Methods for safe capacitor bank control in series compensated transmission lines.

Abstract

A power system, such as a transmission system, may include a series capacitor bank (SCB) for providing series compensation to a power line. The SCB may be electrically inserted into the power line or may be bypassed pursuant to commands transmitted by a remote system. Such commands may be compromised in a cyberattack, causing deterioration and instability in the power system. Therefore, according to one embodiment, a protection layer is provided at an SCB station to intercept commands before execution, evaluate the consistency of the command with the physical state of the power system, and allow or block the command based on the evaluation, thereby protecting the SCB from cyberattacks.

Description

[Technical Field]

[0001] Government Licensing Rights This invention was made with U.S. Government support under Contract No. DE-OE00000897 awarded by the Department of Energy. The U.S. Government has certain rights in this invention.

[0002] background FIELD OF THE INVENTION FIELD OF THE INVENTION The embodiments described herein relate generally to control in power systems, and more particularly to safe control of series capacitor banks (SCBs) in power lines. [Background technology]

[0003] 2. Description of Related Art A series capacitor bank (SCB) comprises multiple capacitors electrically connected in series to store electrical energy. SCBs are incorporated into alternating current (AC) power lines to improve the steady-state performance and dynamic characteristics of power systems. The maximum active power transmittable through a power line is inversely proportional to the line's series inductive reactance. Therefore, by using SCBs to compensate for the power line's series inductive reactance, typically 25% to 70%, a shorter power line can be achieved, resulting in higher active power transmission and improved system dynamic performance. In general, the main benefits of applying series compensation to transmission power systems include improved system dynamic stability, desirable load division between parallel lines, improved voltage regulation and reactive power balance, and reduced transmission losses.

[0004] Security against malicious control of SCBs is considered critical. Attackers may gain access to power system communication channels and initiate unauthorized control commands or modify control commands to manipulate SCB locations. For example, an attacker may issue malicious control commands to manipulate SCB locations under normal conditions, block or compromise control commands under abnormal (e.g., emergency) conditions, generate continuous bypass and insertion commands to SCBs, etc. Unauthorized or modified control commands can cause power line overloads, voltage violations, inter-area oscillations, reduced stability margins against contingencies, and risk system instability. Summary of the Invention [Means for solving the problem]

[0005] overview It would be advantageous to protect series capacitor banks (SCBs) from malicious control. It is also desirable to intercept commands before execution, evaluate the commands based on consistency with the physical state of the power system, and block or allow the commands based on that evaluation. It would be further advantageous to evaluate consistency based on the presence or absence of line faults or other system disturbances and prevent continuous switching of the state of the SCB. Therefore, to address one or more of these concerns, a system, method, and non-transitory computer-readable medium are disclosed for safe control of series capacitor banks (SCBs) in power lines.

[0006] In one embodiment, a method includes using at least one hardware processor in a controller of a series capacitor bank (SCB) station to receive a remote control signal from a system external to the SCB station, the remote control signal representing a command to either electrically insert the SCB into a power line in the power system or to bypass the SCB; evaluating whether the command is consistent with a physical state of the power system; blocking execution of the command by the controller if the command is inconsistent with the physical state of the power system; and allowing execution of the command by the controller if the command is consistent with the physical state of the power system.

[0007] The method may further include using at least one hardware processor to initiate an alert to one or more recipients if the command is inconsistent with a physical state of the power system.

[0008] The method may further include using at least one hardware processor to perform a line-fault detection (LFD) function that determines whether a line fault exists within the detection zone, and evaluating whether the command is consistent with a physical state of the power system includes determining that the command is inconsistent with the physical state of the power system if the command is to bypass the SCB and is received while the LFD function determines that no line fault exists within the detection zone, and determining that the command is consistent with the physical state of the power system if the command is to bypass the SCB and is received while the LFD function determines that a line fault exists within the detection zone. The remote control signal may be received from a line protection system.

[0009] The method may further include using at least one hardware processor to perform a system disturbance detection (SDD) function that determines whether a system disturbance is present in the power system, and evaluating whether the command is consistent with a physical state of the power system includes determining whether the command is consistent based on the presence or absence of the system disturbance determined by the SDD function within a time window around receipt of the remote control signal.

[0010] The system disturbance may include an emergency power transfer, and determining whether the command is consistent based on the presence or absence of the system disturbance includes determining that the command is inconsistent if the command is to insert an SCB and the SDD function determines that there is no emergency power transfer within the time window, and determining that the command is consistent if the command is to insert an SCB and the SDD function determines that there is an emergency power transfer within the time window.

[0011] The system disturbance may include a frequency disturbance, and determining whether the command is consistent based on the presence or absence of the system disturbance includes determining that the command is inconsistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that no frequency disturbance is present within the time window, and determining that the command is consistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that a frequency disturbance is present within the time window.

[0012] The system disturbance may include an abnormal voltage, and determining whether the command is consistent based on the presence or absence of the system disturbance includes determining that the command is inconsistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that no abnormal voltage is present within the time window, and determining that the command is consistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that abnormal voltage is present within the time window.

[0013] The remote control signal may be received from a remedial action scheme (RAS) system, an energy management system (EMS), or a wide-area monitoring, protection, and control (WAMPAC) system.

[0014] Evaluating whether the command is consistent with a physical state of the power system may include determining that the command is inconsistent with the physical state of the power system if either the command is to insert an SCB and the current load on the transmission line is below a first threshold or the command is to bypass the SCB and the current load on the transmission line is above a second threshold, and determining that the command is consistent with the physical state of the power system if either the command is to insert an SCB and the current load on the transmission line is above the second threshold or the command is to bypass the SCB and the current load on the transmission line is below the first threshold.

[0015] Evaluating whether the command is consistent with the physical state of the power system may include determining that the command is inconsistent with the physical state of the power system if either the command is to insert an SCB and was received within a time window from execution of a previous command to bypass the SCB, or the command is to bypass the SCB and was received within a time window from execution of a previous command to insert the SCB.

[0016] The method may further include using at least one hardware processor to perform two or more of a line fault detection (LFD) function to determine whether a line fault exists on the power line, a system disturbance detection (SDD) function to determine whether a system disturbance exists in the power system, or an interlocking scheme (IS) function to determine one or both of a load condition on the power line or whether a previous command was executed within a time window preceding receipt of the remote control signal, and evaluating whether the command is consistent with a physical state of the power system includes executing logic that utilizes determinations by each of two or more of the LFD function, the SDD function, and the IS function to determine whether the command is consistent with the physical state of the power system. The method may further include using the at least one hardware processor to receive real-time measurements of the power system and perform two or more of the LFD function, the SDD function, or the IS function in real time using the real-time measurements as inputs. The logic may complete execution within 500 milliseconds of receiving the remote control signal.

[0017] The method may further include using at least one hardware processor to receive real-time measurements of the power system and continuously determine a physical state of the power system in real time based on the real-time measurements, the evaluation being performed each time a remote control signal is received.

[0018] The method may further include using at least one hardware processor to control a bypass breaker of the SCB station according to the command if execution of the command is permitted, wherein controlling the bypass breaker may include opening the bypass breaker if the command is to insert the SCB and closing the bypass breaker if the command is to bypass the SCB.

[0019] It should be understood that any of the features in the above-described methods may be implemented individually or with any subset of other features in any combination. Thus, to the extent that the appended claims suggest specific dependencies between features, the disclosed embodiments are not limited to those specific dependencies. Rather, any feature described herein may be combined with any other feature described herein, or may be implemented in any combination of features without any one or more other features described herein. Furthermore, any of the methods described above and elsewhere herein may be embodied individually or in any combination in executable software modules of a processor-based system, such as a controller of an SCB station, and / or in executable instructions stored on a non-transitory computer-readable medium.

[0020] BRIEF DESCRIPTION OF THE DRAWINGS The details of the present invention, both as to its structure and operation, can be gleaned in part by studying the accompanying drawings, in which like reference numerals refer to like parts, and in which: [Brief explanation of the drawings]

[0021] [Figure 1] FIG. 1 is a schematic diagram of an exemplary infrastructure in which one or more of the disclosed processes may be implemented, according to one embodiment. [Figure 2] FIG. 1 illustrates an exemplary processing system in which one or more of the processes described herein may be performed, according to one embodiment. [Figure 3] FIG. 1 illustrates a process that may be implemented by a protection layer of a controller of an SCB station, according to one embodiment. [Figure 4] FIG. 2 illustrates examples of security features that may be employed by a protection layer, according to one embodiment. [Figure 5A] FIG. 1 illustrates the status of a power system before a line fault according to an exemplary scenario. [Figure 5B] FIG. 1 illustrates the status of a power system after a line fault according to an exemplary scenario. [Figure 6] 5C is a plot illustrating the behavior of a simulation of the scenario shown in FIGS. 5A and 5B, according to one embodiment. [Figure 7A] FIG. 1 illustrates the status of a power system before an emergency power transfer according to an exemplary scenario. [Figure 7B] FIG. 1 illustrates the status of a power system after an emergency power transfer according to an exemplary scenario. [Figure 8] 7C is a plot illustrating the behavior of a simulation of the scenario shown in FIGS. 7A and 7B, according to one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0022] Detailed Description In one embodiment, a system, method, and non-transitory computer-readable medium are disclosed for safe control of series capacitor banks (SCBs) in power lines. After reading this description, it will be apparent to one skilled in the art how to implement the invention in various alternative embodiments and applications. However, while various embodiments of the invention are described herein, it is understood that these embodiments are presented by way of example and illustration only, and not limitation. Therefore, this detailed description of various embodiments should not be construed as limiting the scope or breadth of the invention, which is set forth in the appended claims.

