Reliability Assessment of Cyber–Physical Distribution Systems Considering Cyber Disturbances

Abstract

With the development of communication technology, traditional distribution networks have gradually developed into cyber–physical systems (CPSs), from which the cyber system provides more protection for the grid and brings new security threat–cyber disturbances. Current research cannot scientifically measure the impact of cyber disturbances on the system and lacks reliability indices for a comprehensive quantitative assessment of CPS reliability from the perspective of cyber–physical fusion. If the impact of information disturbances on system reliability is not assessed accurately, it will not be possible to provide a scientific and reasonable decision basis for system planning and operation. Therefore, a set of reliability assessment methods and indices for distribution network CPSs considering cyber disturbances is proposed. Firstly, a reliability modeling method combining fault tree and Petri net is proposed to model the reliability of a distribution network CPS, which can improve the efficiency and accuracy of the modeling. Secondly, the system state is divided into two categories: normal operation state and cyberattack state. Then, generalized reliability indices considering cyber disturbances for distribution network CPSs are defined. Finally, through the tests on the modified IEEE RBTS BUS2 distribution network CPS, an analysis of the effects of information component failures, cyberattacks, and access network structures on system reliability is conducted in this paper to verify the efficiency of the proposed method and the rationality of the newly defined reliability indices.

1. Introduction

With the wide application of information technology, the traditional distribution network has gradually developed into a highly integrated cyber–physical system (CPS), in which energy support is provided for the cyber system by the physical system, while the cyber system provides 3C (communication, computation, control) technical support for the physical system to achieve collaborative interaction between information flow and energy flow [1,2]. However, compared with the traditional distribution network reliability assessment, the physical system in the distribution network CPS is highly dependent on the cyber system, which makes it face many new challenges in the system reliability assessment [3]. On the one hand, the interaction mechanism of CPS is more ambiguous, which significantly increases the complexity of the distribution network CPS analysis. On the other hand, cyberattacks and information component failures will have a potential negative impact on the reliability of CPS operation in distribution networks, with a strong dependence on the cyber–physical infrastructure. In recent years, malicious cyberattacks have been occurring, affecting the operational status of the system and subsequently the economic and social stability of the city [4]. The failure to make prompt decisions and take reasonable action in response to changes in the system status is the cause of severe losses. Consequently, there is an urgent need to analyze the impact of various types of cyber disturbances, such as external and internal threats, on the reliability of CPSs in distribution networks.

In Table 1, a comparative review of the available research works in the area of the reliability assessment of distribution network CPSs is presented.

In the field of reliability assessment methods, available reliability assessments are divided into three main categories according to the different methods used for cyber systems and physical systems [5]: analytical methods for both cyber systems and physical systems, analytical methods for cyber systems and simulation methods for physical systems, and simulation methods for both cyber systems and physical systems. The simulation method is mainly based on probability and statistics, using computers for simulation [6]. For instance, reference [7] improves the sampling method of the Monte Carlo method. The improved important sampling algorithm realizes the optimization of the state probability distribution for the power system. The non-sequential Monte Carlo method is used in [8] to assess the reliability of the system. However, the computational efficiency problem and sampling difficulty of the simulation method are increasingly highlighted due to the increase in the scale of the system and the diversity of various component states. The main principle of the analysis method is to accurately calculate the reliability indices of the system in accordance with the parameters of each system component by analyzing the logical relationship between each component and the system [9]. Reference [10] uses the analytical method to calculate the availability of protection and monitoring functions and equates them to the corresponding physical components, which contribute to increasing the effectiveness of the CPS reliability assessment.

In the field of reliability modeling, a fault tree analysis represents the logical relationships between systems and components by diagrams [11]. A fault tree analysis has been used in [12,13,14] to assess system reliability. However, certain application bottlenecks of the fault tree analysis method are reflected in the problem of space explosion in calculations with the increasing system scale [15]. Therefore, the method of solving the minimum cut set by using fault trees is only applicable to simple distribution networks, and the calculation is too complicated to be applied to the reliability index calculation of distribution network CPSs. Additionally, Petri net is a graphical and formal modeling tool, with the benefits of expansibility and portability, which has been widely used in the reliability modeling of distributed systems, cyber systems, and discrete systems [16]. Moreover, Petri nets can be easily transformed from fault trees, with a strong logical description capability. Reference [17] establishes a Petri net representation of various complex fault tree relationships and verifies that Petri nets are more efficient than fault trees by using an example of a fault tree with five layers and seven bottom events.

In terms of reliability indices adopted in the reliability assessment, there are currently three main categories: traditional distribution network reliability indices, reliability indices that consider the impact of cyber failures on control, and power supply reliability indices that consider the impact of cyber failures [18]. Traditional distribution network reliability indices mainly quantify the impact of cyber or physical systems on the reliability of the load, including two main aspects: load point reliability indices and reliability indices for systems [19]. With in-depth research on the impact of cyber–physical interactions, it is impossible to comprehensively, quantitatively, and in detail evaluate the operational characteristics of distribution network CPSs and the impact of cyber failures, especially cyber disturbances, on the system state by using the traditional distribution network reliability indices. Hence, the traditional index evaluation scope needs to be extended. Direct load outages, system control failures, and even certain reliability threats will all be brought by a cyber component failure. For example, a set of reliability assessment indices are defined in [20] to quantitatively describe the impact of component failures leading to control function failures on system reliability. Compared with the traditional distribution network reliability indices, these indices take into account the impact of component failures in cyber systems on system control. However, some of the parameters calculated by these indices come from the simulation method sampling; thus, they are only applicable to the simulation method. These indices have some limitations without considering the influence of cyber disturbances on the system reliability. Reference [21] proposes a reliability state model for different types of cyber disturbances and analyzes the impact of different types of cyber disturbances on network availability. In [22], a network reliability model that considers both cyber device failures and cyberattacks is provided, in which the cyber system status is integrated into the malfunction probability modeling of switches for the reliability assessment. Although research on cyber disturbances has steadily advanced, most studies still follow the traditional distribution network reliability assessment methods, which do not account for the impact of cyber disturbances on system reliability in the indices [13,23,24,25].

