widehat{C}=\arg \underset{k}{\max P}\left(C_k∣X\right)$$

(37)

$$\widehat{C}:\mathrm{F}\mathrm{i}\mathrm{n}\mathrm{a}\mathrm{l} \mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}\mathrm{i}\mathrm{c}\mathrm{t}\mathrm{e}\mathrm{d} \mathrm{o}\mathrm{p}\mathrm{e}\mathrm{r}\mathrm{a}\mathrm{t}\mathrm{i}\mathrm{n}\mathrm{g} \mathrm{c}\mathrm{o}\mathrm{n}\mathrm{d}\mathrm{i}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n}$$

$$z_k:\mathrm{O}\mathrm{u}\mathrm{t}\mathrm{p}\mathrm{u}\mathrm{t} \mathrm{s}\mathrm{c}\mathrm{o}\mathrm{r}\mathrm{e} \mathrm{o}\mathrm{f} \mathrm{t}\mathrm{h}\mathrm{e} \mathrm{A}\mathrm{I} \mathrm{c}\mathrm{l}\mathrm{a}\mathrm{s}\mathrm{s}\mathrm{i}\mathrm{f}\mathrm{i}\mathrm{e}\mathrm{r}$$

Explainability Analysis Using SHAP Values

$${\varphi }_i=f_x\left(S\cup \left\{i\right\}\right)-f_x\left(S\right)$$

(38)

$${\varphi }_i:\mathrm{S}\mathrm{H}\mathrm{A}\mathrm{P} \mathrm{f}\mathrm{e}\mathrm{a}\mathrm{t}\mathrm{u}\mathrm{r}\mathrm{e} \mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}\mathrm{r}\mathrm{i}\mathrm{b}\mathrm{u}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n} \mathrm{v}\mathrm{a}\mathrm{l}\mathrm{u}\mathrm{e}$$

$$f_x:\mathrm{A}\mathrm{I} \mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}\mathrm{i}\mathrm{c}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n} \mathrm{f}\mathrm{u}\mathrm{n}\mathrm{c}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n}$$

$$S:\mathrm{S}\mathrm{e}\mathrm{l}\mathrm{e}\mathrm{c}\mathrm{t}\mathrm{e}\mathrm{d} \mathrm{f}\mathrm{e}\mathrm{a}\mathrm{t}\mathrm{u}\mathrm{r}\mathrm{e} \mathrm{s}\mathrm{u}\mathrm{b}\mathrm{s}\mathrm{e}\mathrm{t}$$

$$THD:\mathrm{T}\mathrm{o}\mathrm{t}\mathrm{a}\mathrm{l} \mathrm{h}\mathrm{a}\mathrm{r}\mathrm{m}\mathrm{o}\mathrm{n}\mathrm{i}\mathrm{c} \mathrm{d}\mathrm{i}\mathrm{s}\mathrm{t}\mathrm{o}\mathrm{r}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n}$$

where

${\varphi }_i$ represents the contribution of the feature $i$

$f_x$ denotes the prediction function

$S$ represents the selected feature subset

The explainability layer provides interpretation of the dominant indicators responsible for the abnormal operating condition, enabling differentiation between physical machine degradation and cyber-induced manipulation within the industrial control environment.

Table 3 summarizes the final feature set employed for GRU training and SHAP interpretation. Only these features were retained after the feature selection process to ensure consistency between the mathematical formulation, the AI classifier, and the explainability analysis.

Table 3. Final features used for GRU training and SHAP analysis.

Feature	Symbol	Source	Used in GRU	Used in SHAP
Motor Current	$I_m$	Electrical	✓	✓
Excited Current	$I_e$	Electrical	✓	✓
Torque	$T_e$	Electrical	✓	✓
Phase Shift	$\varphi$	Electrical	✓	✓
Supply Frequency	$f_s$	Electrical	✓	No
Control Sweep Setting	CSS	Controller	✓	No
Packet Delay	$D_p$	Network	✓	✓
Packet Loss	$P_l$	Network	✓	✓

The coupled state-space representation is presented in a generalized form to describe the interaction between the physical process and the communication layer. The primary objective of the proposed mathematical formulation is to establish a unified cyber-physical diagnosis framework rather than derive a complete motor dynamic model.

4. Methodology

Figure 2 illustrates the complete workflow of the proposed framework, including data acquisition, cyberattack implementation, feature extraction, feature fusion, GRU-based classification, SHAP explainability, and final operating-condition identification.

Figure 2. Overall architecture of the proposed cyber-physical fault diagnosis framework.

