Annee academique 2012 - 2013Universite libre de Bruxelles
Ecole polytechnique de Bruxelles
These presentee en vue de
l’obtention du grade de
Docteur en Sciences de l’Ingenieur
Promoteur : Prof. Pierre-Etienne Labeau
Co-Promoteur : Prof. Jean-Claude Maun
Membres du jury :
Prof. Michel Kinnaert (President)
Prof. Benjamin Genet (Secretaire)
Prof. Damien Ernst
Dr. Jonathan Sprooten
Dr. Andrija Volkanovski
A two-levelProbabilistic Risk Assessment
of cascading failures leading to blackoutin transmission power systems
Pierre Henneaux
II
Resume
Dans notre societe, les activites privees et industrielles reposent sur l’hypothese implicite que
l’electricite est disponible a tout moment et a cout raisonnable. Bien que le retour d’experience du
secteur electrique est tres favorable, la production, la transmission et la distribution de l’electricite ne
peuvent pas etre considerees comme des activites totalement fiables. Un risque residuel de blackout
ou de delestage de charge indesire dans certaines zones demeure. L’occurrence d’un tel evenement a
des consequences economiques directes et indirectes desastreuses. L’evaluation de ce risque residuel
et l’identification des scenarios susceptibles d’y contribuer sont cruciaux pour controler et reduire
de maniere optimale ce risque de blackout ou de perturbation majeure. L’objectif de cette these est
le developpement d’une methodologie capable de reveler les scenarios conduisant a un blackout et
d’estimer leurs frequences et leurs consequences avec une precision satisfaisante.
Un blackout est un effondrement du reseau electrique sur une zone geographique etendue, con-
duisant a une coupure de courant, et est du a des defaillances en cascade. Une telle cascade est
composee de deux phases : une cascade lente, debutant avec l’occurrence d’un evenement initiateur
et de temps caracteristiques entre evenements successifs de quelques minutes a quelques heures, et
une cascade rapide, de temps caracteristiques entre evenements successifs de quelques millisecondes
a quelques dizaines de secondes. Dans des defaillances en cascade, il y a un grand couplage entre
evenements : la perte d’un element augmente le stress sur les autres elements et, ainsi, la probabilite
d’avoir une autre defaillance. Il apparaıt que les methodes probabilistes precedemment proposees
ne prennent pas en compte correctement cette dependance entre defaillances, essentiellement car
les deux phases tres differentes sont analysees avec le meme modele. Il y a donc un besoin de
developper une approche probabiliste integree conceptuellement satisfaisante, capable de prendre en
compte toutes les dependances, en utilisant des modeles differents pour la cascade lente et la cascade
rapide. C’est le but de cette these de doctorat.
Ce travail se concentre d’abord sur le niveau I, l’analyse de la progression de la cascade lente
jusqu’a la transition vers la cascade rapide. Nous proposons d’adapter les methodes de la fiabilite
dynamique, developpees initialement pour le domaine nucleaire, au cas des reseaux de transport
electriques. Cette methodologie prendra en compte la double interaction entre la dynamique du
reseau electrique et les changements d’etat des elements du reseau. Cette these introduit egalement
le developement du niveau II pour analyser la cascade rapide, jusqu’a la transition vers un etat
operationnel avec de la charge delestee ou un blackout. La methode proposee est appliquee a deux
reseaux tests. Les resultats montrent que les effets thermiques peuvent jouer un role important
dans les defaillances en cascade, durant la premiere phase. Ils montrent aussi qu’une analyse de
niveau II apres une analyse de niveau I est necessaire pour avoir une estimation de la puissance non
fournie auquel un scenario peut conduire : deux types de scenarios de niveau I de frequence similaire
peuvent induire des risques (en termes de puissance non fournie) et des frequences de blackout tres
differents. L’analyse du processus de restauration (niveau III), est cependant necessaire pour avoir
une estimation du risque en termes d’energie non fournie. Cette these presente egalement plusieurs
perspectives pour ameliorer l’approche afin de pouvoir etendre les applications a des reseaux reels.
i
Summary
In our society, private and industrial activities increasingly rest on the implicit assumption that
electricity is available at any time and at an affordable price. Even if operational data and feedback
from the electrical sector is very positive, a residual risk of blackout or undesired load shedding
in critical zones remains. The occurrence of such a situation is likely to entail major direct and
indirect economical consequences, as observed in recent blackouts. Assessing this residual risk and
identifying scenarios likely to lead to these feared situations is crucial to control and optimally reduce
this risk of blackout or major system disturbance. The objective of this PhD thesis is to develop
a methodology able to reveal scenarios leading to a blackout or a major system disturbance and to
estimate their frequencies and their consequences with a satisfactory accuracy.
A blackout is a collapse of the electrical grid on a large area, leading to a power cutoff, and is due
to a cascading failure. Such a cascade is composed of two phases: a slow cascade, starting with the
occurrence of an initiating event and displaying characteristic times between successive events from
minutes to hours, and a fast cascade, displaying characteristic times between successive events from
milliseconds to tens of seconds. In cascading failures, there is a strong coupling between events: the
loss of an element increases the stress on other elements and, hence, the probability to have another
failure. It appears that probabilistic methods proposed previously do not consider correctly these
dependencies between failures, mainly because the two very different phases are analyzed with the
same model. Thus, there is a need to develop a conceptually satisfying probabilistic approach, able
to take into account all kinds of dependencies, by using different models for the slow and the fast
cascades. This is the aim of this PhD thesis.
This work first focuses on the level-I which is the analysis of the slow cascade progression up to
the transition to the fast cascade. We propose to adapt dynamic reliability, an integrated approach
of Probabilistic Risk Analysis (PRA) developed initially for the nuclear sector, to the case of trans-
mission power systems. This methodology will account for the double interaction between power
system dynamics and state transitions of the grid elements. This PhD thesis also introduces the
development of the level-II to analyze the fast cascade, up to the transition towards an operational
state with load shedding or a blackout. The proposed method is applied to two test systems. Results
show that thermal effects can play an important role in cascading failures, during the first phase.
They also show that the level-II analysis after the level-I is necessary to have an estimation of the loss
of supplied power that a scenario can lead to: two types of level-I scenarios with a similar frequency
can induce very different risks (in terms of loss of supplied power) and blackout frequencies. The
level-III, i.e. the restoration process analysis, is however needed to have an estimation of the risk in
terms of loss of supplied energy. This PhD thesis also presents several perspectives to improve the
approach in order to scale up applications to real grids.
ii
Acknowledgments
First of all, I would like to thank my two supervisors, Pierre-Etienne Labeau and Jean-Claude
Maun. They proposed together this PhD thesis topic, “blackout probabilistic risk assessment”, and
they were very complementary. I am grateful to Pierre-Etienne Labeau for his absolutely invaluable
help, especially for his precious advices and his detailed answers to my questions in reliability, and
for his careful reading of scientific papers and this PhD thesis. Almost each sentence has been
commented and several paragraphs have been criticized. These comments were very interesting and
helped me to improve this PhD thesis. I am grateful to Jean-Claude Maun, incredibly knowledgeable
about power systems, for his precious advices and his detailed answers to my questions in this field.
I would like also to thank mnhp1 for its large contribution to results presented here, and all
the “Service de Metrologie Nucleaire”. In particular, I want to acknowledge Julien Callant and
Artem Napov for technical advices in numerical analysis. Special thanks to all my office fellows for
their company (Julien, Julien, Marie-Carmen, Nicolas, Husein), to Farshid for our common work,
to Laetitia for the administrative support and Alain for the Wednesday lunch.
Kiitos to Liisa Haarla for welcoming me in Finland for two months and for interesting discussions,
especially about the fast cascade and failures of protection systems.
I would like to express my gratitude to my family for providing me with continuous support
throughout my life.
Finally, I would like to thank the Fonds de la Recherche Scientifique - FNRS for my Research
Fellowship.
iii
Contents
Resume i
Summary ii
Acknowledgments iii
Contents v
List of figures viii
List of tables xii
List of acronyms xv
Introduction 1
1 Introduction to electric energy systems 5
1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.2 Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.2.1 Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.2.2 Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3 Static analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.3.1 Components models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.3.2 Load flow analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.3.3 Optimal power flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.4 Dynamic analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
1.4.1 Components models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
1.4.2 Protection systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
1.4.3 Eigenvalue analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.4.4 Dynamic simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.4.5 Angle, voltage and frequency stability . . . . . . . . . . . . . . . . . . . . . . 15
2 Blackouts and major system disturbances 19
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.2 United States, 1996 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.3 United States & Canada, 2003 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.4 Sweden & Denmark, 2003 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.5 Italy, 2003 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.6 Europe, 2006 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.7 Typical blackout development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
v
3 Introduction on reliability analysis methodologies 33
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.1.1 Reliability of components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.1.2 Formal definitions of risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.1.3 Nuclear safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.1.4 Organization of this Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.2 Scenario based risk estimation methodologies . . . . . . . . . . . . . . . . . . . . . . 38
3.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.2.2 Event trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.2.3 Fault trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.3 State based risk estimation methodologies . . . . . . . . . . . . . . . . . . . . . . . . 41
3.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.3.2 State graph . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.3.3 Markovian systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.3.4 Semi-Markovian and non-Markovian systems . . . . . . . . . . . . . . . . . . 44
3.3.5 State enumeration approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
3.3.6 Monte Carlo simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
3.4 Dynamic reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
4 Reliability of electrical grids - state of the art 49
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
4.2 Deterministic studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.3 Probabilistic studies - HLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.4 Probabilistic studies - HLII . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
4.4.1 Static methodologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
4.4.2 Cascading failure simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
4.4.3 Probabilistic methodologies and dynamic simulation . . . . . . . . . . . . . . 57
4.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
5 Blackout PRA in 3 levels 61
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
5.2 Decomposition of the power system PRA in 3 levels . . . . . . . . . . . . . . . . . . 61
5.3 Level-I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
5.3.1 General modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
5.3.2 Temperature evolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
5.3.3 Thermal failure models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
5.3.4 Operator actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
5.3.5 Transition criteria between level-I and level-II . . . . . . . . . . . . . . . . . . 69
5.3.6 Analog simulation algorithm for the slow cascade . . . . . . . . . . . . . . . . 69
5.3.7 Biasing techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
5.4 Clustering between level-I and level-II . . . . . . . . . . . . . . . . . . . . . . . . . . 75
5.5 Level-II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
5.5.1 General modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
5.5.2 Transitions due to electrical variables . . . . . . . . . . . . . . . . . . . . . . 76
5.5.3 Fast cascade simulation algorithm . . . . . . . . . . . . . . . . . . . . . . . . 77
5.6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
6 Applications 79
6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
6.2 One-level blackout PRA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
6.2.1 Test case: data and modeling assumptions . . . . . . . . . . . . . . . . . . . . 79
6.2.2 Results for the base case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
6.2.3 Impact of vegetation height . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
6.2.4 Impact of changes in generation . . . . . . . . . . . . . . . . . . . . . . . . . . 89
6.3 Two-level blackout PRA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
6.3.1 Test case: data and modeling assumptions . . . . . . . . . . . . . . . . . . . . 93
6.3.2 Level-I: results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
6.3.3 Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
6.3.4 Level-II: results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
6.3.5 First two levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
6.4 Level-I blackout PRA efficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
6.4.1 Independent simulation algorithm . . . . . . . . . . . . . . . . . . . . . . . . 100
6.4.2 Dependent simulation algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 101
6.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
7 Perspectives 105
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
7.2 Operators’ actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
7.3 Electrical instability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
7.4 Protection systems failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
7.5 Load modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
7.6 Level-III . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
7.7 Application to real grids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Conclusions 111
A Failure rate of underground cables 113
A.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
A.2 State of the art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
A.2.1 PHI2 method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
A.2.2 The Weibull law for power cables . . . . . . . . . . . . . . . . . . . . . . . . . 116
A.3 Proposed modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
A.3.1 Failure rate and outcrossing rate . . . . . . . . . . . . . . . . . . . . . . . . . 117
A.3.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
A.3.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
A.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
B Test systems 123
B.1 Level-I test system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
B.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
B.1.2 Voltage and power basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
B.1.3 Lines, cables and transformers . . . . . . . . . . . . . . . . . . . . . . . . . . 124
B.1.4 Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
B.1.5 Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
B.1.6 Wind farms and wind speeds . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
B.1.7 Ambient temperature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
B.2 Two-level test system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
B.2.1 General data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
B.2.2 Thermal and mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
B.2.3 Dynamic data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
B.2.4 Relays and protections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
C Transition criteria between level-I and level-II 139
C.1 Angular transient stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
C.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
C.1.2 Simplified model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
C.1.3 Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
C.1.4 Shortcomings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
C.2 Frequency stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
C.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
C.2.2 Simplified model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
C.2.3 Steady state frequency deviation . . . . . . . . . . . . . . . . . . . . . . . . . 144
C.3 Voltage stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
D Failure probability of overhead lines 147
D.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
D.2 State of the art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
D.2.1 Cascading failures methodologies . . . . . . . . . . . . . . . . . . . . . . . . . 148
D.2.2 Increasing thermal rating by risk analysis . . . . . . . . . . . . . . . . . . . . 151
D.3 Physical bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
D.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
D.3.2 Influence of ambient temperature . . . . . . . . . . . . . . . . . . . . . . . . . 152
D.3.3 Influence of wind . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
D.3.4 Total influence of weather conditions . . . . . . . . . . . . . . . . . . . . . . . 154
D.3.5 Influence of vegetation height . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
D.3.6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
D.4 Numerical results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
D.4.1 Test systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
D.4.2 Models used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
D.4.3 Modeling assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
D.4.4 Mini Test System - weak corrective actions model . . . . . . . . . . . . . . . 159
D.4.5 Blackout Test System - weak corrective actions model . . . . . . . . . . . . . 160
D.4.6 Mini Test System - strong corrective actions model . . . . . . . . . . . . . . . 160
D.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Bibliography 169
List of Figures
1.1 Electric power system configuration and structure. . . . . . . . . . . . . . . . . . . . 6
1.2 Power transformer in a substation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.3 Double circuit 400-kV overhead line. . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.4 Configurations of underground cables. . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.5 Typical design of underground cables. . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.6 Line equivalent model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.7 Links equivalent circuit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.8 Elements connected to a bus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.9 Power plant powering a load through one line. . . . . . . . . . . . . . . . . . . . . . . 11
