ESTELLE: A Method to Analyze Automatically the Performance of Telecontrol Protocols in SCADA Systems

ESTELLE: A Me hod o Analyze Au oma ically he Pe o mance o Telecon ol P o ocols in SCADA Sys ems Ve ónica Medina, Isabel Gómez, Joaquín Luque, Membe , IEEE, and Se gio Ma ín Abs ac —This pape p esen s he use o ESTELLE, a o mal desc ip ion echnique, as a me hod o calcula e au oma ically he pe o manceo elecon olp o ocolsinSCADAsys ems.Somespe- ci ic p imi i esa e added o he ESTELLE desc ip ion language in o de o achie e ha goal. As an example, we analyze he pe o - mance o a elecon ol p o ocol. The esul s om his me hod a e compa ed o pe o mance measu emen s ob ained om analy ical and simula ed solu ions Index Te ms—Pe o mance analysis, pe o mance modeling, p o ocol speci ica ion, SCADA sys ems, elecon ol p o ocols, h oughpu , ansmission delay. I. INTRODUCTION IN THE las ew yea s, he ole o powe u ili ies in he wo ld o elecommunica ions has unde gone apid changes which a ec no jus echnological aspec s, bu also issues o egula- ion, access o new ma ke s, he c ea ion o new se ices, e c. This si ua ion c ea es u gen echnological demands ha ha e o be sa is ied o be able o keep on compe ing success ully [1]–[9]. One o he mos impo an aspec s o upda ing echnology is o manage he ope a ion o a powe u ili y ne wo k. Tha is why se e al elecon ol sys ems ha e been applied o ope a e on such a ne wo k in a sa e and economical way since he 1960s [10]–[12]. These elecon ol sys ems a e based on p ocesso a chi ec u e ins alled h oughou he ha dwa e o he powe u ili y ne wo k. The p ocesso s a e mainly loca ed in bo h he ene gy gene a ion plan and he ene gy dis ibu ion and ans o ma ion s a ions. These plan p ocesso s a e called “ emo es” [ hey a e also called emo e e minal uni s (RTUs)] and make i possible o wo k on he powe ne wo k. Remo es communica e wi h one o se e al cen e s (also called con ol cen e s), sending he ne wo k s a us in o ma ion and ecei ing commands. Communica ion p o o- cols, which a e applied o con ol hese powe ne wo ks, should be s udied ho oughly, because he expense o se ing up such sys ems can be educed jus by op imizing hem. These p o o- cols a e called elecon ol p o ocols. A o mal desc ip ion echnique (FDT) is chosen when a p o- ocol has o be speci ied in a o mal way. Al hough he e a e many FDTs, h ee o hem a e he mos popula . These a e ex- ended s a e ansi ion language (ESTELLE) [13] and speci i- ca ion and desc ip ion language (SDL) [14], based on ex ended ini e s a e machines, and language o empo al o de ing spec- i ica ion (LOTOS) [15], based on p ocess algeb a. All h ee a e in e na ional s anda ds and he selec ion o one o he o he de- pends on he speci ic needs o he use o designe . No single FDT sa is ac o ily ul ills all o he equi emen s. Se e al s udies [4], [16] ha e shown ha ESTELLE adap s be e o he elec ical sec o han he o he speci ica ion languages, since i does no equi e much lea ning o special- iza ion e o . A ool, called a uni e sal p o ocol con e e o con e ido uni e sal de p o ocolos (CUP), was designed o implemen and in eg a e elecon ol p o ocol om i s speci i- ca ion in ESTELLE [17]. Ou ecen wo k has ocused on adding pe o mance mea- su emen capabili y o he CUP ool. This way, he pe o mance o elecon ol p o ocols can hus be analyzed om i s speci ica- ion in ESTELLE, and an e icien implemen a ion can be made o