# Security-Oriented Cyber-Physical Risk Assessment for Cyberattacks on Distribution System
## 4 Security-Oriented Cyber-Physical Risk Assessment for CPPDS
### Analysis and Calculation of Physical Consequence under Cyberattack
#### 4.3.2 Physical Consequence Calculation  
When a physical fault occurs on a feeder section, the circuit breaker triggers the protection action. The distribution terminals collect the fault detection information and send it to the slave distribution station. After summarizing the fault information, each slave distribution station sends it to the main distribution station through the SDH communication network. The main station starts the fault location, fault isolation, and power supply recovery process, and issues the orders to control the opening and closing of switches. By destroying the integrity and availability of information, attackers can achieve the purpose of abnormal operation of switches on a feeder, resulting in a certain range of power outage and serious economic losses. Next, the physical consequence of attacking the circuit breaker (CB) and the section switch (SS) is analyzed. Physical consequences of attacking CB  
According to whether a physical fault has occurred in advance, the physical consequences are divided into the consequence caused by a cyberattack directly and cyber-physical combined fault. Depending on the original state of the feeder CB, it can be divided into the undesired-tripping consequence and the failure-to-operate consequence. (1) Physical consequences of CB undesired tripping  
When the power grid is in normal operation, the CB is cyberattacked by tampering with the information of the CB configuration files, resulting in CB undesired tripping. All consumers on this feeder are out of power with type \(b=1\) of power outage. (2) Physical consequences of CB failure to operate  
When a fault occurs in a feeder section, CB and SS are disconnected for fault isolation. After that, CB is cyberattacked and cannot receive the closing command, which makes CB fail to operate. The consumers from the front of the feeder to the fault point are out of power with type \(b=2\) of power outage. As shown in Figure 5, if the fault point is at the third feeder section, after fault isolation, CB1 fails to close by cyberattack. Thus, the consumers on the first and second feeder sections are out of power with type \(b=2\). Considering all combined faults of feeder sections, then sum the physical consequences. The total physical consequence of both CB undesired tripping and failure to operate is calculated by  
\[C_{breaker,j}=\sum_{j=1}^{N_{f_{i}}}C_{f_{i},j}^{TR}+\sum_{j=2}^{N_{f_{i}}} \left(\lambda_{f_{i},j}\sum_{k=1}^{j-1}C_{f_{i},k}^{TR}\right) \tag{16}\]  
where \(\lambda_{f_{i},j}\) is the failure rate of the \(j\)th feeder section on the \(i\)th feeder and \(N_{f_{i}}\) is the number of feeder sections. The first item is the physical consequence of undesired tripping. When calculating \(C_{f_{i},j}^{TR}\), the parameters in \(T(f,a,b)\) are set as \(f=f_{i}\), \(a=0\), and \(b=1\). The second item is the physical consequence of failure to operate, and the parameters are set as \(f=f_{i}\), \(a=j\), and \(b=2\). (1) Physical consequences of SS undesired tripping  
When the power grid is in normal operation, one SS is cyberattacked, resulting in undesired tripping. All consumers from this SS position to the feeder back end are out of power with type \(b=1\). (2) Physical consequences of SS failure to operate  
When a fault occurs at a feeder section, the SS that should have been disconnected due to fault isolation fails to operate due to cyberattack. The adjacent SS have to be tripped to ensure the fault isolation; meanwhile, the power outage region is expanded. As shown in Figure 5, assume that a physical fault occurs at feeder section 2, and the attack target is SS 2. The DAS correctly diagnoses the fault position and sends action instructions to SS 1 and SS 2. However, due to the cyberattack on SS 2, it fails to operate. At this time, SS 1 and SS 3 will be disconnected so the power outage region are expanded. For attacking SS 2, the case of the physical fault occurring at feeder section 3 should also be analyzed similarly.