1.10 P-V characteristics of the one-line system. . . . . . . . . . . . . . . . . . . . . . . . . 12
1.11 Three-zone step distance relaying to protect 100% of a line, and back up the neigh-
boring line. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.12 IEEE-CIGRE classification of power system stability. . . . . . . . . . . . . . . . . . . 16
1.13 Power plant powering a load through two lines. . . . . . . . . . . . . . . . . . . . . . 16
1.14 Collapse process on PV curves. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1 Sequence of significant events and islands formed on August 10, 1996. . . . . . . . . 20
2.2 Rate of events during the cascade. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.3 Northern California island frequency during major system disturbance on August 10,
1996. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.4 Southern island frequency during major system disturbance on August 10, 1996. . . 22
2.5 Geography of the FirstEnergy area in August 2003. . . . . . . . . . . . . . . . . . . . 22
2.6 Cumulative effects of sequential outages on remaining 345-kV lines during cascading
failure on August 14, 2003. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.7 Simulated effect of prior outages on 138-kV line loadings during cascading failure on
August 14, 2003. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.8 Rate of line and generator trips during cascading failure on August 14, 2003. . . . . 24
2.9 Faulty disconnector in Horred during cascading failure on September 23, 2003. . . . 25
2.10 Registration of voltage in the north of Sweden during cascading failure on September
23, 2003. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.11 Line of separation from UCTE during cascading failure on September 28, 2003. . . . 26
2.12 Frequency versus imbalances during cascading failure on September 28, 2003. . . . . 27
2.13 Frequency recordings until area splitting during cascading failure on November 4, 2006. 27
2.14 Schematic map of the UCTE area split into three areas during cascading failure on
November 4, 2006. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
2.15 Frequency recordings after the split during cascading failure on November 4, 2006. . 29
2.16 Important characteristic times in a cascading failure. . . . . . . . . . . . . . . . . . . 29
2.17 Phases of a blackout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.18 Event tree after an initiating event. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
ix
3.1 Bathtub curve. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
3.2 Steam cycle for pressurized-water reactor (PWR). . . . . . . . . . . . . . . . . . . . 37
3.3 The three PRA levels in nuclear safety. . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.4 From an initiating event to the risk estimation. . . . . . . . . . . . . . . . . . . . . . 39
3.5 An event tree for a pipe-break initiating event. . . . . . . . . . . . . . . . . . . . . . 40
3.6 Example of a fault tree. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
3.7 State space diagram of a repairable component. . . . . . . . . . . . . . . . . . . . . . 42
3.8 State space diagram of a three-state repairable component with a derated state. . . . 42
3.9 State space diagram of two repairable components with a common mode failure. . . 42
3.10 Markovian state graph of two repairable components with a common mode failure. . 43
3.11 Chronological components and resulting system state transition processes. . . . . . . 46
3.12 A possible system evolution due to configuration changes. . . . . . . . . . . . . . . . 48
4.1 Reliability studies of electrical grids - classification. . . . . . . . . . . . . . . . . . . . 50
4.2 Typical flowchart for composite system risk evaluation. . . . . . . . . . . . . . . . . . 53
4.3 Flowchart of the TRELSS simulation approach. . . . . . . . . . . . . . . . . . . . . . 54
4.4 Simulation flowchart of Manchester model. . . . . . . . . . . . . . . . . . . . . . . . . 55
4.5 Typical event tree for substation events after a line fault and fault tree for the failure
of the two main protection distance to send a zone 1 trip signal to circuit breaker trip
coils. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
4.6 Illustration of halting voltage collapse by dynamic event tree. . . . . . . . . . . . . . 58
5.1 Decomposition of the power system PRA in 3 levels. . . . . . . . . . . . . . . . . . . 63
5.2 Thermal model of an underground power cable. . . . . . . . . . . . . . . . . . . . . . 65
5.3 Life distribution at constant stress of high voltage cables with extruded isolation. . . 68
5.4 Dielectric strength as a function of temperature. . . . . . . . . . . . . . . . . . . . . 68
5.5 Transformer failure rate as a function of temperature. . . . . . . . . . . . . . . . . . 69
5.6 Algorithm diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
5.7 Mother branch and new branches of a DDET. . . . . . . . . . . . . . . . . . . . . . . 77
6.1 Blackout Test System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
6.2 Mean load as a function of day hour for the four season. . . . . . . . . . . . . . . . . 80
6.3 Mean ambient temperature. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
6.4 Mean wind speed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
6.5 Distribution of line outages during dynamic level-I PRA cascades. . . . . . . . . . . 84
6.6 Total frequency of dangerous scenarios as a function of the ambient temperature. . . 86
6.7 Total frequency of dangerous scenarios as a function of the mean wind speed. . . . . 87
6.8 Total frequency of dangerous scenarios as a function of the load. . . . . . . . . . . . 87
6.9 Total frequency of dangerous scenarios as a function of the hour. . . . . . . . . . . . 87
6.10 Blackout Test System - Critical area (base case). . . . . . . . . . . . . . . . . . . . . 88
6.11 Influence of cross-border power flows on the total frequency of dangerous scenarios. . 91
6.12 Critical area for a mean power flow from NYPS to NETS of 195 MW. . . . . . . . . 91
6.13 Influence of total installed wind power on the total frequency of dangerous scenarios. 92
6.14 Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in
the NYPS (10,12) on the total frequency of dangerous scenarios - Dynamic level-I PRA. 92
6.15 Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in
the NYPS (10,12) on the total frequency of dangerous scenarios - Independent method. 93
6.16 Impact of a four-week maintenance of one unit for each NETS power plant on the
total frequency of dangerous scenarios - Dynamic level-I PRA. . . . . . . . . . . . . 94
6.17 Impact of a four-week maintenance of one unit for each NETS power plan on the total
frequency of dangerous scenarios - Independent method. . . . . . . . . . . . . . . . . 94
6.18 Test system for a two-level blackout risk analysis. . . . . . . . . . . . . . . . . . . . . 94
6.19 Electrical instabilities per type of level-I dangerous scenarios. . . . . . . . . . . . . . 96
6.20 Probability of total load per type of level-I dangerous scenarios. . . . . . . . . . . . . 96
6.21 DET main branches for type 1 scenarios, cluster 3. . . . . . . . . . . . . . . . . . . . 98
6.22 Voltage evolution for type 1 scenarios, cluster 3, example 1. . . . . . . . . . . . . . . 99
6.23 Voltage evolution for type 1 scenarios, cluster 3, example 2. . . . . . . . . . . . . . . 99
6.24 Distribution of the loss of supplied power. . . . . . . . . . . . . . . . . . . . . . . . . 100
6.25 Mean times per MC run - biased independent simulations. . . . . . . . . . . . . . . . 101
6.26 Sample variances - biased independent simulations. . . . . . . . . . . . . . . . . . . . 101
6.27 Figures of merit - biased independent simulations. . . . . . . . . . . . . . . . . . . . 102
6.28 Mean times per MC run - dependent simulations with biased transition times. . . . . 102
6.29 Sample variances - dependent simulations with biased transition times. . . . . . . . . 102
6.30 Figures of merit - dependent simulations with biased transition times. . . . . . . . . 103
6.31 Biased normal law, with nI = 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
A.1 Dielectric strength as a function of temperature. . . . . . . . . . . . . . . . . . . . . 116
A.2 Acceleration factor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
A.3 Failure rate as a function of temperature in stationary conditions. . . . . . . . . . . 120
A.4 Failure rate as a function of temperature in stationary conditions. . . . . . . . . . . 120
A.5 Stationary and non-stationary failure rates for the test case (increasing temperature). 121
A.6 Stationary and non-stationary failure rates for the test case (decreasing temperature). 122
A.7 Stationary and non-stationary failure rates for a slow transient. . . . . . . . . . . . . 122
B.1 68-buses, 16-machine, 5-area test system. . . . . . . . . . . . . . . . . . . . . . . . . 123
B.2 3L2 and 5L2 structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
B.3 Blackout test system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
B.4 Map of KNMI stations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
B.5 Test system for a two-level blackout risk analysis. . . . . . . . . . . . . . . . . . . . . 133
B.6 Excitation system - type AC4A. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
B.7 Model of a power system stabilizer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
B.8 Quadrilateral distance relay characteristic. . . . . . . . . . . . . . . . . . . . . . . . . 138
C.1 Excitation system - type AC4A. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
C.2 Representation of a multi-machine system. . . . . . . . . . . . . . . . . . . . . . . . . 141
C.3 Steady state phasor diagram of the synchronous machine. . . . . . . . . . . . . . . . 143
C.4 The third-order system frequency response model. . . . . . . . . . . . . . . . . . . . 144
D.1 Line overload modelling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
D.2 Probability of the line trip as a function of its loading. . . . . . . . . . . . . . . . . . 150
D.3 Probability of the line trip as a function of its loading. . . . . . . . . . . . . . . . . . 150
D.4 Map of the Netherlands showing the station 278 Heino. . . . . . . . . . . . . . . . . 153
D.5 Cdf of the critical current - influence of the ambient temperature. . . . . . . . . . . . 154
D.6 Cdf of the critical current - influence of the wind speed. . . . . . . . . . . . . . . . . 154
D.7 Cdf of the critical current - influence of the wind. . . . . . . . . . . . . . . . . . . . . 154
D.8 Cdf of the critical current - influence of weather conditions. . . . . . . . . . . . . . . 155
D.9 Critical temperature in function of critical sag. . . . . . . . . . . . . . . . . . . . . . 155
D.10 Standard deviation of the critical current in function of the standard deviation of the
critical temperature. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
D.11 Standard deviation of the critical current in function of the standard deviation of the
vegetation height. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
D.12 Mini Test System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
D.13 Blackout Test System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
D.14 Probability of line tripping in function of load - Mini Test System. . . . . . . . . . . 159
D.15 Three models for the probability of line tripping in function of load - Mini Test System.159
D.16 Probability of line tripping in function of load - Blackout Test System. . . . . . . . . 160
D.17 Three models for the probability of line tripping in function of load - Blackout Test
System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
D.18 Probability of line tripping in function of load - Mini Test System with strong correc-
tive actions model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
D.19 Four models for the probability of line tripping in function of load - Mini Test System
with strong corrective actions model. . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
List of Tables
2.1 Main system states transition phenomena and mechanisms occurring in slow and fast
cascades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
6.1 Cross-border power flows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
6.2 Most frequent dangerous scenarios (base case) . . . . . . . . . . . . . . . . . . . . . . 84
6.3 Fussell-Vesely factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
6.4 Lambert factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
6.5 Probability to have a dangerous scenario after a link trip as initiating event . . . . . 86
6.6 Seasons’ importance (frequencies given are conditional frequencies per season). . . . 87
6.7 Estimations of the total frequency of dangerous scenarios for different vegetation heights. 88
6.8 Dangerous scenarios and their frequencies for different vegetation heights. . . . . . . 89
6.9 Dangerous scenarios and their frequencies for different vegetation heights. . . . . . . 89
6.10 Vesely-Fussel factors for different vegetation heights. . . . . . . . . . . . . . . . . . . 90
6.11 Lambert factors for different vegetation heights. . . . . . . . . . . . . . . . . . . . . . 90
6.12 Most frequent dangerous scenarios for a mean power flow from NETS to NYPS of
398 MW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
6.13 Most frequent dangerous scenarios for a mean power flow from NYPS to NETS of
195 MW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
6.14 Most frequent dangerous scenarios after shutdown of the power plant 2 (NETS) when
the lost power is compensated by all areas. . . . . . . . . . . . . . . . . . . . . . . . 93
6.15 Most frequent dangerous scenarios after shutdown of the power plant 12 (NYPS) when
the lost power is compensated by the NETS. . . . . . . . . . . . . . . . . . . . . . . 93
6.16 Most frequent dangerous scenarios revealed by level-I blackout PRA. . . . . . . . . . 95
6.17 Level-II results by clusters for level-I type 1 (as denoted in Table 6.16) scenarios. . . 97
6.18 Level-II results by clusters for level-I type 2 (as denoted in Table 6.16) scenarios. . . 97
6.19 Level-II results by clusters for level-I type 3 (as denoted in Table 6.16) scenarios. . . 97
6.20 Level-II results by clusters for level-I type 4 (as denoted in Table 6.16) scenarios. . . 98
6.21 Risk and frequency of blackout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
A.1 Parameters of the PHI2 method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
B.1 Power plants data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
B.2 Bus Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
B.3 Weekly peak load in percentage of annual peak. . . . . . . . . . . . . . . . . . . . . . 127
B.4 Daily peak load in percentage of weakly peak. . . . . . . . . . . . . . . . . . . . . . . 127
B.5 Hourly peak load in percentage of daily peak. . . . . . . . . . . . . . . . . . . . . . . 128
B.6 Links Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
B.7 Links Data (continued). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
B.8 Thermal data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
B.9 Mechanica data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
xiii
B.10 Thermal data of underground cables. . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
B.11 Thermal data of power transformers. . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
B.12 Mean ambient temperature (C) for each season and each hour. . . . . . . . . . . . . 133
B.13 Standard deviation of the ambient temperature (C) for each season and each hour. 134
B.14 Power plants general data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
B.15 Bus Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
B.16 Links Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
B.17 Thermal data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
B.18 Mechanica data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
B.19 Thermal data of power transformers. . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
B.20 Wind speed parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
B.21 Dynamic parameters of synchronous machines. . . . . . . . . . . . . . . . . . . . . . 137
B.22 Parameters for excitation system model. . . . . . . . . . . . . . . . . . . . . . . . . . 137
B.23 Parameters for PSS model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
D.1 Assumption on probability of trip as a function of line loading. . . . . . . . . . . . . 150
D.2 Best parameters for the Mini Test System. . . . . . . . . . . . . . . . . . . . . . . . . 159
D.3 Best parameters for the Blackout Test System. . . . . . . . . . . . . . . . . . . . . . 160
D.4 Best parameters for the Mini Test System with strong corrective actions model. . . . 161
List of Acronyms
AIT Average Interruption Time
BO Blackout
CET Continuous Event Tree
DDET Discrete Dynamic Event Tree
DET Dynamic Event Tree
EDT Eastern Daylight Time
ENS Energy Not Supplied
ENTSO-E European Network of Transmission System Operators for Electricity
ET Event Tree
FORM First Order Reliability Method
FT Fault Tree
IAEA International Atomic Energy Agency
IEEE Institute of Electrical and Electronics Engineers
LF Load Flow
MC Monte Carlo
MAPE Mean Absolute Percentage Error
MISO Midwest Independent System Operator
NERC North America Reliability Corporation
NETS New England Test System
NYPS New York Power System
OPF Optimal Power Flow
PDT Pacific Daylight Time
PRA Probabilistic Risk Assessment
RTS Reliability Test System
TSO Transmission System Operator
UCTE Union for the Coordination of the Transmission of Electricity
UTC Coordinated Universal Time
xv
Introduction
In our society, private and industrial activities increasingly rest on the implicit assumption that
electricity is available at any time and at an affordable price. Even if operational data and feedback
from the electrical sector is very positive, generation, transmission and distribution of electricity
can in no way be considered as totally reliable activities. A residual risk of blackout or undesired
load shedding in critical zones remains. One can think that the most important risk of power cut
does not come from large disturbances like blackout because they are rare, but from local events
which are more frequent. However, previous blackouts showed that, despite their low occurrence,
their contributions to mean reliability indices are very important. For example, in Italy, the Average
Interruption Time (AIT) and the Energy Not Supplied (ENS) are, in average on the period 2007-
2011, respectively 0.73 min/year and 460 MWh/year [1]. The targets are maximum 1.00 min/year
and 550 MWh/year. As a comparison, the 2003 blackout in Italy caused an AIT of several hundreds
of minutes (50% of the load was re-supplied after 6.5 hours and 99% after 15 hours) and an estimated
ENS of 177 GWh [2]. Moreover, the occurrence of such a situation is likely to entail major direct
and indirect economical consequences, due to the amplitude of the event, as observed in recent
blackouts. For example, the economic losses of the blackout that happened in the Northeastern area
of the United States and in Canada on August 14, 2003 were about $4-$10 billion (approximately
50 million people affected) [3]. Assessing this residual risk and identifying scenarios likely to lead
to these feared situations is crucial to control and optimally reduce this risk of blackout or major
system disturbance. These issues become even more crucial when considering the current evolution
of the electrical sector. Renewable generation, which is inherently variable, must be absorbed - or
compensated - in all circumstances by the grid, increases the variability - in time and magnitude - of
the power flows. In the liberalization context, the transmission power system is required to operate
more intensively, even though the grid infrastructure is aging. All these elements are in addition
to the usual characteristics of the electricity supply security assessment issues (load variability,
scheduled line outages due to maintenance, as well as random equipment failures) and motivate
the development and the use of probabilistic tools complementary with the tradionnal deterministic
tools.
