Integrated Cyber and Physical Anomaly Location and Classification in Power Distribution Systems
Not provided.
SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Not provided.
Traditional transmission line protection relies on predictable synchronous-based fault signatures, which frequently fail under the non-standard, current-limited fault characteristics of Inverter-Based Resources (IBRs). This study investigates how to achieve secure, communication-free fault isolation in IBR-dominated weak grids without relying on opaque, computationally heavy "black-box" machine learning algorithms. To address this, we propose a novel, standalone, and inherently interpretable data-driven protection framework. Unlike centralized methods requiring multi-terminal communication, this decentralized approach relies solely on local measurements using a hierarchical linear-kernel Support Vector Machine (SVM). The methodology decomposes the protection task into four sequential stages that mimic traditional protection elements: fault detection and fault direction identification, fault type classification, zone classification, and location estimation. This multi-stage architecture allows for specialized feature engineering at each stage, combining high computational efficiency with logic traceability. The framework's end-to-end performance was validated via C-code and PSCAD/EMTDC co-simulation, utilizing a real-world utility network and an OEM black-box IBR model. The proposed relay achieves 97.2% overall accuracy and provides a reliable trip decision within a 2.5-cycle window. The results confirm 100% accuracy in fundamental fault detection, reliable zone selectivity across low to moderate fault resistances, and robust security against non-fault transients, proving its immediate viability for integration into commercial numerical relays.
This paper reports on the structure of a power hardware-in-the-loop (PHIL) simulation testbed that implements, tests, and validates a novel AI-based hierarchical resilient operation model for distribution systems. The testbed implements the central and distributed controllers of the hierarchical resilient operation model and integrates a Digital Real-Time Simulator (DRTS), protective relays, a Real-Time Automation Controller (RTAC), a Software Defined Network (SDN) switch, and a battery energy storage (BES) system. The testbed provides comprehensive real-time visualization and monitoring capability as an advanced situational awareness and operator interface solution. The IEEE 33-node system is used as a test case to test and validate the operation of the model in normal operation and recovery operation after major outages in a fully automated fashion.
Cybersecurity of smart grids have been topic of much interest in recent years. As this critical infrastructure operation increases dependency on automated processes and controls, exposure to cyber-physical threats become inevitable. Considering cyber-physical security of the grid, much focus of attention has been made towards smart grids real-time monitoring solutions, including the state estimation process. Analyzing the relevant literature, one can note though that seldom research has been done on cyber-physical security of smart grids protection systems. Protection systems have intangible value towards grid reliability. This paper presents a cybersecurity framework for smart grids protection systems. A physics-based inspired machine learning solution is at the core process of the framework. Processed relay inputs and outputs are used by a deep predictive coding network. Formal models, a quasi-static state estimator, provides an oracle when low confidence decision is reached. Evolving knowledge is derived through reinforcement learning. Implementation aspects considering the Pacific Northwest National Laboratory Electricity Infrastructure Operations Center are presented. Built as an extra control layer to protection systems, without hard-to-derive parameters, highlights potential aspects towards real-life applications.
Abstract Background and aims Xylella fastidiosa (Xf) is the xylem-dwelling bacterium associated with Pierce’s disease (PD), which causes mortality in agriculturally important species, such as grapevine (Vitis vinifera). The development of PD symptoms in grapevines depends on the ability of Xf to produce cell-wall-degrading enzymes to break up intervessel pit membranes and systematically spread through the xylem vessel network. Our objective here was to investigate whether PD resistance could be mechanistically linked to xylem vessel network local connectivity. Methods We used high-resolution X-ray micro-computed tomography (microCT) imaging to identify and describe the type, area and spatial distribution of intervessel connections for six different grapevine genotypes from three genetic backgrounds, with varying resistance to PD (four PD resistant and two PD susceptible). Key results Our results suggest that PD resistance is unlikely to derive from local xylem network connectivity. The intervessel pit area (Ai) varied from 0.07 ± 0.01 mm2 mm−3 in Lenoir to 0.17 ± 0.03 mm2 mm−3 in Blanc do Bois, both PD resistant. Intervessel contact fraction (Cp) was not statically significant, but the two PD-susceptible genotypes, Syrah (0.056 ± 0.015) and Chardonnay (0.041 ± 0.013), were among the most highly connected vessel networks. Neither Ai nor Cp explained differences in PD resistance among the six genotypes. Bayesian re-analysis of our data shows moderate evidence against the effects of the traits analysed: Ai (BF01 = 4.88), mean vessel density (4.86), relay diameter (4.30), relay density (3.31) and solitary vessel proportion (3.19). Conclusions Our results show that radial and tangential xylem network connectivity is highly conserved within the six different Vitis genotypes we sampled. The way that Xf traverses the vessel network may limit the importance of local network properties to its spread and may confer greater importance on host biochemical responses.
