PaperlayerView exact revision on arXiv

Source-linked AI summary

Safety-Aware Zero Trust Enforcement for IoT and Cyber-Physical Systems

Alessandro Lotto, Alessandro Brighente, Mauro Conti

arXiv:2609.28170v1cs.CR

TL;DR

In IoT/CPS, restricting a suspicious component can reduce cyber exposure while impairing observation or control, and prior work gives less attention to physical consequences introduced by enforcement. The paper maps convergence strains and develops SA-ZT, which selects admissible responses while separating authority, telemetry visibility, and automated influence. Its evaluations expose containment-information and timing trade-offs, while the authors limit claims to an illustrative case and call for broader validation.

  • Problem

    In CPSs, restricting a suspicious component can reduce cyber exposure while removing telemetry or control capabilities needed for operation, a consequence less addressed than harm caused by attacks.

    Source: §I · p. 1, B. CPS-Specific Strains · p. 5

  • Method

    The paper maps ZT tenets to IoT/CPS convergence strains and extends NIST ZTA with a Safety Engine for consequence-aware response selection and a Telemetry Broker for visibility and influence control.

    Source: §IV · p. 3, B. CPS-Specific Strains · p. 5, B. Decision Context and… · p. 7

  • Results

    The evaluation makes containment-information trade-offs explicit: graduated telemetry retains more raw visibility than Binary Isolation, while Binary Isolation has slightly stronger containment and estimation-quality results.

    Source: A. Discussion of Experimental Results · p. 13

  • Takeaways & Limitations

    The evaluation shows that authorization, telemetry visibility and influence, command authority, and timing can be represented as distinct policy dimensions when enforcement affects observation and control.

    Source: A. Discussion of Experimental Results · p. 13

    Validation remains illustrative; future work should vary grids, operating regimes, attacks, uncertainty, physical fidelity, and application domains, while the case-study decomposition does not claim joint or global optimality.

    Source: D. Limitations and Future Work · p. 15

Abstract

from arXiv · show

Zero Trust (ZT) replaces the implicit trust of perimeter-based security with explicit, continuous, context-aware authorization. This shift is particularly relevant to IoT and cyber-physical systems, whose heterogeneous, long-lived, and remotely connected components make persistent trust untenable. Yet their physical coupling complicates ZT adoption: restricting a suspicious component can reduce cyber exposure while removing telemetry or control capabilities required for operation. Existing work mainly models physical harm caused by attacks, with less attention to consequences introduced by enforcement itself. We introduce Safety-Aware Zero Trust (SA-ZT), which treats restriction-induced physical consequences as policy inputs. We map the NIST ZT tenets to nine IoT/CPS convergence strains, distinguish IoT-amplified challenges from those specific to cyber-physical coupling, and derive corresponding operational requirements. SA-ZT extends the NIST ZT Architecture with a Safety Engine and a Telemetry Broker. The Safety Engine selects among admissible responses by jointly considering residual cyber risk and restriction-induced consequences, while the Telemetry Broker mediates raw telemetry visibility and estimator influence. With command-side enforcement, these entities separate raw visibility, automated influence, and state-changing authority, preserving observations for monitoring while constraining their influence on automated control. An IEEE 30-bus case study under false-data-injection attack illustrates how SA-ZT makes cyber containment, telemetry visibility and influence, physical consequences, and authorization timing explicit, providing an implementable and inspectable representation of cyber-physical enforcement trade-offs.

I. INTRODUCTION

ZT’s move to explicit, continuous authorization is difficult to apply in IoT/CPS because restricting a component can reduce cyber exposure while impairing observation or control. The paper maps convergence strains and operational requirements, distinguishing IoT-amplified challenges from those specific to physical coupling.

