1. Protecting against national-scale power blackouts Daniel Bienstock, Columbia University Collaboration with: Sara Mattia, Universitá di Roma, Italy Thomas Gouzènes, Réseau de Transport d’Electricité, France

2. August 2003: North America. 50 million people affected during two days; New York City loses power September 2003: Switzerland-France-Italy. 57 million people affected during one day; Italy loses power Other major incidents in recent years in Europe and Brazil The potential economic and human consequences of a prolongued national-scale blackout are significant Recent major incidents Were the blackouts due to insufficient generation capacity? No: they were due to inadequately protected transmission networks U.S.-Canada task force: The leading cause of the blackout was Inadequate System Understanding

3. A power grid has 3 components The transmission network is the key ingredient in modern grids Modern transmission networks are “lean” and, as a result, “brittle”

4. An inconvenient fact The power flows in a grid are controlled by the laws of physics When analyzing a hypothetical change in a network, the behavior of the power flows must be computed -- it cannot be dictated Two popular methodologies: AC power flow models DC (linearized) flow models

7. Summary “AC” models for computing power flows Account for both “active” and “reactive” power flows Fairly accurate Non-convex system of nonlinear equations Computationally intensive, Newton-like methods Solution methods tend to require a good initial guess Heavy data requirements “DC” models Linearized approximations of AC models Much faster Usually preferred by the industry for large-scale analysis

8. How does a blackout develop? Individual power lines fail due to: External effects: fires, lightning strikes, tree contacts, malicious agents (?) Thermal effects: an overloaded line will melt -- usually requires several minutes (protection equipment will shut it down first) The physics and engineering underlying line failures are well understood Individual line failuressystem collapse

9. A model for system collapse Initial set of externally caused faults: Several lines are disabled The network is altered – new power flows ensue flows in some of the lines exceed the line ratings Further line shutoffs New network: new power flows Cascade ! (sometimes)

10. Simulation RoundNo. of shut-off lines No. of connected components (“islands”) Demand served (%) 1 21100.0 2 83 3 17887.66 4 201682.72

11. What we are doing Proactive planning: how to economically engineer a network so as to ride-out potential failure scenarios Each “scenario” is an “interesting” combination of externally caused faults. Example from industry: “N – k” modeling Reaction planning: what to do if a significant event materializes From a theoretical standpoint, very intractable Multiple time scales The adversarial model

12. Proactive model We can upgrade a network in a number of ways. Examples: Upgrade individual lines Add new lines: Join/split nodes:

13. Integer programming approach 0/1 vector x: each entry represents whether a certain action is taken, or not x has an entry for each line of the network example: a line parallel to a certain line is added, or not total cost = c T x, for a certain cost vector c Problem: find x feasible, of minimum cost What is feasible? In each scenario (of a certain list), the network augmented as per vector x survives the cascade

14. Solution approach: game against an adversary Maintain a “working model” M, which describes conditions that a protection plan x must satisfy This model may be incomplete Solve the problem FIND x OF MINIMUM COST THAT SATISFIES THE CONDITIONS STIPULATED BY M, with solution x* Is x* adequate in all scenarios? YES - DONE NO In some scenario, x* does not suffice. State this fact algebraically Add this algebraic statement to M

15. Solution approach: Bender’s decomposition Maintain a “working formulation” Ax  b of inequalities valid for feasible x Solve the problem Minimize c T x subject to: Ax  b, x 0/1 With solution x* x* feasible? YES - DONE NO Find a valid inequality  T x   with  T x* <  Add  T x   to Ax  b

16. Simple example: we “protect” power lines – a 0/1 variable x per each line the grid survives a cascade if 70% of demand is met if the grid survives two rounds then it survives

17. First round after initial event: lines 1 – 7 shut off 5 islands, 80% of demand is met

18. Second round: lines 8 – 13 shut off, 15 islands 61% < 70% of demand met, collapse x 1 + x 2 + x 3 + x 6 + x 11 + x 12 + x 13  1

19. Experiments, and lessons Algorithm converges in few iterations, even with thousands of scenarios But each iteration is expensive because of the need to simulate scenarios to test if a certain network is survivable – in the worst case, all scenarios must be simulated And where do the scenarios come from?

20. A model for system collapse, revisited Initial set of externally caused faults: Several lines are disabled The network is altered – new power flows ensue flows in some of the lines exceed the line ratings Further line shutoffs New network: new power flows Research topic: can this process be efficiently approximated?

21. How are scenarios generated? Today: “N-1” analysis It can prove too slow on large networks Many of the scenarios are uninteresting The generalization: “N – k” analysis is prohibitively expensive

22. A different technique Stochastic simulation: assign a fault probability to each network component, and simulate the entire system We are dealing with extremely low probability events The interesting scenarios have very low probability, which will likely be incorrectly estimated And in any case we will generate many unimportant scenarios

23. Ongoing work: adversarial problem Problem Problem: find a smallest initial set of faults, following which a cascade occurs Enumerating all k-subsets for k  5 is computationally infeasible for large grids Approach we are using: combination of approximate dynamic programming and integer programming

24. One approach Adversary enumerates sets of k (small) lines at a time Adversary chooses the best set according to an appropriate merit function Examples: number of overloaded lines, nonlinear function of overloads (e.g. exponential), cost of flow under nonlinear cost function A difficulty: problem is not monotone

25. “Braess’ Paradox” Example: if we cut lines a, b, and c the system cascades but if we cut a, b, c, and d it does not

26. Solution approach: game against an adversary Maintain a “working model” M, which describes conditions that a protection plan x must satisfy This model may be incomplete Solve the problem FIND x OF MINIMUM COST THAT SATISFIES THE CONDITIONS STIPULATED BY M, with solution x* Can the adversary collapse the system protected by plan x*? YES - DONE NO In some scenario, x* does not suffice. State this fact algebraically Add this algebraic statement to M