Smart Grid Resilience

Assessment
Using a multi-domain real-time platform
Contents
 About OFFIS
 Why the need of a multi-domain Platform?
 Smart-Grid Resilience Lab
 Use Case I – Proof of concept in a simple feeder
 Use Case II - ICT data for anomaly scored state estimation
About OFFIS
Resilience in Smart Grids
Why a Multi-Domain Platform?
 Energy systems are Cyber-Physical systems (CPES)
 Counted as critical infrastructure (KRITIS)
 Cross-continental size
 New digitalization trends gives the need for Energy Informatics

Smart Cloud
Services Big
Data

Outsourcing AI
Why a Multi-Domain Platform?
CPES Analysis is not just bound to the Identification of
risks and
vulnerabilities
physical aspect anymore

 New Threats: cyberattack Construction of

learning and
Keeping the
system robust and
adaptive systems proactive
 Health of ICT  Health of the Smart Grid
 Extreme events
Bridging outages
and restoring
system services

(Cyber-Physical) Resilience Cycle

Smart-Grid Resilience Lab
Security and Resilience Assessment Platform

 Multi-domain co-simulation (real-time and off-line tools)

 Simulation of complex and large-scale energy systems
 Integration of ICT monitoring and detection into Power
System SCADA (e.g. State Estimation)
 Assessment of cyber-security/communication integrity
and response
 AI-based Data analytics
 Advanced Scenario Generation (e.g. to include unknowns)
Smart-Grid Resilience Lab
Use Case I Proof of concept in a simple feeder

Monitoring Substation 2 Substation 1

Attacker
Center

RTU 2 Distribution Network RTU 1

Defender

Timer Tap Changer

10
09
08
07
06
05
04
03
02
01
00 Tap Pos. -2
-1
0 0.97 1.03

Cntr. Mode Remote 0.90 1.10

0.97 1.03 0.97 1.03 V SS1 [p.u.] 0.000

1.099
1.040
0.987
Local
0.90 Tap+1 1.10 0.90 Tap-1 Tap+1 1.10
Tap-1

V SS1 [p.u.] 0.987

0.989
0.936
0.883
0.000 V SS2 [p.u.] 0.000
1.107
1.048
0.995
Remote Local
Use Case I Proof of concept in a simple feeder
Monitoring Substation 2 Substation 1
Attacker
Center

Modify
RTU 2 Distribution Network RTU 1 Value
Usent = Urec x 0.9

Defender
OFF Timer Tap Changer

10
09
08
07
06
05
04
03
02
01
00 Tap Pos. -2
-1
0 0.97 1.03

Cntr. Mode Remote 0.90 1.10

0.97 1.03 0.97 1.03 V SS1 [p.u.] 0.000

1.099
1.040
0.987 BLACKOUT
Local
0.90 Tap+1 1.10 0.90 Tap-1 Tap+1 1.10
Tap-1

Extreme Overvoltage
V SS1 [p.u.] 0.987
0.989
0.936
0.883
0.000 V SS2 [p.u.] 0.000
1.107
1.048
0.995 Inminent disconnection
Remote Local
Use Case I Proof of concept in a simple feeder
Monitoring Substation 2 Substation 1
Attacker
Center

Modify
RTU 2 Distribution Network RTU 1 Value
Usent = Urec x 0.9

Defender
ON Timer Tap Changer

10
09
08
07
06
05
04
03
02
01
00
Tap Pos. -1
0 0.97 1.03

Remote
Local
Cntr. Mode Local 0.90 1.10

0.97 1.03 0.97 1.03 V SS1 [p.u.] 0.987

1.040
Local
0.90 Tap-1 Tap+1 1.10
Tap-1 Tap+1 1.10
Switching
to Local
Mode V SS1 [p.u.] 0.987
0.936
0.883 V SS2 [p.u.] 0.995
1.048
Remote Local
Use Case II
ICT data for anomaly scored state estimation

System Data

System Data

Anomaly State
Detector System Data Estimator
healthy RTU +
faulty RTU Alerts Trust
Information

RTU Status
Use Case II
ICT data for anomaly scored state estimation
IEEE 39 bus
model

UDP Scenario 1
39 RTUs

Scenario
Use Case 11
60870-5-104
Scenario
Use Case 22  The ICT health monitoring system monitors performance
RTU Status Communication
parameters of RTUs
Information 60870-5-104
emulator

Intrusion
ICT monitoring tool Detection
System

Anomaly Scenario 2
Detector
RTU Status alarm
Information
Trust
Information  The IDS monitors the incoming telegrams and raises
State
Estimator
alarms if it detects suspicious network traffic / packages
Conclusions
 The integration of ICT solutions brings flexibility as well as
complexity at the same time. Realistic multi-domain testing
environments are needed for assessing the performance of System of
Systems.

 The resilience assessments requires scenarios with compromised

components or functionality. The tools should be adopted to this
requirement.
THANK YOU

Felipe Castro

Energy Division
felipe.castro@offis.de
 Use Case II
ICT data for anomaly scored state estimation
IEEE 39 bus
model

UDP
39 RTUs

Use Case 1 Use Case 2

60870-5-104
RTU Status Communication
Information 60870-5-104
emulator

Intrusion
ICT monitoring tool Detection
System

Anomaly
Detector
RTU Status alarm
Information
Trust
Information
State
Estimator
 Use Case II
ICT data for anomaly scored state estimation
IEEE 39 bus
model

UDP
39 RTUs

Use Case 1 Use Case 2

60870-5-104
RTU Status Communication
Information 60870-5-104
emulator

Intrusion
ICT monitoring tool Detection
System

Anomaly
Detector
RTU Status alarm
Information
Trust
Information
State
Estimator
 Use Case II
ICT data for anomaly scored state estimation
IEEE 39 bus
model

UDP
39 RTUs

Use Case 1 Use Case 2

60870-5-104
RTU Status Communication
Information 60870-5-104
emulator

Intrusion
ICT monitoring tool Detection
System

Anomaly
Detector
RTU Status alarm
Information
Trust
Information
State
Estimator
 Use Case II
ICT data for anomaly scored state estimation
IEEE 39 bus
model

UDP
39 RTUs Network Connector

RTUs (Exata, Switch, Router)

Use Case 1 Use Case 2
60870-5-104
RTU Status Communication
Information 60870-5-104
emulator

ICT monitoring tool

Intrusion
Detection
Example of alerts
System

Anomaly
Detector
RTU Status alarm
Information
Trust
Information
State
Estimator