Periodic Reporting for period 2 - eFORT (Establishment of a FramewORk for Transforming current EPES into a more resilient, reliable and secure system all over its value chain)
Reporting period: 2024-03-01 to 2025-08-31
Prompted by the need to comply with environmental and societal concerns, Electrical Power and Energy Systems (EPES) are undergoing urgent modernization to boost reliability and resilience amid rising blackout risks, driven by climate change, and a 380% surge in cyberattacks. Upgrades in digitalization, communications and control, distributed energy resources (DER) integration, and real-time data management aim to cut outage frequency, limit impacts, and speed restoration. eFORT’s goal is to harden European grids against failures, cyber and physical disturbances, and data-privacy threats by developing detection, prevention, and mitigation technologies, a common vulnerability/threat repository, a secure data-sharing framework, and secure-by-design operations. Project solutions will be demonstrated at 4 real-scale sites (i.e. transmission and cascading effects (Netherlands), Distribution (Ukraine), Generation and Islanding modes (Italy) and DER (Spain)) to deliver a holistic security framework that enhances continuity and enables rapid recovery after disturbances. As for the expected impact, the proposed holistic security framework to protect the EPES against man-made hazards and extreme weather events will lead to several contributions in the field of ensuring the continuity and recovery of this critical system.
In the RP2, eFORT advanced significantly on the technical and scientific fronts, progressing from conceptual design to integration and validation across its four demonstration sites.
Key achievements include the creation of the eFORT Vulnerability Database that harmonises classifications and supports real-time analysis through a machine-learning–based Hypothesis Tool, enabling operators to anticipate and evaluate mitigation effectiveness. The database and visualisation dashboard provide one of the most comprehensive sector-specific repositories for cyber-physical threats to energy systems.
In cybersecurity, a multi-layered defence framework has been established through the integration of an Intrusion Detection System (IDS), an enhanced Security Information and Event Management (eSIEM) platform, and the A-Bot intelligent chatbot. The IDS combines machine learning for anomaly detection in substation protocols and has included published studies about the analysis and selection of the most relevant and impactful operational data to feed the algorithms. The eSIEM adds Trust Management and Fast Mitigation modules for rapid response. A-Bot offers operators natural-language, multilingual interaction with alerts and system status, bridging human and machine interfaces. This interface reflects the project’s dedication to integrating relevant, state-of-the-art technologies (LLMs in this example).
Other major technical advancements include the deployment of digital twins for transmission and distribution grids, integrated with reinforcement learning for grid restoration and other models to react to and prevent cascading effects in EPES large scale disturbances; the SecureBox for encrypted data exchange between systems and on-site edge application execution; and the development of blockchain-based mechanisms for traceability and events log and sharing. These tools now operate at TRL 5–6, ready for large-scale demonstration.
In parallel, AI-driven control algorithms for islanding operations have been tested successfully in laboratory and real network conditions, confirming the feasibility of maintaining grid stability autonomously under critical events. They have been implemented on a graphic interface ready to use by the operators, to be validated in one of the demo sites. The BIM-based digital substation design integrates cyber-physical modelling and VR interaction for enhanced operator training and secure automation.
Currently, demonstration activities are validating these technologies in realistic environments in Spain, The Netherlands, Italy and Ukraine, after a careful mapping among technologies and demo leaded by added-value and end-user interest criteria.
Key achievements include the creation of the eFORT Vulnerability Database that harmonises classifications and supports real-time analysis through a machine-learning–based Hypothesis Tool, enabling operators to anticipate and evaluate mitigation effectiveness. The database and visualisation dashboard provide one of the most comprehensive sector-specific repositories for cyber-physical threats to energy systems.
In cybersecurity, a multi-layered defence framework has been established through the integration of an Intrusion Detection System (IDS), an enhanced Security Information and Event Management (eSIEM) platform, and the A-Bot intelligent chatbot. The IDS combines machine learning for anomaly detection in substation protocols and has included published studies about the analysis and selection of the most relevant and impactful operational data to feed the algorithms. The eSIEM adds Trust Management and Fast Mitigation modules for rapid response. A-Bot offers operators natural-language, multilingual interaction with alerts and system status, bridging human and machine interfaces. This interface reflects the project’s dedication to integrating relevant, state-of-the-art technologies (LLMs in this example).
Other major technical advancements include the deployment of digital twins for transmission and distribution grids, integrated with reinforcement learning for grid restoration and other models to react to and prevent cascading effects in EPES large scale disturbances; the SecureBox for encrypted data exchange between systems and on-site edge application execution; and the development of blockchain-based mechanisms for traceability and events log and sharing. These tools now operate at TRL 5–6, ready for large-scale demonstration.
In parallel, AI-driven control algorithms for islanding operations have been tested successfully in laboratory and real network conditions, confirming the feasibility of maintaining grid stability autonomously under critical events. They have been implemented on a graphic interface ready to use by the operators, to be validated in one of the demo sites. The BIM-based digital substation design integrates cyber-physical modelling and VR interaction for enhanced operator training and secure automation.
Currently, demonstration activities are validating these technologies in realistic environments in Spain, The Netherlands, Italy and Ukraine, after a careful mapping among technologies and demo leaded by added-value and end-user interest criteria.
By the end of RP2, eFORT has moved from design to integrated, early validation across four demos (Spain, Italy, the Netherlands, Ukraine), with a portfolio advancing to TRL 5–6. Flagship results include the sector-tailored Vulnerability Database with a machine-learning Hypothesis Tool, an integrated IDS–eSIEM–A-Bot cybersecurity layer, SecureBox for encrypted/standards-based data exchange with edge AI, and grid digital twins enabling learning-based restoration and decision support. Complementary innovations, blockchain-based maintenance traceability (AR-ready), AI islanding control, and BIM-enhanced digital substations, converge in the eFORT Intelligent Platform. Impacts are already visible: 16 publications, 22 KERs, and measurable gains in cascading-failure containment, substation security, and renewable-integration resilience, with KPI- and CBA-based quantification next.
For uptake, priorities are continued large-scale demonstration, access to markets via matured business models, clear IPR for the 22 KERs, standardisation/compliance alignment (e.g. mapping to NIS2), and skills development plus internationalisation to embed capabilities in SOC/control rooms and smart-grid controllers.
For uptake, priorities are continued large-scale demonstration, access to markets via matured business models, clear IPR for the 22 KERs, standardisation/compliance alignment (e.g. mapping to NIS2), and skills development plus internationalisation to embed capabilities in SOC/control rooms and smart-grid controllers.