The objective of this PhD thesis was to develop a methodology able to reveal scenarios leading to
a blackout or a major system disturbance and to estimate their frequencies and their consequences
with a satisfactory accuracy. A blackout is a collapse of the electrical grid on a large area, leading
to a power cutoff, and is due to a cascading failure. Such a cascade is composed of two phases. The
first one is a slow cascade, starting with the occurrence of an initiating event (e.g. line fault or loss of
a power plant) and displaying characteristic times between successive events from minutes to hours.
Events are mainly due to independent failures, operators’ actions or thermal failures. The second
phase is a fast cascade, displaying characteristic times between successive events from milliseconds
to tens of seconds. Events are mainly due to the triggering of element protections when electrical
variables reach their associated setpoints. The restoration of the grid after a blackout or a major
load shedding can be viewed as an additional and last third phase. In cascading failures, there
is a strong coupling between events. Indeed, the loss of an element increases the stress on other
1
INTRODUCTION
elements and, hence, the probability to have another failure or to have elements disconnections
through their protections. It appears that previous probabilistic methods do not consider correctly
these dependencies between failures, mainly because the two very different phases are analyzed
with the same model. Thus, there is a need to develop a conceptually satisfying probabilistic
approach, able to take into account all kind of dependencies, by using different models for the slow
and the fast cascades. We propose to adapt dynamic reliability to the case of transmission power
systems. Dynamic reliability was initially developed, among others, for nuclear power plants and is an
integrated approach of Probabilistic Risk Analysis (PRA) allowing to consider the mutual interaction
between system states transition and process variables evolution. As well as in the nuclear sector, we
propose to decompose the blackout risk analysis in levels, according to the different blackout phases.
This decomposition allows to adapt differently dynamic reliability to each level. This PhD thesis
first focuses on the slow cascade progression up to the transition to the fast cascade. The proposed
methodology will account for the double interaction between power system dynamics and state
transition of the grid elements, as well as for variations in cross-border fluxes, in wind generation
and in the grid load, and for operator actions in the course of a transient. This PhD thesis also
introduces the development of a methodology to analyze the fast cascade, up to an operational state
with load shedding or a blackout.
This PhD thesis presents the first steps towards a three-level PRA of the blackout risk in transmis-
sion power systems. Chapter 1 introduces power systems. Chapter 2 analyzes some recent blackouts
or major system perturbations in order to understand the typical development of a blackout and
important phenomena to consider. Chapter 3 introduces reliability concepts that are used in this
PhD thesis. Chapter 4 presents existing reliability studies of power systems, especially the risk
assessment of cascading failures. Chapter 5 is devoted to the presentation and the development of
the proposed 3-level methodology, especially for the slow cascade. Then, Chapter 6 presents the
numerical results obtained by applying the methodology (level-I and two first levels) on two test
systems. Finally, Chapter 7 suggests some ideas for future work, before general conclusions.
The research work presented in this PhD thesis, started in October 2009, led to the following
communications:
1. Articles in international peer-reviewed journals
• “A level-1 probabilistic risk assessment to blackout hazard in transmission power systems”
in Reliability Engineering & System Safety, vol. 102, 2012 [4].
• “Blackout probabilistic risk assessment and thermal effects: impacts of changes in gener-
ation” in IEEE Transactions on Power Systems, 2013 [5].
2. Oral communications at international conferences with publication in the proceedings:
• “Towards an integrated probabilistic analysis of the blackout risk in transmission power
systems” at 2011 International Topical Meeting on Probabilistic Safety Analysis - Wilm-
ington, USA - March 2011 [6].
• “Role of Thermal Effects in Blackout Probabilistic Risk Assessment” at 2011 Electrical
Power and Energy Conference - Winnipeg, Canada - October 2011 [7].
• “Blackout PRA based identification of critical initial conditions and contingencies” at 12th
International Conference on Probabilistic Methods Applied to Power Systems - Istanbul,
Turkey - June 2012 [8].
• “Towards a 3-level blackout probabilistic risk assessment: achievements and challenges”
at 2013 IEEE PES General Meeting - Vancouver, Canada - July 2013 [9].
• “Two-level blackout probabilistic risk analysis: application to a test system” at ESREL
2013 conference - Amsterdam, Netherlands - October 2013.
2
INTRODUCTION
3. Oral communications at national conferences with publication in the proceedings:
• “PHI2 method and failure rate: application to power cables” at 18e congres de Maıtrise
des risques et de Surete de Fonctionnement - Tours, France - October 2012.
• “ Two-level integrated probabilistic analysis of the blackout risk in transmission power
systems” at 18e congres de Maıtrise des risques et de Surete de Fonctionnement - Tours,
France - October 2012.
3
Chapter 1
Introduction to electric energy
systems
1.1 Introduction
Electricity is a fundamental ingredient of modern society and has become a favorite form of energy
usage at the consumer end. Indeed, for the consumer, electricity is versatile, available (quasi) at
any time and clean. But electricity has a strong differentiation compared to other energies: it is
not susceptible, in practice, to being stored or inventoried. Electricity can be stored in batteries,
but price, efficiency, and size make this impractical for handling the amounts of electricity needed
every day in the world. Moreover, for several reasons (efficiency, cost, pollution, safety), electricity is
generated in power plants whose power (from some MW to 1.5 GW) is larger than individual needs.
Therefore, electricity must be generated in power plants and transmitted through the electrical grid
as it is consumed.
This Chapter explains basic notions that are used in this PhD thesis. It is mainly addressed to
people with limited background in electric energy systems.
1.2 Structure
1.2.1 Levels
The typical electrical grid structure, based on a three-phase system, is nearly the same in all
countries and is shown in Figure 1.1. It is the combination of three areas of operation including two
types of grids [10]:
1. Generation system: facilities for the generation of electricity from energy sources.
2. Transmission system/grid: facilities for the transport of the electrical energy from the power
plants to consumption areas through High-Voltage (HV) lines or cables. Several voltage lev-
els (typically from 30 kV to 500 kV) are used and transformers connect these levels. The
transmission network is a highly meshed grid: several different paths connect one point to
another.
3. Distribution system/grid: facilities for the delivery of the electricity from the transmission
system to individual consumers (e.g. residential, commercial, etc.) within a specific geograph-
ical area. Medium voltages are used (typically from 220 V to tens of kV). The distribution
networks are radial (there is one path to go from one point to another) or weakly meshed.
5
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
Figure 1.1: Electric power system configuration and structure. From [10].
These functional zones can be combined to give three hierarchical levels used in reliability evaluation
[11]. Hierarchical Level I (HLI) is concerned only with the adequacy between generation and load
(generation system studies). Hierarchical Level II (HLII) further includes the transmission system
(composite system studies). The purpose of the Hierarchical Level III is to include all the three
functional zones in an assessment of consumer load point reliability. However, due to the complexity
of the problem, HLIII studies are not directly conducted. As mutual interactions between the
distribution grid and the transmission grid are usually weak1, the distribution system reliability is
assessed independently.
In the actual liberalized European electricity sector, there are four different types of companies:
• The producers, generating electricity in power plants.
• The Transmission System Operators (TSOs) (one per geographical area), owning and operating
the transmission networks.
• The Distribution System Operators (DSOs) (one per geographical area), owning and operating
the distribution networks.
• The retailers or suppliers, buying electrical energy on wholesale market and reselling this
energy to consumers.
All these companies are implied in the reliability of the overall electrical grid.
In case of major system disturbances like blackouts, problems are mainly due to the generation
and the transmission grid. Consequently, this PhD thesis focuses on these two areas of operation
(HLII reliability analysis).
1.2.2 Elements
1.2.2.1 Power plants
There are many electrical generation technologies, but all facilities generate a three-phase, sinu-
soidal voltage system, with a controlled wave frequency and amplitude. Conventional power plants
1The actual implementation of renewable sources on the distribution side can reinforce this interaction.
6
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
include hydroelectric, thermal (fuel-oil/coal/gas), and nuclear power plants. They are connected to
the transmission grid. The hydraulic energy or the high pressure steam is converted into mechanical
rotating energy in the turbine. This mechanical energy is then converted into electric power by a
synchronous generator. The nominal power of these conventional power plants vary typically from
1 MWe (run-of-the-river plants) to 1600 MWe (largest nuclear units in the world). Other types
of power plants, often called alternative plants, are more and more implemented in electric grids.
They are mainly characterized by the use of renewable sources of energy: wind and solar energy.
Wind power plants convert wind energy to electrical energy through synchronous AC generators or
asynchronous machines. They are connected either to the transmission or to the distribution grid.
Their nominal power varies typically from 1 MWe to 5 MWe. Solar energy is mainly exploited by
photovoltaic cells which convert this energy into DC current. Combined heat and power (or co-
generation) plants, based on synchronous machines and connected to the distribution grid, are also
acquiring significance.
In a HLII analysis, power plants connected to the distribution grid can be viewed as negative
loads.
1.2.2.2 Transformers
Raising the electric current to high voltage is necessary to transmit large amounts of electric
power over long distances using reasonably inexpensive line or cable technology without having
unreasonable losses. However, the electrical energy cannot be generated directly and delivered at
too high voltages, due to limited dielectric strength of insulators and security reasons. Transformers
are then needed to raise or lower voltage. A transformer is constituted by two sets of coils around a
ferromagnetic core, immersed in oil to ensure optimum conductor insulation and cooling. A power
transformer in a substation is shown in Figure 1.2.
Figure 1.2: Power transformer in a substation. From [12].
1.2.2.3 Overhead lines
Transmission overhead lines consist of aluminium conductor steel-reinforced cables that rest on
towers. A set of insulators attaches the cables to the towers. To reduce the inductance of the line,
each phase of it is generally divided into two, three or four cables (duplex, triplex or quadruplex
cables). Two triplex overhead lines supported by a Beaubourg tower are shown in Figure 1.3.
7
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
Figure 1.3: Double circuit 400-kV overhead line. From [12].
1.2.2.4 Underground cables
The transmission system also relies on underground cables. It is mostly the case in urban areas
(due to specific constraints) and with low operating voltages (several tens of kV). Due to the high
voltages used, one cable per phase has to be used2, so cables are installed by groups of three, either
in trefoil or in flat formation (horizontal or vertical), as shown in Figure 1.4. The typical design
is shown in Figure 1.5. Initially, the insulation system was constituted by oil-impregnated paper.
However, since the 1960s, crosslinked polyethylene (XLPE) insulated power cables have increasingly
come into use [13].