I. INTRODUCTION

  • In CPSs, restricting suspicious communication can reduce attacker opportunities while removing sensing or actuation needed for legitimate operation.Residual cyber exposure and restriction-induced consequences therefore need to be represented separately.Source: §I · p. 1

III. RELATED WORK

  • Prior work addresses ZT deployment and physical harm from attacks, but offers less guidance on capability-specific restrictions or consequences introduced by enforcement.The paper frames both an analytical gap in classifying convergence strains and an operational gap in selecting restrictions.Source: §I · p. 1, §III · p. 3

II. BACKGROUND: ZERO TRUST ARCHITECTURE

  • NIST ZTA centers on explicit, dynamic, resource-level authorization, with the Policy Engine deciding, the Policy Administrator configuring enforcement, and PEPs mediating communication.The Policy Engine and Administrator together form the Policy Decision Point.Source: §II · p. 2

IV. ZT CONVERGENCE STRAINS AND OPERATIONAL REQUIREMENTS IN IOT/CPSS

  • The analysis maps domain properties to nine strains against ZT tenets, then derives operational requirements; it distinguishes IoT-amplified strains from those specific to physical coupling.A strain is IoT-amplified when IoT makes an enterprise-IT difficulty materially harder; it is CPS-specific when physical-process coupling gives it distinctive significance.Source: §IV · p. 3, Table II · p. 4

A. IoT-Amplified Strains

  • Resource asymmetry and autonomous, headless operation strain uniform assurance and user-centered access assumptions, motivating capability-proportionate evidence and machine-centric authority governance.Requirements include matching evidence collection to device capability and binding machine identity to role, location, action, and changing attributes.Source: A. IoT-Amplified Strains · p. 4
  • Long, uneven device lifecycles and mobile, heterogeneous fleets complicate trust renewal and policy coordination, motivating cryptographic agility and bounded, coordinated distributed state.Requirements cover recoverable trust and replaceable keys, alongside bounded cached authority, invalidation, consistency, failover, and reconciliation.Source: A. IoT-Amplified Strains · p. 4
  • Protocol heterogeneity and legacy assets make flow-level enforcement coarse, motivating semantic operation-level controls and mediated enforcement that records evidence blind spots and residual risk.Operation-level controls can distinguish telemetry from command authority; legacy mediation should state its assumptions, bypass resistance, and remaining coarse authority.Source: A. IoT-Amplified Strains · p. 5

B. CPS-Specific Strains

CPS-specific strains arise because authorization deadlines, uncertain physical evidence, and restrictions can change process behavior. SA-ZT responds with admissible graduated enforcement that separates authority, telemetry visibility, and automated influence.

B. CPS-Specific Strains

  • CPS authorization must meet operational deadlines and use physically meaningful, uncertainty-aware evidence; restrictions can themselves disrupt sensing, stabilization, or recovery.The corresponding requirements call for real-time, disruption-tolerant decisions, explicit evidence uncertainty, and consequence-aware graduated enforcement.Source: B. CPS-Specific Strains · p. 5

V. SAFETY-AWARE ZERO TRUST

  • SA-ZT extends NIST ZTA with consequence-aware response selection and capability-level enforcement, addressing which restriction to apply when responses affect the physical process differently.It keeps residual cyber risk and restriction-induced physical consequences distinct while excluding candidates that violate hard admissibility conditions.Source: §V · p. 6

A. Architecture

  • The Safety Engine filters and ranks responses, while the Telemetry Broker controls retained visibility and maximum estimator influence; command-path enforcement separately constrains state-changing authority.Coordinated, versioned rules are distributed to command PEPs, the broker, and relevant local controllers; decisions and fallback behavior are recorded for audit.Source: A. Architecture · p. 6

B. Decision Context and Capability-Level Enforcement

  • Enforcement units can represent independently controlled scopes, and candidate configurations must satisfy hard operational and physical conditions before soft objectives rank them.The interface separates retained authority U(σ), visible telemetry V(σ), and maximum automated influence W(σ); reference modes range from Full to Isolated, without a universal safety ordering.Source: B. Decision Context and… · pp. 6–7

C. Safety-Engine Formulation

The Safety Engine ranks admissible responses by residual cyber risk and consequences introduced by restriction, subject to hard conditions. Its IEEE 30-bus instantiation makes enforcement capabilities and decision timing explicit without claiming universal safety or global optimality.

