Abstract: Various examples of systems and methods are described herein in which multiple intelligent electronic devices (IEDs) are connected in a network. A software-defined network (SDN) controller may include a rule subsystem, a test mode subsystem, a packet inspection subsystem, and a validation subsystem. The rule subsystem may define a plurality of flow rules. A test mode subsystem may operate the SDN in a testing mode. A packet insertion subsystem may insert test packets within the SDN while the SDN is in the testing mode. The validation subsystem may validate or fail each flow rule depending on how the various test packets are handled.

Abstract: Systems and methods may be used to assess network communications by generating one or more current communication parameters based on communications at an intelligent electronic device (IED) within an electric power delivery system. Network communications may be assessed by determining, at the IED, whether the communications fall within one or more thresholds for the current communication parameters.

Abstract: Embodiments herein include an intelligent electronic device (IED) by employing a multi-factor authentication process. In some embodiments, to change the access level of the IED, the user may use the password and additional inputs such as an off-site operator sending a command, or the user engaging a push button or switch local to the IED.

Abstract: Various examples of systems and methods are described herein in which multiple intelligent electronic devices (IEDs) are connected in a network. A software-defined network (SDN) controller may include a rule subsystem, a test mode subsystem, a packet inspection subsystem, and a validation subsystem. The rule subsystem may define a plurality of flow rules. A test mode subsystem may operate the SDN in a testing mode. A packet insertion subsystem may insert test packets within the SDN while the SDN is in the testing mode. The validation subsystem may validate or fail each flow rule depending on how the various test packets are handled.

Abstract: Various examples of systems and methods are described herein in which multiple intelligent electronic devices (IEDs) are connected in a network. A software-defined network (SDN) controller may include a rule subsystem, a test mode subsystem, a packet inspection subsystem, and a validation subsystem. The rule subsystem may define a plurality of flow rules. A test mode subsystem may operate the SDN in a testing mode. A packet insertion subsystem may insert test packets within the SDN while the SDN is in the testing mode. The validation subsystem may validate or fail each flow rule depending on how the various test packets are handled.

Abstract: Systems and methods to send or receive redundant Generic Object Oriented Substation Event (GOOSE) messages are described. An intelligent electronic device may obtain power system data from a power system. The IED may publish the power system data in a first GOOSE message and publish the same power system data in a second GOOSE message. The second GOOSE message may have different header information than the first GOOSE message to allow the subscriber to determine that the redundant GOOSE messages are both received. If the first and second GOOSE message are duplicates with identical header information but unique trailer information methods allow the subscriber to determine that the duplicate GOOSE messages are both received.

Abstract: Systems and methods to send or receive redundant Generic Object Oriented Substation Event (GOOSE) messages are described. An intelligent electronic device may obtain power system data from a power system. The TED may publish the power system data in a first GOOSE message and publish the same power system data in a second GOOSE message. The second GOOSE message may have different header information than the first GOOSE message to allow the subscriber to determine that the redundant GOOSE messages are both received. If the first and second GOOSE message are duplicates with identical header information but unique trailer information methods allow the subscriber to determine that the duplicate GOOSE messages are both received.

Abstract: Systems and methods to send or receive redundant Generic Object Oriented Substation Event (GOOSE) messages are described. An intelligent electronic device may obtain power system data from a power system. The TED may publish the power system data in a first GOOSE message and publish the same power system data in a second GOOSE message. The second GOOSE message may have different header information than the first GOOSE message to allow the subscriber to determine that the redundant GOOSE messages are both received. If the first and second GOOSE message are duplicates with identical header information but unique trailer information methods allow the subscriber to determine that the duplicate GOOSE messages are both received.

Abstract: Embodiments herein include an intelligent electronic device (IED) by employing a multi-factor authentication process. In some embodiments, to change the access level of the IED, the user may use the password and additional inputs such as an off-site operator sending a command, or the user engaging a push button or switch local to the IED.

Abstract: A network communication system may include intelligent electronic devices (IEDs) in a ring communication network. A software-defined networking device may be programmed by a removable or disconnectable software-defined network (SDN) controller to control the flow path of data packets to the IEDs in the ring network. The software-defined networking device may inspect a data packet intended for a first IED to determine that the inspected data packet requests a responsive data packet from the first IED. A flow path failure may be identified based on a failure to detect a responsive data packet from the first IED within an expected response time.

Abstract: A network communication system may include intelligent electronic devices (IEDs) in a dual-ring communication network. A software-defined network (SDN) device may be programmed by a removable or disconnectable SDN controller to control the flow path of data packets to the IEDs in the dual-ring network. A first ring of the dual-ring communication network may be dedicated to high priority data packets, and a second ring of the dual-ring communication network may be dedicated to low priority data packets. The SDN device may implement various levels of redundancy depending on the number and location of link failures detected. A first level of redundancy may direct high priority data packets in the opposite direction, and a second level of redundancy may direct high priority data packets onto the other ring normally used for low priority data packets.

