Critical Infrastructure Operators Research Articles

Critical Infrastructure in Poland during the COVID-19 Pandemic

Purpose: The paper presents the results of the review of literature and of the legal regulations in the field of the protection of critical infrastructure in Poland during the COVID-19 pandemic. The assumed main goal was to determine the requirements for protecting elements catalogued in 11 critical infrastructure systems, in the face of the risk of losing key personnel and the need to maintain continuity of critical infrastructure operations. Introduction: The first part of the paper discusses the essence and methods of identifying critical infrastructure in Poland. Further on, possible clauses were identified of an epidemic and its impact on individual critical infrastructure systems, with particular focus on the fact that if an epidemic occurs, there may be a temporary or long-term shortage of personnel essential to the business continuity of the facilities, installations and elements included in critical infrastructure. Then, the legal solutions for maintaining the operating continuity of critical infrastructure during COVID-19 implemented in 2020 were presented, pointing to legal tools aimed at ensuring the resilience of critical infrastructure by securing key resource, i.e. the employees. Methodology: Literature research and qualitative analysis were carried out of the legal acts announced in 2020 related to enhancing the resilience of critical infrastructure, and a review was carried out of the recommendations and guidelines addressed to critical infrastructure operators, which were issued in March and September of 2020. The obtained results were analysed using the following: publications, acts of the Polish law, recommendations and guidelines published on the websites of governmental institutions, interviews with independent experts. Conclusions: The first regulations on specific arrangements meant to prevent, counteract and combat COVID-19, other contagious diseases and crisis situations caused by them did not contain any provisions that would be supportive of the protective capacity of the critical infrastructure elements in Poland. The first document in this respect, RCB guidelines of 16 March 2020 have not been formalised yet in the legal system. The so-called Shield 2.0 of 31 March 2021 introduced to the 15x of the COVID-19 Act the tools for specific employers entitled to take advantage of new, previously unavailable opportunities to ensure the continuity of services. Those entitlements made it possible to change the work system or work schedule of employees, to instruct them to work overtime, as well as to refuse to grant annual leave or to cancel it. Keywords: critical infrastructure, pandemic, COVID-19, law, key personel Type of article: case study

Current Issues in European Cybersecurity The NIS Directive, Due Diligence And International Law

The 2016 EU Directive on security of network and information systems (NIS Directive) is arguably the most significant attempt at increasing cybersecurity and network resiliency in Europe. It includes Internet based services and their operators into the well established category of critical infrastructure (CI). This implies an increased reliance on business participation. Numerous categories of Internet based services will need to raise the level of security they provide for their infrastructure and software. They will also be required to share information on threats and best practices in preventing and combating cyberthreats with their peers and states agencies. The NIS Directive makes therefore cybersecurity one more area of international law and policy that relies on a good-business practice based standard of due diligence, required from critical infrastructures operators. This has thus far been the case for e.g. power plant operators, water suppliers or banking services. This paper seeks to put this latest development of cybersecurity in the context of contemporary international law, drawing analogies with the law of state responsibility and international liability, as developed by international environmental law, law of treaties or diplomatic relations.

ЗАБЕЗПЕЧЕННЯ СТАЛОГО РОЗВИТКУ СОЦІАЛЬНО-ЕКОНОМІЧНОГО ПОТЕНЦІАЛУ ОБЛАСТІ ШЛЯХОМ ПІДВИЩЕННЯ КОНКУРЕНТОСПРОМОЖНОСТІ ЕКОНОМІКИ РЕГІОНУ

The article examines the state of ensuring the sustainable development of the social and economic potential of the Vinnytsia region by increasing the competitiveness of the region's economy. It was noted that the spread of COVID-19 had a negative impact on the functioning of the economy: transport, tourism, the service sector, retail trade in non-food products, which were the most affected by leading the quarantine measures and spreading the virus. It has been clarified that the spread of pandemic has changed the agenda of activities of public administration bodies in the Vinnytsia region. It was ensured continuous operation of critical infrastructure and food security facilities, crisis communication with the population regarding compliance with quarantine measures and overcoming COVID-19 pandemic. It was established that under the conditions of martial law, the situation with the provision of critical infrastructure has become even more acute, which should be taken into account when planning measures to implement the Strategy of Balanced Regional Development of the Vinnytsia Region for the period until 2027. It is specified that sustainable development is such development that meets the needs of society in our time, but does not endanger the ability of future generations to meet their own potential needs. It was determined that a significant role in the structure of the real sector of economy is played by the industry of the Vinnytsia region, which during 2021 could not fully overcome the decline in economic activity associated with the COVID-19 pandemic. It has been analyzed that most researchers of impact of COVID-2019 point to the growth of poverty, bankruptcy of small and medium businesses, and decline of the economy. The crisis has forced the governments of some countries to review their internal food stocks and decide to ban the export of certain types of food products. At the same time, the pandemic stimulated development of information and communication sphere. Ensuring the conditions of sustainable economic development and increasing the competitiveness of the region's economy is proposed to be achieved through the development of the region's industrial complex; promotion of sustainable development of agricultural production; increase in the volume of exports of goods; positioning Vinnytsia as a region with a favorable business climate and strong investment potential.

