Substation Security White Paper
Cutting Through the Noise
According to the New York Times, these chilling words were scrawled upon the walls of Entergy’s Keo substation’s burning control room in Cabot, Arkansas – one of three attacks on Entergy’s power grid in Central Arkansas during the Fall of 2013. The ease with which the attacks carried out against Entergy’s Keo and PG&E’s Metcalf substations have highlighted the vulnerability of the nations 55,000 electrical substations located throughout the United States.
The results of these actions have spurred federal regulators to reevaluate security recommendations (CIP-014) and generate the creation of pending regulations governing the resiliency and increased security of the 2,500 High-Voltage – Critical Infrastructure facilities supplying power to large populations, key industry and government facilities.
In addition to the federal regulations, the financial costs and customer confidence affect energy suppliers profitability – and possibly raising rates on customers. A transformer can cost over a $1 million dollars to replace – if you can locate one quickly, as there is not a large inventory of spares and replacing with a new one takes manufacturing six months or more from design to installation. Losing one or more transformers could critically overload the system, affect the shareholders’ confidence and result in fines of tens of thousands to millions of dollars from local and federal authorities.
It is understandable why energy providers are scrambling to implement security measures that can help prevent disasters like Metcalf and Keo. The spectrum of security solutions being deployed is broad – from highly secure multi-layered approaches to “deer cameras” sending 320×320 pictures to cell phones. It is estimated that utilities will spend $100B over the next 10 years to build up the resiliency and security of the grid. However, most of these solutions are looking in or just outside the perimeter. Quantum solutions give security teams robust security by providing awareness of what is happening outside their field of vision, by detecting human footsteps, vehicles or tunneling/gunshots long before the potential threats are at the fence or breaching the perimeter.
This white paper is designed for those who have questions as to how well a seismic-acoustic sensor system can work within the close confines of a “seismically-noisy” electrical substation and expand the substations overall security.
“It’s estimated that utilities will spend $100B over the next 10 years to build up the resiliency & security of the grid.”
Benefits of Quantum Technology Security Sciences
Quantum offers a family of products which can be combined to deliver advanced awareness solutions for a broad range of physical security applications. This includes many elements of the power industry, to include substations, the focus of this paper.
The assets associated with the critical infrastructure industry are many and varied, and nearly all of them require increasingly effective security to counter growing physical threats worldwide. As in many other situations, 20th century technology and practices are becoming more inadequate for 21st century challenges. Modern physical security and surveillance applications require systems which:
- Create increased “awareness zones” to increase time and space for proactive security measures
- Are non-line-of-sight to alert on threats which cannot be seen because they are at great distance or are obscured by obstructions such as topography, vegetation, weather, or intervening structures
- Eliminate false alarms and minimize nuisance alarms while missing few, if any, alerts
- Can be scaled to simultaneously monitor particularly long linear distances or large areas sometimes traversing states or countries
- Are concealable, with minimal vulnerability to discovery, evasion, or compromise
- Integrate seamlessly with legacy systems to improve overall effectiveness
- Are easy to install, need minimal maintenance, and are easily software-upgradable
- Increase probability of deterrence by integrating with deterrent systems to ward off unsophisticated attacks or deliver additional time for more forceful intervention
- Reduce manpower costs
- Provide 24/7 coverage without being susceptible to coercion or bribery
Quantum has designed its solutions to excel at all of these modern requirements. Its compact systems, based on award-winning, proprietary seismic-acoustic technology, will detect, classify, follow, and report potential threats to the user automatically and in real-time, all the time. Quantum’s family of products is configurable to address multiple physical security requirements, to include:
- Perimeters – providing awareness around the hard perimeter of permanent or mobile valued assets
- Linear features – providing awareness on either one or both sides of a long, linear asset, such as a pipeline or border
- Temporary security – portable, quick assembly solutions for protection of mobile assets/teams
Whether remotely deployed in austere environments, or man portable for rapid response, the product family foundation, comprising a state of the art sensor integrated with advanced, intelligent algorithms, delivers value.
The critical infrastructure industry spans numerous segments, this white paper will focus on protection of an electrical substation.
“Quantum offers a family of products which can be combined to deliver advanced awareness solutions for a broad range of physical security applications.”
Quantum systems convert vibrations in the earth into actionable information.
System Deployment & Operations
Quantum systems detect the presence of potential threats, determine the threat type, and alert the user to these facts. The systems do this by detecting and analyzing ground vibrations. Quantum systems expertly detect these vibrations, called signals, and exploit the full fidelity of the information they contain.
