ANIPLA 17.06.08

1
ENTE PER LE NUOVE TECNOLOGIE LENERGIA E
LAMBIENTE
Una strategia per mitigare leffetto delle
interdipendenze tra infrastrutture critiche
S. Bologna, C. Balducelli, A. Di Pietro, L.
Lavalle, G. Vicoli http//www.progettoreti.enea.it
/ ENERSIS 2008Milano, 17 Giugno, 2008
2
ITALY BLACK-OUT September 2003 Event tree from
UCTE report
NETWORK STATE OVERVIEW ROOT CAUSES
Network in (n-1) state with short- term 15
allowable overload
Network in (n-2) state with excessive overload
of remaining lines
Separation of Italy from the UCTE main Grid
Island operation fails due to unit tripping
Pre-incident network in n-1 secure state
AND
2 Lacking a sense of urgency regarding the San
Bernardino line overload and call for inadequate
countermeasures in Italy
1 Unsuccessful re-closing of the Luckmainer line
because of a too high phase angle difference
1-2 min.
3 Angle instability and Voltage collapse in Italy

24 min.
3
Roma Mini TELCO Black-out January 2004
NETWORK STATE OVERVIEW ROOT CAUSES
Pre-incident TELCO network in secure state
Station continue working with decreased battery
autonomy
Many external Telco services go down, as the
ACEA data links between control centers
The normal power supply from ACEA was restarted
Return to normal state
AND
2 The battery autonomy finished as Fire Brigate
was not able to eliminate water in time.
3 The full functionality of the SGT station is
restored
1 Flood on the apparatus room of the Telco SGT
station. UPS start from batteries
90 min.
4 hours
4
MIT Introduction

• MIT is a software system to enhance the
  availability and survivability of LCCIs by
  mitigating (inter)dependency effects. It is
  composed of
• communication components.
• add-on components.
• other software resources (databases,GUI,
  configuration files, run-time environment, etc.)

5
Control Room with MIT WorkStation
LCCI 1
Control Room
MIT WorkStation
MIT WorkStation
Control Room
LCCI 2
6
MIT integration with existing SCADA systems
7
MIT integration with existing SCADA systems
IRRIIS Inter-LCCI Communication Highway
8
Middleware Improved Technology System
component oriented architecture
LCCI 1
LCCIs -gt Critical Infrastructures
LCCI 5
LCCI 2
MIT 4
LCCI 4
LCCI 3
LCCI 6
9
Middleware Improved Technology System
component oriented architecture
10
Middleware Improved Technology System
component oriented architecture
ADD-ON COMPONENTS
Add-on components are responsible on what
internal information has to be sent to
neighbouring LCCIs, and what information received
from neighbouring LCCIs may influence the
internal LCCI state .
11
MIT Add-On Components

• Internal Assessment
• Tool to extract LCCI functional status
• Risk Assessment
• Risk Estimator
• Incident Knowledge Analyser
• Emergency Management
• Assessment of cascading/escalating effects
• Display of Emergency Management Procedures
• Negotiator

12
Risk Estimator functions

• Reasoning about the states of processes and
  services, mainly focusing on the services to be
  exchanged with other LCCIs.
• Estimating the levels of risks associated to
  services exchanges with other LCCIs.
• Working on a service-process model of the LCCIs
  by making use of a fuzzy rules-based mechanism.

13
Visualisation of the levels of risks associated
to the services
After external internal states correlation
LCCI internal state estimation
14
Risk estimator Benefits

• Make operators more aware about the global LCCIs
  state, correlating local LCCI and external LCCIs
  states.
• Give to the LCCIs operators schematic pictures
  evidencing the potential risks to loss internal
  and external services.
• Improve coordination between the LCCI operator
  and the neighbouring LCCIs.

15
Incremental development testing process of the
components
SimCIP
Experimentation of the integrated capabilities
CRIPS
INTEGRATION TESTING VALIDATION
DEVELOPING COMPONENTS
TEFS
MIT Comp
16
Laboratory experimentation
TEST BEDS TO VERIFY THE INTEGRATED CAPABILITIES
LABORATORY EXPERIMENTATION
17
Experimentation strategy (Step 1)
COMPARE BEHAVIOURS WITHOUT MIT
NO ATTACKS/FAULTS
ATTACKS/FAULTS EVENTS TREE
Build an experimentation infrastructure
SimCIP Attack/fault behaviours
SimCIP Normal behaviours
Simulation Environment
Attack/faults scenario tables
Knowledge elicitation about a set of scenarios
18
Experimentation strategy (Step 2)
COMPARE BEHAVIOURS EFFECTS WITH MIT
ATTACKS/FAULTS EVENTS TREE
Build an experimentation infrastructure
SimCIP Attack/fault behaviours
SimCIP Normal behaviours
Simulation Environment
Attack/faults scenario tables
Knowledge elicitation about a set of scenarios
19
Physical set-up of the experimentation
environment
Telecom Simulator
LCCI Telecom Data Base
Optional External Components
SimCIP
MITcommunication
Electrical Control Room
Telecom Control Room
20
LCCIs for experimentation
P ? Power (electrical) network PT ? Power Telecom
network (SCADA systems including also
telecom network owned by Power Network
Operator) T ? Telecom network (Telecom
Infrastructure) TP ? Telecom Power network
(Telecom backup power systems)
LCCIs INVOLVED IN THE ROME MINI TELCO BLACK-OUT
21
Simulating different LCCIs components within
SimCIP
P Power Network Simulation
TP Telco Power Network
Simulation
PT Power Telecom Network
Simulation (SCADA)
Scenario Table
T Telecom Network Simulation
22
Using scenario tables to define different
scenario event sequences
P Power Network Simulation
TP Telco Power Network
Simulation
PT Power Telecom Network
Simulation (SCADA)
Scenario Table
T Telecom Network Simulation
23
Scenarios execution and evaluation
24
Evaluating the expected results
Verify results
Iterative improvements
Scenario tables
Expected results tables
MIT Behavior 1 Detection t1 Local info
t2 Remote Info t3
T
P
TP
PT
Knowledge from analysts/experts
25
Experimentation steps for RE
RE Knowledge Base
General rules
Specific rules
Services
relations
Processes
System ready for demonstration to stakeholders
Updating rules services/processes relations
Knowledge from analysts/experts
1 table fails
2 tables fail
All tables ok
Final experimental step
First experimental step
Second experimental step
26
Final considerations

• To prevent cascading effects among interdependent
  LCCIs is a new challenge
• LCCIs modelling capacity, exploiting also
  commercial simulation tools, is necessary to
  develop realistic testing environment.
• Strategies/guidelines to implement exhaustive
  experimentation sessions must be developed
• Producing/evaluating experiments with/without
  introducing the MIT solutions may help to obtain
  an assessment of the MIT benefits.
• http//www.irriis.org/