Method for safety capacitor bank control of series compensation transmission lines

Abstract

A power system, such as a power transmission system, may include a series capacitor bank (SCB) to provide series compensation on a power line. The SCB may be electrically inserted into the power line or bypassed according to a command sent by a remote system. Such commands may be compromised in network attacks, resulting in conditional deterioration and instability of the power system. Accordingly, in accordance with an embodiment, a protection layer is provided in the SCB station to intercept a command prior to execution, evaluate a consistency of the command to a physical state of the power system, and allow or block the command based on the evaluation, thereby protecting the SCB from network attacks.

Description

[0001] Government licensing rights

[0002] This invention was made with U.S. Government support under Contract No. DE-OE00000897 awarded by the Department of Energy. The U.S. Government has certain rights in this invention. Background Art Technical Field

[0003] Embodiments described herein relate generally to controls in power systems, and more particularly to safe control of series capacitor banks (SCBs) in power lines. Background Art

[0005] A series capacitor bank (SCB) includes a plurality of capacitors that are electrically connected in series with each other to store electrical energy. SCBs are incorporated into alternating current (AC) power lines to improve the steady-state performance and dynamic characteristics of the power system. The maximum active power that can be transmitted through the power line is inversely proportional to the series inductance of the power line. Therefore, by compensating the series inductance of the power line using SCBs, typically between 25% and 70%, electrically shorter power lines can be achieved, and higher active power transmission and improved system performance can be achieved. In general, the main benefits of applying series compensation in transmission power systems include enhanced system dynamic stability, desired load sharing between parallel lines, improved voltage regulation and reactive power balance, and reduced transmission losses.

[0006] Security against malicious control of SCBs is considered critical. An attacker may gain access to the communication channels of the power system and initiate unauthorized control commands or alter control commands to manipulate the SCB position. For example, an attacker may issue malicious control commands to manipulate the SCB position under normal conditions, block or disrupt control commands under abnormal (e.g., emergency) conditions, generate continuous bypass and insertion commands to the SCB, and / or the like. Unauthorized or altered control commands may result in power line overloads, voltage violations, inter-area oscillations, reduced stability margins for emergencies, risks of system instability, etc. Summary of the invention

[0007] It would be advantageous to protect series capacitor banks (SCBs) from malicious control. It would also be desirable to intercept commands before execution, evaluate them based on their consistency with the physical state of the power system, and block or allow the command based on the evaluation. It would be further advantageous to evaluate consistency based on the presence or absence of line faults or other system disturbances, and prevent continuous switching of SCB states. Therefore, to address one or more of the problems, systems, methods, and non-transitory computer readable media for secure control of series capacitor banks (SCBs) in power lines are disclosed.

[0008] In an embodiment, a method includes using at least one hardware processor within a controller of a series capacitor bank (SCB) station to perform the following operations: receiving a remote control signal from a system external to the SCB station, wherein the remote control signal represents a command to electrically insert the SCB into a power line within a power system or to bypass the SCB; evaluating whether the command is consistent with a physical state of the power system; if the command is inconsistent with the physical state of the power system, preventing the command from being executed by the controller; and if the command is consistent with the physical state of the power system, allowing the command to be executed by the controller.

[0009] The method may also include using the at least one hardware processor to initiate an alert to one or more recipients if the command is inconsistent with a physical state of the power system.

[0010] The method may also include using the at least one hardware processor to perform a line fault detection (LFD) function, the LFD function determining whether there is a line fault within a detection zone, wherein evaluating whether the command is consistent with the physical state of the power system includes: determining that the command is inconsistent with the physical state of the power system if the command is for bypassing the SCB and is received when the LFD function determines that there is no line fault within the detection zone, and determining that the command is consistent with the physical state of the power system if the command is for bypassing the SCB and is received when the LFD function determines that there is a line fault within the detection zone. The remote control signal may be received from a line protection system.

[0011] The method may include using the at least one hardware processor to perform a system disturbance detection (SDD) function, the SDD function determining whether a system disturbance exists within the power system, wherein evaluating whether the command is consistent with a physical state of the power system includes determining whether the command is consistent based on the presence or absence of the system disturbance as determined by the SDD function within a time window before and after receiving the remote control signal.

[0012] The system disturbance may include emergency power transmission, wherein determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent when the command is for inserting the SCB and it is determined by the SDD function that there is no emergency power transmission within the time window; and determining that the command is consistent when the command is for inserting the SCB and it is determined by the SDD function that there is emergency power transmission within the time window.

[0013] The system disturbance may include a frequency disturbance, wherein determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent when the command is for inserting one of the SCB or bypassing the SCB and the SDD function determines that there is no frequency disturbance within the time window; and determining that the command is consistent when the command is for inserting the SCB or bypassing the other of the SCB and the SDD function determines that there is a frequency disturbance within the time window.

[0014] The system disturbance may include an abnormal voltage, wherein determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent when the command is for inserting one of the SCB or bypassing the SCB and it is determined by the SDD function that no abnormal voltage exists within the time window; and determining that the command is consistent when the command is for inserting the other of the SCB or bypassing the SCB and it is determined by the SDD function that an abnormal voltage exists within the time window.

[0015] The remote control signal may be received from a remedial action solution (RAS) system, an energy management system (EMS), or a wide area monitoring, protection and control (WAMPAC) system.

[0016] Evaluating whether the command is consistent with the physical state of the power system may include: determining that the command is inconsistent with the physical state of the power system when the command is for inserting the SCB and the current load of the transmission line is lower than a first threshold, or the command is for bypassing the SCB and the current load of the transmission line exceeds a second threshold; and determining that the command is consistent with the physical state of the power system when the command is for inserting the SCB and the current load of the transmission line exceeds the second threshold, or the command is for bypassing the SCB and the current load of the transmission line is lower than the first threshold.

[0017] Evaluating whether the command is consistent with the physical state of the power system may include determining that the command is inconsistent with the physical state of the power system when any of the following situations occurs: the command is for inserting the SCB and is received within a time window starting from the execution of a previous command for bypassing the SCB; or the command is for bypassing the SCB and is received within a time window starting from the execution of a previous command for inserting the SCB.

[0018] The method may also include using the at least one hardware processor to perform two or more of the following: a line fault detection (LFD) function, the LFD function determining whether there is a line fault on the transmission line; a system disturbance detection (SDD) function, the SDD function determining whether there is a system disturbance in the power system; or an interlocking scheme (IS) function, the IS function determining one or both of the following: a load condition of the transmission line or whether a previous command was executed within a time window before receiving the remote control signal; wherein evaluating whether the command is consistent with the physical state of the power system includes executing logic, the logic utilizing the determination of each of two or more of the LFD function, the SDD function, and the IS function to determine whether the command is consistent with the physical state of the power system. The method may further include using the at least one hardware processor to perform the following operations: receiving real-time measurements of the power system; and using the real-time measurements as input to perform two or more of the LFD function, the SDD function, or the IS function in real time. The logic may complete execution within 500 milliseconds of receiving the remote control signal.

[0019] The method may also include using the at least one hardware processor to: receive real-time measurements of the power system; and continuously determine in real-time a physical state of the power system based on the real-time measurements, wherein the evaluation is performed each time a remote control signal is received.

[0020] The method may also include using the at least one hardware processor to control a bypass breaker of the SCB station according to the command when execution of the command is permitted. Controlling the bypass breaker may include: opening the bypass breaker when the command is for inserting the SCB; and closing the bypass breaker when the command is for bypassing the SCB.

[0021] It should be understood that any feature of the above method can be implemented alone or in any combination with any subset of the other features. Therefore, even if the attached claims indicate that there are specific dependencies between the features, the disclosed embodiments are not limited to these specific dependencies. On the contrary, any feature described herein can be combined with any other feature described herein, or implemented in any combination of any features without any one or more other features described herein. In addition, any method described above and elsewhere herein can be embodied in an executable software module of a processor-based system (such as a controller of an SCB station) alone or in any combination and / or in executable instructions stored in a non-transitory computer-readable medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The details of the invention, both as to structure and operation, may be gleaned in part by examination of the accompanying drawings, in which like reference numerals refer to like parts, and in which:

[0023] Figure 1 illustrates a schematic diagram of an example infrastructure in which one or more disclosed processes may be implemented according to an embodiment;

[0024] Figure 2 illustrates an example processing system that may be used to perform one or more of the processes described herein according to an embodiment;

[0025] Figure 3 illustrates a process that may be implemented by a protection layer of a controller of an SCB station according to an embodiment;

[0026] Figure 4 illustrates examples of security functions that may be employed by a protection layer according to an embodiment;

[0027] Figure 5A and Figure 5B illustrates states of a power system before and after a line fault according to an example scenario, respectively;

[0028] Figure 6 The diagram shows a representation of Figure 5A and Figure 5B A graph showing the performance of a simulation of the scenario shown in FIG.

[0029] Fig. 7A and Figure 7B illustrates states of a power system before and after emergency power transmission according to example scenarios, respectively; and

[0030] Figure 8 The diagram shows a representation of Fig. 7A and Figure 7B Graph of the performance of simulating the scenario shown in FIG. DETAILED DESCRIPTION

[0031] In an embodiment, a system, method, and non-transitory computer readable medium for safely controlling a series capacitor bank (SCB) in a power line are disclosed. After reading this specification, it will be clear to those skilled in the art how to implement the present invention in various alternative embodiments and alternative applications. However, although various embodiments of the present invention will be described herein, it should be understood that these embodiments are presented only by way of example and illustration and not by way of limitation. Therefore, this detailed description of various embodiments should not be interpreted as limiting the scope or breadth of the present invention as set forth in the appended claims.

