Substation & BESS Node-Edge Interface Graph for Cyber Digital Twins

J. McKenney

This specification belongs to the Unified Asset Graph working group and to no series of its own. It supplies the substation and battery storage topology that several of its neighbors assume. A synthetic reference battery architecture in the same group gives a named 250 MW site in full, and the energy case paper runs the three-schema join against that site; the three-identity join defines the binding those papers use, and the CIM profile fixes the electrical subset it attaches to.

Licence: CC BY 4.0. 29 August 2026.

Executive Abstract#

Bringing Distributed Energy Resources into legacy substations means unifying plant schematics, power lines, telemetry, and safety envelopes into one computable graph. CAD drawings and spreadsheets cannot show the failure cascades that appear when software automation, battery thermal runaway, and power conversion interact.

The document is a list, not an argument, in two halves. The inventory names equipment in five groups: the substation's high-voltage plant; the battery installation; the auxiliary and emergency supplies that keep protection alive when everything else stops; the automation and control network, with protective relays, merging units, and two separate remote terminal units, one utility-owned and one vendor-owned; and the enterprise and cloud tier.

The wiring list carries the finding. Every connection is a directed edge tagged with its medium, protocol, and payload, so it shows where a connection leaves the site and where none exists.

That absence is the point. The utility and vendor remote terminal units share no routable path; they exchange information only over serial links or a hardware-isolated proxy, so an adversary inside one cannot reach the other. A missing edge is as much a fact as a present one, and that boundary costs an attacker what a firewall rule cannot.

Abstract#

This specification formalizes the Substation and Battery Energy Storage System (BESS) Graph Topology, typing equipment as nodes and flows as directed, attributed edges to join process engineering (DEXPI 2.0 / ISO 15926-4), power systems automation (IEC 61850), market dispatch (IEC 61968-5 CIM), and cyber-physical security zoning (IEC 62443-3-2). It has three parts: node inventory, interface mapping, and graph-database loading rules. The inventory is a bill of materials across five tiers: the primary electrical substation (transformer, circuit breaker, busbar, disconnector, surge arrester, earthing grid); the battery storage architecture from rack strings; the auxiliary and emergency supply; the automation and OT network (IEDs on the process bus, optical merging units digitizing CT and VT signals, separate utility and vendor RTUs, a firewall, a cellular edge gateway); and the central IT, OT, and cloud tier, each node carrying its IEC 62443 zone. Each edge records medium, protocol, and payload, grouped so every boundary crossing is explicit, from the vendor RTU out through a cellular gateway, firewall, and VPN to remote engineering through a jump host. Each node loads with an identifier, zone, criticality rating, and ISO 15926-4 URI; each relationship as a typed directed edge. The finding is a graph property: no routable path connects the utility RTU to the vendor RTU, so the zone boundary appears as an absent edge and lateral movement across it is structural rather than a configuration setting.

1. Node Inventory (Bill of Materials)#

The figure places the three domains the topology distinguishes, physical and power, substation automation, and enterprise and cloud, in relation to one another before the entities in them are listed.

These entities represent the foundational vertices in the Cyber Digital Twin, categorized across physical, electrical, automation, and enterprise governance tiers:

1. Primary Electrical Substation System (Physical & Power Layer)#

• TRF-01: High-voltage power transformer (step-down/step-up, e.g., 132/33kV or 33/11kV).
• CB-01: High-voltage circuit breaker ($\text{SF}_6$ or vacuum interrupter).
• BUS-01: Substation busbar conductor assembly (copper/aluminium).
• DS-01: Motor-operated disconnector and isolator switch.
• LA-01: Metal-oxide surge and lightning arrester.
• GND-01: Substation grounding and earthing grid conductor mesh.

2. Battery Energy Storage System (BESS Architecture)#

• BAT-RACK-01: Lithium-ion battery module strings and rack enclosures.
• PCS-01: Power conversion system and bi-directional inverter (1500V DC to 400V AC).
• BESS-TRF-01: Dedicated BESS step-up transformer (medium-voltage coupling).
• BMS-01: Battery management system (master controller and string/module telemetry).
• HVAC-01: Environmental thermal management unit (chilled water / forced air convection).
• FSS-01: Automated fire suppression system (VESDA early detection, Novec 1230 clean agent, or deluge spray).

