1. EE362G Smart Grids: Introduction to State Estimation
Nikolaos Gatsis
Dept. of Electrical and Computer Engineering,
UT San Antonio
Ross Baldick, Department of Electrical and Computer Engineering
Spring 2019
Copyright © 2019

2. Outline Control center and SCADA system
State estimation with SCADA measurements
Phasor Measurement Units (PMUs)
State Estimation with PMU Measurements
Cyberattacks: GPS Spoofing Attacks
Copyright © 2019

3. System Monitoring
Key feature of a smarter grid: Improved monitoring and control of the transmission system
GPS-synchronized Phasor Measurement Units and communication technologies enable advancements in system monitoring
This lecture reviews traditional and modern technologies and introduces the basics of system monitoring algorithms
Copyright © 2019

4. Control Center
Computer programs, hardware, and communication infrastructure used to monitor, control, and operate the power grid
Functions
State estimation
Economic dispatch
Optimal power flow
Unit commitment
Load forecasting
Security assessment
Figure: M. Kezunovic, et al.: Application of Time-Synchronized Measurements in Power System Transmission Networks, Springer, 2014
Copyright © 2019

5. Typical Hardware Configuration
State estimation, visualization, energy management functions
Communication input/output controllers (CIOC’s) transfer data to computers
Data collected at Remote Terminal Units (RTUs)
Sensors located in the field
Wattmeter, voltmeter, current meter, breaker status
Figure: M. Kezunovic, et al.: Application of Time-Synchronized Measurements in Power System Transmission Networks, Springer, 2014
Copyright © 2019

6. SCADA System Supervisory control and data acquisition system
Transmits data from the field to a central location and vice versa
Data collected every one to a few seconds
Data typically include
Breaker and switch status
MW flow measurements
MVAR flow measurements
Voltage magnitude measurements
Current magnitude measurements
Copyright © 2019

7. SCADA Measurements Copyright © 2019
Figure: M, Kezunovic, et al.: Application of Time-Synchronized Measurements in Power System Transmission Networks, Springer, 2014
Copyright © 2019

8. State Estimation
Given measurements, compute an estimate of the system state
System state typically considered to include the voltages at all buses
If the network topology is known, then all other electrical quantities can be computed (currents, power flows)
Crucial in all other control center functions
Copyright © 2019

9. State Estimation Tasks
Bad data detection
Network Topology
Best estimate of system state & model
Breaker and switch status
Topology Processing
State Estimator
Analog measurements
(power flows, voltage magnitudes, current magnitudes)
Focus of this lecture
Copyright © 2019

10. Modeling Basics Power grid with 𝑁 buses Complex voltage at bus 𝑛
Copyright © 2019

11. System State Number of unknown states
Set to zero to avoid phase ambiguity
Number of unknown states
Copyright © 2019

12. Measurements 𝑀 measurements from sensors
Flows: MW and MVAR flows on transmission lines or transformers
Injections: MW and MVAR injections at system buses
Voltage magnitudes at system buses
Current magnitudes
Let’s look at MW power flows
Copyright © 2019

13. Transmission Lines Copyright © 2019 This is the pie model of the line
y_{nk}: series admittance
b_{nk}^s: Shunt or charging susceptance
Copyright © 2019

14. Line MW Power Flow Nonlinear relationship with the system states
Copyright © 2019

15. Line MVAR Power Flow
Copyright © 2019

16. Measurement Model
Measurement noise
Measurement vector
Vector function: Nonlinear map from states to measurements
State estimation: Given measurement vector, find system state
Overdetermined system: More measurements than unknowns (𝑀>𝐾)
In addition, measurements are perturbed by noise
Copyright © 2019

17. Noise Model Independent measurements across sensors Zero mean
It is possible that a sensor introduces gross errors (outliers or bad data) due to e.g., equipment failure
Specialized techniques can deal with this situation
Standard deviation of measurement of sensor 𝑖: 𝜎 𝑖
Determined by accuracy of meter used
Copyright © 2019

18. Nonlinear Least Squares
Nonlinear Least Squares: Find the state that minimizes the squared residuals
More weight is placed on more accurate sensors
Copyright © 2019

19. Linearization Organize the weights in a matrix Cost function
Suppose we start from a state estimate
Linearization around
Jacobian matrix
(see next slide)
Copyright © 2019

20. Jacobian Matrix
Jacobian matrix evaluated at a particular 𝐱
Make sure to use radians for derivative computation!
The Jacobian matrix and linearization in this lecture are similar to the power flow Jacobian and the Newton-Raphson method developed in EE369
Copyright © 2019

