Page 1 of 22 IEEE PES Transactions on Smart Grid

1
2
3
4
A Coordinated Multi-Switch Attack for Cascading
5
6
Failures in Smart Grid
7 Shan Liu Bo Chen Takis Zourntos Deepa Kundur Karen Butler-Purry
8
9
10 AbstractThis paper explores distributed smart grid attack from prior art by formulating the smart grid security problem
11 strategies to destabilize power system components using variable within a hybrid dynamical system context that is mathemati-
12 structure system theory. Here, an opponent is able to remotely cally representable and relates attack impacts to disturbances
13 control multiple circuit breakers within a power system, say
through data corruption or communication network attack, to on quantifiable power system performance metrics.
14 destabilize target synchronous generators through application of Our past work has focused on the application of variable
15 state-dependent breaker switching. In contrast to attack via a structure system theory to address a class of reconfiguration
16 single breaker, the multi-switch case provides additional degrees attacks in power transmission systems called coordinated vari-
17 of freedom that can lead to stealthier and wide-scale cascading able structure switching attacks [6][10]. We have been able to
18 failures. We provide a dynamical systems context for formulating
distributed multi-switch strategies and execute such attacks on identify a novel class of vulnerabilities unique to smart power
19 systems that leverages the potential of an opponent to obtain
the New England 10-generator 39-bus test system.
20 estimates of localized state information and remotely control
21 Index TermsCoordinated multi-switch attacks, cyber-
physical system security, sliding mode theory, smart grid attacks, an associated circuit breaker. Here, an opponent can employ
22
variable structure system modeling. the local state information to design a switching sequence
23
for the breaker that can cause transient instability of a target
24
synchronous generator leading to power disruption. One key
25 I. I NTRODUCTION observation from these studies is the ease with which it is
26
It is well known that the smart grid promises increased relia- possible to destabilize the power system dynamics (through the
27
bility, efficiency and sustainability through the use of advanced exploitation of vulnerabilities in cyber infrastructure) by using
28
information (cyber) and energy (physical) infrastructure. This short-duration cyber-controlled switching of a single breaker.
29
greater dependence on information systems however raises In this paper, we aim to provide a more comprehensive
30
31 concerns as to how its integration will affect the cyber and assessment of the security posture of a smart grid system by
32 physical security of future power systems. focusing on a non-trivial extension to the single-switch coor-
33 Historically, such cyber-enablement of classical application dinated switching attack that makes use of multiple breaker
34 fields including commerce, entertainment, and social interac- corruptions and collusion to create cascading failures within
35 tions has led to improved functionality and efficiency at the multiple targets of the system. This shifts the vulnerability
36 cost of security. Thus, we assert the importance of addressing analysis problem from one that can be visualized in a two-
37 cyber and physical security issues of emerging cyber-enabled dimensional plane to one in higher-order dimensions. More-
38 power systems. A first step in such a study will require over, construction of an attack has significantly greater degrees
39 the exploration of novel vulnerabilities stemming from cyber- of freedom that we explore by considering simultaneous, con-
40 physical integration, which we aim to address in this paper, to current and progressive approaches to switching. We therefore
41 better develop strategies for their mitigation. test our attack framework for the first time on the 10-machine,
42 There has been a movement toward addressing cyber- 39-bus New England power system in DSAToolsTM providing
43 physical aspects of system security. For instance, informa- an opportunity to study the effectiveness of the coordinated
44 tion confidentiality has been addressed by studying cyber- switching attack on generators with local controllers.
45 to-physical leakage via clues about cyber protocol activity In the next section, we present our multi-switch hybrid
46 in power system voltage and current measurements [1], [2]. dynamical systems modeling framework. Section III provides
47 Novel risk analysis frameworks that account for the physical mathematical examples to give insight on the different ways
48 impacts of cyber attacks have been presented [3], [4]. To in which multiple switching can be harnessed for system
49 more comprehensively account for the interaction between the disruption. In Section IV we demonstrate how the multi-
50 power system and information network, empirical approaches switch attack principles can be applied to the popular 39-bus
51 have been developed that harness realistic communications and New England test power system for targeted and more global
52 power systems simulators [5]. power system disruptions through transient destabilization of
53 We argue that to identify insidious weaknesses stemming select system generators. Final remarks and avenues for future
54 from cyber-physical interaction and evaluate mitigation ap- research are presented in Section V
55 proaches, it is crucial that the physical notion of time be
56 incorporated into the modeling framework. Furthermore, we II. D ISTRIBUTED M ULTI -S WITCH F RAMEWORK
57 believe that for the results to have useful meaning to electric
58 power utilities and for risk analysis, the model should loosely A. Variable Structure Systems
59 represent select aspects of the system physics with appropriate Variable structure systems represent an elegant hybrid dy-
60 granularity. For this reason, our work represents a departure namical systems framework in which to study the behavior
 IEEE PES Transactions on Smart Grid Page 2 of 22
2