ELEGANT: Security of Critical Infrastructures With Digital Twins

The past years have witnessed an increasing interest and concern regarding the development of security monitoring and management mechanisms for Critical Infrastructures, due to their vital role in ensuring the availability of many essential services. This task is not easy due to the specific characteristics of such systems, and the natural resistance of Critical Infrastructures operators against actions implying downtime. Digital Twins, as accurate virtual models of physical objects or processes, can provide a faithful environment for security analysis or evaluation of potential mitigation strategies to be deployed in face of specific situations. Nonetheless, their on-premises deployment can be expensive, implying a significant CAPEX whose return will depend on the ability to plan and deploy a suitable support infrastructure, as well as implementing efficient and scalable data collection and processing mechanisms capable of taking advantage of the acquired resources. This paper presents an off-premises approach to design and deploy Digital Twins to secure critical infrastructures, developed in the scope of the ELEGANT project. Such Digital Twins are built using real-time, high fidelity replicas of Programming Logic Controllers, coupled with scalable and efficient data collection processes, supporting the development and validation of Machine Learning models to mitigate security threats like Denial of Service attacks. The validation approach of ELEGANT, which leveraged from the capabilities of the Fed4Fire federated testbeds evaluated the feasibility of using cloudified Digital Twins, thus converting a significant part of the projected CAPEX for the in-premises model into on-demand, pay-as-you-go OPEX, eventually paving the way for the establishment of a DTaaS (Digital Twin as a Service) paradigm. The achieved results demonstrate that the data pipelines providing support for the ELEGANT Digital Twins have low impact in terms of resource usage in Denial of Service and Distributed Denial of Service attack scenarios, when higher volumes of data are generated.

Business Continuity for Critical Infrastructure Operators

Critical infrastructures often lack resilience and easily lose critical functionalities if hit by adverse events. Continuity management strategies for critical infrastructure operators and the networks that they form, rely also on the functionality of other interrelated networks. Disruptions in operations may affect society and for this reason, securing the operations of critical infrastructure operators is important. The technological impacts of CPS become evident to the resilience of all fields of critical infrastructure, but there is also human elements to take into account. The research question of this study is: How to enhance business continuity of critical infrastructure? This case study research uses qualitative methods collected by conducting interviews of resilience and continuity professionals who work with Finnish critical infrastructure. Resilience and continuity management are key for critical infrastructure operators. Important factors identified were identifying risks, critical activities, key personnel, creating guidelines and procedures, and open communication, which themes were recognised as important to improve resilience and manage continuity.

Beyond Physical Threats: Cyber-attacks on Critical Infrastructure as a Challenge of Changing Security Environment – Overview of Cyber-security legislation and implementation in SEE Countries