The framework consists of six interconnected layers that integrate the physical motor system with industrial communication, cybersecurity analysis, and explainable artificial intelligence. The first two layers acquire electrical measurements from the induction motor using the Siemens SENTRON PAC4200 power quality meter (Siemens AG, Munich, Germany. These measurements are transmitted through a Modbus TCP communication network to the PLC and SCADA system for real-time monitoring and data acquisition. The cyber layer introduces representative industrial cyberattacks, including Denial-of-Service (DoS), False Data Injection (FDI), and Replay attacks, to emulate realistic cyber-physical operating conditions. The acquired electrical and communication features are subsequently fused and processed by a GRU-based explainable AI framework, in which SHAP analysis is employed to interpret the contributions of individual features to the classification process. Finally, the proposed framework identifies eight operating conditions, including healthy operation, physical faults, cyberattacks, and combined cyber-physical events, providing a comprehensive and interpretable diagnostic solution for industrial induction motor systems.

4.1. Experimental Cyber-Physical Testbed

The experimental validation was conducted using a Lucas–Nülle industrial training platform equipped with a data acquisition and three-phase induction motor, a Siemens SENTRON PAC4200 power quality meter (Siemens AG, Munich, Germany), a Siemens S7-1200 PLC-based control system (Siemens AG, Munich, Germany), and a WinCC SCADA monitoring interface (Siemens AG, Munich, Germany). Communication between the field devices and the supervisory system was established through the Modbus TCP protocol using Port 502. The testbed enables simultaneous observation of both physical motor behavior and communication-layer activities, allowing the investigation of cyber-physical interactions under normal and abnormal operating conditions.

Electrical measurements, including motor current, voltage, torque, speed, power factor, and harmonic distortion, were continuously acquired through the PAC4200 meter and transmitted to the SCADA workstation. In parallel, communication-related indicators such as packet delay and packet loss were monitored to capture the effects of cyberattacks on the industrial network.

Figure 3 illustrates the experimental cyber-physical testbed used in this study. The setup consists of a data acquisition system for a three-phase induction motor, a Siemens SENTRON PAC4200 power quality meter, a PLC-based control module, the Lucas–Nülle industrial training platform, a SCADA monitoring and communication interface, a power electronic drive module, and electrical measurement and data acquisition points. Table 4 summarizes the main hardware and communication components used in this work.

Figure 3. Experimental cyber-physical induction motor testbed. (1) Data acquisition. (2) Three-Phase Induction Motor. (3) Siemens SENTRON PAC4200 Power Source. (4) PLC-Based Control and Automation Module. (5) Lucas–Nülle Industrial Training Rack and Power Electronics Interface. (6) SCADA Monitoring and Communication Interface (Meter under attack). (7) Power Electronic Drive/Rectifier Control Module. (8) Electrical Measurement and Data Acquisition Points.

Table 4. Experimental motor setup and testbed configuration.

Parameter	Value
Motor Type	Three-Phase Induction Motor
Rated Supply Frequency	60 Hz
Rated Operating Speed	≈1800 rpm
Control Sweep Setting	0–18
PQM Meter	Siemens SENTRON PAC4200
Measured Variables	Torque, Motor Current, Excited Current, Phase Shift
Communication Protocol	Modbus TCP
Monitoring Platform	SCADA
Cyber Layer	SCADA/PQM/Modbus-TCP
Port Number	502
Attack Types	DoS, FDI, Replay
AI Technique	Explainable AI

4.2. Cyber-Physical Scenario Development

To evaluate the proposed framework’s ability to distinguish physical faults from cyber-induced anomalies, eight operating scenarios were developed. The Healthy scenario represents normal motor operation without any fault or attack condition. Three physical fault conditions were considered: stator, rotor, and bearing faults. These conditions were selected because they represent common failure modes encountered in industrial induction motor applications.

Three cyberattack scenarios were also investigated. The DoS attack was designed to disrupt communication by increasing network latency and packet loss. The FDI attack manipulated selected measurement values transmitted through the communication network. The Replay attack reused previously recorded valid measurements to mislead the monitoring system while maintaining apparently normal operating conditions.

To clearly distinguish the origin of the data used in this study, the investigated operating conditions were categorized into four groups: experimentally measured, experimentally executed cyberattack scenarios, derived physical-fault data, and hybrid cyber-physical data. Healthy motor operation was directly acquired from the Lucas–Nülle platform. The DoS attack was experimentally implemented through the SCADA communication network, whereas the FDI and Replay attacks were generated by controlled manipulation of the acquired communication data. The stator, rotor, and bearing fault conditions were derived from experimentally measured baseline signals according to their characteristic electrical behavior. This distinction is maintained throughout the manuscript to accurately reflect the origin of each operating condition.

Finally, a combined cyber-physical scenario in which a stator fault occurs simultaneously with a DoS attack was introduced. This scenario represents a more challenging operating condition because both physical degradation and communication disturbances occur simultaneously. The complete set of operating conditions used in this study is summarized in Table 4. Figure 4 presents the PuTTY interface used to establish the Modbus TCP communication between the SCADA workstation and the industrial controller.

