Secure electric power delivery system protection during cyber threats
Systems and methods may maintain protection of electric power delivery systems in the event of an attack on protection and/or control features of the power system. Primary protective functions may be physically isolated from other functions in primary protection relays. Integrators may facilitate non-primary protection functions and disconnect all communication with primary protection relays in the event of an attack. Primary protection relays maintain protection functions even during the attack or unavailability of the integrators.
1. A system to maintain protection of an electric power delivery system during a cyber-attack, comprising:
a primary protection relay configured to provide protection to the electric power system, the primary protection relay comprising:
a power system signal input configured to receive electric power delivery system signals from one or more external elements of the electric power delivery system;
a protection subsystem configured to determine an operating condition of the electric power delivery system using the electric power delivery system signals and to implement a protective action command when the operating condition is outside of a predetermined operating parameter; and
a protective action output configured to transmit a protective action command to be performed by primary equipment of the electric power delivery system; and
a supervisory system in communication with the primary protection relay, the supervisory system comprising:
a communication subsystem configured to control communications with the primary protection relay, the communications being distinct from the electric power delivery system signals received from one or more external elements of the electric power delivery system via the power system signal input; and
a kill switch subsystem configured, upon activation following detection of the cyber-attack, to restrict all of the communications with the primary protection relay received via the communication subsystem;
wherein, after activation of the kill switch subsystem and while all of the communications with the primary protection relay continue to be restricted, the primary protection relay continues to provide protection of the electric power delivery system by continuing to receive and monitor the electric power delivery system signals from the one or more external elements of the electric power delivery system during the restriction of all of the communications via the communication subsystem.
2. The system of claim 1 , wherein the supervisory system further comprises a contact input for activation of the kill switch subsystem.
3. The system of claim 1 , wherein the supervisory system comprises an integrator.
4. The system of claim 1 , wherein the supervisory system further comprises a security subsystem in communication with the kill switch subsystem, the security subsystem to detect an attack and activate the kill switch subsystem upon detection of the attack.
5. The system of claim 4 , wherein the security subsystem further comprises a firewall enabled by one of activation of the kill switch subsystem or detection of a cyber threat.
6. The system of claim 1 , wherein the communication subsystem is in communication with the kill switch subsystem and operable to receive of a command to activate the kill switch subsystem.
7. The system of claim 1 , wherein the supervisory system comprises a physical input in communication with the kill switch subsystem to activate the kill switch subsystem.
8. The system of claim 7 , wherein the physical input comprises at least one of a pushbutton, a membrane button, or a physical switch.
9. The system of claim 7 , wherein the physical input is disposed on an accessible face of the primary protection relay.
10. The system of claim 1 , wherein the kill switch subsystem comprises a plurality of communication disconnect switches, each of the plurality of communication disconnect switches to restrict one or more communication paths between the primary protection relay and one or more external elements.
11. The system of claim 1 , wherein the primary protection relay comprises one of a transformer relay, a bus relay, or a feeder relay.
12. The system of claim 1 , wherein the protection subsystem comprises at least one of an overcurrent element, a differential element, an overvoltage element, an undervoltage element, a directional element, a distance element, an overfrequency element, an underfrequency element, or a rate-of-change-of-frequency element.
13. The system of claim 1 , wherein the communication subsystem comprises an optical communication port.
14. A method for selectively disabling at least one communication path to a primary protection relay while the primary protection relay continues to provide protection to an electric power delivery system using a supervisory system, the method comprising:
directing, with a supervisory system, communications between a primary protection relay of the electric power delivery system and one or more external devices in communication with the electric power delivery system through the supervisory system, the primary protection relay configured to:
receive electric power delivery system signals from the one or more external elements of the electric power delivery system;
determine an operating condition of the electric power delivery system using the electric power delivery system signals and to implement a protective action command when the operating condition is outside of a predetermined operating parameter; and
transmit a protective action command to be performed by primary equipment of the electric power delivery system;
detecting, with the supervisory system, activation of a kill switch;
disrupting, with the supervisory system, one or more communication paths between the primary protection relay and the one or more external devices while the kill switch is activated, the one or more communication paths being distinct from the electric power delivery system signals received from one or more external elements of the electric power delivery system by the primary protection relay; and
during the disrupting of the communication path, continuing,
with the primary protection relay, to provide protection operations by continuing to receive and monitor the electric power delivery system signals from the one or more external elements of the electric power delivery system during the disrupting of the one or more communication paths.
15. The method of claim 14 , wherein the supervisory system comprises an integrator.
16. The method of claim 15 , further comprising automatically activating the kill switch in response to one or more detected threats to the electric power delivery system.
17. The method of claim 15 , wherein activating the kill switch comprises detecting manipulation of a physical switch by a user.
18. The method of claim 14 , further comprising activating at least one of a plurality of communication disconnect switches, each of the communication disconnect switches restricting one or more select communication paths between the primary protection relay and the one or more external devices.