Impact of GPS Signal Loss and Spoofing on Power System Synchrophasor Applications
1 like424 views
The document discusses the impact of GPS signal loss and spoofing on synchrophasor applications in power systems, emphasizing the vulnerabilities of Wide Area Monitoring, Protection, and Control (WAMPAC) systems. It provides insights into time synchronization requirements, potential cyber-physical threats, and evaluates the effects of these disruptions through real-time simulations. The study highlights the necessity of accurate time signals for effective PMU operations and the risks posed by intentional GPS interference.
![Thanks!
Questions?
https://www.kth.se/profile/luigiv
Dinosaurs died.
What came next was smaller. [D. Ernst]](https://image.slidesharecdn.com/0-luigi-nist-27042017rev-170821152107/85/Impact-of-GPS-Signal-Loss-and-Spoofing-on-Power-System-Synchrophasor-Applications-40-320.jpg)
Impact of GPS Signal Loss and Spoofing on Power System Synchrophasor Applications
- 1. Prof. Luigi Vanfretti luigiv@kth.se, https://www.kth.se/profile/luigiv/ Impact of GPS Signal Loss and Spoofing on Power System Synchrophasor Applications Invited Talk NIST Gaithersburg, MD April 27, 2017
- 2. • Background • Synchrophasor Technology Fundamentals • Example of WAMPAC Applications Developed at SmarTS Lab • Motivations for our study • Time Synchronization Requirements and PMU-Time Synch. • Vulnerability of WAMPAC Systems (Cyber-Physical Threats) • Impact of Time Synchronization Signal Loss on WAMPAC • Impact of Time Synchronization Spoofing Attacks (TSSAs) on WAMPAC • PMU behaviors under Time-Synch perturbations • Conclusions Outline 2
- 4. Background – Synchrophasor Fundamentals (1/2) 4 0 2 4 6 8 10 12 14 -1 -0.8 -0.6 -0.4 -0.2 0 0.2 0.4 0.6 0.8 1 The fundamental of voltage and/or current signals is estimated then represented as Phasors GPS Satellite GPS Receiver Synchronized Time-Tag Substation Clock Synchrophasors UDP/IP or TCP/IP connection between PMU and Workstation (Client) The phasor is packaged by the PMU in the IEEE C37.118.2 protocol and published using IP protocols, e.g. for a single PMU: Synchronized Phasors are a synthetic representation of the fundamental component of a measured signal
- 5. Background – Synchrophasor Fundamentals (2/2) IEEE Std C37.118.2 Application System PDC PMU 1 PMU 2 PMU n PDC PDC PDC Communication Network Synchrophasor System Architecture Angle differences can be easily computed for the same time stamp
- 6. Background - Time Synch. Requirements 6 Interdependency WAMPAC applications depend on the accuracy of the synchrophasors, and consequently on the precision input time signals. PMU Accuracy Requirement IEEE C37.118.1-2011 specifies a Total Vector Error (TVE) limit of 1% i.e. 0.5730 (degrees) or 31.8 µs at 50 Hz. Vulnerability The GPS system can be interfered both intentionally and/or cosmically. 0 0.01 0.02 0.03 0.04 0.05 0.06 -100 -50 0 50 100 Reference Waveform 50 Hz Synchronized to GPS 0 0.01 0.02 0.03 0.04 0.05 0.06 -100 -50 0 50 100 Measured Waveform 0.019 0.0195 0.02 0.0205 0.021 0.0215 0.022 80 85 90 95 100 105 X: 0.02 Y: 100 Phase Angle Difference with respect to Reference X: 0.02056 Y: 100 08:00:00.000000 08:00:00.020000 08:00:00.040000 08:00:00.060000 The reference wave is defined by a cosine wave (nominal frequency), with a peak at the top of each second. Voltage and current angles are then compared to the reference wave to produce synchronized phasor measurements
- 7. Background - Time Synch. Signals in PMUs 7 GPS Receiver Antenna CT Input Module VT Input Module PMU Power Supply PMU Serial and Ethernet Interface Binary I/Os IRIG Input Settings Reset Power Off Esc Ia = 1500 A Ib = 1499 A Ic = 1501 A Va = 60.01 kV Vb = 60.00 kV Vc = 59.99 kV Date: 01/11/2015 Time: 21:08:19.30 Frequency = 50.00 Hz Phasor Measurement Unit G1 Bus 1 External Grid Bus 2 Bus 3 3-ɸ voltage Substation Clock 3-ɸ currents CT VT Transmission Line GPS GPS IRIG-B Network clock GPS GPS PTP IRIG-B signals from a Substation Clock that modifies GPS signals to the desired time-code format. Most of the commercial PMUs utilize IRIG-B signals for time synchronization Direct GPS signals from GPS antenna PTP from Network Clock
- 8. Background - Testing, V&V in our Experimental Work 8 (1) A real-time simulation model of active distribution networks is developed to test the PMU application. (2) The real-time simulation model is interfaced with phasor measurement units (PMUs) in HIL (3) PMU data is streamed into a PDC, and the concentrated output stream is forwarded to an application development computer (4) A computer with development tools within the LabVIEW environment receives the PMU data. All data acquisition is carried out using the corresponding standards (i.e. IEEE C37, IEC 61850). (5) During development, implementation and testing, the application is fine-tuned through multiple HIL experiments.