As seen in the summary of the literature review of the CPS reliability assessment, few studies have defined new indices for a reliability assessment in the area of assessment indices; only a few studies have considered the impact of physical system failures, information component failures, and cyberattacks on system reliability when performing a reliability assessment of the system simultaneously. Consequently, the relevant research still has the following shortcomings: on the one hand, the research on the cyber–physical interaction has been deepened and the consequences generated by cyber failures have been refined, which require the impact of the cyber disturbance on the system state to be reflected in the indices, thus reflecting the impact on the system reliability. On the other hand, reliability indices that can make comprehensive quantitative assessments of CPS reliability are lacking and unable to scientifically measure the impact of cyber disturbances on the system. A breakthrough from the limitations of the traditional distribution network reliability assessment indices is needed from the perspective of cyber–physical integration.

The contributions of this paper are listed as follows:

• Considering the complexity of distribution network CPS in terms of structure and characteristics, a combination of fault tree and Petri net is used to model the reliability of the system, which realizes the unification of the physical system and cyber system in modeling and gives full play to their own and the combined advantages of fault tree and Petri net.
• To take into account the influence of cyber disturbances on system reliability, the system states are divided, and the probability of the system being in each state is calculated based on the probability of successful cyberattacks, thus achieving an accurate calculation of each load point and system reliability indices.
• In response to the lack of reliability indices for the comprehensive quantitative assessment of cyber–physical system reliability in the existing studies, the generalized distribution network CPS reliability assessment indices are defined, which can accurately assess the system reliability under the influence of cyber disturbances.

This paper consists of five sections, and the parts of this paper are organized as follows. A general description of the research object and the methods used in this paper is provided in Section 2, with a brief description and explanation of each method. In Section 3, reliability modeling of the distribution network CPSs is proposed, with simple examples of how the fault tree model and the Petri net model are modeled as well as the advantages of the modeling method. The generalized distribution network CPS reliability assessment indices considering cyber disturbances and a detailed description of the new indices are defined in Section 4, with the process of the reliability assessment of the distribution network CPS described in detail. In Section 5, a modified IEEE RBTS BUS2 system is taken as an example to verify the validity of the proposed modeling method and indices. Section 6 concludes the paper.

Table 1. Comparative literature review of reliability assessment in distribution network CPS.

References	Years	Study Subjects		Modeling Methods			Assessment Methods		Assessment Indices		Influencing Factors
		Physical System	Cyber System	Fault Tree	Petri Net	Others	Analytical Method	Simulation Method	Traditional Indices	New Indices	Physical System Failures	Information Component Failures	Cyber Attacks
[16]	1997	✓			✓		✓		✓		✓
[15]	2012		✓	✓			✓		✓			✓
[10]	2015	✓	✓			✓		✓	✓		✓	✓
[26]	2016	✓	✓			✓		✓	✓		✓	✓
[23]	2016	✓	✓			✓		✓	✓		✓	✓
[9]	2017	✓				✓		✓		✓	✓
[27]	2017	✓	✓			✓		✓	✓		✓	✓
[14]	2017	✓	✓	✓				✓	✓		✓	✓
[25]	2018	✓	✓			✓	✓		✓		✓	✓
[21]	2018	✓	✓			✓		✓	✓		✓	✓	✓
[20]	2019	✓	✓			✓		✓		✓	✓	✓
[7]	2020	✓				✓		✓	✓		✓
[8]	2020	✓	✓			✓		✓	✓		✓	✓
[12]	2021	✓		✓				✓	✓		✓
[13]	2021	✓		✓			✓		✓		✓
[16]	2022	✓			✓		✓		✓		✓
[22]	2022	✓	✓			✓	✓		✓		✓	✓	✓
Proposed method		✓	✓	✓	✓		✓			✓	✓	✓	✓

Table 1. Comparative literature review of reliability assessment in distribution network CPS.

References	Years	Study Subjects		Modeling Methods			Assessment Methods		Assessment Indices		Influencing Factors
		Physical System	Cyber System	Fault Tree	Petri Net	Others	Analytical Method	Simulation Method	Traditional Indices	New Indices	Physical System Failures	Information Component Failures	Cyber Attacks
[16]	1997	✓			✓		✓		✓		✓
[15]	2012		✓	✓			✓		✓			✓
[10]	2015	✓	✓			✓		✓	✓		✓	✓
[26]	2016	✓	✓			✓		✓	✓		✓	✓
[23]	2016	✓	✓			✓		✓	✓		✓	✓
[9]	2017	✓				✓		✓		✓	✓
[27]	2017	✓	✓			✓		✓	✓		✓	✓
[14]	2017	✓	✓	✓				✓	✓		✓	✓
[25]	2018	✓	✓			✓	✓		✓		✓	✓
[21]	2018	✓	✓			✓		✓	✓		✓	✓	✓
[20]	2019	✓	✓			✓		✓		✓	✓	✓
[7]	2020	✓				✓		✓	✓		✓
[8]	2020	✓	✓			✓		✓	✓		✓	✓
[12]	2021	✓		✓				✓	✓		✓
[13]	2021	✓		✓			✓		✓		✓
[16]	2022	✓			✓		✓		✓		✓
[22]	2022	✓	✓			✓	✓		✓		✓	✓	✓
Proposed method		✓	✓	✓	✓		✓			✓	✓	✓	✓

2. Problem Description

2.1. Structure of Distribution Network CPS

In a distribution network CPS, the physical system is composed mainly of traditional components such as overhead lines, isolation switches, and transformers, which provide energy support for the cyber system, while the cyber system mainly includes components such as servers, switches, and intelligent electronic devices (IEDs), which monitor, control, and protect the physical system [28]. The structure of the distribution network CPS is shown in Figure 1.

