A framework for analyzing cascading failure in large interconnected power systems: A post-contingency evolution simulator

Electrical Power and Energy Systems 81 (2016) 12–21

Contents lists available at ScienceDirect

Electrical Power and Energy Systems journal homepage: www.elsevier.com/locate/ijepes

A framework for analyzing cascading failure in large interconnected power systems: A post-contingency evolution simulator Ettore Bompard a, Abouzar Estebsari a, Tao Huang a,⇑, Gianluca Fulli b a b

Dipartimento Energia, Politecnico di Torino, Torino 10129, Italy European Commission Joint Research Center, Institute for Energy and Transposrt, P.O. Box 2, NL-1755 ZG Petten, The Netherlands

a r t i c l e

i n f o

Article history: Received 22 December 2014 Received in revised form 15 January 2016 Accepted 9 February 2016

Keywords: Power system security Cascading failures Countermeasure Automatic restoration Decision support

a b s t r a c t The power system protection against different threats has become a key and growing concern. A materialized threat provokes a sequence of chained events and counteractions in the grid. The simulation and analysis of the cascades leading to blackouts are extremely intricate due to various time scales, multiple interacting automatic and human-driving actions, and the large set of possible countermeasures. The possibility to simulate the cascading events, considering both behaviors of the system and human/automatic actions, is crucial for designing protective strategies, guiding investments and supporting policy decision making on reinforcing the system. In this paper, we present a simulation framework which, with a steady-state approach, provides system snapshots during cascading failures, taking into account the actions for minimizing the load-shedding or maximizing the restoration of the unserved loads. The conceptual framework is implemented as a software tool to simulate system behaviors and actions like automatic countermeasures, human interventions and optimal operational strategies to defend and restore the system. Combined with a suitable economic assessment method, it can be used to evaluate investments in countermeasures and the potential costs of different threats. It has been applied to study the countermeasures to enhance the security of the EU power transmission network. Ó 2016 Elsevier Ltd. All rights reserved.

Introduction Infrastructures such as electric power, gas and oil networks, water networks, transportation networks, and telecommunication and computer systems are becoming increasingly interconnected with each other. This means that a threat to one infrastructure may rapidly create a global effect by cascading into other infrastructures [1]. Among all these infrastructures, electrical networks are becoming more and more critical, by themselves and for the operation of other infrastructures. Moreover, the growing interconnection and integration of variable generation sources has made the vulnerability of all other networks more dependent on electricity system security [2]. For example, in the 2003 Northeast Blackout, water pressure was lost due to lacked pumps power; all the trains running into and out of New York were shut down; cable television systems were out of order due to the loss of backup power; and cellular telecommunication was disrupted [3]. ⇑ Corresponding author. Tel.: +39 0110907117; fax: +39 0110907199. E-mail addresses: [email protected] (E. Bompard), abouzar.estebsari@ polito.it (A. Estebsari), [email protected] (T. Huang), [email protected] (G. Fulli). http://dx.doi.org/10.1016/j.ijepes.2016.02.010 0142-0615/Ó 2016 Elsevier Ltd. All rights reserved.

Today the electrical power systems on one hand are growing in complexity and vulnerability due to the amount of information exchanged, the new operational methods developed and the extensive use of smarter equipment. On the other hand, along with the traditional threats such as natural, accidental or malicious threats, new threats are emerging [4]. With large scale penetration of renewable energy sources (RES) into power grids, the transmission system faces more risks due to their intermittent nature, thus more attention is being paid on the development of transmission grid, striving to make it more intelligent and more suitable for the transmission of large energy quantities over far-away distances. At least 20% of European energy has to be supplied by renewable sources by 2020 according to the recently adopted European renewable Directive 2009/28/EC. European electricity markets are expected to produce 30–35% by 2020 of its supplied energy by means of renewable resources such as wind and solar power, which are by their nature intermittent, less predictable and more geographically distributed [5–7]. Nowadays, the trial and adoption of innovative paradigms and technologies (such as distributed generation, smart grids and super grids) at infrastructural, operational, market and environmental level, along with fossil energy resources scarcity, energy demand