Figure 1.4: Configurations of underground cables.
1.3 Static analysis
1.3.1 Components models
1.3.1.1 Power plants and loads
Power plants are usually modeled in static analysis by a source of active (PG) and reactive (QG)
powers. These powers can be set under specific limits, as well as the output voltage. Loads are
usually modeled by a consumption of active (PL) and reactive (QL) powers, which can vary or not
as a function of voltage.
2It is not the case for distribution systems, where the three phases can be grouped into one cable due to lower
voltages.
8
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
Figure 1.5: Typical design of underground cables. Adapted from [13].
1.3.1.2 Links
We will call “link” in this thesis either an overhead line, an underground cable or a power trans-
former. In steady-state conditions, a link can be modeled by a two-port network. In general, a
symmetric Pi-Network is used to represent such a two-port network [10], as shown in Figure 1.6.
The series impedance can be decomposed into a resistance which models the electrical resistivity
Figure 1.6: Line equivalent model.
of the link (Joule losses), and an inductance. The shunt impedance is in general dominated by
capacitive effects and we will neglect in our work the shunt resistance (line conductance). The shunt
impedance is then simply given by the shunt susceptance, also called “line charging”. The situation
can be slightly more complex for a transformer, since the complex tap ratio µ is not always equal
to one. The adaptation of the Pi-Network, including the simplification of the shunt impedance, is
shown in Figure 1.7. The tap bus (from bus) is on the left and the Z bus (to bus) on the right.
The complex current injections If and It at the from and to ends of the branch, respectively, can
be expressed in terms of the respective terminal voltages Vf and Vt:(IfIt
)=
((YS + jB/2)/τ2 −YS/µ∗−YS/µ YS + jB/2
)(VfVt
)= Yl
(VfVt
)(1.1)
where Yl is the admittance matrix for the link and ∗ denotes the complex conjugate. For an overhead
line or an underground cable, the tap ratio τ = 1 and the phase shift ϕPS = 0, so:
Yl =
(YS + jB/2 −YS−YS YS + jB/2
)(1.2)
9
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
Figure 1.7: Links equivalent circuit.
1.3.2 Load flow analysis
The load flow problem consists in finding the steady-state operating point of an electric power
system, given the load demanded at consumption buses and the assumed generation levels at specified
supply voltages [10]. Finding the steady-state operating point means obtaining all bus voltages. The
technique presented here relies on the Kirchhoff’s current law for each bus. If we consider a generic
bus i connected by links to a set Si of other buses and to the neutral or ground node through a
shunt admittance as shown in Figure 1.8, the net current injected to the bus by generators or loads
is Ii = IG,i− IL,i, where IG,i and IL,i are the complex currents injected by generating elements and
absorbed by loads, respectively. The Kirchhoff’s current law can be written
Ii =∑j∈Si
yij(Vi − Vj) + yiVi =
[ ∑j∈Si
yij + yi
]Vi −
∑j∈Si
yij Vj =
N∑j=1
YijVj (1.3)
where Y is the global admittance matrix (N ×N complex matrix, where N is the number of buses
in the network) whose elements Yij = Gij + jBij can be computed on the basis of link admittance
matrices discussed previously. As the loads and the generations are not given in terms of currents,
Figure 1.8: Elements connected to a bus.
but in terms of power, the load flow equations are based on the complex power,
Si = ViI∗i , (1.4)
where Si is the net complex power injected to bus i. The Kirchhoff’s law can then be written in
terms of complex powers by
SG,i − SL,i = Si = Vi
N∑j=1
Y ∗ij V∗j (1.5)
10
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
where SG,i and SL,i are the complex power injected by generating elements and that absorbed
by loads, respectively. By expressing the complex power in terms of active and reactive power,
S = P + jQ, and voltages in polar form, Vi = Vi∠θi, the active power balance equation at bus i can
then be written
PG,i − PL,i = Pi = Vi
N∑j=1
Vj(Gij cos(θij) +Bij sin(θij)), (1.6)
and the reactive power balance equation,
QG,i −QL,i = Qi = Vi
N∑j=1
Vj(Gij sin(θij)−Bij cos(θij)), (1.7)
where θij = θi − θj . These are the load flow equations.
Each node provides two load flow equations and four unknowns (Vi,θi,Pi,Qi), which means that
two quantities per node have to be specified to solve the resulting set of equations. In a power
system, there are two different types of nodes:
• Those where a classical power plant is connected to. A power plant regulates the voltage and
injects a precise value of active power. On the contrary, reactive power is produced to maintain
the voltage to its nominal value. They are then called generation buses or PV buses (active
power and voltage are fixed).
• Those where no power plant is connected to. Both active and reactive power absorbed by the
sum of loads connected at the bus are specified. They are then called load buses or PQ buses.
The idea of the load flow analysis is to set voltage magnitudes Vi and generated active powers PG,iat all generation buses except one, the swing bus (or the slack bus), where the voltage and the angle
are set. Variables are the voltage angles at PV and PQ buses θi and voltage magnitudes at PQ buses.
These values are computed on the basis of balance equations for active power at PV and PQ buses
and reactive power at PQ buses. If we have m PV buses and n PQ buses, there are m+2n non-linear
equations to solve with m+2n state variables ((θPV1 , .., θPVm ) and (θPQ1 , .., θPQn , V PQ1 , ..., V PQn )). Once
these m+ 2n equations are solved, the m+ 2 other equations (reactive power balance equations at
PV buses and active/reactive power balance equation at the swing bus) are used to find the reactive
power generation at PV buses and the power generation at the swing bus.
As an example, we can study a power plant powering a load through one line, as shown in Figure
1.9. We consider the line as purely inductive. Bus 1 is naturally defined as the swing bus (only
Figure 1.9: Power plant powering a load through one line.
one generating node) and bus 2 as a PQ bus. The bus 1 voltage is fixed to the reference voltage,
V1 = Vref , and its angle to a null reference value, θ1 = 0. The active power equation for bus 2 can
be written as
− PL,2 = V2Vref−1
XLsin θ2 (1.8)
11
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
and the reactive power equation as
−QL,2 = V2
[Vref
−1
XLcos θ2 + V2
1
XL
]. (1.9)
These equations are non-linear and an analytical solution for V2 and θ2 is difficult to obtain in a
general case. However, we propose to solve them in the specific case QL,2 = 0. In this case, we have
V 22 (V 2
ref − V 22 ) = X2
LP2L,2, (1.10)
and
sin(2θ2) =2PL,2XL
V 2ref
. (1.11)
These equations show that a maximal power can be demanded at bus 2, given by
PmaxL,2 =V 2ref
2XL. (1.12)
In other words, the line inductance limits the power transfer. The P-V curves in a general case for
QL,2 6= 0 but for different power factors are given in Figure 1.10. The power factor is defined by
P/|S| and the maximal active power varies with it. As the typical instantaneous behavior of loads
active power is an increasing function of voltage, the upper part of each curve refers to a stable
operation mode and the lower part to an unstable operation mode.
Figure 1.10: P-V characteristics of the one-line system. From [14].
1.3.3 Optimal power flow
In the classical load flow problem exposed above, the steady state of the grid is computed by
fixing a priori the active power generation at the voltage magnitude at generation buses. One can
be interested in exploiting these degrees of freedom in order to
• Minimize the cost of generation in a secure state,
• Minimize the load shedding needed to reach a secure state from an insecure state.
The general idea of Optimal Power Flow (OPF) is to find a solution of the power system operating
state to optimize a given objective (the cost of generation or the load shedding) while satisfying
load flow equations, as well as all given feasibility and security requirements [10]. OPF is then an
optimization problem and can be mathematically formulated as
minuf(x, u) subject to
h(x, u) = 0
g(x, u) ≥ 0(1.13)
12
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
where u is the set of decision variables (e.g. active power injection and voltage magnitude at
generation buses and load shedding at load buses), x is the set of dependent variables (e.g. voltage
angles at generation buses and voltage magnitudes and angles at load buses), f is the scalar objective
function, h(x, u) = 0 is the set of network equations, and g(x, u) ≥ 0 is the set of operational and
security constraints.
1.4 Dynamic analysis
1.4.1 Components models
In dynamic analysis at the transmission system level, the same models are usually kept for links
as in the static analysis, but dynamic models are adopted for generators and loads.
The basic component of a power plant is the synchronous machine, which can be described by
a set of mechanical and electrical differential equations between mechanical angle, voltages and
currents. The size of this set can vary from 2 equations to 7, according to the complexity needed.
The generator excitation system consists of an exciter and an automatic voltage regulator and is
necessary to supply the generator with DC field current. This excitation system can be modeled
by a set of differential equations. In a conventional power plant, the synchronous generator is
driven by either a steam turbine, a gas turbine or a hydro turbine. The turbine is equipped with a
governing system to regulate the power input. This turbine-governor system is also modeled by a
set of differential equations. Except for specific simplified developments in Appendix C, this PhD
thesis does not develop these dynamic equations. The reader can find detailed information on this
topic in [14].
Load modeling at the transmission grid side is a complex problem, since loads are composite
(induction motors, discharge lighting, heating, electronic devices, ...). Most models used are quasi-
static: they model the load as an algebraic function of voltage and frequency [15, 16]. They implicitly
suppose that the equilibrium is instantaneously reached during a voltage/frequency transient. For
example, the ZIP3 model decomposes the load as a fraction of constant impedance, a fraction of
constant current and a fraction of constant power. As we will discuss in the perspectives Chap-
ter, such models can lead to non-convergence during dynamic simulations. Consequently, they are
not convenient to model specific electrical transients. Other models were developed to model the
time-dependent evolution of the load in case of voltage and/or frequency transient. They lead to
differential equations.
1.4.2 Protection systems
When a fault occurs, the faulty circuit must be disconnected quickly in order to keep the conti-
nuity and quality of service. This is one important aim of protection systems. Independently of a
fault occurrence, specific electrical transients could result in extreme working conditions for certain
elements. The other aim of protection systems is to disconnect elements operating in unacceptable
conditions in order to protect them.
A protection system includes all components that allow the fault to be detected, analyzed and
removed: battery, measurement devices (instrument transformers such as voltage transformers and
current transformers), protection relay and automatic circuit breaker. A network protection system
is in general structured into two forms: primary relaying, responsible for initially removing the fault,
and back-up relaying, responsible for removing the fault if primary relaying fails.
3Z for impedance, I for current, P for power.
13
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
Several categories of protection systems exist, according to the element to protect [17, 18]:
• Over-current protections. An over-current relay is simply a relay that operates or picks up
when the current exceeds a pre-determined value. It can help to protect an element from faults
or from an abnormal overload without fault. Over-current relays are not inherently directional.
Over-current relays can be instantaneous, or with an intentional constant time delay, or with a
time delay depending on the overload such as the higher the current, the smaller the operating
time (e.g. inverse time characteristics).
• Distance protections. They respond to the complex apparent impedance Z (“electrical dis-
tance”, Z = V /I, where V is the element complex voltage and I its complex current) between
the relay location and the fault location. They are usually using three zones with different
tripping times, as shown in Figure 1.11. The aim of zone 1 is to protect the line section instan-
taneously, but not to trip the protected line if a default occur on an adjacent line. Therefore,
zone 1 must not overreach the end of the line section. As errors in the fault location prediction
could occur (e.g. measurement errors), zone 1 should underreach the end of the line section. It
is set usually between 85 and 90% of the line length and it has to be operated instantaneously.
Thus, zone 1 does not protect the entire area between the end of zone 1 and bus B. The
purpose of zone 2 is then to cover this area and it deliberately overreaches beyond the remote
terminal of the transmission line to 120-150% of the line length AB. This zone 2 has a time
delay of about 300 ms. It also backs up the distance relay of the neighboring line. Zone 3 is
applied as a remote backup to zones 1 and 2 of an adjacent line.
Figure 1.11: Three-zone step distance relaying to protect 100% of a line, and back up the neighboring
line. From [18].
• Differential protections. A differential relay is intended to respond to the difference between
incoming and outgoing electrical quantities associated with protective apparatus. The purpose
of such a protection is then specifically to detect faults and not overloads.
• Over-excitation protections. Over-excitation, due to a combination of low frequency and high
voltage, can cause thermal distress in power transformers and generators. Therefore, the ratio
of the voltage to frequency (Volts/Hertz) must be monitored and the over-excitation protection
must trip the generator/transformer if this ratio exceeds a pre-determined value. Such as the
over-current relays, they can be instantaneous, or with an intentional constant time delay, or
with a time delay depending on the overload such as the higher the current, the smaller the
operating time.
• Under-voltage and over-voltage protections. Protections for generator overvoltage have in
general both an instantaneous unit and a time delay unit with an inverse time characteristic.
Under-voltage can be a problem for auxiliary equipment and can then cause indirectly the trip
of the generator.
• Under-frequency and over-frequency protections. The operation of generators at abnormal
frequencies (either over-frequency or under-frequency) can induce mechanical resonances in
the many stages of turbine blades. The abnormal frequencies protections trip the turbine,
with a time delay depending on the speed deviation.
14
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
• Loss-of-field or loss-of excitation protections. The source of excitation for a generator can
be completely or partially removed and this kind of event can induce dangerous operating
conditions for both the generator and the system. The detection method is based on the
variation of impedance viewed from the generator terminals (through distance relays).
• Loss-of-synchronism. When a generator looses synchronism, the resulting high peak currents
and off-frequency operation can cause damage to the generator. The generator thus should be
tripped without delay. The conventional relaying approach for detecting a loss-of-synchronism
condition also relies on the analysis of complex apparent impedance as viewed from the gen-
erator terminals.
• ...
All transmission systems are not using all these protections. For example, over-current protections
are not used in the Belgian transmission system.
