A stochastic study of hidden failures in power system protection

Decision Support Systems 24 Ž1999. 259–268

A stochastic study of hidden failures in power system protection Koeunyi Bae a b

a,)

, James S. Thorp

b,1

428 Phillips Hall, School of Electrical Engineering, Cornell UniÕersity, Ithaca, NY 14853, USA 224 Phillips Hall, School of Electrical Engineering, Cornell UniÕersity, Ithaca, NY 14853, USA

Abstract Recent studies have shown that power systems protection mechanisms have played a major role in propagating disturbances. All of the last five major Western Systems Coordinating Council ŽWSCC. events Žthe North Ridge earthquake, December 14, 1994, July 2 and 3, 1996, and August 10, 1996., involved either false trips of line protection relays or generator protection equipment. Using an importance sampling based algorithm on the 179-bus WSCC equivalent system, we modeled the sequence of rare events involving generator trips and incorrect zone 3 relay operations. Due to possible loss of generation and load, frequencies were monitored for the necessary of load shedding. The algorithm uses the Newton–Raphson method for accuracy but reverts to DC load flow when the Newton–Raphson algorithm fails to converge within three iterations. The resulting sequence of rare events and its corresponding probability are used to detect weak links in the power system. This information can be beneficial not only in areas such as service and maintenance scheduling and in planning, but also in determining locations where an investment in improving the protection system is warranted. q 1999 Elsevier Science B.V. All rights reserved. Keywords: Power systems relaying; Statistics; Power systems protection; Disturbance propagation; Importance sampling; Rare events; Hidden failures

1. Introduction Recent studies show that power protection system played a significant role not only in possible triggering of the initial event, but in further propagating the disturbances. These types of cascading effects lead to major blackouts. The ability to transfer power reliably through a network is a necessity in order to maintain system security. In a deregulated power system of the future, reliability and security are even more crucial when heavy penalties are attached to )

Corresponding author. Tel.: q1-607-254-8811; fax: q1-607255-1001; e-mail: [email protected] 1 Tel.: q1-607-255-3347; fax: q1-607-255-1001; e-mail: [email protected].

failing to maintain a secure network. Hence, there exists a need to study the hidden failures imbedded within the protection system. Hidden failures are the insecure or failed protection system that remains undetected until abnormal operating conditions are reached. In 1996 alone, the Western Systems Coordinating Council ŽWSCC. servicing 59 million people suffered two major blackouts. The WSCC Final Report w10x states that on July 2, parts of the WSCC system were not operating in conditions in compliance with the WSCC Minimum Operating Reliability Criteria. Initiated by a flashover near the Jim Bridger–Kinport 345,000 V line, a protective device operate incorrectly in the Jim Bridger–Goshen 345,000 V line de-energized the line, triggered the remedial

0167-9236r99r$ - see front matter q 1999 Elsevier Science B.V. All rights reserved. PII: S 0 1 6 7 - 9 2 3 6 Ž 9 8 . 0 0 0 6 9 - 4

260

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

action scheme, and led to tripping of two units near the Jim Bridger generating station. Again on July 3, a similar scenario played out. However, the system operators managed to halt the cascading effect. In the WSCC Final Report dated October 1996 w9x, the August 10 event, which affected a loss of power to 7.5 million customers, involved a false tripping of the phase imbalance relay on the exciter system and a zone 1 KD relay malfunction. In both the July 2 and August 10, 1996 cases, hidden failures have been blamed for promoting the initial disturbance. The North America Reliability Council report w4x supports the assertion that protection systems play a huge role in the sequence of events that lead to power system disturbances. In spite of its importance, the impact of protection system malfunction on overall system reliability has not been well studied. The existing protection system has multiple overlapping zones of protection. Their bias is toward dependability, even at the cost of global system security. Highly redundant local protection schemes tend to undermine the total system integrity. Siting the 1996 WSCC events as examples once again, virtually all relay misoperations are false trips, which during major system events act to propagate major disturbances. Simulations to analyze such cascading scenarios can be daunting. The obvious problem arises from the fact that such rare cases are difficult to capture in large but limited databases. Even though thousands of load flows or transient stability cases can be involved in a database, the probability of major disturbances are so small that they cannot reasonably be included by conventional techniques. The North American Electric Reliability Council ŽNERC. reports make it obvious that major disturbances typically involve a string of six to seven unlikely events. Since simulation studies which capture a number of low probability events are difficult to perform, and the exact probability of the various unlikely events are not known, only few attempt has been made to model the temporal spreading of the disturbance. Recent studies w3,5–8x use importance sampling to alleviate the difficulty of simulating rare events. The simulations are performed with altered probabilities, which make the unlikely events more likely and processing the simulation results so that the correct answers are obtained. An importance sampling-based