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

increase, and energy market liberalization, seriously challenge power system security [8–12]. Security of electricity networks is one of the key objectives in the planning and operation and needs to consider the most credible threats to the power systems. In a single area such as a national power grid with a single transmission system operator, the security of the grid may not be as critical as a transcontinental network because in multi-area networks, like the ENTSO-E, neighboring grids may affect one another in case of facing abnormal situations. The evolution of a blackout may be controlled and even stopped in an area; however in the neighboring areas it may lead to severe problems [13]. Moreover, electricity exchange between different areas in a transcontinental network is increasing nowadays due to the increase of power trading. Such concerns make power system analysts paying more attention to the system security [13]. In order to prevent catastrophically unexpected effects to various aspects such as society, economy and industry, power system cascading failures have been studied more seriously in the recent years to urge engineers and scientists to pay more attention to the reasons of power outage. Many investigations have already indicated that cascading failure is one of the main reasons of blackouts [1,14–20]. Identifying the chain of events and finding out how they combine into cascading sequences is getting challenging nowadays [4,21,22,25,27,28]. As the conventional power system security analysis methods are mainly based on multiple case studies with a limited prediction of operational states, cascading failures in the interconnected power system operations can cause large-scaled blackouts. Moreover, most of the existing methods evaluate the consequences for a given contingency considering only one of the phenomena, and it has always been difficult to model and analyze successive combinations of the phenomena. Current standard stability analysis tools such as TRELSS [23], Static Security Assessment programs [24], Transient Security Assessment tools [25,29], Voltage Security Assessment programs [30,31] or Small Signal Analysis programs [32,33] usually focus on the electrical phenomena and often do not model protection in spite of the fact that protections in blackout are crucial [34]. In practice, the operation of the power system reacts to the incidents based on lessons and experiences learned from similar blackouts or simulation results from that noncomprehensive software. Existing tools to simulate system status can only cover a limited set of contingencies. Therefore, it is imperative to have a simulation tool which can not only reproduce the blackout but also predict the chain of events of a blackout before it happens as well as derive the best restoration strategies if necessary. Therefore, power systems modeling and planning requires advancement of the conventional security analysis methods [35,36]. Considering load curve, switching actions, time-based automatic operations and human interventions, power system operational conditions change over time; however the present protective systems and invested countermeasures are all designed without adapting to these changes. Even in the offline studies, it is still challenging to find out when and under what situations they should react how. In this paper, we introduce a conceptual framework, implemented in a software tool, to simulate the evolution of failures in a power system along with modeling a large set of current automatic remedy actions and optimal operational human decisions. Besides, operative strategies based on the expertise of the user can be applied through the human intervention interface; it can also be used to simulate human errors during the blackout development. The remainder of this paper is organized as follows. In Section ‘A framework for the simulation of post-contingency evolution’, the conceptual framework is introduced along with the main

13

objectives and its components. In Section ‘Structure of postcontingency evolution simulator’, the structure of the framework, including the modules such as scheduler, automatic measures and optimal operation decision, and functions are presented. In S ection ‘Application of PCES’, an application of the proposed framework for power system security reinforcement is discussed. In Section ‘Case study’ we demonstrate an illustrative case based on the IEEE 30-bus system to demonstrate the validity of the concept and related software. Conclusive remarks are given in Section ‘Conclusion’.

A framework for the simulation of post-contingency evolution In this section, we briefly introduce the designed simulation framework, its key components and the conceptual considerations. We developed a framework named Post Contingency Evolution Simulator (PCES) to chronologically simulate the sequence of post-contingency failures (‘‘cascading failure”) and the restoration actions over time, under simplified hypothesis that the evolution of the network can be modeled as a sequence of equilibrium derived from a steady-state model of the system, which besides the common simplified conceptual elements (generators, branches, loads), also includes capacitor and shunt inductor banks, FACTS devices and DC lines, phase shifters, and pumped-storage stations. Hence the framework can be used to check the existence of a new equilibrium point, after a series of events, considering both decisions from automatons, e.g. protections, automatic controllers, etc., and from humans modeled as optimal decision making in terms of minimizing the load shedding or maximizing load pick up. We consider the system power-frequency characteristic for the entire system, including generator droop and load frequency response, under a simplified steady-state approach when applying system frequency control. In case of islanding, the powerfrequency characteristics are dynamically assigned to each island. The first set of actions of the system during the evolution of a contingency represents the ‘‘first-stage reaction” which implements automatic responses (component-wise protection relays, system voltage controllers, frequency control system), and time-based human interventions (changing the status or settings of generators, pumped-storage stations, transformers, protections, FACTS, etc). If this reaction cannot lead to a new equilibrium or the new equilibrium implies a loss of load with respect to the load curve, a ‘‘second-stage reaction” is undertaken. This reaction is aimed at minimizing the load shedding and accelerating the load restoration resorting to a set of strategies, in which loads are kept as much as possible according to different levels of priority and their possible contributions to the acceleration of system restoration. An extended network model is provided as an input in terms of network topology and parameters, protection settings, restoration time (specifying after how long an element can be put into use again), and the related restoration cost. Additional inputs include load curve, a set of countermeasures and simulation parameters (second-stage reaction initiating time, simulation end-time, etc.). The evolution of the system is initiated by a triggering event that can be selected from a list of contingencies. Triggering events represent the materialization of one or more threats [25,26]. For example, a flood as an instance of a natural threat may destroy some buses, disconnect some lines and trip some generators in the physical layer. As shown in Fig. 2, after the triggering event occurs, the system automatically reacts to the failures by means of protection relays and automatic control units. This process also involves some actions applied by time-based human interventions.