Quantum’s buried sensors detect acoustic vibrations and convert them into electrical signals which can be automatically analyzed to provide actionable threat information. The electrical signals are processed by a high efficiency computer node at the sensor, where they are automatically analyzed with advanced, state-of-the-art algorithms that can classify the energy source as a potential threat. The node alerts the user in real time to what has been detected and where.
System installation is typically done by trained installers, particularly for a large, permanent deployment. The individual sensors are buried approximately 10” underground. The accompanying nodes may also be buried or may be mounted above ground, depending on the requirements of the deployment. Sensor location is important but not critical. In general, sensors are spaced for overlapping coverage of the faintest signals of interest.
The associated cabling for all types of deployments is shallow-buried if required. The only system elements that must be deployed on or above the ground are GPS, if necessary, and very small, low profile communications antennas. The remainder of the deployed system can be completely out of sight if desired. The standard wireless communications link is a line-of-sight RF HF band radio. The communication range is determined by the transmission power and the antenna height. Other communications options are also available, including Ethernet 10/100, Ethernet radio, SatCom, over-the-horizon RF, cellular, and WiFi.
A view of the substation & location road
Quantum Systems at Work for Power Company Applications
This paper illustrates a typical power company transmission application by considering the monitoring of a working power company substation.
Quantum staff deployed a four sensor system along more than 280 meters of a substation perimeter in Florida to automatically monitor for human footsteps and vehicles. The substation selected is easily accessible to threats seeking to burglarize it, damage it, or compromise its performance. In fact, this particular substation has endured copper theft in the past. The environment is generally flatlands, with typical seismic propagation characteristics, and comprises a mix of Florida scrub and clear areas. Access to the substation is via a primary access road and multiple unimproved dirt or gravel roads. People or vehicles approaching via these accesses, or overland from other directions, cannot always be seen from substation property. The facility is a little more than six acres in size.
“Quantum single-channel sensor systems are deployed in a matter of minutes.”
A time series seismogram. The narrow spaced pulses are footsteps.
The data and results in this paper were generated by four Quantum single-channel sensor systems, all deployed in a matter of minutes, and all communicating with a single laptop user interface. The systems were completely buried and concealed except for the small, whip RF communication antenna. In real time, each sensor system acquired technical data (acoustic vibrations), processed the data, and reported, as programmed, micro-bursts of information associated to any target of interest.
Consider a person walking within the detection range of a sensor. As the walker, a potential threat, comes within range of each sensor, the ground vibrations associated with his or her footsteps excite the sensors and are detected. As they are detected, characteristic features are extracted which are used to classify the target. Once classified with sufficient confidence, an alert is sent to the user interface.
The transmitted alert can be acquired and graphically displayed on any user interface. For this activity, the interface was a laptop computer. Similarly, Quantum systems easily integrate into existing security and surveillance systems to enhance their performance. Quantum systems can also stand alone or provide cues for cameras or UAVs or other customer system elements.
Two sensor deployments were used for the activities described in this paper. The partial perimeter layout (white sensor location markers) was used to demonstrate the effectiveness of a typical security configuration that monitors for threats approaching the substation or loitering at an appreciable distance away from the station, potentially surveilling the substation.
A second sensor deployment out from the facility fence (blue sensor location markers) was used for demonstrating the impact of facility-related seismic noise and clutter on sensor system performance.
The time and location “ground truth” for the potential threats were determined using GPS. During both scenarios, each of the four sensors detected and classified all footstep and vehicle targets for a probability of detection value of 100%.
“The transmitted alert can be acquired & graphically displayed on any user interface.”
Sensor placements at the substation. The white indicators are for the perimeter scenarios. The blue indicators are for the noise and clutter effect evaluation.
Footsteps Approaching a Power Substation
In the first scenario, a potential threat walks out of a forest and towards the substation. For the initial approach, the simulated threat is in an area that cannot be observed from the substation due to obstructions preventing line of sight. For the second half of the approach, the simulated threat is in a cleared area. However, note that at night the visual probability of detection would be extremely low due to the impracticality of nighttime lighting at that distance from the facility.
The sensors were buried as part of a perimeter pattern around the substation. Sensor spacing is a function of many variables to include geometry of the asset, natural and unnatural background noise, geology, detection range to vibration source, nuisance alarm tolerance, and cost. These variables result in an overall probability of classification and a defined “awareness zone.”