[0023] 1. System Overview Infrastructure 1 illustrates a schematic diagram of an exemplary infrastructure in which one or more of the disclosed processes may be implemented, according to one embodiment. The disclosed embodiments are generally considered to be implemented in an electric power system 100, such as a power grid (e.g., at any scale, from a large utility grid to a regional grid). The electric power system 100 may be any network of electrical components (e.g., power system equipment) configured to generate, store, supply, transmit, distribute, and / or consume electrical power, including, but not limited to, power plants configured to generate electricity from combustible fuels (e.g., coal, natural gas, nuclear, etc.) and / or renewable sources (e.g., wind, solar, etc.), transmission systems configured to transport or transmit electricity from sources (e.g., generators, battery energy storage (BES) systems, etc.) to loads, and distribution systems configured to deliver the supplied electricity to nearby homes, businesses, and / or other facilities. However, the disclosed embodiments are primarily described and illustrated herein with respect to an electric power transmission system.

[0024] Power system 100 includes power line 110. Power line 110 may be a transmission line extending between first substation bus 112 and second substation bus 114. However, power line 110 may be any wire or other conductor that conducts electricity through controllable SCBs. Power line 110 may include one or more current measurement devices 116 (e.g., 116A and 116B) that measure the current on power line 110 and one or more voltage measurement devices (e.g., 118A and 118B) that measure the voltage on power line 110. Power line 110 may also include at least one circuit breaker 120.

[0025] The line protection system 130 may receive data reflecting information about the power system 100, including current measurements from at least one current measurement device 116A and / or voltage measurements from at least one voltage measurement device 118A. The line protection system 130 may analyze the data in real time and control the circuit breaker 120 based on the analysis of the data. In particular, the line protection system 130 may trip (i.e., open) the circuit breaker 120 to protect the power line 110 when the line protection system 130 detects a fault in the power line 110 based on the analysis of the data. It should be understood that a line fault may be any abnormal current in the power line 110. In a three-phase power line 110, this includes, but is not limited to, a line-to-line fault (i.e., a short circuit between two phases of the power line 110), a line-to-ground fault (i.e., a short circuit between one phase of the power line 110 and ground), a double line-to-ground fault (i.e., a short circuit between two phases of the power line 110 and ground), etc.

[0026] Power system 100 may also include one or more other control systems 140, such as a Remedial Action Scheme (RAS) system 142, a Supervisory Control and Data Acquisition (SCADA) / Energy Management System (EMS) 144, and a Wide-Area Monitoring, Protection, and Control (WAMPAC) system 146. Each of these systems may, for example, receive data from one or more sensors (e.g., current measuring devices 116, voltage measuring devices 118, etc.) in power system 100, analyze the measurements, and take corrective action when appropriate. For example, RAS system 142 generally provides automatic mitigation of violations in the performance of power system 100 in addition to detecting and isolating faults. Mitigation may include, but is not limited to, adjusting or tripping generation, tripping loads, reconfiguring power system 100, etc. The SCADA / EMS 144 monitors the power system 100, such as a utility grid or a local grid, by acquiring data and performs high-level supervision and control of the power system 100 based on the acquired data and / or in response to user actions. This control may include scheduling power generation, scheduling power consumption, and / or controlling other components of the power system 100. The WAMPAC system 146 is an integrated real-time system that utilizes both wide-area and local information (e.g., voltage and current phasors, frequency, frequency rate of change, etc.) to perform adaptive corrective control and protective actions. It should be understood that any reference herein to the control system 140 may refer to any one or combination of the RAS system 142, the SCADA / EMS 144, the WAMPAC system 146, or any other system that may be used to control an SCB.

[0027] Power system 100 also includes SCB station 150. SCB station 150 is any system including an SCB, a bypass breaker in parallel with the SCB, and a controller configured to switch the bypass breaker between an open state and a closed state. For example, as shown, SCB station 150 includes SCB 151 (e.g., a QBank™ offered by Hitachi Energy Corporation), which may include a group of one or more capacitors electrically connected in series to provide series compensation to power line 110, as well as bypass breaker (BB) 152 (e.g., a high-speed bypass breaker) and controller 154 (e.g., any of the CQ™ series capacitor bank controllers offered by Hitachi Energy Corporation). Controller 154 includes a protection layer 155. SCB station 150 may also include metal oxide varistor (MOV) 156, discharge device 157, and forced-trigger spark gap 158. Collectively, the MOV 156, the discharge device 157, and the forced trigger spark gap 158 may provide overvoltage protection for the SCB 151. The SCB station 150 may implement fixed series compensation, thyristor controlled series compensation, or any flexible alternating current transmission system (FACTS) series compensation.

[0028] SCB stations 150 with corresponding SCBs 151 may be provided at one or more points along power line 110 and at any suitable location along power line 110. For example, a first SCB station 150 may be provided at or near first substation bus 112, and a second SCB station 150 may be provided at or near second substation bus 114. Alternatively or additionally, SCB stations 150 may be located at or near the center of power line 110.

[0029] The controller 154 controls the bypass breaker 152 to switch between an open state, in which the SCB 151 is electrically inserted into the power line 110 to series compensate the power line 110, and a closed state, in which the SCB 151 is bypassed. Typically, the SCB 151 is electrically inserted into the power line 110 by opening the bypass breaker 152 when the power line 110 is under high power transmission conditions, and is bypassed by closing the bypass breaker 152 under low power transmission conditions. This control may be manual (e.g., via the SCADA / EMS 144) or automatic (e.g., by the line protection system 130, the RAS system 142, the WAMPAC system 146, etc.). For example, an operator may provide input to a graphical user interface of the SCADA / EMS 144 to insert or bypass the SCB 151 according to planned operating conditions.

[0030] As another example, the line protection system 130 may detect a line fault and send a remote control signal to the controller 154 to bypass the SCB 151 and control the circuit breaker 120 to open to isolate the fault. Fast bypassing of the SCB 151 is one strategy for reducing transient recovery voltage (TRV) in extra-high voltage transmission lines (e.g., 345 kV to 765 kV). Transmission lines with a high degree of series compensation have increased TRV levels that may exceed the capabilities of the circuit breaker 120. This could lead to damage to the circuit breaker 120 as well as potential damage to other components of the power system 100. For series-compensated transmission lines with potential TRV issues, the line protection system 130 simultaneously sends both a line trip signal to the circuit breaker 120 and a remote control signal representing a command to bypass the SCB 151 to the SCB controller 154 whenever the line protection system 130 detects a line fault. Given that the speed of bypass breaker 152 (e.g., approximately 5 milliseconds) is faster than the speed of circuit breaker 120 (e.g., approximately 20-30 milliseconds), SCB 151 can be sufficiently bypassed before circuit breaker 120 opens.

[0031] As another example, the RAS system 142 may send a remote control signal to the controller 154 under emergency conditions. Rapid bypass or rapid insertion of SCBs 151 on critical transmission lines has been implemented as part of RAS measures in some regional power grids to mitigate the potential risk of system instability due to large generation or transmission disruptions. For example, the RAS system 142 may detect a significant transmission disruption and send a remote control signal to the controller 154 to insert the SCB 151.

[0032] In either case, control system 130 or 140 may send a remote control signal to controller 154 (e.g., via directional communication or via the communication network of power system 100). The remote control signal represents a command to either electrically insert SCB 151 into power line 110 or to bypass SCB 151. It should be understood that the remote control signal may include instructions to either insert SCB 151 or bypass SCB 151, or may include instructions to switch the state of bypass breaker 152 between an open state and a closed state.

[0033] In one embodiment, all remote control signals received by controller 154 are processed by protection layer 155 before executing the command. Protection layer 155 may intercept each command and implement the disclosed process to either allow the command to execute or block the command from executing. If execution of a command is permitted by protection layer 155, controller 154 may send a signal to bypass breaker 152 indicating an instruction to either open or close according to the command. If execution of a command is blocked by protection layer 155, controller 154 may issue a warning and discard or delay the command (e.g., until an operator or other system acknowledges the command).

[0034] The controller 154 may receive data reflecting information about the power system 100, including current measurements from at least one current measurement device 116B and / or voltage measurements from at least one voltage measurement device 118B. This data may be used by functionality implemented in the controller 154 to control one or more functions of the SCB station 150. Of particular relevance to the present disclosure, this data may be used by the protection layer 155 to inform the disclosed process for allowing or blocking execution of commands in the remote control signals.