1
2 of systems with switched dynamics. Here, the dynamics of
3 a system with state x Rn1 change (or switch) to one of
4 a set of predefined subsystems depending on the value of a
5 switching signal s(x, t) that is time and/or state-dependent.
6 In the case of scalar s(x, t) and two subsystems a general
7 structure for a variable structure system can be given by:
8 
f1 (x, t) s(x, t) 0
9 x = . (1)
f2 (x, t) s(x, t) < 0
10
11 For certain structures and parameters of system dynamics and
12 selections of s(x, t), it can be shown that the overall switched
13 system exhibits sliding mode behavior. In the sliding mode,
14 while switching persists, the state of the overall switched
15 system is attracted to and stays on the s(x, t) = 0 manifold
16 termed a sliding surface of the variable structure system.
17 The sliding mode property of variable structure systems has
18 been useful classically for system stabilization to steer the
19 Fig. 1: New England 10-machine, 39-bus Power System.
system state from possible instability to a desirable equilibrium
20 position. An excellent background on sliding mode control can
21 be found in [11], [12] and references therein; moreover, [13] We consider the situation in which the strategy of the
22 provides an excellent tutorial on the subject. opponent is to model the overall system as a variable structure
23 Recently, the authors have modeled smart grid transmis- system and apply state-dependent switching to the corrupted
24 sion systems under reconfiguration (e.g., remotely controlled switches such that sliding mode behavior is manifested. If the
25 smart circuit breaker switching) as variable structure sys- particular sliding mode is unstable, then transient instability
26 tems. We have demonstrated how, in contrast, transient insta- of target synchronous generators will be induced. Consider
27 bility of a target synchronous generator can be induced by an for example the 39-bus New England test system of Fig. 1.
28 opponent who has corrupted a circuit breaker and switches Suppose that an opponent has control over the breakers con-
29 necting Lines 26-28 and 28-29 and has established Generators
it open or closed depending on the sign of an appropriately
30 8 and 9 as targets. The task of the opponent would be to
defined s(x, t) [6], [7]. The system state x represents the phase
31 construct a switching sequence based on variable structure
and frequency of the target generator and the switching has
32 system theory using knowledge of the phase and frequencies
the effect of disrupting both the generator frequency and phase
33 of Generators 8 and 9 for each of the switches at Line 26-
thus desynchronizing it.
34 28 and Line 28-29. If successful, the switching would induce
Much of the analysis of variable structure systems within
35 sliding mode behavior and thus transient destabilization of
the existing literature assumes a single scalar switching signal
36
s(x, t) R. In this vein, the authors past work has considered its targets. Questions naturally arise regarding how multi-
37
the application of sliding mode theory when a single circuit switching should be strategized.
38
breaker is corrupted and employed for transient instability Thus, part of our focus in this paper is to explore different
39
of a sole target synchronous generator. Such a formulation ways to incorporate multiple corrupted switches to target mul-
40
is valuable for identifying local cyber-physical vulnerabilities tiple synchronous generators. In the next section, we provide
41
within smart grid systems, but by nature cannot model poten- a general variable structure system framework. The model is
42
43 tial distributed attacks that can lead to cascading failures. somewhat general so that the attack may be readily applicable
44 to other forms of instability (e.g., frequency and voltage) and
45 B. Distributed Switching for Attack for other types of target components such as transformers or
46 We consider a power system consisting of M > 0 circuit transmission lines beyond the scope of this paper. Moreover, it
47 breakers or switches. We assume that an opponent (or possibly enables us to consider different multi-switch attack strategies
48 a colluding collective of opponents) has control over 0 < within the same system to assess the various compromises. In
49 m M breakers through, say, corruption of breaker control Section IV we specifically focus on transient destabilization
50 signals via attacks on the associated communication network, and our models are more specific.
51 as discussed in [6], [7]. The objective of the opponent is to
52 disrupt the operation of the power system through transient C. Multiple Switching Signals
53 destabilization of one or more target synchronous generators The multi-switch investigation necessitates that the switch-
54 denoted {Gt }, t = 1, 2, . . . , T assuming that the opponent ing signal of Section II-A be a switching vector signal
55 has some knowledge of the target generator states. Such s(x, t) Rm1 where m > 1 is the number of corrupted
56 destabilization will cause generator protection relays to trip switches; the sign of each element of s(x, t) provides in-
57 taking the corresponding generators off-line. Although loss of formation to an opponent on whether to open or close a
58 a single generator may not be of significant concern, in our specific breaker for attack. There is limited variable structure
59 distributed multi-switch framework we investigate the effects system theory literature dedicated to this extended multi-
60 of possible cascading outages. switch situation. We do not provide theoretical foundations for
Page 3 of 22 IEEE PES Transactions on Smart Grid
3

1
2 this underdeveloped class of problems. In contrast, we aim to region about the sliding surface:
3 explore through examples how the multiple switch problem
sj sj < 0 j S. (5)
4 can be constructed and exploited for system destabilization.
5 For the remainder of the paper we consider only time-invariant In the multi-switch cases that follow, we consider the sce-
6 state-dependent vector switching signals and denote it for nario in which each of the m switches open and close accord-
7 simplicity as either s(x) or s. ing to the sign of a particular element of s = [s1 s2 sm ]T .
8 For example, the ith switch would open for si < 0 and close
Consider a nth order linear time invariant variable structure
9 when si 0. The terminal sliding surface for attack is the
system model with m control inputs:
10 intersection of all of the individual switching surfaces s = 0.
11 x = Ax + Bu, (2) Moreover we assume that individual sliding surfaces exist for
12 sj = 0 for j S. The existence of individual sliding surfaces
13 where x Rn1 is the time-dependent state vector, u Rm1
is the input vector, A Rnn is the system transformation provided by Eq. (5) enables the possibility of employing a
14 variety of multi-switch strategies that we investigate for power
15 matrix and B Rnm is the input matrix. The time-invariant
state-dependent switching signal is defined as system attack in this paper.
16 Throughout the paper the authors adopt a compact notation
17
common to systems theory to describe the dynamical repre-
18 s(x) = Cx Rm1 , (3) sentations and variables. However such a convention, albeit
19
simpler, may not readily provide information on temporal or
20 where s(x) = 0 is called the switching surface and C Rmn state dependencies that could better elucidate the concepts
21 is the corresponding coefficient matrix; we denote the ith and relationships in a power systems context. Therefore, we
22 element of s as si R such that s = [s1 s2 sm ]T . For provide a summary in Table I of the key variables of this paper
23 tractability, most switching signals are assumed to be linear
24 and their associated dependencies.
combinations of the system states. In our interpretation of
25 the problem a single circuit breaker, say called Switch i, is
26 controlled via the sign of the ith element of s. Therefore, D. Attack Assumptions and Overview
27 our framework implicitly assumes that m controllable breakers A vulnerability in a system exists when there is a flaw
28 exist in the system. in the system, access to the flaw and a capability by an
29 opponent to exploit the flaw. We consider the vulnerability we
30 The role of u in our formulation is two-fold. First, it
address in this paper to be cyber-physical in nature because
31 represents an appropriate step change in dynamics due to a
a physical weakness is exploited through access provided by
32 sign change in the elements of s(x); thus we expect sgn(si )
cyber (communications) means.
33 components in u to have the desired effect of switching the
In order to study a worst-case scenario for disruption we
34 nature of the dynamics as the signs of the switching signal
assume that attacker communication is ideal and that cor-
35 elements change. Second, it modifies the system dynamics Ax
rupted breakers are temporally synchronized in their switching.
36 in our instructive example of Section III using a second order
Moreover, we assume that physical catastrophe instigated by
37 linear feedback component to guarantee an appropriate sliding
the proposed attack does not affect the performance of the
38 mode exists for a given s = Cx and multi-switch strategy.
associated communication system.
39 The reader should note that in an actual power system attack
1) Attacker Knoweldge: To leverage variable structure sys-
40 scenario addressed in Section IV, the action of an opponent
tem theory to construct a smart grid attack, an opponent would
41 would result only in the first s-dependent component.
need:
42 Consider switching surfaces si = 0 for i = 1, 2, . . . , m
43 1) to identify a set of (physical) target synchronous genera-
whereby their intersection is compactly denoted s = 0 tors to attack denoted {Gt }, t = 1, 2, . . . , T ;
44
meaning s = [s1 s2 sm ]T = [0 0 0]T . To determine 2) electromechanical switching control over m > 1 cor-
45
the existence of the sliding surface s = 0 for a general class rupted circuit breakers in the targets proximity;
46
of variable structure systems it is sufficient to establish that 3) knowledge of the targets states x; and
47
the following condition holds (for s 6= 0) [13]: 4) a local model of the smart grid system encompassing the
48
49 sT s < 0. (4) targets.
50 Physical means to obtain such measurement data and control
51 Typically, the guarantee that Eq. (4) holds occurs for a local switching actions requires that the opponent employ geograph-
52 region of state space. Thus a state trajectory would have to ically proximal and perhaps even distributed and unstealthy
53 enter this local region to guarantee attraction to the sliding techniques, which is impractical for resource constrained op-
54 surface s = 0; once the state is within the region of attraction ponents. However, with the increased dependence on informa-
55 persistent sliding mode switching will guarantee that the state tion technology and its proposed large-scale connectivity, it is
56 is attracted to s = 0 and remains on that surface. feasible that such approaches will be implemented remotely
57 Condition Eq. (4) does not guarantee that the individual through an effective sequence of cyber intrusions.
58 sliding surfaces si = 0 exist for i = 1, 2, . . . , m. If they In order to implement the attack remotely an opponent
59 exist for a subset j S {1, 2, . . . , m} then the following must exploit one or more cyber vulnerabilities within the
60 additional conditions must hold, again, for a possibly local associated communications and computing devices. Numerous
 IEEE PES Transactions on Smart Grid Page 4 of 22
4

