BDEW Whitepaper on Security for the Power Industry has been updated

Whitepaper V 1.1
Anforderungen an sichere Steuerungs- und Telekommunikationssysteme

White Paper V 1.1
Requirements for Secure Control and Telecommunication Systems

This updated white paper specifies essential security measures for control and telecommunication systems for the power industry. The purpose of this document is to sufficiently protect the operation of these systems against security threats. The security measures described in this document are recommended for all newly procured control and telecommunication systems. The strategic goal of this white paper is to favourably influence the future development for aforementioned systems with regard to IT security. Furthermore the document should establish a mutual understanding for the protection issues of these systems throughout the industry.

Click HERE for a copy of the whitepaper.

Click HERE for related documents.

Video About the German Energiewende

A 11 minute film about Germany’s Renewable Energy Revolution, the so called Energiewende (energy transition) has been published recently.
Voices from science, industry, and politics outline the achievements made so far, next steps, and the opportunities the energy transition offers.

Click HERE to watch the video.

Even the video does not mention IEC 61850 – it is clear that the standard series plays a major role in the future energy delivery in Germany, in Europe and all over!

After the announcement of the White House to spent many Billions of US$ on clean energy, I would not wonder if the German and other governments follow and spent also a lot of Euros and other currencies in the near future.

Hope we have enough well educated engineers to work with the money. If you need good education in the automation of power delivery systems: Here you can get some.

New IEC 61850 Edition 2 Demo Package Available to run on Windows

After successful usage of our old demo package provided 2010 and 2011 NettedAutomation provides a new package for Edition 2 of the IEC 61850 core parts.

The new package comes with a DLL comprising the IEC 61850 Stack, an simple API, and a powerful SCL configuration tool – all included in the DLL. The package contains executable programs that can be used right away. Additionally you will find also the course code of the applications for you to modify the applications to your own needs.

There are two different applications for the client and server:

1. C++ programmed very basic console applications:

The values can manually be changed … use the listed commands.

2. .Net/C# programmed enhanced applications (SCADA like):

The client starts the CER system by clicking the box on the upper left corner of the Client application. The Server application will run. Add values in ther server application … to be reported to the client. The use-case is quite realistic.

All client and server applications use the same DLL (provided by SystemCorp). The IEC 61850 models and communication services are configured by corresponding SCL Files. The applications provided are intended to show what IEC 61850 offers and how to use the simple API for a short time-to-marked development. The applications show how to exchange information with your applications:

 

The client and server can run on one machine (local host) or on two machines. In case of two machines you can trace the communication with, e.g., Wireshark. The addresses (MAC and IP) have to be configured differently for the two cases. The client connects automatically with the server (based on the SCL files) – no need for manual intervention. The demo shows how an embedded client can communicate with a server – without and browsing service.

The client and server can be configured to publish GOOSE and SV.

Some basic documentation comes with the package that can be downloaded. The main objective is the use of the package in our comprehensive hands-on training courses.

Click HERE to get access to the package.

Enjoy!

XMPP - IEC 61850-8-2 Defines Additional Communication Mapping

IEC TC 57 has published a first draft for an additional mapping of IEC 61850 information models and communication messages.

IEC 61850-8-2 (57/1583/CD):
Communication networks and systems for power utility automation - Part 8-2: Specific Communication Service Mapping (SCSM) – Mapping to Extensible Messaging Presence Protocol (XMPP)

Closing date for comments is 2015-09-11

The new mapping defines (relies on) the following definitions:

Service mapping (unchanged)
The abstract (client-server) services of IEC 61850-7-2 are mapped to MMS as defined in the existing IEC 61850-8-1 Ed2.

Message Encoding (new concrete encoding)
The encoding of the messages uses ASN.1 XER (XML encoding rule) – in addition to ASN.1 BER according to IEC 61850-8-1 Ed2. The encoding defines an XML schema – contained in the draft.