In order to help to stabilize the system in particular situation, under-frequency and/or under-
voltage (depending on the country) load-shedding relays are installed on the grid. Defense plans
give specific voltage and/or frequency steps for these load shedding relays (load percentage to shed
with a time delay for each step). Only these relays are designed to protect the overall system in
order to avoid to reach a feared situation. All other protection systems are designed to protect a
particular component or a particular subsystem. The latter can thus have a negative effect on the
overall system (e.g. power plants under-frequency protections).
1.4.3 Eigenvalue analysis
The dynamic model of the grid leads to a set of non-linear algebraic and differential equations.
These equations can be linearized around the working point in order to study the system response
to small perturbations. The eigenvalues and eigenvectors of the matrix representing this set of linear
differential equations can then be computed. They indicate the oscillation modes that could occur
in the network, and their damping [14].
1.4.4 Dynamic simulation
Obviously, the eigenvalue analysis is not convenient to study the power system response to a
severe transient disturbance such as a fault on transmission facilities, loss of generation, loss of a
large load, ... In these cases, a dynamic simulation based on the solution of non-linear algebraic
and differential equations is used. Several approaches for solving numerically (based on a time-
discretization scheme) these equations have been developed, depending on the numerical methods
and modeling details used [14]. These approaches have been implemented in commercial software
codes, such as Eurostag (Tractebel) and PSS/E (Siemens).
1.4.5 Angle, voltage and frequency stability
Different types of electrical instabilities can occur in a power system : rotor angle instability,
frequency instability and voltage instability, as shown in Figure 1.12. All these instabilities can lead
to a collapse of the power system and, then, to a blackout. We briefly present these instabilities
here, but the reader can find more details on this topic in [19].
1.4.5.1 Rotor angle instability
Rotor angle stability refers to the ability of the synchronous machines of an interconnected sys-
tem to remain in synchronism. It depends on the ability to maintain/restore equilibrium between
15
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
Figure 1.12: IEEE-CIGRE classification of power system stability. From [19].
electromagnetic torque and mechanical torque of each synchronous machine in the system. There
are two types of angle instabilities: transient and small-disturbance. Transient stability (or large-
disturbance rotor angle stability) refers to the rotor angle stability after the system was subject to a
severe disturbance, such as a short-circuit in the grid. Small-disturbance stability refers to the rotor
angle stability after the system was subject to a disturbance sufficiently small so that linearization
of the power system around its equilibrium point before the disturbance is acceptable for purposes
of analysis.
1.4.5.2 Voltage instability
Voltage stability refers to the ability of a power system to maintain steady voltages at all buses
(inside operational limits). It is strongly linked with the physical limitation of the transmitted power
through a power line by its impedance. This corresponds to the P-V characteristic curve developed
in Subsection 1.3.2 and to the unstable lower part. A transition from the upper stable part to the
unstable lower part (voltage collapse) can occur after the loss of a grid element. We can consider for
example a simple system with a power plant powering a load through two identical lines, as shown
in Figure 1.13. A possible collapse process after the loss of one line is illustrated in Figure 1.14.
Figure 1.13: Power plant powering a load through two lines.
From an initial stable operating point, another operating point is instantaneously reached after the
contingency, if we assume that the load follows instantaneously a constant impedance characteristic.
However, this new operating point corresponds to a consumed power lower than previously. A load
recovery transient thus begins to recover the same consumed power. During this transient, the
critical point is reached because it is impossible to recover the initial power, and a voltage collapse
occurs. A voltage instability can also occur when an operating point is reached on the upper part
of the P-V curve, but outside operational limits of elements. The disconnection of the concerned
elements can deteriorate the situation. The reader can find more details on this instability in [15].
16
CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS
Figure 1.14: Collapse process on PV curves.
1.4.5.3 Frequency instability
Frequency stability refers to the ability of a power system to maintain its frequency around its
nominal value (inside operational limits). In an electrical grid, the generation must be equal to the
consumption at any time (active power). A non-equilibrium between the mechanical power produced
in power plants and the electrical power consumed in the network implies a frequency change. This
can be easily understood through the motion equation of the generator rotor [10],
JdΩ
dt= Tm − Te (1.14)
where J is the inertia momentum of the rotating masses, Ω the mechanical angular speed, Tmthe net mechanical torque (mechanical torque at the turbine minus damping torque), and Te the
electrical torque due to the synchronous machine. Because the electrical energy is generated through
a synchronous machine, the voltage frequency is proportional to the mechanical angular speed. At
the equilibrium, Tm = Te and the angular speed (and, hence, the frequency) is constant (dΩdt = 0).
A frequency decrease (dΩdt < 0) means that the load is higher than the generation (Te > Tm) and
a frequency increase (dΩdt > 0) that the load is smaller than the generation (Te < Tm). Thus, the
generation in power plants is regulated according to the frequency. The automatic generation control,
called primary control, acts in some seconds and increases the generation proportionally to the
frequency mismatch to the frequency reference. Protections are also present at the level of loads to
prevent a frequency collapse. These protections shed load when the frequency is too low. Frequency
stability is then associated with the recovery of system frequency through automatic generation
control and automatic load shedding after large active power imbalances between generation and
load due to system disturbances (for example system splitting).
17
Chapter 2
Blackouts and major system
disturbances
2.1 Introduction
The blackout state is defined by the ENTSO-E1 as the interruption of electricity generation,
transmission, distribution and consumption processes, when operation of the transmission system
or a part thereof is terminated. Blackout state is always qualified as “wide” [20]. A blackout is
due to a cascading failure, following the occurence of an initiating event (e.g. line fault or loss
of a power plant). The first step in developing a methodology able to reveal dangerous scenarios
leading to blackout is to know major phenomena occurring during such a cascading failure in order
to include them in the modeling. This Chapter reviews selected recent blackouts or major power
system disturbance in order to establish a typical blackout development. Additional information
about these blackouts and other recent blackouts can also be found in [21]. Section 2.2 analyzes the
major system disturbance that occurred in the Western area of the United States on August 10, 1996;
Section 2.3 the blackout that happened in the Northeastern area of the United States and in the
Southeastern area of Canada on August 14, 2003; Section 2.4 the blackout that happened in Southern
Sweden and Eastern Denmark on September 23, 2003; Section 2.5 the blackout that happened in
Italy on September 28, 2003 and Section 2.6 the major system disturbance that occurred in Europe
on 4 November, 2006. Finally, Section 2.7 tries to derive a typical blackout development from the
previous analyses and describes important phenomena that should be considered in a blackout PRA.
2.2 United States, 1996
On August 10, 1996, at 15:48 Pacific Daylight Time (PDT), a major disturbance occurred in
the Western Interconnection resulting in the interconnection separating into four electrical islands
(as shown in Figure 2.1), and in the loss of over 28,000 MW of load (approximately 6.5 million
customers) in the West [22]. Even if a huge number of customers endured power outages, the
blackout was avoided in each of these islands. Outages lasted from a few minutes to as long as nine
hours (last customer re-supplied at 01:00 on August 11). The initiating event was the tripping of
the 500 kV Big Eddy - Ostrander line at 14:06 PDT because it flashed (arced) and grounded to a
tree. Two other 500 kV lines (John Day - Marion and Keeler - Allston) opened and locked out at
14:52 and 15:42 after flashing and grounding to a tree. Because a Marion circuit breaker was out
of service, the 500 kV Marion - Lane line was forced out of service when the John Day - Marion
flashed and grounded to a tree. At 15:47:36 PDT, the 230 kV Ross-Lexington line opened when
1European Network of Transmission System Operators for Electricity
19
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
it flashed to a tree. This fault resulted in system protection also removing the Swift hydroelectric
power plant (207 MW). Between 15:47:36 and 15:48:09 PDT, all hydroelectric McNary generating
units were removed from service as a result of erroneous operation of a relay. A mild negatively
damped oscillation then began on the transmission system, and voltages collapsed. Several tens of
lines opened between 15:48:52 and 15:50:00 due to out-of-step and low voltage (via distance relays)
conditions, which led to the separation of the WSCC network into four islands (North, Northern
California, Southern and Alberta). The cumulative number of events as a function of time is shown
in Figure 2.2.
Figure 2.1: Sequence of significant events and islands formed on August 10, 1996. From [22].
Figure 2.2: Rate of events during the cascade.
North island experienced acceptable over-frequency, but several remaining lines opened, which
led to the loss of about 450 MW of customer demand (about 154,000 customers). Electricity was
restored to these customers between 16:20 and 17:01. Frequency within the Northern California
20
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
island dropped, as shown in Figure 2.3. This drop caused the loss of 7,937 MW of generation
and the automatic under frequency load shedding program to remove within this island blocks of
customer demand. This automatic load shedding stabilized the frequency. However, dispatchers
had to manually shed load from 17:22 to 17:32 to bring the frequency back to normal. In total, the
Northern California island lost 11,602 MW of demand (about 2.9 million customers). All customers
had electric service restored by 01:00 on August 11 in this island. The Southern island endured also
a low frequency, as shown in Figure 2.4. Generation summing up to 13,497 MW was disconnected
and 15,820 MW of customer demand (about 4.2 millions customers) were removed from service
(both by under frequency relays and manual load shedding). By 21:42, all the demand shed in the
Southern island was restored. After the separation, the frequency slightly dipped in the Alberta
island, which led to the removing from service of 146 MW of generation and to the shedding of 968
MW of demand (about 192,000 customers) by under frequency relays. Electric service was restored
to all customers in this island by 17:39.
Figure 2.3: Northern California island frequency during major system disturbance on August 10,
1996. From [22].
2.3 United States & Canada, 2003
On August 14, 2003, a few minutes after 4:00 pm Eastern Daylight Time (16:00 EDT), a blackout
occurred in the Northeastern area of the United States and in the Southeastern area of Canada.
Approximately 50 million people were affected and the economic losses in the United States were in
a range between $4 billion and $10 billion [3]. The power was restored only after four days in some
parts of the United States. The blackout started in Ohio, in the FirstEnergy (FE) area (see Figure
2.5), and rippled in the last part of the cascading failure from the Cleveland-Akron area across
much of the northeast United States and Canada. The initiating event was the tripping of Eastlake
Unit 5 (rated at 597 MW) in northern Ohio connected to FE’s 345-kV transmission system at 13:31
EDT. Transmission line loadings were then notably higher but well within normal ratings. Three
345-kV lines tripped at 15:05, 15:32 and 15:41 EDT (see Figure 2.6), due to a contact between the
line conductor and a tree. Two of them were not overloaded (respectively 44% and 88% of rated
values). Between 15:42:53 EDT and 16:05:55 EDT, several (about 13) 138-kV lines tripped (see
Figure 2.7), due to short circuits with ground. A problem with the tripping of a circuit breaker
induced the loss of the Canton Central 345/138-kV transformer at 15:45 EDT and another circuit
21
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
Figure 2.4: Southern island frequency during major system disturbance on August 10, 1996. From
[22].
breaker failure on West Akron transformer #1 causes the five remaining 138-kV lines connected to
the West Akron substation to open. At 16:05:57 EDT a 345-kV line (Sammis-Star) tripped on too
low apparent impedance (depressed voltage divided by abnormally high line current) in protective
zone 3. At 16:06 and 16:08 EDT, three more overloaded 138-kV lines tripped. With another loss of
a 345-kV line at 16:08:59 EDT, the rate of trips increased (see Figure 2.8) and the cascade spread
beyond the Cleveland-Akron area. At 16:13 EDT, the cascading sequence was essentially complete.
Many of the key lines which tripped during this phase operated on zone 3 impedance relays (or zone
2 relays set to operate like zone 3s) which responded to overloads rather than to true faults on the
grid. Power plants tripped mainly on low voltages or over-excitations, but also on under-frequency
and over-current.
Figure 2.5: Geography of the FirstEnergy area in August 2003. From [3].
22
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
Figure 2.6: Cumulative effects of sequential outages on remaining 345-kV lines during cascading
failure on August 14, 2003. From [3].
Figure 2.7: Simulated effect of prior outages on 138-kV line loadings during cascading failure on
August 14, 2003. From [3].
During this cascade, the Midwest Independent System Operator (MISO) state estimator (a system
monitoring tool) was unable to assess system conditions for most of the period between 12:15 EDT
and the end of the cascading failure, due to a combination of human errors (inaccurate input data)
and computer problems. MISO is the reliability coordinator for FirstEnergy. At 14:02 EDT, a 345-
kV line tripped due to a tree contact. This loss had no significant electrical effect on power flows
and voltages in the FE area, but it contributed to the failure of MISO’s state estimator to operate
effectively (no immediate update of its status in the state estimator). Consequently, operators did
not identify fast enough problems on the network to take adequate corrective actions.
At 16:13 EDT, approximately 61,800 MW of customer load were lost in an area that covers 50
million people. The total load restored was about 1,340 MW at 19:30 EDT, 21,300 MW at 23:00
EDT, 41,100 MW at 5:00 EDT (August 15) and at least 48,600 MW at 11:00 EDT. On August 16
23
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
Figure 2.8: Rate of line and generator trips during cascading failure on August 14, 2003. From [3].
at 11:00 EDT, the North American Electric Reliability Corporation (NERC) stated “Virtually all
customers have been returned to electric service, although some customers will continue to experience
rotating outages due to generating capacity availability.”2. On Sunday August 17 at 17:00 EDT,
the NERC stated “The electric transmission system is now operating reliably. All electric power
transmission lines that were removed from service during the blackout on August 14, 2003, have
been returned to service with one exception. The lines between Michigan and Ontario remain out
of service due to operational security reasons; however, they are expected to be returned to service
later this evening. Most of the electric generating units that were removed from service during the
blackout have now been returned to service (the exact number of units that went out of service is
not yet known). Twenty-one of these remain out of service. A number of these generating units are
expected to return to service either this evening or Monday morning. All but one of the units are
expected to return to service during the coming week. No rotating blackouts are currently underway
and none are expected for Monday.”3.
