“Systematic Experimentation and Demonstration activities” IRRIIS AB Meeting Ottobrunn, 20th May 2008 Sandro Bologna ENEA

IRRIIS Control Room with MIT WorkStation LCCI 1 LCCI 2 MIT WorkStation Control Room

IRRIIS MIT integration with existing SCADA systems

IRRIIS MIT integration with existing SCADA systems IRRIIS Inter-LCCI Communication Highway LCCI 1 LCCI 2

IRRIIS Goals of experimentation and demonstration activities Experimentation of SimCIP simulation environment (without MIT) to: o o verify the implemented LCCI models and capabilities to implement different scenarios, o o identify the set of potential risk situations that could benefit from MIT, to be used for the activities of scenarios set-up Experimentation of MIT system using SimCIP environment with the objectives to verify and evaluate the risk reduction effects Demonstrate the results of points 1) and 2) to the stakeholders in order to have their evaluations and feedbacks

IRRIIS Experimentations

IRRIIS Experimentation strategy (Step 1) SimCIP Normal behaviours Test-Bed SimCIP Attack/fault behaviours Attack/faults scenario tables Build an experimentation infrastructure Simulation Environment Knowledge elicitation about a set of scenarios COMPARE BEHAVIOURS WITHOUT MIT Test-Bed NO ATTACKS/ FAULTS ATTACKS/FAULTS EVENTS TREE

IRRIIS SimCIP Attack/fault behaviours Attack/faults scenario tables Build an experimentation infrastructure Simulation Environment Knowledge elicitation about a set of scenarios COMPARE BEHAVIOURS & EFFECTS WITH MIT ATTACKS/FAULTS EVENTS TREE Test-Bed MIT Communication Add-on #n Add-on #2 Add-on #1 Experimentation strategy (Step 2) Test-Bed SimCIP Normal behaviours

IRRIIS Experimentation environment architecture

IRRIIS SimCIP TelecomSimulator LCCI Telecom Data Base ElectricitySimulator LCCI Electricity Data Base MITcommunication Electricity MIT Add-on Telecom MIT Add-on Electrical SCADA Emulator Telecom Electrical Control Room Telecom Control Room Optional External Components Physical set-up of the experimentation environment

IRRIIS LCCIs for experimentation LCCI Owner Power Carrier Telco Carrier Primary LCCI PT Supporting CI PTTP P  Power (electrical) network PT  Power Telecom network (SCADA systems including also telecom network owned by Power Network Operator) T  Telecom network (Telecom Infrastructure) TP  Telecom Power network (Telecom backup power systems) LCCIs INVOLVED IN THE ROME MINI TELCO BLACK-OUT

IRRIIS P – Power Network Simulation PT – Power Telecom Network Simulation (SCADA) TP –Telco Power Network Simulation T – Telecom Network Simulation Scenario Table Simulating different LCCIs components within SimCIP+SinCAL

IRRIIS P – Power Network Simulation PT – Power Telecom Network Simulation (SCADA) TP –Telco Power Network Simulation T – Telecom Network Simulation Scenario Table Using scenario tables to define different scenario event sequences

IRRIIS P (primary fault) P+PT (faults) P+T (faults) P+TP (faults) PT+P (faults) PT+T (faults) PT (primary fault) T (primary fault) TP (primary fault) Scenarios coverage strategy ADDITIONAL “ENVIRONMENTAL” CONDITIONS Scenario Table 2 ……… Scenario Table n ……… Scenario Table 1 ………

IRRIIS Scenarios execution and evaluation Scenario Tables ……… Compiling Selecting Configure Run Logs of the events Experimentation of MIT integrated capabilities RE TEFS MIT Communication IKACRIPS

IRRIIS Evaluating the expected results Expected results tables Scenario tables MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… MIT Components IKA TEFS CRIPS RE PT TP T P Knowledge from analysts/experts Verify results Iterativeimprovements

IRRIIS Experimentation steps for RE Knowledge from analysts/experts RE Knowledge Base Generalrules Specificrules Services Processes relations MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… 2 tables fail First experimental step MIT Behavior 1 Detection t1 Local info t2 Remote Info t3 ……… Scenario 1 Event 1 Event 2 Event 3 ……… 1 table fails Second experimental step Final Updating rules & services/processes relations System ready for demonstration to stakeholders All tables ok

IRRIIS Status of experiments with SimCIP & SinCAL Networks already modeled: P – Network: The chosen P network is the part of the Rome High Voltage (150 kv) distribution network controlled by the OSTIENSE ACEA control Centre. Three Medium Voltage (20 kv) distribution networks, connected to couples of HV primary substations are also considered. PT – Network: The Power Telco network (with simple/reduced SCADA functionality) associated to the previous P network is implemented. TP - Network: The back-up systems of one backbone (BoB) node, two additional Transit nodes and some local nodes were considered as a part of TP network. As described below at this stage only the backup batteries and not the Diesel generators are considered. T – Network Not yet modelled at this stage SSinCAL Iinstallation SSimCIP Iinstallation

