Generic Object Oriented Substation Event Research Articles

Development of 3-phase fault detection, protection, and automation application with the present of DG in AC power system using GOOSE protocol

In this research work, a protection and automation solution is developed, encompassing SEL751 and SEL751A protection relays that communicate through the IEC-61850 Generic Object-Oriented Substation Event (GOOSE) protocol to deliver high-speed detection and clearance of a 3-phase (3P) fault. The study case is a standard IEEE 13-bus grid including the main system generator (G1), power lines, loads, distributed generation (DG), bus bars, and feeders, equipped with protection relays for detecting over-current faults based on time and current. Two protection relays, B1 in the main system and B2 on the DG side, are integrated with a GOOSE protocol communication system. These settings are configured in such a way that, in the event of the main system breaker being disconnected, the DG cannot be connected to the network, making it a suitable setting for anti-islanding mode (AIM). The efficiency of the relay settings is tested by subjecting the power grid to a 3P fault, by the selected Time-Overcurrent (TOC) U3 inverse curve. Throughout the paper, the descriptions of the study, the grid, assumptions, settings calculations, and analysis of results are systematically presented. For the verification of relay settings, the performance of relays is practically tested and accurately analyzed in detail. The results obtained indicate that the presented strategy is quite effective for the configuration, setting operation, and coordination of relays for fast detection and communication through the GOOSE protocol.

Fast and Reliable Sending of Generic Object Oriented Substation Event Frames between Remote Locations over Loss-Prone Networks.

WAMPAC (Wide Area Monitoring Protection and Control) applications are becoming crucial for granting a stable operation of the electricity transmission grid. These systems use a set of sensors distributed between different electrical substations to gather real-time measurements from the field. These sensors are called Phasor Measurement Units (PMUs). Using the gathered data, different monitoring, protection, and control algorithms are run in a Phasor Data Concentrator (PDC) located in a central location. These algorithms close the loop via the generation of remedial commands, which are sent back to the field level with stringent delay, security, and reliability requirements. GOOSE (Generic Object Oriented Substation Events) protocol, defined by IEC 61850 (IEC stands for International Electrotechnical Commission), is used for that aim and also considers the option of sending these commands over IP networks (this option is called Routed-GOOSE). The present article proposes two alternatives for the tunneling of GOOSE frames over IP. Both options allow the decoupling of the transmission and the security aspects, thus increasing flexibility and allowing for easier deployment. The first option, called VX-GOOSE, is a combination of standard protocols, allowing the sending of these frames over UDP/IP tunnels. The tests that have been carried out demonstrate that, under certain network conditions, the transmission of GOOSE frames over UDP may fail, and in some extreme cases, even a whole burst of GOOSEs could be lost. This may have very bad consequences for a distributed electrical system. It should be noted that this limitation affects both VX-GOOSE and Routed-GOOSE. To overcome these limitations, the second option, called Simplemux blast mode, includes a novel mechanism that provides delivery guarantees and a reduced delay, with the counterpart of a certain degree of redundancy. As shown in the experiments, the incurred delays can be significantly reduced when remote locations are connected via unreliable networks, whereas the bandwidth increase caused by redundancy can be kept at reasonable levels. Finally, it should be remarked that although GOOSE is a relevant example use case, this approach can be applied in other fields where flows require very low delay and delivery guarantees.

