Time-Synchronization Attack Detection in Unbalanced Three-Phase Systems

Phasor measurement units (PMU) rely on an accurate time-synchronization to phase-align the phasors and timestamp the voltage and current phasor measurements. Among the symmetrical components computed from the phasors in three-phase systems, the standard practice only uses the direct-sequence component for state estimation and bad data detection (BDD). Time-synchronization attacks (TSAs) can compromise the measured phasors and can, thus, significantly alter the state estimate in a manner that is undetectable by widely used power-system BDD algorithms. In this paper we investigate the potential of utilizing the three-phase model instead of the direct-sequence model for mitigating the vulnerability of state estimation to undetectable TSAs. We show analytically that if the power system is unbalanced then the use of the three-phase model as input to BDD algorithms enables to detect attacks that would be undetectable if only the direct-sequence model was used. Simulations performed on the IEEE 39-bus benchmark using real load profiles recorded on the grid of the city of Lausanne confirm our analytical results. Our results provide a new argument for the adoption of three-phase models for BDD, as their use is a simple, yet effective measure for reducing the vulnerability of PMU measurements to TSAs.

Time-Synchronization Attacks against Critical Infrastructures and their Mitigation

Marguerite Marie Nathalie Delcourt

This work focuses on the security of critical infrastructures against time-synchronization attacks (TSA). A TSA can impact any network that relies on the dynamic analysis of data, by altering the time synchronization between its nodes. Such attacked networks can start failing. Some TSAs are thwarted by cyber-security tools such as authentication and confidentiality algorithms. However, such tools cannot counter TSAs that are implemented physically. Such TSAs are undetectable but they may be detected if they lead to non-plausible observations. The identification of TSAs requires in-depth knowledge of the system's operation.We focus on TSAs in two settings. First, we consider smart grids. Their control and operation require the timely knowledge of the system state, which is inferred from an estimate computed from measurements. We consider phasor measurements taken from phasor measurement units (PMUs). However, they require a precise time synchronization, which is a weakness as existing synchronization methods are vulnerable to attacks. We aim to assess the vulnerability of the synchrophasor-based state estimation of a system, by exploring the feasibility and detectability of TSAs on PMUs. A widespread technique to make the state estimation more robust is to couple it with a bad-data detection (BDD) scheme. However, it is known that false data injection attacks and TSAs can impact the state estimation without being detected by the BDD algorithms. We present practical attack strategies for undetectable TSAs and novel vulnerability conditions. One of them is a static condition that does not depend on the measurement values. We propose a security requirement that prevents it and a greedy offline algorithm that enforces it. If this requirement is satisfied, the grid may still be attacked, although we reason that it is unlikely. We identify two sufficient and necessary vulnerability conditions which depend on the measurement values. For each, we provide a metric that shows the distance between the observed and vulnerability conditions. Enforcing our requirement requires increasing the amount of measurement points of the grid. We investigate the benefits of utilizing the three-phase model instead of the direct-sequence model for security. We show that if the power system is unbalanced, then the use of the three-phase model enables to detect attacks that are undetectable if the direct-sequence model is used. Numerical results from simulations with real load profiles from the Lausanne grid, confirm our findings. Second, we consider sensor networks for passive-source localization. We focus on the localization of a passive source from time difference of arrival (TDOA) measurements. Such measurements are highly sensitive to time-synchronization offsets. We first illustrate that TSAs can affect the localization and we show that residual analysis does not enable the detection and identification of TSAs. Second, we propose a two-step TDOA-localization technique that is robust against TSAs. It uses a known source to define a weight for each pair of sensors, reflecting the confidence in their synchronization. We then use the weighted least-squares estimator with the new weights and the TDOA measurements received from the unknown source. Our method either identifies the network as being too corrupt, or gives a corrected estimate of the unknown position along with a confidence metric. Numerical results illustrate the performance of our technique.

EPFL2021

Advanced Model for Multiphase Generators

György Atilla Bànyai

The current development of generators and power electric drives is characterized by increased power electronic integration. This evolution concerns particularly the variable speed power units allowing both a higher performance and substantial savings on cost but nevertheless, it implies new constraints and difficulties in term of interaction between the various components: generator, converter and network. The design and optimization of such generators is no longer possible with the same approach and same tools as for conventional machines directly connected to a symmetrical three-phase network. This Ph.D. study is related to an industrial project which was developed by ALSTOM in the same time frame in which this thesis work was prepared. Since the project relies on a new high power synchronous generator topology (a multiphase turbo-generator connected to a three phase network via a power electronic converter), not many studies were done especially because of the enormous financial resources required by such studies and limitations in respect of the maximum power that a power electronic device can commute. The goal of this study is the development of an advanced multiphase machine model which can be used in a complex system comprising power electronic elements. The model has to accurately consider the physical phenomena which are taking place in a machine while functioning in such conditions. The selected approach for the development of the machine model is a combined numerical-analytical approach. This solution was preferred since it can take benefit from the precision, a property which is characteristic to the numerical Finite Element Methods (FEM), but also from the fast computation times which is a property of the analytical models. The model presented in this thesis is based on the differential inductance parameter. The differential inductances are calculated analyzing the results of FEM simulations and are used afterwards in analytically expressed circuit equations. The machine circuit equations, having as parameters the differential inductances, are afterwards solved numerically. In order to take advantage of the existing elements necessary for the analysis of the electrical power networks (including power electronic converters), the developed method was integrated into a network simulation software package. This simulation software package was designed for industrial use where a short computation time is desired; the module with the integrated machine model is respecting this principle.

EPFL2011

Locating Faults on Untransposed, Meshed Transmission Networks Using a Limited Number of Synchrophasor Measurements

Sadegh Azizi, Mario Paolone

The method of symmetrical components is not effective for fault location in the case of untransposed lines, due to potential couplings between the sequence circuits. This paper proposes a non-iterative algorithm in the phase-coordinates for wide-area fault location on untransposed transmission networks. In doing so, first, an improved two-terminal method is suggested to accurately locate faults on untransposed lines. Next, an algorithm is proposed to infer voltage and current phasors at the faulted line ends without direct measurements, by taking advantage of the data provided by phasor measurement units (PMUs). Accordingly, the adverse effect of close instrument transformers transients on the estimation accuracy is minimized. Being highly nonlinear in terms of fault distance and impedance, the fault equations are derived and made linear in this paper by defining six suitable auxiliary variables. The resulting system of equations is solved using the least-squares method to obtain three-phase voltages and currents at the faulted line ends. A main feature of the proposed algorithm is that it only requires a limited number of current and voltage synchrophasors. An additional advantage of the proposed algorithm is that the faulted line is not required to be known a-priori. The proposed algorithm is validated using extensive simulation studies on the New England 39-bus test system, accounting for different fault locations, types and resistances.