Figure 4. The user interface of PuTTY. 1: Advanced program and connection settings. 2: Connection parameters—IP address, port, protocol. 3: Saving and loading connections.

Table 5 shows the final cyber-physical scenarios. The Healthy scenario represents the normal operating condition of the three-phase induction motor. The DoS scenario corresponds to a denial-of-service attack targeting the communication infrastructure, while the FDI scenario represents the malicious manipulation of measurement data. The Replay scenario involves retransmitting previously recorded valid data to mislead the monitoring system. In contrast, the Stator Fault + DoS scenario represents a combined cyber-physical event in which a stator-related fault occurs simultaneously with a denial-of-service attack, creating a more challenging operating condition for fault diagnosis and system monitoring.

Table 5. Final cyber-physical scenarios.

Class	Scenario	What It Represents	Data Source
C1	Healthy	Normal induction motor operation	Experimental motor data
C2	Stator Fault	An electrical fault is causing higher current and lower torque	Derived from baseline motor data
C3	Rotor Fault	Rotor-side abnormality causing torque reduction and current ripple	Derived from baseline motor data
C4	Bearing Fault	Mechanical fault causing torque/current oscillation	Derived from baseline motor data
C5	DoS Attack	Communication delay/loss without a true motor fault	SCADA cyber experiment + emulation
C6	FDI Attack	Malicious falsification of sensor readings	Emulated from baseline data
C7	Replay Attack	Reuse of old, valid measurements	Emulated from healthy data
C8	Stator Fault + DoS	Combined physical fault and cyberattack	Derived + cyber emulation

Table 6 summarizes the implementation parameters of the coordinated cyberattacks investigated in this work. The attacks were executed via the industrial communication layer to assess their impact on both network behavior and motor diagnostic performance.

Table 6. Implementation details of the coordinated cyberattacks.

Attack	Target	Modified Data	Duration	Effect
DoS	Modbus TCP Communication	Communication packets	30 s	Increased packet delay and packet loss
FID	SCADA Measurements	Motor current, torque, and voltage registers	20 s	False measurement values
Replay	SCADA Communication	Previously captured packets	20 s	Replayed historical measurements

Table 7 summarizes the procedure adopted to generate the physical fault conditions from the experimentally acquired baseline measurements. Each fault scenario reproduces the characteristic electrical behavior associated with the corresponding induction motor fault.

Table 7. Physical fault generation parameters.

Fault	Modified Parameter	Expected Effect	Data Source
Stator Fault	Stator current	Increased current and THD	Derived from experimental baseline
Rotor Fault	Electromagnetic torque	Torque oscillation and speed variation	Derived from experimental baseline
Bearing Fault	Torque and current	Current fluctuation and vibration-related behavior	Derived from experimental baseline

The combined Stator Fault + DoS scenario was selected because it represents a practical and challenging cyber-physical condition where simultaneous electrical degradation and communication disruption occur. This scenario was chosen as a representative proof-of-concept for evaluating the proposed diagnostic framework. Investigation of additional hybrid attack-fault combinations will be considered in future work.

4.3. Feature Extraction and Dataset Construction

A hybrid feature set that combines physical- and communication-layer measurements was developed to support cyber-physical fault diagnosis. The physical features were obtained directly from the induction motor testbed and included motor current, excitation current, torque, phase shift, supply frequency, and control sweep settings. These measurements capture the electrical and mechanical behavior of the machine under different operating conditions.

To improve sensitivity to cyberattacks, communication-layer indicators were incorporated into the dataset. Specifically, packet delay and packet loss were selected because they provide direct information regarding communication abnormalities and network disturbances. The resulting feature vector, therefore, contains both motor-conditioning information and network-security information, allowing the diagnostic framework to identify physical faults, cyberattacks, and combined cyber-physical events.

The dataset was constructed using samples collected from all operating scenarios. An equal number of samples were assigned to each class to avoid class imbalance during training and evaluation. Table 8, Table 9 and Table 10 summarize the baseline measurements, expected feature behavior, and final feature set used for model development. The dataset partition and GRU hyperparameters are indicated in Table 11 and Table 12. The dataset preparation procedure was revised to clearly describe the data partitioning strategy adopted for model development. Training, validation, and testing datasets were prepared independently to minimize potential data leakage during classifier evaluation.

Table 8. Baseline motor data extracted from experiments.

Feature	Min	Max	Notes
Control Sweep Setting	0	18	Not motor supply frequency
Torque	0.20 Nm	1.49 Nm	From torque curves
Motor Current	0.21 A	2.34 A	From motor current curves
Excited Current	0.55 A	4.80 A	From excitation curves
Phase Shift	−0.973 rad	0.861 rad	From phase-shift data
Motor Supply Frequency	60 Hz	60 Hz	Constant rated supply

Table 9. Feature behavior of each scenario.