algorithm can be used to investigate where in the system changes in the protection mechanism would be most effective, and then evaluate the increase in reliability obtained from monitoring the protection system. Importance sampling is critical to the success of studying hidden failures imbedded in the power system. In the wake of the summer of 1996 events, reliability of the protection system is an issue. It is our contention that study of hidden failures using importance sampling would determine the place in the bulk power system most sensitive to incorrect operations. Not only will this information be crucial for scheduling of maintenance and service, this information can also be used during the initial planning stages to better optimize the system network. 2. Methodology Two types of hidden failures in the relays will be the focus of the study. The first involves the third zone relays protection of transmission line. After reviewing the WSCC events, a second type of hidden failure was added to the list: voltage-based hidden failures triggered by low voltage conditions. 2.1. Line protection hidden failures In Refs. w5,8x, if any line sharing a bus with a transmission line L trips, then hidden failures in line L are exposed. If one line trips correctly, then all the lines connected to its ends are exposed to the incorrect tripping. The recent WSCC events show that although such incorrect relay operations are rare, they do occur. Consider a fictitious model with some initial load flow shown in Fig. 1. If line 2 trips legitimately, then it exposes lines 1, 4, 9 and 19. The rest of the lines are not effected since they are not connected to bus A or E. The 16 possible outcomes at this step are as follows: Ø one possible way of zero incorrect operations; Ø four possible ways of a single line incorrect operations; Ø six possible ways of two line incorrect operations; Ø four possible ways for a three line incorrect operations; and Ø one possible way for all four lines to incorrect operations.

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

For illustration purposes, if the probability of an exposed line tripping is taken as p then probability of it not tripping is q s 1 y p. Hence, there is a probability p 4 that all four lines succumb to the hidden failure and trip incorrectly, 4 pq 3 that a single line trips incorrectly, 6 p 2 q 2 that two lines misoperate, 4 p 3q that three lines trip, and q 4 that all four relays operate correctly. Reverting back to Fig. 1, line 9 operates incorrectly and exposes lines 1, 10, 11, and 19. Suppose lines 10 and 11 trip, then additional lines 7, 12, 13, and 14 are exposed leaving bus C is isolated. In a real power system, isolation of a bus such as C could mean loss of generation or load. This causes a mismatch to develop between the generation and the demand section of the power system. It is crucial that frequency decay of the power system is halted before further damage to turbine blades or auxiliary systems can occur. Hence, underfrequency relays are employed to detect the onset of frequency decay and to maintain a balance between load and generation. The frequency monitoring and the associated load shedding techniques are well documented in Ref. w2x. The bulk power system is usually split into smaller sections. Each one of these regions tracks its own frequency and performs individual load shedding. Though the real WSCC are split into many regions, for our study, the 179-bus equivalent will be only broken into four sections. They are as follows: Ø Canada, Washington, Oregon, Idaho Ø Northern California Ø Southern California Ø Nevada, Utah, Arizona, Wyoming, New Mexico The four regions will monitor frequency separately and shed load accordingly. Loss of 300 MW load for any region is the definition of NERC disturbance used in our experiment. 2.2. Voltage-based hidden failures In the July 2 and 3 and August 10, 1996 events, low voltage conditions led the exciter to believe in the existence of an imbalance in the SCR bridge circuit. The relay operated incorrectly and took action to avoid damage. The generator tripped unnecessarily. Therefore, we include the rare voltage based hidden failures in our study.