[0035] 1.2. Exemplary Processing Device 2 is a block diagram illustrating an exemplary wired or wireless system 200 that may be used in connection with various embodiments described herein. For example, system 200 may be used as or in conjunction with one or more of the functions, processes, or methods (e.g., for storing and / or executing software) described herein and may represent components of controller 154, line protection system 130, control system 140, and / or other processing devices described herein. System 200 may be a server or any conventional personal computer, or any other processor-enabled device capable of wired or wireless data communication. Other computer systems and / or architectures may also be used, as will be apparent to those skilled in the art.

[0036] System 200 preferably includes one or more processors 210. Processor 210 may comprise a central processing unit (CPU). Additional processors may be provided, such as a graphics processing unit (GPU), auxiliary processors for managing input / output, auxiliary processors for performing floating-point operations, dedicated microprocessors (e.g., digital signal processors) with architectures suitable for fast execution of signal processing algorithms, subordinate slave processors (e.g., back-end processors) of a main processing system, additional microprocessors or controllers for dual or multiprocessor systems, and / or coprocessors. Such auxiliary processors may be separate processors or may be integrated with processor 210. Examples of processors that may be used with system 200 include, but are not limited to, any of the processors available from Intel Corporation of Santa Clara, California (e.g., Pentium®, Core i7™, Xeon®, etc.), any of the processors available from Advanced Micro Devices, Incorporated of Santa Clara, California, any of the processors available from Apple Inc. of Cupertino (e.g., A-series, M-series, etc.), any of the processors available from Samsung Electronics Company of Seoul, South Korea (e.g., Exynos®), any of the processors available from NXP Semiconductors NV of Eindhoven, The Netherlands, etc.

[0037] Processor 210 is preferably connected to communication bus 205. Communication bus 205 may include a data channel for facilitating information transfer between storage and other peripheral components of system 200. Additionally, communication bus 205 may provide a set of signals used for communication with processor 210, including a data bus, an address bus, and / or a control bus (not shown). Communication bus 205 may include any standard or non-standard bus architecture, such as, for example, an industry standard architecture (ISA), an extended industry standard architecture (EISA), a Micro Channel Architecture (MCA), a peripheral component interconnect (PCI) local bus, a bus architecture conforming to standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE), including the IEEE 488 general-purpose interface bus (GPIB), IEEE 696 / S-100, etc.

[0038] System 200 preferably includes main memory 215 and may also include secondary memory 220. Main memory 215 provides storage of instructions and data for programs executing on processor 210, such as any of the software described herein. It should be understood that the programs stored in memory and executed by processor 210 may be written and / or compiled according to any suitable language, including, but not limited to, C / C++, Java, JavaScript, Perl, Visual Basic, .NET, etc. Main memory 215 is typically semiconductor-based memory, such as dynamic random access memory (DRAM) and / or static random access memory (SRAM). Other semiconductor-based memory types include, for example, synchronous dynamic random access memory (SDRAM), Rambus dynamic random access memory (RDRAM), ferroelectric random access memory (FRAM), etc., including read-only memory (ROM).

[0039] Secondary memory 220 is a non-transitory computer-readable medium on which computer-executable code (e.g., any of the software disclosed herein, such as protective layer 155) and / or other data is stored. Computer software or data stored in secondary memory 220 is loaded into main memory 215 for execution by processor 210. Secondary memory 220 may include, for example, semiconductor-based memory such as programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), and flash memory (a block-oriented memory similar to EEPROM).

[0040] Secondary memory 220 may optionally include internal media 225 and / or removable media 230. Removable media 230 may be read from and written to in any known manner. Removable storage media 230 may be, for example, a magnetic tape drive, a compact disc (CD) drive, a digital versatile disc (DVD) drive, other optical drive, a flash memory drive, etc.

[0041] In alternative embodiments, secondary memory 220 may include other similar means for allowing computer programs or other data or instructions to be loaded into system 200. Such means may include, for example, a communications interface 240 that allows software and data to be transferred to system 200 from an external storage medium 245. Examples of external storage medium 245 include an external hard disk drive, an external optical drive, an external magneto-optical drive, etc.

[0042] As mentioned above, system 200 may include a communications interface 240. Communications interface 240 allows software and data to be transferred between system 200 and an external device, network, or other information source. For example, computer software or executable code may be transferred to system 200 from a network server via communications interface 240. Examples of communications interface 240 include an internal network adapter, a network interface card (NIC), a Personal Computer Memory Card International Association (PCMCIA) network card, a cardbus network adapter, a wireless network adapter, a Universal Serial Bus (USB) network adapter, a modem, a wireless data card, a communications port, an infrared interface, an IEEE 1394 Firewire, and any other device capable of interfacing system 200 with a network or another computing device.Communications interface 240 preferably implements industry published protocol standards such as Ethernet (IEEE 802 standard), Fibre Channel, digital subscriber line (DSL), asynchronous digital subscriber line (ADSL), Frame Relay, asynchronous transfer mode (ATM), integrated digital services network (ISDN), personal communications service (PCS), transmission control protocol / Internet protocol (TCP / IP), serial line Internet protocol / point to point protocol (SLIP / PPP), etc., although customized or non-standard interface protocols may also be implemented.

[0043] The software and data transferred via communications interface 240 are typically in the form of electrical communications signals 255. These signals 255 may be provided to communications interface 240 via communications channel 250. In one embodiment, communications channel 250 may be a wired or wireless network or any of a variety of other communications links. Communications channel 250 carries signals 255 and may be implemented using a variety of wired or wireless communications means, including wire or cable, optical fiber, conventional telephone line, cellular phone link, wireless data, communications link, radio frequency (“RF”) link, or infrared link, to name just a few.

[0044] Computer-executable code (e.g., computer programs such as the disclosed protection layer 155) is stored in main memory 215 and / or secondary memory 220. Computer-executable code can also be received via communications interface 240 and stored in main memory 215 and / or secondary memory 220. Such computer programs, when executed, enable system 200 to perform various functions of the disclosed embodiments described elsewhere herein.

[0045] As used herein, the term "computer-readable medium" refers to any non-transitory computer-readable storage medium used to provide computer-executable code and / or other data to or within system 200. Examples of such media include main memory 215, secondary memory 220 (including internal memory 225 and / or removable media 230), external storage media 245, and any peripheral devices (including network information servers or other network appliances) communicatively coupled to communication interface 240. These non-transitory computer-readable media are means for providing software and / or other data to system 200.

[0046] In embodiments implemented using software, the software may be stored on a computer-readable medium and loaded into system 200 via removable medium 230, I / O interface 235, or communication interface 240. In such embodiments, the software is loaded into system 200 in the form of electrical communication signals 255. When executed by processor 210, the software preferably causes processor 210 to perform one or more of the processes and functions described elsewhere herein.

[0047] In one embodiment, I / O interface 235 provides an interface between one or more components of system 200 and one or more input and / or output devices. Examples of input devices include, but are not limited to, sensors, keyboards, touchscreens or other touch-sensing devices, cameras, biometric sensing devices, computer mice, trackballs, pen-based pointing devices, etc. Examples of output devices include, but are not limited to, other processing devices, cathode ray tubes (CRTs), plasma displays, light-emitting diode (LED) displays, liquid crystal displays (LCDs), printers, vacuum fluorescent displays (VFDs), surface-conduction electron-emitter displays (SEDs), field emission displays (FEDs), etc. In some cases, input and output devices may be combined, such as in the case of touch-sensitive displays (e.g., smartphones, tablets, or other mobile devices).

[0048] System 200 may also include optional wireless communication components that facilitate wireless communication over voice and / or data networks. The wireless communication components include an antenna system 270, a radio system 265, and a baseband system 260. In system 200, radio frequency (RF) signals are transmitted and received wirelessly by antenna system 270 under the control of radio system 265.

[0049] In one embodiment, antenna system 270 may include one or more antennas and one or more multiplexers (not shown) that perform switching functions to provide transmit and receive signal paths for antenna system 270. In the receive path, the received RF signal may be coupled from the multiplexer to a low noise amplifier (not shown) that amplifies the received RF signal and transmits the amplified signal to radio system 265.

[0050] In alternative embodiments, the radio system 265 may comprise one or more radios configured to communicate over various frequencies. In one embodiment, the radio system 265 may combine a demodulator (not shown) and a modulator (not shown) into a single integrated circuit (IC). The demodulator and modulator may also be separate components. In the incoming path, the demodulator removes the RF carrier signal, leaving a baseband received audio signal that is transmitted from the radio system 265 to the baseband system 260.

[0051] The baseband system 260 is also communicatively coupled to the processor 210. The processor 210 may have access to data storage areas 215 and 220. The processor 210 is preferably configured to execute instructions (i.e., computer programs, such as the disclosed protection layer 155) that may be stored in the main memory 215 or the secondary memory 220. Computer programs may also be received from the baseband processor 260 and stored in the main memory 210 or the secondary memory 220, or executed upon receipt. Such computer programs, when executed, may enable the system 200 to perform various functions of the disclosed embodiments.

