IEEE Power & Energy Magazine - May/June 2019 - 43

grid resiliency can be enhanced using the security of hvdc,
what can be done to ensure hvdc systems are secure?
it is clear that hvdc, in its several possible configurations, provides services that support overall stability and
security when compared to the bulk ac system absent hvdc.
thus, to ensure grid cohesiveness, other utility systems'
interactions with hvdc must be secure. it is obvious that
hvdc systems are beholden to the limitations and vulnerabilities of the array of sensors and digital components in
Scada and WaMpac systems. the bulk power system, as
designed, provides limited defense; settings on most protection devices are typically configured to provide protection
for equipment and do not commonly consider the stability
of a power system as a whole. counterexamples include
power-swing blocking relays and system-specific remedial
action schemes. the first prevents inadvertent relay action
against system swings; the latter initiates switching actions
to arrest system collapse.
With respect to the fragilities outlined previously, it is
clear that particular attention must be paid to the utility control systems interacting with hvdc. part of the solution to
securing hvdc includes intrusion detection tailored to the
Scada protocols used for data communication and authentication in the system, specifically between the converter stations and the ac system control centers at each end. When
compared to it systems, the cyberplane of high-voltage ac/
dc coupled systems and Scada systems, in general, benefits from the fact that functionality is relatively constrained,
protocols are relatively simple, and communication patterns
are regular. this enables adoption of solutions based on
white listing (allowing only protocols and communication
patterns that are known to be correct). although these measures go a long way toward securing the coupled system, we
can further enhance security by leveraging system physics.
For example, it may be possible to model the impact of a
power-order command on the wider ac system ahead of the
(relatively slow) power-order execution or while the dc system ramps up its power injection.
thus, high-level detection techniques are necessary
to ensure nominal operation of the hvdc converter station. output monitoring methods, independent of Scada
and associated devices, are necessary to provide oversight
of general system health. these detection techniques are
responsible for ensuring that the hardware-level switching
action is consistent with the action commanded by remote
sensors and Scada equipment.
Upon detection of a potentially insecure control action,
due to malicious cyberattack, metering error, operator error,
or other unforeseen complications, the power-flow controller will be reconfigured to ensure stability and safety of the
converter while retaining as much functionality as is feasible for the sake of overall grid stability. a control action
that would be cause for concern includes inconsistent power
flows commanded by an outsider intending to destabilize the
electrical grid.
may/june 2019

Framework for Improved Resilience
to illustrate the fundamental challenge at the converter level,
consider two utilities with an existing power transfer agreement and with control centers linked via protocol, such as
the intercontrol center protocol (iccp). the two utility ac
systems are connected at a number of ac buses. in addition,
there is an hvdc link between the two utilities. this consists
of a converter (ac-to-dc) substation in the footprint of the first
utility, the hvdc line itself, and the inverter (dc-to-ac) substation in the footprint of the second utility. communication
between each utility substation is via Scada protocol, such
as distributed network protocol (dnp3). Such a configuration is common in systems that share power via hvdc.
assume an attacker can inject syntactically correct but
physically invalid dnp3 messages between the control room
and hvdc converter station. the adversary can only attack
the data link between the utility control center and the hvdc
converter station. trusted measurements from the rest of the
ac system are available to the detection mechanism. State
estimation may then aid in the validation of the appropriateness of power-order commands and to validate the correct
execution of a correct command.
the power flow on the hvdc line is determined from
the optimal power flow solution by the transmission system
operator, considering the agreement between the sendingand receiving-end ac control centers. all the controls at the
hvdc station are local. these include converter controls, ac
and dc cBs, capacitors, ac and dc filters, and transformer

(a)

(b)

figure 2. (a) A series-connected MTDC system and (b) a
parallel-connected MTDC grid.
ieee power & energy magazine

IEEE Power & Energy Magazine - May/June 2019

Table of Contents for the Digital Edition of IEEE Power & Energy Magazine - May/June 2019