C. Safety-Engine Formulation

  • The Safety Engine ranks admissible configurations using residual cyber risk, operational degradation, response-induced physical risk, and non-physical switching or recovery cost.The objective responds to the current cyber belief and operating context rather than reassessing endpoint trust.Source: C. Safety-Engine Formulation · p. 7
  • Hard admissibility is separate from ranking, and the framework permits staged or bounded procedures without claiming global optimization.If no configuration is feasible, the engine reports violated conditions and invokes the declared degraded-mode fallback.Source: C. Safety-Engine Formulation · p. 7
  • Eq. (4) retains only incremental harm attributable to enforcement against a fixed reference, while containment benefit remains in residual cyber risk.When no probabilistic predictor is available, a declared conservative bound or other decision-time risk measure may replace expectation.Source: C. Safety-Engine Formulation · p. 7
  • The selection rule does not prove universal safety or control-performance improvement; its claims depend on the validity, uncertainty, horizon, and operating envelope of its models.The IEEE 30-bus instantiation likewise disclaims certified safety and global optimality.Source: C. Safety-Engine Formulation · p. 7, §VI · p. 8

VI. IEEE 30-BUS POWER-GRID SAFETY-ENGINE INSTANTIATION

  • The IEEE 30-bus case study represents capability-specific enforcement, estimator validity, physical admissibility, and authorization timing in an auditable decision process.It is presented as an instantiation, not a new grid controller or evidence of certified safety.Source: §VI · pp. 7–8

A. System Model and Architectural Realization

  • Telemetry modes are selected before the current sample; command modes are chosen only after the estimate is accepted or a declared fallback is selected.The Policy Administrator distributes each decision as a consistent policy version, then the command-side PEP applies it to that epoch’s dispatch request.Source: A. System Model and Architectural… · p. 8
  • Fig. 1 depicts 30 buses and 41 branches, with controlled generator interfaces at buses 1, 2, 5, 8, 11, and 13.Branch-flow and bus-injection measurements reach the control center through the Telemetry Broker, while dispatch setpoints leave through the command-side PEP.Source: Figure 1 · p. 8, A. System Model and Architectural… · p. 8
  • Telemetry enforcement separately controls raw visibility and estimator influence, while command modes govern remote authority and validated output behavior.Observation-only preserves authorized monitoring without automated-control influence; Safe-local rejects the remote request and holds the previous validated output.Source: A. System Model and Architectural… · pp. 8–9

B. Mathematical Formulation

The formulation represents telemetry, estimation, dispatch, and enforcement as decision-time quantities, then screens candidate responses before ranking them. Its consequence terms distinguish attack-related risk from harms introduced by restricting or reconfiguring capabilities.

B. Mathematical Formulation

  • The plant model maps 29 non-reference voltage angles to 41 branch-flow and 14 bus-injection measurements, with separate physical-noise and attack terms.Policy-dependent precision is applied separately from the physical measurement-noise covariance.Source: B. Mathematical Formulation · p. 9
  • Telemetry configurations separately encode raw-stream visibility and retained WLS precision, and estimates become authoritative only after validity gates pass.A failed gate can use the previous valid estimate for one declared stale epoch; a further consecutive failure enters Uncertified-hold.Source: B. Mathematical Formulation · p. 9
  • The dispatch mapping uses an accepted or permitted stale estimate, validated generator outputs, and protected aggregate demand to produce one request reused for prediction and enforcement.The realized load is unavailable to the selector; balancing uses only Full and Guarded generators, with bounded cumulative emergency shedding for remaining deficits.Source: B. Mathematical Formulation · p. 9
  • The bounded selector screens command candidates for dispatch, generation, shedding, balance, branch-ceiling, and declared dynamic constraints before ranking them.It enumerates candidates within Hamming distance two of the preceding six-generator vector, at most 154 vectors; if none is feasible, it holds the previous vector and records No-feasible-candidate.Source: B. Mathematical Formulation · p. 9
  • Telemetry scoring includes retained compromise propagation and FDIA exposure, raw-ingress exposure, and visibility and information-quality costs.The information term is a policy-dependent estimation-quality proxy, not physical sensor-noise covariance or attack bias.Source: B. Mathematical Formulation · pp. 9–10
  • Command scoring combines static physical consequences with paired dynamic response increments; dwell and restoration remain explicit transition rules, not soft penalties.The dynamic term ranks short-horizon recovery stress; its frequency and RoCoF scales are reference values, and no hard RoCoF limit is claimed.Source: B. Mathematical Formulation · p. 10
  • The implementation demonstrates an auditable trade-off representation, not certified safety, universal performance improvement, or global optimality.Dwell and restoration requirements are handled as explicit transition rules.Source: B. Mathematical Formulation · p. 10

VII. EXPERIMENTAL EVALUATION

The evaluation uses staged IEEE 30-bus simulations to examine capability-specific enforcement, restriction-induced consequences, and decision timing. Its comparisons are paired on shared scenario evidence, with realized load and execution jitter withheld until after selection.

