Application Notes:

Staying NERC CIP Compliant When Connecting Third-Party Facilities: Two Customer Examples

Several utilities have approached TC Communications looking for a system in which they aim to connect third-party generation facilities to their utility, whereby there is metering data that needs to be passed between the two entities.

Some of the most common situations involve third parties, particularly those in the renewable energy sector, building energy sources such as solar and wind farms and handing them over to utilities. In these cases, metering data of the power that travels back and forth between the generation facilities and the utilities needs to be captured by power meters

The Problem

A simple solution would be to connect the meters directly to the utility since most of the meters that generation facilities use have IP or Ethernet connectivity.

The problem is that many utilities are uncomfortable doing so because of NERC (North American Electric Reliability Corporation) CIP (Critical Infrastructure Protection) requirements and cyber security requirements. Those utilities seek a solution that allows them to provide this metering data without connecting it directly to the utility, meaning that both facilities are isolated from a network cyber security solution.

For utilities with such NERC CIP compliance concerns, TC Communications offers a solution for different applications, including solutions over leased lines, Ethernet, T1 or dark fiber.

Our solution is a drop-in replacement providing isolation between the third-party generation and the central utility. We will show two separate solutions, each providing the same isolation under different circumstances, and we will also illustrate potential alternative methods of connectivity for these solutions. These are not the only solutions to this problem, but they are two that have been successfully deployed by utilities for many real-world applications.

In the rest of this article, we will cover two cases when we deployed a solution for utility customers with similar concerns: the first customer looking to use leased phone lines (POTS) and the second customer, T1 lines.

Although they were using different technology to connect the meters to their utilities, both customers sought isolation between any IP network at either end, which our solutions provided.

Some Quick Background

The electricity industry established the original NERC (National Electric Reliability Council) in 1968 in response to the 1965 Northeast blackout that affected 30 million people. The Energy Policy Act of 2005 called for the creation of an Electric Reliability Organization (ERO) to develop and enforce compliance with reliability standards in the United States.

In 2006, NERC applied for and was granted the designation of the ERO by the FERC (Federal Energy Regulatory Commission) and was renamed the North American Electric Reliability Corporation while retaining its NERC acronym. All bulk electric system (BES) owners, operators, and users must comply with NERC-approved Reliability Standards, such as NERC CIP, which requires utilities to establish a baseline set of security measures. NERC CIP compliance ensures consistent and effective power distribution to all recipients.

First Customer Application: SLSS Replacement

In this section, we will explore two viable solutions we could have provided this customer: 1) an SLSS replacement for a leased line on the PSTN (Publicly Switched Telephone Network), and 2) an SLSS replacement for an IP-based phone line.

However, in this case, the first customer that approached was looking for the former, to use leased phone lines to connect to the third-party facility’s power meters, most of which had modem outputs, allowing them to transport metering data directly to the utility.

An issue with this system is that each modem would potentially need its own leased phone line. As the leased lines market continues to shrink and leased lines are either becoming increasingly unavailable or more expensive, leasing multiple lines for one system becomes an unnecessary burden for organizations. To address this we will introduce an SLSS (substation Line sharing switch. This allows a single phone line to be used to poll multiple devices as follows.

Our Solution

For this customer, we utilized the TC3848-1 as a drop-in replacement for an existing SLSS. One of our JumboSwitch products designed specifically for line switching, the TC3848-1 has a built-in virtual PBX (Private Branch Exchange) system that allows you to manage incoming calls and switch them between different departments. It contains a single FXO port and four FXS ports.

Thanks to its four FXS ports, one TC3848-1 card can connect up to four devices. To connect more devices, we can simply add more TC3848-1 cards to connect up to 28 devices, all of which will share the same virtual PBX on a single leased phone line on the PSTN.

The diagram below illustrates how this might look:

The TC3848-1 mounting is flexible: We can use a 1U rack to configure two cards and connect eight devices, all the way up to a 4U rack for up to seven cards connecting up to 28 devices.