[0032] 1. System Overview

[0033] 1.1. Infrastructure

[0034] Figure 1 A schematic diagram of an example infrastructure in which one or more disclosed processes may be implemented according to an embodiment is illustrated. It is generally contemplated that the disclosed embodiments will be performed in an electric power system 100, such as an electric grid (e.g., at any scale, from a large-scale utility grid to a regional grid). The electric power system 100 may be a network of any electrical components (e.g., electric power system equipment) configured to generate, store, supply, transmit, distribute, and / or consume electric power, including but not limited to power plants configured to generate electric power from combustible fuels (e.g., coal, natural gas, nuclear power, etc.) and / or renewable resources (e.g., wind, solar energy, etc.), transmission systems configured to transmit or transfer electric power from a source (e.g., a generator, a battery energy storage (BES) system, etc.) to a load, and distribution systems configured to feed the supplied electric power to nearby homes, businesses, and / or other institutions. However, the disclosed embodiments will be discussed and described herein primarily with respect to transmission systems.

[0035] The power system 100 includes a power line 110. The power line 110 may be a transmission line extending between a first substation bus 112 and a second substation bus 114. However, the power line 110 may be any wire or other conductor that conducts electricity through a controllable SCB. The power line 110 may include one or more current measurement devices 116 (e.g., 116A and 116B) that measure the current in the power line 110 and one or more voltage measurement devices (e.g., 118A and 118B) that measure the voltage in the power line 110. The power line 110 may also include at least one circuit breaker 120.

[0036] The line protection system 130 may receive data reflecting information about the power system 100, including current measurement values ​​from at least one current measuring device 116A and / or voltage measurement values ​​from at least one voltage measuring device 118A. The line protection system 130 may analyze the data in real time and control the circuit breaker 120 based on the analysis of the data. In particular, in the event that the line protection system 130 detects a fault in the power line 110 based on the analysis of the data, the line protection system 130 may trip (i.e., disconnect) the circuit breaker 120 to protect the power line 110. It should be understood that the line fault may be any abnormal current in the power line 110. In the three-phase power line 110, the line fault includes, but is not limited to, a line-to-line fault (i.e., a short circuit between two phases of the power line 110), a line-to-ground fault (i.e., a short circuit between one phase of the power line 110 and the ground), a double line-to-ground fault (i.e., a short circuit between two phases of the power line 110 and the ground), and the like.

[0037] The power system 100 may also include one or more other control systems 140, such as a remedial action solution (RAS) system 142, a supervisory control and data acquisition (SCADA) / energy management system (EMS) 144, a wide area monitoring, protection and control (WAMPAC) system 146, etc. Each of these systems can receive data from one or more sensors (e.g., (multiple) current measurement devices 116, (multiple) voltage measurement devices 118, etc.) within the power system 100, analyze the measurements, and perform corrective actions where appropriate. For example, in addition to detecting and isolating faults, the RAS system 142 can also automatically mitigate performance violations of the power system 100. Mitigation can include, but is not limited to, adjusting or tripping generation, tripping loads, and / or reconfiguring the power system 100, etc. The SCADA / EMS 144 monitors the power system 100, such as a utility grid or a regional grid, by acquiring data, and performs high-level supervision and control of the power system 100 based on the acquired data and / or in response to user operations. Such control may include dispatching generation, dispatching power consumption, and / or controlling other components of the power system 100. The WAMPAC system 146 is an integrated real-time system that utilizes both wide-area information and local information (e.g., voltage and current phasors, frequency, rate of change of frequency, etc.) to perform adaptive corrective control and protection actions. It should be understood that any reference herein to the control system 140 may refer to one or a combination of the RAS system 142, the SCADA / EMS 144, the WAMPAC system 146, or any other system that may be used to control the SCB.

[0038] The power system 100 also includes an SCB station 150. The SCB station 150 is any system including an SCB, a bypass circuit breaker connected in parallel with the SCB, and a controller configured to switch the bypass circuit breaker between an open state and a closed state. For example, as shown, the SCB station 150 includes: an SCB 151 (e.g., a QBank provided by Hitachi Energy) TM ), which may include a group of one or more capacitors electrically connected in series to provide series compensation to the power line 110; and a bypass breaker (BB) 152 (e.g., a fast bypass breaker) and a controller 154 (e.g., a CQ provided by Hitachi Energy Co., Ltd. TM150. The SCB station 150 may further include a metal oxide varistor (MOV) 156, a discharge device 157, and a forced trigger spark gap 158. The MOV 156, the discharge device 157, and the forced trigger spark gap 158 may together provide overvoltage protection for the SCB 151. The SCB station 150 may implement fixed series compensation, thyristor controlled series compensation, or any flexible alternating current transmission system (FACTS) series compensation.

[0039] The SCB stations 150 and corresponding SCBs 151 may be disposed at one or more points along the power line 110 and at any suitable location(s) along the power line 110. For example, the first SCB station 150 may be disposed at or near the first substation bus 112, and the second SCB station 150 may be disposed at or near the second substation bus 114. Alternatively or additionally, the SCB station 150 may be positioned at or near the middle of the power line 110.

[0040] The controller 154 controls the bypass breaker 152 to switch between an open state and a closed state, in which the SCB 151 is electrically inserted into the power line 110 to provide series compensation to the power line 110, and in which the SCB 151 is bypassed. Typically, the SCB 151 is electrically inserted into the power line 110 by opening the bypass breaker 152 when the power line 110 is in a high power transmission condition, and the SCB is bypassed by closing the bypass breaker 152 under a low power transmission condition. Such control can be done manually (e.g., via the SCADA / EMS 144) or automatically (e.g., by the line protection system 130, the RAS system 142, the WAMPAC system 146, etc.). For example, an operator can provide input to a graphical user interface of the SCADA / EMS 144 to insert or bypass the SCB 151 according to planned operating conditions.

[0041] As another example, the line protection system 130 may detect a line fault and send a remote control signal to the controller 154 to bypass the SCB 151 and control the circuit breaker 120 to open to isolate the fault. Rapid bypassing of the SCB 151 is a strategy for reducing the transient recovery voltage (TRV) of an ultra-high voltage transmission line (e.g., 345 kV to 765 kV). A transmission line with a high degree of series compensation has an increased TRV level that may exceed the capability of the circuit breaker 120. This may cause damage to the circuit breaker 120 and potential damage to other components of the power system 100. For a series compensated transmission line with a potential TRV problem, whenever the line protection system 130 detects a line fault, the line protection system 130 simultaneously sends a line trip signal to the circuit breaker 120 and sends a remote control signal to the SCB controller 154 indicating a command to bypass the SCB 151. Assuming that the speed of bypass breaker 152 is faster (eg, approximately 5 milliseconds) than the speed of circuit breaker 120 (eg, approximately 20 to 30 milliseconds), SCB 151 may be bypassed just before circuit breaker 120 opens.

[0042] As another example, RAS system 142 may send a remote control signal to controller 154 under emergency conditions. In some regional power grids, rapid bypassing or rapid insertion of SCB 151 on critical transmission lines has been implemented as part of a RAS action to reduce the potential risk of system instability due to major generation or transmission outages. For example, RAS system 142 may detect a critical transmission outage and send a remote control signal to controller 154 to insert SCB 151.

[0043] In either case, control system 130 or 140 may send a remote control signal to controller 154 (e.g., via directional communication or via a communication network of power system 100). The remote control signal represents a command to electrically insert SCB 151 into power line 110 or to bypass SCB 151. It should be understood that the remote control signal may include an instruction to insert SCB 151 or to bypass SCB 151, or may include an instruction to switch the state of bypass circuit breaker 152 between an open state and a closed state.

[0044] In an embodiment, each remote control signal received by the controller 154 is processed by the protection layer 155 before executing the command. The protection layer 155 can intercept each command and implement the disclosed process to allow the command to be executed or to prevent the command from being executed. When the protection layer 155 allows the command to be executed, the controller 154 can send a signal to the bypass breaker 152 indicating an instruction to open or close according to the command. When the protection layer 155 prevents the execution of the command, the controller 154 can issue an alarm and discard or delay the command (e.g., until the operator or other system confirms the command)

[0045] Controller 154 may receive data reflecting information about power system 100, including current measurements from at least one current measurement device 116B and / or voltage measurements from at least one voltage measurement device 118B. The data may be used by functions implemented in controller 154 to control one or more features of SCB station 150. Of particular relevance to the present disclosure, the data may be used by protection layer 155 to inform the disclosed process of allowing or preventing execution of commands in remote control signals.

[0046] 1.2. Example Processing Equipment

[0047] Figure 2 is a block diagram illustrating an example wired or wireless system 200 that may be used in conjunction with the various embodiments described herein. For example, the system 200 may be used as or in conjunction with one or more functions, processes, or methods described herein (e.g., for storing and / or executing software), and may represent a component of the controller 154, the line protection system 130, the control system(s) 140, and / or other processing devices described herein. The system 200 may be a server or any conventional personal computer, or any other processor-enabled device capable of wired or wireless data communications. It will be apparent to those skilled in the art that other computer systems and / or architectures may also be used.