[0052] 2. Process Overview An embodiment of a process for secure control of SCBs on a power line will now be described in detail. It should be understood that the described process may be embodied in one or more software modules stored in a memory (e.g., main memory 215) of controller 154, e.g., as protection layer 155, and executed by one or more hardware processors (e.g., processor 210) of controller 154. The described process may be implemented as instructions expressed in source code, object code, and / or machine code. These instructions may be executed directly by hardware processor 210 of controller 154 or may be executed by a virtual machine operating between the object code and hardware processor 210 of controller 154.

[0053] Alternatively, the described processes may be implemented as hardware components (e.g., general-purpose processors, integrated circuits (ICs), application-specific integrated circuits (ASICs), digital signal processors (DSPs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic, etc.), a combination of hardware components, or a combination of hardware and software components. To clearly illustrate the interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps are described herein generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the particular application and design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the invention. Furthermore, the grouping of functions within a component, block, module, circuit, or step is for ease of description. Particular functions or steps may be moved from one component, block, module, circuit, or step to another without departing from the invention.

[0054] Additionally, while the processes described herein are shown with a particular arrangement and order of subprocesses, each process may be implemented with fewer, more, or different subprocesses, and with a different arrangement and / or order of the subprocesses. Furthermore, even if the subprocesses are described or illustrated in a particular order, it should be understood that any subprocess that is not dependent on the completion of another subprocess may be performed before, after, or in parallel with other independent subprocesses.

[0055] 2.1.Protective layer 3 illustrates a process 300 that may be implemented by the protection layer 155 of the controller 154 of each SCB station 150, according to one embodiment. The process 300 may be initiated when the controller 154 is powered up and may run as long as the controller 154 remains active. The process 300 may run in the background of the controller 154 to evaluate any commands received by the controller 154 in remote control signals from the line protection system 130 and / or other control systems 140 before the commands may be executed by the controller 154. The process 300 is designed to prevent cyber-attacks targeted at remote control signals sent by remote systems external to the SCB station 150, such as the line protection system 130 and other control systems 140. Such cyber-attacks may include modifying legitimate remote control signals before receipt by the controller 154 and / or sending false remote control signals to the controller 154.

[0056] Process 300 may include two threads that may execute independently of one another. The first thread includes sub-processes 310 and 320 that collect data regarding the dynamic conditions of power system 100. The second thread includes sub-processes 330-380 for evaluating each command received by controller 154.

[0057] In sub-process 310, process 300 monitors data related to power system 100. For example, this data may include current measurements obtained from current measuring device 116, voltage measurements obtained from voltage measuring device 118, and / or other local metrics obtained from and / or derived from other sensors. This data may be monitored in real time at a high sampling rate. As used herein, the terms “real time” or “real time” encompass both simultaneous occurrence and occurrence that is delayed in time due to normal latencies in processing, storage, communication, etc. Unless new data is received (i.e., “No” in sub-process 310), process 300 continues to monitor for new data. When new data is received (i.e., “Yes” in sub-process 310), process 300 proceeds to sub-process 320.

[0058] In sub-process 320, new data may be processed according to a sliding window ranging from tens of milliseconds to several seconds. As the data is processed, process 300 may update physical state 325 of power system 100. For example, a representation of physical state 325 of power system 100 may be stored in memory (e.g., main memory 215 and / or secondary memory 220 of controller 154). Physical state 325 may include real-time measurements and / or information derived from real-time measurements, including dynamic condition indicators such as line current, incremental line flow change, grid frequency deviation, voltage phase angle change, etc. within the sliding window. Controller 154 may continuously update the stored representation of physical state 325 in real time as new data is received.

[0059] In sub-process 330, process 300 monitors remote control signals received from remote systems, such as line protection system 130 and / or control system 140 (e.g., RAS system 142, SCADA / EMS 144, WAMPAC system 146, etc.), to identify commands within those remote control signals. Unless a new command is received (i.e., "No" in sub-process 330), process 300 continues to monitor for new commands. Each time a new command is received (i.e., "Yes" in sub-process 330), an iteration through the loop formed by sub-processes 340-380 is performed.

[0060] In sub-process 340, process 300 evaluates whether the command is consistent with physical state 325 of power system 100. In particular, protection layer 155 may execute one or more security functions configured to access a representation of physical state 325, detect anomalies in physical state 325, and / or evaluate physical state 325. Protection layer 155 may also execute logic to determine whether the command is consistent with physical state 325 based on the output of the security functions. For example, the logic may apply one or more rules to the command and the output of the security functions to evaluate whether the command is consistent with physical state 325. This consistency evaluation is described in more detail elsewhere herein.

[0061] If the result of the evaluation in sub-process 340 is that the command is consistent with physical state 325 (i.e., "Yes" in sub-process 350), the command may be executed in sub-process 360. Otherwise, if the result of the evaluation in sub-process 340 is that the command is inconsistent with physical state 325 (i.e., "No" in sub-process 350), the command may be blocked in sub-process 370 and / or a warning may be issued in sub-process 380.

[0062] It should be understood that blocking a command means that the command will not be executed. In this case, the command may be discarded, ignored, or delayed until a condition is met. For example, in an implementation that delays execution of a command until a condition is met, subprocess 380 may provide a warning to an operator (e.g., via a graphical user interface of SCADA / EMS 144 or other system, an email, or a text message, etc.), and the operator may be required to acknowledge the command (e.g., via a graphical user interface of SCADA / EMS 144 or other system, a reply to the email or text message, etc.) before the command is executed. As another example, protection layer 155 may trigger a confirmation function in response to a determination that the command is inconsistent with physical state 325 (i.e., a “No” in subprocess 350) to confirm physical state 325 and / or the determined inconsistency. In this case, protection layer 155 may delay execution of the command unless confirmation is received from the confirmation function. This verification function may include requesting or waiting for verification from an external system, running higher fidelity detection algorithms to verify the conditions within power system 100 that were the basis for the integrity assessment in sub-process 340, and / or the like.

[0063] 2.2. Consistency Assessment As described above, subprocess 340 of process 300 evaluates whether a received command is consistent with the physical state 325 of power system 100. In particular, protection layer 155 may perform one or more security functions and execute logic on the output of these security functions whenever the consistency of a command is evaluated.

[0064] 4 illustrates example security functions 400 that may be employed by protection layer 155, according to one embodiment. It should be understood that not all of the illustrated security functions 400 must be utilized in a particular embodiment. Rather, more, fewer, or different combinations of the illustrated security functions 400 and / or their constituent modules may be implemented by protection layer 155. In one embodiment, security functions 400 include a line fault detection (LFD) function 410, a system disturbance detection (SDD) function 420, and / or an interlocking scheme (IS) function 430. LFD function 410 determines whether a line fault is present within a detection zone, SDD function 420 determines whether a system disturbance is present within power system 100 (e.g., resulting from a significant generation or transmission disruption), and IS function 430 may determine a load on power line 110 and / or detect continuous switching.

[0065] The LFD function 410 may include a current derivative module 412, a directionality module 414, a zero-sequence current module 416, etc. The current derivative module 412 may calculate the derivative of the current in the power line 110, for example, from continuous measurements of the current by the current measurement device 116. Generally, a sudden increase (e.g., above a threshold) in the current derivative indicates a line fault. The directionality module 414 may determine the direction of the fault in the power line 110, and the zero-sequence current module 416 may calculate the zero-sequence current in the power line 110. Under normal system conditions, the zero-sequence current in the power line 110 is low and can be ignored. Therefore, a sudden increase (e.g., above a threshold) in the zero-sequence current indicates a line-to-ground fault. Overall, the LFD function 410 may determine whether a line fault is present on the power line 110 within a detection zone (e.g., a primary detection zone defined by, for example, a reach setting that specifies the portion of the power line 110 that is covered by the LFD function 410) based on the outputs of the current derivative module 412, the directionality module 414, the zero sequence current module 416, etc. The LFD function 410 may operate in real time as data is received and stored in a representation of the physical state 325 of the power system 100 so that a current indication of whether a line fault is present on the power line 110 is always readily available.

[0066] The detection zone of the LFD function 410 may be approximately 50%-80% of the length of the power line 110. The LFD function 410 is generally not configured to cover the entire length of the power line 110 because (i) the fault detection algorithms of the LFD function 410 are typically based on local measurements and therefore cannot distinguish remote faults at the ends of the power line 110 from external faults in the forward direction, and (ii) TRV issues are less critical for clearing remote line faults.