Model mapping (unchanged)
As in IEC 61850-8-1 Ed2. This applies to the flattening of the object identification and adding Functional Constraint (FC=ST or MX) in the path name and using “$” for “.”:

Bay5_MMXU1$MX$Hz$mag$i

Underlying Transport (new T-Profile)
The transport (exchange) of the XER encoded messages uses a new approach: using XMPP.

This new transport mechanism and encoding will be used between all kinds of utility Distributed Energy Resource devices and related power management systems, over any communication infrastructure including public networks.

The coming IEC 61850-8-2 can be understood as an (encoding and transport) extension of the existing IEC 61850-8-1.

It is very crucial that most parts of implementations and tools can be re-used! Re-Use is one of the basic approaches used in IEC 61850! Don’t start always from scratch – use what is available and add something.

So, to read the frequency of Bay5 is almost the same .. using the reference
“Bay5_MMXU1$MX$Hz$mag$i”
encoded in ASN.1 BER (IEC 61850-8-1) and in ASN.1 XER (IEC 61850-8-2).

See also example of encoding.

A second document explains the needs and background for an additional mapping:

IEC 61850-80-3 TR (57/1584/DTR):
Communication networks and systems for power utility automation -
Part 80-3: Mapping to Web protocols – Requirements and technical choices

It describes the requirements and the technical principles for a new specific communication service mapping (SCSM) based on Web Protocols.
For more information about the candidate technologies which have been analyzed but not selected as well as about the selection process used for choosing the technology, national committees are invited to consult document 57/1585/INF which is circulated in parallel:

Accompanying document to 57/1584/DTR, Proposed IEC TR 61850-80-3

It mainly describes the technical solutions which have been investigated but finally not selected for the SCSM of the IEC 61850 based on Web Protocols.

1. IEC 61400-25-4 Annex A (Web services)
2. DPWS (Devices Profile for Web Services)
3. REST (Representational State Transfer)
4. XML messaging over Websocket
5. ACSI XML Messaging
6. OPC UA

The finally chosen solution  “MMS XER payload over XMPP as transport” was recognized after several years of work as the preferred solution – especially from a fast time-to-market point of view.

What does XMPP provide?

XMPP (RFC 6120) is a middleware messaging and presence protocol supporting decentralized architectures and provides:

• Registering resources in publicly reachable servers
• Resolving resources based on names
• Security (authentication, integrity, confidentiality) for the communication with the XMPP server

This fits well to the information models defined in IEC 61850.

NEW Training Opportunities for IEC 61850, IEC 61400-25, IEC 60870-5-104, and IEC 62351

Education is one of the crucial aspects when it comes to information modeling, system and device configuration, information exchange, and security measures.

Many new or updated standards have been published during the last couple of months – and more to come: e.g., several parts of the series IEC 61850 will be published as Edition 2.1.

In addition to many new definitions we are seeing more and more utilities and vendors in getting started using the above mentioned standards in Automation and Protection … SCADA, …

Taking the experience with the many solutions and the new standard s into account, FMTP and NettedAutomation offer a new series of training courses (in English and German). FMTP and NettedAutomation have conducted more than 10 in-house courses in recent months and several public events. You would tap the experiences of so far more than 4.000 attendees we have trained (FMTP and NettedAutomation) all over.

Karlsruhe (Deutsch, Karlheinz Schwarz):
02-04 Dezember 2015 (neues Datum)
11-13 Januar 2016
14-16 März 2016

Click HERE for details

Karlsruhe/Germany (English, Andrea Bonetti and Karlheinz Schwarz):
13-16 October 2015
04-07 April 2016
10-13 October 2016

Click HERE for details

Dammam City/Saudi Arabia (English, Andrea Bonetti and Karlheinz Schwarz):
18-21 October 2015

Details will be available soon.

Stockholm/Sweden (English, Andrea Bonetti and Karlheinz Schwarz):
22-25 February 2016
19-22 September 2016

Click HERE for details

We look forward to seeing you in one of the above courses or in an in-house event.