Centralized Protection of Networked Microgrids with Multi-Technology DERs

The structure and connections in networked microgrids consisting of two or more interconnected microgrids is influenced by the dynamic behaviors of power markets, the demand and supply interactions between market participants, and the possibility of operating in the grid-connected or islanded modes. Protection zones in the above-mentioned scenarios are dynamic and should not be determined a priori. Also, fault currents will vary depending on the operating modes, online or offline status of Distributed Energy Resources (DERs), variation of solar irradiation or wind speed, etc. This paper proposes a Centralized Intelligent Station-Level Protection (CISP) approach for the protection of various electric power equipment technologies in networked (interconnected) microgrids using adaptive protective relaying algorithms and a network theory-based zone selection algorithm. The proposed CISP approach utilizes wide area IEC 61869-9 Sampled Values (SVs) measurements and IEC 61850 Generic Object-Oriented Substation Events (GOOSE) messages, intelligently determines the protection zones, and automatically selects the protection algorithms to use in each of the protection zones based on the prevailing system topology and operating conditions. The effectiveness of the proposed CISP approach is demonstrated through real-time simulations using the RTDS®. The results obtained were promising for the various system configurations, operating conditions, and fault conditions considered.

Practical Implementation of Multithreaded Communication Protocols in Modern Protection Relays

Microprocessor-based protection relays that provide reliable and fast responses to abnormal conditions are of paramount importance to electrical grids. Modern numerical relays constitute communication protocols to facilitate data exchange among protection devices. Though it has become an integral part of electrical substation devices, there has not been any significant article that puts forth a detailed description of the preemptive multithreading implementation of multiple communication protocols for protection relays. Hence, this article is aimed at designing a preemptive multithreading system comprising IEC 61850 Manufacturing Message Specification (MMS), Generic Object-Oriented Substation Event (GOOSE), and Sampled Values (SV) along with Modbus TCP/IP and IEC 60870-5-104 communication protocols for protection relays. Latest products from prominent manufacturers of protection relays adopt preemptive multithreading on a real-time Linux operating system. In this work, the designed multi-protocol communication system is implemented on a real-time embedded Linux-based cortex-A7 core of the STM32MP157D-DK1 device. The designed system is verified by conducting an interoperability test with ABB REF615 and Thytronic NA11 protection relays.

A novel hybrid cybersecurity scheme against false data injection attacks in automated power systems

The conventional power systems are evolving as smart grids. In recent times cyberattacks on smart grids have been increasing. Among different attacks, False Data Injection (FDI) is considered as an emerging threat that has significant impact. By exploiting the vulnerabilities of IEC 61850 Generic Object-Oriented Substation Events (GOOSE) and Sampled Values (SV) attackers can launch different FDI attacks. In this paper, a real-time set up capable of simulating FDI on GOOSE and SV protocols is developed to evaluate the impact of such attacks on power grid. IEC 62351 stipulates cybersecurity guidelines for GOOSE and SV, but only at communication or Information Technology (IT) level. Hence there is a need to develop a holistic security both at IT and Operation Technology (OT) level. In this regard, a novel sequence content resolver-based hybrid security scheme suitable to tackle FDI attacks on GOOSE and SV is proposed. Furthermore, the computational performance of the proposed hybrid security scheme is presented to demonstrate its applicability to the time critical GOOSE and SV protocols.

A New Digital Twins-Based Overcurrent Protection Scheme for Distributed Energy Resources Integrated Distribution Networks

This paper presents a novel overcurrent protection scheme based on digital twins for a distribution network with distributed energy resources. A coordination protection standard is employed to perform settings and coordinate intelligent electronic devices, evaluating the effects of distributed energy resources. In addition, some integration criteria for distributed energy resources are proposed to identify the impact on overcurrent protections. The power hardware-in-the-loop (PHIL) scheme is designed to develop digital twins (DT) that connect the real relays to the simulated network. Moreover, a standard for substation automation is employed to define the communication protocol for reading Generic Object-Oriented Substation Events (GOOSE) messages. Furthermore, the IEEE 13-node test feeder is employed to validate the method and model in the real-time simulation software. The results show a miscoordination of the overcurrent protection scheme installed in the distribution network with the action of different distributed energy resources.