[0067] The SDD function 420 may include an emergency power transmission detection module 422, a frequency disturbance detection module 424, an abnormal voltage detection module 426, etc. The emergency power transmission detection module 422 may determine whether there has been a power disruption or emergency power transmission to or from the power line 110 (e.g., by comparing the power flow in the power line 110 stored in the physical state 325 before and after receiving the command). It should be understood that an emergency power transmission is any power transmission between power lines due to an emergency (e.g., a disruption in another power line, such as a DC link, a disruption in the power line 110, etc.). The frequency disturbance detection module 424 may determine whether a power generation disruption or frequency disturbance exists in the power line 110 (e.g., by comparing the frequency in the power line 110 stored in the physical state 325 before and after receiving the command). It should be understood that a frequency disturbance is any frequency in the power line 110 that is abnormal or unexpected (e.g., a frequency above or below a threshold, a rate of change of a frequency above a threshold, etc.). The abnormal voltage detection module 426 may determine whether an abnormal voltage is present on the power line 110 (e.g., by comparing the voltage of the power line 110 stored in the physical state 325 before and after receiving the command). It should be understood that an abnormal voltage is any voltage in the power line 110 that is abnormal or unexpected (e.g., a voltage above or below a threshold). Overall, the SDD function 420 may determine whether and / or what type of system disturbance is present in the power system 100. The system disturbance may be any one or combination of an emergency power transfer, a frequency disturbance, an abnormal voltage, and / or any other abnormal event on the power line 110 whose presence and / or absence can be detected from measurements received by the controller 154. The SDD function 420 may operate in real time as data is received and stored in the representation of the physical state 325 of the power system 100 so that a current indication of whether a system disturbance is present in the power system 100 is always readily available. However, in one embodiment, the SDD function 420 operates in response to receiving a command.Additionally, the particular module (eg, 422, 424, or 426) to be executed may be selected based on the command.

[0068] The IS function 430 may include a load detection module 432, a continuous switching detection module 434, etc. The load detection module 432 may detect a load on the power line 110. For example, the load may be characterized as low when below a first threshold, normal when above the first threshold and below a second threshold, and high when above the second threshold. The continuous switching detection module 434 may detect whether a command is received within a time window since execution of a previous command.

[0069] It is assumed that any command 450 received by controller 154 may be malicious. Therefore, protection layer 155 evaluates each received command 450. Whenever a command 450 is to be evaluated (e.g., in subprocess 340 of process 300), logic 440 may execute with the output of security function 400 and command 450 as input to output an integrity evaluation decision 460 (e.g., used in subprocess 350 to determine whether to allow or block the command). Logic 440 may apply one or more rules to the output of security function 400 and command 450 to present integrity evaluation decision 460.

[0070] As an example, protection layer 155 may receive a command 450 to bypass SCB 151 in a remote control signal purportedly transmitted from line protection system 130. Logic 440 may access the indication last output by LFD function 410 of whether a line fault exists in a detection zone on power line 110 to determine whether a line fault exists. If command 450 is to bypass SCB 151 while LFD function 410 determines that no line fault exists in the detection zone, logic 440 may determine that command 450 is inconsistent with physical state 325 of power system 100 (e.g., "No" in subprocess 350 of process 300). On the other hand, if the command 450 is to bypass the SCB 151 while the LFD function 410 determines that a line fault is present within the detection zone, the logic 440 may determine that the command 450 is consistent with the physical state 325 of the power system 100 (e.g., "Yes" in subprocess 350 of process 300).

[0071] In particular, in embodiments in which LFD function 410 operates in the background to determine whether a line fault exists in real time, logic 440 can determine the integrity of command 450 very quickly (e.g., within milliseconds of receiving command 450) because logic 440 applies rules to existing outputs from LFD function 410 without having to calculate new outputs from LFD function 410. Thus, the disclosed embodiments ensure that fast bypass of SCB 151 can be achieved when a line fault occurs, while at the same time providing security against conflicting and potentially malicious commands.

[0072] As another example, protection layer 155 may receive a command 450 to insert SCB 151 in a remote control signal purportedly transmitted from control system 140 (e.g., RAS system 142, WAMPAC system 146, etc.) in response to a major power disruption. Logic 440 may obtain the output of emergency power transmission detection module 422 of SDD function 420, which may be executed in response to receiving command 450 or by logic 440. Emergency power transmission detection module 422 may examine changes in power flow on power line 110 to determine whether there is an emergency power transmission to power line 110 within a time window around the receipt of the remote control signal containing command 450. If command 450 is to insert SCB 151 and no emergency power transmission is determined by SDD function 420 within the time window, logic 440 may determine that command 450 is inconsistent with physical state 325 of power system 100 (e.g., “No” in subprocess 350 of process 300). On the other hand, if the command 450 is to insert an SCB 151 and the SDD function 420 determines that an emergency power transfer exists, the logic 440 may determine that the command 450 is consistent with the physical state 325 of the power system 100 (e.g., "Yes" in subprocess 350 of process 300).

[0073] As another example, protection layer 155 may receive a command 450 to insert or bypass SCB 151 in a remote control signal purportedly transmitted from control system 140 (e.g., RAS system 142, WAMPAC system 146, etc.) in response to a frequency disturbance. Logic 440 may obtain an output of frequency disturbance detection module 424 of SDD function 420, which may be executed in response to receiving command 450 or by logic 440. Frequency disturbance detection module 424 may analyze physical state 325 to determine whether a frequency disturbance is present within a time window around the receipt of the remote control signal containing command 450. If command 450 is either to insert SCB 151 or to bypass SCB 151 and no frequency disturbance is determined by SDD function 420 within the time window, logic 440 may determine that command 450 is inconsistent with physical state 325 of power system 100 (e.g., a “No” in subprocess 350 of process 300). On the other hand, if command 450 is the other of inserting SCB 151 or bypassing SCB 151 and SDD function 420 determines that a frequency disturbance is present, logic 440 may determine that command 450 is consistent with physical state 325 of power system 100 (e.g., "Yes" in subprocess 350 of process 300). It should be understood that whether command 450 to insert SCB 151 or a command to bypass SCB 151 is consistent with a frequency disturbance depends on the particular frequency disturbance detected.

[0074] As another example, protection layer 155 may receive a command 450 to insert or bypass SCB 151 in a remote control signal purportedly transmitted from control system 140 (e.g., RAS system 142, WAMPAC system 146, etc.) in response to an abnormal voltage. Logic 440 may obtain the output of abnormal voltage detection module 426 of SDD function 420, which may be executed in response to receiving command 450 or by logic 440. Abnormal voltage detection module 426 may analyze physical state 325 to determine whether abnormal voltage is present within a time window around the receipt of the remote control signal containing command 450. If command 450 is either to insert SCB 151 or to bypass SCB 151 and no abnormal voltage is determined by SDD function 420 within the time window, logic 440 may determine that command 450 is inconsistent with physical state 325 of power system 100 (e.g., “No” in subprocess 350 of process 300). On the other hand, if command 450 is the other of inserting SCB 151 or bypassing SCB 151 and SDD function 420 determines that an abnormal voltage is present, logic 440 may determine that command 450 is consistent with physical state 325 of power system 100 (e.g., "Yes" in sub-process 350 of process 300). It should be understood that whether command 450 to insert SCB 151 or a command to bypass SCB 151 is consistent with an abnormal voltage depends on the particular abnormal voltage detected.

[0075] In particular, in embodiments in which SDD function 420 is executed in response to receiving command 450, the associated modules that are executed (e.g., 422, 424, 426, etc.) may be constrained to execute and generate an output within a time window from receipt of a remote control signal that includes command 450. Logic 440 may utilize whatever output is generated within the time window to determine consistency between command 450 and physical state 325. The time window may be several hundred milliseconds (e.g., within 500 milliseconds) from receipt of the remote control signal. This ensures that rapid insertion or bypass of SCB 151 can be achieved to prevent damage to power system 100.

[0076] In one embodiment, the SDD function 420 may be used to defend against denial-of-service (DoS) attacks. In a DoS attack, remote control commands from the control system 140 (e.g., the RAS system 142) may be blocked or compromised by an attacker. For example, if an attacker successfully blocks insertion commands from the RAS system 142 during an abnormal line flow increase, this may lead to significant power swings in the power line 110. If the SCB 151 is not inserted promptly, the power system 100 may become unstable. Therefore, the SDD function 420 may continuously monitor the physical state 325 of the power system 100 and determine whether the dynamic conditions represented in the physical state 325 satisfy predetermined conditions, including one or more criteria indicative of a system disturbance. It should be understood that the emergency power transfer detection module 422, the frequency disturbance detection module 424, the abnormal voltage detection module 426, and / or other modules of the SDD function 420 may each detect predetermined conditions indicative of different system disturbances. Whenever SDD function 420 detects a system disturbance or a particular severe system disturbance, SDD function 420 may automatically issue an alert (e.g., in the same or similar manner as subprocess 380 of process 300). Additionally or alternatively, whenever SDD function 420 detects a system disturbance or a particular severe system disturbance, SDD function 420 may automatically initiate a fast insertion of SCB 151. In particular, SDD function 420 may command controller 154 to open bypass breaker 152.

[0077] As another example, protection layer 155 may receive a command 450 to insert or bypass SCB 151 in a remote control signal purportedly transmitted from control system 140 (e.g., SCADA / EMS 144). Logic 440 may obtain an output of load detection module 432 of IS function 430, which may be executed in response to receiving command 450 or by logic 440. Load detection module 432 may analyze physical condition 325 to determine a current load on power line 110. If command 450 is to insert SCB 151 and the current load is below a first threshold representing a low load, logic 440 may determine that command 450 is inconsistent with physical condition 325 of power system 100. Similarly, if command 450 is to bypass SCB 151 and the current load is above a second threshold representing a high load, logic 440 may determine that command 450 is inconsistent with physical condition 325 of power system 100. Bypassing SCB 151 under high-load conditions may overload other parallel power lines. On the other hand, if command 450 is to insert SCB 151 and the current load is above a second threshold representing a high load, logic 440 may determine that command 450 is consistent with physical state 325 of power system 100. Similarly, if command 450 is to bypass SCB 151 and the current load is below a first threshold representing a low load, logic 440 may determine that command 450 is consistent with physical state 325 of power system 100. As a general rule, SCB 151 should be inserted under high-load conditions and bypassed under low-load conditions.