Contact us if you are interested in an in-house event.

Some Videos related to IEC 61850 by Karlheinz Schwarz

Some videos produced by Karlheinz Schwarz (NettedAutomation GmbH) can be found here:

Click HERE to access a list of several interesting videos on various IEC 61850 (IEC 61400-25) issues.

Enjoy.

In case you would like to see more videos on other issues – let me know.

Contact Karlheinz Schwarz.

Security: A Never Ending or a not Yet Started Story?

Everybody talks about security! Who is working on it? Some people are working on meeting compliance requirements like those defined in NERC CIP. Very few are dealing with measures to make and keep systems secure.

What's the difference between compliance and security? Does being compliant also mean being secure? NO – not at all. Being compliant may let you sleep better …

Two excellent publications touch on these issues:

1. NERC CIP v5 Suggests Compliance Does Not Equal Security

2. What effective legislation would you write for CI ICS

The first article closes:

“Compliance means you won't be fined. Security means you won't end up in the headlines. A friendly security suggestion would be to look beyond CIP compliance and use it as a baseline for your security policies.”

and the second:

“Hopefully, industry can get behind some sort of meaningful control system
security legislation before we end up with a catastrophic attack on a control
system.”

Since most people likely not yet have tried to implement security measures … the following sign (I purchased the other day) wouldn’t help either:

Try it again or the first time. But don’t give up before you have a process for a higher level of security in operation. And never give up to improve.

IEC 62351-11: Draft on Securing XML files

XML (a notation for structured documents) is used in many standards published by IEC TC 57 (Power systems management and associated information exchange). IEC 61850-6 (SCL) is one of these parts that rely on XML and XML schema.

A small change in an SCL file may have a crucial impact of the content of the whole file.  There is a need to secure such files.

IEC TC 57 just published the first CDV:

IEC 62351-11 Ed.1 (57/1562/CDV)

Power systems management and associated information exchange - Data and communications security -
Part 11: Security for XML files

The 62351-11 extensions provide the capability to provide:

• Header information: the header contains information relevant to the creation of the secured document such as the Date and Time of the when the IEC 62351-11 document was created.
• A choice of encapsulating the original XML document in an encrypted (Encrypted) or non-encrypted (nonEncrypted) format. If encryption is chosen, there is a mechanism provided to express the information required to actually perform encryption in an interoperable manner (EncryptionInfo).
• AccessControl: a mechanism to express access control information regarding information contained in the original XML document.
• Body: is used to contain the original XML document that is being encapsulated.
• Signature: a signature that can be used for the purposes of authentication and tamper detection.

What do you think about security? It is important! How many time and money have you and your colleagues or your management spent for making systems more secure? One Euro or 1000 Euro?

When it comes to costs – then people are behaving different.

Be more serious about security.

1400 Tissues (Technical Issues) listed since 2004

The Tissue process is one of the crucial means to improve the quality of the various parts of the IEC 61850 standard series and helps to improve the interoperability of IEDs. Since 2004 the IEC 61850 experts have posted more than 1400 Tissues – number 1400 was posted today (2015-06-04).

The Tissue 1400 is very interesting: It is based on input from utilities (User Feedback Task Force).

This tissue proposes to remove several options in the area of how the subscription is specified in an SCL file – and to allow only ONE possibility. 

This is a good news!

I personally expect that this approach (to get rid of options) will be applied more often in the future.

Note: Many tissues are just questions that are tagged as “blue” tissues.

FDIS of Edition 2 of IEC 61400-25-2 and IEC 61400-25-3 approved

Two final draft international standards of the series IEC 61400-25 have been approved by 100 % of the members on 2015-05-22:

IEC 61400-25-2 Ed.2: Wind turbines -
Part 25-2: Communications for monitoring and control of wind power plants -
Information models

IEC 61400-25-3 Ed.2: Wind turbines -
Part 25-3: Communications for monitoring and control of wind power plants -
Information exchange models

This situation proofs that the core parts of the standard series IEC 61850 and IEC 61400-25 are mature and available.

