Communication Analysis Process The analyses of role-based failure modes in this profile are based on potential deviations from the expected behavior of individual substation automation roles. The expected behavior of each role is characterized and formally specified by the role’s state machine diagram. However, since the role-based failure analyses consider only the behavior of the individual roles in isolation, then even in aggregate they paint only a partial picture of the ways in which anomalous behavior of the SA system as a whole can arise. Therefore role-based failure analyses alone are not sufficient. To garner a more complete picture of the failure modes to which an SA system can be subject, complementary failure analyses are needed based on both the communications between roles and on the five zones specified in the SA architecture diagram. This section considers failure analyses based on communication between roles. A zone-based failure analysis is considered in the next section. A attempts to capture the anomalous behavior (in terms of failure communication failure analysis modes) that can be associated with communications between roles. To determine the failure modes associated with communications between roles, this profile begins by considering the most basic act of communication: sends message to role A M B.” “Role Below are listed four essential communication objectives for the action sends message A “Role to role Underneath two of the objectives are specific corollaries that are implied by the M B.” objectives. should not originate from any role M should arrive at in a timely other than M B A fashion should arrive M should arrive at unaltered M B should not be delivered to any role M other than B should arrive at M B unobserved Figure Communication Objectives –
Communication Analysis Process The analyses of role-based failure modes in this profile are based on potential deviations from the expected behavior of individual substation automation roles. The expected behavior of each role is characterized and formally specified by the role’s state machine diagram. However, since the role-based failure analyses consider only the behavior of the individual roles in isolation, then even in aggregate they paint only a partial picture of the ways in which anomalous behavior of the SA system as a whole can arise. Therefore role-based failure analyses alone are not sufficient. To garner a more complete picture of the failure modes to which an SA system can be subject, complementary failure analyses are needed based on both the communications between roles and on the five zones specified in the SA architecture diagram. This section considers failure analyses based on communication between roles. A zone-based failure analysis is considered in the next section. A communication failure analysis attempts to capture the anomalous behavior (in terms of failure modes) that can be associated with communications between roles. To determine the failure modes associated with communications between roles, this profile begins by considering the most basic act of communication: “Role A sends message M to role B.” Below are listed four essential communication objectives for the action “Role A sends message M to role B.” Underneath two of the objectives are specific corollaries that are implied by the objectives. M should arrive at B in a timely fashion M should arrive M should arrive at B unaltered M should not be delivered to any role other than B M should arrive at B unobserved M should not originate from any role other than A Figure – Communication Objectives
SA%20Security%20Profile%20-%20v0_15%20-%2020120930.docx