This project is a DOE follow-up effort on the CREDC workshop held on September 13, 2018 in Cambridge, MA to discuss cybersecurity of distance relays, which considered the benefits, vulnerabilities and risk mitigations for the use of communication systems in power system protection. The objectives of this project are to define the taxonomy of relay protection and associated communications; define use cases describing approaches to reduce the cyber-attack surface on those protective relays; and evaluate the loss of operational functional capability from changes to communication coverage. Mitigating controls will also be evaluated to understand if there are other approaches to reduce attack surfaces while maintaining communications or partial communications. Distance relays are used to protect transmission lines of approximately 10 to 300 miles in length, by detecting short circuits (i.e., faults) on the lines and then tripping circuit breakers in the substation. Such protection systems are a subset of the power system and they incorporate sensing, logic and communication functions. Protection system exposure to cyberattack could be drastically limited by disconnecting relays from all vulnerable communication systems, but this may adversely impact overall power system performance in the absence of cyberattack. This project began with a use case analysis of protection systems with communications, as summarized in this report. It continued with modeling, testing and evaluation in a miniature power system (MPS), located in the Western Area Power Administration (WAPA) Electric Power Training Center (EPTC). The project also incorporated feedback from two industry meetings held in February and September 2019. The suggested next steps account for and complement the work already underway with DOE/CESER funding: 1. Study the performance of LCD and PC vs. PUTT, which is less reliant on communication system performance and GPS timing references. The PUTT scheme could prove to be more resilient to cyberattack or communications-related disruption. It could also be more tolerant of message re-routing with SDN/SDR communication systems. On the other hand, it will be more vulnerable to false tripping during dynamic events or to loss of the voltage signal. The optimum choice of scheme may depend on the specific power system and risk assessment. This study could provide a new template for evaluation based on business functions. 2. Research and develop new methods to detect and monitor distributed physical attacks, possibly using drones, video sensors, thermal sensors, machine learning and other advanced techniques. This will help mitigate the impact of cyberattack on the protection system, and will also help mitigate the impact of wild fires. 3. Implement a scalable PKI for use in electric utility protection systems. This will encourage widespread adoption of secure authentication methods that are already available, but not widely used at present. This will help secure engineering access to the relays. 4. Investigate the use of SDN in combination with SDR to achieve better cybersecurity and electromagnetic security of the network, incorporating path variability. This would help secure both engineering access and peer-to-peer GOOSE messaging. 5. Perform additional testing, with operator evaluation of “red button” scenarios, PUTT vs. LCD, relay mis-operations, and other cyberattacks in the EPTC. This is an important advantage of testing in the EPTC rather than by computer simulation or even hardware-in-the-loop simulation; the EPTC is already dedicated to managing the situational awareness, operator response times and other human impacts. One of the project objectives was to settle on a common nomenclature for this problem space. We have concluded that the OSI layer model, supplemented by ANSI device numbers and other IEEE standards, is already well-accepted by the industry. The IEEE PSRC knowledge base provides a great deal of public information
We present the issue of monetarily incentivized forwarding in a multi-hop mesh network architecture from an economic perspective. It is anticipated that credit-incentivized forwarding and relaying will be a simple method of exchanging transmission power and spectrum for connectivity. However, gateways and forwarding nodes, like any other free market, may create an oligopolistic market for the users they serve. In this study, a coalition scheme between buyers aims to address price control by gateways or nodes closer to gateways. In a Stackelberg competition game, buyer agents (users) and sellers (gateways) make decisions using reinforcement learning (RL), with decentralized Deep Q-Networks to buy and sell forwarding resources. We allow communication links between the buyers with a limited messaging space, without defining a collusion mechanism. The idea is to demonstrate that through messaging, and RL tacit collusion can emerge between agents in a decentralized setup. The multi-agent reinforcement learning (MARL) system is presented and analyzed from a machine-learning perspective. Moreover, MARL dynamics are discussed via mean field analysis to better understand divergence causes and make implementation recommendations for such systems. Finally, the simulation results show the results of coordination among the users.