The physical layer, the communication and coupling layer, and the decision layer all combine to form the distribution network CPS. The physical layer consists of equipment of the traditional power system needed to generate, transmit, and distribute power. However, the introduction of sensors and communication networks further increases the possibility of the reliable and efficient operation of the power system, with the communication and coupling layer making it possible to use real-time data from the physical layer for real-time decision making [29].

This section may be divided into subheadings. It should provide a concise and precise description of the experimental results, their interpretation, as well as the experimental conclusions that can be drawn.

The schematic diagram of the IED model is shown in Figure 2. IED is an interface device that consists of fault detection units, relay protection units, and control units connecting the cyber system and the physical system [30]. Based on the collected data, the master server makes decisions on scheduling, processes various incidents, and sends control signals to the IEDs, which in turn communicate the commands to the primary equipment through various interactions, thus effectively coupling the physical system with the cyber system [31].

2.2. The Proposed Reliability Assessment Method

The distribution network CPS reliability assessment method proposed in this paper is shown in Figure 3. A combination of fault tree and Petri net is used in the modeling; the reliability indices are defined by considering the influence of cyber disturbances on the system state, and the minimum cut set in the analysis method is used in the reliability assessment. The specific details of the proposed methods are described as follows.

2.2.1. Reliability Modeling Methods—Fault Trees and Petri Nets

In distribution network CPS reliability modeling, since the fault tree model presents clear and graphic causality with comprehensive and concise descriptions of the various causes and logical relationships leading to accidents, fault trees can provide a clear and accurate analysis of the causes of load failures in the system. However, for complex systems, additional steps are required to compile the fault tree, which also needs to establish a relatively large-scale fault tree model [32]. Meanwhile, the calculation is more complicated, which brings difficulties to the qualitative and quantitative analyses. Additionally, the fault tree model is a static analysis model, which makes it unable to study the dynamic process of the reliability of the system under investigation. In contrast, one of the main advantages of Petri nets is the capability to deal with concurrent, synchronous, asynchronous, parallel, nondeterministic, and other practical phenomena that are difficult to solve with general methods. Having simple, well-defined syntax and semantics, the Petri net can describe different levels of abstraction of a system [14]. The reachability of Petri nets is utilized to determine whether the system may operate to a given state under a given initial state. However, the analysis method for Petri net modeling is based on abstract formal definitions, with more complex model description methods. Therefore, the combination of the two is associated with providing a new idea and method to solve the reliability problem of the system, and the fault trees can be easily represented by Petri nets. As a result, a combination of a fault tree and Petri net is used to model the system for reliability modeling in this paper.

2.2.2. Reliability Indices—The Generalized Distribution Network CPS Reliability Assessment Indices Considering Cyber Disturbances

Cyberattacks are the primary external security threats in cyber disturbances, which normally exploit the security weaknesses of elements and tamper with the original data by injecting false data [33]. The internal threats are mainly information component failures. Since the failure rate of the information component is the inherent nature of the component that does not change with external factors, $\lambda$ is used to represent the failure rate of the information component, while the success rate of the information component cyberattack is represented by $P_{\mathrm{atk}}$. Since cyberattacks against IEDs have the greatest impact on the system, IED cyberattacks are used as an example for analysis and calculation, and other cyberattacks are calculated as IED cyberattacks. Based on the characteristics and impacts of the two security threats, the system state is divided into a normal operation state and a cyberattack state, while information component failures may occur at any time in both states.

The number of switches, IEDs, and servers in the minimum set cut for a load point failure are defined as $m$, $n$, and $l$, respectively, and the probability that the load point is under a cyberattack can be derived as follows:

$$p_i=1-\left[{\left(1-p_{atk-IED}\right)}^n\right],$$

(1)

where $p_{atk-IED}$ is the successful probability of IED cyberattacks.

The probability of the load point being in normal operation is $1-p_i$. The number of load outages $C_{\mathrm{in}}$, the duration of outages $U_{\mathrm{in}}$, and the amount of lost load $E_{\mathrm{in}}$ caused by information component failures are calculated as follows:

$$C_{\mathrm{in},i}=n\times {\lambda }_{\mathrm{IED}}+m\times {\lambda }_{\mathrm{switch}}+l\times {\lambda }_{\mathrm{server}},$$

(2)

$$U_{\mathrm{in},i}=n\times U_{\mathrm{IED}}+m\times U_{\mathrm{switch}}+l\times U_{\mathrm{server}},$$

(3)

$$E_{\mathrm{in},i}=U_{\mathrm{in},i}\times D_i,$$

(4)

where ${\lambda }_{\mathrm{IED}}$, ${\lambda }_{switch}$, and ${\lambda }_{server}$ denote the component failure rates of IEDs, switches, and servers, respectively; $U_{\mathrm{IED}}$, $U_{switch}$, and $U_{server}$ are the annual failure times of individual IED, switch, and server, respectively; and $D_i$ represents the average load at the load point.

The number of load outages $C_{\mathrm{ia}}$, the duration of outages $U_{\mathrm{ia}}$, and the amount of lost load $E_{\mathrm{ia}}$ caused by cyberattacks are calculated as:

$$C_{\mathrm{ia},i}=\{\begin{array}{c}0,n_1=0\\ 1,n_1\ne 0\end{array},$$

(5)

$$U_{\mathrm{ia},i}=\left[1-{\left(1-P_{\mathrm{atk}}\right)}^{n_1}\right]\times n_1\times U_{\mathrm{IED}}+\left(n-n_1\right)U_{\mathrm{IED}}+m\times U_{\mathrm{switch}}+l\times U_{\mathrm{server}},$$

(6)

$$E_{\mathrm{ia},i}=U_{\mathrm{ia},i}\times D_i,$$

(7)

where $n_1$ represents the number of IEDs subjected to cyberattacks.