A non-PMU-based WAN protection scheme for swing detection and stability enhancement in power systems

This paper presents a scheme for power swing detection and stability assessment for multi-machine power systems in addition to a brief survey on that topic. The scheme adopts smart grid perception. It is an asynchronous scheme that uses the rate of change of the angle of the generator bus voltage instead of synchronously estimating the absolute rotor angle value for stability assessment. Therefore, it does not require phasor measurement units (PMUs). Instead, it uses commercially available intelligent electronic devices (IEDs). It introduces a new application of the multicast Generic Object Oriented Substation Event (GOOSE) protocol or its routable version (R-GOOSE) to reflect the disturbance in the power grid on the transmission pattern of data packets over the grid data network. In this scheme, the angle change information is transmitted in the form of GOOSE packets simultaneously from the IEDs that readily measure the angles of the affected generators. On the other hand, the detecting device identifies the stability status of each affected generator. The proposed scheme is validated by simulating disturbances on the IEEE 39-bus system. The results show that the scheme can discriminate between stable and unstable swings. In addition, the loss of synchronism of the unstable generator is predicted ahead of its occurrence by enough time to take an appropriate action.

A novel hybrid methodology to secure GOOSE messages against cyberattacks in smart grids

IEC 61850 is emerging as a popular communication standard for smart grids. Standardized communication in smart grids has an unwanted consequence of higher vulnerability to cyber-attacks. Attackers exploit the standardized semantics of the communication protocols to launch different types of attacks such as false data injection (FDI) attacks. Hence, there is a need to develop a cybersecurity testbed and novel mitigation strategies to study the impact of attacks and mitigate them. This paper presents a testbed and methodology to simulate FDI attacks on IEC 61850 standard compliant Generic Object-Oriented Substation Events (GOOSE) protocol using real time digital simulator (RTDS) together with open-source tools such as Snort and Wireshark. Furthermore, a novel hybrid cybersecurity solution by the name of sequence content resolver is proposed to counter such attacks on the GOOSE protocol in smart grids. Utilizing the developed testbed FDI attacks in the form of replay and masquerade attacks on are launched and the impact of attacks on electrical side is studied. Finally, the proposed hybrid cybersecurity solution is implemented with the developed testbed and its effectiveness is demonstrated.

An Effective Security Scheme for Attacks on Sample Value Messages in IEC 61850 Automated Substations

The trend of transforming substations into smart automated facilities has led to their swift digitalization and automation. To facilitate data exchange among equipment within these substations, the IEC 61850 standard has become the predominant standard. However, this standardization has inadvertently made these substations more susceptible to cyberattacks, which is a significant concern given the confidential information that is transmitted. As a result, cybersecurity in substations is becoming an increasingly critical topic. IEC 62351 standard provides guidelines and considerations for securing the IEC 61850 messages to mitigate their vulnerabilities. While securing Generic Object-Oriented Substation Event (GOOSE) messages has received considerable attention in literature, the same level of scrutiny has not been applied to Sampled Value (SV) messages despite their susceptibility to cyberattacks and similar frame format. This paper presents the impact of replay and masquerade attacks on SV messages. It also develops a scheme for securing SV messages against these attacks. Due to high sampling rate and time critical nature of SV messages, the time complexity of security scheme is critical for its applicability to SV messages. Hence, in this work, SV emulators have been developed in order to send these modified secure SV messages and investigate their timing performance. The results show that the proposed scheme can mitigate replay and masquerade attacks on SV messages while providing the necessary high sampling rate and stringent timing requirements.

International Electrotechnical Commission 61850 Routable Generic Object-Oriented Substation Event Messages: A Secure Data-Centric Communication Approach

The necessity of critical communication between intelligent electronic devices (IEDs) in different substations led to expanding the Generic Object-Oriented Substation Event protocol (GOOSE) from the local area network (LAN) to the wide area network (WAN). International Electrotechnical Commission (IEC) 61850-90-5 has extended GOOSE messages as routable GOOSE (R-GOOSE) messages by adding network and transport layers. Therefore, the communication’s end-to-end latency and reliability against cyberattacks should be addressed.

