EIP Status: PLANNED - No specification document exists yet. Contributions and feedback are welcome.
VAP Profile | Energy & Critical Infrastructure

EIP

Energy Infrastructure Profile

"When the Grid Goes Dark, We Need to Know Why"

A Blackout Occurred. What Was the AI Deciding?

2021, Texas Blackout. Millions froze as the power system collapsed.

2003, Northeast Blackout. 55 million affected. Economic losses exceeded $6 billion. (Neither blackout was attributed to AI decision-making; both are cited for scale.)

Modern power grids are optimized by AI. Demand-supply balancing, renewable energy integration, fault prediction, load distribution. But when AI makes a wrong decision, there's no system to trace its rationale.

EIP is intended to cryptographically record all decisions made by AI managing critical infrastructure, enabling root cause analysis and cascade failure tracking when incidents occur.

Why EIP is Needed

Current Challenges in Critical Infrastructure

Untraceable Cascade Failures

A single failure propagates in a chain reaction. It's impossible to identify which AI decision was the origin point.

Unclear Recovery Priorities

When AI decides "prioritize recovery for this area," there's no record of why that decision was made.

Hard to Distinguish Cyberattacks

When AI behaves abnormally, it's difficult to verify post-incident whether it was a "bug" or an "attack."

The Terror of Cascade Failures

Single Failure Occurs
AI Decides Load Balancing
Overload Transferred to Adjacent Systems
Adjacent AI Also Attempts Load Balancing
Cascading System Collapse
Wide-Area Blackout
Cause Unknown
"Which AI's decision was the first mistake?"

Illustrative Incident Patterns

Examples of failures that highlight the need for EIP

Case 1: Demand-Supply Balancing AI Misjudgment

Renewable Output Forecast
AI: Oversupply Detected
Generation Curtailment Order

Reality: Demand surged unexpectedly

Frequency drop → System separation

"Why did AI judge oversupply?"
"Was the input data accurate?"
→ Insufficient evidence, cause unidentifiable

Case 2: Suspected Cyberattack on Water System

Water Plant AI Changes Chemical Dosage
Water Quality Anomaly Detected
Emergency Shutdown

"AI's autonomous decision?"

"External intrusion?"

→ Log integrity not guaranteed, unable to distinguish

EIP Application Scope

Planned Target Systems and Event Types (no specification exists yet)

Power Grid Management

REQUIRED

Demand-supply balancing, renewable integration, load forecasting

Water Network Monitoring

REQUIRED

Water treatment control, distribution optimization, leak detection

Gas Pipeline

REQUIRED

Pressure control, leak detection, emergency shutoff

Communications Infrastructure

REQUIRED

Traffic management, fault prediction, routing

Nuclear Plant Monitoring

REQUIRED

Anomaly detection, cooling control, emergency shutdown decisions

Industrial Plants

RECOMMENDED

SCADA/DCS control, process optimization

Recorded Events (Causal Chain)

Sensor Input
Power/Flow
Pressure/Temp
Frequency/Voltage
State Estimation
System State
Anomaly Detection
Topology
Forecast Generation
Demand Forecast
Fault Prediction
Risk Assessment
Control Decision
Load Balancing
Emergency Response
Recovery Plan
Actuator Output
Circuit Breaker
Valve
Generator

EIP Architecture

Data Flow and Event Structure

System Data Flow

SCADA/EMS/DMS System
Sensors (RTU/IED)
AI/ML Engine
Control Actions
EIP Logger (Sidecar) - Records All Decision Events
Hash Chain - Cryptographically Linked
Digital Signature
Merkle Root - Periodic Anchoring
Secure Archive
Isolated from OT Environment
Air-Gap Compatible
Offline Verification Possible

EIP Event Structure (Conceptual)

{
  "event_id": "019234ab-7c8d-7def-8123-456789abcdef",
  "timestamp_ns": 1734567890123456789,
  "event_type": "CONTROL_DECISION",
  "facility_id": "SUBSTATION_XXXX",
  "provenance": {
    "actor": {
      "type": "AI_MODEL",
      "identifier": "load_balancer_v4.2.1",
      "model_hash": "sha256:abc123...",
      "deployment_zone": "ZONE_A_CONTROL"
    },
    "input": {
      "sensor_readings": {
        "frequency_hz": 59.95,
        "voltage_kv": 274.5,
        "load_mw": 1250.3,
        "renewable_output_mw": 320.0
      },
      "input_hash": "sha256:def456..."
    },
    "action": {
      "decision": "LOAD_SHED_ZONE_C",
      "confidence": 0.92,
      "rationale": {
        "primary_factor": "FREQUENCY_DEVIATION",
        "alternatives_considered": [
          {"action": "IMPORT_FROM_REGION_B", "rejected_reason": "TIE_LINE_CONGESTED"}
        ]
      },
      "expected_impact": {
        "load_reduction_mw": 150,
        "affected_customers": 12500
      }
    }
  },
  "prev_hash": "sha256:789xyz...",
  "signature": "ed25519:..."
}