States, organizations and individuals are becoming targets of both individual and state-sponsored cyber-attacks, by those who recognize the impact of disrupting security systems and effect to people and governments. The energy sector is seen as one of the main targets of cyber-attacks against critical infrastructure, but transport, public sector services, telecommunications and critical (manufacturing) industries are also very vulnerable. One of most used example of cyber-attack is the Ukraine power grid attack in 2015 that left 230,000 people without power for up to 6 hours. Another most high profile example of a cyber-attack against critical infrastructure is the Stuxnet computer virus (first used on Iranian nuclear facility) which could be adapted to attack the SCADA systems (industrial control systems) used by many critical infrastructures in Europe.Wide range of critical infrastructure sectors are reliant on industrial control systems for monitoring processes and controlling physical devices (sensors, pumps, etc.) and for that reason, physical connected devices that support industrial processes are becoming more vulnerable. Not all critical infrastructure operators in all sectors are adequately prepared to manage protection (and raise resilience) effectively across both cyber and physical environments. Additionally there are few challenges in implementation of protection measures, such as lack of collaboration between private and public sector and low levels of awareness on existence of national key legislation.From supranational aspect, in relation to this papers topic, the European Union has took first step in defense to cyber threats in 2016 with „Directive on security of network and information systems“ (NIS Directive) by prescribing member states to adopt more rigid cyber-security standards. The aim of directive is to improve the deterrent and increase the EU’s defenses and reactions to cyber attacks by expanding the cyber security capacity, increasing collaboration at an EU level and introducing measures to prevent risk and handle cyber incidents. There are lot of other „supporting tools“ for Member States countries, such as European Union Agency for Network and Information Security – ENISA (which organize regular cyber security exercises at an EU level, including a large and comprehensive exercise every two years, raising preparedness of EU states); Network of National Coordination Centers and the European Cybersecurity Industrial, Technology and Research Competence Centre; and Coordinated response to major cyber security incidents and crises (Blueprint) with aim to ensure a rapid and coordinated response to large-scale cyber attacks by setting out suitable processes within the EU.Yet, not all Member States share the same capacities for achieving the highest level of cyber-security. They need to continuously work on enhancing the capability of defense against cyber threats as increased risk to state institutions information and communication systems but also the critical infrastructure objects. In Southeast Europe there are few additional challenges – some countries even don't have designated critical infrastructures (lower level of protection; lack of „clear vision“ of criticality) and critical infrastructures are only perceived through physical prism; non-EU countries are not obligated to follow requirements of European Union and its legislation, and there are interdependencies and transboundary cross-sector effects that needs to be taken in consideration. Critical infrastructure Protection (CIP) is the primary area of action, and for some of SEE countries (like the Republic of Croatia) the implementation of cyber security provisions just complements comprehensive activities which are focused on physical protection.This paper will analyze few segments of how SEE countries cope with new security challenges and on which level are they prepared for cyber-attacks and threats: 1. Which security mechanisms they use; 2. The existing legislation (Acts, Strategies, Plan of Action, etc.) related to cyber threats in correlation with strategic critical infrastructure protection documents. Analysis will have two perspectives: from EU member states and from non-EU member states point of view. Additionally, for EU member states it will be analyzed if there were any cyber security legislation before NIS directive that meets same aims. The aim of research is to have an overall picture of efforts in region regarding cyber-security as possibility for improvement thorough cooperation, organizational measures, etc. providing also some recommendations to reduce the gap in the level of cyber-security development with other regions of EU.

Resilience

Resilience

Vision-based automated crack detection using convolutional neural networks for condition assessment of infrastructure

With the growing number of aging infrastructure across the world, there is a high demand for a more effective inspection method to assess its conditions. Routine assessment of structural conditions is a necessity to ensure the safety and operation of critical infrastructure. However, the current practice to detect structural damages, such as cracks, depends on human visual observation methods, which are prone to efficiency, cost, and safety concerns. In this article, we present an automated detection method, which is based on convolutional neural network models and a non-overlapping window-based approach, to detect crack/non-crack conditions of concrete structures from images. To this end, we construct a data set of crack/non-crack concrete structures, comprising 32,704 training patches, 2074 validation patches, and 6032 test patches. We evaluate the performance of our approach using 15 state-of-the-art convolutional neural network models in terms of number of parameters required to train the models, area under the curve, and inference time. Our approach provides over 95% accuracy and over 87% precision in detecting the cracks for most of the convolutional neural network models. We also show that our approach outperforms existing models in literature in terms of accuracy and inference time. The best performance in terms of area under the curve was achieved by visual geometry group-16 model (area under the curve = 0.9805) and best inference time was provided by AlexNet (0.32 s per image in size of 256 × 256 × 3). Our evaluation shows that deeper convolutional neural network models have higher detection accuracies; however, they also require more parameters and have higher inference time. We believe that this study would act as a benchmark for real-time, automated crack detection for condition assessment of infrastructure.

