Question 1

How do you deploy ML inference inside a NERC CIP environment without expanding the ESP?

Accepted Answer

Inference runs inside the existing Electronic Security Perimeter on a hardened Linux host registered as a BES Cyber Asset; we do not punch new holes. Models are signed, hashed, and pulled in through the IDS-monitored EAP as part of the normal CIP-007 patch-management cadence. Logging goes to the utility SIEM with the same CIP-007 R4 retention. The ML host inherits the existing CIP-005 firewall posture, CIP-007 ports-and-services baseline, CIP-010 configuration monitoring, and CIP-011 information-protection controls — auditors see one more BCA, not a new architecture.

Question 2

How do you build an FERC Order 2222-compliant DER aggregation system?

Accepted Answer

Two layers. The aggregator-facing layer registers DERs (rooftop solar, behind-the-meter batteries, smart thermostats, EVSE) with telemetry that satisfies the relevant ISO/RTO's metering and telemetry requirements — for example PJM's 4-second SCADA equivalency for capacity resources. The market layer submits bids and offers into the day-ahead and real-time markets, then disaggregates the cleared award back to individual DERs respecting their IEEE 1547-2018 limits and any distribution-system operator override. We have built this against PJM's DR Hub interface and CAISO's DERP framework.

Question 3

How do you keep an AI workload from violating IEC 62443 zone segmentation between IT and OT?

Accepted Answer

Models train on the IT side from historian extracts (AVEVA PI to Pi2Pi or PI Integrator for Business Analytics into an IT-side data lake). Trained artefacts move into OT through a one-way conduit — typically a data diode or a vetted file-transfer appliance — into the OT-zone inference host. Nothing on the OT side ever calls out to the IT side. The boundary is documented as a 62443-3-3 conduit with SL-T rated against the controlled process, and the inference host runs under the SR (security requirement) profile its zone demands.

Question 4

Can you read AVEVA PI tag streams without destabilising the historian?

Accepted Answer

Yes. We never query the PI Data Archive directly from a model. Standard pattern: PI Integrator for Business Analytics or PI to PI replication into a read replica or a Parquet/Delta lake on the IT side, with interpolated and time-weighted aggregates pre-computed. Asset Framework (AF) templates become the schema. For ten-thousand-tag fleets we typically end up with 1-minute, 15-minute, and hourly rollups feeding the model and raw tags reserved for ad-hoc investigation. The Data Archive sees one well-behaved consumer.

Question 5

How fast can ML help with AGC regulation, and where does it actually move the needle?

Accepted Answer

ML does not replace the AGC PI controller — the closed loop still runs every 2 to 6 seconds against ACE. What ML moves: (1) regulation-reserve sizing, where a forecast of net-load volatility 5-15 minutes ahead lets the operator carry less expensive reserve, and (2) unit dispatch fairness, where a learned model predicts which committed units will respond fastest to a regulation signal so the AGC distribution factors are set better. Real result on a mid-size BA: ~8% reduction in regulation-reserve procurement at unchanged CPS1/CPS2 compliance.

Question 6

How do you build wildfire-PSPS decision support for a California utility?

Accepted Answer

Feature stack: hourly weather (HRRR, NAM, ECMWF), vegetation-moisture indices (NFDRS, LFM from satellite), historical fire perimeters (CAL FIRE), circuit topology with fuse and recloser positions, asset-age inventory, micrometeorological sensor data along the lines, and red-flag warning history. The model is a circuit-level hazard score updated every hour out 72 hours. It does not make the PSPS call — it ranks circuits and produces a defensible record for the operator, the CPUC, and the post-event report. We have built variants of this with utilities that fall under D.21-06-014 PSPS reporting.

Question 7

How does AI orchestrate DERs across IEEE 1547-2018-compliant smart inverters?

Accepted Answer

IEEE 1547-2018 requires smart inverters to support volt-VAR, volt-watt, frequency-watt, and ride-through curves, exposed via Modbus, DNP3, or SunSpec / IEEE 2030.5 (CSIP). The orchestrator solves an optimisation each interval — typically a quadratic program that minimises losses or maximises hosting capacity subject to ANSI C84.1 voltage bands and each inverter's capability curve. The output is updated setpoints pushed via IEEE 2030.5 to each inverter, with the DSO retaining override authority. Distribution power-flow solver in the loop is OpenDSS or GridLAB-D depending on the utility's tooling.

Question 8

How do you automate settlements across multiple ISO/RTO market windows?

Accepted Answer

Each ISO publishes settlement statements on its own cadence — PJM monthly, CAISO daily with monthly true-up, ERCOT every operating day plus resettlements at 10, 55, and 180 days. Our pipeline ingests the settlement files (eMKT for PJM, OASIS for CAISO, MIS for ERCOT, etc.), reconciles them against our shadow settlement computed from meter and award data, and flags variances above a configurable threshold per charge type. Disputed line items get pre-filled dispute templates. On a fleet of about 1.2 GW we typically recover settlement variances in the 0.05–0.2% of gross revenue range that would otherwise leak.

Inference systems for grid operators

What you get

Inference systems we ship for utilities & ISO/RTOs

Short-term load & net-load forecasting

Predictive maintenance on rotating & static assets

AGC reserve & regulation optimisation

DER orchestration & demand response

Wildfire-PSPS decision support

Settlements automation across ISO/RTOs

Data engineering for OT-safe AI

AMI & smart-meter ingestion

SCADA & substation telemetry pipelines

AVEVA PI to lakehouse

IEC 62443-aligned segmentation, NERC CIP-aware evidence

Engineering Q&A