2.2.3. Reliability Assessment Method—Solving the Minimum Cut Set Using Petri Nets

The method of minimum cut set analysis essentially finds the minimum cut set for the load points in the network and calculates the reliability indices, which can reflect the least failure composition pattern of the system failure occurrence and is the necessary condition for system failure. The reliability analysis of the system can be easily performed based on the minimum cut set. Due to the reachability and boundedness of Petri nets, various common phenomena in complex systems are well described with abundant analysis methods [14]. Among them, the analysis method based on the correlation matrix is suitable for large-scale Petri net models with high complexity. In this paper, based on the Petri net model, the topological relations embodied in the Petri net model are calculated and transformed into the form of a correlation matrix, from which the minimum cut set is solved, and finally the top event occurrence probability is calculated according to the failure rate of each component in the minimum cut set; thus, the system reliability indices are solved.

• Find the correlation matrix by Petri net:

The structure of Petri nets can be represented by a matrix, which allows the introduction of a linear algebra approach to the analysis of Petri net properties.

Let $\sum =\left(\mathit{P},\mathit{T};\mathit{F},\mathit{M}\right)$ be a Petri net, where $\mathit{P}=\left\{p_1,p_2,\cdots ,p_m\right\}$, $\mathit{T}=\left\{t_1,t_2,\cdots ,t_n\right\}$. $\mathit{P}$ is the set of places, representing the state of the system; $\mathit{T}$ is the set of transitions, representing the consumption, use of resources, and the changes that make the state of the system; $\mathit{F}$ is the set of input and output functions, called flow relations, establishing a unidirectional connection from places to transitions and from transitions to places; and $\mathit{M}$ is the identity vector on the set of places. Then, the structure of the Petri net $\sum$ can be represented by an n-row and m-column matrix $\mathit{A}$:

$$\mathit{A}={[{\mathrm{a}}_{ij}]}_{n\times m},$$

(8)

$${\mathrm{a}}_{ij}={\mathrm{a}}_{ij}{}^{+}-{\mathrm{a}}_{ij}{}^{-},$$

(9)

$$a_{ij}{}^{+}=\{\begin{array}{c}1,\left(t_i,p_j\right)\in \mathit{F}\\ 0,\mathrm{else}\end{array}i\in \{1,2,\dots ,n\},j\in \{1,2,\dots ,m\},$$

(10)

$$a_{ij}{}^{-}=\{\begin{array}{c}1,\left(p_j,t_i\right)\in \mathit{F}\\ 0,\mathrm{else}\end{array}i\in \{1,2,\dots ,n\},j\in \{1,2,\dots ,m\},$$

(11)

and $\mathit{A}$ is called the association matrix of $\sum$.

• Find the minimum cut set from the correlation matrix:

Solving the system minimum cut set from the correlation matrix, the steps refer to [34].

• Find the top event probability from the minimum cut set:

The probability of occurrence of the top event is determined using the probability of occurrence of the minimum cut set $K_h\left(h=1,2,\cdots ,n\right)$. The mathematical expression is as follows:

$$\begin{array}{ll}P\left(T\right)& =P\left(K_1\cup K_2\cup \cdots \cup K_n\right)\\ & ={\displaystyle \sum _{h=1}^{n}P\left(K_h\right)-}{\displaystyle \sum _{h<j=2}^{n}P\left(K_h,K_j\right)}+{\displaystyle \sum _{h<j<i=3}^{n}P\left(K_h,K_j,K_i\right)+}\cdots +{\left(-1\right)}^{n-1}P\left(K_1,K_2,\cdots ,K_n\right)\end{array},$$

(12)

where $P\left(T\right)$ is the probability of the top event $T$, $P\left(K_h\right)$ is the probability of the h-th cut set, and $n$ is the maximum of the number of minimum cut sets.

3. Distribution Network CPS Reliability Modeling

3.1. Fault Tree Analysis Model

Fault trees are logic diagrams that describe event causality by event symbols, transfer symbols, and logic gate symbols [34]. The fault tree analysis is an analysis method that analyzes the causes of faults in each component of the distribution network CPS to determine all combinations of the fault causes and the probability of occurrence [35]. The analysis steps of the fault tree are shown in Figure 4.

The procedure of constructing the fault tree in this paper includes the following: first, determining the top event, which is the most undesired situation of the system; then analyzing all possible causes of the top event, analyzing the logical relationship between the causes, and connecting them with logic gates; and then analyzing whether the input events directly connected with the top event can be further decomposed, and if so, treating them as the input events of the next level of events and decomposing them until all the input events are no longer decomposable, and the events that cannot be decomposed are the bottom events.

A typical distribution system is shown in Figure 5. The distribution system is a typical radial distribution system consisting of two feeders, with three main lines L1, L2, and L3, and three branch lines L4, L5, and L6. The main lines are separated from each other by isolation switches, and T is the contact switch.

Taking the top event of Load B failure as an example, the possible causes of the top event include the failure of main line L2, failure of branch line L5, and disconnection of the isolation switch. Since the failure of the main line L1 and main line L3 is the cause of the isolation switch disconnection, and as long as one of all possible causes occurs, Load B is bound to fail. Therefore, without considering the failure of the circuit breaker and contact switch inputs, the fault tree of Load B is shown in Figure 6.