261

Suppose a generator bus voltage violates < Vmin < F < V < F < Vmax <

Ž 1.

and there exists inadequate VAR support, then the protection system is again exposed to hidden failures. If the relay operates incorrectly at that bus and the generator trips, then all lines connected to that bus would also be exposed to hidden failures. In Fig. 2, another fictitious model, a legitimate relay operation on line 2, which exposes lines 1, 4, 9, and 19. Line 9 operates incorrectly leaving hidden failures in lines 1, 10, 11, and 19. Suppose line 10 trips and at the same time the generator at bus H trips due to the low voltage plus inadequate VAR combination. This exposes lines 7, 11, 12, 13, and 14. Tripping of lines 13 and 14 exposes lines 7, 11, 12, and 17. The voltage based hidden failure gives another point for an initial disturbance perhaps even accelerating the cascading behavior.

3. Importance sampling Given  x i 4 are identically distributed Bernoulli random variables with P  x i s 14 s r s 1 y P  x i s 04

Ž 2.

where P x i s 14 is the probability of the event occurring and P x i s 04 is the probability of an event not occurring, we will estimate r with at most 20% error with 95% confidence. We want to estimate rˆ

rˆ s

N

1

Ý xi N

Ž 3.

i

to be such that P  < r y rˆ < F 0.2 r 4 G 0.95

Ž 4.

where N is the number of observations of the random variable x i . For example, x i s 1 could correspond to a line being in operation while x i s 0 could refer to the line being tripped. In Ref. w9x, the estimate of N is found to be Ns

100

r

.

Ž 5.

Hence if r is on the order of 10y6 , we would need 10 8 number of samples to simulate the cascading outages.

262

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

Each simulation requires a random number draw putting the long-term behavior of the random number generator under scrutiny. It is clear that such long term simulation would require an unrealistically large amount of computation time and demands the impossible for the random number generator. Importance sampling enables the simulation to be run with altered probabilities so that the rare events occur more frequently. Upon re-examining the sequence of events in Fig. 1, after the original flashover of line 2, misoperation at line 9, and another misoperation at lines 10 and 11, bus C becomes isolated. Suppose the loss of this particular bus pushes the system into the blackout situation. This bus then would be recorded by the conventional method as a 1. The number of 1’s in N simulations divided by N is the estimate of the probability of a cascading failure. In importance sampling rather than using the actual probabilities p and q, the simulations use the altered probabilities pp and qq. Rather than recording the number of 1’s, we record a number t, a ratio of actual probability of the event divided by the probabilities used in the simulation, computed as the simulation progresses. For the event described, ts

p

q

pp

qq

3

p

2

q

ž /ž / ž / ž / pp

qq

Ž 6.

The actual probability of the event is p 3 q 4 while the probability that the event occurs in the simulation is pp 3qq 4 . The following forms the estimate of the probability:

rˆ s

1 N

Fig. 3. Probability of exposed line tripping incorrectly.

zone three impedance as 250% of the line impedance. Dependence on the current system condition implies that impedance must be calculated after each computation. Fig. 4 shows the probability of incorrect generator tripping as a function of reactive power. When the voltage is maintained within operating range, the probability of false trip is negligible. However, once outside that range, misoperations can occur. For our calculation purposes, we will gauge the misoperation using VAR support. If < Q min < F < Q < F < Q max <

2

263

Ž 8.

is violated for any generator bus then operating voltage conditions cannot be met. Hence, the generators are exposed to false trips. Again, the voltage must be recomputed at each stage. 3.1. Importance sampling Õariation

N

Ý ti

Ž 7.

i

and will have the correct mean even if N is smaller than the 100rr estimate. More generally, each line will have a different probability of tripping incorrectly as shown in Fig. 3. The model shows the probability of the exposed line tripping incorrectly as a function of impedance seen by the relay. The value of three times the zone impedance setting is chosen. We will calculate the

Fig. 1. Sequence of cascading events. Fig. 2. Sequence of cascading events.