1
2 TABLE I: Variable dimensions, dependencies and notation. Please note that model parameters such as C, ci , Ai and bi are
3 constants with no temporal or state dependencies.
4 Quantity Dependencies Common Dimensions Other possible
5 notation(s) used description(s)
6 state time x Rn1 x(t)
7 state trajectory/derivative time x Rn1 x(t)
8 state element time xi R xi (t)
9 i (t)
state element derivative time xi R xi (t), dxdt
10
switching vector state (for this paper) s(x) or s Rm1 s(x(t))
11
12 switching signal state (for this paper) si (x) or si R si (x(t))
13 derivative of switching vector state and time s Rm1 s(x)
14 derivative of switching signal state and time si R si (x), si (x(t))
15 equivalent control state and switching vector u Rm1 u(t), u(x, s)
16 system transformation matrix n/a (constant) A Rnn
17 input matrix n/a (constant) B Rnm
18 sliding mode coefficients n/a (constant) C Rmn
19 switching surface state s=0 s(x) = 0
20 linear sliding surface state s = Cx = 0 Cx(t) = 0
21 rotor angle of Gi time i R i (t)
22 rotor angle derivative time i R i (t)
23 rotor speed of Gi time i R i (t)
24 rotor speed derivative time i R i (t)
25
26
27
practical examples of current and expected cyber weaknesses determining an appropriate sliding mode surface s = 0 for
28
29 in power deliver networks have been documented [14] that system destabilization. The attack would be executed using
30 range from exploiting the lack of cyber security mechanisms knowledge of x such that the opponent would close (open)
31 in legacy technology to exploiting holes in well known oper- Breaker j for sj (x) > 0 (sj (x) 0). The stages of attack
32 ating systems used by measurement and control devices. The construction (conducted off-line a priori) and execution can
33 types of cyber intrusions necessary to be able to execute a be represented as follows:
34 coordinated variable-structure switching attack will be specific
1) Select the target generators {Gt }, t = 1, 2, . . . , T for
35 to the actual system hardware and software and is beyond
which state information is available or can be estimated.
36 the scope of this work. However, common approaches may
2) Select the m corrupted or corruptible breakers.
37 involve data interception, modification and fabrication. Direct
3) Mathematically represent the associated target smart grid
38 means of cyber attack could involve the eavesdropping of
system as a variable structure system keeping the switch-
39 local state information from phasor measurement units along
ing rule s(x) Rm1 general, where the jth breaker
40 communication links and the fabrication of circuit breaker
status is controlled by the value of the jth element of s
41 control signals to implement the switching attack. Indirect
for j = 1, 2, . . . , m.
42 means could entail the interception of related measurement
4) Test the existence of sliding mode surfaces according to
43 information to estimate the current state and subsequent false
Eqs. 4 and 5. If a range of C exists for attack then select a
44 data injection attacks on state estimators [15] to induce incor-
value analytically or empirically; details beyond the scope
45 rect decision-making to force switching.
of this paper are provided in [8].
46 False data injection attacks are one form of cyber attack that
5) Based on the existence of the overall and individual
47 can be exploited for coordinated switching attacks; they have
switching surfaces, design a strategy for multiple switch-
48 recently been investigated by Liu et al. [15] in the context of
ing as we will discuss in Sec. III.
49 state estimation. We highlight that indeed such attacks may
50 6) Execute the attack by employing switching of the m
be exploited to facilitate our proposed attack. Our work, in
51 corrupted breakers such that Breaker j is closed (open)
contrast, is focused on how cyber attacks such as these on
52 for sj (x) > 0 (sj (x) 0).
the information system can be harnessed to exploit a physical
53 weakness such as sliding mode instability to establish a new The reader should note that for a given smart grid system,
54 form of cyber-physical vulnerability that has the potential to set of target generators {Gt }, t = 1, 2, . . . , T and set of m
55 bring about cascading failures. corrupted breakers, a range of C may be valid for attack
56 2) Attack Construction and Execution: Based on this in- although it is possible that no value for C exists to instigate
57 formation an opponent would model the local grid as a sliding mode behavior. In the former situation, typically the
58 variable structure system where x is given by the states of attack can achieve its goal within the order of seconds for
59 {Gt }, t = 1, 2, . . . , T and switching occurs at the corrupted any valid value of C, but depending on the specific value
60 breaker(s). An opponent would then construct an attack by of C, the particular system state behavior toward instability
Page 5 of 22 IEEE PES Transactions on Smart Grid
5

1






2 would be different. In the latter case, no coordinated variable
3 structure switching attack is possible. In such a situation, the

 
4 opponent could attempt to change the set of target generators
5 or expand the set of corrupt breakers. The reader should note
6 that existence of the sliding mode thus provides a convenient
7 way to assess the existence of vulnerabilities and prioritize