In Figure 6, L2 and L5 represent the failure of the main line L2 and the branch line L5, respectively; L1 and L3 represent the disconnection of the isolation switch due to the main lines L1 and L3, respectively. All the possible causes of Load B failure in the typical radial distribution system of Figure 5 are clearly represented in Figure 6. The analysis of the fault tree allows the Petri net model of the system to be obtained, which in turn enables a series of reliability indices to be solved.

3.2. Petri Net Model

Although the network structure of Petri nets is static, the tokens in them can flow through the network according to defined occurrence rules; thus, Petri nets are dynamically executable. Consequently, it is feasible to model the CPS with event-driven characteristics using Petri nets.

In this paper, a combination of a fault tree and Petri net is used for CPS reliability modeling of distribution networks, and the fault tree model is transformed into a Petri net model, which is based on the Petri net model and defines a quaternion as:

$$\sum =\left(\mathit{P},\mathit{T};\mathit{F},\mathit{M}\right),$$

(13)

where $\mathit{P}$ is the set of places, representing the fault tree in failures of lines, transformers, switching components, servers, switches and IEDs, etc.; $\mathit{T}$ is the set of transitions, representing the fault transformation process in the fault tree; $\mathit{F}$ is the directed arc, which is the set of input and output functions, indicating the transmission direction of the fault; and $\mathit{M}$ is the initial token of the system.

A fault tree is a logical relationship of fault propagation in a system that can be easily transformed into a Petri net representation. The Petri net representation of the logic “with, or, not” when transformed from a fault tree to a Petri net is shown in Figure 7.

According to the transformation rules of the logic, the fault tree model of Load B in Figure 6 is transformed into the Petri net model as shown in Figure 8.

3.3. Advantages of Combining Fault Trees and Petri Nets

The combination of the two modeling methods can make full use of the advantages and make up for the shortcomings of the two modeling methods to improve the efficiency and accuracy of modeling and analysis when dealing with system topology changes. The advantages of combining the two methods are as follows.

3.3.1. Comprehensive and Accurate Models

The combination of the two modeling methods maximizes the advantages of fault tree modeling. With clear and graphic causality, the fault tree can make a comprehensive and concise description of the various causes and logical relationships that lead to failures, which enables both a qualitative analysis and quantitative analysis. By utilizing this fault analysis method, the reliability modeling of distribution network CPSs is capable of providing a comprehensive and accurate description of various causes of failures.

3.3.2. High Efficiency in Solving

When taking an example of a case with five levels and seven bottom events, solving the minimum cut set by a fault tree requires eight steps, while solving it by Petri nets takes only three steps to complete [36]. Thus, by using fault tree modeling to transform into Petri nets and then solving for the minimum cut set, the efficiency of solving the system can be effectively improved. In addition, a distribution network CPS includes a cyber system to monitor and control the physical system, which makes the system structure more complex, and it is very complicated and time-consuming to calculate the minimum cut set of the system by using the fault tree model only. Therefore, the combination of the two methods greatly improves the efficiency and accuracy of solving the system reliability.

3.3.3. Visual Fault Transmission Process

The reachability of Petri nets allows determining whether the system may run to a given state under an initial state. Using this feature of Petri nets, the software PIPE supports the initial identification of any place in the diagram when defining the initial state. When running this Petri net, the transfer process of tokens, that is, the transfer process of the fault, can be clearly seen, and the final reached place, the result of the fault, can be immediately obtained, which provides convenience to the system fault analysis and reliability calculation. The initial identification assigned to Place L2 in the Petri network in Figure 8 is shown in Figure 9, indicating that L2 is faulty at this time, and then the program is run to obtain the operation results shown in Figure 10, showing that Load B is faulty.

3.3.4. Fast Response to System Topology Changes

With only the fault tree analysis method, when the system topology is changed, the entire system needs to be reanalyzed and the fault tree model reconstructed; however, when using a combination of the two methods for modeling, only the correlation matrix of the Petri net needs to be partially modified, so that reliability indices can be calculated for the system after the topology change.

The output and input matrices of the Petri net in Figure 8 are shown in (14) and (15), respectively.

$$a_{ij}^{+}=\left[\begin{array}{ccccc}1& 0& 0& 0& 0\\ 1& 0& 0& 0& 0\\ 1& 0& 0& 0& 0\\ 1& 0& 0& 0& 0\end{array}\right],$$

(14)

$$a_{ij}^{-}=\left[\begin{array}{ccccc}0& 1& 0& 0& 0\\ 0& 0& 1& 0& 0\\ 0& 0& 0& 1& 0\\ 0& 0& 0& 0& 1\end{array}\right],$$

(15)

Using (14) and (15), the correlation matrix corresponding to this Petri net can be derived, as shown in (16).

$$\mathit{A}=\left[\begin{array}{cccc}1& 1& 1& 1\\ -1& 0& 0& 0\\ 0& -1& 0& 0\\ 0& 0& -1& 0\\ 0& 0& 0& -1\end{array}\right],$$

(16)

Taking the distribution system in Figure 5 as an example, due to the disconnection of isolation switch DS2 for reasons such as the failure of L3, the main line L3 and the load carried by it are supplied by Feeder 2. To evaluate the reliability of the system at this time, if only fault tree modeling is used, the system structure needs to be analyzed again and the fault tree model needs to be reconstructed. However, if the combination of fault tree and Petri net is adopted for modeling, only the output and input matrix need to be changed as shown in (17) and (18), and then the minimum cut set can be solved. This method significantly reduces the modeling time and thus improves the modeling efficiency. Especially for the distribution network CPS, the addition of a cyber system leads to a more complex system structure and more frequent interactions among the parts.

$${\mathit{a}}_{ij}^{+}=\left[\begin{array}{cccc}1& 0& 0& 0\\ 1& 0& 0& 0\\ 1& 0& 0& 0\end{array}\right],$$

(17)

$${\mathit{a}}_{ij}^{-}=\left[\begin{array}{cccc}0& 1& 0& 0\\ 0& 0& 1& 0\\ 0& 0& 0& 1\end{array}\right],$$

(18)

The advantages of combining the two methods in modeling are shown above and will be further demonstrated in Section 5.