hem. To achie e his, some speci ic p imi i es a e added o he speci ica ion in ESTELLE o a elecon ol p o ocol [18], [19]. In his pape , we p esen an al e na i e me hod o s udying he pe o mance o a elecon ol p o ocol wi hou using analy - ical o simula ed solu ions. In ESTELLE, we speci y he pe - o mance analysis model o he elecon ol p o ocol (exis ing o new) including he pe o mance p imi i es. The pe o mance measu es a e hen au oma ically calcula ed. The pe o mance analysis model is needed because i is possible o s udy only one pa (a laye ) o a whole p o ocol. Ino de o alida e hisme hod,wes udy he same elecon ol p o ocol analyzed in [20] and [21], whe e he pe o mance was calcula ed by bo h an analy ical and a simula ed solu ion. We show all he s eps ha a e necessa y o ob ain he pe o mance o such a p o ocol au oma ically and he esul s o ha analysis a e compa ed o hose ob ained in he a o emen ioned wo k. II. PERFORMANCE ANALYSIS Pe o manceanalysis(anac i i yincludedin op o ocolengi- nee ing, i.e., o he se o ac i i ies which, based on some com- munica ion equi emen s, a e able o gene a e a p o ocol exe- cu able code in an e icien and eliable way), is used o analyze ap o ocolino de op edic andop imizei sbeha io .The ea e di e en echniques o measu e pe o mance ha a e no only applied op o ocolsbu also osys emsingene al.Mos sys ems [22] a e s udied by making models o he samesys ems in e ms o logical and quan i a i e ela ionships. They a e hen manipu- la ed and changed o see how he model eac s, and hus how he sys em would eac , ob iously, i he model we e a alid one. I he model is simple enough, i may be possible o wo k wi h i s ela ionships and quan i ies o ge an exac , analy ical solu ion. Howe e , many sys ems a e so complex ha hei alid ma h- ema ical models a e also e y complex, making i necessa y o eso o o he s udy echniques, such as simula ion; ha is, nu- me ically exe cising he model o he inpu s in ques ion o see how hey a ec he ou pu measu es o pe o mance. Al hough simula ions a e o en e e ed o as a “me hod o las eso ,” hey a e in ac almos always he only e ec i e way o measu e sys em pe o mance. This is due o he shee complexi y o he sys ems in ol ed and o he models necessa y o ep esen hem in a alid way. We p opose ano he solu ion o de e mine he pe o mance o a elecon ol p o ocol (ou sys ems) by using FDTs. Fi s , he elecon ol p o ocol, which could be a new o an al eady exis ing one, is speci ied in ESTELLE, including he sui able pe o mance p imi i es. Then, an execu able code is gene a ed, called he simula ing code, which, when i is un, calcula es he pe o mance o such a p o ocol. The ad an age o his p oposal is ha he pe o mance o he elecon ol p o ocol is au oma i- cally de e mined while i s speci ica ion in ESTELLE is made. This way, pe o mance can be p edic ed and some pa ame e s can be se up. The di e ence be ween a simula ed solu ion and ou s is ha he simula ed one simula es a model o he p o ocol and we only simula e op edic pe o manceau oma ically, becauseweac u- ally speci y in ESTELLE he e y p o ocol (wi h some speci ic p imi i es o he pu pose o pe o mance analysis). The e o e, we bo h de e mine he pe o mance and speci y in ESTELLE he elecon ol p o ocol, and also, he execu able code o such a p o ocol can au oma ically be gene a ed using he app op ia e ools. III. ESTELLE PERFORMANCE MODEL The pe o mance o a laye (see