The dams sector is responsible for generating about 28.7 percent of the total renewable energy in the United States, 6.2 percent of its total electricity, and 60 percent of the electricity in the Pacific Northwest. There are 2,133 hydroelectric dams in the United States as of November 2023. Because of our nation’s reliance on this sector, it is imperative that attacks, both cyber and physical, are prevented. The dams sector is vital for U.S. economic stability, environmental safety, and public safety. 

Hydroelectric dams are not only critical for the electricity they provide and the flooding they prevent but also relied upon by other critical infrastructures and systems. Dams are relied on for energy maintenance, water supply for wastewater and cooling systems, and navigational locks for boats and the transportation of goods. 

System Components 

PNNL has designed, engineered, and fabricated multiple scale models, known as platforms, that represent different critical infrastructure equipped with industrial control systems and supervisory control and data acquisition systems. 

PNNL’s hydroelectric dam platform contains representative industrial control system equipment commonly found within a typical U.S. hydroelectric dam, such as the following: 

• Scaled models of physical components: turbine, spill gate, navigation lock, forebay, and tailrace. 
• Cyber-dependent control surfaces and programmable logic controllers. 

Each of these components is fully functioning and operates such that upset conditions that occur in real-world scenarios can be modeled. These conditions include upstream flooding and erosion, downstream flooding, reservoir retention and net head height, grid response and black start prevention, dam islanding, generation disruption, frequency matching, device protection failure, and irrigation disruption. 

Impact 

The hydroelectric dam platform provides the Cybersecurity and Infrastructure Security Agency with the ability to conduct red-team/blue-team cyber exercises and training, consequently raising the industry’s awareness of various cyberattacks that could affect hydroelectric dam operations. These exercises allow government and industry analysts to search for artifacts of cyber-attacker tactics and actions within realistic infrastructures to practice implementing their tools, processes, and coordination to document cyberattack timelines and communicate recommended mitigations. 

Other use cases for the hydroelectric dam platform are operational technology capability evaluations, vulnerability mitigation and analytics research, and dataset generation.