It is very likely that those vendors and users that were waiting for the second edition are now speeding up to implement and use IEC 61400-25.

Draft IEC 61850-90-2 for Substation to Control Center Communication published

The substation (or power plant or …) to control center communication is historically based on hundreds of protocols. Among those you will find also protocols like IEC 60870-5-101, IEC 60870-5-104 or DNP3. The original scope of IEC 61850 was (politically) restricted to substations. From a technical point of view it was expected from the very beginning of the work on IEC 61850 that it could be used also for this and many other use-cases.

After several years of work on the official document it is now available for final vote:

57/1578/DTR (164 pages):
IEC 61850-90-2 TR Ed.1
Communication networks and systems for power utility automation –
Part 90-2: Using IEC 61850 for the communication between substations and control centres

The voting ends on 2015-07-24

This document is very important for the communication with control centers. It covers crucial aspects:

1. Information modeling (proxy/gateway),
2. Information models (use of existing models and extensions)
3. Configuration language and engineering,
4. Information exchange services (redundancy, …)
5. Security aspects

for the following use-cases:

1. Telecontrol
2. Synchrophasor
3. Disturbance
4. Counting
5. Power Quality
6. Asset
7. Parameter configuration

The document contains many examples that help to understand the different use-cases.

This document closes one crucial gap in the information exchange of many different systems, e.g., substations, power plants, hierarchical control centers, with control centers.

The most crucial aspect is the application and extension of SCL (System Configuration Language – IEC 61850-6).

Several useful extensions are defined, e.g., the link between a proxy/gateway model and the original model. To support end to end testing through the Proxy/Gateway functional links between the data objects in the Proxy/Gateway server and the original source of information in a substation IED can be expressed as the following example shows:

<LN lnClass="MMXU" lnType="MMXU" inst="1">
   <Private type="eTr-IEC61850-90-2">
      <eTr-IEC61850-90-2:ProxyOf externalScl="Substation" iedName="IED2" ldInst="MEAS"
      lnClass="MMXU" lnInst="1"/>
   </Private>
</LN>

Links can be created on each level of the data model using the element:

eTr-IEC61850-90-2:ProxyOf

This new part contributes to the vision of a SINGLE seamless information exchange solution for the whole domain of power delivery (generation, transmission, distribution, use).

Just started: Grid 3.0

Have you heard about “Grid 3.0”? This seems to be the next phase of the power delivery system. Recently several U.S. organizations have discussed the future of the power delivery system. According to their view there are 3 phases so far:

• “Grid 1.0” can be thought of as the legacy grid of the 20th century
• “Grid 2.0” is the emergence of the smart grid with automation and information technology improvements, and
• “Grid 3.0” is what comes next: for example, a future grid with advanced grid operations and greater interactions with consumers and other infrastructures.

Click HERE to access a list of presentations from the

Grid 3.0 Workshop
March 26 to March 27
at NIST, Gaithersburg, MD

Click HERE for a workshop summary.

We are currently in all three phases at the same time. Most of the systems are still legacy (for the next 20+ years), a few start to use automation and information technology, and some start to think about the future … power engineers have always thought about the future (even 130 years ago). One of the big issues in Grid 2.0 and Grid 3.0 is the need for interoperable of systems. We can reach a high level of interoperability – if we want! This is less a technical issue. It all depends on decisions to be made by humans. If we decide to get it, we can get it. Some may not like interoperability at all. Or?

Anyway, let’s assume we get there: Would we then generate Data Tsunamis all over? It is likely that people start to push every data into the cloud – expecting that somebody may use it.

Make sure that you understand your needs – before you look for a protocol or a data model. We have a single protocol for most near-real-time data (IEC 61850-8-1) and data models for almost everything. But does everybody need everything? No!

The big question is: What do you need? To answer this: You need to understand your application.