Scenario	Torque	Motor Current	Excited Current	Phase Shift	Packet Delay	Packet Loss
Healthy	Normal	Normal	Normal	Normal	Low	0%
Stator Fault	Decrease	Increase	Slight Increase	More Negative	Low	0%
Rotor Fault	Moderate Decrease	Moderate Increase	Slight Increase	Slight Change	Low	0%
Bearing Fault	Oscillatory	Oscillatory	Normal/Slight Increase	Slight Change	Low	0%
DoS Attack	Normal	Normal	Normal	Normal	High	High
FDI Attack	Manipulated	Manipulated	Manipulated	Manipulated	Low	0%
Replay Attack	Repeated Normal	Repeated Normal	Repeated Normal	Repeated Normal	Medium	0%
Stator Fault + DoS	Decrease	Increase	Increase	More Negative	High	High

Table 10. AI feature set.

Feature	Symbol	Unit
Control Sweep Setting	Fc	index/setting
Motor Supply Frequency	fs	Hz
Torque	T	Nm
Motor Current	Im	A
Excited Current	Ie	A
Phase Shift	φ	rad
Packet Delay	D	MS
Packet Loss	PL	%
Class Label	C	-

Table 11. Dataset partition.

Dataset	Samples	Percentage
Training	2800	70%
Validation	600	15%
Testing	600	15%
Total	4000	100%

Table 12. GRU hyperparameters.

Parameter	Value
GRU Layers	1
Hidden Units	128
Batch Size	32
Optimizer	Adam
Initial Learning Rate	0.001
Epochs	25
Dropout	0.20
Loss Function	Cross-Entropy
Output Layer	SoftMax

The proposed GRU classifier was selected because the acquired cyber-physical measurements are sequential in nature and exhibit temporal dependencies between consecutive observations. Compared with conventional recurrent neural networks, the GRU architecture requires fewer trainable parameters while maintaining effective learning capability, making it suitable for real-time industrial monitoring applications.

4.4. Explainable AI-Based Diagnostic Procedure

The proposed diagnostic framework integrates machine condition indicators and communication-security measurements within a unified explainable AI architecture. Initially, the acquired measurements are preprocessed and normalized before feature extraction. The extracted features are then fused into a single cyber-physical feature vector that represents the system’s current operating state.

The fused feature vector is fed into a GRU-based classifier that determines the most likely operating condition among the defined classes. Following classification, SHAP analysis is used to quantify each feature’s contribution to the final decision. This additional explainability layer provides insight into whether the detected abnormality is primarily associated with a physical motor fault, a communication-layer attack, or a combined cyber-physical event. Table 13 shows the computational performance in this work.

Table 13. Computational performance.

Metric	Value
Training Time	41 s
Average Inference Time	3.8 mms/sample
Average Prediction Time	4.1 ms/sample

The complete diagnostic workflow consists of feature acquisition, feature fusion, classification, explainability analysis, and final decision generation, as shown in Algorithm 1. This structure enables accurate fault diagnosis while simultaneously providing interpretable information for industrial operators and maintenance personnel.

Algorithm 1: Explainable Cyber-Physical Fault Diagnosis of Three-Phase Induction Motors.

1: Acquire electrical measurements from the experimental testbed:     {Motor Current (Im), Excited Current (Ie), Torque (T),     Phase Shift (φ), Supply Frequency (fs),     Control Sweep Setting (Fc)} 2: Acquire communication-layer measurements:     {Packet Delay (D), Packet Loss (PL)} 3: Synchronize SCADA and motor measurements through the Modbus TCP communication channel. 4: Construct the hybrid cyber-physical feature vector:     F = {Fc, fs, T, Im, Ie, φ, D, PL} 5: Normalize all extracted features. 6: Assign each sample to one of the predefined operating classes:     Healthy, Stator Fault, Rotor Fault, Bearing Fault,     DoS Attack, FDI Attack, Replay Attack,     Stator Fault + DoS. 7: Split the dataset into training and testing subsets. 8: Train the GRU classifier using the normalized cyber-physical feature vectors. 9: for each testing sample do 10:    Predict the operating condition using the trained GRU model. 11:    Compute SHAP values for all input features. 12:    Rank the features according to their SHAP importance. 13:    Interpret the detected event as:       • Physical motor fault       • Cyberattack       • Combined cyber-physical event 14: end for 15: Store the predicted class together with the corresponding explainability results. 16: Compute the confusion matrix and overall classification accuracy.

5. Results and Discussion

This section presents the experimental results obtained under normal operation, physical faults, cyberattacks, and combined cyber-physical conditions. The results are first analyzed from the perspective of the induction motor’s electrical behavior, followed by the communication-layer characteristics under coordinated network attacks. Finally, the diagnostic performance of the proposed GRU-based explainable AI framework is evaluated using quantitative metrics and SHAP-based interpretations to demonstrate its effectiveness.