4. Reliability Assessment of Distribution Network CPS

4.1. Reliability Assessment Indices

To take into account the impact of cyber disturbances on system reliability, generalized distribution network CPS reliability assessment indices considering cyber disturbances are defined in this paper, which account for load shedding caused by information component failures and cyberattacks and characterize the changes in system reliability resulting from control failures caused by physical component failures and cyber disturbances. Based on the annual average outage frequency $\lambda$ (times/a) and annual average outage time $U$ (h/a) at load points, the generalized distribution network CPS reliability assessment indices considering cyber disturbance are defined.

4.1.1. The Generalized System Average Interruption Frequency Index-$G_{SAIFI}$

$G_{\mathrm{SAIFI}}$ reflects the frequency of load shedding due to control failures caused directly by physical component failures or through cyber disturbances. This index is defined as follows:

$$G_{\mathrm{SAIFI}}=\frac{{\displaystyle \sum _{l=1}^n{n}_l}\left[C_{\mathrm{ph},l}+\left(1-p_l\right)C_{\mathrm{in},l}+p_l{C}_{\mathrm{ia},l}\right]}{{\displaystyle \sum _{l=1}^n{n}_l}},$$

(19)

where $n$ represents the number of load points; $n_l$ represents the number of users of the l-th load point; $C_{\mathrm{ph},l}$ denotes the number of load points shed due to the direct failure of physical components; $C_{\mathrm{in},l}$ means the number of load points shed due to control failure caused by the failure of information components; and $C_{\mathrm{ia},l}$ stands for the number of load points shed due to control failure caused by cyberattacks.

4.1.2. The Generalized System Average Interruption Duration Index-$G_{SAIDI}$

$G_{\mathrm{SAIDI}}$ reflects the annual average duration of load shedding due to control failures caused directly by physical component failures or through cyber disturbances. This index is defined as follows:

$$G_{\mathrm{SAIDI}}=\frac{{\displaystyle \sum _{l=1}^n{n}_l}\left[U_{\mathrm{ph},l}+\left(1-p_l\right)U_{\mathrm{in},l}+p_l{U}_{\mathrm{ia},l}\right]}{{\displaystyle \sum _{l=1}^n{n}_l}},$$

(20)

where $U_{\mathrm{ph},l}$ represents the annual outage time at the load point due to the failure of physical components; $U_{\mathrm{in},l}$ denotes the annual outage time at the load point due to control failure caused by the failure of the information components; and $U_{\mathrm{ia},l}$ indicates the annual outage time at the load point due to control failure caused by cyberattacks.

4.1.3. Generalized Expectation of Energy Not Supply-$G_{EENS}$

$G_{\mathrm{EENS}}$ reflects the expected amount of energy not supplied by the system due to control failures caused directly by physical component failures or through cyber disturbances. This index is defined as follows:

$$G_{\mathrm{EENS}}={\displaystyle \sum _{l=1}^n\left[E_{\mathrm{ph},l}+\left(1-p_l\right)E_{\mathrm{in},l}+p_l{E}_{\mathrm{ia},l}\right]},$$

(21)

where $E_{\mathrm{ph},l}$ represents the expected value of the power shortage due to the failure of physical components directly; $E_{\mathrm{in},l}$ means the expected value of the power shortage due to control failure caused by the failure of information components; $E_{\mathrm{ia},l}$ indicates the expected value of the power shortage due to control failure caused by cyberattacks.

4.1.4. The Generalized Average Service Availability Index-$G_{ASAI}$

$G_{\mathrm{ASAI}}$ is the ratio of the number of hours without power supply to the total number of hours of power supply required by customers in the system. This index is defined as follows:

$$G_{\mathrm{ASAI}}=1-\frac{{\displaystyle \sum _{l=1}^n{n}_l\left[U_{\mathrm{ph},l}+\left(1-p_l\right)U_{\mathrm{in},l}+p_l{U}_{\mathrm{ia},l}\right]}}{{\displaystyle \sum _{l=1}^{n}8760·n_l}},$$

(22)

The reliability indices defined in this paper are applicable not only to the case where cyber disturbances affect the system state but also to other disturbances that cause changes in the system state.

4.2. Reliability Assessment Process

The reliability assessment model of the distribution network CPS is constructed by combining a fault tree and Petri net, and the reliability assessment is carried out by finding its corresponding correlation matrix from the Petri net model and then finding the minimum cut set. In the selection of reliability indices, the generalized distribution network CPS reliability assessment indices considering cyber disturbances are defined. The flow chart of the reliability assessment for the distribution network CPS proposed in this paper is presented in Figure 11.

On the basis of the above discussion, the reliability assessment process proposed in this paper is divided into the following four stages:

• Stage I: Establish the reliability model of the distribution network CPS, which can be divided into the following three steps.
  • Step 1: Determine the top event of the failure according to the topology and coupling relationship of the system.
  • Step 2: Analyze the causes of load failures so that a load fault tree model can be built and simplified.
  • Step 3: Perform a qualitative analysis of the fault tree model, and the fault tree model will be transformed into the corresponding Petri net model.
• Stage II: Solve the corresponding correlation matrix in the reliability model, which is divided into the following two steps.
  • Step 1: Solve the input and output matrices of the model according to the structure of Petri nets.
  • Step 2: Solve the correlation matrix based on the input matrix and output matrix.
• Stage III: Solve the minimum cut set from the correlation matrix. This phase is divided into the following three steps.
  • Step 1: Find the top place of the event and the input event.
  • Step 2: Determine whether the event is an intermediate place, if not, it is the bottom library house; otherwise, go back to Step 1.
  • Step 3: Expand all the bottom places to obtain the cut set and simplify it to the minimum cut set.
• Stage IV: Calculate the system reliability indices. This stage can be divided into the following six steps.
  • Step 1: Solve for the probability $P\left(T\right)$ of occurrence of the top event based on the minimum cut set.
  • Step 2: Solve for the probability $p_i$ of a load point in the state of cyberattacks.
  • Step 3: Calculate the failure rate $\lambda$ of each load point.
  • Step 4: Calculate $C_{\mathrm{ph}},C_{\mathrm{in}},C_{\mathrm{ia}},U_{\mathrm{ph}},U_{\mathrm{in}},U_{\mathrm{ia}},E_{\mathrm{ph}},E_{\mathrm{in}},\mathrm{and}{E}_{\mathrm{ia}},$ based on the failure rate $\lambda$ of each load point.
  • Step 5: Calculate the reliability indices of each system.
  • Step 6: Evaluate the system reliability.

5. Case Study

5.1. Introduction of Case

In this paper, the IEEE RBTS BUS2 [37] is modified to construct a distribution network CPS for case studies, and the topology is shown in Figure 12. A star topology is used for the cyber system, with ethernet passive optical network communication for data. Fiber optics, a control center server, several switches, and IEDs for controlling individual switch components are laid along the primary grid of the distribution network, as shown in Figure 13.

The failure rate and repair time of each component in the cyber system are shown in

Table 2. Reliability parameters of information components.

Components	Failure Rate $\mathit{\lambda }$ (Times/Year)	Repair Time $\mathit{\gamma }$ (Hour)
Server	0.01	8
Switch	0.05	12
IED	0.06	12

, and the reliability parameters of the physical system are detailed in

Table A1. Component reliability raw data.

Components	${\mathit{\lambda }}_{\mathit{P}}$ (Times/km·Year)	$\mathit{r}$ (Hour/Times)	${\mathit{r}}_{\mathit{P}}$ (Hour)	$\mathit{s}$ (Hour)
Transformer	0.0150	200	10	1.0
Overhead line	0.0650	5		1.0

${\lambda }_P$ is the permanent failure rate; $r$ is the average fault repair time; $r_P$ is the standby replacement time; and $s$ is the switchover time.

,

Table A2. Feeder type and length for RBTS-BUS2.

Feeder Type	Length (km)	Corresponding Feeder Number
1	0.60	2,6,10,14,17,21,25,28,30,34
2	0.75	1,4,7,9,12,16,19,22,24,27,29,32,35
3	0.80	3,5,8,11,13,15,18,20,23,26,31,33,36

and

Table A3. Load point user type and peak load.

Load Point	Number of Load Points	Average Load (MW)	Number of Users
1,2,3,10,11	5	0.535	210
12,17,18,19	4	0.450	200
8	1	1.00	1
9	1	1.15	1
4,5,13,14,20,21	6	0.566	1
6,7,15,16,22	5	0.454	10
Total	22	12.291	1908

in Appendix A.

The actual distribution network CPS structure is complex, with more uncertainties and more complicated calculations. Therefore, this paper makes some assumptions in the calculation, which narrow the scope of consideration and simplify the calculation process.

(1)

Since this paper focuses on the distribution network CPS, the other two important systems of the power system, namely, the generation system and the transmission system, are considered to be reliable at the time of the study.

(2)

Power limitation is not considered.

(3)

The components are independent.

(4)

Only the steady-state effects of faults are considered.

(5)

The effects of other factors such as weather are not considered, only outages caused by equipment failure.

(6)

The load of the intact section can be fully transferred after a contact switch failure.

(7)

The initial power supply is absolutely reliable.

5.2. Analysis of Results

Taking the LP1 fault as an example, the fault tree in Figure A1 in Appendix A is built. According to the transformation rules between the fault tree and Petri net model, the fault tree model in Figure A1 is transformed into the Petri net model shown in Figure A2.

To assess the impact of cyber systems on the reliability of physical systems, the following two cases can be studied.

• Case 1: The impact of the cyber system is considered.
• Case 2: The cyber system is assumed to be completely reliable.

The reliability indices of the two cases are calculated separately, and the results of Case 2 are compared with the results of [38,39], which are shown in

Table 3. Comparison of reliability indices results.

Indices	Case 1	Case 2	[38]	[39]
GSAIFI	0.5576	0.2482	0.248	0.248
GSAIDI	7.2858	3.6126	3.61	3.56
GEENS	79.3715	37.7457	37.7626	36.956
GASAI	99.9168%	99.9588%	99.9588%	99.9588%

.

As shown in Table 3, when the cyber system is assumed to be completely reliable, the change rates of G_SAIFI, G_SAIDI, G_EENS, and G_ASAI are within acceptable limits. The calculation results are highly consistent, proving that the accuracy of our method can be guaranteed.

As shown in Table 3, the system reliability of Case 1 is significantly lower than that of Case 2, indicating that cyber system failure will lead to a significant reduction in the reliability of the system. The reason is that considering the cyber system influence increases the uncertainty in the system, which is also affected by cyber system failure, leading to a decrease in the system reliability. Therefore, although cyber systems help to improve the efficiency of the fault management process, the reliability impact caused by them should not be ignored, especially in the future when the coupling between cyber and physical systems becomes deeper, which reflects the importance of considering cyber systems for distribution network CPS reliability assessments.