- 9. Synchrophasor-Based Near-Real-Time Monitoring Applications 9 (1) Monitoring & Visualization (2) Mobile Apps (4) Forced Oscillation Detection (5) Real-Time Voltage Stability Assessment (1)-(2) M. S. Almas, et al, "Synchrophasor network, laboratory and software applications developed in the STRONg2rid project," 2014 IEEE PES General Meeting | Conference & Exposition, National Harbor, MD, 2014, pp. 1-5. doi: 10.1109/PESGM.2014.6938835 (3) V. S. Perić, M. Baudette, L. Vanfretti, J. O. Gjerde and S. Løvlund, "Implementation and testing of a real-time mode estimation algorithm using ambient PMU data,"Power Systems Conference (PSC), 2014 Clemson University, Clemson, SC, 2014, pp. 1-5. doi: 10.1109/PSC.2014.6808116 (4) M. Baudette et al., "Validating a real-time PMU-based application for monitoring of sub-synchronous wind farm oscillations," Innovative Smart Grid Technologies Conference (ISGT), 2014 IEEE PES, Washington, DC, 2014, pp. 1-5. doi: 10.1109/ISGT.2014.6816444 (5) J. Lavenius and L. Vanfretti, “Real-Time Voltage Stability Monitoring using PMUs”, Workshop on Resiliency for Power Networks of the Future, May 8th 2015. Online: http://www.eps.ee.kth.se/personal/vanfretti/events/stint-capes-resiliency- 2015/07_JanLav_Statnett.pdf (6) A. Bidadfar, H. Hooshyar, M. Monadi, L. Vanfretti, Decoupled Voltage Stability Assessment of Distribution Networks using Synchrophasors,” IEEE PES General Meeting 2016, Boston, MA, USA. Pre-print: link. (3) Inter-Area Oscillation Assessment (6) Real-Time PV-Curve Voltage Stability Assessment
- 10. Now on GitHub! … (kind of) 10 A Simple Application Application Development Toolkit
- 11. Synchrophasor-Based Wide-Area Controls (1/2) 11 A, B A B Controller Configuration Interface Software-Hardware Layers Testing E. Rebello, M. S. Almas and L. Vanfretti, "An experimental setup for testing synchrophasor-based Damping control systems," Environment and Electrical Engineering (EEEIC), 2015 IEEE 15th International Conference on, Rome, 2015, pp. 1945-1950. doi: 10.1109/EEEIC.2015.7165470 E. Rebello, L. Vanfretti and M. Shoaib Almas, "Software architecture development and implementation of a synchrophasor-based real-time oscillation damping control system," PowerTech, 2015 IEEE Eindhoven, Eindhoven, 2015, pp. 1-6. doi: 10.1109/PTC.2015.7232288 E. Rebello, L. Vanfretti and M. Shoaib Almas, "PMU-based real-time damping control system software and hardware architecture synthesis and evaluation," 2015 IEEE Power & Energy Society General Meeting, Denver, CO, 2015, pp. 1-5. doi: 10.1109/PESGM.2015.7285812 A B S3DK
- 12. Testing: • Using the 2-Area Four machine Klein-Roger- Kundur power system model. • In RT-SIL and RT-HIL. Results: • Several local and remote synchrophasor input signals tested • There is a big difference in the perfromance of the controller in RT-SIL and RT-HIL. • These results highlight the importance of considering the effect of the hardware implementation when looking at software simulation results. Synchrophasor-Based Wide-Area Controls (2/2) 12 G. M. Jonsdottir, M. S. Almas, M. Baudette, M. P. Palsson and L. Vanfretti, "RT-SIL performance analysis of synchrophasor-and-active load-based power system damping controllers," 2015 IEEE Power & Energy Society General Meeting, Denver, CO, 2015, pp. 1-5. doi: 10.1109/PESGM.2015.7286372 G. M. Jonsdottir, M. S. Almas, M. Baudette, L. Vanfretti, and M. P. Palsson, “Hardware Prototyping of Synchrophasor and Active Load-Based Oscillation Damping Controllers using RT-HIL Approach”, IEEE PES GM 2016, July 17-21, Boston, Massachusetts, USA The load control algorithm developed d/dt max min Load control algorithm Load Modulation Phasor POD Local/Remote Measurements Oscillatory Content Load Change Signal Switch>0 Idea: Develop an algorithm to control industrial load, in particular aluminum smelters for damping of inter-area oscillations. Input Signal 1: V+ Area1 Input Signal 2: (Vφ Area1 - Vφ Area2)/2 Scenario: 5% change in Vref of G1