 
8 system components for hardening as discussed by the authors Fig. 2: State trajectory for synchronized switching.
9 in [8].
10 persistently apply synchronized switching (i.e., having both
11 III. M ULTIPLE S WITCHING AND THE S LIDING M ODE switches open and close at the same time) to Switches 1 and 2.
12 To be effective switching must occur when x(t) is in the region
We consider three approaches to illustrate how multiple
13 of attraction of the s1,2 = 0 sliding surface and consequently
corrupted switches can be exploited by an opponent for
14 the state will be driven to s1,2 = 0 as illustrated in Fig. 2. In
system disruption. For simplicity we focus on a two-switch
15 this case the existence of s1,2 = 0 (equivalent to s = 0) also
situation in which s = [s1 s2 ]T ; the general m-switch
16 implies the existence of the individual sliding surfaces.
17 case would represent a natural extension to this multi-switch
To develop an illustrative example of the effects of simulta-
18 foundation. We first consider a case, called synchronized
neous switching, we consider our canonical system of Eq. (6)
19 switching, whereby the switches have the same switching
and determine a u1,2 = u1 = u2 to guarantee s1,2 s1,2 < 0.
20 surfaces s1 = s2 = C 1 x = 0 thus are synchronized with
Consider:
21 switching occurring simultaneously. Next, we focus on the
22 case of concurrent switching, in which the switches have s1,2 s1,2 = s1,2 C 1 x = s1,2 C 1 (Ax + Bu) < 0, (8)
23 distinct switching surfaces s1 = C 1 x = 0 and s2 = C 2 x = 0
with switching occurring simultaneously. Last, we focus on where u = [u1,2 u1,2 ]T . There are a variety of strategies to
24
progressive switching where switches with distinct switching assign u1,2 to guarantee sliding mode existence. In this paper
25
surfaces begin in tandem. we assign u1,2 such that s1,2 s1,2 = |s1,2 | < 0, a common
26
To demonstrate the application of different strategies for approach within the sliding mode community. We therefore
27
multi-switch variable structure system attacks, we make use determine u1,2 such that s1,2 C 1 Ax + s1,2 C 1 Bu = |s1,2 | =
28
29 of the following fundamental third-order canonical form real- s1,2 sgn(s1,2 ) which simplifies to give
30 ization of the linear time-invariant system of Eq. (2): c11 x2 + c12 x3 + c13 (1 x1 + 2 x2 + 3 x3 ) + sgn(s1,2 )
31 u1,2 = .
0 1 0 x1 0 0   c12 + c13
32 u (9)
x(t) = 0 0 1 x2 + 0 1 1 . (6) and an overall description of the system dynamics with con-
33 u
1 2 3 x3 1 0 | {z2 } current switching:
34 | {z } | {z } | {z } u
35 A x B x1 =x2



1 1 1 1 1
36 x = c3 1 x1 (c1 + c3 2 )x2 + (c3 c3 3 )x3 sgn(s1,2 )

As discussed in Section II-C, we assign the input u = [u1 u2 ]T


2
37 to be not only s-dependent to represent the effects of switch-
1
c2 + c 31 .
38 ing, but also x-dependent to adjust the system dynamics

c 1 x + (c1 c1 )x + (c1 c1 )x sgn(s
1 1 2 2 3 3 1,2 )
x3 = 2 2 1 2 2


39 such that appropriate sliding modes exist to illustrate various c12 + c13
40 (10)
switching strategies within the same context. The dynamics of Eq. 10 describes the systems evolution
41 The two switching surfaces are represented as:
42 (attraction) toward s1,2 = 0.

43  1 1 1  x1 1) Numerical Illustration: Consider the canonical system
c c c
44 s = Cx = 12 22 32 x2 , (7) for 1 = 1, 2 = 2 and 3 = 3. The original system
c1 c2 c3
45 x3 state trajectories and state values as a function of time are
46 shown in Figs. 3 (a) and (b), respectively, demonstrating the
where C i = [ci1 ci2 ci3 ] is the coefficient vector of si , i = 1, 2. stable nature of the overall system. To apply a switching attack,
47
In Section IV , the opponent-corrupted switches are operated C 1 is selected such that:
48
such that when switching is applied, Switch i opens if si < 0
49
and closes if si 0 for i = 1, 2. C 1 = [1 2 1]. (11)
50
51 The corresponding simulation results are shown in Fig. 4. As
52 A. Synchronized Switching can be observed, the system achieves instability demonstrating
53 We first consider the synchronized switching case where the how the simultaneous switching case can disrupt system
54 C 1 = C 2 because it provides a natural bridge between our operation.
55 former single switch work [6], [7] and the multi-switch exten-
56 sion in this paper. For the synchronized case, by definition
57 s1 = s2 = s1,2 which implies that the sliding surface B. Concurrent Switching
58 s = [s1 s2 ]T = 0 can also be represented as s1,2 = 0 and that We next consider the situation in which the sliding surface
59 s1,2 = c11 x1 + c12 x2 + c13 x3 . We assume that the sliding surface s = 0 exists and the strategy is to simultaneously and
60 s1,2 = 0 exists. The strategy here is to simultaneously and persistently apply sliding mode switching to Switches 1 and
 IEEE PES Transactions on Smart Grid Page 6 of 22
6

1
2


3
4
 

5
6
7
8
9  
10  
11
12
13
(a) System trajectories. (b) System states versus time.
14 Fig. 5: State trajectory for concurrent switching.
15 Fig. 3: State trajectories and states values for canonical system.
16 sT s = |s| < 0 as common and therefore determine u
17
such that sT CAx + sT CBu = |s| = sT sgn(s) to
18 1 1
give u = (CB) (CAx) (CB) sgn(s) and an overall
19
description of the system dynamics with concurrent switching:
20
21
x1 =x2

22
(c2 c1 c13 c21 )x2 + c23 sgn(s1 ) c13 sgn(s2 )
x2 = 3 1

23 c13 c22 c12 c23 . (13)
24
1 2 2 1 2 1
(c c c2 c1 )x2 c2 sgn(s1 ) + c2 sgn(s2 )
x3 = 2 1
25

26 c13 c22 c12 c23
27 (a) System trajectories. (b) System states. 1) Unstable Sliding Modes: Sliding mode control has been
28 conventionally employed for stabilization. Thus, the resulting
29 dynamics after the state reaches the sliding surface and re-
30
mains there are stable. In contrast, for power system disrup-
31
tion, opponents aim to identify unstable sliding modes through
32
appropriate selection of C.
33
34 We employ the method of equivalent control to determine an
35 effective set of system dynamics on the s = 0 sliding surface.
36 Therefore we set:
37
s = C x = C(Ax + Bu) = 0. (14)
38
39 Solving for u gives us the equivalent control ueq =
40 (c) Switch 1 status. (d) Switch 2 status. (CB)1 CAx. Thus, the effective system dynamics on the
41 sliding surface becomes:
42 Fig. 4: System trajectories and states for synchronized switch-
1
43 ing. x = Ax + Bueq = Ax B(CB) CAx (15)
1
44 = (I B(CB) C)Ax (16)
45
0 1

