Self-Healing and Resilient Critical Infrastructures

Transcription

1 Self-Healing and Resilient Critical Infrastructures Rune Gustavsson & Björn Ståhl School of Engineering Blekinge Institute of Technology (BTH) SWEDEN Gustavsson Ståhl CRITIS

2 Overview Case study EU Project INTEGRAL Engineering principles of Self-Healing and Resilience Conclusions and pointers toward future work Gustavsson Ståhl CRITIS

3 EU FP INTEGRAL INTEGRAL - Integrated ICT- Platform based distribution control in electricity grids with a large share of distributed energy resources (DER) and renewable energy resources (RER). Member of DG TREN SmartGrids Gustavsson Ståhl CRITIS

4 INTEGRAL - Three interconnected Critical Infrastructures (EMS, ICT & CBS) Market model Smart Meter Access point CELL - based Intergated Approach Service Oriented Architecture EMS DER/RES Grid ICT System CBS Business Grid Design and maintain trustworthy Quality of Service! Gustavsson Ståhl CRITIS

5 Our approach: A configurable experiment driven approach Complements traditional off-line static assessments Implements techniques for hardening and/or protecting execution of software A methodology combining fault injections and hardening techniques Implements mechanisms of self-healing Gustavsson Ståhl CRITIS

6 INTEGRAL - Objectives Addresses important operational aspects on how to run DES/RES integrated with the grid, e.g., Self-Healing, fault handling and automatic grid reconfiguration in the presence of a large number of DER/RES. Optimality of autonomous DER/RES islanded operations in interaction with higher levels of the grid. System level security and protection of DER/RES distributed control information and actions Balancing and trade of services with the help of clusters of cells Gustavsson Ståhl CRITIS

7 INTEGRAL - Field Demonstrators A. Normal operating conditions of DER/RES aggregations, showing their potential to reduce grid power imbalances optimize local power and energy management, minimize cost etc. B. Critical operating conditions of DER/RES aggregations, showing stability also in integrated grids. C. Emergency operating conditions, showing selfhealing capabilities of DER/RES aggregations. Gustavsson Ståhl CRITIS

8 Cell Structure Gustavsson Ståhl CRITIS

9 Coordination Challenges Different situations Normal Critical Emergency Gustavsson Ståhl CRITIS

10 Engineering principles of Self- Healing and Resilience Operationalizable definitions A principled approach Tools Gustavsson Ståhl CRITIS

11 Basic definition Definition (Self-healability). Self-healability is the property that enables a system to perceive that it is not operating correctly and, without human intervention, make the necessary adjustments to restore itself to normality (Ghosh, et. al., 2007). Gustavsson Ståhl CRITIS

12 Related definitions Dependable systems, that are defined as systems globally trustworthy with respects to their ability to always deliver its service. Fault-tolerant systems, in which faults may occur but do not affect the performance of the system. Resilient systems, systems that could reconfigure to harness disturbances. As oppose to these three definitions that specify the goals but not the means, selfhealability aims at correcting or put right undesirable system situations. That is an active approach that operationalize the definitions stated above Gustavsson Ståhl CRITIS

13 Software intensive systems Software is the glue connecting the different critical infrastructures EMS, ICT and CBS. In fact they are individually, or combined, examples of software intensive systems. In the following we focus on self-healing and resilience of software intensive systems. Gustavsson Ståhl CRITIS

14 Hardening Software Intensive Systems - Developing self-healing mechanisms Principled debugging Models and methods supporting instrumentation, monitoring of execution flows, intervention, manipulation of execution sate and exploring state Detecting causes of unwanted behaviour Explanations at appropriate operationalizable level of abstraction Modify some part of the program, environment or build a tool chain to prevent the system from unwanted behaviour. Identification of self-healing mechanism Gustavsson Ståhl CRITIS

15 System views System views captures relevant aspects of the system under consideration. That is at least the following: Expectations on systems, subsystems or components behaviour with respect to some event/or expectation on good/poor quality in some component et cetera. Measurements of data in the execution system of data structures in the source code et cetera. Ideas of meaningful representation of data, and Assumptions Gustavsson Ståhl CRITIS

16 Subdividing a system into components Subdivision into communicating subsystems Recursive boundaries Interfaces Sub-divided into Components as Services Gustavsson Ståhl CRITIS 2008

17 Programmable components Programmable router as an aggregate Monitoring of Service Level Agreements, Access Control, Protocols, Message Streams, and information content! Gustavsson Ståhl CRITIS

18 Tools EXP II configuration of experimental environments Setting up and performing experiments INSPECT Modelling and monitoring of data streams across boundaries Support of reasoning about or validation of properties or qualities Gustavsson Ståhl CRITIS

19 EXP - II The main features of our new environment under development are: Support for environment manipulation during experiments, e.g., fault injections Virtualization at interaction points at borders Extensions of basic services of EXP across platforms and networks Support for experiments on instrumentation and measurements (Network of software probes) Support for feed-back, calibration and debugging Support for configuration of experimental environments. Programmable nodes and connectivity models Gustavsson Ståhl CRITIS

20 The EXP-II environment. Gustavsson Ståhl CRITIS

21 The EXP environment An configurable experimental set up Gustavsson Ståhl CRITIS

22 Building an experiment environment High-level view Gustavsson Ståhl CRITIS

23 Experiments of ICT embedded in power systems Overview Gustavsson Ståhl CRITIS

24 INSPECT Gustavsson Ståhl CRITIS

25 Contract specified behaviour Inter-component (agent) contracts as rules about event triggered: Obligations Obligation discharge Obligation violation Event notification channels, time stamping and notifier authentication Event calculus reasoning for agents Gustavsson Ståhl CRITIS

26 Conclusions Our experiment based approach allows a principled methodology towards design, implementation, observation, and maintenance of resilient SCADA systems supporting critical infrastructures Work in progress but already interesting results References Comparisons with other approaches References Gustavsson Ståhl CRITIS

27 Next steps Participation in the INTEGRAL project Demo C: Critical situations & Self-Healing Development of methodologies and tools Three PhD students Gustavsson Ståhl CRITIS

28 Thank you Questions!? Gustavsson Ståhl CRITIS