Demo 1. Spain

IoT, blockchain and cybersecurity in a prosumer-grid

Location

Escúzar, Spain

Key partners

Lead: CUERVA
CIRCE
Schneider
Comillas
SIA

Main solutions

Blockchain technology
IoT security
Secure distributed energy resource operation
SecureBox
IDS/IPS
Remote terminal unit (substation)

Description

An area of the distribution network operated by Cuerva Energía S.L. is used as the main electricity infrastructure for the Granada Smart Grid Living Lab. The demo involves a substation, operated by Cuerva Energía S.L, connecting the MV distribution grid directly to the HV network. This distribution network feeds the village of Escúzar, which will serve as the demo-site for the micro grid and end-user level.

LV distribution grid serves mainly residential consumers, with 450 supply points and a peak load near 0.55 MW. Near the village, there are 2 PV plants of 4 MW and 1.8 MW, each connected to the MV grid. In the area, there are also a small number of residential households with self-generation.

Additionally, the plan is to deploy a small-scale PV plant around 60 kW for shared self-consumption between the public supply points owned by the city townhall.

Escúzar electrical substation, built in 2008, will be also used as a complementary demo-site to validate digital substation developments.

Approaches

At the IoT (Internet of Things) level, the methodology for mitigating a massive attack on distributed resources will be applied. This will allow assessing the vulnerabilities of the CUERVA living lab, defining an action plan to prevent attacks, generating cybersecurity algorithms and simulating faulty conditions to test the response and resiliency.

At industrial level, the SecureBox, as part of the IDS/IPS system will be tested. It will be used for monitoring the status of industrial devices (security patches, alarms, etc.), such as smart meters, and its emergency functions.

Some of the developments performed in D4 will be replicated to modernise and secure the CUERVA substation, with attention to RTU (remote terminal unit) enhancements. The focus will be on user management and secure access, and activity monitoring, facilitating the direct integration of DSO custom systems in micro-grids and segments of the network.

Approaches

Innovations and technological advances

  1. Edge functions for privacy management and secure distributed energy resource (DER) operation.
  2. Secure grid inventory and monitoring: blockchain-based technology layer.
  3. Improvement of the functionalities available at the substation devices, such as remote terminal unit (RTU).
  4. Assessment of potential vulnerabilities and threats of IoT devices.

Results Overview

The Spanish pilot  successfully validated three use cases under real operational conditions at the Escúzar substation and surrounding low-voltage network.

What was achieved: The team confirmed that all three use cases could function as intended in a live setting. Cybersecurity monitoring tools were installed and tested on CUERVA’s actual electricity network, a blockchain-based asset management system was demonstrated for battery and energy-market transactions, and a risk-analysis tool was applied to real, mapped sections of the local grid.

Technologies demonstrated:

  • Cybersecurity monitoring (UC2): A device called “SecureBox” captures network traffic at the substation and sends it to an “Intelligent Platform,” which automatically detects suspicious activity, raises alerts on a dashboard, and lets the operations team respond. Importantly, this was tested against real conditions at a working substation, not a simulation. A-Bot was designed and developed. It leverages a Large Language Model (LLM) to provide grid operators with real-time natural language responses about the status of the electrical grid and includes a dedicated alert notification mechanism. The chatbot is intended for grid operators, to support them during monitoring and simulation activities.
  • Blockchain for asset management (UC1): A blockchain system tracked battery assets and energy-market transactions, paired with augmented/virtual reality tools to make information easier for technicians to consult.
  • Dynamic risk analysis (UC3): Using detailed network modelling software, the team analysed two real local networks (Fornes, which includes a shared energy community, and Jayena, which includes a grid-connected battery), covering nearly a thousand individual connection points, including homes, EV chargers and renewable assets.

Main findings/lessons learned: The pilot confirmed the practical feasibility of these tools on real infrastructure, but also identified next steps for maturing them further: extending the blockchain solution into an actual energy-market environment, upgrading the cybersecurity platform so it can automatically respond to threats rather than only detect them, and scaling the risk-assessment tool to larger, more complex parts of the grid.

Particularly successful demonstration: The cybersecurity use case (UC2) stands out, as it was validated directly on live substation infrastructure, a meaningful step toward real-world deployment rather than a proof of concept.

Key Results

  • Real-world cybersecurity validation: SecureBox and the Intelligent Platform were deployed and tested on CUERVA’s actual live substation network at Escúzar, detecting threats and raising alerts under real operational conditions, not a simulation.
  • Blockchain-based asset management demonstrated: A blockchain system for battery asset tracking and energy-market transactions was validated, enhanced with AR/VR interfaces to make data easier for technicians to access.
  • Dynamic risk analysis on real grid models: A detailed network model was built and analysed for two real local networks (Fornes and Jayena), covering nearly 1,000 connection points including homes, EV chargers, an energy community, and a grid-connected battery.
  • Three use cases validated end-to-end: All three demonstrator scenarios (cybersecurity monitoring, blockchain asset management, and dynamic risk analysis) were successfully tested and confirmed as functional in their intended settings.
  • Operational threat-detection workflow proven: A full alert pathway was validated, from traffic capture, through automated detection, to a dashboard alert reviewed by the operations team, showing the concept works in practice at a working substation.
  • Foundation laid for scale-up: Results clarified concrete next steps for maturing the solutions (real market deployment of blockchain, active-response cybersecurity capability, and larger-scale risk assessment), giving the project a clear path toward broader replication.

Impact and Next Steps

Distribution system operators (DSOs) and transmission operators, grid technicians, energy communities, and end-users with distributed resources (EV chargers, solar, batteries) can all benefit from these results. DSOs gain practical cybersecurity monitoring tools, technicians benefit from AR/VR-supported maintenance, and communities benefit from better risk visibility over their local grids.

The results contribute to a more secure and resilient power system by demonstrating real-time threat detection at substation level, improving traceability and accountability of grid assets via blockchain, and enabling proactive risk assessment across increasingly complex networks with renewables, EVs, and batteries.

The solutions are designed for replication. SecureBox and the Intelligent Platform can be deployed at other substations, the blockchain framework can extend to real energy markets, and the risk-analysis methodology can scale to larger, more complex grid topologies, supporting broader adoption across the EU.

Contact the demo lead:

frubio@cuervaenergia.com

i.iriondo@vergy.es