Fault detection and isolation is critical for reliable operation of distribution systems. The ride-through requirements for the distributed energy resources (DER), mandated by the IEEE 1547-2018 standard, makes it challenging to use undervoltage (UV) conditions for fault detection. In addition, with low fault current contribution from these inverter-based DERs, the time-overcurrent relays are also less effective. Thus motivated, this paper presents a learning-based approach for fault detection and localization. A convolutional neural network (CNN)-based model is proposed which uses local voltage and current waveforms from DER locations and feeder substations, for training a zonal classifier. The classifier can be adopted into any relay-like device for discriminating between faults originating from different protection zones. The performance of the proposed approach was tested on publicly available test feeders with distributed photovoltaics (PVs).
Digital real time simulators (DRTS) are increasingly being used for the evaluation of power hardware and controller hardware in the laboratory prior to field deployment. Although DRTS are capable of simulating large models in real-time, it is challenging to visualize the results of large models without overdrawing or confounding the viewer. This paper provides an open-source framework for users to visualize their DRTS-based hardware-in-the-loop (HIL) experimental results in real-time. This proposed framework can be used by experimental test beds that can push data through an internet protocol based network. The proposed framework includes three main components. First, it includes the DRTS that generates and pushes the data to a relay. Second, it includes an application that serves multiple purposes, from data storage, testing, and translation of the data to a publisher/subscriber protocol. Finally, it includes libraries and applications that can be used to visualize the data by subscribing to the relay. This framework is available in open source, and it is tested using the HIL platform developed for testing advanced distribution management systems.
Protecting inverter-interfaced microgrids is challenging as conventional time-overcurrent protection becomes unusable due to the lack of fault current. There is a great need for novel protective relaying methods that enable the application of protection coordination on microgrids, thereby allowing for microgrids with larger areas and numbers of loads while not compromising reliable power delivery. Tools for modeling and analyzing such microgrids under fault conditions are necessary in order to help design such protective relaying and operate microgrids in a configuration that can be protected, though there is currently a lack of tools applicable to inverter-interfaced microgrids. This paper introduces the concept of applying an optimization problem formulation to the topic of inverter-interfaced microgrid fault modeling, and discusses how it can be employed both for simulating short-circuits and as a set of constraints for optimal microgrid operation to ensure protective device coordination.
With the increasing penetration of Distributed Energy Resources (DERs) at the grid-edge, power systems include more energy storage, remote switches, relays, voltage regulators, and other intelligent electronic devices (IED). Effective control of these grid-edge devices by using Advanced Distribution Management Systems (ADMS) can yield substantial improvements to the resiliency and power quality of distribution systems. In this paper, improvements to the resiliency of a distribution system are demonstrated using a multi-site evaluation environment consisting of a real-time Hardware-in-Loop (HIL) setup in which DERs and other IEDs are modeled; and an ADMS which monitors and is able to control the distribution system assets. The HIL model and the ADMS are located 2400 km away, with communication between the sites enabled by a data manager using Distributed Network Protocol 3 (DNP3), demonstrating the system's capabilities even over long distances. After a simulated transmission system failure in the HIL demonstration setup, DERs and other devices are operated to restore critical loads and node voltage profile (to within the 'nominal +/-5%' band) in the distribution system.