To summarize, the cascading failure leading to the blackout started with the loss of a power plant
at 13:31 EDT (August 14, 2003). From this initiating event to 16:09 EDT, the rate of trips was low
(time between events from tens of seconds to tens of minutes). Then, the rate of trips increased
after the loss of a 345-kV line (time between events from milliseconds to some seconds). At 16:13
EDT the blackout state was reached on a large area. The complete restoration took some days.
2.4 Sweden & Denmark, 2003
On September 23, 2003, at 12:36 (local time), a blackout occurred in Southern Sweden and
Eastern Denmark (total non-supplied demand: 10 GWh) [23]. The total demand in Sweden was
quite moderate (15,000 MW) due to the unusually warm weather for the season, but four nuclear
units were out of service (on-going annual overhaul and delayed restarts due to safety requirements),
as well as two 400 kV lines (scheduled maintenance) and HVDC links to Poland and Germany. The
initiating event was the loss of a nuclear power plant (1,250 MW) at 12:30 on the eastern coast.
Five minutes later, a double busbar fault occurred in a 400-kV substation on the western coast of
Sweden, as shown in Figure 2.9. The reason was a thermal damage to one disconnector device: one
2NERC Press Release, 8/16/2003 11 a.m. EDT3NERC Press Release, Sunday August 17, 2003, 5:00 p.m.
24
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
of the mechanical joints had been disrupted as a result of overheating. The loading current of the
isolator had increased from around 1,000 A to some 1,500 A following the initiating event (rating
for maximum load: 3100 A). About 90 seconds after the busbar fault, the situation developed into a
Figure 2.9: Faulty disconnector in Horred during cascading failure on September 23, 2003. From
[23].
voltage collapse in a section of the grid, as shown in Figure 2.10. Very low levels of voltage entailed
distance protections reaching the low impedance criteria to trip circuit breakers. Thereby, the grid
split up into two parts, leading to the isolation of the Southern part, comprising the South of Sweden
and Eastern Denmark. The latter subsystem suffered from an important imbalance between power
injection to the system and system load. Within seconds, the frequency and voltage had dropped
to unacceptable levels for generators which led the entire area to blackout. The immediate basis for
the restoration was the intact grid north of the split: lines and substations were energized to build
up the grid from north towards the south. By 19:00, almost all loads were re-supplied.
Figure 2.10: Registration of voltage in the north of Sweden during cascading failure on September
23, 2003. From [23].
2.5 Italy, 2003
On September 28, 2003, a few seconds after 03:28 (local time), a blackout occurred in Italy (about
57 million people affected) [2]. The power was restored only after 18 hours in some part of Italy.
The initiating event was the tripping of a 380-kV line between Switzerland and Italy at 03:01:42
(line 1 in Figure 2.11), due to a tree flashover. This line was loaded at approximately 86% of its
maximum capacity. Indeed, all tie-lines4 between the Italian grid and the rest of the European
grid were highly loaded just before the initiating event because Italy was importing 6,651 MW from
the northern border (France, Switzerland, Austria and Slovenia). The attempts of reclosing failed
due to an overly high phase angle (42). After the loss of this line, the load on the neighboring
lines increased. At 03:25:21, a second 380-kV line tripped (line 2 in Figure 2.11), after flashover
4A tie-line is a circuit (e.g. a transmission line) connecting two or more control area or systems of an electric
system.
25
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
with a tree. This line was operating at around 110% of its nominal capacity just after the loss
of the first line. From 03:02 to 03:25, operators tried to eliminate the overload: imports from the
northern border were reduced to 6,326 MW. Unfortunetely, the thermal transient was faster than
operators. At 03:25:25, 03:25:26 and 03:25:28, three 220-kV lines tripped (lines 3.1, 3.2 and 4 on
Figure 2.11) due to high overloads (trip on high current according to protection devices). The
Italian grid then lost its synchronism with the UCTE main grid which entailed the disconnection
of all remaining connecting lines between Italy and UCTE by regular function of the protection
devices. In fact, the isolated area was not exactly Italy (see Figure 2.11) and the total imbalance of
this isolated area just after the separation was about 6,646 MW. This negative imbalance between
power injection to the system and system load caused an abrupt frequency drop (see Figure 2.12).
The primary control operation of the generating units increased the generation of about 1,465 MW
a few seconds after the event, but the frequency felt by 1.5 Hz in this time. All the pumping units in
service were automatically disconnected between 49.720 and 48.985 Hz, shedding about 3,220 MW.
Moreover, starting from 49.70 Hz, 7,710 MW were automatically shed during the frequency transient
(about 85% of 1300 frequency relays functioned normally). But about 7,532 MW of generation were
also lost during the transient for many reasons (turbine tripping, underfrequency relay operation,
undervoltage relay operation, ...). Therefore, frequency felt below 47.5 Hz, resulting in the tripping
of the generating units that were still in operation, leading to a blackout at 03:28:05. Eight power
plants switched in isolated operation on house-load, which improved the restoration phase. From
the splitting from the UCTE network to the blackout, the transient last for 2.5 minutes.
Figure 2.11: Line of separation from UCTE during cascading failure on September 28, 2003. From
[2].
The restoration stage started just after the diagnosis. 50% of the load was re-supplied after 6 hours
and 30 minutes, 70% after 10 hours, 99% after 15 hours and the last customer was re-connected
after 18 hours and 12 minutes.
2.6 Europe, 2006
On November 4, 2006, around 22:10 UTC+1, the UCTE European interconnected electric grid
was affected by a major system disturbance that led to power supply disruptions for more than 15
million households [24]. However, the blackout was avoided. The problem started from the North
German transmission grid with a manual opening of a double 380-kV line at 21:38. At this time, a
26
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
Figure 2.12: Frequency versus imbalances during cascading failure on September 28, 2003. From [2].
large power flow was going from East to West. After the manual switch-off, this flow was transferred
to other lines. In particular, the current in another 380-kV line was very near its tripping current
(2,100 A). Operators expected that coupling two busbars in a substation would end up in a reduction
of the current by about 80 A. This maneuver was done at 22:10:11 UTC+1 but the current in the
line increased by 67 A (instead of decreasing) and the line was automatically tripped at 22:10:13
UTC+1 by the distance relays due to overloading. At this time, under-damped oscillations appeared
inside the UCTE electric grid (see Figure 2.13). Between 22:10:15 UTC+1 and 22:10:27 UTC+1,
four 220-kV lines and nine 380-kV lines tripped on overcurrent (distance protection), increasing the
oscillations. Between 22:10:28 and 22:10:29, sixteen more lines tripped, leading to a splitting of the
UCTE network in three areas (see Figures 2.13 and 2.14).
Figure 2.13: Frequency recordings until area splitting during cascading failure on November 4, 2006.
From [24].
27
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
Figure 2.14: Schematic map of the UCTE area split into three areas during cascading failure on
November 4, 2006. From [24].
After this separation, the Western area (composed of Spain, Portugal, France, Italy, Belgium,
Luxemburg, The Netherlands, a part of Germany, Switzerland, a part of Austria, Slovenia and a part
of Croatia) faced significant supply-demand imbalance (about 8,940 MW over a generation of 182,700
MW). The frequency then dropped quickly to about 49 Hz (see Figure 2.15). According to defense
plans, a total of about 17,000 MW of consumption and 1,600 MW of pumps were automatically shed
on frequency set points during the transient. There is a difference between the initial imbalance and
the total load shed because power plants tripped during the frequency transient. About 10,200 MW
of wind and combined-heat-and-power generation and a thermal generation unit of about 700 MW
of nominal power tripped, increasing the imbalance. In order to quickly restore the balance and
the frequency to its nominal value of 50 Hz, TSOs manually started generation units (mainly hydro
ones) for a total of about 16,800 MW.
In the opposite, the Northeastern area faced severe imbalance conditions with a generation surplus
of more than 10,000 MW (approximately 17% of total generation in this area before the splitting).
The frequency then rose quickly to about 51.4 Hz (see Figure 2.15). However, in few seconds, this
frequency was reduced to the range of about 50.3 Hz by primary control and automatic tripping
of the generating units sensitive to high frequency value (mainly windmills). At this stage, the
new steady-state situation in this area 2 resulted in power flows within acceptable limits without
serious danger for power systems operation. But the windmills slowly started being automatically
reconnected to the power systems (in Germany and Austria) thus gradually increasing generation
in these control areas. To compensate, thermal generation decreased. The consequence of this
overall process was the overloading of some lines. Fortunately, the successful resynchronization of
the Western area with the Northeastern area at 22:47 UTC+1 decreased the flows to acceptable
levels within half an hour.
2.7 Typical blackout development
Before outlining a typical blackout development scheme, it is important to remind the important
characteristic times in an electrical grid, as illustrated in Figure 2.16. Electrical transients occur
28
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
Figure 2.15: Frequency recordings after the split during cascading failure on November 4, 2006.
From [24].
with a large range of time constants, ranging from some milliseconds for electromagnetic transients
to some tens of seconds for voltage transients involving load tap changers. Operators reaction times
are in general from several minutes to some tens of minutes. Thermal transients occur in electric
grids with time constants ranging from some tens of minutes (for overhead lines) to some hours
(for underground cables and power transformers). The mean time between two independent failures
varies from some hours to some weeks, depending on the grid’s reliability and size.
Figure 2.16: Important characteristic times in a cascading failure.
As shown before, a blackout is due to a cascading failure, following the occurrence of an initiating
event (e.g. line fault or loss of a power plant). However, the N − 1 security rule applied by
Transmission System Operators (TSOs) is a rule according to which elements remaining in operation
after a fault of transmission system element must be capable of accommodating the new operational
situation without violating operational security limits [20]. Therefore, one unique contingency should
not entail a fast collapse of the electric grid and at least one more contingency is necessary. Obviously,
a second event, independent of the first one, can occur before any corrective action, as it seemed
to be the case for the Swedish/Danish blackout5. But, as the mean time between two independent
failures is high compared to the operators characteristic times, the probability of such a succession
of independent events is usually very low. Some blackouts can be due to multiple initiating events
whose occurrence makes directly the N−1 security rule no longer valid. Earthquakes, storms, tower
failures, ... can be the cause of the simultaneous (or quasi-simultaneous) loss of several elements.
5Even if [23] states “The probability of such a coincidence is extremely low as the interrelation between the faults
in the two separate locations was either zero or very weak”, it is not obvious for us that the initiating event did not
increase the probability of failure of the mechanical joint.
29
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
For example, the blackout which occurred in November 2009 in Brazil and Paraguay was due to
heavy rains and strong winds which caused short-circuits in a power transformer, leading to the
loss of the Itaipu hydroelectric power plant. A hidden failure is a permanent defect that will cause
one or several protection systems to incorrectly remove corresponding circuit element(s) as a direct
consequence of a fault in the grid6: a protection can trip an element although it should not trip.
Moreover, a protection system can fail to trip a faulted element, what entails the trip of other
elements by distance relays. Such protection systems failures revealed by an initiating event can
be the cause of the quasi-simultaneous loss of several elements and make quasi-directly the N − 1
security rule no longer valid. Additional contingencies can also be due to thermal effects. Following
the occurrence of a first event, the reconfiguration of the power flows in the grid can induce a thermal
transient which increases the temperatures of overhead lines, underground cables and transformers.
When the temperature of a line increases, its sag also increases, possibly leading to a short circuit
between the line and the vegetation. When the temperature of a cable or a transformer increases,
the dielectric strength decreases, possibly leading to a dielectric breakdown. If another element
undergoes a thermal failure, the thermal effect on other elements will be reinforced, possibly leading
to a cascade. The most famous example of such a thermal and slow cascade is the 2003 blackout
in the Northeastern area of the United States and in the Southeastern area of Canada, where about
20 high-voltage overhead lines sagged low enough to enter in contact with something below them
between 3 PM and 4 PM [3]. In this case, operators were not able to take fast enough corrective
actions due to a lack of situational awareness. After each short-circuit occurring in a cascade, the
problem of hidden failures can lead to the removal of several elements. An operator action can also
trigger a collapse, as it was the case in the major system perturbation in November 2006 in Europe:
based on an incorrect state estimation, a busbar coupling caused a line tripping.
Based on the analysis of these past blackouts and major system disturbances, and of other recent
past blackouts [26], the typical development of a cascading failure leading to a blackout can be
split in two phases, as illustrated in Figures 2.17 and 2.18. Following the occurrence of an initial
perturbation (initiating(s) event(s): the loss of one or several elements), two possibilities arise. If
this perturbation causes the simultaneous loss of several elements (due to a common mode failure or
a protection system failure) the N − 1 rule directly ends up and the system can become electrically
unstable (the initiating events are also the triggering events). A fast collapse of the electrical grid
can then start. But, in most cases, thanks to the N − 1 rule, the grid stays electrically stable after
the initiating event. A competition then starts between operators corrective actions and possible
additional failures, either due to thermal effects or independent. In particular, insufficient situa-
tion awareness for the operators during this phase results in a delayed or incorrect response, and
then increases the probability to loose additional elements. This phase is called slow cascade (or
steady-state progression), because it displays characteristic times between successive events rang-
ing from tens of seconds to hours. The occurrence of additional events during this slow cascade
can trigger (after the triggering event) an electrical instability (violation of protection set points,
angular instability, etc.). Then a second phase called fast cascade (or high-speed cascade) occurs,
ruled by electrical transients, displaying characteristic times between successive events ranging from
milliseconds to tens of seconds. This phase is too fast to allow operators to take corrective actions
and is characterized by a rapid succession of electrical events (additional failures, protection actions,
etc.) whose occurrence order and timing are driven by the power system’s dynamic evolution in the
course of this transient. After this fast cascade, the electrical grid reaches a stable state: a possible
collapse of the power system in some zones, or a major load shedding. Once a blackout or a major
load shedding has occurred, the recovery period, which might last for several hours to several days,
6A hidden failure is sometimes defined as “a permanent defect that will cause a relay or a relay system to incorrectly
remove a circuit element(s) as a direct consequence of another switching event” [25]. We do not completely agree
we this definition since we think that it is not another switching event which is the cause of a trip due to an hidden
failure, but a fault.