14

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

A scheduler is designed to control and schedule triggering events occurrence, all system time-dependent automatic protections, load curve following and system component settings modification as a flexible model of human driven actions as well as initiating the ‘‘second-stage reaction”. A system feasibility check, in terms of network integrity, frequency deviation, bus voltages and line flows violation, is performed at each discrete time-point programmed in the scheduler. Appropriate actions are undertaken at the same time-points to allow the simulation of the system evolution (Fig. 1). The PCES enables the assessment of the ‘‘physical” impacts of different triggering events on the system, basically in terms of unserved energy and extra-operational cost (cost incurred to mitigate the impact of the events), which provides a basis for an economic assessment of the considered contingencies. It provides a way of considering different countermeasures and ranking them in terms of cost-effectiveness to identify the most effective ones. The tool along with an appropriate economic assessment tool can be used to facilitate the decision-making in the area of power systems security. System operaonal status

0 0

Structure of post-contingency evolution simulator The structure of the PCES includes three key modules: scheduler, first-stage reaction and second-stage reaction. Fig. 2 shows the overall conceptual representation of the PCES. Scheduler The scheduler dynamically manages the sequence of actions, from the initial triggering event to the final equilibrium of the system passing by a set of automatic and human driving interventions (first and second stage reactions). The simulation time is discretized mainly by the user-defined time steps into a sequence of time-points used to create system snapshots (Fig. 1). The scheduler would also dynamically insert necessary time-points, provoked by special events during the simulation. Therefore, the evolution of the system status can be replayed through the snapshots recorded at each time-point. At each of them, changes in the system configuration or parameters call the power-flow or optimization calculation to assess the system state. The effects of

Second-Stage Reacon iniang me

Iteraon interval of First-Stage Reacon

Simulaon end me

Time [min]

Iteraon interval of Second-Stage Reacon

Just aer triggering events: System operaonal status modified Before triggering events: System in normal operaonal status Fig. 1. Time scheduling, triggering event and reactions.

Fig. 2. Conceptual represent of PCES.

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

various events and reactions would be examined only at the closest time-point after they happen. First-stage reaction First-stage reaction covers the time-span from the triggering event to the intervention of the operator and aims to minimize the load shedding. The module updates the status of the system, when triggering events, cascading effects, load changes, automatic countermeasures (protections) take place. The main reactions/ functions considered are: frequency control, voltage control, component-wise protections, automatic load shifting, human operational intervention, and system feasibility evaluation. The PCES can handle the network islanding. If the system is split into several islands due to the opening of lines (either resulted by triggering events or protection actions), they can be treated separately. Then, through restoration plans, islands may get integrated. In the case of blackout, black-start procedures can be implemented in both the entire system and individual island. System frequency control To model the daily operation of Transmission System Operators (TSOs) for load-frequency control and reserve management, we designed a module for monitoring generation-consumption balance and assuring secure operation of the synchronous areas [31]. Various sequenced actions to restore frequency in case of deviation are undertaken, including spinning reserve (such as primary control and secondary control), cold reserve and automatic/ manual under frequency load shedding, over frequency generator tripping. Given the power-frequency characteristic of the whole system (or of the island considered), measured by Ks (MW/Hz), we compute the frequency deviation Df (1) where DPs is the power imbalance, and DPt is the power exchange on tie-lines. Based on the input droop Kgi (2) [31] of generator i for primary control, we compute its power adjustment DPgi (3), where Pri is the rated power of generator i and fr is the reference frequency. In our modeled primary control, the self-regulation of the load is assumed to be 1%/Hz [31], which means a load decrease of 1% occurs in case of a frequency drop of 1 Hz.

Df ¼ ðDPs  DPt Þ=K s

ð1Þ

K gi ¼ Df  P r =ðf r  DPgi Þ i 2 N g

ð2Þ

DPgi ¼ Df  P ri =ðf r  K gi Þ i 2 N g

ð3Þ

Secondary frequency control involves selected generators (or loads), which respond to automatic generation control (AGC) signals centrally provided from the TSO. The power adjustment of generator i, under secondary control, is computed by (5) where Ri (MW) is the regulation band of generator i, A (4) is the area control error (ACE), deviation for secondary control and Na is a set of all generators under AGC (i 2 Na) [31]. Y is the output signal of AGC controller which is a function of ACE (5). b is the proportional factor (gain) of the secondary controller and Tr is the integration time constant of the secondary controller [33].