Figure 5 shows that during the healthy condition, phase currents were 1.76 A, 1.93 A, and 1.71 A, while measured phase voltages were 178 V. The SCADA interface accurately reflected the motor’s electrical behavior under normal operating conditions. The observed measurements indicate stable motor operation and provide a reference baseline for comparison with attack scenarios. The SCADA-reported frequency under different operating conditions. During normal operation, the reported frequency remained close to the nominal 60 Hz.

Figure 5. Healthy operating condition displayed by the SCADA interface.

Healthy and Replay conditions remained close to 60 Hz throughout the experiment. FDI maintained a biased frequency around 56–57 Hz. DoS fluctuated between 21.48 Hz and 52.16 Hz, while the hybrid condition varied from 19.8 Hz to 49.1 Hz.

Figure 6 shows that the displayed phase currents dropped to 0 A for all phases. At the same time, phase-to-phase voltages were reported as 0 V. This behavior indicates severe communication or control disruption in which the monitoring system no longer receives valid operational data. Such conditions can mislead operators into interpreting the motor state as disconnected or unavailable.

Figure 6. Operating condition displayed by the SCADA interface under attack.

Figure 7 shows that the SCADA interface displays the Replay attack scenario, in which all measured phase currents remained at 0 A, while the reported phase voltages were approximately 16 V. The discrepancy between the available voltage and zero-current measurements suggests abnormal communication behavior rather than a conventional motor fault. This condition is consistent with manipulated or interrupted monitoring data.

Figure 7. SCADA interface displaying the Replay attack scenario.

Figure 8 shows the SCADA interface displaying the False Data Injection (FDI) attack scenario, in which the SCADA-reported phase currents were 1.76 A, 1.93 A, and 1.71 A, while the phase voltages decreased to 175 V, 162 V, and 162 V, respectively. The measurements demonstrate a substantial deviation from the healthy baseline. The abnormal voltage values indicate measurement tampering, a characteristic of false data injection attacks that compromise monitoring integrity.

Figure 8. SCADA interface displaying the False Data Injection (FDI) attack scenario.

Figure 9 shows the PAC4200 meter-reported line voltages of 25 V, 10 V, and 30 V, while the measured phase currents were 1.80 A, 1.23 A, and 1.28 A. The communication configuration utilized Modbus TCP through Port 502. The measurements confirm stable motor operation under normal conditions and establish the baseline operating point used throughout the experimental campaign. The absence of neutral current and the balanced current profile indicate healthy machine behavior before the introduction of faults or cyberattacks.

Figure 9. PQM display and Modbus TCP communication configuration.

The reported voltage values correspond to different measurement points and operating conditions within the experimental platform. Therefore, variations between SCADA visualization and power-quality meter readings are expected and do not represent inconsistent operating conditions.

Table 14 shows the healthy operation recorded phase voltages of 25 V, 10 V, and 30 V and phase currents of 1.80 A, 1.23 A, and 1.28 A. These measurements confirm stable motor operation and were used as the baseline reference for all fault and cyberattack scenarios. The balanced current profile and zero neutral current indicate the absence of abnormal electrical conditions. The voltage values reported in this table correspond to processed measurement values acquired from the monitoring interface and should not be interpreted as the motor terminal supply voltage. The SCADA display and PQM measurements represent different monitoring layers within the experimental platform.

Table 14. Experimental PQM measurements during healthy operation.

Parameter	Value
Line Voltage L12	25 V
Line Voltage L23	10 V
Line Voltage L31	30 V
Current L1	1.80 A
Current L2	1.23 A
Current L3	1.28 A
Neutral Current	0.00 A

Table 15 shows a dataset structure. A balanced dataset containing 4000 samples was constructed, with 500 samples assigned to each operating condition. The balanced class distribution prevented bias during model training and contributed to the stable classification performance observed across all operating scenarios.

Table 15. Dataset structure.

Scenario	Samples
Healthy	500
Stator Fault	500
Rotor Fault	500
Bearing Fault	500
DoS Attack	500
FDI Attack	500
Replay Attack	500
Stator Fault + DoS	500
Total	4000

Table 16 shows that the communication delay increased from 4.8 ms under healthy operation to 37.6 ms during the DoS attack and 42.1 ms during the Stator Fault + DoS condition. Packet loss also increased from 0% to 28.4% and 31.5%, respectively. The results demonstrate that network-based attacks significantly degrade communication quality. The hybrid scenario produced the worst communication performance because physical degradation and network disruption occurred simultaneously. The electrical measurements classified as “Normal” during the DoS attack correspond to the physical motor behavior, whereas the communication degradation is reflected by the network-layer indicators. Consequently, the proposed framework analyzes electrical and communication features jointly rather than independently.