30
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
can be viewed as an additional (and last) phase. The terms “slow” and “fast” cascades are directly
inspired by the comparison between the mean time between events in each phase and the operator
characteristic times, as shown in Figure 2.16.
Figure 2.17: Phases of a blackout. From [26].
Figure 2.18: Event tree after an initiating event.
We should note that events occurring during the slow and the fast cascades, respectively, can be
very different in number and in type. During the slow cascade, only a small number of elements
are lost, typically from two to about twenty. There were 4 elements lost before the fast cascade in
the major disturbance which occurred in the Western Interconnection (United States) in August 10,
1996. There were 22 elements lost before the fast cascade in the 2003 US/Canada blackout. The
slow cascade was very short during the 2003 Sweden/Denmark blackout: 3 elements were lost in
5 minutes, the last two simultaneously (double busbar fault due to a disconnector damage). Only
2 elements were lost during the slow cascade of the blackout which occurred in September 2003 in
Italy. The fast cascade was triggered by 3 events in the major system perturbation in November
2006 in Europe. On the contrary, as the overall network collapses during a fast cascade leading to
a blackout, several hundreds of elements can be lost. This is illustrated in Figure 2.8 for the 2003
US/Canada blackout (the fast cascade began at 16:06). Elements trip mainly due to failures during
the slow cascade. On the contrary, elements trip mainly because electrical variables crossed their
protections’ setpoints without additional fault during the fast cascade.
Previous examples showed also that a large variety of mechanisms are involved in cascading
outages: common mode failures and protection systems failures which cause several initial outages7,
high static loads after power flow redistribution which can lead to additional thermal failures, no
corrective actions or wrong operators actions due to lack of situational awareness, static currents or
7This Chapter does not develop examples where protection system failures play a significant role during the slow
cascade. However, it caused several blackouts or major system disturbances (e.g. system disturbances in the US on
April 16 and July 2-3, 1996, and blackout in Croatia on January 12, 2003).
31
CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES
apparent impedances triggering relays, voltage/small-disturbance/transient/frequency instabilities,
... We propose to separate the main phenomena occurring in cascading failures in three subsets,
according to whether they are dominant during the slow or the fast cascade, or important for the
transition between the slow and the fast cascades:
• For the slow cascade: additional failures, either independent, or due to thermal effects (in
particular, trip of overhead lines due to a tree flashover, which can occur even if the load is under
the nominal value), several simultaneous outages caused by protection systems failures (e.g.
hidden failures), and (remedial) operators’ actions (which should improve but can deteriorate
the grid stability and are strongly linked with the reliability of the ICT infrastructure).
• For the transition between the slow and the fast cascades: all kinds of electrical instabilities
(violations of protection limits, voltage, frequency, transient and small-signal instabilities) can
trigger the fast cascade.
• For the fast cascade: the triggering of protections due to the value of electrical variables
during the transient, and possible failures of relays. We insist that only load shedding relays
are designed to protect the overall system in order to avoid to reach a feared situation, and
that all other protection systems are designed to protect a particular component or a particular
subsystem8. The latter can thus have a negative effect on the overall system.
Main system state transition phenomena and mechanisms occurring in slow and fast cascades are
summarized in Table 2.1. The word “transition” refers here to the transition from one system state
to another one and not to the transition between the slow cascade and the fast cascade. As it is
complex to model all these mechanisms in one model, the approach proposed in Chapter 5 should
be understood as a general framework able to take into account these phenomena, even if only a
subset of these mechanisms will be modeled in practice.
Phase Main transition phenomena Main failure mechanisms
Slow Failures Independent, thermal,
Cascade Operators actions and protection systems failures
Fast Protections systems Protections systems failures
Cascade Load shedding relays (relays, circuit breakers, ...)
Table 2.1: Main system states transition phenomena and mechanisms occurring in slow and fast
cascades.
8It is completely different in nuclear power plants, where the aim of all protection systems is to avoid to reach a
feared situation at the system level.
32
Chapter 3
Introduction on reliability analysis
methodologies
3.1 Introduction
As seen in the previous Chapter, blackouts are due to cascading failures. The estimation of
scenarios that could lead to blackout, their frequencies, their consequences and the risk they induce,
has to rely on reliability analysis methodologies. These methods were initially developed for other
sectors (nuclear engineering, aviation and space, ...) but they are progressively transposed to power
systems. The aim of this Chapter is to present briefly the main methodologies that are used in this
PhD thesis. Reliability properties of complex systems cannot be estimated directly from operational
feedback. Indeed, as they are designed in a reliable way, failures of one system are too rare to
apply statistical inference. Moreover, it is inconceivable to build several identical complex systems
to collect better statistics. However, as system failures are caused by combinations of component
failures, the reliability properties of systems can be computed from the reliability properties of basic
components. The latter properties can be estimated directly from operational feedback or from
test campaigns by statistical inference. This introduction thus begins with the development of the
reliability properties of basic components (Subsection 3.1.1). Reliability methodologies can then be
used to estimate the “risk” induced by systems. However, risk is a word with various definitions. It is
thus necessary to clarify the definition used in this PhD thesis to avoid confusion. This introduction
then clarifies the definition of risk used in this PhD thesis (Subsection 3.1.2). As the blackout PRA
methodology developed in this PhD thesis are inspired by three PRA levels used for safety analysis of
nuclear power plants, the latter are presented in Subsection 3.1.3. The organization of the following
Sections of this Chapter is described in 3.1.4.
3.1.1 Reliability of components
The aim of this Subsection is to introduce reliability properties of basic components. The reliability
of an item is defined by the International Electrical Commission as “the probability that it can
perform a required function under given conditions for a given time interval” (by assuming in general
that the item is in a state to perform this required function at the beginning of the time interval)
[27]. Mathematically, the reliability R(t) of item I at time t can be expressed as [28]
R(t) = Pr[I not failing on [0, t]]. (3.1)
If the random variable representing the lifetime (or the first failure time) is denoted by Tf , we have
R(t) = Pr[Tf > t]. (3.2)
33
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
The reliability R(t) is then a non-increasing function on [0,∞[, with R(0) = 1 and limt→∞R(t) = 0.
Similarly, the unreliability F (t) of item I at time t is the probability that this item has failed on
[0, t],
F (t) = Pr[Tf ≤ t] = 1−R(t). (3.3)
The failure density f(t) is the probability density function of the random variable Tf ,
f(t) =dF (t)
dt= −dR(t)
dt. (3.4)
The probability of failure during a small time interval [t, t+dt] is given by f(t)dt = F (t+dt)−F (t).
A useful parameter in reliability studies is the failure rate, a conditional failure density. The failure
rate λ(t) is the probability of failure per time unit at time t, given the item has not failed on [0, t],
λ(t) =f(t)
1− F (t)=f(t)
R(t)= −R
′(t)
R(t). (3.5)
From (3.5), the reliability can be expressed as a function of the failure rate by
R(t) = exp
[−∫ t
0
λ(s)ds
]. (3.6)
The Mean Time To Failure (MTTF), i.e. the expected value of Tf , is simply given by
MTTF =
∫ ∞0
R(t)dt. (3.7)
The bathtub curve concept is widely used to represent the evolution in time of the failure rate of
many components or systems, as shown in Figure 3.1. The bathtub curve consists of three successive
Figure 3.1: Bathtub curve. From [21].
parts [21]:
• An infant mortality period with a decreasing failure rate, mostly caused by inner defects. As
these defects should cause quickly the failure of the component/system (early failures), the
failure rate decreases quickly during this period.
• A normal/useful life period with a low and approximately constant failure rate (mainly due to
random failures).
• A wear-out period that exhibits an increasing failure rate (due to an increasing ageing and
wear-out).
34
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
During the useful life of a component, when the failure rate is approximately constant, λ(t) ≈ λ,
the random variable representing the lifetime of the item follows an exponential law with
R(t) = exp(−λt) (3.8)
and
MTTF =1
λ(3.9)
An analog modeling can be developed for the repair process, which can be described by a repair
rate µ(t), similar to the failure rate. For repairable components, availability is another important
property. The availability of an item is defined by the International Electrical Commission as “the
probability that an item is in a state to perform a required function under given conditions at a given
instant of time, assuming that the required external resources are provided ” [27]. Mathematically,
the availability A(t) of item I at time t can be expressed as [28]
A(t) = Pr[I not failing in t]. (3.10)
Obviously, the availability of a non-repairable component is simply given by its reliability. In general,
the availability of a component depends on the combined aspects of its reliability performance, its
maintainability performance and its maintenance support performance.
Some components can fail only when they are triggered (e.g. switches). In these case, an on-
demand failure probability (or failure rate on demand) can be used [21].
Components’ failures data can be collected through a test campaign or operational feedback.
Based on these data, the failure rate can be estimated by statistical inference:
1. A parametric law is selected a priori on a qualitative analysis of failures data and prior
knowledge of typical laws for the concerned component
2. The parameters of this law are adjusted through statistical inference (e.g. maximum likelihood
estimation)
3. The likelihood of the adjusted parametric law is evaluated through a statistical hypothesis test
(e.g. Chi-squared test)
3.1.2 Formal definitions of risk
Risk is a word with various definitions. It is thus necessary to clarify the definition used in this PhD
thesis to avoid confusion. Risk is defined by [29] (Oxford University Press dictionary) as “possibility
of something bad happening at some time in the future; a situation that could be dangerous or have
a bad result”. This definition is close to the definition of hazard: “a thing that can be dangerous
or cause damage” [29]. This definition of risk is limited since the idea of likelihood of something
bad happening is not considered. From this definition, one can say that the risk of a major nuclear
accident exists, as well as the risk of an electric blackout, but the idea of quantification or ranking
of the risks does not appear. The International Electrical Commission defines the electrical risk
as the “combination of the probability of occurrence of electrical harm and the severity of that
harm when electric energy is present in an electrical installation” [27]. This definition introduces
the idea of likelihood of something bad happening, through the probability of occurrence. We can
generalize this definition for the risk as the “combination of a probability for an accident occurrence
and the resulting negative consequences”. If we assume that there are n different potential source
of accidents, the latter definition leads to a preliminary definition for the overall risk as a collection
of n pairs,
Risk ≡ (P1, C1), ..., (Pi, Ci), ...(Pn, Cn), (3.11)
35
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
where Pi and Ci denote the probability of occurrence of the accident i and its consequences, respec-
tively. However, it is confusing to speak about “probability of accident occurrence” if a time interval
on which the accident is likely to take place is not specified. The last definition can thus be adapted
either by speaking about probability of a feared situation/state, or by speaking about occurrence
frequency Fi of an accident i ,
Risk ≡ (F1, C1), ..., (Fi, Ci), ...(Fn, Cn). (3.12)
The concept of accident occurrence frequency can be sometimes difficult to understand. We can
simply remind that the frequency of the consequence of an event is the inverse of the mean time
after which this consequence takes place (for a sufficiently large population). Since one can be
interested in many different consequences (the number of fatalities, the number of injuries, the
amount of radionuclide release, the amount of money or property or other resources lost, the loss
of supplied power, the energy not served, ...), there are many risk definitions, one per consequence
definition.
They are therefore two ways to estimate the risk: a “situation/state-based” approach which has to
estimate the probability of a feared situation/state, and a “scenario-based” approach which has to
estimate the frequency of a feared scenario. The selection of one of these approaches depends on the
type of events and the time scale studied. A situation-based approach studies mean properties of the
system since it relies on the probability to find the system in each state, and it is thus concerned by
long time scales. On the contrary, a scenario-based approach studies the development of accidental
scenarios and it is thus concerned by short time scales.
The previous preliminary definition of risk as a collection of pairs is interesting for a small n, since
it gives detailed information on potential accidents. However, it does not allow to rank1 accidents
or different system configurations according to their risk contribution to the global risk. The most
common practice in engineering consists in taking the product of the frequency (or probability) and
consequences as the measure of risk. It corresponds to the “mean negative consequences”. The risk
Ri of the potential accident i is then
Ri = Fi × Ci, (3.13)
and the risk associated with the feared situation/state i,
Ri = Pi × Ci. (3.14)
The overall risk R is then simply given by the sum on all potential accidents of their individual risk,
R =
n∑i=1
Ri =
n∑i=1
Fi × Ci, (3.15)
or by the sum on all potential feared situations/states of their individual risk,
R =
n∑i=1
Ri =
n∑i=1
Pi × Ci. (3.16)
The purpose of a risk study is not only to compute this overall risk, but to identify the triplet
scenario,frequency,consequence for each potential accident or the triplet situation,probability,
consequence for each feared situation, according to the approach selected. The scenario knowledge
(identification of accident progression) or the situation knowledge (identification of the set of failures)
is necessary to improve protection. From the frequency, or the probability, and consequences, the
risk can be computed, and scenarios or situations can be ranked according to it (or according to
frequency or probability or consequences). Again, there are as many definitions of risk as definitions
of consequences, and interesting consequences should be clearly defined before any risk analysis.
1Except by using multicriteria ranking.
36
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
3.1.3 Nuclear safety
The safe design of nuclear installations is based on a deterministic approach and the concept of
defence in depth. The deterministic approach rely on the assumption that a nuclear power plant will
be reliable if it can endure several sets of dangerous problems (loss of off-site power, loss-of-coolant,
...) without core damage. The list of accidents a nuclear power plant must endure is set by public
authorities in each country (design basis accidents). The defence in depth concept was stated by
the IAEA by “All safety activities, whether organizational, behavioural or equipment related, are
subject to layers of overlapping provisions, so that if a failure should occur it would be compensated
for or corrected without causing harm to individuals or the public at large. This idea of multiple
levels of protection is the central feature of defence in depth...” [30]. One implication of this defence
in depth concept is the implementation of several successive physical barriers for the confinement of
radioactive material in a nuclear power plant. In such a nuclear installation, radioactive material is
produced in the fuel matrix by fission or activation. As shown in Figure 3.2, for pressurized water
reactors, the barriers confining the fission products are typically [31]:
• The fuel matrix and the fuel cladding,
• The boundary of the reactor coolant system (the primary circuit),
• The reactor containment system.
