Process Cybersecurity, Data Integrity and Impact of Measures (and sensors)

Can a single plant de-estabilise a complete electrical grid?

I decided to write this after reading the article by @Joe Weiss regarding the lessons learned published by NERC after experiencing frequency disturbances over the eastern grid.

Our energy is run under Alternating Current (AC) since Tesla model was definetely adopted and its frequency is 60Hz-50Hz (depending wether you are in America or Europe etc). It is important for all rotating machines, from washing machines to turbines generating power.

In a connected grid, frequencuy is the dynamic result of forces due to real time differences in generation versus consumption, all over such grid

If frequency varies much, rotating machines tend to trip to self protect, what can lead to cascading effects if variation grows. I usually use this video to explain the escalation from systems to ecosystems (as electric grids are indeed).

In this case, the origin of the variation was due to a combined cycle power plant in Florida. It was discovered that a power transformer had been misconnected, leading to a wrong output power measure.

Such measure is needed by the control module name PLI (Power Load Imbalance) that sends correcting signals to the power island (gas & steam turbines) to match the power reference.

If the reference is higher or lower than the power output, the controls will work over steam or gas valves to adjust both processes. These systems are adjusted to work really smooth on little variations but to react fast if variations are big. (Wind turbines have something similar working over the pitch controller, different reaction speed)

Bad readings caused big variations and fast reaction from systems that, not only needed to work on control valves but on interception valves (steam side). You can see better the steam flow in the following video.

The plant experienced oscillations for 18minutes and reaching 200MW peak to peak, what led operator to remove the unit from service. In this case we are speaking of a manned plant where noise and vibrations (and shocks as interception valve seemed to close several times) could be sensed from the main control room, in case of remote operations, only a number oscillating that could have led to higher consequences.

Normally, from an asset management perspective, a power plant has in their turbines their crown jewels, however, this example reminds that criticallity has to be analysed from a process perspective to put together controls and instrumentation involved.

Now more eyes put on controls, but mainly as for a IT perspective, this event has to make us highlight the processes involved in maintenance and engineering modifications, and their potential impact on the whole ecosystem.

And regarding the whole architecture, let's think deeper on sensors, traditionally connected to the controllers, so that no encryption or authentication was considered but now are deployed widely, connecting through TCP/IP, with similiar security levels (non existent) increasing surface of exposure.

And think of Aurora project, these instruments can be configured in a wrong way and it could compromise the process without meaning to be malware!