Influence of coronavirus crisis on food industry economy

Recently, there has been a very rapid accumulation of empirical data of economic indicators of the food crisis associated with the coronavirus pandemic. The purpose of this article was to develop a set of measures aimed at minimizing the negative economic impact of the coronavirus crisis (CVC) both at the national and international levels. All these presupposed solving the following tasks. Having studied the nature of the crisis, we found out that it had the greatest impact on such components of food sector as transport, logistic chains, and human resources. We revealed that, first of all, such areas of the economy as fisheries and agricultural production of fruits and vegetables were affected by the crisis. It is obvious that it will also adversely affect small farmers, seasonal and migrant workers, etc. The work proposes the most effective public measures against the negative impact of CVC on the global economy. In particular, we examined the scenario of (possibly temporary) nationalization of operators of critical infrastructure to produce planned critical goods or services. The developed set of measures included limitation of the workers’ rights and freedoms by imposing to them labor duties, or replacing them with military ones, limiting the price of strategic goods, and organizing their consumption and distribution. Possible triggers for the implementation of such a scenario in the agricultural sector are offered, as well as mechanisms of protecting and supporting groups of economic agents affected by CVC are proposed.

Commentary on newly released measures for cyber security review of China

On 27 April 2020, the Cyberspace Administration of China (CAC) together with 12 other bureaus, including the National Development and Reform Commission, jointly issued the Measures for Cyber Security Review (the “2020 Measures”), replacing the Measures for Security Review of Network Products and Services (for Trial Implementation) (the “2017 Measures”) issued by the CAC in 2017, and will be officially implemented on 1 June, 2020. As early as 24 May 2019, CAC issued the Measures for Cybersecurity Review (Consultation Draft) (the “2019 Consultation Draft”), putting forward the core idea of taking critical information infrastructure operators (CIIO) as the starting point for reviewing, which reflects the trend of China’s cybersecurity review and supervision.

Critical infrastructure under attack: lessons from a honeypot

As its name suggests, critical infrastructure is just that – critical. It includes facilities, information, processes and systems upon which our society functions and depends – from energy and our water supply, to transport, election systems and the government. The health sector too is pivotal in supporting everyday citizens and never has this been clearer than today, in the midst of a pandemic.Critical infrastructure includes facilities, information, processes and systems upon which our society functions and depends. And it is increasingly under attack.To counter this threat, critical infrastructure operators should aim to minimise mean time to response when attacks occur. They also need to gain more visibility into their systems – particularly between the IT and OT environments. And security needs to be an intrinsic element in all OT systems, right from the initial design, argues Israel Barak, Cybereason.

Developments in China’s data protection and privacy regulatory regime

On 1st June, 2017, the People’s Republic of China (PRC) Cybersecurity Law (CSL) came into force and became the first comprehensive privacy and security regulation for cyberspace and data protection. The CSL represents the gradual formation of China’s new legal framework for cyber security and data protection, despite the regime being split across various legislation and industry-specific regulations (including their draft versions). In light of the rapidly evolving regulatory environment, the broad and sometimes vaguely expressed obligations imposed by the CSL have added further complexity to the system and attracted significant attention and criticism from international companies due to its unclear application, lack of protection authority, harsh penalties, risk of stolen intellectual property, and strict compliance obligations. While new judicial developments seek to gradually provide clarification of the law — as seen in the outbreak of the COVID-19 pandemic — continuous and thorough review of cybersecurity measures will place foreign entities, ‘network operators’, and ‘critical information infrastructure operators’ in a position to effectively manage unprecedented, paradigm-shifting compliance obligations and risks. This paper outlines China’s data protection and privacy regulatory framework, provides a thorough analysis on important provisions of the CSL, and comments on recent legislative changes. Further, this paper will engage in an in-depth discussion on compliance procedures for best practice, compare the CSL with the European General Data Protection Regulation (GDPR), and analyse the impact of the coronavirus disease 2019 (COVID-19) pandemic on PRC data privacy legislation.

Warning issued over critical infrastructure

The US National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued an urgent warning to operators of critical national infrastructure (CNI) that they may be under attack.

From Risk Management to Resilience Management in Critical Infrastructure

This article discusses critical infrastructure resilience in terms of how it could be incorporated into the existing safety and security practices, namely the ISO 31000 risk management standard. The article starts by outlining the resilience discourse, focusing on the organizational, technological, and societal domains of resilience. It goes on to present an approach to how the risk management standard can be extended to a critical infrastructure resilience management framework. Focusing in particular on the organizational and technological resilience domains, which are considered those that can most readily be controlled by critical infrastructure operators, the article presents one of the resilience assessment techniques in some detail to operationalize the overall management framework. In so doing, the article proposes a prestandardization input for critical infrastructure resilience management, tested in an operational environment. The article concludes with five maxims for this objective: no duplicate practices; tailorability; plurality of assessment techniques; measurability; and relative ease of use.

