Summary of GOOSE Substation Communication

This paper presents a model designing and simulation realization of arc protection system based on GOOSE (Generic Object Oriented Substation Event) .It is proposed to fully use the logical node GGIO (Generic Input and Output) of IEC61850 in the modeling of intelligent electronic devices. The real-time data (data of arc intensity and loop circuit) are transferred by GOOSE message with time delay less than 4 ms. GOOSE message communications mechanism is introduced. Winpcap development packet is selected and the simulation program is written to transmit and capture the GOOSE messages.

The IEC-61850 standard introduced multiple protocols to increase data visibility across various power grid systems. The Generic Object Oriented Substation Events (GOOSE) protocol in particular is designed for bay-level communications, distributing high-priority messages across a power grid through the use of Intelligent Electrical Devices (IEDs). However, the protocol's multicast messaging and time requirements create cybersecurity concerns that can be exploited by a malicious actor. While the literature has examined the protocol's cybersecurity vulnerabilities, there is limited research on the consequences for performance and cybersecurity of the protocol's implementation on physical IEDs. In this paper, we introduce a flexible and practical testbed for GOOSE implementation evaluations performed on different devices, and to enable the demonstration of how different implementations on physical devices aim to mitigate GOOSE's vulnerabilities. We show the results of our testbed generating GOOSE traffic at variable data rates, with varying packet sizes. These results are then compared and verified against an IED with GOOSE protocol functionality to validate protocol generation. While this paper focuses on IEC-61850 GOOSE, the testbed presented herein is not limited to a single protocol, however, and can easily be utilized to expand the evaluation scope to a variety of Operational Technology (OT) communications protocols.

This paper puts forward a security audit scheme that combines SCD configuration file parsing with network traffic identification. Obtain a pre-defined network topology and virtual link logic loop by parsing the SCD file and establish a security baseline for the service. Identify and capture generic object-oriented substation event (GOOSE) messages, sampled value (SV) messages, manufacturing message specification (MMS) messages, and the information of devices connected to the switch to obtain the actual network topology, and virtual link physical loop. When an unknown system IP, communication protocol, or message occurs, the device protocol auditing alarm can be triggered. And when the device polling data traffic is missing, the offline disconnection alarm of the auditing device can be triggered. The manipulation of industrial control command parameters caused by Trojans, computer viruses, and man-in-the-middle attack, and the abnormal state caused by operators’ misoperation also can trigger the legal abnormal alarm. In this way, real-time monitoring and security auditing of intelligent substation network threats can be realized.

The main purpose of this paper is to study the communication protocol IEC61850 (Communication Networks and Systems in Substations) to develop of practical fast transmission modes in direct trip schemes, using communication functions to implement protection, control and condition monitoring functions under IEC61850 protocol to complete devices data integration in substation automation system. The way of direct trip schemes can provide fast communication speed to stable power system operation in case of suddenly events occasions. The messages interchange via GOOSE (Generic Object Oriented Substation Event) application is based on the IEC61850 communication protocol to implement fast direct trip modes. It is found that the interaction communication of direct trip schemes among various protective relays can be achieved by the IEC61850 protocol based on GOOSE application to approach system stabile operation under occasionally events.

This paper centers on the use of GOOSE (generic object oriented substation event) to provide the messaging means to perform protection and control functions via a local area network (LAN) within the substation through the use of IEDs (intelligent electronic devices). It is explained that GOOSE is not used for data retrieval such as settings, oscillography, or metering and that a full description may be found in the GOMSFE (Generic Object Models for Substation and Feeder Equipment) documentation.

Creating a common protection testing-template is very intricate because of the high flexibility of digital protection devices. In such a testing-template all main protection functions need to be considered. The Substation Configuration Language (SCL) referring to IEC 61850 defines a consistent representation format. This representation format for example describes the configuration of the protection relays and defines different data-types. In addition a Generic Object Oriented Substation Event (GOOSE) is defined by the IEC 61850. GOOSEs are used to send messages about the condition of an IED. This paper describes the experiences made when using the SCL-files to create a relay specific testing-template. Furthermore it describes the approach of using GOOSEs for testing purposes.

In this paper, a data-centric communication framework is proposed for multicast routable generic object-oriented substation event (GOOSE) messages (MRGM) over the wide area network (WAN) for effective substation-to-substation (SS2SS) and substation to control center (SS2CC) communications. In this structure, the IEC 61850 GOOSE message is transmitted over the WAN using the data distribution service (DDS) as a fast, reliable, and secure data-centric communication middleware. The main feature of this framework is its multicast capability, where several authorized subscribers can receive a published message simultaneously. This can significantly improve the system monitoring and control of the protection systems in modern smart grids, where intelligent schemes can be applied. The effectiveness of the proposed platform, in terms of total end-to-end delay between participants, is evaluated through experimental results obtained from the actual hardware-based test setup developed at the Florida International University (FIU) smart grid testbed. The results demonstrate that the latency between sending and receiving a GOOSE message among participants is within its maximum time span defined by the IEC 61850-90-5 working group for communications over the WAN.

