Energy dispatch or energy management system (EMS) refers to the slowest MG control where operations are carried out at the minute scale or more. Furthermore, called tertiary control, this level consists of the operating and controlling features acting on the energy resources and loads to manage the power flow exchanges within the MG and with the main grid to ensure optimal operations
[14]. This optimality is usually defined in terms of economic as well as ecological criteria. In charge of the energy dispatch optimization, EMS can be divided into different modules dealing with the demand and the production side as well as the forecasting of both
[15]. Those modules are defined as:
DSM includes methods used to adapt demand to available generation, for example, to promote self-consumption and reduce the aggregated energy consumption during peak demand
[16]. These processes are encouraged by financial incentives, such as off-peak rates that lower the electricity cost during specific times as well as through consumer education. The aim of those preventive methods is not only to reduce the overall consumption but also to spread it temporally so as to match generation and infrastructure capacities with energy demand. By ensuring this energy balance, DSM reduces the need for investments in power system capacity. On the generation side, DO refers to the methods used to optimally generate energy and allocate it according to the loads, storage systems and sources
[17].
The sources can be all kinds, including diesel generators, solar panels, or wind turbines. DO can aim for different optimization objectives, such as economical ones by reducing the energy costs or environmental by reducing the CO2 emissions or by increasing the share of renewable energy used. Another optimization objective can be the power stability in the MG to ensure a high-power quality. Finally, FM refers to the forecasting techniques applied to predict power generation
[18] as well as energy load
[19] and electricity prices
[20] based on external and internal factors. Forecasting techniques are numerous and can range from linear to nonlinear methods as well as machine learning ones. The techniques are selected according to the forecast requirements, the data available and the time resolution. Common forecasts for power generation are mainly related to renewable energy, such as solar and wind power.
Comparing EMS control features is challenging as various strategies, having distinct characteristics and objectives, have been developed to carry out those functionalities. To interpret the performance difference, it is necessary to identify the characteristics of the compared control modules. For example, the comparison of two energy load FMs having different time resolutions, prediction methods and data inputs will not allow concluding, which characteristics influence the variations of performance on the MG fuel consumption. Additionally, comparing DSM modules presenting distinct control architectures and prediction horizons will also lead to a weak interpretation of their performance differences as their source is uncertain. Moreover, to evaluate tertiary control modules, it is recommended to identify and limit their characteristics differences.
3.3. Cybersecurity
Cybersecurity is an important factor in the life cycle and operation of an MG. This section gives an overview of cybersecurity aspects as well as current approaches for improving security on different levels. Subsequently, a summary of quality benchmarks for a cyber-secure MG is presented, along with recommended actions, which can reduce security risks in such systems.
The MG is a cyber-physical system, which comprises information, control, communication and field levels
[21]. The information level refers to the processing, storing, and provisioning of information in data centers and cloud applications. The aggregated information is also used at the control level, which coordinates the secure, reliable and stable operation of the grid. Control-level applications (e.g., SCADA and DCS) are concerned with monitoring and managing grid operations. The communication level comprises information and ICT, which allows the timely and secure transmission of information between different actors (e.g., measurements or control commands). Lastly, the field level includes the electrical equipment and smart devices involved in energy generation, transmission, distribution, consumption, and measurement.
Attacks targeting an MG can be initially classified as passive and active. Passive attacks extract valuable information, such as consumer data, credentials, and configurations. Information leakage is generally a high-risk problem if privacy is a concern, but it appears at first inconsequential for the grid’s safe operation. However, the leaked information could allow passive actors to corrupt a system actively in the future
[22]. Active attacks include injection of meter readings, forging or replaying commands, and elevating the privilege of users to corrupt a system temporarily (e.g., to disrupt or destroy it) or permanently (i.e., as a strategic access point in the future). Adversaries can exploit several attack vectors, which introduce significant risks in the electrical infrastructure. In a worst-case scenario, attacks can lead to blackouts, physical damage, and loss of life. Exploitable attack vectors must be addressed on a device, software, communication, and orchestration level
[23].
The main cyber-security challenge on a field or device level can be summarized as the reliance on inputs and actions of devices that may be in the hands of an adversary. Indeed, the issue is compounded by the fast deployment of smart devices without adequate security and protection. Trust in the MG control and operation can be defined as some degree of confidence that, during some specific interval, the appropriate actor is accessing accurate and unmodified data, which is created by the intended device in the expected location at the proper time and communicated using the expected protocols
[24]. Traditionally, the grid’s control system is viewed as an environment with implicit security and trust (e.g., because the infrastructure is owned, operated, and protected by the operator). However, MG devices do not necessarily have physical protection and are owned and operated by multiple parties, including potential adversaries. Devices must be designed to be tamper-resistant to prevent physical manipulation. Additionally, the push towards cloud services for grid management has significantly increased the number and variety of devices and parties involved such that often, access control-based policies will not be applicable or scale well
[25]. The use of trusted computing hardware for MG devices can effectively address the need for adequate authentication, authorization, and credential protection as they offer a secure foundation (a root of trust) for important security guarantees, such as integrity, authenticity, confidentiality, provenance, and resilience
[26][27][28].
The complexity of software systems, which enable the function, control, and processing in a smart MG, is increasing and rivals that of today’s commodity systems (e.g., IoT devices, mobile and desktop computers)
[29]. MG layers commonly share software from other domains and computing systems and with it their bugs and vulnerabilities. However, threats related to software engineering are well known and can be addressed in several ways
[30]. The software systems in an MG will have to be designed and tested to the same principles as software, which is expected to be secure. Safety-critical systems often must undergo much more rigorous testing and certification procedure. One approach to improve software quality is referred to as formal specification and verification. However, large pieces of software (e.g., legacy code, updates, or patches) are notoriously laborious to specify, verify, or certify
[31]. Fuzzing technologies provide an efficient way for testing such software systems for bugs and errors
[32]. The MG is an essential infrastructure where non-critical software (e.g., user interfaces) should not interfere with critical software components. Applications from different security domains and with different levels of criticality must be isolated from another.