- 14. Synchrophasor-Based Wide-Area Protection Synchro-check and Automatic Synchronization 14 Synchro-check Function M. S. Almas and L. Vanfretti, "A Hybrid Synchrophasor and GOOSE-Based Power System Synchronization Scheme," in IEEE Access, vol. 4, no. , pp. 4659-4668, 2016. START Synchrophasors input from PMU-A and PMU-B Vdead < VLive < VA Vdead < VLive < VB Block CB Closure Calculate Angle for synchronization Close CB for Synchronization fmin < fA < fmax fmin < fB < fmax |fA - fB|< fThresh Block CB Closure NO NO YES YES VB > VA GOOSE message to increase VField GOOSE message to decrease VField YES NO fB > fA GOOSE message to increase PMech GOOSE message to decrease PMech NO YES YES NO |VA - VB|< VThresh YES VA > VLive and VB < Vdead VA < Vdead and VB > VLive Yes Yes Yes VA < Vdead and VB < Vdead Yes Live Line Dead Bus (LLDB) Dead Line Dead Bus (DDDB) Dead Line Live Bus (DLDB) AND Dead Bus Closing Enabling Input Received? f Diff = ?Sync YES WAIT NO PMU-based Automatic Synchronization Algorithm 83 1.5 Voltage/frequency boundary test Lead Time Testing Phase angle window verification Scheme Validation
- 15. 15 On December 23, 2015, Ukrainian power companies experienced unscheduled power outages impacting a large number of customers in Ukraine. Reference: https://ics-cert.us-cert.gov/alerts/IR- ALERT-H-16-056-01 IEEE Spectrum August 2016 (GPS Lies) GPS and Cyber-Security (Presumed) and Actual Threats
- 16. Intentional Physical Attacks 16 GPS Spoofer Physical Attacks • Disconnecting PMU’s time-synchronization signal input • Disconnecting PMU’s Power Supply • Disconnecting communication link between PMU and the network
- 18. Make a GPS Jammer – Unlawful to intentionally interfere with GPS signal – Impact on other technologies cellphone services, WIFI etc. In this study • Experimentally assesses the impact of loss of time-synchronization signal (Jamming) on WAMPAC applications. – Phase Angle Monitoring (PAM), anti-islanding protection, and oscillation damping applications are analyzed. • Literature review shows the impact of loss of time synchronization signals on offline and real-time monitoring applications only through (offline) simulation studies. Real-Time Hardware-in-the-Loop simulation – Opal-RT eMEGAsim Real-Time Simulator – Commercial PMUs – SmarTS-Lab Methodology (1/3) – How to Study the Impact of Time Synch. Signal Loss? 18 Substation Clock PMU IRIG-B
- 19. Methodology (2/3) - How to Study the Impact of Time Synchronization Spoofing Attack? 19 • The TSSA is modeled through real-time IRIG-B signal generator, within the RT simulator. • Possible to delay the time synchronization signals from microseconds to milliseconds. 1 1.05 1.1 1.15 1.2 1.25 1.3 0 5 10 Simulation Time (sec) WidthModulatedOutputVoltage(IRIG-B) Real-Time IRIG-B Signal Generation (1 sec simulation showing one complete frame of IRIG-B Time Code) Simulation was carried out on 14th April 2015 1.3 1.35 1.4 1.45 1.5 1.55 1.6 1.65 0 5 10 1.7 1.75 1.8 1.85 1.9 1.95 2 0 5 10 P6 P9 P0 P1 P2 P3 P5P4 P7 P8 1 2 4 8 10 20 40 P0 1 2 4 8 10 201 2 4 8 10 20 40 100 2001 2 4 8 10 20 40 80 1 2 4 8 10 20 40 80 Logical 1 (50 %, 5ms) Logical 0 (20 %, 2ms) Ref. Marker (80 %, 8ms) Control Functions Days Years Seconds Minutes Hours Time of Day Binary Seconds (51601 seconds) Control Functions 1 PPS
- 20. Methodology (3/3) - How to Study the Impact of Time Synchronization Spoofing Attack? 20 The IRIG-B signal generator model and power system model are executed in real-time. Experimentally assesses the impact of TSSA on WAMPAC applications. • Phase Angle Monitoring (PAM), anti-islanding protection, and oscillation damping applications are analyzed. • Literature review shows the impact of TSSA on monitoring and post-fault analysis applications only.