A. Setup and Implementation

  • The Python simulation uses the 100-MVA IEEE 30-bus case and constrained linear-program corrective dispatch, with implementation modules separating cyber, telemetry, estimation, selection, enforcement, and plant evaluation.Only a current accepted or permitted one-epoch stale estimate supports a new command, and one dispatch request is reused for prediction, enforcement, counterfactual comparison, and logging.Source: A. Setup and Implementation · p. 10
  • The staged configurations add graduated telemetry enforcement, static command consequences, then dynamic response prediction and mode-dependent authorization delay.Frozen Link and Clean Model validate the reconstructed cyber topology and attack-free physical pipeline; No Enforcement and Binary Isolation provide Graduated Telemetry references.Source: A. Setup and Implementation · p. 11, Table IV · p. 11

B. Evaluation Goals, Methodology, and Metrics

  • The evaluation pairs policies on shared compromise, alert, attack, noise, load, and disturbance realizations to compare containment-information trade-offs and selector effects.The dynamic and timing-aware comparison adds response prediction and slower-delay conditions; the selector does not observe realized jitter or load before selection.Source: B. Evaluation Goals, Methodology, and… · p. 11

C. Model Validation

Model checks validate implementation consistency rather than policy superiority. Experiments expose trade-offs in containment, restriction-induced physical consequences, dynamic selection, and authorization timing.

C. Model Validation

  • Validation checks cover finite constraints, attack-free feasibility, causal and enforcement invariants, and deterministic reconstruction of the 55-node, 83-link graph.These checks establish implementation consistency, not policy superiority.Source: C. Model Validation · pp. 11–12
  • Branch headroom uses attack-free all-Full flow-error 0.99 quantiles with a system-wide floor; the reference loading point targets 0.75 without starting at a violation.Finite limits replace sentinel bounds, and the RATE_A pattern comes from the companion MATPOWER case30 topology.Source: C. Model Validation · p. 12

D. Experimental Results

  • Graduated Telemetry reduced mean compromised-endpoint fraction by 84.2% and impactful FDIA bypass by 91.3% relative to No Enforcement.Binary Isolation provided slightly stronger containment, observability, and estimation-quality results, while Graduated Enforcement retained more raw visibility (0.98568 versus 0.98110).Source: Table VI · p. 13, D. Experimental Results · p. 13
  • Across loads, the selector chose the same vectors as response-blind selection, while restriction caused 15, 18, and 23 infeasible epochs versus none under all-Full.The selected static response term was never positive, so it did not affect selection in this scenario family.Source: Table VII · p. 13, D. Experimental Results · p. 13
  • Although positive in 4,449 of 8,000 epochs, the dynamic term changed 92 (1.15%) command vectors; those decisions lowered stress in 40, raised it in 49, and tied in three.Aggregate frequency-deviation and RoCoF metrics remained nearly unchanged, and paired intervals for small static-infeasibility and mean-static-cost reductions included zero.Source: D. Experimental Results · p. 13
  • Increasing Full/Guarded delays from 0.10/0.20 s to 0.40/0.60 s raised mean maximum frequency deviation from 0.02789 to 0.04216 Hz and mean settling time from 0.07740 to 0.23023 s.Mean maximum RoCoF remained essentially unchanged; the timing-aware selector changed 79 of 8,000 command vectors under slower delays, with no declared hard dynamic events or systematic improvement.Source: D. Experimental Results · p. 13

VIII. DISCUSSION

The discussion finds that SA-ZT exposes trade-offs among containment, information, physical consequences, and authorization timing rather than guaranteeing uniformly better outcomes. It then answers the research questions, derives design principles, and identifies limits to the case study and framework.