0
46 2. To be effective, switching must begin when x(t) is in 1 2 1 2 x1
0 c31 c12 c11 c32 0
47 the region of attraction of the s = 0 sliding surface and = c3 c2 c2 c3 x 2 . (17)
c11 c22 c12 c21 x
48 consequently the state will be driven to s = 0 as illustrated 0 c1 c2 c1 c2 0 3
3 2
49 in Fig. 5. In this concurrent switching case, individual sliding | {z 2 3 }
50 modes do not have to exist. (IB(CB)1 C)A

51 To develop an illustrative example of the effects of such It is easy to see from the structure of matrix (I
52 concurrent switching, we once again consider our canonical 1 c1 c2 c1 c2
B(CB) C)A that the eigenvalues are 0, 0 and c31 c12 c11 c32 .
53 system of Eq. (6) and determine a u to guarantee sT s < 0. 3 2 2 3
Thus to guarantee instability of this linear system it is neces-
54 Such a system will have resulting dynamics that we will use sary that the non-zero eigenvalue be positive. Thus, C should
55 to demonstrate the effects of system disruption due to multi- be selected such that
56 switch attacks. Consider:
57 c13 c21 c11 c23
sT s = sT C x = sT C(Ax + Bu) < 0. (12) > 0. (18)
58 c13 c22 c12 c23
59 There are a variety of strategies to assign u to guarantee It is clear that such a C exists with appropriately selected
60 sliding mode existence. We once again assign u such that parameters. Thus a multi-switch attack is feasible in this case.
Page 7 of 22 IEEE PES Transactions on Smart Grid
7

1
2 2) Numerical Illustration: Consider the canonical system


3 for 1 = 1, 2 = 2 and 3 = 3. The original system
4 state trajectories and state values as a function of time are
 


5 shown in Figs. 3 (a) and (b), respectively, demonstrating the

6 stable nature of the overall system. To apply a switching attack,
7 C is selected to fulfill Condition (18) by assigning:
8  1 1 1  
c1 c2 c3 1 2 1
9 C= 2 2 2 = . (19)
c1 c2 c3 2 1 1  
10  
11 1
which provides eigenvalues for (I B(CB) C)A at 0, 0 and
12 1
3 > 0 as desired. Eq. (13) describes the systems evolution to
13 s = 0. Figs. 6(a) and (b) demonstrate the system state behavior
14 and Figs. 6(c) and (d) give the switch status. It is clear that Fig. 7: State trajectory for progressive switching.
15 the switching induces system instability within a short period
16 of time even when the original system is stable.
17
18
19 to an opponent may be beneficial when intending to apply
20 synchronized cyber-physical attacks on the overall system.
21
22
We demonstrate in this section how an opponent can apply
23
progressive switching and appropriately leverage the existence
24
of an individual sliding surface to improve the stealthiness of
25
an attack. If we consider the two-switch case as illustrated
26
27 in Fig. 7, the opponents aim is to first apply Switch 1 to
28 attract a state x(t) that is within the region of attraction of the
29 s1 = 0 sliding surface and then, while x(t) is moving on this
30 individual sliding surface, add Switch 2 as well to attract the
(a) System trajectories. (b) System states.
31 overall system to the s = 0 sliding surface. If the individual
32 s1 = 0 sliding mode is stable and the s = 0 sliding mode
33 is unstable an initially stealthy but subsequently high impact
34 attack is realized. We consider the progressive switching attack
35 to have the following three stages.
36
37 Stage 1: The system state x is driven to the s1 = 0 sliding
38 surface. We make use of our canonical form system of Eq. (6)
39 and illustrate this behavior by assigning an input u as follows:
40 1 1
41 u = (C 1 B) (C 1 Ax) (C 1 B) sgn(s1 ), (20)
42 that guarantees the existence of the s1 = 0 sliding surface:
43 (c) Switch 1 status. (d) Switch 2 status. s1 s1 = s1 C 1 x = C 1 (Ax + Bu) = s1 sgn(s1 ) = |s1 | < 0
44 to obtain the following overall Stage 1 dynamics:
Fig. 6: System trajectories and states for concurrent switching.
45
x1 =x2
46

1

h
2
c12 c13 1 x1 + c12 (c11 + c13 2 )x2 + ((c13 )

x2 =
47

1 2 1 2

(c 3 ) + (c 2 )
C. Progressive Switching

48

i
2
+2(c12 ) + c12 c13 3 )x3 c12 sgn(s1 )

49 .
Consider the case in which the sliding surface s = 0 and
1

h
2 2 2 2
50 an individual sliding surface s1 = 0, say, both exist. For such 1 1 1 1


x3 = 2 2
(2(c3 ) 1 + (c2 ) 1 )x1 + (2(c3 ) 2 + (c2 ) 2
(c13 ) + (c12 )


51

a situation, it is possible for an opponent to apply concurrent


2 2
i
+c13 c11 )x2 + (2(c13 ) 3 + (c12 ) 3 + c13 c12 )x3 c13 sgn(s1 )

52 switching as discussed in the previous section. There however

53 may be disadvantages to this for a successful attack. First, the (21)

54 region of convergence for the s = 0 sliding surface may be
55 difficult to reach for certain system conditions in which say the
56 equilibrium position is distant from the region of convergence. Stage 2: The system state x enters and remains on the s1 =
57 Furthermore, the opponent may prefer to be stealthy for a 0 sliding surface. Here, the method of equivalent control can be
58 period of time slowly moving the trajectory to a seemingly employed to describe the effective dynamics in the presence of
59 stable but vulnerable position prior to an appropriately timed Switch 1 switching. We set s1 = C 1 x = C 1 (Ax+Bu) = 0 to
60 disruption. The additional timing control that this provides
1
give ueq = (C 1 B) (C 1 Ax). Substituting this into Eq. (6)
 IEEE PES Transactions on Smart Grid Page 8 of 22
8

