Electroshock: Switching a 6 kV Substation

You can read a hundred pages about substations.

Or open one breaker and see what really happens.

Electroshock is our GRID lab, and it is a live 6 kV substation you operate rather than read about.

The Topology

• 2 incomers
• 2 busbars
• 6 feeders
• 2 RTUs

DNP3 and IEC 104 run between them, with real switching logic and real interlocks. It sits inside Firegate, the substation zone we launched in July: labshocksecurity.com/news/firegate-substation-lab-dnp3-iec104

What You Do

• Send DNP3 and IEC 104 commands
• Open and close breakers
• Transfer load between busbars
• Capture the traffic in Wireshark
• Trace signals between the RTUs and the HMI
• Follow the process step by step

Then Reality Starts

This is the part a simulator usually skips:

Now you have to find out why.

Not because somebody designed a puzzle. Because that is how real systems behave. An interlock exists to refuse an operation that would be unsafe, and it refuses you without explaining itself.

The gap between "my command was accepted" and "the process did what I intended" is where OT security actually lives. A protocol-valid command that changes nothing, and a protocol-valid command that trips a bus, look identical on the wire.

You learn the difference by causing both.

Why We Built GRID

Not to teach protocol fields. Not to memorise standards.

To let you test how a power system actually works:

OT security must be testable.

Not documented.

Try It Yourself

• Start free: github.com/zakharb/labshock — runs locally with Docker, no cloud.
• Open Electroshock and transfer load between busbars, with Wireshark running the whole time.
• Find one operation the interlocks refuse, then work out which condition blocked it before you look it up.
• Compare notes with people doing the same thing: discord.gg/bpmaQFfW76