Protecting against national-scale power
blackouts
Daniel Bienstock, Columbia University
Collaboration with:
Sara Mattia, Universitá di Roma, Italy
Thomas Gouzènes, Réseau de Transport d’Electricité, France
Recent major incidents
• August 2003: North America. 50 million people affected during
two days; New York City loses power
• September 2003: Switzerland-France-Italy. 57 million people
affected during one day; Italy loses power
• Other major incidents in recent years in Europe and Brazil
• The potential economic and human consequences of a prolongued
national-scale blackout are significant
Were the blackouts due to insufficient generation
capacity?
No: they were due to inadequately protected transmission
networks
U.S.-Canada task force:
The leading cause of the blackout was
Inadequate System Understanding
A power grid has 3 components
The transmission network is the key ingredient in modern grids
Modern transmission networks are “lean” and, as a result, “brittle”
An inconvenient fact
The power flows in a grid are controlled by the laws of
physics
When analyzing a hypothetical change in a network, the
behavior of the power flows must be computed -- it
cannot be dictated
Two popular methodologies:
• AC power flow models
• DC (linearized) flow models
Summary
“AC” models for computing power flows
•
•
•
•
•
•
Account for both “active” and “reactive” power flows
Fairly accurate
Non-convex system of nonlinear equations
Computationally intensive, Newton-like methods
Solution methods tend to require a good initial guess
Heavy data requirements
“DC” models
• Linearized approximations of AC models
• Much faster
• Usually preferred by the industry for large-scale analysis
How does a blackout develop?
Individual power lines fail due to:
• External effects: fires, lightning strikes, tree contacts, malicious agents (?)
• Thermal effects: an overloaded line will melt -- usually requires several minutes
(protection equipment will shut it down first)
The physics and engineering underlying line failures are well understood
Individual line failures
system collapse
A model for system collapse
Initial set of
externally caused faults:
Several lines are disabled
The network is altered –
new power flows ensue
flows in some of the lines exceed the line ratings
Further line shutoffs
New network: new power flows
Cascade !
(sometimes)
Simulation
Round
No. of shut-off
lines
No. of connected
components
(“islands”)
Demand
served (%)
1
2
1
100.0
2
8
3
100.0
3
17
8
87.66
4
20
16
82.72
What we are doing
•
Proactive planning:
how to economically engineer a network
so as to ride-out potential failure scenarios
Each “scenario” is an “interesting” combination of
externally caused faults.
Example from industry: “N – k” modeling
• Reaction planning:
materializes
what to do if a significant event
• From a theoretical standpoint, very intractable
• Multiple time scales
The adversarial model
Proactive model
We can upgrade a network in a number of ways.
Upgrade individual lines
Add new lines:
Join/split nodes:
Examples:
Integer programming approach
• 0/1 vector x: each entry represents whether a
certain action is taken, or not
• x has an entry for each line of the network
• example: a line parallel to a certain line is
added, or not
• total cost =
Problem:
cT x,
for a certain cost vector c
find x feasible, of minimum cost
What is feasible?
In each scenario (of a certain list), the network
augmented as per vector x survives the cascade
Solution approach: game against an adversary
Maintain a “working model” M,
which describes conditions that a
protection plan x must satisfy
This model may be incomplete
Solve the problem
FIND x OF MINIMUM COST THAT
SATISFIES THE CONDITIONS
STIPULATED BY M,
with solution x*
Add this
algebraic
statement to M
Is x* adequate in all scenarios?
YES - DONE
NO
In some scenario, x*
does not suffice.
State this fact
algebraically
Solution approach: Bender’s decomposition
Maintain a “working formulation”
Ax  b
of inequalities valid for feasible x
Solve the problem
Minimize cTx
subject to: Ax  b, x 0/1
Add Tx  
With solution x*
to Ax  b
x* feasible?
YES - DONE
NO
Find a valid inequality
Tx  
with Tx* < 
Simple example:
• we “protect” power lines –
a 0/1 variable x per each line
• the grid survives a cascade if 70% of demand is met
• if the grid survives two rounds then it survives
First round after initial event:
• lines 1 – 7 shut off
• 5 islands, 80% of demand is met
Second round:
• lines 8 – 13 shut off, 15 islands
• 61% < 70% of demand met, collapse
x1 + x2 + x3 + x6 + x11 + x12 + x13  1
Experiments, and lessons
•
Algorithm converges in few iterations,
even with thousands of scenarios
•
But each iteration is expensive because of the
need to simulate scenarios to test if a
certain network is survivable – in the worst
case, all scenarios must be simulated
And where do the scenarios come from?
A model for system collapse, revisited
Initial set of
externally caused faults:
Several lines are disabled
The network is altered –
new power flows ensue
flows in some of the lines exceed the line ratings
Further line shutoffs
New network: new power flows
Research topic: can this process be efficiently
approximated?
How are scenarios generated?
Today: “N-1” analysis
• It can prove too slow on large networks
• Many of the scenarios are uninteresting
• The generalization: “N – k” analysis is
prohibitively expensive
A different technique
Stochastic simulation:
assign a fault probability to each network
component, and simulate the entire system
• We are dealing with extremely low probability
events
• The interesting scenarios have very low
probability, which will likely be
incorrectly estimated
• And in any case we will generate many
unimportant scenarios
Ongoing work: adversarial problem
Problem: find a smallest initial set of
faults, following which a cascade occurs
Enumerating all k-subsets for k  5 is
computationally infeasible for large grids
Approach we are using:
combination of
approximate dynamic programming
and integer programming
One approach
• Adversary enumerates sets of k (small) lines
at a time
• Adversary chooses the best set according to an
appropriate merit function
• Examples: number of overloaded lines, nonlinear
function of overloads (e.g. exponential), cost of
flow under nonlinear cost function
A difficulty: problem is not monotone
“Braess’ Paradox”
Example:
if we cut lines a, b, and c the system
cascades
but if we cut a, b, c, and d it does
not
Solution approach: game against an adversary
Maintain a “working model” M,
which describes conditions that a
protection plan x must satisfy
This model may be incomplete
Solve the problem
FIND x OF MINIMUM COST THAT
SATISFIES THE CONDITIONS
STIPULATED BY M,
with solution x*
Add this
algebraic
statement to M
Can the adversary collapse the system protected by plan x*?
YES - DONE
NO
In some scenario, x*
does not suffice.
State this fact
algebraically