1
2 IV. S IMULATIONS
3 In this section, we apply the multi-switch principles of
4
the previous section to the New England 10-machine, 39-
5
bus system of Fig. 1 employing DSAToolsT M . The first
6
step requires identification of attack parameters from our
7
variable structure system model of the corresponding smart
8
grid. Specifically, we make use of the swing equation model in
9
which generators are not equipped with local controllers. The
10
11 second step implements the designed attack in a simulation
12 model that includes these controllers. The reader should note
13 that although our swing equation model does not include
14
(a) System trajectories. (b) System states. generator control, our simulation model in DSAToolsT M
15 includes excitation and governor control for more realistic
16 assessment. The automatic voltage regulator (AVR) data is de-
17 rived from http://electrica.uc3m.es/pablole/new england.html
18 (in PSS/E format), where the static and dynamic data have
19 been obtained from the example files of PST toolbox (
20 http://www.ecse.rpi.edu/pst/PST.html). The turbine governor
21 data is from the PSS/E program application guide. Thus,
22 our approach allows construction of an attack using idealized
23 analytical models that can effectively execute under more
24 realistic conditions.
25 Under non-attack conditions, the systems with AVR and
26 (c) Switch 1 status. (d) Switch 2 status.
turbine governors are robust and stable to disturbance. How-
27 ever, as we demonstrate in this section after our coordinated
28 Fig. 8: System trajectories and states for progressive switching. switching attack is applied, the system can become unstable
29 within the order of seconds.
30
31 gives overall Stage 2 dynamics:
32
A. Attack Construction

x1 =x2
33
1 1 1 1 1 1 1 1 An opponents objective is to first construct an attack by
x2 = c2 c3 1 x1 c2 (c1 + c3 2 )x2 + c3 (c3 c2 3 )x3


34 2 2 selecting a multi-switch strategy and determining the param-
35 (c13 ) + (c12 ) . eters of C to disrupt power delivery using a model of the

2 2
36 1 1 1 1 1 1 1

(c2 ) 1 x1 + ((c2 ) 2 c3 c1 )x2 + c2 (c2 3 c3 )x3 power system, and then execute the attack using local state
x3 =


37 2
(c13 ) + (c12 )
2 information of target generators. Moreover, it can be shown
38 (22) that this attack is robust to model error and noisy states [10].
39 Analogous to Section III-B we can select C to guarantee, in The overall system can be modeled via the swing equations
40 contrast, the stability of the s1 = 0 sliding surface. with the following dynamics:
41
42 Stage 3: The system state x is driven to the s = 0 sliding i =i s
43 surface at the intersection of s1 = 0 and s2 = 0. To illustrate 1 ,
this behavior, we once again set sT s < 0 to give the Stage 3
i = [Pmi 10
k=1 Ei Ek |Yik | cos (i k Yik )]
44 Mi
45 dynamics of Eq. (13). (24)
46 where i , i , Mi , Pmi and Ei are the phase angle, frequency
47 1) Numerical Illustration: Once again, we consider the (with nominal frequency being 60 Hz), moment of inertia,
48 stable canonical system for 1 = 1, 2 = 2 and 3 = 3. mechanical power and terminal voltage of the ith generator.
49 Using parallel reasoning to the concurrent switching example, Yik is the Kron-reduced equivalent admittance between the
50 the two switching surfaces are selected as: ith and kth generators. Typical parameter values for the New
 
51 1 2 1 England system are assumed. The jth (corrupted) breaker in
52 C= . (23) the system is assumed to target Generator t and incorporate
2 1 1
53 the following switching signal with coefficients cj1 and cj2 :
54 The corresponding simulation results of system trajectories,
55 s j = c j1 t + c j 2 t . (25)
system states, switches are shown in Fig. 8. As shown, during
56 Stages 1 and 2, the system trajectory is attracted to the s1 = The overall system is assumed to be initially at a stable
57 0 sliding surface and remains stable as Switch 1 is applied. equilibrium point. The task of an opponent in control of the
58 However, when Switch 2 is applied the joint switching has the jth corrupted breaker would be to select the parameters cj1
59 effect of destabilization the overall system when it is attracted and cj2 judiciously to induce instability in Generator t; this can
60 to the s = 0 sliding surface. be conducted empirically or analytically [8] using the model
Page 9 of 22 IEEE PES Transactions on Smart Grid
9

1
2 of Eq. 24. Execution of the attack on Generator t requires
3 knowledge of t and t .
4 We consider the concurrent and progressive approaches to
5 multi-switch attack and then consider how the multi-switch
6 framework can be leveraged by an opponent to initiate cas-
7 cading failures within the system. We do not provide results
8 for the synchronized switching case, which is somewhat analo-
9 gous to a single switch case since one common switching sur-
10 face is used for all switches. Instead for comparative purposes,
11 we provide results for the single switch case and compare it
12 to our multi-switch case to see the attack performance gains
13 possible. (a) Phase portrait. (b) Generator 9 frequency.
14
15
16 B. Single Switch Attack
17
18 We first assume an opponent corrupts the breaker corre-
19 sponding to Line 26-28 of Fig. 1 and targets Generator 9 to in-
20 duce instability employing the sliding surface s = 59 + 9 .
21 Fig. 9 illustrates the corresponding effects on the system
22 when switching is applied starting at 10 s for only a 2-3
23 second duration. Fig. 9(a) shows the state trajectory leading to
24 instability while Figs. 9(b), (c) and (d) demonstrate the time
25 scale upon which disruption occurs. The switch status used is
26 presented in Fig. 9(e). (c) Generator 9 angle. (d) Generator 9 terminal voltage.
27 Next we consider the situation in which the breaker of
28 Line 28-29 is corrupted and targets Generator 9 once again
29 to induce instability using s = 89 + 9 . Fig. 10 presents
30 the results of the attack starting at 10 s demonstrating once
31 again instability within 2-3 seconds of switching.
32
33
34 C. Concurrent Switching
35
We next consider the scenario in which an opponent simul-
36
taneously corrupts the breakers corresponding to Line 26-28
37
(Switch 1) and Line 28-29 (Switch 2) of Fig. 1 and targets
38
Generator 9 once again to induce instability. The opponent is (e) Switch status.
39
assumed to employ s1 = 59 + 9 and s2 = 89 + 9 for
40 Fig. 9: System trajectories and states for a single switch attack
41 attack as in Section IV-B. Fig. 11 illustrates the corresponding
on Line 26-28.
42 effects on the system when concurrent switching is applied
43 starting at 10 s for only a 1 second duration. Instability is E. Cascading Failure
44 clearly evident in frequency, angle and voltage. It should be Traditionally, cascading failure analysis focuses on steady
45 noted that the use of both switches in contrast to either single state system characteristics about an initial equilibrium state
46 switch for attack results in faster instability with a shorter using static power flow methods; dynamic analysis is con-
47 switch duration. sidered in general to be difficult to model and complex to
48 assess. In this section we aim to address cascading failures
49 dynamically but in the context of our proposed multi-switch
50 D. Progressive Switching
analysis framework. We consider how corruption of a subset
51 In this case we consider corruption of breakers on Line of breakers within the New England 10-machine test system
52 02-25 (Switch 1) and Line 28-29 (Switch 2) with target of Fig 1 can be exploited to strain the system sufficiently to
53 Generator 8. Although it can be shown that an individual result in a sequence of trips and failures resulting in the loss
54 sliding mode does not exist for Switch 2, it does for Switch 1. of a substantial amount of load. We model the presence of
55 Thus we employ progressive switching starting with Switch protection as detailed in [16] and [17]. The overload protection
56 1. We assume an opponent employs s1 = 78 + 8 and on transmission lines is assumed to trigger when the active
57 s2 = 58 + 8 and Switch 1 begins at 10.0 s and Switch power over a line is more than 800 MW for 5 seconds.
58 2 joins at 10.5 s appropriately coordinating with Switch 1. We consider the corruption of Line 26-28 (Switch 1), Line
59 Fig. 12 demonstrates the effectiveness of the approach for 28-29 (Switch 2). In the first phase of the attack, an opponent
60 system destabilization. targets Generator 9 employing s1 = 59 + 9 and s2 =
 IEEE PES Transactions on Smart Grid Page 10 of 22
10