This paper describes a smart load shedding scheme that monitors plant loads, plant generation and generation/utility supply reserve to select the minimum number and lowest priority loads for shedding. The paper first gives an overview of industrial power system dynamics undergoing loss of supply contingencies and existing load shed practices, such as undervoltage, underfrequency, frequency rate of change or contingency based load shedding. It will examine the impact of speed of load shedding on stability. The paper goes on to describe a load shed system that continuously calculates the generation reserve available and shed-able load available in real time by acquiring analog power measurements from generators and utility supplies through IEC61850 GOOSE (Generic Object Oriented Substation Event) messaging. This fast load shed scheme uses the reliability and redundancy of modern Ethernet networks and has simplicity compared to traditional systems. Application solutions are presented and analyzed that handle the required data acquisition using communications and protection devices typically present at an industrial facility, along with means to disseminate load shedding commands with sub-cycle speed to thousands of shed-able loads. Actual performance results from such a load shed system are presented.

This paper describes a smart load shedding scheme that monitors plant loads, plant generation and generation/utility supply reserve to select the minimum number and lowest priority loads for shedding. The paper first gives an overview of industrial power system dynamics undergoing loss of supply contingencies and existing load shed practices, such as undervoltage, underfrequency, frequency rate of change or contingency based load shedding. It will examine the impact of speed of load shedding on stability. The paper goes on to describe a load shed system that continuously calculates the generation reserve available and shed-able load available in real time by acquiring analog power measurements from generators and utility supplies through IEC61850 GOOSE (Generic Object Oriented Substation Event) messaging. This fast load shed scheme uses the reliability and redundancy of modern Ethernet networks and has simplicity compared to traditional systems. Application solutions are presented and analyzed that handle the required data acquisition using communications and protection devices typically present at an industrial facility, along with means to disseminate load shedding commands with sub-cycle speed to thousands of shed-able loads. Actual performance results from such a load shed system are presented.

Summary Substation automation system consists of intelligent electronic devices, substation computer and a communication network between them. The network is used for control implementation, protection and monitoring tasks in substations. This paper presents a tripping circuit monitor (TCM) that accurately translates substation event information into a binary data representation using nonintrusive current transducers. The data are then transmitted using generic object oriented substation event message format, which is defined in the latest substation communication standard IEC 61850, onto local Ethernet network. The TCM is also capable of implementing either IEEE 1588–2002 or IEEE 1588–2008 standards to provide synchronized time stamp value for each translated binary data within sub-microsecond accuracy. The substation event data, which is captured by the TCM module, have a number of applications in current electric substations. The main application of the TCM device is to provide a communication interface between electromechanical relays and modern numerical intelligent electronic devices. Other possible applications include improving substation system-wide testing and enhancing substation topology processing in supervisory control and data acquisition systems. Test results that demonstrate the operation of the new TCM module are also presented in the paper. Copyright © 2013 John Wiley & Sons, Ltd.

Extending reliable and dependable communications for protection and control applications beyond the substation fence to additional sites and field devices can sometimes be a challenging task. Uneven terrain, distance, or other factors can make running cable difficult or impossible. In some cases, wireless communication is a cost-effective and practical alternative to pulling cable. Radios have proven to be an effective means of extending communications for supervisory control and data acquisition (SCADA) and engineering access, as well as for critical protection and control applications using serial communications. Low-latency Ethernet protocols like Generic Object-Oriented Substation Event (GOOSE) are becoming popular for high-speed, point-to-multipoint signaling protection and control applications. Radios used in protection and control should be evaluated for the specific application for which they are intended. This paper examines the application of GOOSE over Ethernet radios and the associated challenges. The paper shares results from a real-world implementation, including results from GOOSE latency tests for protection and control applications.

Power system automation and communication standards are spearheading the power system transition towards a smart grid. IEC 61850 is one such standard, which is widely used for substation automation and protection. It enables real-time communication and data exchange between critical substation automation and protection devices within digital substations. However, IEC 61850 is not cyber secure. In this paper, we demonstrate the dangerous implications of not securing IEC 61850 standard. Cyber attacks may exploit the vulnerabilities of the Sampled Values (SV) and Generic Object-Oriented Substation Event (GOOSE) protocols of IEC 61850. The cyber attacks may be realised by injecting spoofed SV and GOOSE data frames into the substation communication network at the bay level. We demonstrate that such cyber attacks may lead to obstruction or tripping of multiple protective relays. Coordinated cyber attacks against the protection system in digital substations may cause generation and line disconnections, triggering cascading failures in the power grid. This may eventually result in a partial or complete blackout. The attack model, impact on system dynamics and cascading failures are veri ed experimentally through a proposed cyber-physical experimental framework that closely resembles real-world conditions within a digital substation, including Intelligent Electronic Devices (IEDs) and protection schemes. It is implemented through Hardware-in-the-Loop (HIL) simulations of commercial relays with a Real-Time Digital Simulator (RTDS).