- 21. Experimental Setup Time Synch. Signal Loss 21 Real-Time Simulator Substation Clock Arbiter Model 1094 B GPS Antenna Phasor Measurment Units (PMUs) IRIG-B Communication Network (Managed Ethernet Switch) PMU Stream Monitoring application displaying real-time electrical quantities Sychrophasors received in external controllers based on NI-cRIOs with deployed algorithm for protection (islanding detection) and control application (power oscillation damping) Legend GPS Signal Hardwired PMU stream PDC stream To WAMPAC Feedback Signal 3-phase Voltage and current signals to the low-level interface of PMUs Feedback signal from external controller to RTS To External Controllers for synchrophasor protection/control applications Unwraps PDC stream and provides raw measurements in LabView enviroment S3 DK SEL 421 (1) SEL 421 (2) Power system test- case model executed in real-time in Opal-RT Phasor Data Concentrator SEL-5073 PDC stream PMU1 = reference PMU continuously receiving IRIG-B signals from the substation clock. PMU2 = test PMU IRIG-B input is disconnected at a given point in time This resulted in imprecise synchrophasors computations by PMU 2 as compared to the reference PMU 1 Case A: ”Rick” Time Sync Signal Loss
- 22. Experimental Setup Time Synch. Signal Spoofing 22 IRIG-B (Spoofed) PDC Stream Trip Signal (GOOSE) PMU-B (Spoofed) Trip Signal (GOOSE) Protection Operated Breaker Open Breaker Opening Time 19:57:08.200 IRIG-B (ref) IRIG-B signals to PMUs PMU-A (Reference) Reference Spoofed S3 DK 50.05 50.04 50.02 50 49.98 49.96 49.95 Measured Synchrophasor Frequency Frequency 0 10 20 30 40 50 60 70 80 90 100 49.94 49.96 49.98 50 50.02 50.04 50.06 Hardwired PMU Stream 3-Phase Voltage and current signals Raw ValuesFeedback Legend1 Model execution 2 3 4 SEL-PDC 50735 Raw synchrophasors in LabView 6 GUI for WAMPAC Applications Real-Time External Controllers 7a7b 8a 8b Damping signals are fedback to the power system Synchrophasors computation PDC Stream Synchrophasors IRIG-B generator and power system model Executed in RTS PMU-A = reference PMU continuously receiving authentic (Reference) IRIG-B signals from the RTS. This resulted in imprecise synchrophasors computations by PMU-B as compared to the reference PMU-A PMU-B = test PMU Receives Spoofed IRIG- B signals at a given point in time Case B: ”Morty” Time Sync Signal Spoofing
- 23. Results Synchrophasor Computation 23 500 1000 1500 2000 250 300 350 X: 779.3 Y: 338.8 Angle (Degrees) Voltage Phase Angle as Computed by PMU 1 and PMU 2 Time (sec) 500 1000 1500 2000 -20 -10 0 X: 779.3 Y: -0.075 AngleDifference (Degrees) Voltage Phase Angle Difference when the GPS Signal is Lost at PMU 2 Time (sec) 500 1000 1500 2000 0 2 4 X: 1779 Y: 3 Error Time Error from Oscillography of PMU 2 Time (sec) X: 879.3 Y: 2 X: 779.3 Y: 0 X: 789.3 Y: 1 Out of Sync Unlocked Time PMU 1 (GPS Connected) PMU 2 (GPS Disconnected at t=779.3) 890 900 910 920 930 940 -2 -1.5 Zoom • As GPS time synchronization signal to PMU 2 is lost, its error in voltage phase angle computation increases. • The top plot shows voltage phase angle in degrees as computed by both PMUs, middle plot shows the voltage phase angle difference with respect to reference PMU 1.