As explained in Ref. w8x, the following variation on importance sampling was incorporated into the algorithm. The numerator in Eq. Ž6. is the actual probability of the sample path of sequences of line outages. Rather than accumulate the weighted probabilities as in Eq. Ž7., we can record the distinct sample paths exposed in the simulation using pp probabilities along with the actual probabilities and then sum the probabilities. If the number of simulations is large enough to produce the significant sam-

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

264

Fig. 4. Probability of generator tripping incorrectly.

ple paths, then the sum is a tight lower bound to the actual probability of failure. Although the choice of the simulation probabilities is less critical than the direct importance sampling, some variation in the typical sample paths are observed as the rule for generating the pp’s is changed. If all exposed lines are given the same probability Žsay 1r2. then the resulting sample paths are somewhat different than those obtained when the exposed probabilities are simply scaled so the largest is 1r2. A solution is to randomize the rule for generating the simulation probabilities. If pj represents the actual probability among the exposed lines, then ppj s 0.5

pj

mj

ž / pmax

Ž 9.

where m j ’s are uniform random variables in the interval 0 to 1. The value m j s 1 corresponds to uniform scaling while a value of 0 corresponds to setting all the values to 1r2. Since the m j ’s are chosen at each step, all combinations are exposed.

4. The algorithm For the following simulations, we use a definition of major disturbance given by NERC to determine the termination of the cascading effect. The loss of 300 MW or more load in any of the four sections of the WSCC equivalent model qualifies the system to be in a state of a blackout. Initially the simulation begins from a base load flow. A line is selected as the triggering event and the following algorithm is repeated N times.

1. Determine all the lines that tripped in the last iteration. 2. Determine all lines connected to the buses of step 1. These are the exposed lines. 3. Check for violations in VAR constraints and find the probability of generator tripping using Fig. 4. 4. If generator protection operates incorrectly, add all lines connected to the bus to the list of exposed lines. 5. Check the frequency of the regions and shed load to maintain system balance. 6. Compute the load flow using the Newton–Raphson method. If it fails to converge within three iterations, use DC load flow. 7. Recompute the impedance seen by relays for exposed lines. 8. Find the probability of tripping for each exposed line using Fig. 3. 9. For the exposed line record, t i s Ł j pj Ł k Ž1 y p k . where j are all lines that tripped and k all lines that did not trip. 10. Record all the lines that tripped. 11. Go to step 1 if any lines tripped and each region are within the 300 MW load loss. Continue until no lines are lost or experience a blackout. 12. If the system fails, determine if t s Ł i t i is a new number or a new sequence of line outages. If so record it. 5. WSCC 179-bus equivalent system The 179-bus WSCC system has 29 generators and 203 transmission lines. The initial load flow data is based on the December 12, 1994 conditions. We chose this particular system rather than a fictional one Ži.e., New England 39 bus. for the sole purpose of testing if the algorithm can pinpoint any weaknesses in a real system. For each simulation, a single transmission line, l o , acts as the initial triggering event. All exposed lines associated with this event have different probabilities of tripping incorrectly as shown in Fig. 3. Probability of a generator tripping is according to Fig. 4. In both, maximum probability of a hidden failure is set at and is the number of iteration per simulation. Each iteration is terminated when load shedding exceeds 300 MW.