A ¼ DP s þ DP t ,

DPgi ¼ Y  Ri

ð4Þ n X Ri i¼1

! where Y ¼ b  A 

1 Tr

Z A  dt

ð5Þ

In our PCES constraints related to the AGC ramp rate (MW/min) and generators’ maximum/minimum output are considered. In addition, both automatic and manual under frequency load shedding is modeled. For automatic under frequency load shedding

15

(UFLS), a stepwise scheme based on the ENTSO-E regulation [32] is implemented; however PCES allows customizing load-shedding schemes. Manual load shedding is designed to shed the userdefined percentage of load in the following cases: insufficient automatic under-frequency load shedding, inability to restore or maintain proper generation-load balance or inability to increase frequency by solo adjusting generation to permit synchronizing with other areas. In case of under-frequency, cold reserve generators are put into service based on a preset startup time. The pumped-storage stations, based on the deviation, can be switched among generator, load or out-of-service modes. Component wise protection systems We model the main protections of the systems components. For all the parallel-connected components (generators, loads, capacitor/inductor banks, SVC, STATCOM, etc.) we considered under/over voltage relays and for all branches between two buses (such as lines, transformers) the overflow (max current) relay is modeled with different delays based on different thresholds. Moreover, under/over frequency relays are also modeled for the generators. Voltage control We consider AVR for each generation to keep the voltage to its set point as far as reactive generation limits allow. Undervoltage load shedding (UVLS) [41] is implemented as well by considering undervoltage relays located at some critical buses with predefined voltage drops and corresponding percentages of automatic load shedding [42]. Human interventions It provides the maximal flexibility of PCES functionalities extension to model human behaviors on the system. User’s expertise and experience can be easily passed to the simulation through this option. This option, implemented as one of ‘‘scheduler” submodules, allows user to set new values for all adjustable equipment parameters, specifying at which time after triggering event they should be executed. Second-stage reaction Second-stage reaction module targets at the establishment of new system equilibrium, the loads and system restoration, and the black start. As soon as the PCES reaches the initiating time of the secondstage reaction, it firstly checks if the new equilibrium point has been established, if not, it tries to find a feasible solution for the system by minimizing load shedding. This is done by means of optimization modeling, prioritizing loads and considering all islanded or isolated areas. The optimal operational status is quickly achieved so that in each island, the system is feasible even if the whole system cannot be integrated. A 3-step procedure of load restoration has been adopted considering load priority. Each load is assumed to have an interruptible portion and a prioritized proportion. In the prioritized portion, part is shedable by UFLS (e.g. in ENTSO-E, 50% of loads are shedable [32]) while the rest cannot (Fig. 3). The 3-step procedure can be articulated as follows: S1 – restore all prioritized loads and try to restore as much as possible the rest. S2 – restore all the non-shedable loads and try to restore as much as possible prioritized loads. S3 – restore as much as possible loads regardless of their priorities.

16

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

Interrupble Priorized Load [MW] Demand

0

Application of PCES

Shedable Fig. 3. Load priorities for step-wise restoration procedure of PCES.

Islands may get integrated during the restoration, depending on branches’ re-closure time. Generators enabled for blackstart are flagged and prioritized; we consider various technical constraints such as technical limits for rotating machines (generators minimum/maximum active/reactive power, ramp rate) and operational constraints (reserves, voltage level regulation and reactive power management). Let us assume i to be a generic bus, i 2 N set of the buses, Ns # N is the set of shedable load. Similarly, we assume k to be a generic branch connecting bus i to bus j where {i,j} # N and k 2 L set of branches. The decision making for minimizing the load shedding, for a given operative condition, can be formulated as an OPF (6).

min

P gi ;Q gi ;DP di ;DQ di

X ðDP2di Þ i 2 N s

ð6Þ

i

The equality constrains are the power flow Eqs. (7)–(10).

Pgi  ðPdi  DPdi Þ ¼ V i

n X

V j ðGij cos hij þ Bij sin hij Þ; i 2 N s

ð7Þ

n X V j ðGij sin hij þ Bij cos hij Þ; i 2 N s

ð8Þ

j¼1 j–i

Q gi  ðQ di  DQ di Þ ¼ V i

j¼1 j–i

Pgi  Pdi ¼ V i

n X V j ðGij cos hij þ Bij sin hij Þ; i 2 ðN  N s Þ

ð9Þ

j¼1 j–i

Q gi  Q di ¼ V i

n X V j ðGij sin hij þ Bij cos hij Þ; i 2 ðN  N s Þ

ð10Þ

j¼1 j–i

where Pgi (Qgi) is generator i active (reactive) output, Pdi (Qdi) is active (reactive) load on bus i. DPdi (DQdi) are active (reactive) loads going to be shed. Vi and hi are bus voltage magnitude and angle. Gi and Bi are the elements of bus admittance matrix. The inequality constraints are (11)–(13): min min Pmin < Pgi < Pmax < Q gi < Q max 6 V i 6 V max gi ; V i gi gi ; Q gi i

ð11Þ

where i 2 N. And for the shedable load on bus i 2 Ns (12):

0 6 Pdi 6 Pmax di ;

0 6 Q di 6 Q max di

ð12Þ

; jSk j 6 Smax k

k2L

ð13Þ

DPdi ¼ Ci; DQ di

i 2 Ns

ð14Þ

(14) is related to the assumption the loads are kept with a constant power factor. The 3-step restoration procedure is formalized as an optimization problem:

min

P gi ;Q gi ;DP di ;DQ di

X

 P2dpi ;

i 2 Np

constraints are (11)–(13), in which DPi and DQi are substituted by – Pdpi and – Qdpi respectively. Ns is also substituted by Np # N as set of buses in which load is being restored.