Table 16. Communication performance under cyberattacks.

Scenario	Delay (ms)	Packet Loss (%)
Healthy	4.8	0
DoS	37.6	28.4
FDI	6.3	0
Replay	11.2	0
Stator Fault + DoS	42.1	31.5

The motor supply frequency was maintained at 60 Hz, corresponding approximately to 1800 rpm for the tested induction motor. The 0–18 range used in the experimental curves represents the control sweep setting and should not be interpreted as the actual motor supply frequency.

Table 17 presents the SCADA-reported frequency measurements under different cyber-physical scenarios. During healthy operation, the reported frequency remained highly stable around the nominal value of 60 Hz, varying only between 59.76 Hz and 60.34 Hz, which indicates normal system operation. The Replay attack produced measurements that closely followed the healthy condition, with values ranging from 59.92 Hz to 60.24 Hz, because previously recorded valid measurements were retransmitted to the SCADA system. In contrast, the FDI attack introduced biased frequency readings that remained relatively stable between 55.90 Hz and 57.40 Hz, representing a deviation of approximately 4–7% from the nominal frequency. The DoS attack generated the most severe communication-induced fluctuations, where the reported frequency varied significantly from 21.48 Hz to 52.16 Hz. Similarly, the combined Stator Fault + DoS condition exhibited substantial deviations, with reported values ranging from 19.80 Hz to 49.10 Hz. Compared with the healthy condition, the hybrid scenario produced the largest reduction in the reported frequency, confirming that simultaneous physical faults and communication attacks have a greater impact on monitoring reliability than either disturbance alone. These results demonstrate that SCADA-reported frequency can effectively differentiate between normal operation, cyberattacks, and combined cyber-physical events.

Table 17. SCADA-measured frequency readings under cyber-physical scenarios.

Time (s)	Healthy	DoS	FDI	Replay	Stator Fault + DoS
0	59.92	23.28	56.10	59.92	21.50
15	60.05	42.68	56.40	59.92	24.10
30	59.88	43.08	56.20	59.92	27.40
45	60.12	21.48	55.90	59.92	19.80
60	59.76	39.78	56.50	60.05	28.60
75	60.18	41.28	56.80	60.05	30.20
90	59.95	43.75	56.40	60.05	32.40
105	60.07	41.93	56.30	60.05	31.10
120	59.89	45.25	56.90	59.88	33.50
135	60.15	46.43	57.00	59.88	35.20
150	60.24	46.90	56.80	59.88	36.80
165	59.93	43.91	56.50	59.88	34.50
180	60.02	39.78	56.20	60.07	35.90
195	59.81	36.22	56.70	60.07	37.10
210	60.11	49.09	57.10	60.07	38.40
225	59.97	39.10	56.80	60.07	39.60
240	60.21	49.63	57.20	60.24	40.20
255	60.08	38.11	56.90	60.24	41.50
270	60.17	38.12	57.10	60.24	42.30
285	60.29	39.12	56.80	60.24	43.10
300	60.34	44.13	57.30	60.11	44.20
315	60.12	47.52	57.10	60.11	45.00
330	59.86	49.55	56.90	60.11	46.10
345	59.91	50.37	57.20	60.11	47.30
360	60.04	51.25	57.40	60.04	48.20
375	60.09	52.16	57.20	60.04	49.10

The Replay attack produced measurements that closely resembled the healthy condition because previously recorded valid data were repeatedly transmitted to the monitoring system. In contrast, the DoS attack introduced significant fluctuations and reporting inconsistencies due to communication disruption. The FDI attack resulted in biased but relatively stable frequency readings. At the same time, the combined Stator Fault + DoS scenario exhibited the largest deviation, reflecting the simultaneous impact of physical degradation and network-layer disturbances.

Replay attacks are difficult to detect because the reported values closely resemble normal operation. In contrast, DoS attacks caused severe fluctuations due to communication interruptions. The hybrid condition produced the largest deviation because both physical and cyber disturbances simultaneously affected the monitored data.

Figure 10 shows that the Healthy and Replay scenarios remain close to 60 Hz throughout the experiment. FDI maintained values between approximately 55.9 Hz and 57.4 Hz. DoS fluctuated between 21.48 Hz and 52.16 Hz, while the Stator Fault + DoS condition varied from 19.8 Hz to 49.1 Hz. The replay attack was difficult to distinguish from normal operation because previously recorded valid measurements were retransmitted. In contrast, DoS attacks introduced severe frequency fluctuations due to communication interruptions. The hybrid scenario produced the largest deviation because both physical degradation and cyber disturbances occurred simultaneously.

Figure 10. SCADA-reported frequency under normal, cyberattack, and cyber-physical operating conditions.