A. Discussion of Experimental Results

  • Graduated Telemetry reduces compromise propagation and impactful FDIA bypass while retaining more raw visibility than Binary Isolation, which has slightly stronger containment and estimation-quality results.The contribution is an explicit containment-information trade-off: visibility for observation does not establish trustworthiness or authorize estimator use.Source: A. Discussion of Experimental Results · p. 13
  • Withdrawing remote command authority can alter physical outcomes, and a restriction-induced consequence need not change the selected command vector.The prospective static term was never positive for selected candidates; its removal changed no selected vector.Source: A. Discussion of Experimental Results · pp. 13–14
  • Dynamic information affects only a small subset of tested decisions with mixed realized effects, while delayed command realization worsens frequency excursion and settling time.Maximum RoCoF remains nearly unchanged; candidate-versus-reference terms may also miss timing degradation shared by both trajectories.Source: A. Discussion of Experimental Results · p. 14

B. Answers to the Research Questions

  • The analysis distinguishes six IoT-amplified strains from three CPS-specific strains, derives cumulative requirements, and represents authority, telemetry visibility, estimator influence, and peer communication separately.The IEEE 30-bus case demonstrates an implementable, auditable decision structure within its declared model, not universal policy improvement.Source: B. Answers to the Research Questions · pp. 14–15

C. Implications for Cyber-Physical ZT

  • The design principles call for separate capability semantics and logged risk quantities, hard admissibility before preference ranking, and declared timing, fallback, and recovery behavior.Response terms should be checked for consequence activation, candidate discrimination, and realized selection effect.Source: C. Implications for Cyber-Physical ZT · p. 15

D. Limitations and Future Work

  • Evidence is limited to one transmission benchmark, fixed scenario banks, and a declared attack family; broader model, domain, guarantee, and deployment validation remains future work.The case-study selection uses causal decomposition and bounded search, not joint or global optimization.Source: D. Limitations and Future Work · p. 15

IX. CONCLUSION

  • The conclusion presents the IEEE 30-bus instantiation as a demonstration of the decision contract and calls for validation with higher-fidelity models and other cyber-physical domains.The evaluation reports a containment-information trade-off, physical consequences from command restriction, and observable effects of authorization timing.Source: §IX · p. 16

APPENDIX A DETAILED IEEE 30-BUS FORMULATION AND

The appendix documents the staged IEEE 30-bus implementation and its modeling distinctions. It details construction checks, telemetry and attack handling, and how policy modes affect observation and estimator admission.

APPENDIX A DETAILED IEEE 30-BUS FORMULATION AND

  • The case study implements a staged algorithm rather than an idealized joint optimizer, separating sensor noise from policy precision and accepted estimates from provisional ones.It also distinguishes controller requests from applied commands and operating stress from hard infeasibility.Source: Appendix A · p. 17

A. DC Plant and Measurement-Matrix Derivation

  • The DC formulation fixes branch orientations and bus 1 as the reference, mapping the reduced state to complete bus angles.The appendix defines branch reactance and normalized transformer tap conventions, applying unity when an encoded zero tap is present.Source: A. DC Plant and Measurement-Matrix… · p. 17
  • The formulation distinguishes finite operating stress from infeasibility at a synthetic benchmark ceiling; the 1.15 factor is not a utility protection rating.Normal operating-envelope ratings, dispatch headroom, and the controller planning envelope have separate roles.Source: A. DC Plant and Measurement-Matrix… · p. 17
  • Branch-flow and selected-bus injection measurements form separate blocks, with a fixed permutation aligning stored measurements to logical endpoint order.The injection selector identifies buses where injection measurements are available.Source: A. DC Plant and Measurement-Matrix… · p. 17
  • Construction checks align the network matrices and measurement rows; nonzero transformer phase shifts are rejected because they require affine offsets.The checks include base MVA, bus reference, branch endpoints and ordering, tap ratios, and flow and injection row alignment.Source: A. DC Plant and Measurement-Matrix… · p. 17

B. Attack Realizability and Compromise Belief

  • The hidden compromise process generates state-consistent attacks and sensor noise, but hidden simulation truth is used for outcomes rather than passed to the selector.The attacked sample is modeled before estimator admission; telemetry modes are selected before acquisition.Source: B. Attack Realizability and Compromise… · pp. 17–18
  • Telemetry modes determine peer propagation, raw delivery, and estimator admission or precision; an excluded attacked row may remain visible to an authorized observer.The belief-side compromise prediction uses the policy-mediated peer-authority matrix.Source: B. Attack Realizability and Compromise… · pp. 17–18

C. Policy-Mediated State Estimation

This section separates raw telemetry visibility, estimator weighting, and physical sensor noise in policy-mediated state estimation. It describes quality and bad-data checks and the fallback behavior after estimator failures.

