A Supervisory Approach towards Cyber- Secure Generator ... · A Supervisory Approach towards Cyber-Secure Generator Protection ... relay technicians, protection ... Compromised settings

1

A Supervisory Approach towards Cyber-Secure Generator Protection

RAJESH G. KAVASSERI, Y. CUI AND N. R. CHAUDHURI DEPARTMENT OF ELECTRICAL AND COMPUTER

ENGINEERING NORTH DAKOTA STATE UNIVERSITY

CPS WEEK, CPSR Workshop, VIENNA, April 2016

Support from NSF CPS #1544621 gratefully acknowledged (*)

Context • Modern system protection largely served by

microprocessor-based relays; • Multifunctional role for relays – besides

protection - control/automation/metering… • Network/remote access to multiple parties:

relay technicians, protection engineers, control engineers, corporate groups and vendors.

What’s at stake? – A lot! • The “heart” (sanctum sanctorum) of a

relay lies in its “settings”. • Incorrect settings (intentionally or

otherwise) can be severely detrimental to system operation.

• How do we safeguard these settings? In this multi-party, multi-access scenario?

• Current practice: access restrictions, privileges, relay recommissioning,..

Example (from [1])

SETTINGS

Example (from [2], BPA)

SETTINGS

Synchrophasor Vector Processor

Focus: Out of Step (OOS) Events for Synchronous generators

• OOS: generator exhibits undamped power swings with (potential) loss of synchronism

• Protection solutions based on “settings” a) Rate of change of positive sequence

impedance seen at generator terminals (implemented by impedance relays/blinders)

b) More recently, slip and acceleration based relays requiring PMU inputs – used by SEL

Example/Relay characteristics

7

TRIP

Settings: (R,X) center, radius, blinder positions, separation timers

Example/characteristics (from [2])

8

Settings: Discriminating lines

Compromised settings will impact protection – potentially reversing TRIP and BLOCK decisions !

Key Idea – Can we computationally supervise this relay through an independent path?

For OOS, the key variable to monitor is the rotor angular separation

Challenge – The voltage angles can be directly measured, but

not the rotor angle – The apparent impedance is used to approximate

the angular separation between the rotor angle and voltage angle (Device 78)

10

Measurable Immeasurable

Solution: * Estimate the angular separation using Dynamic State Estimation (DSE) * Kalman filter-based methods can be used; but here, we use particle filters for robustness and accuracy

Dynamic State Estimation (DSE)

11

DSE

𝑽 ,∠𝜽 𝑰 ,∠𝝓

• Generator model • Exciter, turbine model • Measurement model

Supervisory Scheme

Local PMU

𝜹,𝝎,𝑬𝒅′ ,𝑬𝒒′,𝑬𝒇𝒅,𝑻𝒎

Phasor information and resultant product (e.g. power output)

Estimated dynamic states

Particle Filter Approach

12

𝑥𝑘 = 𝑓𝑘 𝑥𝑘−1,𝑢𝑘−1,𝑤𝑘−1

𝑦𝑘 = ℎ𝑘 𝑥𝑘 ,𝑢𝑘 , 𝑣𝑘 System Equation

Measurement Equation

𝑝 𝑥𝑘|𝑌𝑘 = pdf of 𝑥𝑘(𝑠𝑠𝑠𝑠𝑠 𝑣𝑠𝑣𝑠𝑣𝑣) given a set of measurements

We have

We solve for

At each time step k: • The a priori particles are computed from the system dynamics (f()) and the

known pdf of the process noise.

• For m measurements, the probability of a priori particles conditioned on the measurement is given by:

• The probabilities are normalized and the a posteriori are resampled.

Case Study: New England System

13

G1

30

2

25

G837

26 28 29

G938

1

G10

39

9

8

7

5 6

4

3

G2

31 11

12

10

13

14

G3

32

18

27

17

16

15

19

20

G5

34G4

33

21 22

G6

35

23

G7

36

24

System summary: • 10 generators • 39 buses • 46 branches Prime-mover, excitation controllers and power system stabilizers are all modeled

Self-clear fault on line 28-29

Sample of Tracking Results

14

Summary of 100 Monte Carlo trials

Sample of Tracking Results

15

Summary of 100 Monte Carlo trials

Detection Method

16

17

Consistency Test: Stable Case

18

Consistency Test: Unstable Case

19

Misinterpretation due to Faulty Setting

Stable swing leads to a mis-trip

Unstable swing goes undetectable

20

Angular separation by DSE for generator mis-trip case

Angular separation = rotor angle – voltage angle of HV side of the transformer

• An alternative pathway is proposed to monitor the swing stability independently

• Simulation results show that the proposed approach complies with conventional relay decision

• The alternative pathway can provide supervisory supplement on detecting anomalous operation since it does not rely on the same set of settings and directly reflect angular separation

Conclusions

Sources

• [1] Technical Report/SEL Publication: Advanced Real-Time Synchrophasor Applications Edmund O. Schweitzer, III, David Whitehead, Armando Guzmán, Yanfeng Gong, and Marcos Donolo, Schweitzer Engineering Laboratories, Inc.

• [2] Schweitzer, E. O., Guzman, A., Altuve, H. J., and Tziou-varas, D. A., “Real-Time Synchrophasor Applications

for Wide-Area Protection, Control, and Monitoring,” Tech. report., Schweitzer Eng. Laboratories, 2009.

Danke!

(*) The views and opinions of authors expressed herein do not necessarily state or reflect those of the NSF or any government agency thereof.