In Figure 11, communication delay increased from 4.8 ms under healthy operation to 37.6 ms during the DoS attack and 42.1 ms during the Stator Fault + DoS condition. Packet loss increased from 0% to 28.4% and 31.5%, respectively. These results confirm that communication-layer attacks significantly degrade network performance. The hybrid scenario produced the worst communication quality because both network congestion and physical system abnormalities were present simultaneously.

Figure 11. Communication delay and packet loss under different cyber-physical operating conditions.

Figure 12 shows that the healthy current remained around 1.8 A. Rotor fault currents fluctuated around 2.0 A, while stator fault and Stator Fault + DoS conditions reached approximately 2.4–2.6 A during several operating intervals. Rotor Fault produced moderate current increases around 2.0 A. Physical motor faults generated higher current amplitudes due to electromagnetic imbalance. The hybrid condition produced the highest current values, demonstrating that physical faults remained observable even during communication-layer attacks.

Figure 12. Motor current variations under healthy, fault, cyberattack, and hybrid operating conditions.

Figure 13 illustrates the learning behavior of the proposed GRU model during training. The network was trained for 25 epochs with an initial learning rate of 0.001, requiring 41 s to complete 2175 training iterations. The validation accuracy gradually increased during training, reaching 93.17% at the final epoch, while both the training and validation losses decreased continuously from approximately 2.05 to 0.20. The convergence of both curves without significant oscillation indicates stable learning and demonstrates that the selected hyperparameters provide reliable optimization for the proposed cyber-physical fault diagnosis framework. Table 18 shows the GRU training parameters.

Figure 13. Training progress of the proposed GRU classifier, showing the evolution of training and validation accuracy alongside the corresponding loss values over 25 epochs.

Table 18. GRU training parameters.

Parameter	Value
Network Type	GRU
Epochs	25
Initial Learning Rate	0.001
Training Time	41 s
Validation Accuracy	93.17%
Total Iterations	2175
Iterations per Epoch	87
Validation Frequency	30 iterations
Hardware Resource	Single CPU

In Figure 14, Packet Delay achieved the highest SHAP importance value (≈0.31), followed by THD (≈0.22), Motor Current (≈0.18), Torque (≈0.14), Phase Shift (≈0.09), and Packet Loss (≈0.06). The explainability results indicate that communication features were the dominant indicators for cyberattack detection, whereas electrical measurements remained critical for identifying motor faults. This confirms the effectiveness of combining cyber and physical features within a unified diagnostic framework.

Figure 14. SHAP feature importance ranking for the proposed GRU classifier.

SHAP analysis provides global feature attribution, thereby improving the interpretability of the proposed diagnostic framework. Future work will investigate integrating local explainability methods with physics-informed validation to further strengthen the interpretation of cyber-physical diagnostic decisions.

Figure 15 presents the confusion matrix of the proposed GRU classifier, illustrating the classification performance for all eight operating conditions. The results demonstrate that the proposed framework achieves reliable discrimination between physical faults, cyberattacks, and hybrid cyber-physical scenarios. The model correctly classified 558 out of 600 test samples, yielding an overall classification accuracy of approximately 93.0%, consistent with the final validation accuracy of 93.17%. The DoS Attack and Stator Fault + DoS classes achieved 100% classification accuracy, while the Replay Attack class achieved 98.67%. The Healthy, Rotor Fault, and Stator Fault classes obtained accuracies of 94.67%, 93.33%, and 92.00%, respectively. The FDI Attack class achieved 89.33%, whereas the Bearing Fault class recorded the lowest classification accuracy (76.00%) due to confusion with electrically similar fault conditions. Overall, the proposed GRU classifier demonstrated reliable discrimination between physical faults, cyberattacks, and combined cyber-physical events under real-time operating conditions. Table 19 shows the class-wise classification performance of the proposed GRU model.

Figure 15. Confusion matrix of the proposed GRU classifier.

Table 19. Class-wise classification performance of the proposed GRU model.

Operating Condition	Correctly Classified	Classification Accuracy (%)
Healthy	71 / 75	94.67
Stator Fault	69 / 75	92.00
Rotor Fault	70 / 75	93.33
Bearing Fault	57 / 75	76.00
DoS Attack	75 / 75	100.00
FDI Attack	67 / 75	89.33
Replay Attack	74 / 75	98.67
Stator Fault + DoS	75 /75	100.00

Figure 16 presents the ROC curves obtained for the eight operating conditions using the proposed GRU classifier. Most operating conditions exhibit ROC curves concentrated near the upper-left corner, indicating a high true positive rate with a low false positive rate. The Healthy, DoS Attack, FDI Attack, Replay Attack, and Stator Fault + DoS classes demonstrate excellent separability. In contrast, the Bearing Fault class shows relatively lower discrimination performance, consistent with the confusion matrix results, given its similarity to other mechanical fault conditions. Overall, the ROC analysis confirms the effectiveness of the proposed GRU model in distinguishing between physical faults, cyberattacks, and combined cyber-physical operating conditions. Table 20 shows the values of the Area Under the ROC Curve (AUC).