Automated Cybersecurity Tester for IEC61850-Based Digital Substations

Power substations are the crucial nodes of an interconnected grid, serving as the points where power is transferred from the transmission/distribution grids to the loads. However, interconnected cyberphysical systems and communication-based operations at substations lead to many cybersecurity vulnerabilities. Therefore, more sophisticated cybersecurity vulnerability analyses and threat modeling are required during productization phases, and system hardening is mandatory for the commercialization of products. This paper shows the design and methods to test the cybersecurity of multicast messages for digital substations. The proposed vulnerability assessment methods are based on the semantics of IEC61850 Generic Object Oriented Substation Event (GOOSE) and Sampled Value (SV), and cybersecurity features from IEC62351-6. Different case scenarios for cyberattacks are considered to check the vulnerabilities of the device under test (DUT) based on the IEC62351-6 standard. In order to discover security vulnerabilities in a digital substation, the proposed cybersecurity tester will generate malicious packets that compromise the regular functionality. The results show that the proposed cybersecurity testing module is able to detect potential vulnerabilities in multicast messages and the authentication methods (e.g., message authentication code) of multicast communications. Both commercial and simulated devices are used for the case studies.

Fault Diagnosis Method of Intelligent Substation Protection System Based on Gradient Boosting Decision Tree

In order to improve the efficiency of the devices’ fault diagnosis of the protection systems of intelligent substation, a fault diagnosis method based on a gradient boosting decision tree (GBDT) was proposed. Using the integrated alarm information, the device self-checking information, the link information of generic object-oriented substation event (GOOSE) and sampled value (SV) and the sampling value information generated during the fault of the protection system, the fault feature information set is constructed. According to different fault characteristics, the protection system faults are classified into simple faults and complex faults to improve the diagnosis efficiency. Using GBDT training rules, a fault diagnosis model of protection system based on GBDT is established and fault diagnosis steps are given. This study takes a 110 kV intelligent substation in southern China as an example, to verify the effectiveness and accuracy of the proposed fault diagnosis method, and compared it with the existing methods in terms of the accuracy. The diagnostic accuracy in the case of false alarms and the case of multiple faults are verified. The results show that the method can meet the practical engineering application.

Towards a standardisation for digital inputs and outputs of protection functions in IEC 60255 series

Fully digitalized substations using IEC 61850 process bus are being introduced all over the world. Numerous utilities have featured pilot projects, demonstrators or even industrial scale deployment of these Fully Digital Protection, Automation and Control Systems (FD-PACS). Product standards such as profiles for Instrument Transformers have been developed and published (IEC 61869-6 and IEC 61869-9 by TC 38—Instrument Transformers). This raises the question about the standards for digitally interfaced protection functions. In 2016, IEC TC 95 (Measuring relays and protection equipment) charged a working group to investigate this subject and to elaborate recommendations concerning requirements and testing of protection IED with digital inputs and outputs for protection standards (IEC 60255-1xx series). For protection functions, publisher/subscriber based data streams are supposed to comply with IEC 61850 and IEC 61869 standards. This holds in particular for Sampled Values (SV) representing energising inputs of the protection function, and is also applicable to Generic Object Oriented Substation Event (GOOSE) which can be used for input or output of protection functions. Quality attributes of published data depend on the operational and connection status of the function and the hosting IED. In addition, protection functions have to take into account the information regarding the time synchronisation of the received SV and other parameters. This paper gives an overview of these features and the proposed way to take them into account in the IEC 60255 standard series. It describes the progress of WG 2 and relates it to existing standardization documents.