IEC 61850 meets Fieldbus: Bridge between Profinet and IEC 61850

Industrial automation systems highly rely on many different fieldbusses – one of the crucial Ethernet-based fieldbusses is the Profinet IO (defined in IEC 61158). IEC 61850 is THE standard for information modeling, information models, system and device configuration, soft-realtime communication (GOOSE and SV), and SCADA communication (event reporting, control, exchange self-descrition online from device, logging, statistical and historical statistical information, alarms, ….recording).

Information exchange between (1) power system protection and automation in power transmission, distribution, and power generation (central and distributed) and (2) industrial automation systems is one of the crucial needs for energy efficiency and smart(er) grids.

A new bridge between the two domains is now offered by HMS (gateway SG-40): bridging Profinet to IEC 61850.

HMS – a Swedish based company with 370 employees worldwide – has delivered products integrated in millions of devices around the world.

Key features of the SG-40 Profinet Gateway are:

• Web based programming with predefined function blocks
• Optional IEC61131-3 compliant CODESYS softPLC programming 
• PROFINET IO slave
• Additional industrial Ethernet networks supported with Anybus technology
• Modbus TCP client
• Modbus RTU master
• IEC61850 client/server
• IEC60870-5-104 server
• OpenVPN client
• Integrated firewall

The family of the smart grid supporting devices offered by HMS comprises the following the device types (for many different applications):

Click HERE for more information you can find at the HMS website.

The SG-40 supports a variety of mappings between several protocols:

1. IEC 61850 device information mapped to Profinet IO to expose IEC 61850 information to the industrial automation world:

2. Profinet IO information mapped to IEC 61850 device information to expose fieldbus information to the power delivery automation IEC 61850:

3. Many other mappings are supported (to/from Modbus, IEC 60870-5-104, DNP3, …).

All signals can be mapped in both directions.

The SG-10, SG-11, and SG-40 devices are using a Web-Browser for a very simple graphical programming tool. No other tools – except Web-Browser – are needed.

A 15 minute video explains the basic concepts of the gateways SG-10, SG-11 and SG-40. These devices provide a highly standardized and easy approach of bridging signals between multiple standard information exchange systems.

The configuration of the devices is very simple … no tool other than a web browser is needed to configure the input and output signals coming from (going to) the devices connected to various communication systems.

The devices can play one or all roles of IEC 61850 (Server, Client, Publisher, or Subscriber) in parallel. This allows to “collect”, e.g., many signals from a substation as a client and expose them into a Profinet network; or “collect” signals from the Profinet slaves and master and map them to an IEC 61850 Server.

This allows a very short time-to-market integration of the information of power related information into the industrial automation and vice versa.

One key-point is: The standard series IEC 61850 is the ONLY standard that offers a very comprehensive information model for all crucial power delivery system needs!

Are You Looking for IEC 61850 Related Publications?

Here is a very interesting link to a database (GetInfo - The Portal for Science and Technology) that lists some 830 publications related to IEC 61850. You can search for authors and contributors.

Click HERE for a search on “IEC 61850”.

Renewable Energies and Energy efficiency in your Neighborhood

I just came about the following interesting website showing a map of thousands of renewable resources in Europe:

http://www.repowermap.org/index.php?ln=en

You may search for Frankfurt or other cities:

The map shows some 60,000 examples. You can add your own PV system or …

Enjoy!

Could a Power Outage of an Airplane happen in the Air?

Yes, a power outage of an modern airplane could be caused by a simple software problem – related likely to a wrong assumption. What does this mean for the future power systems?

The following official report from the U.S. Government FAA, dated May 01, 2015 says that a

“Boeing Model 787 airplane that has been powered continuously for 248 days can lose all alternating current (AC) electrical power due to the generator control units (GCUs) simultaneously going into failsafe mode. This condition is caused by a software counter internal to the GCUs that will overflow after 248 days of continuous power. …

The software counter internal to the generator control units (GCUs) will overflow after 248 days of continuous power, causing that GCU to go into failsafe mode. If the four main GCUs (associated with the engine mounted generators) were powered up at the same time, after 248 days of continuous power, all four GCUs will go into failsafe mode at the same time, resulting in a loss of all AC electrical power regardless of flight phase.”