Digital substations have adopted a high amount of information and communication technology (ICT) and cyber–physical systems (CPSs) for monitoring and control. As a result, cyber attacks on substations have been increasing and have become a major concern. An intrusion-detection system (IDS) could be a solution to detect and identify the abnormal behaviors of hackers. In this paper, a Deep Neural Network (DNN)-based IDS is proposed to detect malicious generic object-oriented substation event (GOOSE) communication over the process and station bus network, followed by the multiclassification of the cyber attacks. For training, both the abnormal and the normal substation networks are monitored, captured, and logged, and then the proposed algorithm is applied for distinguishing normal events from abnormal ones within the network communication packets. The designed system is implemented and tested with a real-time IEC 61850 GOOSE message dataset using two different approaches. The experimental results show that the proposed system can successfully detect intrusions with an accuracy of 98%. In addition, a comparison is performed in which the proposed IDS outperforms the support vector machine (SVM)-based IDS.

Integration of Information and Communication Technology (ICT) in modern smart grids (SGs) offers many advantages including the use of renewables and an effective way to protect, control and monitor the energy transmission and distribution. To reach an optimal operation of future energy systems, availability, integrity and confidentiality of data should be guaranteed. Research on the cyber-physical security of electrical substations based on IEC 61850 is still at an early stage. In the present work, we first model the network traffic data in electrical substations, then, we present a statistical Anomaly Detection (AD) method to detect Denial of Service (DoS) attacks against the Generic Object Oriented Substation Event (GOOSE) network communication. According to interpretations on the self-similarity and the Long-Range Dependency (LRD) of the data, an Auto-Regressive Fractionally Integrated Moving Average (ARFIMA) model was shown to describe well the GOOSE communication in the substation process network. Based on this ARFIMA-model and in view of cyber-physical security, an effective model-based AD method is developed and analyzed. Two variants of the statistical AD considering statistical hypothesis testing based on the Generalized Likelihood Ratio Test (GLRT) and the cumulative sum (CUSUM) are presented to detect flooding attacks that might affect the availability of the data. Our work presents a novel AD method, with two different variants, tailored to the specific features of the GOOSE traffic in IEC 61850 substations. The statistical AD is capable of detecting anomalies at unknown change times under the realistic assumption of unknown model parameters. The performance of both variants of the AD method is validated and assessed using data collected from a simulation case study. We perform several Monte-Carlo simulations under different noise variances. The detection delay is provided for each detector and it represents the number of discrete time samples after which an anomaly is detected. In fact, our statistical AD method with both variants (CUSUM and GLRT) has around half the false positive rate and a smaller detection delay when compared with two of the closest works found in the literature. Our AD approach based on the GLRT detector has the smallest false positive rate among all considered approaches. Whereas, our AD approach based on the CUSUM test has the lowest false negative rate thus the best detection rate. Depending on the requirements as well as the costs of false alarms or missed anomalies, both variants of our statistical detection method can be used and are further analyzed using composite detection metrics.

As the number of users or services continues to increase, limited bandwidth resources become a huge challenge for power wireless communication networks. The communication protocols widely used in the current distribution network have unclear data meanings, less correlation between data, and inability to interoperate between terminals, which is a bottleneck restricting the development of smart distribution networks. With the development and implementation of the IEC 61850 standard, more and more power service are sent in the form of broadcast and multicast. Among them, the GOOSE (generic object oriented substation event) service is used to transmit events such as real-time trip signals that require fast delivery of message information, and real-time performance is its main feature. However, in the multicast transmission of the power service carried by the existing transmission mode, there is a serious contradiction between resource utilization and the quality of services (QoS) of users. Therefore, in order to balance the QoS with poor signal quality in SFN (Single Frequency Network) transmission mode and to solve the problem of resource allocation being limited by the worst QoS, this paper proposes a hybrid transmission mode combining PTP (point to point) and SFN transmission. In addition, in order to improve resource utilization efficiency, we design a new transmission mode selection algorithm focus on the improvement of spectrum efficiency. The optimal solution obtained through greedy algorithms is the best transmission mode scheduling strategy. The simulation results show that the MIX (mixed transmission mode) effectively reduces the impact of poor QoS users on system performance when the number of users increases. At the same time, the transmission mode selection algorithm can save system resources more effectively than the traditional selection algorithm (PTP and SFN mode).