[0048] The system 200 preferably includes one or more processors 210. The processor(s) 210 may include a central processing unit (CPU). Additional processors may be provided, such as a graphics processing unit (GPU), an auxiliary processor to manage input / output, an auxiliary processor to perform floating point math operations, a special microprocessor with an architecture suitable for fast execution of signal processing algorithms (e.g., a digital signal processor), a slave processor subordinate to a main processing system (e.g., a back-end processor), an additional microprocessor or controller for a dual-processor or multi-processor system, and / or a coprocessor. Such auxiliary processors may be discrete processors or may be integrated with the processor 210. Examples of processors that may be used with the system 200 include, but are not limited to, any processor provided by Intel Corporation of Santa Clara, California (e.g., a Pentium 400 processor ...TM , Core i7 TM , Xeon TM any processor provided by Advanced Micro Devices, Inc. (AMD) of Santa Clara, California, any processor provided by Apple Inc. of Cupertino (e.g., A-series, M-series, etc.), any processor provided by Samsung Electronics Co., Ltd. of Seoul, South Korea (e.g., Exynos TM ), any processor provided by NXP Semiconductors of Eindhoven, the Netherlands, etc.

[0049] The processor 210 is preferably connected to a communication bus 205. The communication bus 205 may include a data channel for facilitating the transfer of information between the storage devices and other peripheral components of the system 200. In addition, the communication bus 205 may provide a set of signals for communicating with the processor 210, including a data bus, an address bus, and / or a control bus (not shown). The communication bus 205 may include any standard or non-standard bus architecture, such as a bus architecture that conforms to the Industry Standard Architecture (ISA), the Extended Industry Standard Architecture (EISA), the Micro Channel Architecture (MCA), the Peripheral Component Interconnect (PCI) local bus, a bus architecture that conforms to standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE) including the IEEE 488 General Purpose Interface Bus (GPIB) and / or IEEE 696 / S-100, etc.

[0050] The system 200 preferably includes a main memory 215, and may also include a secondary memory 220. The main memory 215 provides instructions and data storage for programs executed on the processor 210 (such as any software discussed herein). It should be understood that the programs stored in the memory and executed by the processor 210 can be written and / or compiled according to any suitable language, including but not limited to C / C++, Java, JavaScript, Perl, Visual Basic, NET, etc. The main memory 215 is typically a semiconductor-based memory, such as a dynamic random access memory (DRAM) and / or a static random access memory (SRAM). Other semiconductor-based memory types include, for example, synchronous dynamic random access memory (SDRAM), Rambus dynamic random access memory (RDRAM), ferroelectric random access memory (FRAM), etc., including read-only memory (ROM).

[0051] The secondary memory 220 is a non-transitory computer-readable medium having computer executable code (e.g., any software disclosed herein, such as the protective layer 155) and / or other data stored thereon. The computer software or data stored on the secondary memory 220 is read into the main memory 215 for execution by the processor 210. The secondary memory 220 may include, for example, semiconductor-based memory such as a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), and flash memory (a block-oriented memory similar to EEPROM).

[0052] The secondary storage 220 may optionally include internal media 225 and / or removable media 230. The removable media 230 is read and / or written in any well-known manner. The removable storage medium 230 may be, for example, a tape drive, a compact disk (CD) drive, a digital versatile disk (DVD) drive, other optical drives, and / or a flash memory drive, etc.

[0053] In alternative embodiments, secondary memory 220 may include other similar means for allowing computer programs or other data or instructions to be loaded into system 200. Such means may include, for example, a communication interface 240 that allows software and data to be transferred to system 200 from an external storage medium 245. Examples of external storage medium 245 include an external hard drive, an external optical drive, and / or an external magneto-optical drive, etc.

[0054] As mentioned above, the system 200 may include a communication interface 240. The communication interface 240 allows software and data to be transferred between the system 200 and external devices, networks, or other information sources. For example, computer software or executable code may be transferred from a network server to the system 200 via the communication interface 240. Examples of the communication interface 240 include a built-in network adapter, a network interface card (NIC), a Personal Computer Memory Card International Association (PCMCIA) network card, a cardbus network adapter, a wireless network adapter, a universal serial bus (USB) network adapter, a modem, a wireless data card, a communications port, an infrared interface, an IEEE 1394 FireWire, and any other device capable of interfacing the system 200 with a network or another computing device. The communication interface 240 preferably implements industry-published protocol standards, such as Ethernet IEEE 802 standards, Fibre Channel, Digital Subscriber Line (DSL), Asynchronous Digital Subscriber Line (ADSL), Frame Relay, Asynchronous Transfer Mode (ATM), Integrated Services Digital Network (ISDN), Personal Communications Service (PCS), Transmission Control Protocol / Internet Protocol (TCP / IP), Serial Line Internet Protocol / Point-to-Point Protocol (SLIP / PPP), etc., but customized or non-standard interface protocols may also be implemented.

[0055] Software and data transmitted via communication interface 240 are typically in the form of electrical communication signals 255. These signals 255 may be provided to communication interface 240 via communication channel 250. In embodiments, communication channel 250 may be a wired or wireless network or any other communication link. Communication channel 250 carries signals 255 and may be implemented using a variety of wired or wireless communication means, including wire or cable, fiber optics, a conventional telephone line, a cellular telephone link, a wireless data communication link, a radio frequency ("RF") link, or an infrared link, to name a few.

[0056] Computer executable code (e.g., a computer program, such as the disclosed protection layer 155) is stored in the main memory 215 and / or the secondary memory 220. The computer executable code may also be received via the communication interface 240 and stored in the main memory 215 and / or the secondary memory 220. Such a computer program, when executed, enables the system 200 to perform various functions of the disclosed embodiments as described elsewhere herein.

[0057] In this specification, the term "computer-readable medium" is used to refer to any non-transitory computer-readable storage medium used to provide computer executable code and / or other data to or within the system 200. Examples of such media include main memory 215, auxiliary memory 220 (including internal memory 225 and / or removable media 230), external storage media 245, and any peripheral devices (including network information servers or other network devices) communicatively coupled to communication interface 240. These non-transitory computer-readable media are means for providing software and / or other data to system 200.

[0058] In embodiments implemented using software, the software may be stored on a computer-readable medium and loaded into the system 200 via the removable media 230, the I / O interface 235, or the communication interface 240. In such embodiments, the software is loaded into the system 200 in the form of an electrical communication signal 255. The software, when executed by the processor 210, preferably causes the processor 210 to perform one or more of the processes and functions described elsewhere herein.

[0059] In an embodiment, the I / O interface 235 provides an interface between one or more components of the system 200 and one or more input and / or output devices. Example input devices include, but are not limited to, sensors, keyboards, touch screens or other touch-sensitive devices, cameras, biometric sensing devices, computer mice, trackballs, and / or pen-based pointing devices, etc. Examples of output devices include, but are not limited to, other processing devices, cathode ray tubes (CRTs), plasma displays, light emitting diode (LED) displays, liquid crystal displays (LCDs), printers, vacuum fluorescent displays (VFDs), surface conduction electron emitter displays (SEDs), and / or field emission displays (FEDs), etc. In some cases, input and output devices may be combined, such as in the case of a touch panel display (e.g., in a smartphone, tablet computer, or other mobile device).

[0060] System 200 may also include optional wireless communication components that facilitate wireless communication over a voice network and / or a data network. The wireless communication components include antenna system 270, radio system 265, and baseband system 260. In system 200, radio frequency (RF) signals are transmitted and received over the air by antenna system 270 under the management of radio system 265.

[0061] In an embodiment, the antenna system 270 may include one or more antennas and one or more multiplexers (not shown) that perform switching functions to provide transmit and receive signal paths for the antenna system 270. In the receive path, the received RF signal may be coupled from the multiplexer to a low noise amplifier (not shown) that amplifies the received RF signal and sends the amplified signal to the radio system 265.

[0062] In an alternative embodiment, the radio system 265 may include one or more radios configured to communicate on various frequencies. In an embodiment, the radio system 265 may combine a demodulator (not shown) and a modulator (not shown) in one integrated circuit (IC). The demodulator and modulator may also be separate components. In the incoming path, the demodulator removes the RF carrier signal, leaving a baseband receive audio signal that is sent from the radio system 265 to the baseband system 260.

[0063] The baseband system 260 is also communicatively coupled to the processor(s) 210. The processor(s) 210 may access the data storage areas 215 and 220. The processor(s) 210 are preferably configured to execute instructions (i.e., computer programs, such as the disclosed protection layer 155) which may be stored in the main memory 215 or the secondary memory 220. The computer programs may also be received from the baseband processor 260 and stored in the main memory 210 or the secondary memory 220, or executed upon receipt. Such computer programs, when executed, may enable the system 200 to perform the various functions of the disclosed embodiments.

[0064] 2. Process Overview

[0065] An embodiment of a process for securely controlling SCBs in a power line will now be described in detail. It should be understood that the described process may be embodied in one or more software modules executed by one or more hardware processors (e.g., processor 210) of the controller 154, such as embodied as protection layer 155, stored in a memory (e.g., main memory 215) of the controller 154. The described process may be implemented as instructions represented in source code, object code, and / or machine code. These instructions may be directly executed by the (multiple) hardware processors 210 of the controller 154, or alternatively, may be executed by a virtual machine running between the object code and the (multiple) hardware processors 210 of the controller 154.

[0066] Alternatively, the described process can be implemented as a hardware component (e.g., a general purpose processor, an integrated circuit (IC), an application specific integrated circuit (ASIC), a digital signal processor (DSP), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic, etc.), a combination of hardware components, or a combination of hardware components and software components. In order to clearly illustrate the interchangeability of hardware and software, various illustrative components, blocks, modules, circuits and steps are generally described herein according to their functions. Whether such functions are implemented as hardware or software depends on the specific application and the design constraints imposed on the entire system. The technician can use different ways to implement the described functions for each specific application, but such implementation decisions should not be interpreted as causing departure from the scope of the present invention. In addition, the functional grouping within the components, blocks, modules, circuits or steps is for ease of description. Without departing from the present invention, a specific function or step can be moved from one component, block, module, circuit or step to another.