[0078] As another example, protection layer 155 may receive a command 450 to insert or bypass SCB 151 in a remote control signal purportedly transmitted from control system 140 (e.g., SCADA / EMS 144). Logic 440 may obtain the output of consecutive switching detection module 434, which may be executed in response to receiving command 450 or by logic 440. Consecutive switching detection module 434 may determine whether the current command 450 was received within a time window from the execution of a previous command, representing a switching of the state of SCB 151 relative to the previous command. For example, if the current command 450 is to insert SCB 151 and was received within a time window from the execution of a previous command to bypass SCB 151, logic 440 may determine that the current command 450 is inconsistent with physical state 325 of power system 100. Similarly, if the current command 450 is to bypass SCB 151 and is received within a time window from the execution of a previous command to insert SCB 151, logic 440 may determine that the current command 450 is inconsistent with the physical state 325 of power system 100. Continuous switching between insertion and bypass of SCB 151 within a short period of time can cause forced power swings, inter-area power oscillations, and instability in an underdamped power system 100. The time window may be set to an appropriate length to prevent these swings and instabilities in power system 100, thereby blocking the malicious switching command.

[0079] It should be appreciated that logic 440 may combine the outputs of two or more security features 400 to generate consistency assessment decision 460. In particular, logic 440 may apply rules to resolve conflicts between two or more security features 400. For example, if evaluations of command 450 across all security features 400 all result in a determination that command 450 is consistent with physical state 325, consistency assessment decision 460 may be that command 450 is consistent with physical state 325. Similarly, if evaluations of command 450 across all security features 400 all result in a determination that command 450 is inconsistent with physical state 325, consistency assessment decision 460 may be that command 450 is inconsistent with physical state 325. In one embodiment, if there is a mix of decisions (i.e., one or more decisions of consistency and one or more decisions of inconsistency), logic 440 may apply rules to make a final consistency assessment decision 460, such as always deciding that command 450 is inconsistent with physical state 325, selecting a consensus decision when there are three or more security features 400, prioritizing security features 400 and selecting the decision of the security feature 400 with the highest priority, or weighting security features 400 and selecting the decision with the highest weight.

[0080] 3. Example scenario The operation of the disclosed embodiments will now be described with respect to exemplary scenarios. It should be understood that these are non-limiting examples intended to illustrate the workings of the disclosed embodiments and are not a requirement of any embodiment.

[0081] 5A and 5B illustrate the status of power system 100 before and after a line fault, respectively, according to an exemplary scenario. In the illustrated scenario, power system 100 is a transmission system that transmits electricity along a transmission path between area A and area B. The transmission path consists of a high-voltage direct current (DC) link 160 and an AC link having two AC transmission lines 110A and 110B. Each of AC transmission lines 110A and 110B is series compensated by two SCB stations 150. In particular, AC transmission line 110A includes circuit breaker 120A, SCB station 150A, SCB station 150B, and circuit breaker 120B in series from area A to area B. Similarly, AC transmission line 110B includes circuit breaker 120C, SCB station 150C, SCB station 150D, and circuit breaker 120D in series from area A to area B.

[0082] In the pre-fault condition shown in FIG. 5A, the SCB 151 of each SCB station 150A-150D is inserted (i.e., each respective bypass breaker 152 is in an open state), and all circuit breakers 120A-120D are closed. Thus, both AC transmission lines 110A and 110B are series compensated. In the fault condition, a three-phase-to-ground fault occurs approximately in the center of AC transmission line 110B and is within the detection zone of the LFD functions 410 of both SCB stations 150C and 150D. The line protection system 130 issues bypass commands to SCB stations 150C and 150D on AC transmission line 110B, opening circuit breakers 120C and 120D on AC transmission line 110B. As a result, in the post-fault condition shown in Figure 5B, the SCB 151 of each SCB station 150C, 150D on the AC transmission line 110B is bypassed (i.e., the respective bypass breakers 152 are switched to a closed state). Then, the circuit breakers 120C, 120D on the AC transmission line 110B are opened. In this manner, by bypassing the SCB 151 before opening the corresponding circuit breaker 120, transient recovery voltages may be mitigated. Note that no change occurs on the AC transmission line 110A.

[0083] 6 represents the results of a simulation of the scenario shown in Figures 5A and 5B, consisting of four plots along the same timeline (in seconds) showing the current in each of the three phases in AC transmission line 110B, the output of LFD function 410 in response to remote control signals received from line protection system 130, the position of bypass breaker 152, and the position of circuit breaker 120 for each of the three phases in AC transmission line 110B, according to one embodiment. Plot A in Figure 6 shows the current in the three phases of AC transmission line 110B.

[0084] Plot B of FIG. 6 illustrates the time at which the LFD function 410 detects a line fault relative to the time at which a remote control signal containing a command to bypass the SCB 151 is received from the line protection system 130. A value of 0 represents the absence of a signal, and a value of 1 represents the presence of a signal. As illustrated, the LFD function 410 detects a line fault relatively quickly (i.e., within approximately 5 milliseconds of the occurrence of the line fault). Typically, the line protection system 130 can detect a line fault within its detection zone within one-half cycle time. Communication of the bypass command from the line protection system 130 and the SCB station 150 may add a communication delay (e.g., approximately 2 milliseconds). Therefore, the LFD function 410 detects the line fault before the remote control signal containing the bypass command is received from the line protection system 130. Thus, because the line fault has already been confirmed by the time the bypass command is received, logic 440 can immediately determine that the bypass command is consistent with physical state 325 (i.e., "Yes" in subprocess 350 of process 300), and controller 154 can quickly execute the bypass command (e.g., subprocess 360 of process 300). It should be understood that plot B may represent the behavior of each SCB station 150C and 150D.

[0085] Plots C and D of FIG. 6 represent the position of bypass breaker 152 on AC transmission line 110B and the position of each phase circuit breaker 120 on AC transmission line 110B, respectively. A value of 0 represents a closed state, and a value of 1 represents an open state. As shown, due to a rapid decision by protection layer 155, bypass breaker 152 closes immediately after a bypass command is received from line protection system 130. In particular, phase C circuit breaker 120 opens a half-cycle after phases A and B circuit breakers 120 open due to different current zero-crossing moments. It should be understood that plots C and D may also represent the operation of each SCB station 150C and 150D and each circuit breaker 120C and 120D, respectively.

[0086] Notably, in the above scenario, the remote control signal was a valid signal determined to be consistent. If the remote control signal from the line protection system 130 were malicious, the signal from the line fault detection module 410 would never indicate the presence of a line fault (i.e., would remain at a value of 0). As a result, the bypass breaker 152 on the AC transmission line 110B would remain open. In other words, logic 440 may determine that the commands are consistent if the signal from the line fault detection module 410 and the signal from the line protection system 130 both have a value of 1. Conversely, logic 440 may determine that the commands are contradictory if the signal from the line fault detection module 410 has a value of 0 and the signal from the line protection system 130 has a value of 1. It should be understood that logic 440 may not execute when the signal from the line protection system 130 has a value of 0, which means that a command was not received.

[0087] 7A and 7B illustrate the status of the power system 100 before and after emergency power transmission, respectively, according to an exemplary scenario. The components of the power system 100 in FIGS. 7A and 7B are the same as the components of the power system 100 in FIGS. 5A and 5B, and therefore will not be redundantly described here.

[0088] In the pre-transmission condition shown in FIG. 7A, the SCB 151 of each SCB station 150A-150D is bypassed (i.e., each respective bypass breaker 152 is in a closed state), and all circuit breakers 120A-120D are closed. Therefore, neither of the AC transmission lines 110A nor 110B is series-compensated. As shown in FIG. 7B, there is a forced disruption of the DC link 160, which causes a significant system disturbance and results in an emergency power transfer to the AC lines 110A and 110B. As a result, the RAS system 142 issues insertion commands to the SCB stations 150A-150D to effectively compensate for the line inductive reactance of the AC transmission lines 110A and 110B and enhance the stability of the power system 100 against high power swings. As a result, in the post-transmission condition shown in FIG. 7B, the SCB 151 of each SCB station 150A-150D is inserted (i.e., each respective bypass breaker 152 is switched to an open state). Circuit breakers 120A-120D remain closed.

[0089] 7A and 7B , the output of SDD function 420 in response to remote control signals received from RAS system 142, and the position of bypass breaker 152 for each of SCB stations 150A-150D. Plot A of FIG. 8 shows the power flow on DC link 160 and the AC link, and indicates a disruption on DC link 160 at approximately 6 seconds along the timeline.