ð15Þ

PCES can be applied as a crucial component of a decision support system for network reinforcement and operation based on a cost/ benefit analysis (Fig. 4). The architecture of the software system is developed in a fully generic approach in such a way that the tool can be applied to different scales of power networks, national, regional, and continental [42–44]. Upon materialization of a threat (triggering event), the system would, eventually, experience unserved energy for a given amount of time that can be translated into economic losses. Different types of long-term countermeasures (i.e. investment on new lines or generators, adding FACTS devices, etc.) can be considered and their benefits, in terms of the reduction in the cost of unserved energy, can be compared with the needed investments to rank them and find the best tradeoff. Also the impacts of on-line measures (relay settings, etc.) can be studied. The overall architecture of the decision support system, based on PCES, is depicted in Fig. 4. Network modeling and optimal operational decision layer provide the physical impacts of threats to the existing network considering also possible countermeasures. Besides the network data in study, the input also consists of a threat catalog (Threats Cata.) and a countermeasure catalog (Cou. Mea.Cata.). The threats catalog is a set of possible threats against the network in study; and the countermeasure catalog includes new interesting remedy actions, protection schemes and enhancement, investment options, etc., as decision variables of the decision support system. A possible threat from the pre-defined catalog, brings the system, after the first-stage reaction, to the S0 status. Then second stage reactions will take place, as described in the previous section, bringing the system into a new status S1i, in which the impact of the triggering event in terms of unserved energy and extra operational cost is assessed (I1i) with the related economic loss L1i. Extra operational cost is the additional cost due to the adjustment in the generator and load power to mitigate the effects of the triggering event. A countermeasure Ci, from the pre-defined countermeasure catalog, can be implemented and the reaction to the same triggering event will move the systems to the Si2 status, to which correspond impact I2i, and loss L2i. The implementation of a countermeasure Ci would have investment cost Mi. Finally, the decision making layer performs a trade-off analysis between the losses and countermeasures to provide the best option T, based on the ranking of the different countermeasure in terms of the benefit they provide with reference to their costs. The described framework has been implemented as a decision support system software for the SESAME project (https://www. sesame-project.eu/) and applied to two national interconnected networks, i.e. Austrian and Romania. The Austrian case is a simplified transmission networks, around 50 buses with interconnections to 5 neighboring countries; while the Romania case is the real data set used by the Romania TSO and contains both the transmission and distribution networks with around 1000 buses. However, due to the sensitivity issues of the applications to the real networks, the results cannot be revealed to public. In the next section, we will use an IEEE-30 bus test system to demonstrate the main capabilities and results of the PCES. Case study

i

where Pdpi is the amount of load which is going to be restored at bus i. The equality constrains are (7)–(10) and (14) and the inequality

We present an application of PCES to a simple test case to show the main features of the tool. We use a modified IEEE 30-bus study

17

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

Fig. 4. PCES in a decision support system for power system security.

G

G 2

1

18

15

19

14 3

4

28

G

13 8 9

6

7

12

5

11

26

17

16

10

20

G

25 22

21

23

24 29 G

30

G

27

Fig. 5. Study case topology including triggering event and invested lines.

case [19,36]. The base power flow solution [37,38] has been modified to ensure n  1 contingency compliance. The triggering event is the loss of the generator at bus 27 and its impact is assessed in the base case and in the case with two additional lines (between bus 15 and 23, 10 and 22) built (Fig. 5). With respect to the standard systems, we need to add additional parameters (protection settings, restoration time and costs, generation droop, etc.). The general settings for PCES are reported in Table 1. The system load curve is reported in Fig. 6.

We assume that a technical failure trips out the generator on bus 27, with an active power output of 45.2 MW, at 7:52 am when the total active demand is 189.2 MW. The behavior of the system, for a total duration of 70 min, is simulated considering both firststage and second-stage reactions, in the base case (without the two additional lines) and in the case with countermeasures (with the two additional lines). Considering the time points set by the scheduler (every 10 min) and the changes in the load (discretized 24-h load curve, Fig. 6)

18

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

the frequency back to almost 50 Hz. At this point, a load increase around 20% causes again power deficit which cannot be compensated by the other 5 generators so more load shedding is required. The behavior of generators, in terms of power output, is represented in Fig. 9. Under frequency automatic load shedding sheds loads from 7:52 to 8:00 due to power imbalance caused by tripped generator, and during the time interval 8:00 to 8:10 due to power imbalance caused by demand increase (Fig. 8). From 8:10 to 8:20, system frequency is 50 Hz so no more UFLS is required. From 8:20 to 8:22, disconnection of 6 lines (Fig. 7) creates two islands and one isolated bus (bus 8). One island as shown in Fig. 7 is completely in blackout and at 8:22 (before second-stage reaction initiation) there are only three generators in service (1, 2, 13). With countermeasure: Disconnection of lines 10–22 and 15–23 separates a region from the rest of network, in which there is a remarkable power imbalance due to the generator lost at bus 27. This imbalance causes a considerably frequency deviation which triggers other generators frequency protection system resulting in a local blackout. To mitigate this effect, a countermeasure investment for two additional lines (10–22 and 15–23) can be considered. The effect of the loss of generator 27 is, in this case, shown in Table 2, and Fig. 9 b. The total unserved energy is 79.52 MWh. The extra operational cost is also calculated for each snapshot (Table 2). Without countermeasure, generator on bus 27 is shut down after 7:520 while others increase their output due to primary and secondary control until 8:200 . With countermeasure, except for