3. Substation Auxiliary & Emergency Power#

• AUX-BAT-01: 110V DC station battery bank (valve-regulated lead-acid, VRLA).
• AUX-CHG-01: Redundant uninterruptible DC battery charger system.
• AUX-DC-BUS: Station 110V DC distribution switchboard and protective fusing.

4. Substation Automation & OT Network (IEC 62443 Zones 1 & 2)#

• IED-01: Intelligent electronic device and protective relay (Zone 1 process bus).
• MU-01: Optical merging unit digitizing analogue CT/VT signals per IEC 61850-9-2 [1].
• RTU-EE: Utility remote terminal unit (Zone 2.3 supervisory interface).
• RTU-VEN: Vendor-managed remote terminal unit (BESS subsystem controller).
• SW-01: Ruggedized substation Ethernet switch (Layer 2 VLAN separation).
• FW-01: Substation perimeter stateful firewall and deep packet inspection gateway (Zone 2.4) [4].
• MOD-01: Utility-controlled cellular edge gateway (private APN encrypted tunnel).

5. Central IT/OT & Cloud Integration (Zones 3, 4 & External Interfaces)#

• DERMS-01: Distributed Energy Resource Management System application cluster (Kubernetes on Nutanix).
• UT-SRV-01: Central utility gateway server managing data plane and control plane routing.
• ADMS-01: Advanced Distribution Management System (Zone 3.1.3 supervisory core).
• ICCP-GW: Inter-Control Center Communications Protocol adapter proxy.
• EIP-01: Enterprise integration platform message broker.
• HIST-01: Time-series operational historian database (PostgreSQL / TimescaleDB).
• OT-BUS-01: On-premise industrial enterprise service bus.
• AZ-APIM: Cloud API management gateway.
• AZ-BUS: Cloud enterprise message queue.
• AZ-SQL: Relational cloud registry database.
• PORTAL-INST: Installer and connection compliance web portal.
• API-RET: Market retailer programmatic dispatch interface.
• BH-01: Secure OT bastion host and multi-factor jump gateway (Zone 3.5).
• ANALYTICS-01: Dynamic operating envelope and grid constraint calculator.

2. Interface Connection Mapping (Edges)#

Edges define directed relationships between nodes, carrying physical medium, protocol parameters, and operational payloads:

A. Physical & Environmental Flows#

B. Electrical Power Flows#

C. Substation Automation & Local Control (Zones 1 & 2)#

D. BESS Gateway & Remote Engineering Access#

E. Enterprise Integration & Real-Time Grid Dispatch#

3. Digital Twin Graph Instantiation Guidelines#

To ingest this specification into a property graph database (Neo4j / Azure Digital Twins):

1. Node Properties: Every entity in section 1 is instantiated with:
   • node_id: Unique identifier (e.g., TRF-01, BMS-01).
   • zone_level: IEC 62443 zone assignment (e.g., Zone 1, Zone 2.3, Zone 3.5).
   • criticality_tier: Asset loss criticality rating ($C \in [1, 4]$).
   • dexpi_uri: Standardized ISO 15926-4 reference URI [5].
2. Edge Properties: Relationships in section 2 are instantiated as directed edges:
   • [:CARRIES_FLOW {type: "ELECTRICAL", voltage_v: 1500, medium: "DC_BUS"}]
   • [:CARRIES_CONTROL {protocol: "IEC_61850_GOOSE", latency_ms: 4.0, encrypted: false}]
3. Lateral Movement Restriction (Zone Boundary Defense): Notice that no routable Ethernet path connects RTU-EE and RTU-VEN. They interact strictly via serial connections or hardware-isolated jump proxies. In the Seldon graph simulation engine, this architectural boundary introduces a massive Kramers potential barrier height, preventing an attacker on the vendor subsystem from laterally pivoting into utility substation protection relays.

4. References#

• [1] IEC 61850 (2021): Communication networks and systems for power utility automation. International Electrotechnical Commission.
• [2] IEC 61968-5 (2020): Application integration at electric utilities, System interfaces for distribution management, Part 5: Distributed energy optimization.
• [3] DEXPI e.V. (2025): DEXPI 2.0 Specification: Plant and Process Information Exchange.
• [4] IEC 62443-3-2 (2020): Security for industrial automation and control systems, Security risk assessment for system design.
• [5] ISO/TS 15926-4 (2019): Industrial automation systems and integration, Integration of life-cycle data for process plants including oil and gas production facilities, Part 4: Initial reference data.