CASCADING FAILURE Ian Dobson ECE dept., University of Wisconsin USA Ben Carreras Oak Ridge National Lab USA David Newman Physics dept., University of Alaska USA Presentation at University of Liege March 2003 Funding in part from USA DOE CERTS and NSF is gratefully acknowledged

power tails have huge impact probability (log scale) -1 S e -S blackout size S (log scale) power tails have huge impact on large blackout risk. risk = probability x cost

NERC blackout data 15 years, 427 blackouts 1984-1998 (also sandpile data) power tail in NERC data consistent with power system operated near criticality

Cascading failure; large blackouts dependent rare events + many combinations = hard to analyze or simulate mechanisms: hidden failures, overloads, oscillations, transients, control or operator error, ... but all depend on loading

Loading and cascading LOW LOAD - weak dependence - events nearly independent - exponential tails in blackout size pdf CRITICAL LOAD - power tails in blackout size pdf HIGHER LOAD - strong dependence - total blackout likely

Extremes of loading TRANSITION ?? VERY LOW LOADING log-log plot VERY LOW LOADING independent failures; pdf has exponential tail PDF blackout size TRANSITION ?? VERY HIGH LOADING total blackout with probability one PDF blackout size

Types of dependency in failure of systems with many components independent common mode common cause cascading failure

CASCADE: A probabilistic loading-dependent model of cascading failure

CASCADE model n identical components with random initial load uniform in [Lmin, Lmax] initial disturbance D adds load to each component component fails when its load exceeds threshold Lfail and then adds load P to every other component. Load transfer amount P measures component coupling, dependency iterate until no further failures

5 component example

5 component example

Normalize so that initial load range is [0,1] and failure threshold is 1 normalized initial disturbance d d = normalized load transfer p p = D - (Lfail - Lmax) Lmax -Lmin P Lmax -Lmin

Formulas for probability of r components fail for 0<d<1 n-r ( ) d (rp+d) (1-rp-d) ; np+d<1 quasibinomial distribution; Consul 74 n r for np+d >1, extended quasibinomial: quasibinomial for smaller r zero for intermediate r remaining probability for r = n

average number of failures < r > n=100 components d p

example of application: modeling load increase - Lmax = Lfail = 1 increase average load L by increasing Lmin 1 L - -

example of application: n = 100 components P = D = 0.005 p = d = 0.005 1 - Lmin

probability distribution as average load L increases

<r> average # failures <r> versus load L p=d and n=100

example 2 of application: back off Lmax ( n-1 criterion) Lfail = 1 k - Lmax - Lmin = 0

Increase average load leads to change in d and p constant

GPD formulas for probability of r components fail -rl-q (rl+q) e / r! ; nl+q<n;r<n ; remaining probability for r = n. For r<n agrees with generalized Poisson distribution GPD for nl+q>n, extended GPD: GPD for smaller r zero for intermediate r remaining probability for r = n

probability distribution as average load L increases GPD model

SUMMARY OF CASCADE features of loading-dependent cascading failure are captured in probabilistic model with analytic solution extended quasibinomial distribution with n,d,p; approximated by GPD with q=nd, l=np. distributions show exponential or power tails or high probability of total failure; power tail and total failure regimes show greatly increased risk of catastrophic failure power tails when l=np=1.

OPA: A power systems blackout model including cascading failure and self-organizing dynamics

Why would power systems operate near criticality?? Near criticality, expected blackout size sharply increases; increased risk of cascading failure.

Forces shaping power transmission Load increase (2% per year) and increase in bulk power transfers, economics Engineering: new controls and equipment upgrade weakest parts these engineering forces are part of the dynamics!

Ingredients of SOC in idealized sandpile system state = local max gradients event = sand topples (cascade of events is an avalanche) addition of sand builds up sandpile gravity pulls down sandpile Hence dynamic equilibrium with avalanches of all sizes and long time correlations

Analogy between power system and sand pile

OPA model Summary transmission system modeled with DC load flow and LP dispatch random initial disturbances and probabilistic cascading line outages and overloads underlying load growth + load variations engineering responses to blackouts: upgrade lines involved in blackouts; upgrade generation

DC load flow model (linear, no losses, real power only) Power injections at buses P max generators have max power P Line flows F max line flow limits + F

Slow and fast timescales SLOW : load growth and responses to blackouts. (days to years) slow dynamics indexed by days FAST : cascading events. (minutes to hours) fast dynamics happen at daily peak load; timing neglected

Response to blackout by engineers For lines involved in the blackout, max increase line limit F by a fixed percentage. Also, when total generation margin drops below threshold,increase generator power limit P at selected generators coordinated with line limits. max

Fast cascade dynamics Start with daily flows and injections Outage lines with given probability (initial disturbance) Use LP to redispatch Outage lines overloaded in step 3 with given probability If outage goto 3, else stop Objective: produce list of lines involved in cascade consistent with system constraints

Conventional LP redispatch to satisfy limits Minimize change in generation and loads (load change weighted x 100) subject to: overall power balance line flow limits load shedding positive and less than total load generation positive and less than generator limit

Model Is the total generation margin below critical? 1 day loop Yes Secular increase on demand Random fluctuation of loads Upgrade of lines after blackout Possible random outage No A new generator build after n days LP calculation If power shed, it is a blackout Are any overload lines? 1 minute loop no Yes, test for outage Yes No outage Line outage

Possible Approaches to Modeling Blackout Dynamics Complexity (nonlinear dynamics, interdependences) Model detail (increase details in the models, structure of networks,…) OPA model By incorporating the complex behavior, the OPA approach aims to extract universal features (power tails,…).

OPA model results include: self-organization to a dynamic equilibrium complicated critical point behaviors

Time evolution The system evolves to steady state. A measure of the state of the system is the average fractional line loading. 200 days

Steady state

OPA/NERC results

Application of the OPA model The probability distribution function of blackout size for different networks has a similar functional form - universality?

Effect of blackout mitigation methods on pdf of blackout size “obvious” methods can have counterintuitive effects

Mitigation Require a certain minimum number of transmission lines to overload before any line outages can occur.

A minimum number of line overloads before any line outages With no mitigation, there are blackouts with line outages ranging from zero up to 20. When we suppress outages unless there are n > nmax overloaded lines, there is an increase in the number of large blackouts. The overall result is only a reduction of 15% of the total number of blackouts. this reduction may not yield overall benefit to consumers.

Forest fire mitigation

Dynamics essential in evaluating blackout mitigation methods Suppose power system organizes itself to near criticality We try a mitigation method requiring 30 lines to overload before outages occur. Method effective in short time scale. In long time scale very large blackouts occur.

KEY POINTS NERC data suggests power tails and power system operated near criticality power tails imply significant risk of large blackouts and nonstandard risk analysis cascading loading-dependent failure engineering improvements and economic forces can drive to criticality in mitigating blackout risk, sensible approaches can have unintended consequences

BIG PICTURE Substantial risk of large blackouts caused by cascading events; need to address a huge number of rare interactions Where is the “edge” for high risk of cascading failure? How do we detect this in designing complex engineering systems? Risk analysis and blackout mitigation based on entire pdf, including high risk large blackouts. Developing understanding and methods is better than the direct experimental approach of waiting for large blackouts to happen!

Papers on this topic are available from http://eceserv0. ece. wisc