Fig. 1), in line wi h he open sys em in e connec ion model (OSI) [23] o a simila one, is going o be s udied using wo pa ame e s, namely, he h oughpu and ansmission delay. The h oughpu is de ined as he numbe o success ully ansmi ed messages pe mean ansmission ime o a message, and he ansmission delay, is de ined as he ime in e al, in uni s o he a e age ansmission ime o a message, om he momen a message is gene a ed o he ins an i is co ec ly ecei ed. Fo he pu pose o analysis, he beha io o he and lowe laye s is ypi ied, om he poin o iew o he laye , as a i ual channel (see Fig. 2). Tha channel sends a se o bi s a a a e o and he e is a delayed due o he laye p opaga ion ime. The h oughpu o he laye is hen de ined as (1) Fig. 1. Laye ed model. Fig. 2. Lowe laye s model. Le be he ime in which he laye COMPUTER A(see Fig. 2) ecei es a message om he laye o be sen . Fu he mo e, le be he ime in which he COMPUTER B laye ecei es such a message om he laye . Then, he ansmission delay is gi en as (2) When a elecon ol p o ocol is speci ied in ESTELLE, he e is no in o ma ion abou which modules belong o he same laye . The messages a e sen using in e ac ion poin s among modules (di e en laye s) ha a e connec ed o a ached, bu he e is no possible knowledge abou he pee en i ies (o modules) ha a e eally exchanging messages. Thus, some addi ional in o ma ion has o be added o he speci ica ion in ESTELLE o ob ain he ansmission delay and he h oughpu in o de o use he p e ious pe o mance analysis model in he ESTELLE simula ing model, as de ined in (1) and (2). O he s pa ame e s, such as he medium, minimum, and maximum message wai ing ime o a queue in a module, he numbe o messages ecei ed, e c., a e au oma ically calcula ed wi hou adding ex a in o ma ion. Th ee kinds o p imi i es ha e been added o he ESTELLE speci ica ions, which a e explained in de ail in [18]. The i s wo a e o he h oughpu , and he hi d one is o he message delays. These p imi i es a e lis ed as ollows. 1) CUP_PETICION_TRANSMISION: This p imi i e is used when he laye ecei es a eques om he laye o send a se o bi s. 2) CUP_TRANSMISION_VALIDA: This p imi i e is used when he laye sends a se o bi s using he se ices p o ided by he laye . This se o bi s consis s o wo pa s— he se o bi s o he laye and he ex a bi s o he laye . 3) CUP_CATEGORIA:The messages o a laye a e classi- ied o ha e hei own ansmission delay. This p imi i e is used o his pu pose. A p o ocol designe who wan s o measu e he pe o mance o a elecon ol p o ocol has o wo k in he ollowing way. a) Fi s , he speci ies he elecon ol p o ocol in ESTELLE, adding he a o emen ioned p imi i es o his speci ica ion. The p imi i es a e included in he body de ini ion o a module a he adequa e ansi ion, depending on he mea- su emen he designe needs. As he ime is simula ed, he ESTELLE TIMESCALE clause is used o de e mine i s uni . b) Once he designe has speci ied he p o ocol in ESTELLE wi h he pe o mance p imi i es in he app op ia e place, he can compile i and make i s execu able code. Some iles a e sa ed wi h he pe o mance in o ma ion when he execu able code is execu ed ( he designe can se he execu ion ime) o analyze esul s. IV. APPLYING THE MODEL In o de o alida e ou me hod o calcula ing he pe o - mance, we s udy he same elecon ol p o ocol analyzed in [20]. Tha pape p esen ed a me hod o calcula ing he ca- paci y o a mul ipoin communica ions channel