21. Solution of Linearized Model
Set derivatives with respect to 𝑥 𝑖 to zero
Solution:
Copyright © 2019

22. Iterative Solution Algorithm
Initialization:
Repeat the following steps
Compute the Jacobian
Update state
Until
Copyright © 2019

23. Example Given the following measurements, solve for the state vector
In this network, we have
Figure: M. Kezunovic, et al.: Application of Time-Synchronized Measurements in Power System Transmission Networks, Springer, 2014
Given the following measurements, solve for the state vector
Assume all weights are equal to 1
Copyright © 2019

24. Setting Up the Solution
State vector
Nonlinear functions
Jacobian matrix
Copyright © 2019

25. Solution Initialization Iterative algorithm demonstrated in Matlab
Note that x(3) is in radians!
Copyright © 2019

26. Phasor Measurement Units
Phasor measurement unit (PMU) features
PMUs can measure the voltage phasor at the bus and current phasor at the lines
Collect measurements between 10 and 60 times per second for 60 Hz systems and between 10 to 50 times per second for 50 Hz systems (IEEE C Standard)
Equipped with GPS receivers that provide a very accurate clock signal
GPS time information is used to timestamp the PMU measurements
Copyright © 2019

27. Phasor Data Concentrators
Phasor Data Concentrators (PDCs) collect measurements from multiple PMUs
Buffer input streams to account for differences between times of delivery from different PMUs
Align data according to their time-stamp
Provide the data to other PDCs or the control center
Copyright © 2019

28. PMU/PDC network Local PDC Hardware based device
Figure: M. Kezunovic, et al.: Application of Time-Synchronized Measurements in Power System Transmission Networks, Springer, 2014
Local PDC
Hardware based device
Physically close at the PMU (e.g., at the substation)
Super PDC
Operates at regional scale
Organizes dataset and makes it available for control center functions
Corporate PDC
Collects data from multiple PMUs and PDCs at high speeds
Copyright © 2019

29. PMUs in North American Grid
Copyright © 2019

30. Measurement Accuracy Specified by the IEEE C37.118 Standard
Figure: M. Kezunovic, et al.: Application of Time-Synchronized Measurements in Power System Transmission Networks, Springer, 2014
Specified by the IEEE C Standard
Required accuracy is 1% total variation error
Timing error of 1 μsec corresponds to 0.022° phase error at 60 Hz (Δφ=2πfΔt)
1% TVE corresponds to a phase error of 0.57°, or 0.01 rad, or time error of 26.5 μsec
GPS time provides the required accuracy
Copyright © 2019

31. PMU vs. SCADA SCADA PMU Measurements Power flows and injections,
voltage magnitudes, current magnitudes
Voltage and current phasors, frequency
Measurement model for state estimation
Nonlinear
Linear
Solution of state estimation
Iterative
Direct
Measurement rate
One measurement every one to a few seconds
10 – 60 measurements per second
Synchronization between measurements
Poor: Time skewness
Precise: GPS time
Copyright © 2019

32. State Estimation with PMUs
Express the state in rectangular coordinates
No need to assume a phase reference ( 𝑉 1,𝑖 =0)
PMU measures the phasor, which includes phase information
PMU measures the voltage and current phasors
Express measurements in rectangular coordinates
Measurements are linearly related to the state (voltages)
Copyright © 2019

33. Line Currents Express voltage in rectangular coordinates
Collect real and imaginary parts of the current
Copyright © 2019

34. Measurement Model with PMU Data
Measurement noise
Measurement vector
Real and imaginary parts of voltages at buses with PMUs
Real and imaginary parts of currents at lines connected to buses with PMUs
Vector function:
Linear map from states to measurements
PMU
Copyright © 2019

35. Linear Least Squares Set derivatives with respect to 𝑥 𝑖 to zero
Direct solution, no iterations
Solution:
Copyright © 2019

36. Example 1 2 3 4 PMUs at buses 1 and 2
Given the following measurement vector, find the system state
Suppose all weights are 1
First, write the state
Second, write matrix H
Then, apply the formula on the previous slide. 3 4
Note that if we had a PMU installed only at bus 1, we would only have 6 measurements, and it would be impossible to estimate the 8 states
Copyright © 2019

37. Solution
Copyright © 2019

38. GPS Spoofing A type of cyberattack
Malicious agents transmitting unauthorized GPS signals with the intention of misleading the estimation of position and time by the GPS receiver
The user may not realize that they are reading a manipulated GPS signal
Copyright © 2019

