A review of cascading events in the panEuropean electricity network

10/12/2021

Energy infrastructures are complex systems which have physical, geographical, logical and, finally, cyber interdependencies with other critical infrastructures, e.g. transport, telecommunications, water, agriculture, health, finance, chemical industry and networks supporting the government, central and territorial entities, emergency services, as well as military- and civil defense. A disruption in the normal operation of critical energy infrastructures can have a negative cascading effect on other infrastructures, as well.

In the interconnected panEuropean electricity network, these disruptions can have significant impacts in the adjacent electricity systems, and even lead to a wide area collapse of frequency and black outs. The disruptions mentioned can be caused by human errors, weather events, physical failures on critical infrastructures and cyber attacks. Some significant events that occurred during the last years are presented hereafter.

On 4 November 2006, the disconnection without any warning of a high voltage line in Germany deprived 15 million Europeans of electricity for several hours, even causing the Spain Morocco interconnection to trip. The cause of these cascading events leading to blackout was a planned routine disconnection of the EMS power line crossing in Northwest Germany to allow a ship to pass beneath the overhead cables. This outage change was communicated to the neighboring TSOs and they did simulations to ensure stability. However, another change to the shipyard schedule requested the shut-off to change once again. This new change was not communicated to the neighboring TSOs until very late so a full analysis was not done. Thus, an electrical blackout had cascaded across Europe extending from Poland in the north-east, to the Benelux countries and France in the west, through to Portugal, Spain and Morocco in the south-west, and across to Greece and the Balkans in the south-east.
On 23 December 2015, hackers remotely compromised information systems of three energy distribution companies in Ukraine and temporarily disrupted the electricity supply to consumers. Thirty (30) substations (7 110kV substations and 23 35kV substations) were disconnected from the grid, and approximately 230000 people were affected, ICS physically damaged, and the end consumers suffered lack of electricity for a period from 1 to 6 hours. The substations were manually operated for several weeks after the event.
On March 2020, ENTSO-E, the European Network of Transmission System Operators, has announced that it found evidence of a successful cyber intrusion in its office network. ENTSO-E represents 43 electricity transmission system operators from 36 countries across Europe, thus extending beyond EU borders. According to the organization, a risk assessment has been performed and contingency plans are now in place to reduce the risk and impact of any further attacks. The malware attack caused the website and electronic filing system to go offline, but no sensitive or confidential data was compromised. However, it's important to note that the ENTSOe keeps records of technical information on power plants and operations networks of the utilities and other entities it regulates - and if attackers were able to obtain such information, it could be used to facilitate operations against the utilities directly.
On 24 July 2021, due to a major incident in France, the transmission systems of Portugal and Spain, together with a small part of the French transmission system, were disconnected from the synchronous area Continental Europe. Subject to further investigation, the cause of the event is presumed to have been a forest fire in the vicinity of the transmission lines.
On 8 January 2021, the synchronous area of Continental Europe was separated into two parts due to outages of several transmission network elements in a very short time. The initial event was the tripping of a 400 kV busbar coupler in the substation Ernestinovo (Croatia) by overcurrent protection. This resulted in a decoupling of the two busbars in the Ernestinovo substation, which in turn separated North-West and south-east electric power flows in this substation. This event lead to the shifting of electric power flows to neighbouring lines which were subsequently overloaded. This was followed by the further tripping of lines due to distance protection, and eventually to other disconnections that resulted to the separation of the Continental Europe Synchronous Area.

References

https://www.entsoe.eu
B.Miller, and D.C.Rowe, Symantec, ICS-CER, NERC
“Cyber attacks and Energy Infrastructures: Anticipating Risks”, IFRI Centre for Energy, January 2017.