In fact, two of the more important variables that influence the detection range of Quantum’s systems are Probability of Detection (Pd), the likelihood of correctly detecting and classifying the target, and Nuisance Alarm Rate (NAR), which is the incorrect classification of the desired target due to other signals or to system malfunction. These two variables trade off with each other. While increasing Pd can increase the dimensions of the awareness zone, it can also increase the nuisance alarm rate. The system configuration for a client application is tuned to each client’s preferences.
For this deployment, a nominal 92m (100yd) sensor spacing was chosen at a minimum of 98m from the facility fence.
The walking threat followed the path shown producing the signals in the seismograms of each sensor. A seismogram is the incoming data stream for that sensor and is the basis for that sensor’s performance as well as overall system performance.
The portion of the walker path when one or more (usually 3) sensor systems were alerting is highlighted in yellow
A view of line-of-sight and the non-line-of-sight approaches to the northwest corner of the facility.
Ground level view of a power substation & its complex of power lines.
Distance walker to each sensor when alert initially reported and when alert terminated.
Walker on path from non-line-of-sight origin to substation.
All four sensor systems alerted on the footsteps, with sensor systems 3 and 4 continuously alerting over most of the potential threat’s entire path. Sensor system 1 was the furthest from the footstep trajectory, and alerted twice, as the trajectory was at nearly the detection range limit for this sensor.
The security system result is a high confidence classification with very low probability of false alarm at a distance of more than 170m from the substation’s hard perimeter, which extends into a significant non-line-of-sight region. In fact, the reason sensors 3 and 4 have an apparent lower alert distance is because the simulated threat did not begin the walk at a great enough distance from those sensors.
When a sensor detects potential footsteps, the system analyzes the detected vibrations in detail to extract features and develop a statistical confidence that footsteps have been detected. When sufficiently confident, the system issues a footstep alert which continues until confidence in the classification of new data drops below a threshold. In addition to the alert distances shown in the seismogram above, the “S” on the seismogram show the actual alert start and stop as does the yellow line on the GPS track.
Seismograms for the four sensor systems. The sensor numbers are indicated. Each sensor system processes its own seismogram at the sensor location. For each trace, an “S” indicates the time of first alert and of alert termination.
A Vehicle Accessing the Substation Location
Using the same sensor configuration, a vehicle threat was demonstrated. As a vehicle puts more energy into the earth than a single walker, the detection range for a moving vehicle is greater.
As a vehicle moves along the ground, it injects energy into the earth and air – engine noise, exhaust noise, and the “road noise” of its suspension system and tires making contact with the ground. Quantum’s single concealed sensor detects both, enhancing our system’s performance even further.
The vehicle, a 2010 Ford F-150 4×4 pickup truck, approached the substation from the east along an access road. When abreast of the facility, it turned onto a gravel road which ran between sensor systems 3 and 4. The vehicle moved until it was approximately 160m west of sensor system 1, then stopped. At that point it was still within detection range of all of the sensors. Limited by road roughness, the truck moved at 12-15 mph over this course. It was detected at all speeds and every time was classified as a vehicle. Quantum sensor systems have been demonstrated to detect and classify vehicles at up to highway speeds.
The four sensor system seismograms indicate the times at which each system alerted and subsequently stopped the vehicle alert with the letter “S”. The GPS tracking “ground truth” of the truck indicates that it came to a stop at the end of its travel shortly before the four sensor systems discontinued alerting. The yellow highlighting illustrates the portion of the truck’s path where one or more (all four, most of the time) sensor systems were alerting on the presence of a vehicle. In practice, multiple alarms build confidence that a potential threat has been detected, as most nuisance alarms affect only one sensor system.
The truck-to-sensor distance in meters when each sensor system sent out its first vehicle alert is impressive. The “drop” distance is not listed as the truck was still within classification range of all of the sensors when it came to the end of its run. Had the truck passengers gotten out of the truck and walked towards the facility, the sensor network would have issued a footsteps alert for this new potential threat.
Results of the vehicle test. The portion of the truck run where single or multiple sensor systems (all four most of the time) sent a vehicle alert is highlighted yellow.
Distance from vehicle to each sensor when alert initially reported.
The Ford pickup truck used for the vehicle detections and classifications.
Seismograms for the Ford truck. The “S”s indicate the times of alert start and termination.