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

5.1. Simulation results

265

ated with that sequence. Table 1 shows simulation results for initial triggering event of l o s 200, a transmission line between BenLomnd ŽUT. and Midpoint ŽID.. For any initial event, l o , we generate M

For each initial line out, we obtain a table of sequence of line outages and the probability associTable 1 Sequence of events for initial failure at line 200 Lines out 1 1 1 1 1 1 1 1 154 1 1 1 1 154 1 1 1 1 1 1 155 155 1 156 1 155 1 1 1 1 1 154 1 154 154 1 1 154 1 155 154 154 155 154 154 154 154

4 4 154 4 4 154 154 4 155 154 154 155 154 155 154 156 4 154 4 154 156 156 154 157 156 156 154 154 4 156 154 156 155 156 155 154 154 155 156 156 156 155 156 156 155 155 156

Probability 154 155 155 154 155 156 155 154 156 156 156 156 155 156 155 157 155 156 156 155 157 157 155 158 157 157 155 155 156 158 156 157 156 157 156 155 156 156 157 157 158 156 159 157 156 156 159

156 156 156 156 156 157 156 156 157 157 158 157 156 157 156 158 156 157 157 156 158 158 156 159 158 158 156 156 157 160 157 158 157 158 157 156 157 158 160 158 159 157 160 158 157 157 160

157 157 157 157 157 158 157 157 158 158 159 158 157 158 158 159 158 158 158 157 159 159 158 161 159 159 157 158 159 161 158 159 158 159 158 157 158 159 161 160 160 158 161 161 159 158 161

158 158 158 158 158 159 159 158 159 159 160 159 158 159 160 160 159 159 160 158 160 160 159 162 160 160 158 159 160 162 160 160 160 160 160 160 160 160 162 161 161 159 162 162 160 160 162

159 159 159 159 159 160 160 159 160 160 161 160 160 160 162 161 160 161 161 159 161 161 160 163 161 161 159 160 162 163 161 161 161 161 161 161 161 161 163 162 162 160 163 165 161 161 163

160 160 160 160 160 161 161 160 161 161 162 161 161 161 163 163 161 162 162 160 162 162 161 164 162 163 160 162 163 164 162 162 162 162 162 162 162 162 166 165 163 164 164 168 162 162 168

161 161 161 161 161 162 162 161 162 162 163 163 164 163 164 164 162 163 164 161 165 164 162 165 163 164 162 163 164 165 164 163 166 165 163 163 163 163 168 168 168 168 168 200 163 200 200

162 162 162 162 162 163 163 162 163 163 164 164 165 164 165 165 163 164 165 164 166 166 164 166 164 166 164 165 166 168 166 168 168 166 168 165 168 164 200 200 200 200 200 202 200 0 0

163 163 164 163 163 164 165 163 164 164 165 165 166 166 166 166 165 165 166 165 168 168 165 168 166 168 200 200 168 200 168 200 200 200 200 166 200 168 202 201 201 202 0 0 0 0 0

164 164 165 164 164 165 166 164 165 165 166 166 168 168 168 168 166 166 168 200 200 200 166 200 168 200 201 201 200 201 200 201 201 201 202 200 202 200 0 0 0 0 0 0 0 0 0

165 165 166 165 165 166 168 168 166 166 200 200 200 200 200 200 200 168 200 201 201 201 200 201 200 201 202 202 201 202 201 202 202 202 0 0 0 0 0 0 0 0 0 0 0 0 0

166 166 168 166 166 168 200 200 200 200 201 201 201 201 201 201 201 200 201 202 202 202 201 202 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

168 168 200 168 200 200 201 201 201 201 202 202 202 202 202 202 202 201 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

200 200 201 200 201 201 202 202 202 202 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

201 202 202 202 202 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

202 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2.00 = 10y1 2 3.00 = 10y1 2 3.00 = 10y1 2 5.00 = 10y1 2 1.40 = 10y1 1 1.90 = 10y1 1 2.80 = 10y1 1 2.80 = 10y11 1.67 = 10y1 0 3.49 = 10y1 0 4.30 = 10y1 0 2.80 = 10y9 3.80 = 10y9