International humanitarian law and cyber operations during armed conflicts

Executive summary•Cyber operations have become a reality in contemporary armed conflict. The International Committee of the Red Cross (ICRC) is concerned by the potential human cost arising from the increasing use of cyber operations during armed conflicts.•In the ICRC's view, international humanitarian law (IHL) limits cyber operations during armed conflicts just as it limits the use of any other weapon, means or method of warfare in an armed conflict, whether new or old.•Affirming the applicability of IHL does not legitimize cyber warfare, just as it does not legitimize any other form of warfare. Any use of force by States – cyber or kinetic – remains governed by the Charter of the United Nations and the relevant rules of customary international law, in particular the prohibition against the use of force. International disputes must be settled by peaceful means, in cyberspace as in all other domains.•It is now critical for the international community to affirm the applicability of international humanitarian law to the use of cyber operations during armed conflicts. The ICRC also calls for discussions among governmental and other experts on how existing IHL rules apply and whether the existing law is adequate and sufficient. In this respect, the ICRC welcomes the intergovernmental discussions currently taking place in the framework of two United Nations General Assembly mandated processes.•Events of recent years have shown that cyber operations, whether during or outside armed conflict, can disrupt the operation of critical civilian infrastructure and hamper the delivery of essential services to the population. In the context of armed conflicts, civilian infrastructure is protected against cyber attacks by existing IHL principles and rules, in particular the principles of distinction, proportionality and precautions in attack. IHL also affords special protection to hospitals and objects indispensable to the survival of the civilian population, among others.•During armed conflicts, the employment of cyber tools that spread and cause damage indiscriminately is prohibited. From a technological perspective, some cyber tools can be designed and used to target and harm only specific objects and to not spread or cause harm indiscriminately. However, the interconnectivity that characterizes cyberspace means that whatever has an interface with the Internet can be targeted from anywhere in the world and that a cyber attack on a specific system may have repercussions on various other systems. As a result, there is a real risk that cyber tools are not designed or used – either deliberately or by mistake – in compliance with IHL.•States’ interpretation of existing IHL rules will determine the extent to which IHL protects against the effects of cyber operations. In particular, States should take clear positions about their commitment to interpret IHL so as to preserve civilian infrastructure from significant disruption and to protect civilian data. The availability of such positions will also influence the assessment of whether the existing rules are adequate or whether new rules may be needed. If States see a need to develop new rules, they should build on and strengthen the existing legal framework – including IHL.

Critical infrastructure in the shaping of national security

Critical infrastructure plays a key role in ensuring the national security of a state, due to important functions thereof in military, economic, and public administration sectors. The destruction, damage, failure or other deprivation of critical infrastructure of its operational capabilities constitutes a direct threat to the structural and personal security of the state. The research methods and techniques implemented in the research process itself primarily hinge on critical analysis of acts of law and organisational and competence-related documents, subject-matter literature, synthesis and inference in order to reach the formulated objectives based on efficiency criteria. The main findings indicate that critical infrastructure is perceived as a set of systems which exerts a substantial impact on the security of the state and, obviously, its inhabitants. The results advocate for a reflection that critical infrastructure embraces a number of facilities which appear to be remarkably diverse. They are buildings, structures, installations, equipment and services which, integrally, form cohesive systems which allow the proper functioning of a given state. It is the state whose role is just to supervise and coordinate, whereas the operators of critical infrastructure are the ones who are to protect it. The overall findings of this paper present the notion that safeguarding critical infrastructure is a task of crucial importance to the national security of a state and, therefore, it would be worth reconsidering the intensification of rules which apply to the infrastructure of national security and its efficient functioning.

Who cares what it means? Practical reasons for using the word resilience with critical infrastructure operators

Resilience: a highly debated term, with what seems to be an endless amount of slightly varied definitions depending on the sector, domain, or researcher who is addressing the topic, mainly boils down to rebounding after a crisis. For critical infrastructure (CI), the EU-funded H2020 IMPROVER project used the following definition: “the ability of a CI system exposed to hazards to resist, absorb, accommodate to and recover from the effects of a hazard in a timely and efficient manner, for the preservation and restoration of essential societal services.” This was the starting point for much of the work done within that project, however, through six interactive workshops with infrastructure operators organized by the IMPROVER project, what has become apparent is that the definition of resilience isn't what matters; what does matter is the way resilience changes the outlook of operators. This paper presents the results of a critical thematic analysis carried out on the discussions held at these workshops. The findings reflect the practitioners’ views on resilience and are in strong agreement with much of the current academic literature, in particular with literature on resilience engineering. One of the main findings is that resilience as a concept is operationalisable and that a lack of a consensus on details of a definition is no obstacle to using the term or striving to operationalise it. Indeed, resilience is an optimistic approach when compared to current risk management practices, allowing operators to be actors in responding to crisis as opposed to simply being subjects exposed to risks. While many aspects of resilience are also found in risk management, the ability to learn how to respond to unexpected events appears to empower operators. Furthermore, the change in perspective from risk to resilience better deals with another change critical infrastructure operators are going through: from protecting assets from hazards to being able to continuously provide a minimum level of essential services to the public.