- 24. Results Synchrophasor Computation 24 0 50 100 150 200 250 300 0 0.2 0.4 0.6 0.8 1 5th Step 50 micro second error 3rd Step 30 micro second error 2nd Step 20 micro second error 1st Step 10 micro second error 4th Step 40 micro second error Positive Sequence Voltage Phase Angle Phase Error Limit for TVE = 1 % (0.573 degrees) Phase Error in Measured Positive Sequence Voltage Phasor as Computed by PMU PhaseAngleError(Degrees) Time (sec) a b c Time Error 0 µs Time Error 1000 µs Each 10 µs time synchronization error due to TSSA results in a phase angle error of 0.1790 in PMU-B • TSSA results in an error in voltage phase angle computation beyond 0.5730 mark as soon as the time error increases beyond 30 µs, thus breaching the maximum allowable TVE limit. • The actual synchrophasors as computed by the PMU before and after time spoofing by 1000 µs, thus resulting in a phase angle error of about 180
- 25. Results Phase Angle Monitoring Application 25 21 23 22 24 25 26 33 32 37 38 39 36 41 40 43 42 45 46 48 29 30 49 50 27 31 44 47 28 34 35 51 52 NORTH EQUIV. SOUTH CENTRAL 1G 2G 3G 4G 5G 6G 7G 8G 9G 10G 11G 12G 13G 14G 15G 16G 17G 18G 19G 20G 400 kV 220 kV 130 kV 15 kV 400 kV DC SL CB1 CB2 CB3 PMU-A PMU-B • The impact of Time Synchronization Signal Loss and TSSA on Phase Angle Monitoring is analyzed on a variant of the Nordic-32 power system model. • PMU-A and PMU-B are receiving three phase voltages and currents from Bus-38 and Bus-43, respectively which allow monitoring a major corridor between the North and the Central part of the network. • At a given point in time, the time synchronization signal input to PMU- B is disconnected/spoofed
- 26. Results Phase Angle Monitoring Application 26 • The loss in time synchronization signal shows an erroneous increase in line loading from 80% to 92 % and shows an increase from 625 MW to 752 MW within a span of 550 s after the disconnection of time signal from PMU2
- 27. Results Phase Angle Monitoring Application 27 Vφ-Bus-38 Vφ-Bus-43 • From t = 30 s, the TSSA is launched on PMU-B (connected at Bus-43) to introduce a time synchronization error in steps of 10 µs at precisely every 5 seconds. Within a span of 70 s, an erroneous increase in line loading of 12 % and an increase in power transfer from 630 MW to 765 MW is observed. By the end of the TSSA at t = 100 s, the error in phase angle differences is 2.690 due to a time synchronization error of 150 µs.
- 28. Results Passive Anti-Islanding Protection 28 G2 Bus 2 Bus 7 Bus 8 Bus 9 Bus 3 G3 G1 Bus 5 Bus 6 Bus 4 T2 T3 T1 Load C 100 MW 35 Mvar Load B 90 MW 30 Mvar Load A 125 MW 50 Mvar Bus 1 18/230 kV 230/18 kV 18/230 kV 300 MW 270 MW 300 MW CB-1a CB-2a CB-3 Trip Signal (GOOSE) Islanded System CB-1b CB-2b PMU-2 (Client) PMU-1 (Server) Va, Vb, Vc, V+, Ia, Ib, Ic, I+ computed at 50 frames / sec are sent to PMU-2 Passive Islanding Detection Algorithm is executed inside PMU-B Direct relay-to-relay communication V and I (Bus-4) V and I (Bus-7) Hardwire Interface Synchrophasors over TCP/IP IEC 61850-8-1 GOOSE Legend PMV53 := V1YPMA % Storing Local Positive sequence synchrophasor voltage angle in user defined analog PMV54 := RTCAP01 % Storing remote Positive sequence synchrophasor voltage angle in user defined analog PMV55 := 8.00000 % Store threshold value of 8 degrees in user defined analog PSV01 := abs (PMV53 - PMV54) > PMV55 % SET if measured synchrophasor synchrophasor voltage phase angle