Table 1 Summary of network data. Total capacity Total initial demand Second-stage reaction initiating time Time interval for each first-stage reaction calculation Time interval for each second-stage reaction calculation Simulation end time Time of loss event Loss percentage of supply System base MVA System reference frequency

280 MW 189.2 MW 30 min 10 min 15 min 70 min 07:52 20% 100 MVA 50 Hz

PCES provides 8 different snapshot of the system in terms of frequency, bus, branch and generator operation status, islanding information, unserved energy to each load, time, interval, etc. (Table 2). The snapshot evolution can serve for different purposes (i.e. frequency tracking, islanding, congestions, load profile, generators variation versus time); we focus here, as an example, on the unserved total energy amount with and without the countermeasure of new lines. A rough cost-benefit analysis is as well briefly introduced. Without countermeasure: The tripping of generator on bus 27 causes a power deficit in the system which creates an under frequency condition. The frequency drops to 47.62 Hz, based on the system power-frequency. At 8:00 AM, secondary and primary frequency control along with the automatic load shedding brings back

At 7:52 Triggering event occurs

Simulation ends at 9:02

Total Demand [MW]

300 250 200 150 100 50 0 0

1

2

3

4

5

6

7

8

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 Time [hour]

Fig. 6. Assumed load curve for the study case.

Table 2 Snapshot description of the scenario simulation (Italic number for case with countermeasures). Clock time

Time (min)

Description of snapshot Total generation (MW)

7:52 7:52 8:00 8:10 8:20 8:22 8:37 9:02

0 0+ 8 18 28 30 45 70

Total served load (MW)

No. of islands

Extra operational cost (monetary unit)

w/o

w

w/o

w

w/o

w

w/o

w

191.9 146.6 170.6 186.4 187.2 117.5 137.4 143.5

191.7 146.6 169.3 184.8 185.4 162.3 180.8 188.9

189.2 189.2 165.3 181.2 181.2 125.2 135.7 141.7

189.2 189.2 165.3 181.2 181.2 152.4 178.9 185.7

1 1 1 1 1 3 1 1

1 1 1 1 1 2 1 1

0 0 194.2 414.3 408.8 176.8 1172.7 1973.3

0 0 193.3 414 408.6 131.3 594.4 1050.2

19

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

G

3

28

7

9

G

13

12

5

17

16

10

G

25 22

G

19

14

11

26

18

15

4

6

8

G

2

1

20 21

G

30

29

27

23

24

BLACKOUT RREGION

Fig. 7. System snapshot at 8:22.

Rao of supplied to demand [%]

100

80

60

SecondStage Reacon

40

First-Stage Reacon 20

0

7:52

7:52

8:00

8:10

8:20

8:22

8:37

9:02 Time [min]

Buses 2, 3, 4, 7, 10, 12, 14, 15, 16, 19, 20, 21 without C All loads (except on bus 8, 26, 29) with C Bus 8, 23, 24, 26, 29 without C Bus 18 without C Bus 30 without C Bus 17 without C Bus 8 with C Bus 26 & 29 with C Fig. 8. Ratio of supplied load to demand considering load curve – with and without countermeasure (C).

the lost generator, all the others would keep supplying the load; the unserved energy with countermeasure is 49.44 MWh, around 38% less than in the case without countermeasure. In Fig. 8 the percentage load shedding for different bus sets, without and with countermeasures are reported. In the case with countermeasure, after initiating second-stage reaction, all loads (except on 3 buses) are restored to the expected demand values according to the load curve however in the case without countermeasure loads on some buses such as 18, 23 and 24 lose supply. The two situation (with/without countermeasures) can be compared contrasting the different unserved energy with the investment (building new lines) and operational costs (increased power output requires to on-operation generators and cost for cost shedding).

In order to monetize the impact of the countermeasure on the level of security of supply, the total cost (including extra operational cost and socio-economy cost) with and without applying countermeasure can be compared. The extra operational cost is calculated by PCES (Table 2). The calculation of economic losses is debatable. To illustrate the application of PCES we consider the value of unserved electrical energy as set out of Italian Regulator 3000 €/MWh [39]. In our case study the value of the economic loss would be respectively 148,320 € and 238,560 € with and without countermeasure. Neglecting the small amount of extra operational cost, 90,240 € represents the avoided costs due the implementation of the countermeasure. The comparison of the avoided cost with the cost of countermeasures provides the basis for a cost/benefit analysis that is outside the scope of this paper [40].