266

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

different sequences. In this case, 59 distinct sequences were recorded. Note however, that events involving the same lines but tripping in a different order will have distinct probabilities. Out of these M s 59 lines, only Mˆ contribute significantly to the total probability Ži.e., sum of probability of all sequences.. For l o s 200, only 13 cases exhibit substantial probabilities. The other M–Mˆ sequences contain one of the Mˆ sequences as its subset. Therefore, we can justify using only the Mˆ sequences in evaluating the weaknesses in the system. Note: by the past definition of a major disturbance used in Ref. w1x Žthe isolation of a node during a sequence of relay misoperations., the sequence of lines tend to be short. Most notably, very few sequences in the Mˆ set contained the long string of six or seven events. By using one of the NERC definition of a blackout, Mˆ shown in Table 1 contains longer strings of events. The event with the largest probability contains nine transmission lines with a probability of occurrence at

rˆ s 3.8 = 10y9 for initial probability of p s 0.05. The longest sequence and one with the lowest probability involves 18 transmission lines. If total probability of sequence of events for initial line outage of l o is o

p l s Ý pil

o

Ž 10 .

;i

where i is the ith sample path of total M, then the probability of line k’s contribution to the major disturbance for l o is o

pŽ k < l . s

Ý pil kgi

o

f

Ý

pil

o

Ž 11 .

kgm

where m g Mˆ is the list of sequences that contribute significantly to the total probability. When the initial line outage, l o , is plotted vs. probability of subsequent tripped lines Ži.e., line k given l o ., few lines stand out. If the system has a narrow banded adjacency matrix, then most of the

Fig. 5. WSCC 179-bus system. The right hand axis denotes the initial line out number. The left-hand axis marks the subsequent tripped lines. The z-axis denotes the corresponding probability.

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

267

Table 2 List of transmission lines with the highest probability of hidden failures Initial line

Subsequent line

Bus to

Bus from

Probability

Regions

94 94 94 94 94 13 13 21 21 21 21 107 107 107 107 109 109 109 109 11 11 11 11 13 13

94 198 199 80 83 13 17 7 11 14 21 104 107 173 176 106 109 110 113 7 11 14 21 196 18

Burns Burns Burns2 Grizzly2 Malin2 Moenkop2 Palovrd Navajo2 Moenkopi Moenkopi Fourcor2 Round Mt Table Mt Malin4 Malin Round2 Round3 Table Mt Table Mt Navajo2 Moenkopi Moenkopi Fourcor2 Palovrd Palovrd

Burns Burns2 Summer L Summer L Summer L Westwing Westwing Moenkopi Moenkop1 Moenkop3 Moenkopi Round1 Round2 Round Mt Round Mt Table Mt Round4 Table1 Table Moenkopi Moenkop1 Moenkop3 Moenkopi Devers Westwing

0.0003 0.0003 0.0003 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002 0.0002

SE Oregon SE Oregon SE Oregon SE Oregon SE Oregon NE Arizona NE Arizona NE Arizona NE Arizona NE Arizona NE Arizona California California California California California California California California NE Arizona NE Arizona NE Arizona NE Arizona NE Arizona NE Arizona

activity occurs along the diagonal. In a real power system, no matter how clever the labeling, it is highly unlikely that a tightly banded adjacency matrix exist. For the 179-bus WSCC system in Fig. 5, there are clusters of high peaks around the diagonal with several off diagonal sharp peaks. These are the ‘weak’ lines in the system since they are more prone to contribute to a blackout event. This figure shows that the 179-bus system contains single contingency cases with high probability and lengthy chains of misoperations Žsee l o around 1–20, 100, 150, and 200.. Also viewing the graph from the tripped lines’ perspective, those same areas show weakness. This implies that certain transmission lines are effected by a large number of initiating events. For those reasons, the WSCC system contains several weak links that tend to propagate the initial disturbance. Table 2 is a list of the highest likelihood cases and the corresponding transmission line names involved in a blackout event. The transmission line

between Burns and Burns1 located in southeastern Oregon has the highest probability of being part of a disaster. Each of the four frequency regions was represented in this high probability list. This implies that this experiment, with 300 MW load loss being the blackout definition and the division of WSCC into only four regions, shows frail links in southeastern Oregon, California, and northeastern Arizonar northwestern New Mexico.