difference is greater than 8 degrees PCT01IN := PSV01 % Input for conditioning timer. Timer tracks PSV01 PCT01PU := 10.000000 % Pickup is set to 10 cycles i.e. When PSV changes state from 0 to 1, the timer picks it up only if state of PSV01 stays 1 for 10 cycles PCT01Q : Timer output SET to 1 when time exceeds 10 cycles after PSV01 is set GOOSE TRIP 10 cyc 0 cyc Voltage Phase Angle PMU-B (Local) 8 Voltage Phase Angle PMU-A (Remote) |abs| • If CB-1a, CB-1b and CB-2a, CB-2b are opened simultaneously, this results in an islanding condition with G1 supplying electric power to Load A at Bus 5. • Once the breakers are opened and the island is formed, G1 needs to be disconnected from the isolated network within 2 seconds as specified by IEEE Std. 1547-2008 Synchrophasor phase angle based passive islanding detection scheme
- 29. Results Passive Anti-Islanding Protection 29 0 0.5 1 1.5 2 2.5 3 3.5 20% 30% 40% 50% 60% 70% Anti-Islanding Scheme Operating Time Case A: Reliable GPS Case B: PMU-2 GPS disconnected for 200s Active Power Mismatch Time(s) 0 1 2 3 4 20% 30% 40% 50% 60% Anti-Islanding Scheme Operating Time Case A: Reliable GPS Case B: PMU-2 GPS disconnected for 200s • Due to the loss of the time- synchronization signal input to PMU-2, the protection operation time has increased by 1.022 s for 20 % active power mismatch and 0.62 s for 30 % active power mismatch. 10% Active Power Mismatch (Reliable Time Sync Signals to both PMUs) Angle Difference (degrees) Time (s) Trip Generation 59.6 59.8 60 60.2 60.4 60.6 60.8 0 4 8 12 16 X: 60 Y: 7.035e-006 59.6 59.8 60 60.2 60.4 60.6 60.8 0 1 X: 60.43 Y: 1 X: 60.63 Y: 1 Island formed by opening CB-1 Instance at which synchrophasor voltage angle difference increases beyond 8 degrees Timer output changes status as angle difference remains above 8 degrees for 10 cycles Phase Angle Difference (VφPMU-A-VφPMU-B) Phase Angle Threshold Islanding Detection Trip Signal Issued by PMU-B 1 2 3 • At 60 s, island is formed by opening CBs. • The phase angle difference (blue trace) goes beyond 80 at 60.43 s (grey trace). • Once the timer elapses 10 cycles, the PMU-B issues a trip command to disconnect the DG from the isolated island (green trace). Total operation time for this scheme with 10% active power mismatch is 0.63 s.
- 30. Results Passive Anti-Islanding Protection 30 • Synchrophasor positive sequence voltage phase angle difference as computed by PMU-B (VφPMU-A-VφPMU-B) when subjected to TSSA. • As the TSSA is increased beyond 448.48 µs, the phase angle difference computed by PMU-B goes above 80 and the anti-islanding protection scheme initiates false tripping instantly. 0 200 400 600 800 1000 0 5 8 10 15 20 X: 450 Y: 8.028 GPS Spoofing (µs) PhaseAngleDifference(Degrees) Input to Anti-Islanding Algorithm when PMU-B is subjected to TSSA X: 300 Y: 5.327 X: 200 Y: 3.526 X: 50 Y: 0.826 X: 50 Y: 0.891 Phase Angle Difference (VφPMU-A-VφPMU-B) Phase Angle Threshold X: 448.48 Y: 8.000 Case-B: PMU-B subjected to TSSA Input to Anti-Islanding Algorithm Time Synchronization Error (µs) Active Power Mismatch (ΔP) Trip Time for DG Disconnection (s) Active Power Mismatch (%) Trip Time (s) 0 0.5 1 1.5 2 0% 5% 10% 20% No spoofing 100 µs 200 µs 300 µs 400 µs -50 -25 0 25 50 0 0.5 1 1.5 2 No TSSA 400 µs a b Trip Time (s) • The operation time also reduces with an increase in active power mismatch between generator G1 and Load-A for all cases i.e. with and without TSSA.