39. Time Synchronization Attacks
GPS provides time reference of microsecond precision
PMUs
Cellphone towers
Air traffic control towers
Financial institutions
Industrial control systems
Time Synchronization Attacks: GPS Spoofing Attacks against stationary GPS receivers with the intention of altering the GPS-based time reference
Copyright © 2019

40. Recognized Vulnerability
National Electric Sector Cybersecurity Organization Resource (NESCOR), Electric Sector Failure Scenarios and Impact Analyses
Scenario WAMPAC.12: GPS Time Signal Compromise
United States Government Accountability Office, Report to Congressional Requesters, GPS DISRUPTIONS: Efforts to Assess Risks to Critical Infrastructure and Coordinate Agency Actions Should Be Enhanced, Nov. 2013
Copyright © 2019

41. Computing Receiver Position and Time
Satellite signal
TOT: Time Of Transmission
Satellite time
TOR: Time Of Reception
GPS receiver time
Receiver perceived time due to clock offset
Receiver true time
True time (UTC) for phasor reference
Receiver clock offset (b)
Measurement: Pseudorange ρ=c∙(TOR-TOT) for each satellite (c = speed of light)
Solution algorithm
Navigation data from satellites
Satellite positions
Receiver position (x,y,z)
Copyright © 2019

42. GPS Spoofing Mechanisms
Successful GPS spoofing for stationary receivers (e.g. PMU): The attacker must not alter the receiver’s position estimate
Data-level spoofing: The attacker synthesizes fake GPS signals with altered navigation data
Signal-level spoofing: The attacker synthesizes fake signals that carry the same navigation data as concurrently broadcast by the satellites, but can affect the perceived time of reception TOR
Record-and-replay attacks: The attacker records valid GPS signals and transmits them with a delay
In all the above scenarios, a time offset Δ𝑡 is introduced in the time reference signal for phasor timestamping
Translates to a phase error in the PMU measurement
Copyright © 2019

43. Experimental Demonstration
UT Austin, Pacific Northwest National Laboratory (PNNL), UIUC
Figure shows the angle difference between measurements from a reference PMU and a spoofed one
Point 3 marks the point where the IEEE C Standard is violated (phase error > 0.57°), which means the attack is successful
Angle error can become very large (70°)
Spoofing attack on a ship’s GPS
D. P. Shepard, T. E. Humphreys, A. A. Fansler, Evaluation of the vulnerability of phasor measurement units to GPS spoofing attacks, Int. Journal of Critical Infrastructure Protection, Volume 5, Issues 3–4, 2012
Copyright © 2019

44. Countermeasures (1) At the GPS receiver level
More sophisticated receiver architectures that tracks legitimate and forged satellites
Encryption based techniques
Setups with multiple antennas or multiple receivers
Statistical and anomaly detection methods for the receiver clock offset estimates
Copyright © 2019

45. Countermeasures (2)
If undetected at the receiver level, GPS spoofing attacks will impact the PMU measurements
Develop state estimation methods that handle GPS-spoofed measurements
Novel measurement model: Suppose that a GPS spoofing attack on PMU at bus 𝑛 shifted the angle by Δ 𝜃 𝑛
Measurement
Attack (unknown)
System state (unknown)
Copyright © 2019

46. Nonlinear Least Squares with GPS Spoofed PMU Measurements
Minimize the least squares objective with respect to state and attack angles
Attacks within [-60°,60°] on buses of the IEEE 118-bus network
P. Risbud, N. Gatsis, A. Taha, "Vulnerability Analysis of Smart Grids to GPS Spoofing," IEEE Trans. Smart Grid
Copyright © 2019

47. Summary Control center, SCADA system
State estimation: Compute system state from a set of measurements
Crucial for control center operations
SCADA measurements: Nonlinear model, iterative solution algorithm
Phasor Measurement Units
GPS-synchronized measurements
Significantly improve the visibility of the grid
State estimation with PMU measurements
Linear model, direct solution
GPS Spoofing: Cyberattacks affecting the time synchronization of PMU measurements (and other applications requiring precise timing)
Experimentally demonstrated
Recognized by various stakeholders
Development of countermeasures is an active research field
Copyright © 2019

48. Homework Exercises: Due Thursday, Feb. 7
For the 2-bus network of Slide 23, suppose that the following measurement vector is recorded. Compute the state estimate, assuming all weights are one (Matlab code for the example of Slide 23 provided).
Copyright © 2019

49. Homework Exercises: Due Thursday, Feb. 7
For the 4-bus network of Slide 36, suppose that PMUs are placed on buses 1 and 3 and the following measurement vector is recorded. Compute the state estimate, assuming all weights are one.
Copyright © 2019