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

Normalized generator power w.r.t rated power [%]

20

bus 1

bus 2

bus 22

bus 23

bus 13

100 90 80 70 60 50 40 30

SSecondecondStage Stag ge Reacon Reac on

First-Stage Fir irst--Stag ge Reacon Reeaco on

20 10 0 7:52

7:52

8:00

8:10

8:20

8:22

8:37

9:02

Time [min]

(a) Normalized generator power w.r.t rated power [%]

bus 27

bus 1

bus 2

bus 22

bus 27

bus 23

bus 13

100 90 80 70 60 50 40 30

SecondStage Reacon

First-Stage Reacon

20 10 0 7:52

7:52

8:00

(b)

8:10

8:20

8:22

8:37

9:02

Time [min]

Fig. 9. Normalized generator power w.r.t rated power (%) (a) without countermeasure and (b) with countermeasure.

Conclusion Modeling the evolution of a power system after the materialization of a threat is crucial for assessing the ‘‘level of security”. Although the ‘‘absolute secure” system does not exist, the investment can increase level of security to a reasonably expectation constrained by the limited finical resources to procure operational and structural countermeasures against a large set of possible threats. The decision on the implementation of a set of selected feasible countermeasures needs to be taken through a scientific evidence based approach. Therefore, a proper-approached software tool to model the behavior of the system in response to the materialization of various threats is needed to assess the physical impacts in terms of unserved energy and related costs. In this paper, we presented our developed tool which is able to perform a cost-benefit analysis via comparing the costs of an incentivized threat with and without the countermeasures in terms of prevented economic losses and investment.

The simulation tool can capture the behaviors of the system after an adverse event considering different countermeasures. It checks the existence of a new equilibrium point, after a series of events, considering both decisions from automatic protection and control systems, and human driving optimal decision. The optimal decision making module of the proposed framework can also be served as a restoration and recovery support tool during severe situation. The optimal operational status can be quickly achieved so that in each island, if possible, the isolated system can feasibly function. By applying different countermeasures from the catalog, the tool would eventually provide sound scientific evidences for the decision maker to possibly allocate the limited resources in a best way thanks to the Post-Contingency Evolution Simulator. Acknowledgments This paper has been produced with the financial assistance of the SESAME project (a FP7-security project co-funded by the European Commission with grant number 261696, aiming at providing a

E. Bompard et al. / Electrical Power and Energy Systems 81 (2016) 12–21

contribution to the development of tools and a regulation framework for the security of the European power grid against natural, accidental and malicious attacks. https://www.sesame-project.eu/). References [1] The North American Electric Reliability Corporation [Internet]. 2011 long term reliability assessment; 2011 November . [2] Mili L, Qiu Q. Risk assessment of catastrophic failures in electric power systems. Int J Critical Infrastruct 2004;1(1). [3] US-Canada Power System Outage Task Force. Final report on the August 14, 2003 blackout in the United States and Canada: causes and recommendations; 2004 April [4] Bompard E, Huang T, Wu Y, Cremenescu M. Classification and trend analysis of threats origins to the security of power systems. Int J Elect Power Energy Syst 2013;50:50–64. http://dx.doi.org/10.1016/j.ijepes.2013.02.008. ISSN 01420615. [5] EURELECTRIC. Integrating intermittent renewables sources into the EU electricity system by 2020: challenges and solutions; 2010 . [6] Battaglini A et al. Development of SuperSmart Grids for a more efficient utilisation of electricity from renewable sources. J Clean Prod 2009;17 (10):911–8. [7] Cailliau M, Foresti M, Villar CM. Winds of change. IEEE Power Energy Magaz 2010;8(5):53–62. [8] Zhang XP, et al. Towards European smart grids. In: Power and energy society general meeting, 2011. IEEE; 2011. [9] Jiang Zhenhua, et al. A vision of smart transmission grids. In: Power & energy society general meeting, 2009. PES ‘09. IEEE; 2009. [10] Van Hertem D, Ghandhari M, Delimar M. Technical limitations towards a SuperGrid—a European prospective. IEEE; 2010. [11] Ahmed N, et al. Prospects and challenges of future HVDC SuperGrids with modular multilevel converters. IEEE; 2011. [12] Hammons TJ, et al. State of the art in ultrahigh-voltage transmission. In: Proceedings of the IEEE, vol. 99. p. 1–31. [13] Karas J, Sulamaa P. The increasing scope and authority for power exchanges. Elforsk report; June 2013. [14] Shi LB, Shi ZY, Yao LZ, et al. A review of mechanism of large cascading failure blackouts of modern power system. Power System Technology, 3rd ed., vol. 34; March 2010. p. 48–54 [15] Mei SW, Xue AC, Zhang XM. The self-organized criticality of power system and the safety of huge power grid. Beijing: Publisher of Tsinghua University; 2009. [16] Chen J, Thorp JS. A reliability study of transmission system protection via a hidden failure DC load flow model. In: Power system management and control; April 2002. [17] Parrilo PA, Lall S, Paganini F, et al. Model reduction for analysis of cascading failures in power systems. In: American control conference. San Diego, California; June 1999. [18] Li SH, Ding M, Wang M, et al. Search of power system chained failure mode considering uncertainty of element fault and performance of protective relaying. Power System Technology, 13th ed., vol. 28; July 2004. p. 27–31, 44. [19] Dobson I, Carreras BA, Newman DE. A probabilistic loading dependent model of cascading failure and possible implications for blackouts. In: Hawaii international conference on system sciences. Maui, Hawaii; January 2003. [20] Carreras BA, Newman DE, Dobson I, et al. Evidence for self organized criticality in electric power system blackouts. In: Hawaii international conference on system sciences. Maui, Hawaiil January 2001.