- 31. Results Oscillation Damping Control Application 31 G1 G2 Area 1 900 MVA 900 MVA 900 MVA 20 kV / 230 kV 25 Km 10 Km 900 MVA 20 kV / 230 kV Local Loads 967 MW 100 MVAR (Inductive) -387 MVAR (Capacitive) 220 Km Parallel Transmission Lines Power Transfer Area 1 to Area 2 10 Km 25 Km G3 900 MVA 900 MVA 20 kV / 230 kV G4 900 MVA 20 kV / 230 kV 900 MVA Local Loads 1767 MW 100 MVAR (Inductive) -537 MVAR (Capacitive) Area 2 Bus1 Bus2 SVC Isvc Vmeasure Vref ΔVPODVerror Synchrophasors from PMU-A POD S3 DK Unwraps PDC stream and provides raw measurements to NI-cRIO POD C37.118.2 V+ PMU-1 , I+ PMU-1 PPMU-1 , QPMU-1 V+ PMU-2 , I+ PMU-2 PPMU-2 , QPMU-2 Executed in real-time using 4-cores of Opal-RT’s eMEGAsim Real-Time Simulator Wide-Area POD deployed on NI-cRIO 9081 (1.06 GHz, 16 GB) One analog output module NI-9264 (25 kS/s per channel) to feed back damping signal to simulator Synchrophasors from PMU-B SEL-PDC 5073 C37.118.2 C37.118.2 PMU-A (Reference) PMU-B (Spoofed) WAPOD is realized by deploying phasor-based oscillation damping algorithm in a National Instrument’s Compact Reconfigurable I/O controller (NI-cRIO). This WAPOD performs following functions: • Receives local and/or remote synchrophasors as inputs, • Separates the controller input signal into average and oscillatory content • Oscillatory content of the signal is phase shifted to create the damping signal. • This damping signal is provided as a supplementary control signal to the Static VAR Compensator (SVC) executing in real-time in the RTS to provide damping
- 32. Results Oscillation Damping Control Application 32 Signal Loss • With the WAPOD disabled, the 0.64 Hz inter-area oscillation is undamped. • With reliable GPS signals to both PMUs, the oscillations are adequately damped. • WAPOD’s performance degrades as the GPS disconnection time for PMU-2 increases 55 60 65 70 3 3.5 4 4.5 5 5.5 x 10 8 Time (s)ActivePowerTransfer(MW) WAPOD: Voltage Phase Angle Difference as an Input No Spoofing PMU-B Spoofing: 1000 µs PMU-B Spoofing: 1500 µs PMU-B Spoofing: 2000 µs PMU-B Spoofing: 3000 µs55 60 65 70 3 3.5 4 4.5 5 5.5 x 10 8 Time (s) ActivePowerTransfer(MW) WAPOD: Voltage Phase Angle Difference as an Input No Spoofing PMU-B Spoofing: 1000 µs PMU-B Spoofing: 1500 µs PMU-B Spoofing: 2000 µs PMU-B Spoofing: 3000 µs Spoofing Attack • As the time synchronization error in PMU-B increases, its error in phase angle computation escalates. • As the TSSA increases beyond 1500 µs, the WAPOD introduces a negative damping.
- 33. Do all PMUs behave similarly? 33 Synchrophasors Identical 3-phase V & I Signals to all PMUs 1 SEL-PDC 5073 PDC Stream PMU-B (SEL) PMU-A (Reference) PMU-C (Arbiter) PMU-D (ABB) PMU-E (Sub.net) 3-Phase voltage and current signals generation RTS Substation Clock Time Sync Hardwired Legend PMU Stream PDC Stream Workstation PMUs under TestGPS Antenna 2 3 4 Analyzing archived PDC data IRIG-B GPS Signals for other PMUs GPS Splitter 0 00:06:00 00:15:00 00:30:00 -0.5 0 0.5 1 1.5 2 AngleDifference (Degrees) Phase Angle Computation Error due to Loss of GPS PMU-B PMU-C PMU-D PMU-E 00:06:12 00:12:35 00:20:56 00:30:33 Phase Angle Computation Error due to Loss of Time Synchronization Signal AngleDifference(Degrees) Time (HH:MM:SS) 01:00:00 02:00:00 03:00:00 04:00:00 0 50 100 150 200 250 300 350 Time (HH:MM:SS) AngleDifference(Degrees) Phae Angle Computation Error due to Loss of GPS SEL Arbiter ABB Sub.net 390 175.2 34.52 10.45 PMU-B PMU-C PMU-D PMU-E Phase Angle Computation Error due to Loss of Time Synchronization Signal AngleDifference(Degrees) Time (HH:MM:SS) • At t = 00:05:40, the time synchronization input signal to PMUs (B-E) was disconnected. • All PMUs exceed 1 % TVE (0.5730 or 31.8 µs) within 24 minutes of the loss of time- sync. • For 4-hour analysis, maximum phase angle error of 3900 (21.64 ms) corresponding to PMU-D and a minimum phase angle difference of 10.450 (0.58 ms) corresponding to PMU-E is observed.