[0067] In addition, although the processes described herein are illustrated by certain arrangements and sequencing of subprocesses, each process can be implemented by fewer, more, or different subprocesses and different arrangements and / or sequencing of subprocesses. In addition, it should be understood that any subprocess that is not dependent on the completion of another subprocess can be performed before, after, or in parallel with the other independent subprocess, even if the subprocesses are described or illustrated in a particular order.

[0068] 2.1. Protective layer

[0069] Figure 3 A process 300 is illustrated that may be implemented by the protection layer 155 of the controller 154 of each SCB station 150 according to an embodiment. The process 300 may be initiated when the controller 154 is booted and executed while the controller 154 remains active. The process 300 may be executed in the background of the controller 154 to evaluate each command received by the controller 154 in a remote control signal from the line protection system 130 and / or other control systems 140 before the controller 154 executes the command. The process 300 is designed to prevent cyber attacks against remote control signals sent by remote systems external to the SCB station 150, such as the line protection system 130 and other control systems 140. Such cyber attacks may include altering legitimate remote control signals before the controller 154 receives them and / or sending false remote control signals to the controller 154.

[0070] Process 300 may include two threads that may be executed independently of each other. The first thread includes subprocesses 310 and 320 to collect data about the dynamic conditions of power system 100. The second thread includes subprocesses 330 to 380 to evaluate each command received by controller 154.

[0071] In subprocess 310, process 300 monitors data related to power system 100. For example, the data may include current measurements obtained from (multiple) current measuring devices 116, voltage measurements obtained from (multiple) voltage measuring devices 118, and / or other local indicators obtained from other sensors and / or derived from these sensors. The data can be monitored in real time at a high sampling rate. As used herein, the term "real time" or "real-time" covers simultaneous events and events delayed in time due to the common waiting time of processing, storage, communication, etc. As long as no new data is received (i.e., "no" in subprocess 310), process 300 continues to monitor new data. In the case of receiving new data (i.e., "yes" in subprocess 310), process 300 proceeds to subprocess 320.

[0072] In subprocess 320, new data may be processed according to a sliding window ranging from tens of milliseconds to several seconds. While processing the data, process 300 may update a physical state 325 of the power system 100. For example, a representation of the physical state 325 of the power system 100 may be stored in a memory (e.g., the main memory 215 and / or the auxiliary memory 220 of the controller 154). The physical state 325 may include real-time measurements and / or information derived from real-time measurements, including, for example, dynamic condition indicators, such as derivatives of line currents within a sliding window, incremental line flow changes, grid frequency deviations, and / or voltage phase angle changes, etc. In the event of receiving new data, the controller 154 may continue to update the stored representation of the physical state 325 in real time.

[0073] In subprocess 330, process 300 monitors remote control signals received from remote systems such as line protection system 130 and / or control system 140 (e.g., RAS system 142, SCADA / EMS 144, WAMPAC system 146, etc.) to identify commands within these remote control signals. As long as no new commands are received (i.e., "No" in subprocess 330), process 300 continues to monitor for new commands. Each time a new command is received (i.e., "Yes" in subprocess 330), an iteration through the loop formed by subprocesses 340 to 380 is performed.

[0074] In subprocess 340, process 300 evaluates whether the command is consistent with physical state 325 of power system 100. In particular, protection layer 155 may access a representation of physical state 325 and execute one or more safety functions configured to detect anomalies in physical state 325 and / or otherwise evaluate physical state 325. Protection layer 155 may also execute logic to determine whether the command is consistent with physical state 325 based on the output of the safety function(s). For example, the logic may apply one or more rules to the command and the output of the safety function(s) to evaluate whether the command is consistent with physical state 325. Such consistency evaluation is described in more detail elsewhere herein.

[0075] If the evaluation result in subprocess 340 is that the command is consistent with physical state 325 (i.e., "yes" in subprocess 350), the command can be executed in subprocess 360. Otherwise, if the evaluation result in subprocess 340 is that the command is inconsistent with physical state 325 (i.e., "no" in subprocess 350), the command can be blocked in subprocess 370 and / or an alarm can be issued in subprocess 380.

[0076] It should be understood that blocking a command means that the command is not executed. In this case, the command can be discarded, ignored or delayed until the condition is met. For example, in an embodiment in which the execution of the command is delayed until the condition is met, an alarm can be provided to the operator in subprocess 380 (e.g., via a graphical user interface of SCADA / EMS144 or other system, an email or text message, etc.), and the operator can be required to approve the command before executing the command (e.g., via a graphical user interface of SCADA / EMS144 or other system, reply to an email or text message, etc.). As another example, the protection layer 155 can trigger a confirmation function in response to determining that the command is inconsistent with the physical state 325 (i.e., "no" in subprocess 350) to confirm the physical state 325 and / or the determined inconsistency. In this case, the protection layer 155 can delay the execution of the command until and unless a confirmation is received from the confirmation function. The confirmation function can include requesting or waiting for confirmation from an external system, executing a higher fidelity detection algorithm to confirm the conditions in the power system 100 based on which the consistency assessment in subprocess 340 is based, and the like.

[0077] 2.2. Conformity Assessment

[0078] As discussed above, subprocess 340 of process 300 evaluates whether the received command is consistent with the physical state 325 of power system 100. In particular, protection layer 155 may perform one or more safety functions and execute logic on the output of the safety function(s) whenever a command is evaluated for consistency.

[0079] Figure 4 An example of a safety function 400 that can be employed by the protection layer 155 according to an embodiment is illustrated. It should be understood that not all of the illustrated safety functions 400 must be used in a particular embodiment. Instead, the protection layer 155 can implement more safety functions, fewer safety functions, or different combinations of safety functions in the illustrated safety functions 400, and / or more modules, fewer modules, or different combinations of modules in its constituent modules. In an embodiment, the safety function 400 includes a line fault detection (LFD) function 410, a system disturbance detection (SDD) function 420, and / or an interlocking scheme (IS) function 430. The LFD function 410 determines whether there is a line fault within the detection zone, the SDD function 420 determines whether there is a system disturbance (e.g., caused by a critical generation or transmission outage) within the power system 100, and the IS function 430 can determine the load on the power line 110 and / or detect continuous switching.

[0080] The LFD function 410 may include a current derivative module 412, a directional module 414, a zero-sequence current module 416, and the like. The current derivative module 412 may, for example, calculate the derivative of the current in the power line 110 based on the continuous measurement of the current by the (multiple) current measuring devices 116. Typically, a sudden rise in the current derivative (e.g., above a threshold) indicates the presence of a line fault. The directional module 414 may determine the direction of the fault on the power line 110, and the zero-sequence current module 416 may calculate the zero-sequence current in the power line 110. Under normal system conditions, the zero-sequence current in the power line 110 is small and negligible. Therefore, a sudden rise in the zero-sequence current (e.g., above a threshold) indicates the presence of a line-to-ground fault. In general, the LFD function 410 may determine whether there is a line fault in the power line 110 within the detection zone (e.g., a main detection zone defined by the reach setting of the portion of the power line 110 covered by the LFD function 410, for example) based on the outputs of the current derivative module 412, the directional module 414, the zero-sequence current module 416, and the like. LFD functionality 410 may operate in real-time as data is received and stored in a representation of physical state 325 of power system 100 , such that a current indication of whether a line fault is present in power line 110 is always available at all times.

[0081] The detection zone of the LFD function 410 may be approximately 50% to 80% of the length of the power line 110. The LFD function 410 is typically not configured to cover the entire length of the power line 110 for the following reasons: (i) the fault detection algorithm of the LFD function 410 is typically based on local measurements and therefore cannot distinguish between a remote fault at the end of the power line 110 and an external fault in the forward direction; and (ii) the TRV problem is less severe for clearing remote line faults.

[0082] The SDD function 420 may include an emergency power transmission detection module 422, a frequency disturbance detection module 424, an abnormal voltage detection module 426, and the like. The emergency power transmission detection module 422 may determine whether a power transmission interruption or an emergency power transmission to or from the power line 110 has occurred (e.g., by comparing the power flow in the power line 110 stored in the physical state 325 before and after receiving the command). It should be understood that an emergency power transmission is any power transmission between power lines due to an emergency situation (e.g., another power line (such as a DC link) is interrupted, the power line 110 is interrupted, etc.). The frequency disturbance detection module 424 may determine whether there is a power generation interruption or a frequency disturbance in the power line 110 (e.g., by comparing the frequency in the power line 110 stored in the physical state 325 before and after receiving the command). It should be understood that a frequency disturbance is any abnormal or unexpected frequency in the power line 110 (e.g., a frequency above or below a threshold, a rate of change of frequency above a threshold, etc.). The abnormal voltage detection module 426 can determine whether an abnormal voltage exists in the power line 110 (e.g., by comparing the voltage in the power line 110 stored in the physical state 325 before and after receiving the command). It should be understood that an abnormal voltage is any voltage that appears abnormal or unexpected in the power line 110 (e.g., a voltage that is higher or lower than a threshold). In general, the SDD function 420 can determine whether there is a system disturbance in the power system 100 and / or what type of system disturbance exists in the power system 100. The system disturbance can be any one or a combination of emergency power transmission, frequency disturbance, abnormal voltage, and / or any other abnormal event on the power line 110, the presence and / or absence of which can be detected from the measurement values ​​received from the controller 154. The SDD function 420 can operate in real time as data is received and stored in the representation of the physical state 325 of the power system 100, so that a current indication of whether there is a system disturbance in the power system 100 is always available at any time. However, in an embodiment, the SDD function 420 operates in response to receiving a command. Additionally, the specific module(s) (eg, 422, 424, or 426) to be executed may be selected based on the command.