5.2.1. Impact of Information Component Failure Rate on CPS Reliability of Distribution Network

To investigate the influence of various types of information components on system reliability at different failure rates, a single failure of an information component on the reliability of the distribution network CPS is considered in this paper. A certain component is selected as an unreliable component, and the other components are considered to be completely reliable. The failure rate of each type of information component is gradually increased or decreased by a certain percentage, and the failure rate of other equipment is kept constant so that the average value is obtained for the results of multiple calculations. Through the change in the indices, the trend of the system reliability index G_SAIDI can be obtained for each type of information component under different failure rates, as shown in Figure 14.

As shown in Figure 14, the changes in the failure rate of different devices have a variability in the impact on the reliability of the distribution network CPS. The impact of single information component failure on CPS reliability is ranked as follows: IEDs > switches > servers. Among them, the change in server failure has less impact on reliability compared to IEDs as well as switches. The main reason is that at this stage, sufficient protection measures are available for servers, which greatly reduce the failure rate of servers; thus, server interruptions have little impact on the reliability of distribution network CPSs.

5.2.2. Impact of Cyberattacks on System Reliability

In the distribution network CPS, the main potential points of attack are the servers in the control center and the IEDs connected through the switches. The various cyberattacks are shown below.

• The distribution network is operating normally, and the cyber attacker attacks the IED:
  • If the IED fails, the cyberattack will not affect the system’s reliability;
  • If the IED is attacked during normal operation, the consequences are related to the number and location of the attacked IEDs.
• The distribution network is operating normally, and the cyber attacker attacks the master server:
  • If the cyber system fails completely, the master server cannot be attacked;
  • If a part of the cyber system fails, the attacker can use the master to control the IEDs;
  • If the cyber system is normal, the attacked master server may cause the whole system to be paralyzed.

To analyze the impact of different cyberattack objects on the system reliability, the calculation is divided into three cases below, and the results are shown in Figure 15.

• Case 3: The object of the attack is the master server.
• Case 4: The object of the attack is one IED.
• Case 5: The object of the attack is two IEDs.

As shown in Figure 15, the impact of the cyberattack object on the system reliability is from one IED to two IEDs and the master server in order from large to small, indicating that for cyber systems, choosing the method with a higher success rate to carry out cyberattacks will cause greater economic losses to the system.

To study the impact of specific IED attacks on system reliability, based on the situation of the normal operation of the physical system, various scenarios of cyberattacks on one IED and two IEDs are calculated separately. The types of scenes are shown in

Table 4. Scenario division of cyberattack IED.

Attack Type	Scenario
One IED	1 IED1	2 IED4	3 IED5	4 IED8
Two IEDs	1 IED1, IED8	2 IED1, IED2	3 IED1, IED5	4 IED2, IED6
	5 IED5, IED6	6 IED9, IED10	7 IED2, IED9	8 IED3, IED7
	9 IED3, IED11

.

The calculation results of the reliability indices for each scenario are shown in Figure 16, Figure 17, Figure 18 and Figure 19.

From Figure 16 and Figure 17, it can be seen that the reliability indices of the system increase to different degrees when attacking one IED compared with the reliability indices without considering cyberattacks. This indicates that attacking one IED makes the system reliability decrease, and the fewer the number of switches on the bus where the IED control switch is located and the fewer the number of connected IEDs under the normal operation of the physical system, the smaller its impact on the reliability of the system.

From Figure 18 and Figure 19, it can be seen that the reliability indices of the system when attacking two IEDs increase to different degrees compared with the reliability indices without considering cyberattacks. This indicates that attacking two IEDs makes the system reliability decrease, and for cyberattacking two IEDs, the longer the distance between two IEDs in the attacked IED combination, the greater the impact on reliability. Accordingly, it can provide a reference for the investment of defense resources.

5.2.3. Impact of Access Network Structure on CPS Reliability of Distribution Network

In addition, the cyber system network topology is also an important factor affecting the reliability of CPSs in distribution networks. Therefore, the impact of various different access network structures, such as bus-type, star-type, tree-type, and net-type, on the CPS reliability of the distribution network is studied in this paper. The schematic diagram of each access network structure is shown in Figure 20.

The results of the effects of different access network structures on the system reliability indices are shown in Figure 21.

Figure 21 shows that the net-type has the smallest reliability indices and the highest system reliability because more redundant communication lines are available as backups to improve the reliability of the system. Furthermore, the reliability indices of the star-type are slightly higher than those of the net-type, but the variation of the reliability indices is smaller compared with the rest of the structures. Therefore, a suitable access network structure needs to be selected according to the reliability requirements.

In the calculation of reliability indices for different access network structures, the superiority of the combined method of fault tree and Petri net in this paper is also reflected, as only the correlation matrix of Petri net needs to be changed to continue the calculation, which greatly improves the efficiency of the reliability assessment.

6. Conclusions

A reliability assessment model of a distribution network CPS is constructed in this paper by considering the coupling characteristics of the physical system and cyber system of the distribution network using a combination of a fault tree and Petri net. The reliability assessment indices of distribution network CPSs considering cyber disturbances are defined. The effects of different cyber disturbances on system reliability are analyzed to meet the development of new distribution systems with increasing scale and complex structure. The main conclusions are as follows.

(1)

The proposed reliability model for distribution network CPSs and the combination of fault trees and Petri nets greatly improve the modeling efficiency.

(2)

The defined reliability assessment indices for distribution network CPSs considering cyber disturbances are able to characterize changes in system reliability caused by control failures due to failures of physical components and cyber disturbances, enabling a comprehensive quantitative assessment of CPS reliability, with simple modifications to be applied to other kinds of disturbances that affect the system state.

(3)

The impact in the different cyber disturbances on system reliability is analyzed, concluding that the changes in failure rate of different information components have different degrees of impact on system reliability, the number and location of objects of cyberattacks also have a greater impact on system reliability, and a certain impact of access network structure is also caused. With the methods in this paper, system planning, construction, operation, and maintenance protection can be provided for reference.