This report summarizes the design and pilot demonstration of a framework called Grid Guard that was created to provide increased data and device trustworthiness to electric grid devices by leveraging distributed ledger technology (DLT), specifically blockchain. Grid Guard contains a combination of core cryptographic methods such as the secure hash algorithm (SHA), and asymmetric cryptography, private permissioned blockchain, baselining configuration data, consensus algorithm (Raft) and the Hyperledger Fabric (HLF) framework. The system implements a low energy, fast, and robust enhancement to system trustworthiness within and across electric grid systems such as substations, control centers and metering infrastructures. Blockchain is a distributed database structured that provides a practically unalterable (immutable) timeline of stored transactions. By relying on hashing and the Raft consensus algorithm, if an entity tries to illegitimately alter a record at one instance of the database the other ledger nodes are not altered. They work to cross-reference each other and easily locate any incorrectly added data and remove it. The bulk raw data is stored in an off-chain storage (outside of the blockchain ledger) and a hash of this baseline data is stored in the Blockchain ledger via hashing windows of time-series and configuration data, after aggregation and filtering. The bulk off-chain data repository is then considered to be trust-anchored using the hashes stored in the blockchain. To secure the electric grid testbed devices and data, device configuration baselines were compared to those baselines that had been previously stored in the ledger. Statistical baselines for device configurations, network communication patterns, and high-speed sensor data are calculated and then stored off-chain and hashes stored in the ledger. Measurements such as three-phase voltage and current, frequency, breaker status, protection scheme settings, network configuration settings (and other device configuration artifacts) and network traffic features (packet interarrival times) are compared every minute or other selected time windows. During phase 1 of the Grid Guard DLT project different DLT technologies were studies, and an assessment was performed on DLT technology vulnerabilities, uses, and key characteristics. DLT consensus protocols were studies (e.g., RAFT, named after Reliable, Replicated, Redundant, And Fault-Tolerant). Also, cryptography, public, private and permissioned or permissionless systems were assessed. Grid Guard implements a permissioned private DLT. Consensus algorithm selection and choice of DLT implementation depended heavily on the use-case. For this use-case, parameters were selected to measure performance and existing tools for assessment. Benchmarking was performed theoretically and practically. During phase 2 hashed transactions/blocks were inserted into the ledger every second. During phase 2 of the Grid Guard DLT project, a prototype framework was developed and demonstrated for attestation of critical substation devices and data using precision timing systems that use PTP and IRIG-B protocols) on a testbed of operational devices that emulated a distribution substation, control center, and power metering infrastructure using real Operational Technology (OT). The testbed includes OT devices such as protective relays, human machine interfaces (HMI), and power meters. To determine when to collect and compare system and network baselines, an initial examination of an anomaly detection capability to identify malicious manipulation of data streams was conducted. The resulting anomaly detection was demonstrated in a set of experiments and leveraged to trigger device artifact attestation checks. Attestation checks occur against device configuration baselines when compared with the immutable blockchain-stored baselines, which provided a cryptographically supported means by which to store baselines. The electrical substation-grid testbed was created to test the Grid Guard framework. The testbed emulates the operations of a portion of a power grid and SCADA systems as closely as possible. The testbed integrates real protocols, mainly IEC 61850 standard protocols, such as the Sampled Value (SV) and the GOOSE protocols. The testbed also supports DNP3 and other layer 2 and layer 3 protocols such as Telnet, SSH, SFTP/FTP and other proprietary protocols needed to connect to industrial control system equipment. The testbed emulates real power conditions using the OpalRT hardware-in-the-loop (HIL) device which can create fault situations that cannot be easily tested on real systems. The electrical substation-grid testbed was created using real measurement, communication, and protection devices that electrical utilities commonly use.
