S. Bologna, C. Balducelli, A. Di Pietro, L. Lavalle, G. Vicoli ENERSIS 2008 Milano, 17 Giugno, 2008 Una strategia per mitigare l’effetto delle interdipendenze tra infrastrutture critiche E NTE PER LE N UOVE TECNOLOGIE L’ E NERGIA E L’ A MBIENTE

ITALY BLACK-OUT September 2003 Event tree from UCTE report Pre-incident network in n-1 secure state Network in (n-1) state with short- term 15’ allowable overload Network in (n-2) state with excessive overload of remaining lines Separatio n of Italy from the UCTE main Grid Island operation fails due to unit tripping AND 1st tree flashover line tripping 2nd tree flashover line tripping Italy disconnected Tripping of many power units AND NETWORK STATE OVERVIEW & ROOT CAUSES 1 Unsuccessful re- closing of the Luckmainer line because of a too high phase angle difference 2 Lacking a sense of urgency regarding the San Bernardino line overload and call for inadequate countermeasures in Italy 3 Angle instability and Voltage collapse in Italy 24 min. 1-2 min. Safe network state Endangered network state Disturbed network state Collapsed network Event Root cause Legend

Roma Mini TELCO Black-out January 2004 Pre-incident TELCO network in secure state Station continue working with decreased battery autonomy Many external Telco services go down, as the ACEA data links between control centers The normal power supply from ACEA was restarted Return to normal state AND Trip of main power supply Loss of power supply Damaged equipment replaced Telco services restart AND NETWORK STATE OVERVIEW & ROOT CAUSES 1 Flood on the apparatus room of the Telco SGT station. UPS start from batteries 2 The battery autonomy finished as Fire Brigate was not able to eliminate water in time. 3 The full functionality of the SGT station is restored 4 hours Safe network state Endangered network state Disturbed network state Collapsed network Event Root cause Legend 90 min.

MIT is a software system to enhance the availability and survivability of LCCIs by mitigating (inter)dependency effects. It is composed of: communication components. add-on components. other software resources (databases,GUI, configuration files, run-time environment, etc.) MIT Introduction

Control Room with MIT WorkStation LCCI 1 LCCI 2 MIT WorkStation Control Room

MIT integration with existing SCADA systems

IRRIIS Inter-LCCI Communication Highway

Middleware Improved Technology System: component oriented architecture LCCI 1 LCCI 2 LCCI 3 LCCI 5 LCCI 4 LCCI 6 MIT 4 Client-server peer to peer communication LCCIs -> Critical Infrastructures MIT 2 MIT 1 MIT 5 MIT 6 MIT 3 MIT Communication Components MIT Add-On Components

COMMUNICATION COMPONENTS Communication components are responsible on how sending/receiving information from neighbouring LCCIs, using the appropriate time constraints and security levels. Middleware Improved Technology System: component oriented architecture

ADD-ON COMPONENTS Add-on components are responsible on what internal information has to be sent to neighbouring LCCIs, and what information received from neighbouring LCCIs may influence the internal LCCI state. Middleware Improved Technology System: component oriented architecture

MIT Add-On Components Internal Assessment –Tool to extract LCCI functional status Risk Assessment –Risk Estimator –Incident Knowledge Analyser Emergency Management –Assessment of cascading/escalating effects –Display of Emergency Management Procedures –Negotiator

Risk Estimator functions Reasoning about the states of processes and services, mainly focusing on the services to be exchanged with other LCCIs. Estimating the levels of risks associated to services exchanges with other LCCIs. Working on a service-process model of the LCCIs by making use of a fuzzy rules-based mechanism.

Visualisation of the levels of risks associated to the services LCCI internal state estimation After external & internal states correlation

Make operators more aware about the global LCCIs state, correlating local LCCI and external LCCIs states. Give to the LCCIs operators schematic pictures evidencing the potential risks to loss internal and external services. Improve coordination between the LCCI operator and the neighbouring LCCIs. Risk estimator Benefits

Incremental development & testing process of the components DEVELOPING COMPONENTS INTEGRATION TESTING & VALIDATION Experimentation of the integrated capabilities SimCIP CRIPS TEFS MIT Comp

Laboratory experimentation LABORATORY EXPERIMENTATION TEST BEDS TO VERIFY THE INTEGRATED CAPABILITIES

Experimentation strategy (Step 1) SimCIP Normal behaviours Test-Bed SimCIP Attack/fault behaviours Attack/faults scenario tables Build an experimentation infrastructure Simulation Environment Knowledge elicitation about a set of scenarios COMPARE BEHAVIOURS WITHOUT MIT Test-Bed NO ATTACKS/ FAULTS ATTACKS/FAULTS EVENTS TREE

SimCIP Attack/fault behaviours Attack/faults scenario tables Build an experimentation infrastructure Simulation Environment Knowledge elicitation about a set of scenarios COMPARE BEHAVIOURS & EFFECTS WITH MIT ATTACKS/FAULTS EVENTS TREE Test-Bed MIT Communication Add-on #n Add-on #2 Add-on #1 Experimentation strategy (Step 2) Test-Bed SimCIP Normal behaviours

SimCIP TelecomSimulator LCCI Telecom Data Base ElectricitySimulator LCCI Electricity Data Base MITcommunication Electricity MIT Add-on Telecom MIT Add-on Electrical SCADA Emulator Telecom Electrical Control Room Telecom Control Room Optional External Components Physical set-up of the experimentation environment

LCCIs for experimentation LCCI Owner Power Carrier Telco Carrier Primary LCCI PT Supporting CI PTTP P  Power (electrical) network PT  Power Telecom network (SCADA systems including also telecom network owned by Power Network Operator) T  Telecom network (Telecom Infrastructure) TP  Telecom Power network (Telecom backup power systems) LCCIs INVOLVED IN THE ROME MINI TELCO BLACK-OUT

P – Power Network Simulation PT – Power Telecom Network Simulation (SCADA) TP –Telco Power Network Simulation T – Telecom Network Simulation Scenario Table Simulating different LCCIs components within SimCIP

P – Power Network Simulation PT – Power Telecom Network Simulation (SCADA) TP –Telco Power Network Simulation T – Telecom Network Simulation Scenario Table Using scenario tables to define different scenario event sequences

Scenarios execution and evaluation Scenario Tables ……… Compiling Selecting Configure Run Logs of the events Experimentation of MIT integrated capabilities RE TEFS MIT Communication IKACRIPS

Evaluating the expected results Expected results tables Scenario tables MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… MIT Components IKA TEFS CRIPS RE PT TP T P Knowledge from analysts/experts Verify results Iterativeimprovements

Experimentation steps for RE Knowledge from analysts/experts RE Knowledge Base Generalrules Specificrules Services Processes relations MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… 2 tables fail First experimental step MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… 1 table fails Second experimental step Final Updating rules & services/processes relations System ready for demonstration to stakeholders All tables ok

To prevent cascading effects among interdependent LCCIs is a new challenge LCCIs modelling capacity, exploiting also commercial simulation tools, is necessary to develop realistic testing environment. Strategies/guidelines to implement exhaustive experimentation sessions must be developed Producing/evaluating experiments with/without introducing the MIT solutions may help to obtain an assessment of the MIT benefits. Final considerations