[0083] The IS function 430 may include a load detection module 432, a continuous switching detection module 434, etc. The load detection module 432 may detect the load on the power line 110. For example, in the case where the load is below a first threshold, the load may be characterized as low, in the case where the load exceeds the first threshold and is below a second threshold, the load may be characterized as normal, and in the case where the load exceeds the second threshold, the load may be characterized as high. The continuous switching detection module 434 may detect whether a command is received within a time window from the execution of a previous command.

[0084] It is assumed that any command 450 received by the controller 154 may be malicious. Therefore, the protection layer 155 evaluates each command 450 received. Whenever a command 450 is to be evaluated (e.g., in a subprocess 340 of the process 300), the logic 440 can be executed with the output of the (multiple) security function 400 and the command 450 as input to output a consistency evaluation determination 460 (e.g., for determining whether to allow or block the command in the subprocess 350). The logic 440 can apply one or more rules to the output of the (multiple) security function 400 and the command 450 to render the consistency evaluation determination 460.

[0085] As an example, the protection layer 155 may receive a command 450 for bypassing the SCB 151 in a remote control signal purportedly sent from the line protection system 130. The logic 440 may access an indication of whether a line fault exists in a detection zone on the power line 110 (most recently output by the LFD function 410) to determine whether a line fault exists. In the event that the command 450 is for bypassing the SCB 151 and the LFD function 410 determines that there is no line fault within the detection zone, the logic 440 may determine that the command 450 is inconsistent with the physical state 325 of the power system 100 (e.g., a "no" in the sub-process 350 of the process 300). On the other hand, in the event that the command 450 is for bypassing the SCB 151 and the LFD function 410 determines that there is a line fault within the detection zone, the logic 440 may determine that the command 450 is consistent with the physical state 325 of the power system 100 (e.g., a "yes" in the sub-process 350 of the process 300).

[0086] Notably, in embodiments where the LFD function 410 operates in the background to determine in real time whether a line fault exists, the logic 440 can determine the consistency of the command 450 very quickly (e.g., within a few milliseconds from receiving the command 450). This is because the logic 440 applies the rules to the existing output from the LFD function 410 without having to calculate new output from the LFD function 410. Thus, the disclosed embodiments ensure that a fast bypass of the SCB 151 can be achieved when a line fault occurs, while providing security against inconsistent and potentially malicious commands.

[0087] As another example, the protection layer 155 may receive a command 450 for inserting the SCB 151 in a remote control signal sent from the control system 140 (e.g., the RAS system 142, the WAMPAC system 146, etc.) purportedly in response to a major power transmission interruption. The logic 440 may obtain an output of an emergency power transmission detection module 422 of the SDD function 420, which may be responsive to receiving the command 450 or executed by the logic 440. The emergency power transmission detection module 422 may check for power flow changes in the power line 110 to determine whether there is an emergency power transmission to the power line 110 within a time window before and after receiving the remote control signal including the command 450. In the event that the command 450 is for inserting the SCB 151 and the SDD function 420 determines that there is no emergency power transmission within the time window, the logic 440 may determine that the command 450 is inconsistent with the physical state 325 of the power system 100 (e.g., "No" in the subprocess 350 of the process 300). On the other hand, where command 450 is for inserting SCB 151 and SDD function 420 determines that an emergency power transfer exists, logic 440 may determine that command 450 is consistent with physical state 325 of power system 100 (eg, “yes” in subprocess 350 of process 300 ).

[0088] As another example, the protection layer 155 may receive a command 450 for inserting or bypassing the SCB 151 in a remote control signal sent from the control system 140 (e.g., the RAS system 142, the WAMPAC system 146, etc.) purportedly in response to a frequency disturbance. The logic 440 may obtain an output of a frequency disturbance detection module 424 of the SDD function 420, which may be in response to receiving the command 450 or executed by the logic 440. The frequency disturbance detection module 424 may analyze the physical state 325 to determine whether there is a frequency disturbance within a time window before and after receiving the remote control signal including the command 450. In the event that the command 450 is for one of inserting the SCB 151 or bypassing the SCB 151 and the SDD function 420 determines that there is no frequency disturbance within the time window, the logic 440 may determine that the command 450 is inconsistent with the physical state 325 of the power system 100 (e.g., "No" in the subprocess 350 of the process 300). On the other hand, in the event that the command 450 is for inserting the other of the SCB 151 or bypassing the SCB 151 and the SDD function 420 determines that there is a frequency disturbance, the logic 440 may determine that the command 450 is consistent with the physical state 325 of the power system 100 (e.g., "yes" in the subprocess 350 of the process 300). It should be understood that whether the command 450 for inserting the SCB 151 or bypassing the SCB 151 is consistent with the frequency disturbance will depend on the specific frequency disturbance detected.

[0089] As another example, the protection layer 155 may receive a command 450 for inserting or bypassing the SCB 151 in a remote control signal sent from the control system 140 (e.g., the RAS system 142, the WAMPAC system 146, etc.) purportedly in response to an abnormal voltage. The logic 440 may obtain an output of an abnormal voltage detection module 426 of the SDD function 420, which may be in response to receiving the command 450 or executed by the logic 440. The abnormal voltage detection module 426 may analyze the physical state 325 to determine whether an abnormal voltage exists within a time window before and after receiving the remote control signal including the command 450. In the event that the command 450 is for one of inserting the SCB 151 or bypassing the SCB 151 and the SDD function 420 determines that there is no abnormal voltage within the time window, the logic 440 may determine that the command 450 is inconsistent with the physical state 325 of the power system 100 (e.g., "No" in the subprocess 350 of the process 300). On the other hand, in the event that the command 450 is for inserting the other of the SCB 151 or bypassing the SCB 151 and the SDD function 420 determines that an abnormal voltage exists, the logic 440 may determine that the command 450 is consistent with the physical state 325 of the power system 100 (e.g., "yes" in the subprocess 350 of the process 300). It should be understood that whether the command 450 for inserting the SCB 151 or bypassing the SCB 151 is consistent with the abnormal voltage will depend on the specific voltage abnormality detected.

[0090] It is worth noting that in embodiments where the SDD function 420 is executed in response to receiving the command 450, the associated modules (e.g., 422, 424, 426, etc.) being executed may be constrained to execute and produce outputs within a time window from the receipt of the remote control signal including the command 450. The logic 440 may utilize any output produced within the time window to determine the consistency of the command 450 with the physical state 325. The time window may be several hundred milliseconds (e.g., within 500 milliseconds) from the receipt of the remote control signal. This ensures that rapid insertion or bypassing of the SCB 151 may be achieved to prevent damage to the power system 100.

[0091] In an embodiment, the SDD function 420 can be used as a defense against a denial of service (DoS) attack. In a DoS attack, a remote control command from the control system 140 (e.g., the RAS system 142) is blocked or disrupted by an attacker. For example, if an attacker successfully blocks an insertion command from the RAS system 142, this may cause severe power swings in the power line 110 during an abnormal line flow increase. If the SCB 151 is not quickly inserted, the power system 100 may become unstable. Therefore, the SDD function 420 continuously monitors the physical state 325 of the power system 100 and determines whether the dynamic condition represented by the physical state 325 satisfies a predefined condition, including one or more criteria indicating a system disturbance. It should be understood that the emergency power transmission detection module 422, the frequency disturbance detection module 424, the abnormal voltage detection module 426, and / or other modules of the SDD function 420 can each detect predefined conditions representing different system disturbances. Whenever the SDD function 420 detects a system disturbance or some severe system disturbance, the SDD function 420 automatically issues an alarm (e.g., in the same or similar manner as in subprocess 380 of process 300). Additionally or alternatively, whenever the SDD function 420 detects a system disturbance or some severe system disturbance, the SDD function 420 automatically initiates a rapid insertion of the SCB 151. In particular, the SDD function 420 may instruct the controller 154 to open the bypass breaker 152.

[0092] As another example, the protection layer 155 may receive a command 450 for inserting or bypassing the SCB 151 in a remote control signal purportedly sent from the control system 140 (e.g., SCADA / EMS 144). The logic 440 may obtain an output of a load detection module 432 of the IS function 430, which may be responsive to receiving the command 450 or executed by the logic 440. The load detection module 432 may analyze the physical state 325 to determine the current load on the power line 110. In the event that the command 450 is for inserting the SCB 151 and the current load is below a first threshold (indicating a low load), the logic 440 may determine that the command 450 is inconsistent with the physical state 325 of the power system 100. Similarly, in the event that the command 450 is for bypassing the SCB 151 and the current load exceeds a second threshold (indicating a high load), the logic 440 may determine that the command 450 is inconsistent with the physical state 325 of the power system 100. Bypassing the SCB 151 under high load conditions may overload other parallel power lines. On the other hand, in the case where the command 450 is for inserting the SCB 151 and the current load exceeds the second threshold (indicating a high load), the logic 440 may determine that the command 450 is consistent with the physical state 325 of the power system 100. Likewise, in the case where the command 450 is for bypassing the SCB 151 and the current load is below the first threshold (indicating a low load), the logic 440 may determine that the command 450 is consistent with the physical state 325 of the power system 100. In principle, the SCB 151 should be inserted under high load conditions and bypassed under low load conditions.

