Not Applicable
The present invention is in the technical field of measurement of electric parameters.
More particularly, the present invention is in the technical field of voltage and current phasor measurements on an alternating current (a.c.) power distribution grid, and employing those phasor measurements to detect a cyber attack on remotely-operable elements of that power distribution grid.
Electric power distribution grids, including substations, are commonly used to move a.c. power from high-voltage transmission lines towards a set of loads, and sometimes to move power from distributed generation resources.
These electric power distribution grids, including substations, contain elements such as switches, bus connecting elements, interrupting elements, and transformer tap changing elements. To improve energy efficiency and grid reliability, these elements are often configured for remote operation, for example by an operator at a Distribution Grid Control Center.
Such a remote operation generally takes place through a communication network. Often, the remotely-operable element can report its present state. For example, a distribution grid control center might be able to ask a remotely-operable switch to report if it is “on” or “off”, and a distribution control center could instruct such a remotely-operable switch to change its state from “off” to “on”.
Such automated systems can be subject to cyber attack, an event in which unauthorized individuals or organizations attempt to take control of remotely-operated elements in a distribution grid, or attempt to cause remotely-operated elements to incorrectly report their state, or both.
In our Department of Energy ARPA-E Project DE-AR0000340, titled “Micro-Synchrophasors for Distribution Systems,” we have been investigating the application of synchrophasor measurements to medium-voltage distribution grids, as opposed to the traditional application to high-voltage transmission grids. Due to smaller inductances and shorter distances on distribution grids compared to transmission grids, the phase angle changes during interesting phenomena on distribution grids are much smaller. We have determined that, for distribution grid applications, a angular resolution for voltage phasors and current phasors of ±0.015° could be useful.
Such voltage phasor and current phasor measurements can be used to detect cyber attacks on distribution systems.
The present invention is a method and apparatus for detecting cyber attacks on remotely-operable elements on a distribution grid by comparing a first state estimation of the distribution grid based on the commands to and reports from the remotely-operable elements, with a second state estimation of the distribution grid based on precise phasor measurements performed on the distribution grid. A difference between the two state estimations indicates that the distribution grid may be under cyber attack.
Turning our attention to
Medium-voltage a.c. power leaves the substation through other remotely-operable elements 10,11,12 and travels in the usual ways, well known in the art, in this illustrative example through distribution feeders 20,21,22,23,24,25,26,27, in some cases passing through additional remotely-operable elements 13,14,15 to ultimately reach loads 31,32,33,34,35. The exact nature of the loads 31,32,33,34,35 are not important to the present invention.
Continuing to examine
Examining the illustration of the connections 41 to the remotely-operable elements, we see that the arrows are bi-directional, indicating that the Distribution Grid Control Center 40 can both instruct the remotely-operable elements 5,6,9,10,11,12,13,14,15 to change to a different state, e.g. change from “off” to “on”, and the remotely-operable elements 5,6,9,10,11,12,13,14,15 may in some cases also report their state to the Distribution Grid Control Center 40, both types of communications taking place through the connections 41.
The exact nature of the connections 41 is unimportant to the present invention except that the connections 41 may be subject to a disruptive cyber attack. Such a disruptive cyber attack could, for example, cause one or more of the remotely-operable elements 5,6,9,10,11,12,13,14,15 to transition to an undesired state; or it could, for example, cause one or more of the remotely-operable elements 5,6,9,10,11,12,13,14,15 to inaccurately report its state, e.g. report that it is “off” when it is in fact “on”.
Continuing to examine
The μPMU's 50, 51, 52 report their time-synchronized magnitudes and phase angles through communication channels 53, the precise nature of which is not important to the present invention except that it is unlikely to be subject to the attack at the same time and in the same way as the other connections 41, to a Phasor Data Concentrator 60 of a type well-known in the art, which calculates various phasor and power flow parameters such as phase angle differences, the exact list and nature of which is not critical to the present invention. These phasor and power flow parameters are passed to a Phasor-based State Estimator 61, which has algorithms, the nature of which do not limit the present invention, that employ the values of the phasor and power flow parameters to form an estimate of the state of this distribution grid.
By the “state” of this distribution grid, we mean the present state of all of the elements in this distribution grid, including the remotely-operably elements 5,6,9,10,11,12,13,14,15 . Returning our attention to the Distribution Grid Control Center 40, we see that, based on the information it receives from remotely-operable elements 5,6,9,10,11,12,13,14,15 through their connections 41, it prepares State Estimation A 43 and communicates it through a communication channel 42, the nature of which is not critical to the present invention. A second State Estimate B 62 is prepared by the Phasor-based State Estimator 61 and communicated through a connection 63.
A State Estimation comparison block 44, the details of which are not critical to the present invention, compares State Estimation A 43 with State Estimation B 62. The State Estimation comparison block 44 may, for example, simply compare the estimated states prepared in State Estimation A 43 and State Estimation B 62; or it may also include an evaluation of confidence in the estimations prepared by State Estimation A 43 and State Estimation B 62, or use other algorithms to conclude whether the two State Estimations are sufficiently equal.
If the algorithm comparison block 44 determines that the two State Estimations 43, 62 are not equal, it concludes that the distribution grid may be under a cyber attack. It could, for example, use a communication channel 45 to activate an alarm 46 in the Distribution Grid Control Center. It will be apparent to one of ordinary skill that the above description, which assumes a single-phase system, can be readily extended to three-phase systems.
Turning our attention now to
The Micro Synchrophasor Instrument 31 incorporates a display 33 and communications means 36. The display 33 is not an essential element to the present invention. The Micro Synchrophasor Instrument 31 also incorporates voltage inputs 35 for measuring voltage phasors, current inputs 34 for optionally measuring the current phasors, and computing means 32 for converting raw voltage measurements and optional raw current measurements into phasor measurements.
While the foregoing written description of the invention enables one of ordinary skill to make and use what is considered presently to be the best mode thereof, those of ordinary skill will understand and appreciate the existence of variations, combinations, and equivalents of the specific embodiment, method, and examples herein. The invention should therefore not be limited by the above described embodiment, method, and examples, but by all embodiments and methods within the scope and spirit of the invention.
Application Ser. No. 14/808,439, “Method and Apparatus for Precision Phasor Measurements Through a Medium-voltage Distribution Transformer”
The invention disclosed herein was conceived and developed in part during work on Award Number DE-AR0000340, titled “Micro-Synchrophasors for Distribution Systems,” from the Advanced Research Projects Agency-Energy (ARPA-E) of the U.S. Department of Energy.