1
2
3
4
5
6
7
8
9
10
11
12
13 (a) Phase portrait. (b) Generator 9 frequency.
(a) Phase portrait. (b) Generator 9 frequency.
14
15
16
17
18
19
20
21
22
23
24
25
26 (c) Generator 9 angle. (d) Generator 9 terminal voltage.
(c) Generator 9 angle. (d) Generator 9 terminal voltage.
27
28
29
30
31
32
33
34
35
36
37
38
39 (e) Switch 1 status (Line 26-28). (f) Switch 2 status (Line 28-29).
(e) Switch status.
40
Fig. 11: System trajectories and states for a coordinated
41 Fig. 10: System trajectories and states for a single switch concurrent multi-switch attack.
42 attack on Line 28-29.
43 V. F INAL R EMARKS AND F UTURE W ORK
44
45 In this environment of rushed development and rapid de-
46 89 +9 . After Generator 9 is tripped by protection devices, a ployment, we contend that there is a timely and critical need
47 second phase is applied. Here, the opponent targets Generator for research that takes a systematic view of smart grid vulner-
48 8 employing s1 = 28 + 8 and s2 = 88 + 8 . The attack ability analysis and protection in order to provide engineering
49 results in a series of critical component trips and a resulting principles of more general use. This paper presented a worst-
50 domino effect presented in Table II and Fig. 13. Eventually, case scenario for a multi-switch attack making use of variable
51 the entire system works under power provided by Generator structure system theory for power system disruption. We have
52 10 only, which is clearly sufficient to meet the normal demand demonstrated the utility of employing multiple switches for
53 requirements. creating transient instability in target generators of a power
54 grid.
55 An opponent only needs to apply switching from 10 s to 11 s Future work will focus on developing analytical bounds on
56 and 20 s to 21 s to have devastating effects within 80 s even the time to catastrophe in the presence of ideal and non-ideal
57 with the use of protection. This impact is significant in contrast inter-attacker communications. Based on these results we will
58 to use of a single switch and demonstrates the potential of aim develop adaptive distributed control strategies that aim
59 coordinated variable structure switching attacks for large-scale to minimize damage through effective system reconfiguration
60 system disruption. such as islanding. Moreover, we will aim to identify peer-
Page 11 of 22 IEEE PES Transactions on Smart Grid
11

1
2 TABLE II: Cascading failure process of New England 10-machine, 39-bus Power System.
3 Time (s) Event Recording
4 0-10 Normal operating
5 10-11 Switching attacks implemented on Generator 9
11-16.38 Generator 9 loses synchronous, and is tripped by over-frequency relay at 16.38 second
6 16.38-20 System is operating at 59.8 HZ after tripping Generator 9
7 20-21 Switching attacks implemented on Generator 8
8 21-26.9 Generator 8 loses synchronous, and is tripped by over-frequency relay at 26.9 second
26.9-31.3 Generator 5 loses synchronous, and is tripped by over-frequency relay at 31.3 seccond
9 31.3-50 Line 21-22 active power increases, and is tripped by overload transmission line protection relay at 50 second
10 50-50.74 Generator 7 loses synchronous, and is tripped by over-frequency relay at 50.74 second
11 50.74-50.78 Generator 6 loses synchronous, and is tripped by over-frequency relay at 50.78 second
12 50.78-50.82 Bus 3 frequency decreases, the load on Bus 3 is tripped by UFLS at 50.82 second
50.82-51.03 Bus 16 frequency decreases, the load on Bus 16 is tripped by UFLS aT 51.03 second
13 51.03-51.15 Generator 4 loses synchronous, and is tripped by over-frequency relay at 51.15 second
14 51.15-51.26 Bus 15 and 18 frequencies decrease, the loads on Bus 15 and 18 are tripped by UFLS at 51.26 second
15 51.26-51.28 Generator 2 loses synchronous, and is tripped by over-frequency relay at 51.28 second
51.28-51.29 Generator 3 loses synchronous, and is tripped by over-frequency relay at 51.29 second
16 51.29-51.47 Bus 7 frequency decreases, the load on Bus 7 is tripped by UFLS at 51.47 second
17 51.47-53.66 Bus 25, 26 and 28 frequencies decrease, the loads on Bus 25, 26 and 28 are tripped by UFLS at 53.66 second
18 53.66-62.1 Generator 1 loses synchronous, and is tripped by over-frequency relay at 62.1 second
62.1-80 Generator 10 provides power to the remaining loads under fairly low frequency and voltage, which can not
19 meet the normal power requirements.
20
21 to-peer-type strategies within groups of microgrid systems to
22 rebalance and create resilience to switching attacks. Another
23
avenue of future work will identify strategies to measure the
24
effectiveness of a multi-switch attack to identify optimal values
25
of the sliding mode coefficient matrix C.
26
27
28 ACKNOWLEDGMENT
29 Funding for this work was provided through the U.S.
30
National Science Foundation Project ECCS-1028246 and the
31
Norman Hackerman Advanced Research Program Project
32
000512-0111-2009.
33 (a) Phase portrait. (b) Generator frequency.
34
35 R EFERENCES
36 [1] H. Tang and B. McMillin, Security property violation in CPS through
37 timing, in Proc. 28th International Conference on Distributed Comput-
38 ing Systems Workshops, 2008, pp. 519524.
39 [2] B. McMillin, Complexities of information security in cyber-physical
power systems, in Proc. IEEE Power Systems Conference and Exposi-
40 tion, March 2009, pp. 12.
41 [3] C.-C. Liu, C.-W. Ten, and M. Govindarasu, Cybersecurity of SCADA
42 systems: Vulnerability assessment and mitigation, in Proc. IEEE Power
Systems Conference and Exposition, March 2009, pp. 13.
43 [4] S. Sridhar, A. Hahn, and M. Govindarasu, Cyber-physical system
44 security for the electric power grid, Proceedings of the IEEE, vol. 100,
45 no. 1, pp. 210224, January 2012.
46 [5] H. Lin, S. Sambamoorthy, S. Shukla, J. Thorp, and L. Mili, Power
(c) Generator angle. (d) Generator terminal voltage. system and communicaiton network co-simulation for smart grid ap-
47 plications, in Proc. IEEE PES Conference on Innovative Smart Grid
48 Technologies (ISGT), Anaheim, California, January 2011, pp. 16.
49 [6] S. Liu, X. Feng, D. Kundur, T. Zourntos, and K. Butler-Purry, Switched
system models for coordinated cyber-physical attack construction and
50 simulation, in Second IEEE International Conference on Smart Grid
51 Communications, Brussels, Belgium, October 17 2011, pp. 4954.
52 [7] , A class of cyber-physical switching attacks for power system
disruption, in 7th ACM Annual Cyber Security and Information Intelli-
53 gence Research Workshop, Oak Ridge, Tennessee, October 12-14 2011.
54 [8] S. Liu, S. Mashayekh, D. Kundur, T. Zourntos, and K. Butler-Purry,
55 A smart grid vulnerability analysis framework for coordinated variable
56 structure switching attacks, in 2012 IEEE Power & Energy Society
General Meeting, San Diego, California, July 22-26 2012.
57 [9] S. Liu, D. Kundur, T. Zourntos, and K. Butler-Purry, Coordinated
58 variable structure switching in smart power systems: Attacks and miti-
59 (e) Switch status on Line 02-25. (f) Switch status on Line 28-29. gation, in 1st International Conference on High Confidence Networked
Systems at Cyber Physical Systems Week, Beijing, China, April 17-18
60 2012, pp. 2130.
Fig. 12: System trajectories and states for a coordinated
progressive multi-switch attack.
 IEEE PES Transactions on Smart Grid Page 12 of 22
12