[0090] Plot B of FIG. 8 illustrates the time at which the emergency power transfer detection module 422 of the SDD function 420 detects an emergency power transfer relative to the time at which a remote control signal containing a command to insert the SCB 151 is received from the RAS system 142. A value of 0 represents the absence of a signal, and a value of 1 represents the presence of a signal. In this scenario, it is assumed that the remote control signal is transmitted by the RAS system 142 immediately upon the occurrence of an outage on the DC link 160 without any time delay, although this is not necessarily the case in practice. As illustrated, the emergency power transfer detection module 422 detects an emergency power transfer relatively quickly (e.g., within one second) after the insertion command is received. Therefore, the logic 440 can quickly determine that the insertion command is consistent with the physical state 325 (i.e., “Yes” in subprocess 350 of process 300), and the controller 154 can quickly execute the insertion command (e.g., subprocess 360 of process 300). It should be understood that plot B may represent the operation of each SCB station 150A-150D.

[0091] 8 represents the position of bypass breaker 152, with a value of 0 representing a closed state and a value of 1 representing an open state. As shown, bypass breaker 152 opens immediately after emergency power transfer detection module 422 of SDD function 420 detects an emergency power transfer, which is immediately after an insertion command is received from RAS system 142. It should be understood that plot C may represent the operation of each SCB station 150A-150D.

[0092] Notably, in the above scenario, the remote control signal was a valid signal determined to be consistent. If the remote control signal from RAS system 142 were malicious, the signal from SDD function 420 would never indicate the presence of a system disturbance (i.e., would remain at a value of 0). As a result, bypass breakers 152 of SCB stations 150A-150D would remain closed. In other words, logic 440 may determine that the commands are consistent if the signal from emergency power transfer detection module 422 and the signal from RAS system 142 both have a value of 1. Conversely, logic 440 may determine that the commands are inconsistent if the signal from emergency power transfer detection module 422 has a value of 0 and the signal from RAS system 142 has a value of 1. It should be understood that logic 440 may not execute when the signal from RAS system 142 has a value of 0, which means that a command was not received.

[0093] 4. Exemplary Embodiments A power system 100, such as a transmission system, may include one or more SCBs 151 at one or more SCB stations 150 on one or more power lines 110. Each SCB station 150 may be controlled by remote control signals transmitted by a remote system, such as a line protection system 130 or one or more control systems 140, to insert or bypass the respective SCB 151 according to scheduled or emergency switching actions. For example, the SCB station 150 may receive commands from a system operator via the SCADA / EMS 144 for scheduled operation, receive fast bypass commands from the line protection system 130 for TRV reduction, receive fast bypass or insertion commands from a system protection scheme (e.g., implemented in the control system 140) as part of a stability improvement strategy for significant generation or transmission disruptions, etc.

[0094] Hackers may access the communication channels of the power system 100 and cause the SCB station 150 to send unauthorized or altered insertion or bypass commands in order to manipulate the position of the SCB 151. These malicious commands may cause deterioration and risk instability of the power system 100, which may lead to the collapse of the power system 100. Therefore, protection against malicious control of the SCB 151 is considered important.

[0095] In one embodiment, one or more, and potentially all, SCB stations 150 in power system 100 may include a controller 154 that stores and executes protection layer 155. Protection layer 155 may intercept all commands received from remote systems (e.g., line protection system 130, control system 140, etc.) to insert or bypass SCBs 151 of SCB stations 150 and evaluate whether the commands are consistent with physical conditions 325 of power system 100. The evaluation may utilize local real-time measurements of voltage and current monitored by controller 154, one or more security features 400 that detect one or more conditions in the real-time measurements, and logic 440 that applies one or more rules to the detected conditions and commands. Based on this evaluation, protection layer 155 may determine whether to execute a given command (e.g., in subprocess 360 of process 300) or block the given command (e.g., in subprocess 370 of process 300). In this manner, the protection layer 155 may prevent cyber attacks intended to manipulate the SCB locations within the power line 110.

[0096] Embodiments of protection layer 155 provide rapid and reliable detection of system disturbances indicative of line faults and contingencies of concern within a detection zone (e.g., a primary detection zone). Furthermore, embodiments of protection layer 155 utilize efficient detection algorithms to detect conditions of concern based on local measurements and logic 440 to apply one or more rules for evaluating command integrity, which are readily implementable in controller 154 of SCB station 150. Furthermore, in one embodiment, SDD function 420 can be used as a defense against DoS attacks by initiating rapid SCB bypass or insertion if control commands (e.g., from RAS system 142) are compromised or blocked by an attacker. Protection layer 155 may also block unwanted control commands sent by malfunctioning remote systems.

[0097] Embodiment 1: A method including: receiving, in a controller of a series capacitor bank (SCB) station, a remote control signal from a system external to the SCB station, the remote control signal representing a command to either electrically insert the SCB into a power line in the power system or to bypass the SCB; using at least one hardware processor to: evaluate whether the command is consistent with a physical state of the power system; block execution of the command by the controller if the command is inconsistent with the physical state of the power system; and allow execution of the command by the controller if the command is consistent with the physical state of the power system.

[0098] Embodiment 2: The method of embodiment 1, further comprising using at least one hardware processor to initiate an alert to one or more recipients if the command is inconsistent with a physical state of the power system.

[0099] Embodiment 3: The method of any of the preceding embodiments, further including using at least one hardware processor to perform a line-fault detection (LFD) function that determines whether a line fault exists within the detection zone, and wherein evaluating whether the command is consistent with a physical state of the power system includes: determining that the command is inconsistent with the physical state of the power system if the command is to bypass the SCB and is received while the LFD function determines that no line fault exists within the detection zone; and determining that the command is consistent with the physical state of the power system if the command is to bypass the SCB and is received while the LFD function determines that a line fault exists within the detection zone.

[0100] Embodiment 4: The method of embodiment 3, wherein the remote control signal is received from a line protection system. Embodiment 5: The method of any of the preceding embodiments, further comprising using at least one hardware processor to perform a system disturbance detection (SDD) function that determines whether a system disturbance is present in the power system, and wherein evaluating whether the command is consistent with a physical state of the power system comprises determining whether the command is consistent based on the presence or absence of the system disturbance determined by the SDD function within a time window around receipt of the remote control signal.

[0101] Embodiment 6: The method of embodiment 5, wherein the system disturbance includes an emergency power transfer, and determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent if the command is to insert an SCB and the SDD function determines that there is no emergency power transfer within the time window; and determining that the command is consistent if the command is to insert an SCB and the SDD function determines that there is an emergency power transfer within the time window.

[0102] Embodiment 7: The method of embodiment 5 or 6, wherein the system disturbance includes a frequency disturbance, and determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that no frequency disturbance exists within the time window; and determining that the command is consistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that a frequency disturbance exists within the time window.

[0103] Embodiment 8: The method of any one of embodiments 5 to 7, wherein the system disturbance includes an abnormal voltage, and determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that no abnormal voltage exists within the time window; and determining that the command is consistent if the command is either to insert an SCB or to bypass an SCB and the SDD function determines that abnormal voltage exists within the time window.

[0104] Embodiment 9: The method of any one of embodiments 5 to 8, wherein the remote control signal is received from a remedial action scheme (RAS) system, an energy management system (EMS), or a wide-area monitoring, protection, and control (WAMPAC) system.

[0105] Embodiment 10: The method of any preceding embodiment, wherein evaluating whether the command is consistent with a physical state of the power system includes: determining that the command is inconsistent with the physical state of the power system if either the command is to insert an SCB and the current load on the transmission line is below a first threshold, or the command is to bypass the SCB and the current load on the transmission line is above a second threshold; and determining that the command is consistent with the physical state of the power system if either the command is to insert an SCB and the current load on the transmission line is above the second threshold, or the command is to bypass the SCB and the current load on the transmission line is below the first threshold.

[0106] Embodiment 11: The method of any of the preceding embodiments, wherein evaluating whether the command is consistent with a physical state of the power system includes determining that the command is inconsistent with the physical state of the power system if either the command is to insert an SCB and was received within a time window from execution of a previous command to bypass the SCB, or the command is to bypass the SCB and was received within a time window from execution of a previous command to insert an SCB.

[0107] Embodiment 12: The method of embodiment 11, wherein the remote control signal is received from a remedial action scheme (RAS) system, an energy management system (EMS), or a wide area monitoring, protection, and control (WAMPAC) system.

[0108] Embodiment 13: The method of any preceding embodiment, further including using at least one hardware processor to perform two or more of a line fault detection (LFD) function that determines whether a line fault exists on the transmission line, a system disturbance detection (SDD) function that determines whether a system disturbance exists within the power system, or an interlocking scheme (IS) function that determines one or both of a load condition on the transmission line or whether a previous command was executed within a time window preceding receipt of the remote control signal, wherein evaluating whether the command is consistent with a physical state of the power system includes executing logic that utilizes determinations by each of two or more of the LFD function, the SDD function, and the IS function to determine whether the command is consistent with the physical state of the power system.

