Distributed Control of FACTS Devices Using a Transportation Model Bruce McMillin Computer Science Mariesa Crow Electrical and Computer Engineering University of Missouri-Rolla Rolla, MO

Outline FACTS Devices Max Flow Suitability of Max Flow to Power System Distributed Max Flow Fault Tolerance of Distributed Max Flow

Project Motivation Due to large unidirectional power flows, transmission grids are becoming increasingly susceptible to cascading failures Decentralized network control is necessary to rebalance power flow and contain the extent of the cascade

FACTS devices offer a decentralized network-embedded control mechanism

Project Objective Develop an effective distributed FACTS control algorithm to mitigate cascading grid failures, either intentional or unintentional Make the developed algorithms fault- tolerant using formal methods based on power system specifications

Approach The embedded controllers will execute graph-theory-based max flow distributed algorithms to identify critical transmission corridors and adjust power flow accordingly to avoid cascading failures

Outline FACTS Devices Max Flow Suitability of Max Flow to Power System Distributed Max Flow Fault Tolerance of Distributed Max Flow

Example

Max-Flow Assign an initial flow to all arcs Mark the source and sink Search for a node that can be labeled. If none is found, flow is maximum, stop. Backtrack the path computing the minimum  ij used. Go to previous step.

sa t  = s a e d c b t s a e d c b t s a e d c b t s a e d c b t a e d c b t s a e d c b t s a e d c b t s a e d c b t s a e d c b t s a e d c b t s a e d c b t s a e d c b t s e d c b t s e d c b s e d c b t s d c b t s d c b t s d c b t s d c b t s d c b t s d c b t s d c b t c b s d c b t s c b t s c b t c b t 0 sa t  =15 d 20 sa t  =17 30 c sa t 28  =28 50 e s b t 22  =22 22 e s b c 28 8  =3 3 d t 13 s b t 25 5  =5 5 d s b  =10 t s b t 10  =10 10 c

Loss of Line B-D Load at bus D must be reduced from 20 to 15 Load at bus C must be reduced from 30 to 27

Outline FACTS Devices Max Flow Suitability of Max Flow to Power System Distributed Max Flow Fault Tolerance of Distributed Max Flow

Suitability of Transportation Model (max flow)to Power Systems? Losses and Reactive Power? Experimental Verification –No difference at steady state from max flow –A few percent difference between max flow calculations and load-flow analysis after a contingency using FACTS devices

In general, lines are not all maximally loaded. The power flow can then be re- directed to new transmission corridors. –Where re-direct? –How much to re-direct? –How account for KCL? –Control/communication between decision- making devices?

Placement of FACTS Devices Experimentally: 1.Delete a line 2.Run Max Flow servicing loads increasing line capacities by reverse augmentation to a maximum of 20%. 3.Using Load Flow analysis, place FACTS devices to eliminate overloaded lines. 4.Go to step 1

Placement of FACTS Devices

Resulting System Configuration

Resulting Line Overloads (>20%)

Outline FACTS Devices Max Flow Suitability of Max Flow to Power System Distributed Max Flow Fault Tolerance of Distributed Max Flow

Distributed Max flow Multiple source (generator) Concurrent flow-augmenting probes FACTS devices communicate by message passing along the direction of the flow augmentation Each FACTS device computes the flow for a partition of lines (using Chaco from Sandia) Multiple Computers, Open Communication Lines, Distributed Software

Outline FACTS Devices Max Flow Suitability of Max Flow to Power System Distributed Max Flow Fault Tolerance of Distributed Max Flow

Vulnerabilities Computer System Failure Programming Errors Hackers (Security Intrusions)

Software Correctness? Distributed Computing System –Verification (Development Time)? Complexity –Model Checking and Theorem Proving –Testing Test Cases –Monitoring Assertion Testing.

Proposed Idea Combine assertions from formal verification with run-time checking (monitoring).

Proposed Approach Distributed run-time assertion checking –focuses on the unique execution in progress - guarantees that the current execution meets its specifications regardless of underlying hardware or system confidence

Embedded Monitoring Assertions are predicates are a collected global state of events If an event happens before another they can be partially ordered Lamport Logical Clock –Each event has a logical timestamp C[event] –The most current event is the one with the largest timestamp. –Timestamps are forced to increase on a message receive so that message sends precede message receives.

Underlying Theory Correctness is defined by theorems about the program. Theorems are easily translated into assertions for monitoring. For the assertions to be correct, a program code action, a, must not interfere with the truth of an assertion, P ( a ). In a distributed system, this truth must be preserved over all interleavings of processes. Using timestamps, the monitoring is guaranteed to correctly reflect the distributed program’s state.

Failure Scenario Distributed Multiple Source Max Flow Correctness is defined by KCL at each node FACTS devices B and C faulty Attempt to Overload line B-C (flow=20)

Failure Scenario s a e d c b t Push Flow to A&B, B finds C blocked s a e d c b t Push Flow to A&B 10 B Can Augment Flow to t s a e d c b t Push Flow to A&B 20 B Can Augment Flow to t B Incorrectly Overloads Arc to C with 20, Node C tries to hide, as well, And augments flow C-t as Before B’s Probe Returns, A augments through D. Since the path is full, D receives a blocked message, carrying C’s sum of 7 t s a e d c b Push Flow to A&B 20 B Augments Flow to t, instead. B Incorrectly Overloads Arc to C with 20, Node C tries to hide, as well, And augments flow C-t as 13 10

System Framework Informal Specification Security and Functional Requirements FormalCode Operational Evaluation System OK or Specification Violation Intruders Failures InterpretationRefinement Verification

Status and Results Simple Max Flow is an effective formalism to balance power flow Detects Faults Need to measure performance and fault tolerance levels. Real-Time algorithm needs to respond before cascading failure occurs.