Abstract: A network communication system may include intelligent electronic devices (IEDs) in a ring communication network. A software-defined networking device may be programmed by a removable or disconnectable software-defined network (SDN) controller to control the flow path of data packets to the IEDs in the ring network. The software-defined networking device may inspect a data packet intended for a first IED to determine that the inspected data packet requests a responsive data packet from the first IED. A flow path failure may be identified based on a failure to detect a responsive data packet from the first IED within an expected response time.

Abstract: Mitigation of gratuitous conditions on an electric power delivery system is disclosed herein. Intelligent electronic devices (IEDs) may take actions on the electric power delivery system based on commands received via communications channels and based on detected electrical conditions. When a gratuitous condition (such as a cyber attack) is detected, a block command is provided to the IEDs such that the IEDs do not effect actions corresponding with commands received over a communications system. Communications may pass through a condition monitor of a communications device to detect insecurity and either block the communications or command the IED to enter interlock mode.

Abstract: The present disclosure pertains to detecting a network attack. In one embodiment, a first device may receive a high-precision time signal and may use the signal to associate a first time stamp with each of a plurality of data packets reflecting a time that each data packet is transmitted. A second device may receive the plurality of data packets from the first device via a data network. The second device may also receive the high-precision time signal and may use the signal to associate a second time stamp with each of the plurality of data packets reflecting a time that each data packet is received. A time of flight may be determined based on the first time stamp and the second time stamp. The second device may determine whether the time of flight for each of the first plurality of data packets is consistent with a valid time of flight.

Abstract: A single point to modify a behavior of intelligent electronic devices (IEDs) between active and testing modes is disclosed herein. The IED may include a variety of logical nodes, each with a behavior object related to the active or testing mode behavior of the IED. A single testing mode selection point of the IED is used to modify each of the logical nodes to change between active and testing modes. The testing mode selection point may be a logical input. The testing mode selection point may be a physical switch on the IED.

Abstract: The present disclosure pertains to detecting a network attack. In one embodiment, a first device may receive a high-precision time signal and may use the signal to associate a first time stamp with each of a plurality of data packets reflecting a time that each data packet is transmitted. A second device may receive the plurality of data packets from the first device via a data network. The second device may also receive the high-precision time signal and may use the signal to associate a second time stamp with each of the plurality of data packets reflecting a time that each data packet is received. A time of flight may be determined based on the first time stamp and the second time stamp. The second device may determine whether the time of flight for each of the first plurality of data packets is consistent with a valid time of flight.

Abstract: A single point to modify a behavior of intelligent electronic devices (IEDs) between active and testing modes is disclosed herein. The IED may include a variety of logical nodes, each with a behavior object related to the active or testing mode behavior of the IED. A single testing mode selection point of the IED is used to modify each of the logical nodes to change between active and testing modes. The testing mode selection point may be a logical input. The testing mode selection point may be a physical switch on the IED.

Abstract: Disclosed is a control system for a water network. The control system includes a plurality of remotely-located monitoring and or monitoring and automatic control stations each including an automation controller for local control and automation, and each in communication via a dual-ring communication topology for system or wide-area control. The dual-ring facilitates redundant peer-to-peer data exchange to provide upstream and downstream water flow and water quality information. Systems described herein may calculate flow differential based on water flow data from each of the monitoring stations, and control flow based on the calculated flow differential.

Abstract: The present disclosure pertains to systems and methods for publishing time-synchronized information. In one embodiment, a system may include a time interface configured to receive a common time signal and a network interface configured to transmit a plurality of data packets using a network. A publishing subsystem may be configured to cause the system to publish at least one data value according to a schedule and the common time signal. A processing sequence number subsystem may be configured to generate a processing sequence number to be included in the plurality of data packets and to reset the processing sequence number at a fixed interval based on the common time signal. A data packet subsystem may be configured to generate a plurality of data packets comprising a respective processing sequence number and the at least one data value.

Abstract: The present disclosure pertains to systems and methods for publishing time-synchronized information. In one embodiment, a system may include a time interface configured to receive a common time signal and a network interface configured to transmit a plurality of data packets using a network. A publishing subsystem may be configured to cause the system to publish at least one data value according to a schedule and the common time signal. A processing sequence number subsystem may be configured to generate a processing sequence number to be included in the plurality of data packets and to reset the processing sequence number at a fixed interval based on the common time signal. A data packet subsystem may be configured to generate a plurality of data packets comprising a respective processing sequence number and the at least one data value.