- 34. Internal Clocks 34 60 65 70 75 80 85 -90 -85 -80 PhaeAngle (Degrees) Impact of TSSA on PMU's Internal Oscillator 60 65 70 75 80 85 0 5 10 X: 65.82 Y: 2.914e-016 PhaseAngleDifference (Degrees) Phase Angle Computation Error Time (s) X: 79.4 Y: 0.8922 PMU-A : Reference PMU-B: TSSA 8.0230 0 5 10 15 0 0.5 1 Time (s) PhaseAngleDifference (Degrees) Modified TSSA : Jamming Followed by Spoofing 1.0630 1.0530 0.9980 Jamming = 3 s Jamming = 5 s Jamming = 14 s • If TSSA is launched instantly, the internal oscillator takes around 10 s to re-synchronize to the spoofed signal and during this period, the phase angle computation error goes beyond 80. • Such a TSSA is relatively easy to identify as the compromised PMU shows large phase angle deviations for a few seconds. Sophisticated TSSA can be launched by • Firstly jamming the authentic GPS signals for a small duration • And then feeding the spoofed signals to the PMU. In this case, the internal oscillator of the PMU undergoes a smooth transition to the spoofed signal and does not result in large phase angle deviations.
- 35. Impact of Time Synchronization Loss and Spoofing Synchrophasor Applications 35 Application Effect Significance Phase Angle Monitoring Misleading information resulting in false control actions either manually or automatic Major Anti-Islanding Protection False activation of protection scheme leading to system separation Threshold dependent Oscillation Damping Control Controller’s performance degradation that may result in incorporating negative damping into the system leading to loss of synchronism Controller and System dependent
- 36. Loss / Spoofing of time-synchronization signal results in corrupted power system monitoring results, delayed / faulty protection activation, and degradation of WAPOD controller. When the GPS signal is lost, the PMUs rely on their local oscillator to compute synchrophasors. • Each PMU has a different internal oscillator and therefore results in different phase angle computation error when its external time synchronization signal is lost. When subjected to a TSSA instantly, the internal oscillator of the PMUs needs to resynchronize to the spoofed time synchronization signal which requires additional time. • During this period, the PMUs report a large phase angle computation error, which can result in mal-operation of the associated monitoring, protection and control applications Conclusions (1/2) 36
- 37. To provide a quantitative metric for the TSSA’s tolerance level of each application, the aspects to consider include, but are not limited to: • Threshold settings, for example the phase angle difference value above which the application would initiate a trip / control action. – These thresholds are system dependent and are unique for each application. • For the specific case of oscillation damping, the change in system topology results in a shift in the mode’s frequency and damping, thus resulting in different damping requirements for the controller. – Changes in time requires adaptive time-delay compensation, not typically available in today’s controls. • The maximum tolerance for each application can be calculated using the demonstrated RT-HIL setup and the proposed TSSA methodology. – These tolerance levels are system and application dependent and therefore will be different for each case. Conclusions (2/2) 37
- 38. • The current PMUs lack the functionalities to identify between authentic and spoofed time synchronization signals. • Some of the recent recommendations put forward by North American SynchroPhasor Initiative (NASPI) and National Institute of Standard and Technology (NIST) to address TSSA are; o Supplying PMUs with two time synchronization sources (GPS and GALILEO). o Relying on GPS-independent networks such as telecom infrastructure to avoid dependence on very low power GPS signals from satellites. o Jamming, spoofing and interference detection and correction at the receiver (Substation clock / PMU). o Appropriate internal holdover oscillator for PMUs as back-ups for providing accurate time signals in case of absence of external time synchronization signals. Recommendations 38
- 39. • M. S. Almas, and L. Vanfretti, “Impact of Time-Synchronization Signal Loss on PMU-based WAMPAC Applications”, IEEE PES GM 2016, July 17-21, Boston, Massachusetts, USA. Awarded one of the Best Conference Papers on Power System Stability and Protection • M. S. Almas, L. Vanfretti, R. S. Singh, and G. M. Jonsdottir, "Vulnerability of Synchrophasor-based WAMPAC Applications’ to Time Synchronization Spoofing," in IEEE Transactions on Smart Grid , vol.PP, no.99, pp.1-1 doi: 10.1109/TSG.2017.2665461 • M. S. Almas and L. Vanfretti, “RT-HIL Implementation of Hybrid Synchrophasor and GOOSE-based Passive Islanding Schemes”, IEEE Transactions on Power Delivery, Vol. 31, No. 3, pp. 1299-1309, DOI: 10.1109/TPWRD.2015.2473669 • M.S. Almas, M. Baudette, L. Vanfretti, S. Løvlund and J.O. Gjerde, “Synchrophasor Network, Laboratory and Software Applications Developed in the STRONg2rid Project”, IEEE PES GM 2014, Washington DC, USA Main Publications Related to this Talk! 39
- 40. Thanks! Questions? https://www.kth.se/profile/luigiv Dinosaurs died. What came next was smaller. [D. Ernst]