IRRIIS SSinCAL load-flow model installation tthree electrical power production points

IRRIIS SSinCAL load-flow model installation Tthree electrical services consuming areas Oone serving a “BoB” Telecom node Ttwo serving “Transit” Telecom dodes

IRRIIS SSimCIP PT and TP implemented models VOLTAGE BUSBAR MONITORS POWER-FLOW LINES MONITORS SWITCHING LINES ACTUATORS LOAD CHARGING ACTUATORS PT - AGENTS BUILDING SERVICES (Batteries, ect.) TELCO DEVICES POWER INTERFACES BoB devices Transit devices TP - AGENTS Local devices

IRRIIS These events may be classified into more types: Loss of power service supply (caused by line overloading) from one (or more) of the three in-feeder points. Consequences. strong under voltage condition having impact on all the three considered distribution 20 Kv areas with high risk of a generalised black out and loss of the power services to Telecom buildings. Expected mitigation: possibility to negotiate load shedding policies inside areas that are less critical for Telecom LCCI. FIRST TYPE (proposed by Siemens) First implemented scenario table P- Network starting events

IRRIIS Loss of power service supply (caused by a short circuit) form one or more of the primary substations serving one of the three distribution areas, together with a not usual load request from an important consumer in such area. Consequences. Under voltage condition mainly concentrated on the specific affected area. Expected mitigation: Early warning of possible black out involving the specific affected area and negotiation of the restoration time in case of outage. SECOND TYPE EVENTS Implemented scenario table Table under development P- Network starting events

IRRIIS Degradation of the BoB or Transit Telco devices functionalities, caused by a flooding inside Telco buildings. Consequently some parts of the PT network become inoperable. Consequences. Additional faults events on the P network (like under voltage or overloading conditions) cannot be monitored/managed by operators (and by MIT components too.) Expected mitigation: Such type of “information system black-outs” risks must be diagnosed early and communicated between LCCIs. In such way on field preventive measures may be undertaken TYPE OF EVENT ( Events are similar to the real Torpagnotta scenario ) Implemented scenario table Table under development TP- Network starting events

IRRIIS First results from experimentation and demonstration activities Experimentation of SimCIP simulation environment (without MIT) to o o verify the implemented LCCI models and capabilities to implement different scenarios, o o identify the set of potential risk situations that could benefit from MIT, to be used for the activities of scenario set- up 1A. A first version of PT and TP models are correctly implemented, a first scenario table is running, additional scenarios are under development 1B A first set of potential risk situations are identified only for faults arising from the P network. SimCIP T models are under implementation Experimentation of MIT system using SimCIP environment with the objectives to verify and evaluate the risk reduction effects 2. Not started yet Demonstrate the results of points 1) and 2) to the stakeholders in order to have their evaluations and feedbacks 3. Not started yet. Improvements of SimCIP models ad scenarios (1A) are needed, and some experiments with MIT (2) have to be configured and executed.

IRRIIS Demonstrations

IRRIIS The demostrations Purpose: - demonstrate MIT concepts/components to interested LCCI-stakeholders using the SimCIP environment Objective: - convince LCCI stakeholders that MIT components have a benefit for them (e.g. help to avoid or mitigate cascading effects leading to black-outs) Procedure: - demonstrate the successfully executed IRRIIS experiments Organisation: - scenario-based demo with active LCCI-stakeholder involvement 3 public demonstration events (Germany, Italy, Spain)

IRRIIS Schedule for Demonstration Events Month*HostName Oct/Nov 2008 IABG 1 st Demonstration event in Germany Spring 2009 ENEA 2 nd Demonstration event in Italy Spring 2009 AIA or REE 3 rd Demonstration event in Spain *preliminary dates depending on project progress

IRRIIS Rooms Tech Setup Social Event Flyer Handouts Presentations PoC Acquisition PoC* Invitation Announcements Materials Invitation Setting Demonstrations (WP4.1) Selected Experiments Experimentations (WP3.5) Integration, test and validation of MIT components (WP3.4) SINCALMITsSimCIP Prerequisites and Tasks Prerequisites Tasks Experiments * Point of Contact Questionnaire Deliverables Evaluation Feedback What How Frame- work Whom Tec Basis

IRRIIS Demonstration Visualisation Example Demonstration Projection Screen CI-ViewerSincal SimCIP Time Synchronous Presentation of SimCIP and MITs on multiple Screens Audience MIT

IRRIIS

CI Status Visualisation

IRRIIS Comparison & Evaluation of Effects No. of inhabitants and density of population Supply areas of ACEA  Number of affected households  Amount of lost energy in MWh  Duration of the outage City Model of Rome