Abstract: Technologies for detecting cyber-attacks against electrical distribution devices include a controller. The controller includes circuitry to determine a first measured value of a first operational parameter of a transformer based upon one or more signals received from one or more sensors of the transformer. The circuitry is also to determine a second measured value of a second operational parameter of the transformer based upon one or more signals received from the one or more sensors of the transformer, calculate a first expected value of the first operational parameter based on the second measured value of the second operational parameter and a model of the transformer that relates the first and second operational parameters, compare the first measured value of the first operational parameter to the first expected value of the first operational parameter, and identify when a difference between the first measured value and the first expected value exceeds a first threshold.

Abstract: Power systems, such as transmission systems, may comprise a series capacitor bank (SCB) to provide series compensation on a power line. The SCB may be electrically inserted into the power line or bypassed according to commands sent by remote systems. Such commands may be compromised in a cyberattack to cause deteriorated conditions and instability in the power system. Thus, according to an embodiment, a protection layer is provided in an SCB station to intercept commands prior to execution, assess the consistency of the commands with a physical state of the power system, and either allow or block the commands based on the assessment, to thereby protect the SCB from cyberattacks.

Abstract: Systems and methods for fault detection and protection in electric power systems that evaluates electromagnetic transients caused by faults. A fault can be detected using sampled data from a first monitored point in the power system. Detection of fault transients and associated characteristics, including transient direction, can also be extracted through evaluation of sample data from other monitored points in the power system. A monitoring device can evaluate whether to trip a switching device in response to the detection of the fault and based on confirmation of an indication of detection of fault transients at the other monitored points of the power system. The determination of whether to trip or activate the switching device can also be based on other factors, including the timing of receipt of an indication of the detection of the fault transients and/or an evaluation of the characteristics of the detected transients.

Abstract: Technologies for providing secure emergency power control of a high voltage direct current transmission (HVDC) system include a controller. The controller includes circuitry configured to receive status data indicative of a present physical status of a power system. The circuitry is also configured to obtain an emergency power control command triggered by a remote source. The emergency power control command is to be executed by an HVDC transmission system of the power system. Further, the circuitry is configured to determine, as a function of the status data, whether the emergency power control command is consistent with the present physical status of the power system and block, in response to a determination that the emergency power control command is not consistent with the present physical status of the power system, execution of the emergency power control command by the HVDC transmission system.

Abstract: An example method for detecting and mitigating attacks on electric power substations comprises detecting a command to open or close a circuit breaker in the electric power substation. A modified extended substation model for the electric power substation is generated, based on the detected command and based on measurements in substation, where the modified extended substation model is a power flow model for the substation and for one or more directly connected neighboring substations. A power flow analysis is performed, using the modified extended substation model, to generate a predicted voltage for each of a plurality of nodes in the substation and in the one or more directly connected neighboring substations. Each predicted voltage is compared to a corresponding allowable voltage range, and execution of the command is blocked in response to determining that one or more of the voltages is outside the corresponding allowable voltage range.

Abstract: Systems, methods, techniques and apparatuses of power network state estimation are disclosed. One exemplary embodiment is a method for state estimation in a power network comprising receiving a set of supervisory control and data acquisition (SCADA) information including a power network topology; generating a SCADA state estimation using the set of SCADA information; receiving, with a cloud-computing architecture, a set of PMU phasors; aligning, with the cloud-computing architecture, a timestamp of the SCADA estimation and a timestamp of the set of PMU phasors; updating, with the cloud-computing architecture, the power network topology using the set of PMU phasors; generating, with the cloud-computing architecture, a hybrid state estimation using the updated power network topology, the set of PMU phasors, and the SCADA state estimation; and transmitting the hybrid state estimation to a local control system.

Abstract: Systems and methods for fault detection and protection in electric power systems that evaluates electromagnetic transients caused by faults. A fault can be detected using sampled data from a first monitored point in the power system. Detection of fault transients and associated characteristics, including transient direction, can also be extracted through evaluation of sample data from other monitored points in the power system. A monitoring device can evaluate whether to trip a switching device in response to the detection of the fault and based on confirmation of an indication of detection of fault transients at the other monitored points of the power system. The determination of whether to trip or activate the switching device can also be based on other factors, including the timing of receipt of an indication of the detection of the fault transients and/or an evaluation of the characteristics of the detected transients.

Abstract: The present application is directed to a three phase power transmission system including a first conductor line, a second conductor line and a third conductor line. One or more sensors are configured to detect traveling waves in each of the first second and third conductors. A controller is configured to receive data transmitted by the one or more sensors and determine which of the traveling modal waves is a first metallic mode wave (MM1), a second metallic mode (MM2) wave and/or a ground mode (GM0) wave. The controller is operable to determine which of the conductor lines are faulted based on detection of one or more of MM1 waves, MM2 waves and/or GM0 waves.

Abstract: Systems and methods for fault detection and protection in electric power systems that evaluates electromagnetic transients caused by faults. A fault can be detected using sampled data from a first monitored point in the power system. Detection of fault transients and associated characteristics, including transient direction, can also be extracted through evaluation of sample data from other monitored points in the power system. A monitoring device can evaluate whether to trip a switching device in response to the detection of the fault and based on confirmation of an indication of detection of fault transients at the other monitored points of the power system. The determination of whether to trip or activate the switching device can also be based on other factors, including the timing of receipt of an indication of the detection of the fault transients and/or an evaluation of the characteristics of the detected transients.

