cascading failure

CASCADING FAILUREIan Dobson

ECE dept., University of Wisconsin USA

Ben Carreras Oak Ridge National Lab USA

David Newman Physics dept., University of Alaska USA

Presentation at University of LiegeMarch 2003

Funding in part from USA DOE CERTS and NSFis gratefully acknowledged

power tail

blackout size S (log scale)

(log scale) S -1

-Se

power tails have huge impact on large blackout risk.

probability

risk = probability x cost

NERC blackout data15 years, 427 blackouts 1984-1998

(also sandpile data)

10-6

10-5

10-4

10-3

10-2

10-1

100

101

102

103

104

Sandpile avalanche

MWh lost

Probability

Event size

power tail in NERC data consistent with power system operated near criticality

Cascading failure; large blackouts

• dependent rare events + many combinations = hard to analyze or simulate

• mechanisms: hidden failures, overloads, oscillations, transients, control or operator error, ... but all depend on loading

Loading and cascading• LOW LOAD

- weak dependence- events nearly independent - exponential tails in blackout size pdf

• CRITICAL LOAD- power tails in blackout size pdf

• HIGHER LOAD- strong dependence- total blackout likely

Extremes of loadingVERY LOW LOADING

independent failures; pdf has exponential tail

TRANSITION ??

VERY HIGH LOADING

total blackoutwith probabilityone

blackout size

PDF

PDF

blackout size

log-log plot

Types of dependency in failure of systems with many components

• independent

• common mode

• common cause

• cascading failure

CASCADE:A probabilistic

loading-dependent model of cascading failure

CASCADE model

• n identical components with random initial load uniform in [Lmin, Lmax]

• initial disturbance D adds load to each component• component fails when its load exceeds threshold Lfail

and then adds load P to every other component. Load transfer amount P measures component coupling, dependency

• iterate until no further failures

5 component example

5 component example

Normalize so that initial load range is [0,1]

and failure threshold is 1 normalized initial disturbance d

d =

normalized load transfer p

p =

D - (Lfail - Lmax) Lmax -Lmin

P Lmax -Lmin

Formulas for probability of r components fail for 0<d<1

nr)( d (rp+d) (1-rp-d) ; np+d<1

quasibinomial distribution; Consul 74

r-1 n-r

for np+d >1, extended quasibinomial:• quasibinomial for smaller r • zero for intermediate r• remaining probability for r = n

average number of failures < r > n=100 components

d

p

example of application:modeling load increase• Lmax = Lfail = 1

• increase average load L by increasing Lmin

-

--

1

0

L

example of application:

• n = 100 components• P = D = 0.005

• p = d = 0.005

1 - Lmin

probability distribution asaverage load L increases

0.5 0.6 0.7 0.8 0.9L

20

40

60

80

100average # failures <r>versus load Lp=d and n=100

<r>

example 2 of application:back off Lmax ( n-1 criterion)

-

-

Lfail = 1

Lmin = 0

Lmax-k

Increase average load leads to change in d and p constant

1 5 10 50 100 5001000r

0.00001

0.0001

0.001

0.01

0.1

1f p=0.00075, n=1000

d=0.0005 d=0.05 d=0.2

d=0.25

GPD formulas for probability of r components fail

(r+) e / r! ; n+<n;r<n; remaining probability for r = n. For r<n agrees with generalized Poisson distribution GPD

r-1

for n+>n, extended GPD:• GPD for smaller r • zero for intermediate r• remaining probability for r = n

-r-

probability distribution as average load L increases

GPD model

1 2 5 10 20 50 100r

0.00001

0.0001

0.001

0.01

0.1

1f

L=0.82

L=0.2

L=0.747

SUMMARY OF CASCADE• features of loading-dependent cascading failure

are captured in probabilistic model with analytic solution

• extended quasibinomial distribution with n,d,p; approximated by GPD with nd, np

• distributions show exponential or power tails or high probability of total failure;

• power tail and total failure regimes show greatly increased risk of catastrophic failure

• power tails when np1

OPA:A power systems blackoutmodel including cascading failure and self-organizing

dynamics

Why would power systems operate near criticality??

• Near criticality, expected blackout size sharply increases; increased risk of cascading failure.

0

5

10

15

20

25

30

1 104

1.2 104

1.4 104

1.6 104

1.2 104 1.4 104 1.6 104 1.8 104

outages

Power Served

<Number of line outages> Power Served

Power Demand

Forces shaping power transmission

• Load increase (2% per year) and increase in bulk power transfers, economics

• Engineering:

• new controls and equipment• upgrade weakest parts

these engineering forces are part of the dynamics!