[0093] As another example, the protection layer 155 may receive a command 450 for inserting or bypassing the SCB 151 in a remote control signal purportedly sent from the control system 140 (e.g., the SCADA / EMS 144). The logic 440 may obtain an output of a continuous switching detection module 434, which may be responsive to receiving the command 450 or executed by the logic 440. The continuous switching detection module 434 may determine whether the current command 450 is received within a time window from executing a previous command and represents a switch in the state of the SCB 151 relative to the previous command. For example, in the case where the current command 450 is for inserting the SCB 151 and is received within a time window from executing a previous command for bypassing the SCB 151, the logic 440 may determine that the current command 450 is inconsistent with the physical state 325 of the power system 100. Likewise, in the event that the current command 450 is for bypassing the SCB 151 and is received within a time window from the execution of a previous command for inserting the SCB 151, the logic 440 may determine that the current command 450 is inconsistent with the physical state 325 of the power system 100. Continuous switching between inserting and bypassing the SCB 151 within a short period of time may result in forced power swings, inter-area power oscillations, and instability in the poorly damped power system 100. The time window may be set to an appropriate length of time to prevent these swings and instability in the power system 100, thereby preventing malicious switching commands.

[0094] It should be appreciated that the logic 440 may combine the outputs of two or more safety functions 400 to produce a consistency evaluation determination 460. In particular, the logic 440 may apply rules for resolving conflicts between two or more safety functions 400. For example, if the evaluation of the command 450 across all safety functions 400 determines that the command 450 is consistent with the physical state 325, then the consistency evaluation determination 460 may be that the command 450 is consistent with the physical state 325. Likewise, if the evaluation of the command 450 across all safety functions 400 determines that the command 450 is inconsistent with the physical state 325, then the consistency evaluation determination 460 may be that the command 450 is inconsistent with the physical state 325. In an embodiment, if there are mixed determinations (i.e., one or more consistency determinations and one or more inconsistency determinations), the logic 440 can apply rules to render the final consistency evaluation determination 460, such as always determining that the command 450 is inconsistent with the physical state 325, selecting a consensus determination when there are three or more safety functions 400, prioritizing the safety functions 400 and selecting the determination of the highest priority safety function 400, weighting the safety functions 400 and selecting the determination with the highest weight, and so on.

[0095] 3. Example scenario

[0096] The performance of the disclosed embodiments with respect to example scenarios will now be described. It should be understood that these are non-limiting examples intended to illustrate the operation of the disclosed embodiments, and are not a requirement of any embodiment.

[0097] Figure 5A and Figure 5B The states of the power system 100 before and after a line fault according to an example scenario are illustrated respectively. In the illustrated scenario, the power system 100 is a transmission system that transmits power along a transmission corridor between region A and region B. The transmission corridor consists of a high-voltage direct current (DC) link 160 and an AC link having two AC transmission lines 110A and 110B. Each AC transmission line 110A and 110B is compensated in series by two SCB stations 150. In particular, the AC transmission line 110A includes a circuit breaker 120A, an SCB station 150A, an SCB station 150B, and a circuit breaker 120B connected in series from region A to region B. Similarly, the AC transmission line 110B includes a circuit breaker 120C, an SCB station 150C, an SCB station 150D, and a circuit breaker 120D connected in series from region A to region B.

[0098] exist Figure 5A In the illustrated pre-fault condition, the SCB 151 of each SCB station 150A to 150D is inserted (i.e., each corresponding bypass breaker 152 is in the open state), and all circuit breakers 120A to 120D are closed. Therefore, both AC transmission lines 110A and 110B are series compensated. Under the fault condition, a three-phase to ground fault occurs at approximately the middle of the AC transmission line 110B, so it is within the detection zone of the LFD function 410 for both SCB stations 150C and 150D. The line protection system 130 will issue bypass commands to the SCB stations 150C and 150D on the AC transmission line 110B and open the circuit breakers 120C and 120D on the AC transmission line 110B. Therefore, under the fault condition, the three-phase to ground fault occurs at approximately the middle of the AC transmission line 110B, so it is within the detection zone of the LFD function 410 for both SCB stations 150C and 150D. The line protection system 130 will issue bypass commands to the SCB stations 150C and 150D on the AC transmission line 110B and open the circuit breakers 120C and 120D on the AC transmission line 110B. Figure 5B In the illustrated post-fault condition, the SCB 151 of each SCB station 150C and 150D on the AC transmission line 110B is bypassed (i.e., the corresponding bypass circuit breaker 152 is switched to a closed state). Thereafter, the circuit breakers 120C and 120D on the AC transmission line 110B are opened. Bypassing the SCB 151 in this manner can mitigate transient recovery voltages before opening the corresponding circuit breaker 120. It is noteworthy that no changes occur to the AC transmission line 110A.

[0099] According to an embodiment, Figure 6 By representing the same timeline (in seconds) Figure 5A and Figure 5B, which respectively illustrate the current of each of the three phases of the AC transmission line 110B, the output of the LFD function 410 and the remote control signal received from the line protection system 130, the position of the bypass breaker 152, and the position of the circuit breaker 120 of each of the three phases of the AC transmission line 110B. Figure 6 Graph A in illustrative examples illustrates the currents of the three phases of the AC transmission line 110B.

[0100] Figure 6 Graph B in FIG illustrates the time when the LFD function 410 detects the line fault relative to the time when the remote control signal including the command to bypass the SCB 151 is received from the line protection system 130. A value of 0 indicates that the signal is not present, and a value of 1 indicates that the signal is present. As illustrated, the LFD function 410 detects the line fault relatively quickly (i.e., within about 5 milliseconds after the line fault occurs). Typically, the line protection system 130 can detect the line fault within the detection zone within a half-cycle time. The communication of the bypass command from the line protection system 130 to the SCB station 150 may increase the communication delay (e.g., about 2 milliseconds). Therefore, the LFD function 410 detects the line fault before receiving the remote control signal including the bypass command from the line protection system 130. Therefore, since the line fault has been confirmed when the bypass command is received, the logic 440 can immediately determine that the bypass command is consistent with the physical state 325 (i.e., "yes" in the subprocess 350 of the process 300), and the controller 154 can quickly execute the bypass command (e.g., the subprocess 360 of the process 300). It should be appreciated that graph B may represent the operation of each of SCB stations 150C and 150D.

[0101] Figure 6 Graphs C and D in FIG. 1 represent the position of the bypass breaker 152 on the AC transmission line 110B and the position of the circuit breaker 120 of each phase of the AC transmission line 110B, respectively. A value of 0 represents a closed state, and a value of 1 represents an open state. As illustrated, due to the rapid determination of the protection layer 155, the bypass breaker 152 is closed shortly after receiving the bypass command from the line protection system 130. It is worth noting that due to the different current zero-crossing moments, the circuit breaker 120 of phase C is opened half a cycle after the circuit breakers 120 of phases A and B are opened. It should be understood that the graphs C and D can represent the operation of each SCB station 150C and 150D and each circuit breaker 120C and 120D, respectively.

[0102] It is noteworthy that in the scenario described above, the remote control signal is a valid signal that is determined to be consistent. In the event that the remote control signal from the line protection system 130 is malicious, the signal from the line fault detection module 410 will never indicate the presence of a line fault (i.e., will remain at a value of 0). Therefore, the bypass breaker 152 on the AC transmission line 110B will remain open. In other words, the logic 440 may determine that the commands are consistent when both the signal from the line fault detection module 410 and the signal from the line protection system 130 have a value of 1. Conversely, the logic 440 may determine that the commands are inconsistent when the value of the signal from the line fault detection module 410 is 0 and the value of the signal from the line protection system 130 is 1. It should be understood that when the value of the signal from the line protection system 130 is 0, the logic 440 may not execute because it means that the command has not been received.

[0103] Fig. 7A and Figure 7B States of the power system 100 before and after emergency power transmission according to example scenarios are respectively illustrated. Fig. 7A and Figure 7B Components of the power system 100 and Figure 5A and Figure 5B The components of the power system 100 are the same as those in the present invention, and thus will not be described in detail herein.

[0104] exist Fig. 7A In the illustrated pre-transmission condition, the SCB 151 of each SCB station 150A to 150D is bypassed (i.e., each corresponding bypass breaker 152 is in a closed state), and all circuit breakers 120A to 120D are closed. Therefore, neither AC transmission line 110A nor 110B is series compensated. Figure 7B As illustrated in , the DC link 160 is forcibly interrupted, which causes a severe system disturbance, resulting in an emergency power transmission to the AC lines 110A and 110B. Therefore, the RAS system 142 will issue insertion commands to the SCB stations 150A to 150D to effectively compensate for the line inductance of the AC transmission lines 110A and 110B and enhance the stability of the power system 100 against high power swings. Figure 7B In the illustrated post-transmission condition, the SCB 151 of each SCB station 150A to 150D is plugged in (ie, the corresponding bypass breaker 152 is switched to the open state). The circuit breakers 120A to 120D remain closed.

[0105] According to an embodiment, Figure 8 By representing the same timeline (in seconds) Fig. 7A and Figure 7B, which respectively illustrate the load on the DC link 160 and the AC link consisting of power lines 110A and 110B, the output of the SDD function 420 and the remote control signal received from the RAS system 142, and the position of the bypass breaker 152 of each of the SCB stations 150A to 150D. Figure 8 Graph A in illustrates power flow on the DC link 160 and the AC link, and depicts an interruption of the DC link 160 at a time of approximately 6 seconds along the timeline.

