UNCLASSIFIED Cryptologic Quarterly Data Communications Via Powerlines I I (b) (3)-P.L. 86-36 The author is a member ofNSA Cohort 11 at bine, such as in nuclear- or coal-powered electric the Joint Military Intelligence College. Many of power plants, or a low-speed turbine, such as is the ideas presented in this paper were developed used in hydroelectric power plants). The power is as a class research paper at the Joint Military transferred to the transmission system via a volt­ Intelligence College. age step-up transformer.3 Typical voltages in this The views expressed in this paper are those of stage range from 138 kV to 500 kV or more. Bulk the author and do not reflect the official policy power is delivered from the generating plants via or position of the Department of Defense or the this intercity transmission system (which can U.S. government. span several states) to the transmission substa­ tions where the power is transferred to a sub­ The hunger for increased bandwidth is driv­ transmission system whose voltages range from ing individuals, corporations, and organizations 38 kV to 138 kV; power transference is made via to seek new methods for delivering Internet serv­ a step-down transformer. The subtransmission ice to customers. Many of these methods are well system delivers the high voltage throughout a city known: radio-frequency (or wireless) communi­ or large region. Power is delivered to the con­ cations (such as the IEEE 802.11 Wireless LAN, sumers via the distribution system. Transference Bluetooth, and the HomeRF and SWAP from the subtransmission system to the distribu­ Protocols), infrared communications (IrDA), tion system is made within regions called distri­ fiber-optic channels, high-speed telephone con­ bution substations, likewise using step-down nections (such as DSL and ISDN or the more transformers. Output cables from the distribution modern Home Phoneline Networking Alliance substations are typically called feeders. (HomePNA) system).1 One approach that is still receiving a cool reception in the United States is a In the United States, the distribution system highly discussed option in Europe and the rest of is subdivided into two components: the primary the world using the power grid as a delivery con­ distribution system (the voltages of which run duit for high-speed data communications. This from 4.6 kV to 12.47 kV) 4 and the secondary dis­ paper provides a brief introduction to High­ tribution system (the voltages of which are the Speed Powerline Communications (HSPLC): the typical 120/240/208 voltages in houses and technologies, politic;:al struggles, and future look. offices). Power from the primary distribution sys­ tem to the secondary distribution system is trans­ The Electric Power Grid Design ferred via the distribution transformers common­ ly seen on top of power poles or in large metal Before discussing HSPLC, it is informative to boxes near offices and apartment complexes. A outline the construction of the power delivery sys­ typical arrangement for suburban power connec­ tems in the United States and Europe. In the tions has four houses connected in a secondary United States, electric power is transferred from distribution system, being served by a single dis­ the power producer to the power user via a three­ tribution transformer. At best, a secondary distri­ stage delivery system. Electric power is generated bution system in the U.S. services only a few at a moderately high voltage (typically around apartments with a single transformer. 2 4.16 - 13.8 kilovolts (kV); 1 kV = 1000 volts) at the power plant (using either a high-speed tur- UNCLASSIFIED Page 53 Cryptologic Quarterly UNCLASSIFIED Europe and most of the rest of the world use a Xl0,7 the granddaddy of powerline protocols, single layer distribution system. Output voltages uses amplitude modulation to send binary infor­ from the subtransmission substations range from mation from a controller/transmitter to XlO 200 to 300 volts, depending on the country. The modules that are plugged into a standard electri­ reasons for the differing philosophies are not cal outlet. The control pulses consist of 120 kHz important to this paper, but it is important to rec­ bursts with a lms envelope: the presence of a ognize that in the United States usually only a burst signals a logical "1'' while the absence of a handful of consumers connected are in a single burst is a logical "0."8 A single bit is transmitted (secondary) distribution system while in the rest twice (for reliability)9 on each cycle of the 60 Hz of the world hundreds of consumers can be con­ AC power sine-wave; the bursts are synchronized nected in a single distribution system. As will be to within 200ms of the zero-voltage crossing seen later, these facts partially answer the ques­ point of the AC power sine-wave. As a result, its tion of why