Ingredients of SOC in idealized sandpile

• system state = local max gradients • event = sand topples (cascade of events is an

avalanche)1 addition of sand builds up sandpile2 gravity pulls down sandpile• Hence dynamic equilibrium with avalanches of all

sizes and long time correlations

Power system Sand pile

system state loading pattern gradient profile

driving force customer demand adding sand

relaxing force response to blackout gravity

event limit flow or trip sand topples

Analogy between power system and sand pile

OPA model Summary

• transmission system modeled with DC load flow and LP dispatch

• random initial disturbances and probabilistic cascading line outages and overloads

• underlying load growth + load variations• engineering responses to blackouts: upgrade

lines involved in blackouts; upgrade generation

DC load flow model(linear, no losses, real power only)

Power injections at buses P

Line flows F

generators have max power P max

line flow limits + Fmax

Slow and fast timescales

• SLOW : load growth and responses to blackouts. (days to years)slow dynamics indexed by days

• FAST : cascading events.(minutes to hours)fast dynamics happen at daily peak load; timing neglected

Response to blackout by engineers

increase line limit F by a fixed percentage.maxFor lines involved in the blackout,

Also, when total generation margin drops below threshold,increase generator power limit Pat selected generators coordinated with line limits.

max

Fast cascade dynamics1 Start with daily flows and injections

2 Outage lines with given probability (initial disturbance)

3 Use LP to redispatch

4 Outage lines overloaded in step 3 with given probability

5 If outage goto 3, else stop

Objective: produce list of lines involved in cascade consistent with system constraints

Conventional LP redispatch to satisfy limits

Minimize change in generation and loads (load change weighted x 100) subject to:

overall power balanceline flow limitsload shedding positive and less than total loadgeneration positive and less than generator limit

Model

Are any overload lines?

Yes, test for outage

Line outage

no

No outage

If power shed,it is a blackout

LP calculation

Yes

Secular increase on demandRandom fluctuation of loadsUpgrade of lines after blackoutPossible random outage

1 day loop

1 minuteloop

Is the total generation margin below critical?

No Yes

A new generatorbuild after n days

Possible Approaches to Modeling Blackout Dynamics

Complexity(nonlinear dynamics, interdependences)

Model detail(increase detailsin the models,structure of networks,…)

OPA model

By incorporating the complex behavior, the OPA approach aimsto extract universal features (power tails,…).

OPA model results include:

• self-organization to a dynamic equilibrium

• complicated critical point behaviors

Time evolution• The system evolves to steady state.• A measure of the state of the system is the average

fractional line loading.

M =1

Numberlines

FijFij

maxLines∑

Fij ≡Power flow between

nodes i and j

0.40.50.60.70.80.9

1

010203040506070

0 100 2 104 4 104 6 104 8 104

<M> Total overloads

Time (days)

0

5

10

15

20

6.06 104 6.07 104 6.08 104

Total overloads

Time (days)

200 days

Steady state

0

5

10

15

20

25

30

0

4000

8000

1.2 10

4

1.6 10

4

0 10

0

2 10

4

4 10

4

6 10

4

8 10

4

Blackouts

Power Served

Number Blackout per 300 days

Power Served

Time (days)

OPA/NERC results

10-2

10-1

100

101

102

10-4

10-3

10-2

10-1

100

NERC data

382-node Network

Probabilty distribution

Load shed/ Power served

Application of the OPA model

10-1

100

101

102

10-3 10-2 10-1 100

IEEE 118WSCCN = 382

Probability distribution

Load shed/ Power delivered

• The probability distribution function of blackout size for different networks has a similar functional form - universality?

Effect of blackout mitigation methods on pdf of blackout size

“obvious” methods can have counterintuitive effects

Mitigation

• Require a certain minimum number of transmission lines to overload before any line outages can occur.

A minimum number of line overloads before any line outages

• With no mitigation, there are blackouts with line outages ranging from zero up to 20.

• When we suppress outages unless there are n > nmax overloaded lines, there is an increase in the number of large blackouts.

• The overall result is only a reduction of 15% of the total number of blackouts.

• this reduction may not yield overall benefit to consumers.

100

101

102

103

104

105

0 10 20 30 40 50 60 70

Base case

nmax

= 10

nmax

= 20

nmax

= 30

Number of blackouts

Line outages

Forest fire mitigation

0.1

1

10

100

1000

104

20 40 60 80 100

Trees burned with efficient firefighters

Trees burned without firefighters

# of events of given size

Size of fire

Dynamics essential in evaluating blackout mitigation methods

• Suppose power system organizes itself to near criticality

• We try a mitigation method requiring 30 lines to overload before outages occur.

• Method effective in short time scale. In long time scale very large blackouts occur.

-0.6

-0.4

-0.2

0

0.2

0.4

0.6

0.8

0

20

40

60

80

100

0 5000 10000 15000 20000

<M>

outages

<M> Number of line outages per blackout

Time (days)

Standard

Suppress

n < 30

KEY POINTS• NERC data suggests power tails and power

system operated near criticality

• power tails imply significant risk of large blackouts and nonstandard risk analysis

• cascading loading-dependent failure

• engineering improvements and economic forces can drive to criticality

• in mitigating blackout risk, sensible approaches can have unintended consequences

BIG PICTURE• Substantial risk of large blackouts caused by

cascading events; need to address a huge number of rare interactions

• Where is the “edge” for high risk of cascading failure? How do we detect this in designing complex engineering systems?

• Risk analysis and blackout mitigation based on entire pdf, including high risk large blackouts.

• Developing understanding and methods is better than the direct experimental approach of waiting for large blackouts to happen!

Papers on this topic are available from

http://eceserv0.ece.wisc.edu/~dobson/home.html