This proves to be a very cost-effective solution since you can program the virtual PBX to poll up to 28 devices while utilizing just one leased phone line. You also have the flexibility to connect multiple devices at one site or devices spread out at several remote locations.

Our solution using the TC3848-1 in place of an SLSS allows the customer’s polling computer to poll any of the meters at the generation facility by calling a particular extension, choosing the device, gathering the metering data, then proceeding to the next device. It is a very straightforward process.

An IP-Based Alternative

An alternative solution we provided to another customer in a comparable situation involved two TC interface units transporting the phone line over Ethernet/IP. In this case, a leased phone line was not available, so the utility used a commercial ISP (internet service provider) to provide IP connectivity.

We used one TC1910 telephone extender unit to connect the utility, came out of the phone line to connect to another TC interface unit to transport IP over the commercial IP network. Then, we used a second unit to convert the transport back to a phone line and connect to the site where the SLSS replacement unit was located. From there, the TC3848-1 card was connected to the meters at the generation facility was connected to the meters at the generation facility.

The diagram below illustrates this alternative method in the bottom half:

With this method, we could provide an isolation point using the phone line at two locations: one at the utility end, and another at the SLSS end. This way, the utility has no direct connectivity to an external IP solution. We were able to achieve the same goal of transmitting the metering data across the network without directly involving any IP connectivity, alleviating any NERC CIP compliance or cyber security concerns for the customer.

Using Dark Fiber

Yet another alternative is to use essentially the same setup as the one described above, but this time using different TC interface units to connect over dark fiber. Instead of a leased phone line or commercial IP connectivity, utilities can use two TC1901 to connect to the TC3848-1 SSLS replacement over Dark fiber. Just as in the previous example, this method provides two phone line isolation points, bypassing the need to connect the meters directly to the utility’s IP network.

The diagram below illustrates how similar this setup is to the IP-based solution:

Second Customer Application

First Solution

Now, we will look at a second customer example. This customer had T1 connectivity between their utility site and their third-party generation site. In this case, the customer had direct serial connectivity to the meters at the third-party site, meaning that they were looking to transport that serial data over a T1 line to a SCADA host at the utility site.

In this situation, we used the JumboBank® TC8631-1 four-channel serial over T1/E1 multiplexer on each end to connect the SCADA host and the meters, serial to serial, over a single T1 line. Two cards were placed at each end to provide eight connections (for eight meters).

This method offers long-range, easy-to-deploy connectivity over T1 while maintaining isolation at both ends, as there is no external IP connectivity involved at all.

The diagram below illustrates how this would look:

Second Solution

Later, the same customer approached us for a similar solution, but this time, they were looking to use a commercial IP network in the absence of T1 connectivity. Our solution was to add JumboSwitch cards to provide T1 connectivity.

First, on each end, we used the same TC8631 T1/E1 multiplexer to connect serial-to-serial the SCADA host on the utility side and the meters on the generation facility side.

In the middle, we used a JumboSwitch TC3845-1 T1/E1-over-IP card to connect to the TC8631-1 card connected to the SCADA host over T1. From here, the TC3845-1 transports commercial IP over Ethernet. A second TC3845-1 card then connects to another TC8631-1 card and converts it back to T1.

The diagram below illustrates how this was done:

This method provides a T1 isolation point on each end, preventing any direct IP connectivity between the utility and the third-party facility, again helping the utility access any metering data needed while achieving NERC CIP compliance.

Conclusion

These examples illustrate how TC Communications provides multiple solutions to utility customers with different requirements. Our JumboSwitch and JumboBank solutions provide flexibility, and in the case of customers using leased lines, JumboSwitch can help reduce costs for utilities by keeping the number of leased phone lines needed to a minimum.

For more information about SLSS replacement: IEEE 1613 Compatible Substation Line Sharing Switch

Related


Interested in similar content? Subscribe to our mailing list.