CYBER RESILIENT ENERGY DELIVERY CONSORTIUM | CRED-C.ORG

FUNDING SUPPORT PROVIDED BY THE U.S. DEPARTMENT OF ENERGY AND THE U.S. DEPARTMENT OF HOMELAND SECURITY

Securing Fault Localization ApplicationsAnna Scaglione, Teklemariam Tesfay

FAULT DETECTORS ARE VULNERABLE

PMU DATA FOR FAULT LOCALIZATION

COLLABORATION OPPORTUNITIES

Compare fault localization results that use data from a

limited number of PMUs with results from fault detectors

data analytics to detect the presence of a cyber attack.

ZONE IDENTIFICATION

CYBER ATTACK DETECTION

• Faults happen due to natural effects, man-made situations, or from

equipment failures

• Data from fault detectors allow fast fault detection and localization

• An attacker can manipulate the SCADA data from fault detectors to

give wrong fault location or hide its presence, thereby delaying

service restoration

• Analyzing aggregated data from multiple PMUs to localize fault

• Only few PMU deployed (economics!) forcing utilities to operate in

low measurement regime

• Not enough to pinpoint the exact location of a fault

Proposed formulation

• Localizes a fault with low resolution about the exact

location

• Uses pre- and post-fault data and bus admittance matrix

• Tested on an IEEE-34 bus system using OpenDSS to

generate simulated pre- and post-fault data.

This research would benefit from collaboration with industry

partners in the following areas:

• Datasets of PMU measurements and SCADA data from actual

distribution systems

• Industry level implementation for DMS to commercialize our solution

• Contact: Anna.Scaglione@asu.edu, ttesfay@asu.edu

• Activity webpage: https://cred-c.org/researchactivity/Analytics

Fault

Type

Exact fault location Highly probably faulty nodes

LLL 816 814,816,850

A-G 822-A 814-A,816-A,818-A,820-A,822-A,850-A

BC-G 852-B-C 832-B-C,852-B-C

Future Direction

• Mathematical formulation for optimal PMU placement guaranteeing

minimum ambiguity throughout the network

• Implement the proposed method on SPARCS architecture

Simulation results show the presence of a cluster of nodes

(communities) as candidate fault locations

5

0

0.5

1

1.5

2

2.5

3

3.5

4

4.5

5

Obje

ctive F

unction V

alu

e

104

800 802 806 808 812 814 816 824 828 830 854 832 858 834 860 842 836 840 862 844 846 848 850 888 852 890

Fault Location Candidate Bus

20332094

Fig. 4. Objective Function Value of Eq. (6) for Three-Phase Fault-Bus 834 .

Scenario 2: In this scenario, we assume that the exact value

of the fault current is somehow given to us. The reason for this

assumption is to show that the approximate fault current is not

only the cause for the aforementioned ambiguity and, in fact,

the similarity of the corresponding columns of Za is the root

cause of this ambiguity. In this scenario, a three-phase fault is

introduced at bus 836. The result of the metric for this case

is given in Fig. 5. It is clear from the results that there is an

inherent ambiguity in locating the fault in this case even when

the exact fault current is available: due to the correlation of the

columns in Za buses 840, and 862 are prone to be mistaken

with bus 836 as the fault location.

B. Test-Case Community of Nodes

In this part, the correlation of the columns of the matrix

pre-multiplied by I E ,ℓ in Eq. (6) and Eq. (14) is shown. We

use the following definition to look at the normalized value of

the unsigned correlation of the columns.

Definition. The absolute value for the correlation coefficients

of the columns of a matrix X = [X 1, X 2, . . .] that is used is

defined as follows:

[C]m ,n =|X H

m X n |

||X m || ||X n ||(16)

Fig. 6 shows the correlation of the columns of Za (on the

left) and D (on the right) corresponding to phase-A that is

0

200

400

600

800

1000

1200

1400

Ob

jec

tive

Fu

nc

tio

n V

alu

e

834 860 842 836 840 862 844 846 848

Fault Location Candidate Bus

Fig. 5. Objective Function Value of Eq. (6) for Three-Phase Fault-Bus 836 .

produced using the definition4 given in Eq. (16) based on the

placement in Table. I.Before Whitening

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1After Whitening

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Fig. 6. Correlation of Columns related to Phase-A of a) Z a and b) D .