Click HERE for the full report.

What is the lesson we can learn from this situation? I guess simply this: If you have to program something you need to know precisely under which assumptions the “something” should work. Usually you have to make firm assumption under which the “something” will work. If you would assume (for example) that an airplane of model 787 would never be powered continuously longer than 90 days, then the counter would not overflow under normal conditions.

But: If this assumption is wrong, then the counter could overflow.

I guess that we quite often design systems under assumptions that may be valid at time of the design – but that may show later that they were quite wrong! Some 40-50 years ago it was not assumed that the traffic in 2015 would be as is is now. Or?

The power utilities assumed some 15 years ago that PV-Power (mainly installed on roofs) should just be understood and treated as negative power connected to the grid – so that there was no need to invest in power management and automation systems. I remember such discussions in the German national standardization (DKE). Within a short time period they had to learn that the assumption was wrong! Now we have almost 40 GW of installed PV systems.

The next wrong assumption could likely be the number of Batteries connected to the power grid. The needed investment in the future power system will highly depend on the assumption on how fast the installation of batteries will happen! I have talked recently to utility experts that they fear a fast growth of network connected batteries. The batteries behave different compared to Wind Turbines and PV systems – batteries can import and export energy. They can change their behavior within very short time. A sudden huge power flow change of millions of battery systems could cause power outages.

So, MUST we assume that this could easily happens or not? Depending on our answer, we have do spent more or less Euros or Dollars … Experts that don’t want to invest a lot more will argue, that it is unlikely to happen.

The (wrong) assumptions of today could likely be the reasons of power outages in the near future. The bad side of the assumption that the installation of battery systems will grow fast is: It will require a lot of more efforts to keep the power system reliable.

I guess we will see increasing numbers of batteries being installed after yesterdays announcement (May 01, 2015) of the new Partnership for Global Energy Transformation: LichtBlick (Germany) integrates Tesla Battery Storage (US) into Energy Markets.

A crucial key component in the future power systems is related to information management and standardized information exchange with IEC 60870-5-104 and IEC 61850. VHPready is an important step to support LichtBlick and many other companies.

The Complete Content of the IEC 61850 News Blog is now Available as Single PDF Document

For those readers of this IEC 61850, IEC 60870-5/6, DNP3, … news blog that want to get the complete content as a single pdf document, it is just a click away … it contains 1000+ posts from 2008 until 2015-04-28. Once you have downloaded the file you can easily browse the content … search … mark … copy … You will find useful information about the standards, vendors like ABB, HMS, Siemens, or utilities …

Click HERE to download all posts of the IEC 61850 blog in a single pdf [11.3 MB, 766 pages DIN A4]

Enjoy.

In case you have a question, drop us an EMAIL.

OPC Server using an IEC 61850 Client

OPC (DA and UA) is used quite often for higher level communication between PLCs and SCADA servers. How could you tap IEC 61850 information for communication to an OPC Client?

First of all, you need an IEC 61850 Client that talks to IEC 61850 Servers or receives GOOSE messages. Second, you need an OPC Server that sits on top of the IEC 61850 Client.

Softing (Nuremberg/Munich, Germany) offers such an OPC (DA and UA) Server with an IEC 61850 build-in client. The client automatically detects all logical nodes and data objects and converts them automatically into OPC items:

 

OPC Server (DA and UA, dataFEED OPC Suite) with the build-in IEC 61850 client as well an OPC demo client from Softing is available, contact: http://industrial.softing.com/en

A free of charge copy of the dataFEED OPC Suite and OPC Client is available for interested attendees of NettedAutomations training courses.

Click HERE to check a Video with a brief demo on how to use the dataFEED in conjunction with IEC 61850.