C. Policy-Mediated State Estimation

  • Telemetry configurations encode raw visibility separately from relative estimator precision, which changes WLS weighting rather than physical sensor noise.Guarded mode reduces relative precision but does not guarantee a fixed bound on attack-induced state displacement.Source: C. Policy-Mediated State Estimation · p. 18
  • The inverse weighted information is a policy quality proxy, not generally the actual estimation-error covariance or complete physical uncertainty.Attack bias must be treated separately from the physical-noise covariance.Source: C. Policy-Mediated State Estimation · p. 18
  • Normal acceptance requires the stated residual threshold and at least one valid degree-of-freedom condition; the FDI proxy uses detection probability for the attack-induced mean residual.The proxy does not reuse policy precision as physical noise.Source: C. Policy-Mediated State Estimation · p. 18
  • A numerical estimate becomes authoritative only after all four gates pass; successive failures move operation from the last valid estimate to an estimator-independent hold.On the first consecutive failure, command selection may use the preceding valid estimate; further failure enters Uncertified-hold and stops estimator-dependent command-mode search.Source: C. Policy-Mediated State Estimation · p. 18

D. Command-Mode Realization

The command realization procedure translates selected modes into applied dispatch while preserving authority boundaries. Deployability and hard-admissibility checks constrain candidate searches and specify a fallback when none passes.

D. Command-Mode Realization

  • Safe-local is a local hold or protection fallback, whereas Isolated also removes the ordinary remote interface; neither implies a distinct hidden balancing law.Their network, transition, and timing semantics differ despite an identical quasi-static setpoint in the last two cases.Source: D. Command-Mode Realization · p. 18
  • Central balance correction allocates eligible generation and bounded emergency shedding for deficits, and reduces generation before cancelling scheduled shedding for surpluses.Unresolved deficits or surpluses are reported, and the procedure preserves the authority boundary after local mode enforcement.Source: D. Command-Mode Realization · p. 19

E. Deployability and Hard Admissibility

  • Telemetry candidates must satisfy deployability and hard gates, while command candidates are searched within the admissible neighborhood through Hamming distance two after dwell and transition rules.Actual bad-data-test acceptance is checked after the selected sample is acquired.Source: E. Deployability and Hard Admissibility · p. 19
  • Command candidates must pass balance and flow hard screens; normal-rating exceedances and reference-scale stress remain finite diagnostics rather than infeasibility conditions.If no candidate passes, the search returns reason codes and holds the preceding mode vector as a declared fallback, not as an admissible candidate.Source: E. Deployability and Hard Admissibility · p. 19

F. Objective-Term Construction and Normalization

The staged objectives combine propagation, residual cyber risk, operational consequences, and switching cost without treating them as one global optimization. Telemetry and command candidates are screened and scored using distinct operational components.

F. Objective-Term Construction and Normalization

  • The staged objectives instantiate four conceptual terms without claiming to solve one global joint problem.The operational components distinguish telemetry configuration scoring from feasible local command-candidate scoring.Source: F. Objective-Term Construction and… · pp. 19–20
  • Attack-bypass risk estimates the probability that admitted attack rows evade the residual threshold, excluding candidates that fail estimator-validity gates.The bypass probability uses a noncentral chi-square cumulative distribution function.Source: F. Objective-Term Construction and… · p. 19
  • Telemetry scoring distinguishes raw-ingress risk, operational cost, and information quality rather than treating visibility and observability as interchangeable.Raw visibility, structural observability, and the information-quality proxy are related but distinct.Source: F. Objective-Term Construction and… · p. 19
  • Command candidates are scored after transition and dwell constraints, using retained central authority as command risk and normalized ordinal mode distance for switching costs.The command-stage score retains a term constant across command candidates to keep the staged decomposition explicit.Source: F. Objective-Term Construction and… · p. 20
  • Static response risk combines a hard indicator for static-condition violations with nonnegative excess consequence, while preserving physical improvements in the separately reported trajectory.Dynamic and Timing-Aware adds dynamic response risk to static response risk.Source: F. Objective-Term Construction and… · p. 20

G. Independent Short-Horizon Dynamic Prediction

Dynamic and Timing-Aware adds a short-horizon aggregate frequency and active-power model to quasi-static evaluation. It compares candidate responses with a shared reference across independent decision epochs, while accounting for authorization timing and stated limits on the model's safety claims.