6. Conclusion By incorporating an importance sampling based algorithm, this study of cascading protection system failures hopes to illustrate weaknesses in the power system. By monitoring the frequency deviations which enables load shedding and using a NERC definition of a blackout, the study shows that WSCC 179-bus system on December 12, 1994 shows signs of weak links in southeastern Oregon.

K. Bae, J.S. Thorpr Decision Support Systems 24 (1999) 259–268

268

7. Symbols and units p

q

r rˆ pp qq V Vmin Vmax N Q Qmin Qmax M Mˆ lo o pl pŽ k < l

o

.

Probability of exposed line tripping; actual probability of an exposed line tripping Probability of exposed line not tripping; actual probability of an exposed line not tripping Probability of an event occurring Estimate of r Altered probability of exposed line tripping Altered probability of exposed line not tripping Generator bus voltage Generator bus voltage minimum Generator bus voltage maximum Number of iterations of simulation VAR support Minimum VAR support Maximum VAR support Number of distinct sequences of lines failures Subset of M containing majority of probability Initiating line trip Probability of sequence of events for initial line out of l o Probability of line K ’s likelihood of being involved in a major disturbance given l o

Acknowledgements This work was conducted under the NSF grant number ECS-9634823.

References w1x K. Bae, J.S. Thorp, An importance sampling application: 179-bus WSCC system under voltage based hidden failures

w2x w3x

w4x w5x

w6x

w7x

w8x

w9x w10x

and relay misoperations, Proceedings of the Thirty-first Hawaii International Conference on System Sciences, Vol. 3, 1998. S.H. Horowitz, A.G. Phadke, Power System Relaying, Research Studies Press, Somerset, England, 1992. S.H. Horowitz, A.G. Phadke, J.S. Thorp, The role of adaptive protection in mitigating system blackouts, 1995 CIGRE SC 34 Colloquium, Stockholm, 11–17 June 1995. NERC Disturbance Reports, North American Electric Reliability Council, NJ, 1984–1988. C. Tamronglak, A.G. Phadke, S.H. Horowitz, J.S. Thorp, Anatomy of power system blackouts: preventive relaying strategies, ’95 WM 032-3-PWRD, IEEE Winter Meeting, Feb. 1995. C. Tamronglak, S.H. Horowitz, A.G. Phadke, J.S. Thorp, Anatomy of power system blackouts: preventive relaying strategies, IEEE Transactions on Power Delivery 11 Ž2. Ž1996. 708–715. J.S. Thorp, A.G. Phadke, Expose hidden failures to prevent cascading outages, IEEE Computer Applications in Power 9 Ž3. Ž1996. 20–23. J.S. Thorp, A.G. Phadke, S.H. Horowitz, C. Tamronglak, Anatomy of Power System Disturbances: Importance Sampling, PSCC, Dresden, Aug. 1996. Western Systems Coordinating Council Final Report, 2 and 3 July event, 19 September 1996. Western Systems Coordinating Council Final Report, 10 August 1996 event, October 1996.

Koeunyi Bae is currently enrolled in the PhD program in Electrical Engineering at Cornell University in Ithaca, NY. She received her BSEE and Master of Engineering EE in 1994 and 1995 from Cornell. Her research interests include power systems protection and nonlinear dynamical systems. James S. Thorp ŽF, 1989. received the BEE, MS, and PhD degrees from Cornell University, Ithaca, NY. He joined the faculty of Cornell in 1962, where he is currently a Professor and Director of the School of Electrical Engineering. In 1976, he was the Faculty Intern at the American Electric Power Service. He was an associate editor for the IEEE Transactions on Circuits and Systems from 1985 to 1987. In 1988, he was an Overseas Fellow at the Churchill College, Cambridge, England. He is a member of the IEEE Power Systems Relaying Committee, CIGRE, Eta Kappa Nu, Tau Beta Pi, and Sigma Xi.