A Cyber-Physical Approach to Resilience and Robustness by Design

Modern critical infrastructures (e.g. Critical Energy Infrastructures) are increasingly evolving into complex and distributed networks of Cyber-Physical Systems. Although the cyber systems provide great flexibility in the operation of critical infrastructure, it also introduces additional security threats that need to be properly addressed during the design and development phase. In this landscape, resilience and robustness by design are becoming fundamental requirements. In order to achieve that, new approaches and technological solutions have to be developed that guarantee i) the fast incident/attack detection; and ii) the adoption of proper mitigation strategies that ensure the continuity of service from the infrastructure. The “Double Virtualization” emerged recently as a potential strategy/approach to ensure the robust and resilient design and management of critical energy infrastructures based on Cyber-Physical Systems. The presented approach exploits the separation of the virtual capabilities/functionalities of a device from the physical system and/or platform used to run/execute them while allowing to dynamically (re-) configure the system in the presence of predicted and unpredicted incidents/accidents. Internet-based technologies are used for developing and deploying the envisioned approach.

Spectrum Vulnerabilities, Part I: Systematic and Technological Challenges to Identifying and Understanding Vulnerabilities

An IoT device in a Faraday cage is about as good as a paperweight. Yet, the inherent openness of wireless systems leaves IoT devices exposed to vulnerabilities. These vulnerabilities are unavoidable precisely because inputs into radio receivers cannot be sealed off and wireless links cannot be completely isolated. Left unaddressed, these spectrum vulnerabilities can be exploited by malicious actors or be the source of non-malicious harmful interference, both of which can have high social and economic costs. Notwithstanding these vulnerabilities, wireless devices have become increasingly prevalent, and our reliance on radios is only expected to increase. This is unsurprising considering that connected devices have become indispensable to public safety and national security communications, business and critical infrastructure operations, navigation, socializing, and entertainment. Stakeholders and policymakers have only just begun to understand how the prevalence of connected devices and their vulnerabilities results in a high number of actual and potential security risks. Consequently, they have struggled to identify and understand those risks, let alone develop solutions to address them. If vulnerabilities cannot be identified, they cannot be prioritized, and if they cannot be prioritized, they will not be sufficiently resourced. In March 2019, I was invited to attend and report on a roundtable discussion convened by Silicon Flatirons that brought together experts from government, academia, and industry to discuss spectrum vulnerabilities. This column, which will be presented in two parts, captures some of the discussion. Part I will focus on the systematic and technological challenges to identifying and understanding spectrum vulnerabilities. Part II, which will appear in the next issue of IEEE Internet of Things Magazine, will focus on recommendations to address those challenges. The ideas and conclusions herein are attributable to the participants, who engaged in the conversation under the Chatham House Rule.

Quantifying the System-Level Resilience of Thermal Power Generation to Extreme Temperatures and Water Scarcity

Severe weather events, such as extreme temperatures and water scarcity, can have significant impacts on the operation of critical electrical power infrastructure and, consequently, pose major threats to its resilience. Differently from existing studies that focus on the impact of extreme weather on individual power plants, this article quantifies the resilience of thermal power generation to extreme temperatures and the different levels of water availability from a system-level perspective. This article starts by introducing the fundamental engineering models of thermal power plants’ cooling systems. A system-level quantification methodology is then proposed, which also introduces a multicoordinate resilience-oriented metric that assesses system vulnerability through the concepts of conditional value-at-risk and its rate of change in response to changes in the considered weather conditions. The numerical results obtained using a simplified version of the British transmission system not only demonstrate that the proposed framework is well suited to quantify the system-level resilience of the test system to extreme temperatures and different levels of water availability and scarcity but also highlight the benefits of using the newly defined resilience metric in such studies.