when a polling p o ocol is used. An exac solu ion, an app oxima e bu easie o use solu ion, and simula ed solu ion we e ob ained o e- spond o he ollowing ques ion: “How many emo es (RTUs) can sha e a link wi hou deg ading sys em pe o mance?” Ob- iously, he answe would depend upon a ious pa ame e s such as link eloci y, message leng h, he amoun o in o ma- ion gene a ed by each RTU, e c. Howe e , i also would de- pend signi ican ly upon he communica ions p o ocol, called medium access con ol (MAC) p o ocol, used o communica e be ween he con ol cen e and he emo es [24]. This p o ocol akes a ques ion-answe o m in many con ol cen e s, also Fig. 3. Laye ed medium access p o ocol. called polling p o ocol. The con ol cen e polls he i s e- mo e on he link; i he emo e has messages o send, i does so, and i no , i sends a null message. The con ol cen e goes on o he poll, he second emo e, and so on, successi ely un il i has con ac ed all he emo es on he link, a which ime i s a s o e again wi h he i s RTU. This is he ypical p o- ocol used in he MAC laye in elecon ol p o ocols. Le us analyze such a MAC p o ocol (polling p o ocol) o measu e i s pe o mance using i s speci ica ion in ESTELLE and compa e esul s. As desc ibed in he p e ious pa ag aph, he e a e wo kinds o s a ions, namely, a p ima y s a ion (con- ol cen e ) and one o mo e seconda y s a ions ( emo es). The seconda y s a ions ha e o be polled by he p ima y s a ion be- o e acqui ing he channel, ha is o say, he p ima y s a ion con ols he communica ion channel. Fig. 3 illus a es he p o- ocol communica ion model. This p o ocol is di ided in o h ee laye s and he e is an addi ional one o join all he communi- ca ing en i ies o he pu pose o pe o mance analysis. We a e only in e es ed in he MAC laye so he uppe and he lowe laye s a e speci ied o beha e as he eal ones ( he ones used in he elecon ol p o ocol s ack). The e a e only se en di e en modules in ESTELLE o speci y his p o ocol: a p ima y USER module, a p ima y MAC module, a p ima y PHYSICAL module, a COMMU- NICATION CHANNEL module o in e connec he p ima y s a ion o he seconda y s a ions, a seconda y USER module, a seconda y MAC module, and a seconda y PHYSICAL module. Each module in e changes in e ac ions only wi h he modules o which i is connec ed by means o in e ac ion poin s. The in e ac ion poin s a e de ined in he module heade de ini ion and i s desc ip ion is associa ed wi h he channel de ini ion. Each module also needs a body de ini ion o desc ibe i s beha io . The beha io o a module in ESTELLE is desc ibed by an ex ended ini e s a e machine; he e is a speci ic syn ax o do so. The s a ions exchange ou kinds o messages: 1) e en ; 2) measu emen ; 3) command; and 4) command acknowl- edgmen . The e a e ou possible ansmissions delayed; one o each class. The ansmission delayed is measu ed a he USER laye and he h oughpu is measu ed a he MAC laye . Fig. 4. P o ocol e iciency. Fig. 5. Measu emen ansmission delay. Once he speci ica ion o he MAC p o ocol1is compiled and e o ee, he execu able code is gene a ed. A ile is sa ed wi h he pe o mance in o ma ion when he execu able code is exe- cu ed; he execu ion ime can also be se up. Sec ion V consis s o he analysis o esul s. V. ANALYZING RESULTS We make he same conjec u e as in [20], i.e., each seconda y s a ion gene a es messages exponen ially (a Poisson p ocess) wi h an a e age ime o 4 