1
2 Shan Liu is a Ph.D. candidate in Electrical & Computer Engineering at Texas
3 A&M University. Her research interests focus on the cyber security of the
electric smart grid and cyber-physical system theory. She has received the
4 CSIIRW11 best paper and multiple travel grant awards.
5
6
7
8
9
10
11
12 Bo Chen s a Ph.D student in Power System Automation laboratory (PSAL)
13 in Electrical & Computer Engineering at Texas A&M University. His research
(a) Generator frequencies. (b) Generator angles. focuses on the power system stability, cyber security of smart grid.
14
15
16
17
18
19
20
21 Takis Zourntos is a Research Assistant Professor at Texas A&M University
22 and has over 15 years experience at the interface of microelectronics and
control theory, which he currently applies to cyber-physical systems applica-
23 tions such as power systems and robotics. His recent cyber-physical systems
24 robotics research has been featured in Popular Science magazines 2009 Best
25 of Whats New: Security Innovation and wired.com.
26 (c) Generator terminal voltages. (d) Phase portrait of Generator 9.
27
28
29
30
31
32
Deepa Kundur is a Professor in Electrical & Computer Engineering at the
33 University of Toronto. She is an appointed member of the NERC Smart
34 Grid Task Force, was an elected member of the IEEE Information Forensics
35 and Security Technical Committee, and was the inaugural vice-chair of the
Security Interest Group of the IEEE Multimedia Communications Technical
36 Committee. She recently chaired the Trustworthy Cyber-Physical Systems
37 and Infrastructures Track of the NSF and PNNL-sponsored 2011 Workshop
38 on Cooperative Autonomous Resilient Defenses in Cyberspace and was an
39 invited speaker to the NSF-sponsored 2011 Workshop on Cyber-Physical
(e) Phase portrait of Generator 8. (f) Real power (MW) on line 21-22 for
Applications in Smart Grids. She is the author of several widespread tutorial
40 overload protective relay.
papers including two articles in the IEEE Signal Processing Magazine (May
41 Fig. 13: System trajectories and states of cascading failure 1996 and March 2004) and three articles in the Proceedings of the IEEE (July
42 1999, June 2004 and January 2008). Dr. Kundurs smart grid cyber security
analysis. work has recently received best paper recognitions at ACM CSIIRW11 and
43 IEEE CCECE12.
44
45 [10] , Coordinated variable structure switching attack in the presence
46 of model error and state estimation, in Third IEEE International Con-
47 ference on Smart Grid Communications, Tainan City, Taiwan, November
5-8 2012.
48
[11] D. Liberzon, Switching in Systems and Control. Birkh auser, 2003.
49
50 [12] V. Utkin, Sliding Modes and Their Applications in Variable Structure
Systems. MIR Publishers, 1978.
51 Karen Butler-Purry is a Professor in Electrical & Computer Engineering
[13] R. DeCarlo, S. Zak, and G. Matthews, Variable structure control of and Executive Associate Vice-President for Graduate Studies at Texas A&M
52 nonlinear multivariable systems: A tutorial, Proceedings of the IEEE, University. Her research interests are in the areas of computer and intelligent
53 vol. 76, no. 3, pp. 212232, March 1988. systems application to power distribution systems, distribution automation and
54 [14] T. Flick and J. Morehouse, Securing the Smart Grid: Next Generation management, fault diagnosis, estimation of remaining life of transformers,
55 Power Grid Security. Syngress, 2011. intelligent reconfiguration, and modeling and simulation for hybrid vehicles.
56 [15] Y. Liu, P. Ning, and M. K. Reiter, False data injection attacks against
57 state estimation in electric power grids, in Proc. 16th ACM Conference
on Computer and Communications Security, Chicago, IL, November
58 2009, pp. 2132.
59 [16] WECC, WECC off-nominal frequency load shedding plan, 2010.
60 [17] , Application of zone 3 distance relays on transmission lines,
1997.