Network Architecture for IEC61850-90-5 Communication: Case Study of Evaluating R-GOOSE over 5G for Communication-Based Protection

The smart grid includes wide-area applications in which inter-substation communication is required to realize innovative monitoring, protection, and control solutions. Internet-based data exchange, i.e., communication over Internet Protocol (IP), is regarded as the latest trend for inter-substation communication. Interoperability can be achieved via the use of standardized IEC 61850-90-5 messages communicating over IP. Wide-area applications can obtain benefits from IP-multicast technologies and use a one-to-many communication model among substations communicating across a communication network. Cellular Internet is being considered as a potential cost-efficient solution which can be used for the IP-multicast communication. However, it requires knowledge of communicating uncommon IP-multicast traffic over the Internet. Moreover, it presents challenges in terms of cybersecurity and real-time requirements. These challenges must be overcome to realize authentic and correct operation of the wide-area applications. There is thus a need to examine communication security and to evaluate if the communication network characteristics satisfy the application real-time requirement. This paper investigates the secure communication of IEC61850-90-5 multicast messages over the public communication network and proposes two network architectures using the Generic Routing Encapsulation (GRE) tunnel and multipoint GRE (mGRE) within Dynamic Multipoint VPN (DMVPN). Additionally, this paper evaluates the feasibility of cellular (5G and 4G) Internet for the communication of multicast Routable Generic Object Oriented Substation Events (R-GOOSE) messages in wide-area protection applications. For this purpose, we introduce a lab setup to experiment the transmission of R-GOOSE messages within the proposed network architectures. The lab setup contains both software and hardware components. A software application is developed to publish multicast R-GOOSE with a fresh timestamp acquired from time synchronization equipment. These messages are transmitted over the Internet by computer networking devices that support cellular communication. The communication latency of the transmitted messages is measured and analyzed statistically. The statistical analysis results are discussed to evaluate performance of R-GOOSE over cellular Internet for two communication-based protection applications: Logic Selectivity and Loss-of-Main protection schemes.

Hardware Development and Interoperability Testing of a Multivendor-IEC-61850-Based Digital Substation

Substations are becoming increasingly reliant on international electrotechnical commission (IEC)-61850-enabled devices. However, device compatibility with these standards does not guarantee interoperability when devices are taken from different manufacturers. If interoperability of multivendor devices can be achieved, then power utilities will be in a position to implement multivendor devices in substations. The study here presents the development and testing of a digital substation test platform that incorporates devices from different manufacturers. The process bus communication and protection operation of the intelligent electronic devices (IEDs) were tested to validate device interoperability. The testbed was tested for two IED process bus communications, generic object-oriented substation event (GOOSE) and sampled measured value (SMV). The GOOSE is travelling between IED to IED with an end-to-end (ETE) delay of 2 ms and the SMV read by the IEDs are the same as the injected real-time substation inputs 220 kV and 1 kA. Three IED protection studies (overcurrent, earth fault, and overvoltage) were performed, and IED response curves were obtained. In addition, data monitoring and client–server communications were studied using installed software tools. The testbed configuration in this study has faced some real-time challenges regarding differences in device edition, device firmware, and ethernet switch due to its multivendor approach. All the mentioned configuration issues were resolved in this study with successful testing and validation of the testbed. The study of this testbed will provide solutions to the problems associated with a multivendor system faced by substation engineers and will help them in opting for multivendor installations. This system can be extended in the future by installing more multivendor devices with complex network topology and a SCADA system.

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

Design of Hardware Setup Based on IEC 61850 Communication Protocol for Detection & Blocking of Harmonics in Power Transformer

In this paper, the authors have developed a hardware model for blocking even and odd harmonics of a power transformer. In the proposed hardware model, intelligent differential & over-current relays are used for the blocking of harmonics of a power transformer. The harmonic restraint function on the differential relay (7UT61) prevents the relay from tripping during transformer magnetizing inrush current. However, the over-current relays which are used for back up protection does not have a harmonic restraint element, and over-current relay trips due to magnetizing inrush current, causes unwanted interruptions and power failures. The establishment of harmonic blocking scheme for over-current protection in power transformers is an important finding of this research study. IEC61850 standard-Based GOOSE (Generic Object Oriented Substation Event) applications used in power transformer protection for fast detecting and clearing of faults is an interested study presented in the proposed work.