Next-generation communication technology will be made possible by cooperation between terrestrial networks with nonterrestrial networks (NTNs) composed of high-altitude platform stations (HAPSs) and satellites. Further, as humanity embarks on the long road to establish new habitats on other planets, the cooperation between NTNs and deep-space networks (DSNs) will be necessary. In this regard, we propose the use of reconfigurable intelligent surfaces (RISs) to improve coordination between these networks given that RISs perfectly match the size, weight, and power (SWaP) restrictions of operating in space. Here, a comprehensive framework of RIS-assisted nonterrestrial and interplanetary communications is presented that pinpoints challenges, use cases, and open issues. Furthermore, the performance of RIS-assisted NTNs under environmental effects, such as solar scintillation and satellite drag, is discussed in light of simulation results.
This thesis presents the development of a laboratory-scale cyber–physical midstream pipeline testbed designed to address this gap and support research in industrial control systems security. The platform integrates pumps, valves, sensors, programmable logic controllers (PLCs), and a human–machine interface (HMI) to emulate the monitoring and control architecture of real pipeline operations. The physical process is implemented as a closed-loop liquid circulation system designed to replicate flow behavior characteristic of midstream pipeline infrastructure. The testbed enables real-time data acquisition of key process variables, including flow rate and pressure facilitating the generation of datasets representative of normal pipeline operation. A threat model encompassing common ICS attack vectors was developed, including sensor spoofing, command injection, false data injection, denial-of-service attacks, and relay manipulation. Multiple attack scenarios were implemented and evaluated to demonstrate how cyber intrusions targeting sensors, actuators, networks, and software propagate into measurable physical consequences in pipeline flow and pressure. The developed platform serves as a practical, cost-effective environment for experimentation, education, and future cybersecurity research in midstream pipeline systems.
An earlier study evaluated issues with microgrid protection. This highlighted the difficulties with microgrid protection, which include: 1. lack of fault current from inverter-interfaced generation, 2. varying fault current between grid-connected and islanded modes, 3. potential for normally-meshed operation and 4. unbalanced operation due to single-phase loads. It is worth noting that not all microgrid designs will include all these challenges. For example, microgrids could choose to omit meshed operation. Previous work identified differential protection based on the discrete S-transform for line protection and admittance protection for load protection as possible solutions . However, some severe limitations were identified. This included the potential for blinding of the discrete S-transform protection when fault contribution on either end of the line is similar, and loss of protection selectivity for admittance protection in the case of upstream line-ground faults. This report investigates admittance protection as a solution for line and load protection in greater detail by comparing analytical and simulated results. Section 2 describes the protection schemes analyzed and the behavior of inverter-interfaced microgrids under faults in more detail. Section 3 derives sequence networks for the fault cases considered. Section 4 presents a transient model constructed to validate the impedances calculated from the sequence networks. Section 5 compares the results from the sequence networks and transient model. Last, Section 6 presents the conclusions of this study in terms of the suitability of admittance relaying for protection of inverter-interfaced microgrids.
Smart networks such as microgrid (MG) and active distribution networks (ADN) have been recently playing an important role in power system operation. The design and implementation of appropriate protection systems for such networks must be addressed, which imposes new technical challenges. This paper presents the implementation and validation aspects of an adaptive fault detection strategy based on neural networks (NNs) and multiple sampling points for ADN and MG. The solution is implemented on an edge device. Artificial NNs are used to derive a data-driven model that uses only local measurements to detect fault states of the network without the need for communication infrastructure. Multiple sampling points are used to derive a data-driven model, which allows the generalization considering the implementation in physical systems. The adaptive fault detector model is implemented on a Jetson Nano system, which is a single-board computer (SBC) with a small Graphic Processing Unit (GPU) intended to run machine learning loads at the edge. The proposed method is tested in a physical, real-life, low-voltage network located at Universidad del Norte, Colombia. This testing network is based on the IEEE-13 Node Test Feeder scaled down to 220 V. The validation in a simulation environment shows the accuracy and dependability above 99.6%, while the real-time tests show the accuracy and dependability of 95.5% and 100%, respectively. Without hard-to-derive parameters, the easy-to-implement embedded model highlights the potential for real-life applications.
Explore the source record for details and available documents.
Explore the source record for details and available documents.