In this figure,5 the correlated columns of Za in Fig. 6a form

smaller groups, due to the sensors placement. To better under-

stand the location of highly correlated nodes with respect to

each other, we first choose a threshold of τ on the correlation

coefficient and build an adjacency matrix A as follows:

[A ]m ,n =1 if [C]m ,n ≥ τ , m = n

0 else(17)

Fig. 7 shows a graph corresponding to the adjacency matrix

A , built using the correlation coefficients of columns of D

and overlaid on the IEEE-34 test case topology. The heat-map

Adjacency Matrix Graph

Fig. 7. Adjacency Matrix Graph for Correlation Coefficients of Columns ofD with τ = 0.814.

for the correlation coefficients of the columns corresponding

to phase-B and phase-C in the matrix D follow a similar

pattern as in Fig. 6 (b). As expected based on our analysis

in Section III-A, the nodes with high correlation are those

that are located in a neighborhood of each other. The fault

location in the presented approach can locate the fault up to

the resolution of these communities, which can be interpreted

as a low-resolution representation of the graph.

It should be noted that the communities that emerge are de-

pendent on the locations of the sensors. The placement based

on Table I has been done leveraging the heuristic discussed at

the end of Section III-A. To show how abad placement change

4Note that the correlation between the columns corresponding to phasei ( i = a, b, c) and j ( j = i ) is not important since for a faulty phase i ,the indices corresponding to phase j are not candidates. For example, whena three phase fault occurs, we want to put the first element of fault currentvector at locations corresponding to phase a so it is important how thesecolumns corresponding to phase a form communities no matter what theircorrelations are with respect to the columns corresponding to phase b or c.

5The ordering of the nodes have changed here to put the neighboring nodesas close as possible to each other to better visualize the communities, whereasthe actual matrix is separated as blocks of available and unavailable nodes.

• Nodes that have similar properties in

the fault localization application (that

have strong correlation) form a zone

• The size and structure of the zones are

dependent on the network topology

and the placement of PMUs

• Proposed a placement heuristics

guaranteeing balanced zone sizes

Zones are formed by neighboring nodes in a network

800802 806 808

810

812 814R1

850

816

818

820

822

824 826

828 830 854 856

852

R2

832

T1888 890

838

862

840836860834858

864842

844

846

848

Substation

DG1

IMPACT ON STATE OF GRID SECURITY

Impacts on Your Grid

• Prevent delayed recovery from a fault that could be caused as a result

of a cyber attack which mis-locates or hides the fault

Business Benefits

• Economic placement of PMUs

• Minimize economic lose by enabling fast isolation of fault locations

• Simulated SCADA data for fault detectors at each end of the lines is

generated using opendnp3.

• A-G fault introduced at 822-A

• PMU data analytics shows fault in buses 814-A,816-A,818-A,820-

A,822-A,850-A (Zone B)

• Simulated SCADA data from fault detectors manipulated such that the

analytics shows fault at 846-A (Zone D)

• Inconsistent results. Alarm about presence of a cyber attack!

800802 806 808

810

812 814R1

850

816

818

820

822

824 826

828 830 854 856

852

R2

832

T1888 890

838

862

840836860834858

864842

844

846

848

Substation

DG1Actual

fault locationFault location from

manipulated data

Faulty Zone identified using

μPMU data analytics

A

BC

D

F

RESEARCH VISION

SPARCS hierarchical architecture

Correlation coefficients threat-map

Local PMU data analytics

Local SCADA data analytics

Cassandra /Elastic Search Databases

Central PMU analytics

Central SCADA data analytics

…Check for

inconsistency

…

800802 806 808

810

812 814R1

850

816

818

820

822

824 826

828 830 854 856

852

R2

832

T1888 890

838

862

840836860834858

864842

844

846

848

Substation

DG1

PMU Fault detector

010…

Attacker