# Evaluating Cybersecurity Risks of Bulgaria's Energy Sector: Focus on PV and HVAC-R
## 4 PV Plants with Energy Storage Capability
For comparison, the data from a simulation for the average production of a 10 kWp photovoltaic plant and the average monthly energy price are shown in the same coordinate system. As can be seen from the load profiles, the load variation is very slight. This can be explained by the fact that the largest residential consumer is the HVAC-R system, which operates in heating mode in winter and cooling mode in summer. A simplified structure of an air conditioning installation is shown in Figure 11.  
Attention should be paid to the need for control of PV systems with hybrid inverters. Consumption may not change significantly, but the available PV energy changes considerably throughout the year. The prices of the energy purchased in addition to that generated by the PVs vary not only in magnitude but also in time, with maximum values changing over time. In financial terms, the optimal use of such a system requires frequent changes to the settings. The intervals for prioritized battery charging and the intervals for prioritized battery discharging are set. Such a system cannot be used effectively if it is separated from the global network. Figure 10: Residential load profiles: **(a)** for a day in December, **(b)** for a day in July. Figure 9: Hybrid inverter operating in “no-energy return” mode. As a counterpoint, the HVAC-R system should be mentioned, which is also complex and seemingly requires frequent adjustments. The vast experience with such systems has revealed that in most cases there is no internet connection, or if there is one, it is only used for monitoring, and the options for changing settings or updating software are disabled. This fully satisfies the customers. A survey of the four largest companies that maintain HVAC-R systems in the country found that none of them could point to a single instance of a cyber-attack or a problem related to remote management. The situation with the exploitation of hybrid inverters is quite different. Despite their short history so far, they already have a track record of technical problems that are directly related to security. Hybrid Inverters and Security Concerns  
A study was conducted on the most prominent Bulgarian renewable energy equipment suppliers of inverters--hybrid and grid-connected. The companies studied the total market share of the photovoltaic system market of over 80% (according to self-reported figures and turnover by Commercial Register public records). Below is a list of the brands represented in the product catalogs of these companies:  
* Huawei;
* Deye;
* GoodWe;
* Solis;
* Growatt;
* Sungrow;
* Afore;
* EASun;
* TBB Power. As evident from the above, the Bulgarian market is dominated by Chinese manufacturers, while EU brands like SMA, Victron, and Fronius have a niche presence. The market shares of Huawei and Deye are more than 60%. In [68] similar results are published claiming that in 2023 \"78% of the PV inverters shipped (to EU), originated from China\" and also that there are \"seven manufacturers with the ability to remotely manipulate more than 10 GW of generation capacity\". According to our prognosis those numbers will grow. The EU market as a whole is similar. This is further visualized by data from [68] in Figure 12.  
Figure 11: Simplified structure of an HVAC-R installation. The inverters are directly connected to the global network and use entirely in-house-developed proprietary cloud structures, firmware, and hardware. Inverters are an embedded system; i.e. the firmware is solely under the control of the manufacturer. A potential disconnect from the internet and the respective manufacturer servers would lead to deteriorated financial and operational indicators and is therefore not considered acceptable. This applies to both hybrid inverters and battery management systems (BMSs). If the forecast for intensive growth is justified, PV plants with storage capability will soon occupy a significant share of the electricity mix. Possible consequences of cyber-attacks:  
* Attempts to destabilize the entire energy system with subsequent blackout.