Denial-of-Service Attack on IEC 61850-Based Substation Automation System: A Crucial Cyber Threat towards Smart Substation Pathways.

The generation of the mix-based expansion of modern power grids has urged the utilization of digital infrastructures. The introduction of Substation Automation Systems (SAS), advanced networks and communication technologies have drastically increased the complexity of the power system, which could prone the entire power network to hackers. The exploitation of the cyber security vulnerabilities by an attacker may result in devastating consequences and can leave millions of people in severe power outage. To resolve this issue, this paper presents a network model developed in OPNET that has been subjected to various Denial of Service (DoS) attacks to demonstrate cyber security aspect of an international electrotechnical commission (IEC) 61850 based digital substations. The attack scenarios have exhibited significant increases in the system delay and the prevention of messages, i.e., Generic Object-Oriented Substation Events (GOOSE) and Sampled Measured Values (SMV), from being transmitted within an acceptable time frame. In addition to that, it may cause malfunction of the devices such as unresponsiveness of Intelligent Electronic Devices (IEDs), which could eventually lead to catastrophic scenarios, especially under different fault conditions. The simulation results of this work focus on the DoS attack made on SAS. A detailed set of rigorous case studies have been conducted to demonstrate the effects of these attacks.

Rainbow Signature Scheme to Secure GOOSE Communications From Quantum Computer Attacks

The International Electrotechnical Commission (IEC) 62351-6 standard prescribes provisions to secure IEC 61850-8-1 generic object-oriented substation events (GOOSE) communications from cyber threats. The GOOSE authentication schemes recommended by IEC 62351-6 have shortcomings, such as long authentication-value computation times, large signature lengths, the usage of symmetric keys, and susceptibility to quantum computer attacks. To overcome these, this paper proposes the usage of the rainbow signature scheme (RSS), a quantum cryptographic method to secure GOOSE messages. The RSS offers fast signature generation and verification using asymmetric keys, making it very attractive to meet the time-latency and security requirements of the GOOSE protocol. The adaptation of the RSS cryptography method for its application to the GOOSE protocol is presented in this paper. The algorithms for key generation, signature computation and message verification are discussed in detail. A first-of-its-kind C library that incorporates security features within the GOOSE protocol in compliance with the IEC 62351-6-stipulated format, is developed. The superior features of the RSS in comparison with the other IEC 62351-6 security schemes are demonstrated.

On the Assessment of Cyber Risks and Attack Surfaces in a Real-Time Co-Simulation Cybersecurity Testbed for Inverter-Based Microgrids

The integration of variable distributed generations (DGs) and loads in microgrids (MGs) has made the reliance on communication systems inevitable for information exchange in both control and protection architectures to enhance the overall system reliability, resiliency and sustainability. This communication backbone in turn also exposes MGs to potential malicious cyber attacks. To study these vulnerabilities and impacts of various cyber attacks, testbeds play a crucial role in managing their complexity. This research work presents a detailed study of the development of a real-time co-simulation testbed for inverter-based MGs. It consists of a OP5700 real-time simulator, which is used to emulate both the physical and cyber layer of an AC MG in real time through HYPERSIM software; and SEL-3530 Real-Time Automation Controller (RTAC) hardware configured with ACSELERATOR RTAC SEL-5033 software. A human–machine interface (HMI) is used for local/remote monitoring and control. The creation and management of HMI is carried out in ACSELERATOR Diagram Builder SEL-5035 software. Furthermore, communication protocols such as Modbus, sampled measured values (SMVs), generic object-oriented substation event (GOOSE) and distributed network protocol 3 (DNP3) on an Ethernet-based interface were established, which map the interaction among the corresponding nodes of cyber-physical layers and also synchronizes data transmission between the systems. The testbed not only provides a real-time co-simulation environment for the validation of the control and protection algorithms but also extends to the verification of various detection and mitigation algorithms. Moreover, an attack scenario is also presented to demonstrate the ability of the testbed. Finally, challenges and future research directions are recognized and discussed.