Regulatory Mapping

International Standards and Regulations

Regulation Jurisdiction Requirements EIP Support
EU NIS2 Directive EU Critical infrastructure cybersecurity, incident reporting Design target (planned)
NERC CIP Standards North America Power system cybersecurity, audit trails Design target (planned)
EU AI Act Annex III EU Safety-component AI in the supply of gas, heating or electricity is high-risk (Annex III, point 2) Design target (planned)
IEC 62443 International Industrial control system security Complementary
NIST Cybersecurity Framework USA Critical infrastructure protection framework Design target (planned)

NERC CIP — Design Targets (planned)

CIP-005: Electronic Security Perimeter OT/IT Separation
CIP-007: System Security Management Full Event Logging
CIP-008: Incident Reporting Tamper-Evident Evidence
CIP-009: Recovery Plans State Reconstruction
CIP-010: Configuration Management AI/Model Tracking

EU NIS2 Directive — Design Targets (planned)

Risk Management Measures Risk Factor Logging
Incident Handling Root Cause Evidence
Business Continuity Recovery Support
Supply Chain Security Vendor AI Tracking
Incident reporting (Art. 23): early warning in 24 h, notification in 72 h, final report in one month Instant Export

OT Environment Adaptation

Designed for Operational Technology Constraints

IT Environment (General Systems)

  • Always connected to internet
  • Regular updates possible
  • Cloud services available
  • Easy restart/maintenance

OT Environment (Critical Infrastructure)

  • May be air-gapped (no internet)
  • Updates difficult (24/7 operation)
  • Real-time required (millisecond control)
  • Availability priority (99.999% uptime)
  • Legacy system coexistence (10-30 years)

EIP OT-Adapted Design

Air-Gap

Offline sign/verify

Real-Time

Async logging

High Avail.

Fail-safe design

Legacy

Sidecar approach

Long-Term

20-40 year retention

No Added Control-Path Latency (design goal)

Async processing

Use Cases

How EIP Is Intended to Support Incident Response

Use Case 1: Cascade Failure Root Cause Analysis

Phase Without EIP With EIP
Blackout Occurs Multiple systems collapse simultaneously Same
Initial Investigation "Don't know where it started" Identify first event by timestamp
Causal Tracing "Log formats differ across systems" Trace chain with unified format
AI Decision Verification "Unknown if AI input was correct" Verify with input data hash
Cause Identification Speculation-based report Verify "System A AI used incorrect topology"
Prevention Vague improvements Specific model/data quality fixes

Use Case 2: Cyberattack Forensics

Anomaly Detected: AI Issued Unexpected Control Command

EIP Evidence Analysis

Input Data Integrity Check Normal
Model Hash Verification Mismatch!
Signature Verification Invalid Signature
Conclusion: Model Tampering Attack
Preserve Evidence & Submit Incident Report

Use Case 3: Recovery Priority Justification

Major Blackout Occurs

AI Recovery Priority Decision:

TOP Hospitals & Medical Facilities
HIGH Communications Infrastructure
MED Commercial Facilities
SEQ Residential Areas
Citizens complain: "Why is our area last?"

EIP Evidence Explanation

  • System state at time of decision
  • Rationale for load priorities
  • Alternatives considered and rejection reasons
  • Rules and policies applied to the decision

Fulfill Transparent Accountability

Technical Specification Summary

Design targets — EIP is planned and no specification document exists

Timestamp

μsec

IEEE 1588 PTP

Throughput

10K/sec

Max Rate

Hash

SHA-256

Cryptographic

Signature

Ed25519

+Dilithium PQC

OT Env

Air-Gap

Offline OK

Retention

20-40Y

Set per applicable requirements

Tolerance

Fail-Safe

Control OK

Latency

None added (goal)

Async

Roadmap

EIP Development Timeline — no dates set; no milestone has been reached to date, and EIP remains Planned with no specification document

Planned — no date set

EIP Draft Specification v0.1 Release

Planned — no date set

Technical Validation with Utilities

Planned — no date set

NERC/FERC (NA), ENTSO-E (EU) Briefing

Planned — no date set

EIP v1.0 Official Release

Planned — no date set

IEC TC 57 Collaboration Start

Planned — no date set

IEEE/IEC Standardization Activities

VAP/VSO Relationship

Framework Hierarchy

VAP

Verifiable AI Provenance

Universal Framework for All Domains

VSO

VeritasChain Standards Organization

Standards Organization

VCP

Finance

v1.2 Released

DVP

Automotive

Planned

MAP

Medical

v0.1.2 Working Draft

EIP

Energy

Planned

PAP

Public Sector

Partial Draft

Related Industry Standards

Intended Relationship to Existing Standards (planned)

Standard Role EIP Relationship
IEC 61850 Substation Automation Communication EIP complements AI decision layer
IEC 61968/61970 (CIM) Power System Information Model EIP events reference CIM objects
DNP3 / Modbus SCADA Communication Protocols EIP operates above protocol layer
OPC UA Industrial Communication Standard Integrates as EIP event source
IEEE C37.118 Synchrophasor Measurement PMU data recorded as EIP input

Get Involved with EIP

EIP is currently at the planning stage (no specification document exists yet). We welcome participation and feedback from utilities, regulators, and infrastructure operators.

"When the power grid collapses, the question isn't 'whose fault is it?' — it's 'why did it happen?'"
— VeritasChain Standards Organization
"The grid never forgets. Neither should our audit trails."

This work is licensed under CC BY 4.0 International