[0106] Figure 8 Graph B of illustrates the time when the emergency power transmission detection module 422 of the SDD function 420 detects the emergency power transmission relative to the time when the remote control signal including the command to insert the SCB 151 is received from the RAS system 142. A value of 0 indicates that the signal is not present, and a value of 1 indicates that the signal is present. In this scenario, it is assumed that the RAS system 142 sends the remote control signal immediately after the interruption of the DC link 160 occurs without any time delay, but this may not be the case in reality. As illustrated, after receiving the insertion command, the emergency power transmission detection module 422 detects the emergency power transmission relatively quickly (e.g., within 1 second). Therefore, the logic 440 can quickly determine that the insertion command is consistent with the physical state 325 (i.e., "yes" in the sub-process 350 of the process 300), and the controller 154 can quickly execute the insertion command (e.g., the sub-process 360 of the process 300). It should be understood that Graph B can represent the operation of each SCB station 150A to 150D.

[0107] Figure 8 Graph C of 150A represents the position of the bypass breaker 152, where a value of 0 represents a closed state and a value of 1 represents an open state. As illustrated, the bypass breaker 152 is opened immediately after the emergency power transmission detection module 422 of the SDD function 420 detects an emergency power transmission, which is detected shortly after receiving the insertion command from the RAS system 142. It should be understood that the graph C can represent the operation of each SCB station 150A to 150D.

[0108] It is noteworthy that in the scenario described above, the remote control signal is a valid signal that is determined to be consistent. In the case where the remote control signal from the RAS system 142 is malicious, the signal from the SDD function 420 will never indicate the presence of a system disturbance (i.e., will remain at a value of 0). Therefore, the bypass circuit breakers 152 of the SCB stations 150A to 150D will remain closed. In other words, the logic 440 can determine that when the value of the signal from the emergency power transmission detection module 422 and the signal from the RAS system 142 are both 1, the command is consistent. Conversely, the logic 440 can determine that when the value of the signal from the emergency power transmission detection module 422 is 0 and the value of the signal from the RAS system 142 is 1, the command is inconsistent. It should be understood that when the value of the signal from the RAS system 142 is 0, the logic 440 may not execute because it means that the command has not been received.

[0109] 4. Example Embodiments

[0110] The power system 100 (e.g., a transmission system) may include one or more SCBs 151 in one or more SCB stations 150 on one or more power lines 110. Each SCB station 150 may be controlled by a remote control signal sent by a remote system (e.g., a line protection system 130 or one or more control systems 140) to insert or bypass its corresponding SCB 151 according to a dispatch operation or an emergency switching operation. For example, the SCB station 150 may receive a command for a dispatch operation from a system operator via the SCADA / EMS 144, receive a fast bypass command for TRV reduction from the line protection system 130, receive a fast bypass or insertion command from a system protection scheme (e.g., implemented in (multiple) control systems 140) as part of a stability enhancement strategy for critical generation or transmission outages, etc.

[0111] A hacker may gain access to a communication channel in the power system 100 and send an unauthorized or altered insertion command or bypass command to the SCB station 150 to manipulate the position of the SCB 151. These malicious commands may cause the condition of the power system 100 to deteriorate and risk instability, potentially leading to a collapse of the power system 100. Therefore, preventing malicious control of the SCB 151 is considered critical.

[0112] In an embodiment, one or more and potentially all SCB stations 150 in the power system 100 may include a controller 154 that stores and executes a protection layer 155. The protection layer 155 may intercept all commands received from remote systems (e.g., line protection system 130, control system 140, etc.) to insert or bypass the SCB 151 of the SCB station 150 and evaluate whether the command is consistent with the physical state 325 of the power system 100. The evaluation may utilize local real-time measurements of voltage and current monitored by the controller 154, one or more safety functions 400 that detect one or more conditions in the real-time measurements, and logic 440 that applies one or more rules to the detected condition(s) and commands. Based on the evaluation, the protection layer 155 may determine whether to execute a given command (e.g., in subprocess 360 of process 300) or block a given command (e.g., in subprocess 370 of process 300). In this way, the protection layer 155 may prevent cyber attacks aimed at manipulating the location of SCBs in the power line 110.

[0113] Embodiments of the protection layer 155 are capable of quickly and reliably detecting line faults within a detection zone (e.g., a primary detection zone) and system disturbances that indicate incidents of interest. Additionally, embodiments of the protection layer 155 utilize efficient detection algorithms to detect local measurement-based conditions of interest, and utilize logic 440 to apply one or more rules to evaluate command consistency, which is easily implemented in the controller 154 of the SCB station 150. Additionally, in embodiments, the SDD function 420 can be used as a defense against DoS attacks by initiating rapid SCB bypass or insertion in the event that a control command (e.g., from the RAS system 142) is compromised or blocked by an attacker. The protection layer 155 can also block unwanted control commands sent by a malfunctioning remote system.

[0114] Embodiment 1: A method, comprising using at least one hardware processor within a controller of a series capacitor bank (SCB) station to perform the following operations: receiving a remote control signal from a system external to the SCB station, wherein the remote control signal represents a command for electrically inserting the SCB into a power line within a power system or bypassing the SCB; evaluating whether the command is consistent with a physical state of the power system; if the command is inconsistent with the physical state of the power system, preventing the controller from executing the command; and if the command is consistent with the physical state of the power system, allowing the controller to execute the command.

[0115] Embodiment 2: The method of embodiment 1 further comprises using the at least one hardware processor to initiate an alert to one or more recipients if the command is inconsistent with a physical state of the power system.

[0116] Embodiment 3: The method as described in any of the aforementioned embodiments further includes using the at least one hardware processor to perform a line fault detection (LFD) function, the LFD function determining whether there is a line fault within a detection zone, wherein evaluating whether the command is consistent with the physical state of the power system includes: determining that the command is inconsistent with the physical state of the power system when the command is for bypassing the SCB and is received when it is determined by the LFD function that there is no line fault within the detection zone; and determining that the command is consistent with the physical state of the power system when the command is for bypassing the SCB and is received when it is determined by the LFD function that there is a line fault within the detection zone.

[0117] Embodiment 4: The method as described in Embodiment 3, wherein the remote control signal is received from a line protection system.

[0118] Embodiment 5: The method as described in any of the foregoing embodiments further includes using the at least one hardware processor to perform a system disturbance detection (SDD) function, wherein the SDD function determines whether there is a system disturbance in the power system, wherein evaluating whether the command is consistent with the physical state of the power system includes: within a time window before and after receiving the remote control signal, determining whether the command is consistent based on the presence or absence of the system disturbance as determined by the SDD function.

[0119] Embodiment 6: A method as described in Embodiment 5, wherein the system disturbance includes emergency power transmission, and wherein determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent when the command is for inserting the SCB and it is determined by the SDD function that there is no emergency power transmission within the time window; and determining that the command is consistent when the command is for inserting the SCB and it is determined by the SDD function that there is emergency power transmission within the time window.

[0120] Embodiment 7: A method as described in Embodiment 5 or 6, wherein the system disturbance includes a frequency disturbance, and wherein determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent when the command is for inserting one of the SCB or bypassing the SCB and the SDD function determines that there is no frequency disturbance within the time window; and determining that the command is consistent when the command is for inserting the SCB or bypassing the other of the SCB and the SDD function determines that there is a frequency disturbance within the time window.

[0121] Embodiment 8: A method as described in any one of Embodiments 5 to 7, wherein the system disturbance includes an abnormal voltage, and wherein determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent when the command is for inserting one of the SCB or bypassing the SCB and the SDD function determines that there is no abnormal voltage within the time window; and determining that the command is consistent when the command is for inserting the SCB or bypassing the other of the SCB and the SDD function determines that there is an abnormal voltage within the time window.

[0122] Embodiment 9: The method as described in any one of embodiments 5 to 8, wherein the remote control signal is received from a remedial action solution (RAS) system, an energy management system (EMS), or a wide area monitoring, protection and control (WAMPAC) system.

[0123] Embodiment 10: A method as described in any of the aforementioned embodiments, wherein evaluating whether the command is consistent with the physical state of the power system comprises: determining that the command is inconsistent with the physical state of the power system when the command is for inserting the SCB and the current load of the transmission line is lower than a first threshold, or the command is for bypassing the SCB and the current load of the transmission line exceeds a second threshold; and determining that the command is consistent with the physical state of the power system when the command is for inserting the SCB and the current load of the transmission line exceeds the second threshold, or the command is for bypassing the SCB and the current load of the transmission line is lower than the first threshold.

[0124] Embodiment 11: A method as described in any of the preceding embodiments, wherein evaluating whether the command is consistent with the physical state of the power system includes determining that the command is inconsistent with the physical state of the power system when any of the following situations occurs: the command is for inserting the SCB and is received within a time window starting from the execution of a previous command for bypassing the SCB; or the command is for bypassing the SCB and is received within a time window starting from the execution of a previous command for inserting the SCB.

[0125] Embodiment 12: The method of Embodiment 11, wherein the remote control signal is received from a remedial action solution (RAS) system, an energy management system (EMS), or a wide area monitoring, protection and control (WAMPAC) system.

[0126] Embodiment 13: The method as described in any of the preceding embodiments further includes using the at least one hardware processor to perform two or more of the following: a line fault detection (LFD) function, wherein the LFD function determines whether there is a line fault on the transmission line; a system disturbance detection (SDD) function, wherein the SDD function determines whether there is a system disturbance within the power system; or an interlocking scheme (IS) function, wherein the IS function determines one or both of the following: the load condition of the transmission line or whether a previous command was executed within a time window before receiving the remote control signal; wherein, evaluating whether the command is consistent with the physical state of the power system includes executing logic, wherein the logic utilizes the determination of each of two or more of the LFD function, the SDD function and the IS function to determine whether the command is consistent with the physical state of the power system.

