Protecting against national-scale power blackouts

1. Protecting against national-scale power blackouts Daniel Bienstock, Columbia University Collaboration with: Sara Mattia, Universitá di Roma, Italy Thomas Gouzènes, Réseau de Transport d’Electricité, France

2. Recent major incidents • August 2003: North America. 50 million people affected during two days; New York City loses power • September 2003: Switzerland-France-Italy. 57 million people affected during one day; Italy loses power • Other major incidents in recent years in Europe and Brazil • The potential economic and human consequences of a prolongued national-scale blackout are significant Were the blackouts due to insufficient generation capacity? No: they were due to inadequately protected transmission networks U.S.-Canada task force: The leading cause of the blackout was Inadequate System Understanding

3. A power grid has 3 components The transmission network is the key ingredient in modern grids Modern transmission networks are “lean” and, as a result, “brittle”

4. An inconvenient fact The power flows in a grid are controlled by the laws of physics When analyzing a hypothetical change in a network, the behavior of the power flows must be computed -- it cannot be dictated • Two popular methodologies: • AC power flow models • DC (linearized) flow models

7. Summary • “AC” models for computing power flows • Account for both “active” and “reactive” power flows • Fairly accurate • Non-convex system of nonlinear equations • Computationally intensive, Newton-like methods • Solution methods tend to require a good initial guess • Heavy data requirements • “DC” models • Linearized approximations of AC models • Much faster • Usually preferred by the industry for large-scale analysis

8. How does a blackout develop? • Individual power lines fail due to: • External effects: fires, lightning strikes, tree contacts, malicious agents (?) • Thermal effects: an overloaded line will melt -- usually requires several minutes • (protection equipment will shut it down first) • The physics and engineering underlying line failures are well understood Individual line failures system collapse

9. A model for system collapse Initial set of externally caused faults: Several lines are disabled The network is altered – new power flows ensue flows in some of the lines exceed the line ratings Further line shutoffs New network: new power flows Cascade ! (sometimes)

10. Simulation

11. What we are doing • Proactive planning: how to economically engineer a network • so as to ride-out potential failure scenarios • Each “scenario” is an “interesting” combination of • externally caused faults. • Example from industry: “N – k” modeling • Reaction planning: what to do if a significant event materializes • From a theoretical standpoint, very intractable • Multiple time scales The adversarial model

12. Proactive model We can upgrade a network in a number of ways. Examples: Upgrade individual lines Add new lines: Join/split nodes:

13. Integer programming approach • 0/1 vector x: each entry represents whether a certain action is taken, or not • x has an entry for each line of the network • example: a line parallel to a certain line is added, or not • total cost = cT x, for a certain cost vector c Problem:find x feasible, of minimum cost What is feasible? In each scenario (of a certain list), the network augmented as per vector x survives the cascade

14. Solution approach: game against an adversary Maintain a “working model” M, which describes conditions that a protection plan x must satisfy This model may be incomplete Solve the problem FIND x OF MINIMUM COST THAT SATISFIES THE CONDITIONS STIPULATED BY M, with solution x* Add this algebraic statement to M Is x* adequate in all scenarios? In some scenario, x* does not suffice. State this fact algebraically YES - DONE NO

15. Solution approach: Bender’s decomposition Maintain a “working formulation” Ax  b of inequalities valid for feasible x Solve the problem Minimize cTx subject to: Ax  b, x 0/1 With solution x* Add Tx  to Ax  b x* feasible? Find a valid inequality Tx  with Tx* < YES - DONE NO

16. Simple example: • we “protect” power lines – • a 0/1 variable x per each line • the grid survives a cascade if 70% of demand is met • if the grid survives two rounds then it survives

17. First round after initial event: • lines 1 – 7 shut off • 5 islands, 80% of demand is met

18. Second round: • lines 8 – 13 shut off, 15 islands • 61% < 70% of demand met, collapse x1 + x2 + x3 + x6 + x11 + x12 + x13 1

19. Experiments, and lessons • Algorithm converges in few iterations, • even with thousands of scenarios • But each iteration is expensive because of the need to simulate scenarios to test if a certain network is survivable – in the worst case, all scenarios must be simulated And where do the scenarios come from?

20. A model for system collapse, revisited Initial set of externally caused faults: Several lines are disabled The network is altered – new power flows ensue flows in some of the lines exceed the line ratings Further line shutoffs New network: new power flows Research topic: can this process be efficiently approximated?

21. How are scenarios generated? Today: “N-1” analysis • It can prove too slow on large networks • Many of the scenarios are uninteresting • The generalization: “N – k” analysis is prohibitively expensive

22. A different technique Stochastic simulation: assign a fault probability to each network component, and simulate the entire system • We are dealing with extremely low probability events • The interesting scenarios have very low probability, which will likely be incorrectly estimated • And in any case we will generate many unimportant scenarios

23. Ongoing work: adversarial problem Problem: find a smallest initial set of faults, following which a cascade occurs Enumerating all k-subsets for k  5 is computationally infeasible for large grids Approach we are using: combination of approximate dynamic programming and integer programming

24. One approach • Adversary enumerates sets of k (small) lines at a time • Adversary chooses the best set according to an appropriate merit function • Examples: number of overloaded lines, nonlinear function of overloads (e.g. exponential), cost of flow under nonlinear cost function A difficulty: problem is not monotone

25. “Braess’ Paradox” Example: if we cut lines a, b, and c the system cascades but if we cut a, b, c, and d it does not

26. Solution approach: game against an adversary Maintain a “working model” M, which describes conditions that a protection plan x must satisfy This model may be incomplete Solve the problem FIND x OF MINIMUM COST THAT SATISFIES THE CONDITIONS STIPULATED BY M, with solution x* Add this algebraic statement to M Can the adversary collapse the system protected by plan x*? In some scenario, x* does not suffice. State this fact algebraically YES - DONE NO