REAL-TIME CONTAINERIZATIONFOR DIGITAL TWIN APPLICATIONSIN POWER GRID SYSTEMS

Sammanfattning

Modern power grids rely on Embedded Controller Devices (ECDs) for real-time (RT) protectionand control of electrical substations, where missed deadlines can result in equipment damage orlarge-scale outages. The International Electrotechnical Commission (IEC) 61850 communicationstandard imposes strict timing constraints on these devices, with Generic Object-Oriented SubstationEvent (GOOSE) trip messages requiring delivery in under 4 ms and Sampled Values (SV)streams operating at inter-frame intervals as low as 250 μs. At the industrial partner of this thesis,ECD software is currently tested on a Windows-based VMware setup that diverges from the Linuxproduction platform and limits the number of virtual ECDs that can run on a single host. This thesisinvestigates whether a fully Linux-based containerized deployment can replace that setup whilepreserving the RT guarantees required for ECD operation. The work combines system analysis, astructured threat taxonomy, and controlled experimentation on two hardware platforms representativeof distinct deployment contexts: a commercial mini-PC with Non-Volatile Memory Express(NVMe) storage and an industrial embedded PC with Serial Advanced Technology Attachment(SATA) storage. Nearly fifty experimental configurations are evaluated across Central ProcessingUnit (CPU) topology, kernel-level isolation, storage subsystem hardening, and long-duration soaktests. The results show that the Docker container layer itself introduces negligible overhead, witha worst-case delta of 63 μs observed during container initialization and no measurable impact onaverage latency. CPU placement and subsystem-induced preemption are identified as the dominantthreats, the latter being a fifth threat category added to the taxonomy after empirical discovery onthe SATA platform. A layered mitigation stack reduces worst-case timing violations from 6,281 μsto below 100 μs, and an end-to-end validation with ten concurrent ECD containers exchanges realIEC 61850 traffic over six hours with zero SV frame drops and SV-to-GOOSE trip delays boundedby 728 μs, well within the IEC 61850 P3 performance class. These findings demonstrate that legacyRT Linux-based ECD software can be containerized while preserving IEC 61850 timing guarantees,and provide a structured methodology that practitioners can apply when containerizing other legacyRT embedded systems in critical infrastructure domains.