s, and he p ima y s a ion gene a es command messages exponen ially wi h an a e age ime o 8 s. A seconda y s a ion is less likely o gene a e an e en message han a measu emen message. The swi ching ime is 10 ms. The leng h o measu emen and e en messages is 380 b and he leng h o command messages is 60 b. The simula ing ime is 1 h and he maximum numbe o RTUs (seconda y s a ions) is 28. The ansmission delay is au oma ically calcula ed using (2) o each kind o message sen . Equa ion (3) shows he e iciency ( h oughpu ) o he MAC laye , i.e., he bi - a e o he MAC laye pe ansmission bi - a e (bi - a e o he physical laye ) only subs i u ing o MAC in o (1). Equa ion (4) shows , which is ela ed o he o al bi s sen om he USER laye and he simula ing ime. The e iciency o he MAC laye is hen au oma ically calcula ed using (5) by only subs i u ing (4) in o (3). The h oughpu is a numbe be ween one and ze o bi - a es (3) o al numbe o bi sen om use laye simula ing ime (4) 1The speci ica ion in ESTELLE is no shown o b e i y. Fig. 6. E en ansmission delay. Fig. 7. Command ansmission delay. Fig. 8. P o ocol e iciency. Fig. 9. E en ansmission delay. o al numbe o bi sen om use laye simula ing ime bi - a e (5) Figs. 4–7 compa e ou esul s o e iciency, measu emen ansmission delay, e en ansmission delay, and command ansmission delay wi h hose ob ained in [19] by means o a simula ed solu ion o a bi - a e o 1200 b/s.2The ESTELLE esul s a e labeled “Es -speed,” being speed he numbe o bi s sends pe second (b/s). The e iciency esul s in a simula ed so- lu ion a e he same as in he ESTELLE solu ion o all bi - a es. Howe e , he e a e di e en esul s o he ansmission delay. The eason o his beha io is ha messages a e gene a ed andomly so ha ansmission delay can luc ua e be ween an e o gap. Fo ins ance, le us ake he ansmission delay o he command message o 4 RTUs. The e is a di e ence o 0,2 s be ween ou esul and a simula ed one because he ansmission delay o he command message always luc ua es be ween 0,4 s and 0,8 s. This depends on whe he he command message is sen as soon as i is gene a ed o a e he a i al o he answe o he p e ious que ying message. Finally, he h oughpu and e en ansmission delays calcu- la ed by he ESTELLE solu ion a e compa ed o bo h he ana- ly ical solu ion (exac and app oxima e) and he simula ed solu- ion, as shown in Figs. 8 and 9. VI. CONCLUSIONS The op imiza ion o elecon ol p o ocols can educe he ins alla ion cos s o elecon ol sys ems in powe u ili ies. FDTs a e used o speci y p o ocols, o which ESTELLE is mo e sui able han o he me hods in he elec ical sec o . P imi i es added o ESTELLE make i possible o measu e he pe o mance o such p o ocols; he e o e, elecon ol p o ocols can be imp o ed. These imp o emen s could simply consis o se ing up some new pa ame e s o an exis ing elecon ol p o ocol o eplacing hem wi h be e ones ( o ins ance, s anda dized ones). In his pape , his al e na i e me hod o s udying he pe o - mance o a elecon ol p o ocol has been p esen ed. Fu he - mo e, in o de o alida e i , we ha e s udied success ully he same elecon ol p o ocol analyzed in [20] and [21], whe e he pe o mance was calcula ed by bo h an analy ical and a simu- la ed solu ion. REFERENCES [1] D. R. Amb ose, “In e -u ili y communica ions wi hin WSCC,” IEEE T ans. Powe Sys ., ol. 6, No . 