Converged Approach towards Resilient Industrial control systems and Cyber Assurance (CAPRICA)

Energy production and distribution is undergoing radical change driven by a "Green" agenda pushing for increased energy conservation, greater emphasis on renewable energy sources and more sophisticated demand side business models. The UK currently has 12% of its energy requirements met by wind farms. This percentage is set to grow as wind generated electricity is imported from neighbouring countries. For example Ireland (where already 50% of domestic energy requirements are met by wind farms) will become a net exporter of wind generated electricity in the near future. The significance of this market change cannot be underestimated and will lead to broad infrastructural change. Wind generated electricity is bursty in nature, largely unpredictable and seldom occurs when consumer demand is greatest. This is true of most renewable energy sources. Wind farms are typically sited in remote areas of low population density and collectively represent a highly distributed generation source. This is in stark contrast to the traditional grid which can be characterised as a strictly hierarchical, centrally managed network of carbon or nuclear energy fuelled generators which can accurately predict demand side requirements and vary their output accordingly.

Grid infrastructure and methods of operation will change radically in order to accommodate new, distributed, renewable energy generation and a growing population of prosumers - retail customers who consume and produce energy in tandem. The technical challenges are manifold and many of the assumptions underpinning traditional grid operations are rapidly dissolving. Energy network operators urgently need new guidance and direction to meet the dual challenges of:
1. Maintaining operational control over new, highly distributed generation facilities embedded in a prosumer
driven, highly connected, ICT dependent, grid infrastructure.

2. Implementing sufficient control measures to protect grid operations from Internet borne threats and attacks.

Caprica meets these challenges head on and proposes to investigate the phenomena of synchronous islanding via experimentation on the only large scale synchrophasor network available in the UK. Islanding occurs when a geographic portion of the distribution network becomes electrically isolated from the rest of the grid. Reconnecting an island back onto the grid can be very dangerous if the two portions of the network are not properly synchronised. Phase drift is a likely scenario for a self-powered island driven by wind or other renewable generation sources. The QUB EPIC team have been working on this problem and can demonstrate solutions based on a distributed control architecture using synchrophasor measurement devices. The synchrophasors operate over a public telecoms network which immediately leads to cyber vulnerabilities in the grid control system. A cyber-attack which manipulates synchrophasor measurements could cause untold damage to grid infrastructure and consumer equipment on a national scale. To counter this risk the EPIC and CSIT research groups have come together to collaboratively investigate the control and cyber security elements of synchronous islanding. By providing an integrated view of grid status and cyber defences we will demonstrate improved operational decision making, improved grid resilience in the face of cyber attack, and lay the groundwork for a new distributed control architecture for the UK smartgrid.

1. New methods of control over the evolving smartgrid infrastructure containing a significant proportion of
distributed generation via renewable energy sources. Specifically new operational methodologies for dealing
with "power system islanding" whilst maintaining supply continuity to end-users and maintaining their safety.

First users of this research output will be Scottish and Southern Energy (SSE) plc.

2. New cyber security technology to protect distribution network infrastructure and critical operations carried out
via synchrophasors. Specifically SCADA protocol specific intrusion detection systems based on stateful
protocol analysis and model based payload analysis of Phasor Measurement Units (PMUs).

First users of this technology will be Thales UK.

3. New integrated threat detection methods using combined intelligence from both the cyber domain and the
distributed control domain.

First users of this technology will be SONI.

4. New grid operating procedures to facilitate "maintenance windows" which can be used to upgrade portions of
the distribution network. In this way grid infrastructure can be upgraded via a rolling upgrade programme and
ongoing protection against evolving cyber threats can be effectively implemented.

First users of this technology will be SSE.