Noise and Clutter Considerations for a Transmission Facility
If land accessibility outside of an asset is an issue due to limitations in ownership or right of way, it is important to evaluate system performance as a function of proximity to an asset, especially if the asset is a source of noise. To demonstrate the effect of substation noise, four sensor systems were deployed in a line perpendicular to the facility fence in an east-west direction. Sensor system 1, nearest the fence, was located 6m (20 ft) outside the fence. Sensors 2, 3, and 4 were deployed at 38m (125 ft) spacing, placing the outermost sensor (4) 120m (395 ft) to the west of the substation fence. The photograph at the top of the page was taken from the sensor 4 location, with staff standing at the locations of the other three sensors and the substation in the background.
Signals referred to as “clutter” and as “noise” may compromise the performance of any sensor-based system. For seismic and seismic-acoustic systems, the compromise may manifest as either reduced sensitivity (and therefore lowered detection range) or as mis-classifications of other detections (and therefore lowered Pd and/or increased NAR). Both footsteps and vehicle detections were evaluated.
Sensor location and path taken by walker to approach the substation walking along the row of sensors.
“Clutter” is defined as seismic signals from a known or unknown source which is of no interest for classification as a potential threat. “Noise” is the aggregate seismic vibrations from the rest of the world, with no apparent structure. Clutter is the noisy stereo in the next room when one is trying to listen to a quiet symphony. Noise is the radio hiss in the background of the symphony music. At the substation location, the primary source of clutter was from nearby residences, commercial facilities, power lines, the substation, and road traffic. The primary source of noise was from the substation.
Plot of time-averaged clutter and walker signal strengths over frequency, illustrating the significant signal-to-clutter ratios available to support signal processing and analysis.
Seismograms from the four sensor systems as the walker approached and passed by each sensor.
Again, the walker approached the facility from the west. The seismograms clearly show the footstep patterns as the walker approached and passed each sensor system.
One analysis of the results was to compare the time-averaged signal strength detected by a sensor quiescently to that detected by that same sensor with the walker in the vicinity. The results for all four sensor systems were similar and show the average signal strength significantly exceeds the background clutter strength. In fact, over the frequency range of interest, the signal-to-clutter ratio is many decibels, ensuring an unencumbered automated analysis of the signal of interest.
This was also observed in a joint time-frequency analysis of the four sensor systems, called a spectrogram. Contrast the quiescent spectrogram of sensor system 4, furthest from the substation, with the equivalent spectrogram for sensor system 1, nearest the substation. The 60Hz clutter associated to electrical power in North America and low frequency noise are significantly more energetic at the location of sensor system 1, as expected.
Despite this, a joint time-frequency analysis of the walker across all four sensor systems illustrates that the significant signal to clutter ratio delivered by each of the sensors provides a very clean signal to its node for signal processing, data analysis, and confident alerting to potential threats.
The final figure is of a sensor design for this particular facility. With Quantum sensor systems deployed as shown, only eight sensors will be needed to cover more than 40 acres of terrain around this substation. The larger the sensor perimeter around a critical infrastructural facility, the larger the awareness zone and the better chance for applying proactive security measures. However, should a tight sensor perimeter very close to a facility be required, Quantum systems will still perform to significantly valuable expectations.
Spectrogram of elevated background environment (red “hash” of signal at very bottom) detected by sensor system 1.
Spectrogram of background environment detected by sensor system 4
Spectrograms for all four sensor systems as walker approached and passed each sensor. The signal-to-clutter noise ratio is high enough that little clutter registers in any of the spectrograms.
A notional sensor layout for perimeter monitoring the entire substation. The 8 sensor solution monitors more than 40 acres of land.
Significantly increases the probability of deterrence by providing security teams with the information they need to monitor & proactively respond to threats against critical infrastructure facilities.
The results of the testing show that the Quantum solution is capable of detecting and alerting on pedestrians and moving vehicles in the vicinity of electrical substations. Combined, Quantum’s high Probability of Detection (Pd) and greater range for alerting, along with its robust classification capability can significantly increase the probability of deterrence as well as provide security teams with the information they need to monitor and proactively respond to threats against critical infrastructure facilities.
The scenarios examined here are centered on a power company substation facility. This report could as well have focused on other generation, transmission, or distribution assets to include:
- Conventional or nuclear power plants
- Solar, wind, and other power generation facilities
- Vulnerable power transmission lines and towers
- Critical distribution points