[0109] Embodiment 14: The method of embodiment 13, further comprising using at least one hardware processor to receive real-time measurements of the power system and perform two or more of the LFD function, the SDD function, or the IS function in real time using the real-time measurements as inputs.

[0110] Embodiment 15: The method of embodiment 14, wherein the logic completes execution within 500 milliseconds of receiving the remote control signal.

[0111] Embodiment 16: The method of any of the preceding embodiments, further including using at least one hardware processor to receive real-time measurements of the power system and continuously determine a physical state of the power system in real time based on the real-time measurements, wherein the evaluation is performed each time a remote control signal is received.

[0112] Embodiment 17: The method of any of the preceding embodiments, further comprising, if execution of the command is permitted, using at least one hardware processor to control a bypass breaker of the SCB station in accordance with the command.

[0113] Embodiment 18: The method of embodiment 17, wherein controlling the bypass breaker includes opening the bypass breaker if the command is to insert the SCB, and closing the bypass breaker if the command is to bypass the SCB.

[0114] Embodiment 19: A series capacitor bank (SCB) station comprising an SCB including a bank of capacitors arranged in series along a transmission line in a power system, a bypass breaker, and a controller, wherein the controller includes software representing a local protection layer and at least one hardware processor configured to execute the software to perform the method of any one of embodiments 1 to 18.

[0115] Embodiment 20: A non-transitory computer-readable medium having stored thereon instructions, which when executed by a processor of a series capacitor bank (SCB) station, cause the processor to perform the method of any one of embodiments 1 to 18.

[0116] The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles described herein may be applied to other embodiments without departing from the spirit or scope of the present invention. It should therefore be understood that the description and drawings presented herein represent presently preferred embodiments of the present invention and, therefore, represent the subject matter broadly contemplated by the present invention. It is further understood that the scope of the present invention fully encompasses other embodiments that may become apparent to those skilled in the art, and therefore, the scope of the present invention is not limited.

[0117] Combinations described herein, such as "at least one of A, B, or C," "one or more of A, B, or C," "at least one of A, B, and C," "one or more of A, B, and C," and "A, B, C, or any combination thereof," include any combination of A, B, and / or C, and may include multiple As, multiple Bs, or multiple Cs. Specifically, combinations such as "at least one of A, B, or C," "one or more of A, B, or C," "at least one of A, B, and C," "one or more of A, B, and C," and "A, B, C, or any combination thereof," may be A only, B only, C only, A and B, A and C, B and C, or A, B, and C, and any such combination may include one or more members of its components A, B, and / or C. For example, a combination of A and B may include one A and multiple Bs, multiple A and one B, or multiple A and multiple Bs.

Claims

1. In the series capacitor bank (SCB) station controller, receiving a remote control signal from a system external to the SCB station, the remote control signal representing a command to either electrically insert the SCB into a power line in a power system or to bypass the SCB; evaluating whether the command is consistent with a physical state of the power system; blocking execution of the command by the controller if the command is inconsistent with the physical state of the power system; allowing the controller to execute the command if the command is consistent with the physical state of the power system; 2. A method comprising: using at least one hardware processor to perform

2. 2. The method of claim 1, further comprising: using the at least one hardware processor to initiate an alert to one or more recipients if the command is inconsistent with the physical state of the power system.

3. and further comprising using the at least one hardware processor to perform a line-fault detection (LFD) function to determine whether a line fault exists within a detection zone, wherein evaluating whether the command is consistent with the physical state of the power system comprises: determining that the command is inconsistent with the physical state of the power system if the command is to bypass the SCB and is received while the LFD function determines that no line fault exists within the detection zone; and determining that the command is consistent with the physical state of the power system if the command is to bypass the SCB and is received while the LFD function determines that the line fault is present within the detection zone; The method of claim 1 , comprising:

4. The method of claim 3 , wherein the remote control signal is received from a line protection system.

5. 2. The method of claim 1, further comprising using the at least one hardware processor to perform a system disturbance detection (SDD) function that determines whether a system disturbance is present in the power system, and wherein evaluating whether the command is consistent with the physical state of the power system comprises determining whether the command is consistent based on the presence or absence of the system disturbance determined by the SDD function within a time window around receipt of the remote control signal.

6. The system disturbance comprises an emergency power transfer, and determining whether the command is consistent based on the presence or absence of the system disturbance comprises: determining that the command is inconsistent if the command is to insert the SCB and the SDD function determines that there is no emergency power transfer within the time window; and determining that the command is consistent if the command is to insert the SCB and the SDD function determines that the emergency power transfer occurs within the time window; The method of claim 5 , comprising:

7. The system disturbance includes a frequency disturbance, and determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent if the command is either to insert the SCB or to bypass the SCB and the SDD function determines that there is no frequency disturbance within the time window; determining that the command is consistent if the command is to insert the SCB or to bypass the SCB, and the SDD function determines that the frequency disturbance is present within the time window; The method of claim 5 , comprising:

8. The system disturbance includes an abnormal voltage, and determining whether the command is consistent based on the presence or absence of the system disturbance includes: determining that the command is inconsistent if the command is either to insert the SCB or to bypass the SCB and the SDD function determines that no abnormal voltage exists within the time window; determining that the command is consistent if the command is to insert the SCB or to bypass the SCB, and the SDD function determines that the abnormal voltage exists within the time window; The method of claim 5 , comprising:

9. 6. The method of claim 5, wherein the remote control signal is received from a remedial action scheme (RAS) system, an energy management system (EMS), or a wide-area monitoring, protection, and control (WAMPAC) system.

10. Evaluating whether the command is consistent with the physical state of the power system includes: the command is to insert the SCB and the current load on the transmission line falls below a first threshold; or The command is to bypass the SCB and the current load on the transmission line exceeds a second threshold. determining that the command is inconsistent with the physical state of the power system if either the command is to insert the SCB and the current load on the transmission line exceeds the second threshold; or The command is to bypass the SCB, and the current load on the transmission line is below the first threshold. determining that the command is consistent with the physical state of the power system if either The method of claim 1 , comprising:

11. Evaluating whether the command is consistent with the physical state of the power system includes: The command is to insert the SCB and was received within a time window from execution of a previous command to bypass the SCB, or The command bypasses the SCB and was received within the time window since execution of a previous command to insert the SCB. The method of claim 1 , further comprising determining that the command is inconsistent with the physical state of the power system if either

12. 12. The method of claim 11, wherein the remote control signal is received from a remedial action scheme (RAS) system, an energy management system (EMS), or a wide area monitoring, protection, and control (WAMPAC) system.

13. a line fault detection (LFD) function for determining whether a line fault exists on the power transmission line; a system disturbance detection (SDD) function that determines whether a system disturbance is present in the power system; or an interlocking scheme (IS) function that determines the load condition of the power line and / or whether a previous command was executed within a time window preceding receipt of the remote control signal; using the at least one hardware processor to perform two or more of:

2. The method of claim 1, wherein evaluating whether the command is consistent with the physical state of the electrical power system comprises executing logic that utilizes the determination by each of the two or more of the LFD function, the SDD function, and the IS function to determine whether the command is consistent with the physical state of the electrical power system.

14. receiving real-time measurements of the power system; performing said two or more of said LFD function, said SDD function, or said IS function in real time using said real time measurements as inputs; 14. The method of claim 13, further comprising using the at least one hardware processor to:

15. 15. The method of claim 14, wherein the logic completes execution within 500 milliseconds of receiving the remote control signal.

16. receiving real-time measurements of the power system; continuously determining the physical state of the power system in real time based on the real-time measurements; using the at least one hardware processor to perform The method of claim 1 , wherein the evaluation is performed each time a remote control signal is received.

17. 2. The method of claim 1, further comprising: if execution of the command is permitted, using the at least one hardware processor to control a bypass breaker of the SCB station in accordance with the command.

18. controlling the bypass breaker If the command is to insert the SCB, opening the bypass breaker; If the command is to bypass the SCB, closing the bypass breaker.

18. The method of claim 17, comprising:

19. an SCB including a bank of capacitors arranged in series along a transmission line in the power system; A bypass breaker, Controller and 1. A series capacitor bank (SCB) station comprising: The controller software representing a local protection layer; receiving a remote control signal from a system external to the SCB station, the remote control signal representing a command to either electrically insert the SCB into the transmission line by opening the bypass breaker or to bypass the SCB by closing the bypass breaker; evaluating whether the command is consistent with a physical state of the power system; blocking execution of the command if the command is inconsistent with the physical state of the power system; Executing the command if the command is consistent with the physical state of the power system. at least one hardware processor configured to execute the software to perform the Series Capacitor Bank (SCB) stations, including:

20. A non-transitory computer-readable medium having stored thereon instructions that, when executed by a processor of a series capacitor bank (SCB) station, receiving a remote control signal from a system external to the SCB station, the remote control signal representing a command to either electrically insert the SCB into a transmission line within an electric power system or to bypass the SCB; evaluating whether the command is consistent with a physical state of the power system; blocking execution of the command by the controller if the command is inconsistent with the physical state of the power system; allowing the controller to execute the command if the command is consistent with the physical state of the power system; a non-transitory computer-readable medium for causing the processor to perform the steps of:

Images