HSPLC is of great interest in Europe transmission rate is limited to 60 bits per second but of only mild interest in the U.S. (bps). Further, a complete X-10 command con­ sists of two packets, each containing two identical Low-speed Powerline Communications messages of 11 bits (voltage cycles); each packet is Protocols separated by a 3-cycle gap10 (again, redundancy for reliability). The result is that a single X-10 Using the electric powerline to send informa­ command takes approximately 4 7 cycles of the 60 tion is not a new idea. Sweden has used its elec­ Hz signal or 0.8 seconds to send. tric power grid for telephone communications for many years. Further, electric power lines have The developers of the CEBus standard (EIA- been used throughout the world for low-frequen­ 600) state that they use spread-spectrum tech­ cy communications by the electric power indus­ nology to transmit data. 11 However, unlike tradi­ try, for baby monitors, or simple control func­ tional spread-spectrum techniques such as fre­ tions, using protocols such as XlO@ Home quency-hopping or direct-sequence spreading, Automation, Intellon CEBus@, Echelon the spread-spectrum of CEBus sweeps the signal LONWorks@, or Intelogis [email protected] These frequency from 100 Hz to 400 Hz for each bit. proprietary protocols are low speed and are used According to the developers, this overcomes some solely for controlling consumer systems, such as of the inherent noise problems associated with lights, appliances or simple electronics. In addi­ higher speed powerline communications. Like tion to these consumer-oriented protocols, the XlO, CEBus has two fundamental components: a power industry has a separate protocol for using transceiver and a microcontroller. Unlike XlO, powerlines to communicate system control CEBus is not restricted to powerline communica­ (SCADA) data. In the past, signals used by the tions but can use any communication media, electric utilities for controlling signal powerline including RF.1 2 At its higher level, CEBus uses communication have been analog. Data are trans­ its own Common Application Language (CAL) to mitted using either amplitude modulation (either ensure that CEBus compliant systems made by double-sideband or single-sideband) or frequen­ different manufacturers can exchange commands cy-shift (ON-OFF) keying on carrier frequencies and status requests.13 CAL creates device "con­ from 30 kHz to 500 kHz in the U.S. and from 10 texts" and object classes to communicate a kHz to 490 kHz in Canada.6 Because the power given command to the appropriate device. 14 The industry worldwide is changing its protocols for CEBus protocol is similar to Ethernet in that all SCADA communications, this report does not (a) it is peer-to-peer and (b) it uses a Carrier examine the power utility protocols. Sense Multiple Access/Collision Detection and Resolution (CSMA/CDCR) protocol to avoid data Page 54 UNCLASSIFIED UNCLASSIFIED Cryptologic Quarterly collisions.15 This protocol requires a network client/server operation) or the CEBus Generic node to wait until the line is clear so that there Common Application Language (CAL, for peer­ will be no simultaneous transmission on the line. to-peer operation); at the Network, Transport, Data are transmitted at the rate of approximately and Data Link Layers, PLUG-IN defines the 10 kilobits per second (kbps). Standard EIA 709.2 Power Line Exchange (PLX) Protocol while at the defines the specifications to use either CEBus for Physical Layer PLUG-IN uses the Digital Power sending data over two- and three-phase electrical Line (DPL) Protocol. Using DPL, PLUG-IN powerlines. The standard restricts the powerline boasts data transmission rates of up to 350 kbps channel to a spectral bandwidth from 125 kHz to using a single channel frequency. PLUG-IN uses 140 kHz and specifies data communication rates Frequency-Shift-Keying (FSK) to encode the data of 5.65 kbps while providing a narrow-band onto the signal carrier. A proposed version of power line signaling technology that meets North PLUG-IN DPL (for Digital Power Line) is to use American and European regulations.16 multiple signal channels to produce speeds of over 1 Mbps. Bit error rates for DPL are in the LONWorks17 (ANSI/EIA 701.9-A-1999) is range of 10-9 with 80 dB of dynamic range. The similar to CEBus: it works as either a peer-to-peer FSK scheme encodes the digital data onto the or a master-slave data communication system; it power line by using hvo or more separate fre­ uses spread spectrum technology to transmit quencies that are in a fairly narrow frequency data; and it uses a CSMA technique for data colli­ band. Like the other low-speed powerline com­ sion avoidance. Additionally, LONWorks also munications protocols, PLUG-IN is intended for supports many communication media including control system communication signals.