21

[21] Li J. Identification of cascaded generator over-excitation tripping events. M.S. Thesis. Iowa State University; 2007. [22] Liu CC, et al. Learning to recognize the vulnerable patterns of cascaded events. EPRI Technical Report; 2007. [23] Zhang P. TRELSS application manual for cascading failure, reliability, and deterministic analysis. EPRI Technical Update Report; October 2003. [24] NERC Model Validation Task Force of the Transmission Issues Subcommittee. Power system model validation, a NERC white paper; May 28, 2010. [25] Huang T, Voronca SL, Purcarea A, Estebsari A, Bompard E. Analysis of chain of events in major historic power outages. In: Advances in electrical and computer engineering, AECE, 2014, Issue 3. p. 1844–7600, ISSN: 1582–7445, e-ISSN, doi:http://dx.doi.org/10.4316/aece. [26] Pieters Wolter, van der Ven Sanne HG, Probst Christian W. A move in the security measurement stalemate: elo-style ratings to quantify vulnerability. In: Proceedings of the 2012 workshop on New security paradigms. ACM; 2012. [27] Dechesne F, Pieters W, Lukszo Z, Bompard E, Huang T, Estebsari A, et al. D4.1 system specification of decision support system. Deliverable of the FP7 SESAME Project. [28] Bompard E, Cremenescu M, Estebsari A, Huang T, Wu Y, Zelastiba D, et al. Analysis of historic outages. Deliverable D1. 1, FP7 SESAME Project. [29] Sauer PW. Post-contingency equilibrium analysis of power systems. In: 35th Hawaii international conference on system sciences; 2002. [30] Medvedeva-tšernobrivaja V, Attikas R, Tammoja H. Characteristic numbers of primary control in the isolated Estonian power system. Oil Shale 2011;28 (1S):214–22. [31] ENTSO-E Operation Handbook. Policy 1. Load-Frequency Control and Performance. [32] ENTSO-E Operation Handbook. Policy 5. Emergency Operations. [33] ENTSO-E Operation Handbook. Policy 1. Appendix 1. Load-Frequency Control and Performance. [34] Initial review of methods for cascading failure analysis in electric power transmission systems. IEEE PES CAMS task force on understanding, prediction, mitigation and restoration of cascading failures. IEEE power engineering society general meeting. Pittsburgh (PA), USA; July 2008. [35] Chang Liang, Wu Zhigang. Performance and reliability of electrical power grids under cascading failures. Int J Elect Power Energy Syst 2011;33(8):1410–9. [36] Kalyani, Swarup KS. Pattern analysis and classification for security evaluation in power networks. Int J Elect Power Energy Syst 2013;44(1):547–60. [37] Ferrero RW, Shahidehpour SM, Ramesh VC. Transaction analysis deregulated power systems using game theory. IEEE Trans Power Syst 1997;12(3):1340–7. [38] Alsac O, Stott B. Optimal load flow with steady state security. IEEE Trans Power Apparatus Syst 1974;PAS 93(3):745–51. . [39] http://www.autorita.energia.it/allegati/docs/08/203-08arg.pdf. [40] Schmidthaler M, Reichl. Eliciting the economic value of electricity supply security – A European valuation. In: Proceedings of Cigré symposium Auckland on 16–17th September 2013; 2013. [41] Charles Mozina. Undervoltage load shedding. Beckwith Electric Co., Inc. [42] Estebsari A, Pons E, Huang T, Bompard E. Techno-economic impacts of automatic undervoltage load shedding under emergency. Elect Power Syst Res 2016;131:168–77. http://dx.doi.org/10.1016/j.epsr.2015.10.016. ISSN 03787796. [43] Doheijo Lozano E, Estebsari A, Friedl W, García Gutiérrez F, Huang T, Mateos García I, et al. D6.1 Report on trial application I, Austrian Network. Deliverable of the FP7 SESAME Project. [44] Cremenescu M, Doheijo Lozano E, Estebsari A, García Gutiérrez F, Huang T, Mateos García I, et al. D7.1 Report on trial application II, Romanian Network. Deliverable of the FP7 SESAME Project.