Abstract: Systems, methods, techniques and apparatuses of nested microgrids are disclosed. One exemplary embodiment is a method for removing false data in a nested microgrid system, the method comprising: calculating a first local state estimation using a first plurality of local measurements and a second local state estimation using a second plurality of local measurements; calculating, with a central control system, a plurality of global state estimations including a first global state estimation a second global state estimation; performing a first false data detection test using the first local state estimation and one global state estimation of the plurality of global state estimations; performing a second false data detection test using the first global state estimation and the second global state estimation; detecting false data; and updating the first global state estimation, the second global state estimation, or the first local state estimation in response to detecting the false data.

Abstract: Technologies for providing secure emergency power control of a high voltage direct current transmission (HVDC) system include a controller. The controller includes circuitry configured to receive status data indicative of a present physical status of a power system. The circuitry is also configured to obtain an emergency power control command triggered by a remote source. The emergency power control command is to be executed by an HVDC transmission system of the power system. Further, the circuitry is configured to determine, as a function of the status data, whether the emergency power control command is consistent with the present physical status of the power system and block, in response to a determination that the emergency power control command is not consistent with the present physical status of the power system, execution of the emergency power control command by the HVDC transmission system.

Abstract: Technologies for detecting cyber-attacks against electrical distribution devices include a controller. The controller includes circuitry to determine a first measured value of a first operational parameter of a transformer based upon one or more signals received from one or more sensors of the transformer. The circuitry is also to determine a second measured value of a second operational parameter of the transformer based upon one or more signals received from the one or more sensors of the transformer, calculate a first expected value of the first operational parameter based on the second measured value of the second operational parameter and a model of the transformer that relates the first and second operational parameters, compare the first measured value of the first operational parameter to the first expected value of the first operational parameter, and identify when a difference between the first measured value and the first expected value exceeds a first threshold.

Abstract: The present application is directed to a three phase power transmission system including a first conductor line, a second conductor line and a third conductor line. One or more sensors are configured to detect traveling waves in each of the first second and third conductors. A controller is configured to receive data transmitted by the one or more sensors and determine which of the traveling modal waves is a first metallic mode wave (MM1), a second metallic mode (MM2) wave and/or a ground mode (GM0) wave. The controller is operable to determine which of the conductor lines are faulted based on detection of one or more of MM1 waves, MM2 waves and/or GM0 waves.

Abstract: Methods and systems for secured control of circuit breakers in an electric power substation against undesired direct operation. Consequences of a malicious action are prevented or mitigated using a validation approach that either blocks the command or ensures a negligible effect on system operation. An example method, suitable for implementation in a monitoring device in an electric power substation, includes receiving a command to open or close a circuit breaker. In response, one or more state parameters for the electric power network that comprises the substation are then predicted, the predicted state parameters reflecting an operating state for the network under the assumption that the received command is executed. The method further comprises comparing the predicted one or more state parameters to corresponding operational limits. Execution of the command is then blocked, in response to determining that one or more of the predicted state parameters violate the corresponding operational limits.

Abstract: Unique systems, methods, techniques and apparatuses of a substation phasor data concentrator (ssPDC) is disclosed herein. One exemplary embodiment is a method for operating an electrical substation including a merging unit (MU), a phasor measurement unit (PMU), and a substation phasor data concentrator (ssPDC).

Abstract: An example method for detecting and mitigating attacks on electric power substations comprises detecting a command to open or close a circuit breaker in the electric power substation. A modified extended substation model for the electric power substation is generated, based on the detected command and based on measurements in substation, where the modified extended substation model is a power flow model for the substation and for one or more directly connected neighboring substations. A power flow analysis is performed, using the modified extended substation model, to generate a predicted voltage for each of a plurality of nodes in the substation and in the one or more directly connected neighboring substations. Each predicted voltage is compared to a corresponding allowable voltage range, and execution of the command is blocked in response to determining that one or more of the voltages is outside the corresponding allowable voltage range.

Abstract: A method and an apparatus for fault detection in a mixed configuration power transmission line including a plurality of sections arranged between one end of the transmission line and the other end of the transmission line and including at least one overhead line section and at least one cable section are disclosed. Based on a comparison travelling wave voltage or current time derivatives at the one end and the other end of the power transmission line with selected threshold values, it is determined if there is a fault occurring in at least one cable section of the power transmission line. Embodiments utilize amplification of travelling wave voltages and/or currents which may occur at junctions between a cable section and an adjacent overhead line section in determining if the fault occurs in a cable section of the power transmission line.

Abstract: An example method for detecting and mitigating attacks on electric power substations comprises detecting a command to open or close a circuit breaker in the electric power substation. A modified extended substation model for the electric power substation is generated, based on the detected command and based on measurements in substation, where the modified extended substation model is a power flow model for the substation and for one or more directly connected neighboring substations. A power flow analysis is performed, using the modified extended substation model, to generate a predicted voltage for each of a plurality of nodes in the substation and in the one or more directly connected neighboring substations. Each predicted voltage is compared to a corresponding allowable voltage range, and execution of the command is blocked in response to determining that one or more of the voltages is outside the corresponding allowable voltage range.

Abstract: Unique systems, methods, techniques and apparatuses of a substation phasor data concentrator (ssPDC) is disclosed herein. One exemplary embodiment is a method for operating an electrical substation including a merging unit (MU), a phasor measurement unit (PMU), and a substation phasor data concentrator (ssPDC).

Abstract: A method and an apparatus for fault detection in a mixed configuration power transmission line including a plurality of sections arranged between one end of the transmission line and the other end of the transmission line and including at least one overhead line section and at least one cable section are disclosed. Based on a comparison travelling wave voltage or current time derivatives at the one end and the other end of the power transmission line with selected threshold values, it is determined if there is a fault occurring in at least one cable section of the power transmission line. Embodiments utilize amplification of travelling wave voltages and/or currents which may occur at junctions between a cable section and an adjacent overhead line section in determining if the fault occurs in a cable section of the power transmission line.