G. Independent Short-Horizon Dynamic Prediction

  • The dynamic layer is an aggregate active-power/frequency model, not a multi-machine, voltage, or transient line-flow model.It tracks center-of-inertia frequency deviation, aggregate mechanical power, and served electrical demand.Source: G. Independent Short-Horizon Dynamic… · p. 20
  • Each five-second timing-sensitivity epoch is independent, with candidate, all-Full reference, and realized branches sharing initialization and terminal state not carried forward.The internal integration grid includes each finite command-activation time.Source: G. Independent Short-Horizon Dynamic… · p. 20
  • The selector plans over three jitter nodes without observing future execution jitter, which is sampled only after selection.Candidate and reference use the same jitter node during evaluation.Source: G. Independent Short-Horizon Dynamic… · p. 20
  • Dynamic response risk compares candidate and reference outcomes using expected nodewise positive increments in dynamic decision severity.Severity combines predictive stress with a hard cost for declared hard-condition crossings.Source: G. Independent Short-Horizon Dynamic… · p. 20
  • The 0.5-Hz and 0.5-Hz/s scales are for reporting and normalization, not certified limits; the model establishes neither recursive dynamic safety nor multi-machine stability.No hard RoCoF predicate is declared, and under-frequency load shedding is disabled in the primary campaign.Source: G. Independent Short-Horizon Dynamic… · pp. 20–21

APPENDIX B CORRECTIVE DISPATCH AND ATTACK-INDEPENDENT

The appendix specifies a corrective-dispatch mapping and its attack-independent calibration and operating assumptions. Forecast demand is separated from realized load, and the resulting dispatch uses constrained controller inputs and declared benchmark envelopes.

APPENDIX B CORRECTIVE DISPATCH AND ATTACK-INDEPENDENT

  • Because the source case lacks finite generator ramp data, flexibility is declared as a decision-epoch envelope rather than a generator-specific ramp rate.The scaled branch envelopes are benchmark MW flow envelopes within the DC active-power model, not validated AC thermal ratings.Source: Appendix B · p. 21
  • An attack may alter the inferred spatial load distribution and resulting redispatch, but cannot create aggregate forecast demand.The realized stochastic load multiplier is applied after the selector's forecast input.Source: Appendix B · p. 21
  • The corrective-dispatch mapping uses decision-time context for operating limits and controller headroom, and failed solves return a diagnostic hold request rejected during ordinary candidate screening.The same successful dispatch request is used in candidate scoring, enforcement, logging, and the all-Full reference.Source: Appendix B · p. 21
  • Controller headroom is calibrated using attack-free samples, with an independent validation run that does not change the frozen margin.The operating-stress reference is selected from eligible attack-free points, without using attack outcomes or relative policy performance.Source: Appendix B · p. 21

APPENDIX C FROZEN EVALUATION PARAMETERS

Appendix C fixes the scenario bank, policy priorities, and controller and authorization parameters used for comparisons. Appendix D consolidates notation for the domain-independent formulation and IEEE 30-bus instantiation.

APPENDIX C FROZEN EVALUATION PARAMETERS

  • The frozen parameters define an illustrative scenario bank and policy priorities, not fitted estimates of an operational transmission system.Policies share compromise, alert, attack, measurement-noise, load, and disturbance realizations within each comparison.Source: Appendix C · pp. 21–22
  • The telemetry heuristic considers at most ten suspicious or recovering endpoints and accepts at most four improving mode changes per epoch; it is not a global optimizer.Evidence-dependent broker refinement is disabled in the reported campaign.Source: Appendix C · p. 22
  • The dynamic parameterization declares no hard RoCoF limit and disables under-frequency load shedding in the reported primary campaigns.The authorization-delay sensitivity changes Full and Guarded delays while leaving the local-fallback delay and other parameters unchanged.Source: Appendix C · p. 22

APPENDIX D TERMINOLOGY

  • Appendix D consolidates notation used by both the domain-independent SA-ZT formulation and its IEEE 30-bus instantiation.Table X is identified as the core notation reference.Source: Appendix D · p. 22, Table X · p. 23

Related papers

Loading 2609.28170v1…