Figure 16. Receiver Operating Characteristic (ROC) curves of the proposed GRU classifier for the eight operating conditions.

Table 20. Area Under the ROC Curve (AUC).

Operating Condition	AUC
Healthy	0.989
Stator Fault	0.976
Rotor Fault	0.981
Bearing Fault	0.941
DoS Attack	1.000
FDI Attack	0.972
Replay Attack	0.997
Stator Fault + DoS	1.000
Average AUC	0.982

Although the present work focuses on validating the proposed cyber-physical diagnostic framework using fused electrical and communication features, a detailed ablation study investigating electrical-only, network-only, and hybrid feature subsets will be considered in future work to further quantify the contribution of each feature category.

The reported detection rate was calculated from the correctly identified abnormal operating conditions over the complete testing dataset.

The experimental results demonstrate consistent discrimination between physical faults, cyberattacks, and hybrid operating conditions. Future work will incorporate additional performance indicators, including false alarm rate, detection delay, and residual-based analysis, to provide a more comprehensive evaluation.

6. Limitations and Future Work

The proposed framework operates as a closed-set classifier and assumes that all operating conditions are represented in the training set. In practical industrial environments, previously unseen attack strategies may produce feature distributions outside the trained classes. Future work will therefore investigate Open-Set Recognition (OSR) and Out-of-Distribution (OOD) detection techniques to improve the robustness of cyber-physical fault diagnosis in the presence of unknown attacks.

The present study was conducted under rated operating conditions to establish the proposed cyber-physical diagnostic framework. Future work will extend the experimental validation to variable-speed and variable-load operating conditions to further evaluate the robustness of the proposed method under practical industrial environments.

Future work will include a comprehensive benchmarking study against conventional model-based and AI-based diagnostic approaches, conducted under identical experimental conditions, to further quantify the advantages of the proposed framework.

7. Conclusions

This paper presented a real-time cyber-physical fault diagnosis framework for three-phase induction motors operating under coordinated network attacks. The proposed framework combines electrical machine measurements with communication-layer indicators within a unified explainable AI architecture implemented on a Lucas–Nülle industrial laboratory platform integrated with a PLC, SCADA system, Siemens SENTRON PAC4200 power quality meter, and Modbus TCP communication. Unlike conventional fault diagnosis approaches that focus primarily on physical machine faults, the proposed system simultaneously considers electrical faults, cyberattacks, and combined cyber-physical events.

Experimental evaluation was conducted under eight operating conditions, including healthy operation, stator fault, rotor fault, bearing fault, DoS attack, FDI attack, Replay attack, and a combined Stator Fault + DoS scenario. The experimental results demonstrated that communication-layer attacks significantly affect monitoring reliability. Communication delays increased from 4.8 ms during normal operation to 37.6 ms under the DoS attack and further increased to 42.1 ms during the combined cyber-physical scenario. Similarly, packet loss increased from 0% under healthy operation to 28.4% during the DoS attack and 31.5% during the Stator Fault + DoS condition, confirming the considerable impact of coordinated attacks on industrial communication performance.

Analysis of the SCADA measurements further demonstrated that different attack scenarios produced distinct operational characteristics. The Healthy and Replay scenarios maintained reported frequencies close to the nominal 60 Hz, whereas the FDI attack generated consistently biased measurements between 55.90 Hz and 57.40 Hz. In contrast, the DoS attack caused severe fluctuations in reporting, ranging from 21.48 Hz to 52.16 Hz. At the same time, the combined Stator Fault + DoS condition produced the largest deviation, with reported frequencies ranging from 19.80 Hz to 49.10 Hz. These observations indicate that integrating communication features with electrical measurements substantially improves the ability to distinguish genuine motor faults from cyber-induced anomalies.

The explainable AI framework also provided transparent decision support by identifying the relative contribution of each feature to the classification process. SHAP analysis showed that packet delay was the most influential feature, followed by total harmonic distortion (THD), motor current, torque, phase shift, and packet loss, demonstrating that both communication-layer and electrical measurements contribute to reliable cyber-physical diagnosis. The proposed GRU-based classifier achieved an overall classification accuracy of approximately 93.17%, with most operating conditions correctly classified at 97–99%, confirming the effectiveness of the proposed diagnostic framework for real-time industrial applications.

Future work will focus on validating the proposed framework under additional industrial communication protocols, including PROFINET, EtherNet/IP, and IEC 61850, while extending the cyberattack scenarios to include more sophisticated, coordinated attacks. In addition, future research will investigate federated and online learning strategies to improve scalability and enable adaptive cyber-physical fault diagnosis in large-scale industrial environments.