[0127] Embodiment 14: The method as described in Embodiment 13 also includes using the at least one hardware processor to perform the following operations: receiving real-time measurement values ​​of the power system; and using the real-time measurement values ​​as input to execute two or more of the LFD function, the SDD function or the IS function in real time.

[0128] Embodiment 15: The method of embodiment 14, wherein the logic is executed within 500 milliseconds of receiving the remote control signal.

[0129] Embodiment 16: The method as described in any of the preceding embodiments further includes using the at least one hardware processor to perform the following operations: receiving real-time measurement values ​​of the power system; and continuously determining the physical state of the power system in real time based on the real-time measurement values, wherein the evaluation is performed each time a remote control signal is received.

[0130] Embodiment 17: The method as described in any of the preceding embodiments further includes using the at least one hardware processor to control a bypass breaker of the SCB station according to the command if execution of the command is allowed.

[0131] Embodiment 18: The method as described in Embodiment 17, wherein controlling the bypass circuit breaker includes: opening the bypass circuit breaker when the command is for inserting the SCB; and closing the bypass circuit breaker when the command is for bypassing the SCB.

[0132] Embodiment 19: A series capacitor bank (SCB) station, comprising: an SCB, the SCB comprising a group of capacitors arranged in series along a transmission line within a power system; a bypass circuit breaker; and a controller, the controller comprising software representing a local protection layer and at least one hardware processor, the at least one hardware processor being configured to execute the software to perform a method as described in any one of Embodiments 1 to 18.

[0133] Embodiment 20: A non-transitory computer readable medium having instructions stored thereon, wherein the instructions, when executed by a processor of a series capacitor bank (SCB) station, cause the processor to perform the method of any one of Embodiments 1 to 18.

[0134] The above description of the disclosed embodiments is provided to enable any person skilled in the art to implement or use the present invention. It will become apparent to those skilled in the art that various modifications to these embodiments will become apparent, and the general principles described herein may be applied to other embodiments without departing from the spirit or scope of the present invention. Therefore, it should be understood that the description and accompanying drawings presented herein represent the present invention's current preferred embodiments, and therefore represent the subject matter of the present invention's broad considerations. It should be further understood that the scope of the present invention fully encompasses other embodiments that are apparent to those skilled in the art, and therefore the scope of the present invention is not limited.

[0135] Combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" described herein include any combination of A, B, and / or C, and may include multiple A, multiple B, or multiple C. Specifically, combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B, and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" may be only A, only B, only C, A and B, A and C, B and C, or A, B, and C, and any such combination may contain one or more members of its constituent parts A, B, and / or C. For example, the combination of A and B may include one A and multiple Bs, multiple A and one B, or multiple A and multiple Bs.

Claims

1. A method comprising using at least one hardware processor within a controller of a series capacitor bank (SCB) station to: receiving a remote control signal from a system external to the SCB station, wherein, The remote control signal represents a command to electrically insert the SCB into a power line within a power system or to bypass the SCB; evaluating whether the command is consistent with a physical state of the power system; preventing execution of the command by the controller if the command is inconsistent with a physical state of the power system; as well as In the event that the command is consistent with the physical state of the power system, execution of the command by the controller is permitted.

2. The method of claim 1, further comprising using the at least one hardware processor to initiate an alert to one or more recipients if the command is inconsistent with a physical state of the power system.

3. The method of claim 1, further comprising using the at least one hardware processor to perform a line fault detection (LFD) function, the LFD function determining whether a line fault exists within a detection zone, wherein Evaluating whether the command is consistent with the physical state of the power system includes: In a case where the command is for bypassing the SCB and the command is received when it is determined by the LFD function that no line fault exists within the detection zone, determining that the command is inconsistent with a physical state of the power system; and In a case where the command is for bypassing the SCB and the command is received when a line fault is determined to exist within the detection zone by the LFD function, the command is determined to be consistent with a physical state of the power system.

4. The method of claim 3, wherein: The remote control signal is received from a line protection system.

5. The method of claim 1, further comprising using the at least one hardware processor to perform a system disturbance detection (SDD) function, the SDD function determining whether a system disturbance exists within the power system, wherein Evaluating whether the command is consistent with a physical state of the power system includes determining whether the command is consistent based on the presence or absence of the system disturbance as determined by the SDD function within a time window around receipt of the remote control signal.

6. The method of claim 5, wherein: The system disturbance comprises an emergency power transfer, and wherein determining whether the command is consistent based on the presence or absence of the system disturbance comprises: determining that the command is inconsistent if the command is for inserting the SCB and an emergency power transfer is not present within the time window as determined by the SDD function; and In the event that the command is for inserting the SCB and it is determined by the SDD function that there is an emergency power transfer within the time window, the command is determined to be consistent.

7. The method of claim 5, wherein: The system disturbance comprises a frequency disturbance, and wherein determining whether the command is consistent based on the presence or absence of the system disturbance comprises: In the event that the command is for one of inserting the SCB or bypassing the SCB and it is determined by the SDD function that there is no frequency disturbance within the time window, determining that the command is inconsistent; and The command is determined to be consistent in the event that the command is for inserting the SCB or bypassing another one of the SCBs and a frequency disturbance is determined by the SDD function to exist within the time window.

8. The method of claim 5, wherein: The system disturbance comprises an abnormal voltage, and wherein determining whether the command is consistent based on the presence or absence of the system disturbance comprises: In a case where the command is for one of inserting the SCB or bypassing the SCB and it is determined by the SDD function that there is no abnormal voltage within the time window, determining that the command is inconsistent; and In the case where the command is for inserting the SCB or bypassing another one of the SCBs and it is determined by the SDD function that an abnormal voltage exists within the time window, the command is determined to be consistent.

9. The method of claim 5, wherein: The remote control signal is received from a remedial action solution (RAS) system, an energy management system (EMS), or a wide area monitoring, protection and control (WAMPAC) system.

10. The method of claim 1, wherein: Evaluating whether the command is consistent with the physical state of the power system includes: In the event of any of the following situations, it is determined that the command is inconsistent with the physical state of the power system: The command is for inserting the SCB and the current load of the transmission line is below a first threshold; or The command is for bypassing the SCB and a current load of the transmission line exceeds a second threshold; and The command is determined to be consistent with the physical state of the power system when any of the following conditions occurs: The command is for inserting the SCB and the current load of the transmission line exceeds the second threshold; or The command is for bypassing the SCB and a current load of the transmission line is below the first threshold.

11. The method of claim 1, wherein: Evaluating whether the command is consistent with the physical state of the power system includes determining that the command is inconsistent with the physical state of the power system if any of the following occurs: The command is for inserting the SCB and the command is received within a time window from execution of a previous command for bypassing the SCB; or The command is for bypassing the SCB and is received within a time window from execution of a previous command for inserting the SCB.

12. The method of claim 11, wherein: The remote control signal is received from a remedial action solution (RAS) system, an energy management system (EMS), or a wide area monitoring, protection and control (WAMPAC) system.

13. The method of claim 1 , further comprising using the at least one hardware processor to perform two or more of the following: a line fault detection (LFD) function, the LFD function determining whether there is a line fault on the transmission line; a system disturbance detection (SDD) function, the SDD function determining whether a system disturbance exists within the power system; or an interlock scheme (IS) function, the IS function determining one or both of: a load condition of the transmission line or whether a previous command was executed within a time window prior to receipt of the remote control signal; in, Evaluating whether the command is consistent with a physical state of the power system includes executing logic that utilizes determinations of each of two or more of the LFD function, the SDD function, and the IS function to determine whether the command is consistent with a physical state of the power system.

14. The method of claim 13, further comprising using the at least one hardware processor to: receiving real-time measurements of the power system; and Two or more of the LFD function, the SDD function, or the IS function are performed in real time using the real-time measurements as input.

15. The method of claim 14, wherein: The logic is executed within 500 milliseconds of receiving the remote control signal.

16. The method of claim 1, further comprising using the at least one hardware processor to: receiving real-time measurements of the power system; and continuously determining in real time the physical state of the power system based on the real-time measurements, in, The evaluation is performed each time a remote control signal is received.

17. The method of claim 1, further comprising using the at least one hardware processor to control a bypass breaker of the SCB station according to the command if execution of the command is permitted.

18. The method of claim 17, wherein: Controlling the bypass circuit breaker comprises: in case the command is for inserting the SCB, opening the bypass breaker; and In case the command is for bypassing the SCB, the bypass breaker is closed.

19. A series capacitor bank (SCB) station comprising: An SCB comprising a bank of capacitors arranged in series along a transmission line within the power system; Bypass circuit breaker; as well as A controller, the controller comprising: Software representing a local protection layer; and at least one hardware processor configured to execute the software to: receiving a remote control signal from a system external to the SCB station, wherein the remote control signal represents a command to electrically insert the SCB into the transmission line by opening the bypass breaker or to bypass the SCB by closing the bypass breaker; evaluating whether the command is consistent with a physical state of the power system; preventing execution of the command if the command is inconsistent with a physical state of the power system; and In case the command is consistent with the physical state of the power system, the command is executed.

20. A non-transitory computer readable medium having instructions stored thereon, wherein: The instructions, when executed by a processor of a series capacitor bank (SCB) station, cause the processor to: receiving a remote control signal from a system external to the SCB station, wherein the remote control signal represents a command to electrically insert the SCB into a transmission line within a power system or to bypass the SCB; evaluating whether the command is consistent with a physical state of the power system; preventing execution of the command by the controller if the command is inconsistent with a physical state of the power system; and In the event that the command is consistent with the physical state of the power system, execution of the command by the controller is permitted.

Images