1991. [2] A. Ba negea, D. Fe a i, B. A. Mah, M. Mo an, and D. C. Ve naand Hui Zhang, “The Tene eal- ime p o ocol sui e: Design, implemen a- ion,and expe iences,”IEEE/ACM T ans.Ne wo king, ol.4,Feb.1996. [3] J. P. Be na d and D. Du oche , “An expe sys em o aul diagnosis in eg a ed in exis ing SCADA sys ems,” IEEE T ans. Powe Sys ., ol. 9, Feb. 1993. [4] Con e ido Uni e sal de P o ocolos de Telecon ol: Dep . Tecnologia Elec ónica, 1992, ol. 132.181. [5] T. E. Dy-Liacco, “Mode n con ol cen e s and compu e ne wo king,” IEEE Compu . Appl. Powe , Oc obe 1994. [6] G. E icson and A. Johnsson, “Examina ion o ELCOM-90, TASE.1, andICCP/TASE.2 o in e -con olcen e communica ion,”IEEET ans. Powe Deli e y, ol. 12, Ap . 1997. [7] G. Glijnis, “Eu opean u ili ies open lines o communica ions,” IEEE Compu . Appl. Powe , ol. 9, Oc . 1996. [8] Y. H. Kim, N. Fukushima,and T. E. Dy Liacco, “KEPCO’s na ionalcon- ol cen e wi h an ad anced ene gy managemen sys em,” IEEE T ans. Powe Sys ., ol. 5, No . 1990. 2Resul s om 300 and 600 simula ions a e no shown in he igu e o cla i y. [9] H.Lee Smi h,“Subs a ionau oma ionp oblemsand possibili ies,”IEEE Compu . Appl. Powe , Oc . 1996. [10] J. I. Escude o, J. Luque, and F. Gonzalo, “Quali y o se ice in he NOMOS TMN sys em,” in P oc. In . Con . Powe Sec o Telecommu- nica ion Sys em o 21s Cen u y, Nue a Delhi, India, Jan. 1997. [11] J. I. Escude o, F. Gonzalo, and J. Luque, “The challenge o managing new communica ions echnologies,” in P oc. SC35 CIGRE Colloquium, Beijing, China, Sep . 1997. [12] C. León, J. B. Casado, J. Luque,and F. Gonzalo, “SER: Expe sys emin he aul managemen o a adio-delay ne wo k,” IEEE S ockholm Powe Tech., June 1995. [13] Es elle—A Fo mal Desc ip ion Technique Based on an Ex ended S a e T ansi ion Model, ISO S anda d OSI 9074, 1989. [14] Speci ica ion and Desc ip ion Language (SDL), S anda d Z.100 CCITT, 1992. [15] LOTOS—A Fo mal Desc ip ion Technique Based on he Tempo al O - de ing o Obse a ional Beha io , ISO S anda d OSI 8807, 1989. [16] J. Luque, F. Gonzalo, F. Pé ez, and M. Mejías, “Fo mal echniques im- p o e connec i i y in supe iso y sys ems,” IEEE Compu .Appl. Powe , Ap . 1994. [17] A. V. Medina, I. Gómez, F. Pé ez, J.Luque, and S. Ma in, “Code gene - a o o in eg a e elecon ol p o ocols,” in P oc. MELECOM, Tel-A i , Is ael, 1998. [18] V. Medina, I. Gómez, S. Ma ín, and J. Luque, “Applying es elle o au o- ma ically de e mine he pe o mance o elecon ol p o ocols in SCADA sys ems,” in P oc. CIGRÉ, C aco ia, Polonia, 1999. [19] V. Medina, I. Gómez, G. Sánchez, A. Ba bancho, and S. Ma in, “Using p o ocol enginee ing echniques o imp o e elecon ol p o ocol pe o - mance,” in P oc. Powe and Ene gy Sys em, IASTED Con ., Ma bella, Málaga, Spain, Sep . 2000. [20] J. Luque, I. Gómez, and J. I. Escude o, “De e mining he channel ca- paci y in SCADA sys ems using polling p o ocols,” IEEE T ans. Powe Sys ., ol. 11, May 1996. [21] J. Luque and I. Gómez, “The ole o medium access con ol p o ocols in SCADA sys ems,” IEEE T ans. Powe Deli e y, ol. 11, July 1996. [22] A. M. Law and W. D. Kel on, Simula ion Modeling and Analysis.New Yo k: McG aw-Hill, 1991. [23] In o ma ion P ocessing Sys ems—Open Sys ems In e connec- ion—Basic Re e ence Model, ISO S anda d 7498, 1984. [24] I.Gómez, J.Luque,and J. IEscude o,“Medium accesscon ol p o ocols o elec ical powe ne wo k con ol,” in P oc. Bilken In . Con . Ligh - wa e Technology and Communica ions, Anka a, Tu key, July 1992, pp. 23–29.