Figure 3.2: Steam cycle for pressurized-water reactor (PWR). Adapted from [32].
Complementary to deterministic and defence in depth approaches for the design, probabilistic
studies are performed to assess the residual risk. Due to this defence in depth concept, nuclear power
plant PRA is not an easy matter. It is based on a scenario analysis and is in general decomposed in
three levels, as illustrated in Figure 3.3 [33]:
• A Level 1 PRA estimates the frequency of accidents that cause damage to the nuclear reactor
core. In that way, the Level 1 PRA provides the first measure of risk, the Core Damage
Frequency (CDF). It is the accident frequency analysis. It starts with an initiating event and
it ends either when a core damage state is reached, or a safe situation. In other words, a Level
1 PRA reveals the vulnerability paths of the power plant leading to a core damage.
• A Level 2 PRA estimates the frequency of accidents that release radioactivity from the nu-
clear power plant due to the loss of integrity of the primary circuit and the containment. A
consequence analysis can also estimate how much radioactivity is released. In that way, the
Level 2 PRA provides second measures of risk, the Large (Early) Release Frequency (L(E)RF).
Eventually, it can also provides the “mean” radioactivity release. It is the accident progression
and source term analysis. It starts at the end of Level 1 (from a core damage state) and it
37
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
ends either when a release of radioactivity occurs or when a safe situation is reached. In other
words, a Level 2 PRA reveals the vulnerability paths of the power plant leading to off-site
consequences and can also quantifies the radioactivity release after a core damage.
• A Level 3 PRA estimates the “mean” consequences in terms of doses to the public and damage
to the environment. In that way, the Level 3 PRA provides the final measure of risk. It is the
offsite consequences analysis. It starts at the end of Level 2 (from a radioactivity release) and
it ends when health effects resulting from the radiation doses to the population around the
plant or the land contamination resulting from radioactive material released in the accident
are estimated.
This decomposition is motivated, among other, by the different physical phenomena that occur in
each level. Level 1 focuses on the first barrier integrity, while level 2 is concerned by the second and
the third barriers integrity. No barrier is associated with level 3.
Figure 3.3: The three PRA levels in nuclear safety.
3.1.4 Organization of this Chapter
Sections 3.2 and 3.3 present widely used scenario-based and state-based risk estimation method-
ologies, respectively. As the approach developed for blackout PRA in this PhD thesis relies on
dynamic reliability methodologies, Section 3.4 introduces the concept of dynamic reliability. Finally,
Section 3.5 concludes.
3.2 Scenario based risk estimation methodologies
3.2.1 Introduction
As specified in Subsection 3.1.2, the purpose of a scenario-based risk study is to compute the
triplets scenario,frequency, consequence for each potential accident. The typical analysis scheme
used to compute these triplets is given in Figure 3.4 [28]. There can be no feared consequences if
there is not unexpected event, called initiating event, which initiates an accidental sequence. Each
accident then starts with an initiating event. After identifying initiating events, the second phase
begins for each of them with the task of identifying the accident sequences: the potential courses of
events that might follow an initiating event are then examined. Indeed, the occurrence of an initiating
event can trigger protection systems (including human actions) to avoid/limit feared consequences,
or can trigger additional failures. The accident sequence analysis consists therefore in identifying
all possible sequences initiated by the initiating event, according to events that could occur. It
is the first element of the triplets s,f,c. The other two elements are then computed in parallel,
on the basis of the scenario. The scenarios variability is due to the possible failures of the solicited
systems. To quantify the frequency, the frequency of the initiating event and the failure probabilities
of each system have to be quantified. This is the objective of the system analysis. Since the accident
development also depends on human actions, the estimation of the accident frequency also relies
38
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
on human reliability analysis. In parallel, consequences are estimated for each scenario through a
consequence model which relies on a physical model of the system. Frequency and consequences can
then be combined to give a risk estimation.
Figure 3.4: From an initiating event to the risk estimation.
3.2.2 Event trees
Following a particular initiating event, the Event Tree (ET) analysis is a technique used to find
potential accident sequences [28, 21]. The ET is a diagram that shows the initiating event and
the failures or successes of the systems triggered in the progression of the accidental transient.
Event trees are thus based on inductive/forward logic on the chronology (or at least ordering) of
events. Figure 3.5 shows an ET for a Loss Of Cooling Accident (LOCA) in a typical nuclear power
plant. The accident starts with a coolant pipe break having a frequency of occurrence FA. The
potential course of events and all possible alternatives that might follow such a coolant pipe break
are then successively examined. At the first branching, the status of the electric power is considered.
The unavaibility (with a probability PB) results in very large release. If it is available (with a
probability 1− PB), the Emergency Core Cooling System (ECCS) is studied. Failure of the ECCS
(with a probability PC1) results in fuel meltdown and varying amounts of fission product release,
depending on the success or failure of the fission product removal systems. If the ECCS succeeds
(with a probability 1 − PC1), the fission product removal system is studied. Failure of the fission
product removal system (with a probability PD1) results in small and medium fission product releases
depending on the conservation or not of the containment integrity. The success of the fission product
removal system can avoid fission product release if the containment integrity is kept, or can limit
the release if the containment integrity is not kept. The frequency of an ET branch is simply given
by the product of the initiating event frequency by the successive branching probabilities. In case of
dependencies between events, conditional branching probabilities must be used. The consequences
of each branch have to be estimated on a physical modeling basis. For example, simulations of the
plant response can be performed for each branch to estimate the amount of fission product releases.
3.2.3 Fault trees
If all data used in an ET are known, the triplets scenario,frequence, consequence can be directly
obtained from the ET. However, the branchings in the ET are due to complex systems and branching
probabilities have to be computed. Fault Tree (FT) analysis can then be used. It is an analytical
technique, where an undesired state of the system is specified (top event) and then the system is
analyzed to find all combinations of basic events leading to the occurrence of the undesired state
[28, 21]. The FT is a graphic model in which logical gates integrate the primary events (i.e. basic
39
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
Figure 3.5: An event tree for a pipe-break initiating event. Adapted from [28].
events and the house events) to the top event. A basic event is a random event whose occurrence
probability can be directly quantified. House events represent those basic eventss forced to be either
in their true or false state. Fault trees are thus based on deductive/backward logic and analyze a
unique and well-defined undesired event. The FT of a system that has a principal power system
and a standby power supply is shown in Figure 3.6. The standby power is switched into operation
by an automatic switch when the principal power supply fails. Power is unavailable in the system
if the principal and standby units both fail (first entry of the OR gate under the top event), or if
the switch controller fails and the principal units fail and the switch controller failure exists when
principal unit fails (second entry of the OR gate under the top event).
Figure 3.6: Example of a fault tree. From [28].
When the inputs of an OR gate are independent, the probability of the output is given by the
sum of the input probabilities minus their product. When inputs of an AND gate are independent,
the probability of the output is given by the product of the input probabilities. However, interde-
pendencies in complex systems entail in general dependencies between inputs of several gates, even
if all basic events are independent (e.g. if a basic event is the entry of two different gates). The
quantification of the top event probability from basic event probabilities relies then on more complex
techniques such as minimal cut sets and minimal path sets (sometimes called tie sets). A cut set is
a collection of basic events such as, if all basic events occur, the top event is guaranteed to occur.
A path set is the dual concept of a cut set: it is a collection of basic events such as, if none of the
events in the set occurs, the non-occurrence of the top event is guaranteed. A minimal cut set is a
cut set containing no other cut set (i.e. if any basic event is removed from the set, the remaining
40
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
events collectively are no longer a cut set). A minimal path set is a path set containing no other path
set (i.e. if any basic event is removed from the set, the remaining events collectively are no longer
a path set). The quantification of the probability of the top event relies on the description of the
state of the basic event or the system by a binary indicator variable. If we assign a binary indicator
variable Yi to the basic event i, then Yi = 1 when the basic event exists and Yi = 0 on the contrary.
Similarly, we assign the binary indicator variable ψ(Y ) to the top event, where Y = (Y1, ..., Yn).
This function ψ(Y ) is known as the structure function for the top event. The probability of the top
event is the expected value of the structure function. If we consider a fault tree having m minimal
cut sets with cut set i containing ni basic events Bi,j , the structure function is given by [28]
ψ(Y ) =
m∨i=1
[ ni∧j=1
Yi,j
], (3.17)
where Yi,j is the indicator variable for Bi,j . In the same way, if we consider a fault tree having m
minimal path sets with path set i containing ni basic events Bi,j , the structure function is given by
[28]
ψ(Y ) =
m∧i=1
[ ni∨j=1
Yi,j
]. (3.18)
For a reasonable number of basic events, the structure function can then be expanded and simplified
using the specific properties of Boole’s algebra (idempotence law, absorption law, ...), resulting in
a polynomial form whose expected value can be easily computed from the basic event probabilities
when they are independent.
3.2.3.1 Conclusions
They are several steps to compute the triplets s,f,c for each potential accident in a scenario-
based risk study: identifying initiating events, identifying dangerous scenarios they can initiate,
estimating their frequencies through the successive failure or success probabilities and estimating
the consequences of each scenario through a consequence model. Event tree and fault tree analyses
are then complementary techniques to be combined for identifying accident sequences that could
occur in a complex system and estimate their consequences. Event trees are developed by asking
questions such as “What happens if the pipe breaks?”, and fault trees such as “How could the
electric power fail?” [28]. If an ET branching is not due to a single component, but to a subsystem,
a FT has to be used to compute branching probabilities.
3.3 State based risk estimation methodologies
3.3.1 Introduction
As specified in Subsection 3.1.2, the purpose of a state-based risk study is to compute the triplets
state,probability, consequence for each feared state. As for scenario based risk estimation method-
ologies, consequences are estimated for each state through a consequence model which relies on a
physical model of the system. According to the size of the system and the type of transitions be-
tween states, different methodologies are to be used to identify feared situations and to compute
their probabilities. For a small number of system states, a state graph can be useful to understand
the general mathematical modeling. Therefore, next Subsection presents this tool. Subsections 3.3.3
and 3.3.4 develop the mathematical modeling for Markovian and semi-Markovian processes, respec-
tively. Finally, Subsections 3.3.5 and 3.3.6 introduce two methods widely used for power systems,
state enumeration and Monte Carlo simulation, respectively.
41
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
3.3.2 State graph
The state graph (or system state transition diagram, or state space diagram) represents all possible
exclusive states of a system based on the states of its components, as well as all possible transitions
between system states [34]. The state space diagram of a system is constructed according to com-
binations of individual components’ states, their individual transitions, their common transitions
(e.g. common mode failure), but also from operational constraints which can entail dependencies
(e.g. only one repairman available). A state transition diagram of a repairable component with two
states (up and down) is shown in Figure 3.7. The transition from the up state to the down state is
due to a failure and the transition from the down state to the up state is due to a repair. Obviously,
Figure 3.7: State space diagram of a repairable component.
this state graph allows to represent easily components with more than two states. For example,
when a non-severe failure occurs, some components can still operate in a degraded state (or derated
state for electrical components) due to a partial failure mode, as shown in Figure 3.8. Multi-state
Figure 3.8: State space diagram of a three-state repairable component with a derated state.
component state space diagrams can also be used to model a preoutage state (a degradation which
does not entail the immediate failure), to separate forced down state and planned outage state, ...
Figure 3.9 shows the five states and their transitions for a system of two repairable components with
a common mode failure (direct transition from state 1 to state 4). The main advantage of state
space diagram is the clear picture of all states and transitions between them. It is extremely useful
in modeling individual multi-state components. However, such a diagram is not applicable to large
systems: if a system contains N components without dependencies, each of them having two states
(operational or failed), the number of system states is 2N , which is quickly unmanageable for large
N .
Figure 3.9: State space diagram of two repairable components with a common mode failure.
3.3.3 Markovian systems
A Markovian process can be defined as “a continuous stochastic process in which future states
are conditional only on the present state and are independent of previous states” [21]. The future
evolution of a Markovian system depends only on the actual state, and not on the system’s past
42
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
history. In stochastic processes theory, a regeneration time is such that at this time, the future of
the process is independent from the past. In a Markovian process, each time is a regeneration time.
If we denote by πi(t) the probability to find the system at time t in state i, the derivative π′i(t) is
given by the conservation equations
π′i(t) = (inflow to state i)− (outflow out of state i)
=∑j 6=i[rate of transition to state i from state j]× [probability to be in state j]
−∑j 6=i[rate of transition from state i to state j]× [probability to be in state i].
(3.19)
Due to the Markovian hypothesis, the rate of transition from one state to another is constant. If we
denote by pi→j the transition rate from state i to state j (probability per unit time that the system
goes from state i to state j), this equation can be re-written
π′i(t) =∑j 6=i
pj→iπj(t)−∑j 6=i
pi→jπi(t) (3.20)
If the failure of an element k entails the transition from state i to state j, the corresponding transition
rate pi→j is the failure rate of this element λk. If the transition from state i to state j is due to
the repair of element k, the corresponding transition rate pi→j is the repair rate of this element µk.
These equations can therefore be written without a state space diagram, even if it is easier with.
The transition rates are in general indicated on the state graph of a Markovian system. The state
space diagram of the Markovian system constituted by two repairable components with a common
mode failure is then given in Figure 3.10, where λ1 and λ2 are the failure rates of components 1 and
2, respectively, µ1 and µ2 are the repair rates of components 1 and 2, respectively, and λc is the
common mode failure rate. It leads directly to the equations
Figure 3.10: Markovian state graph of two repairable components with a common mode failure.
π′1(t) = µ1π2(t) + µ2π3(t)− (λ1 + λ2 + λc)π1(t) (3.21)
π′2(t) = λ1π1(t) + µ2π4(t)− (µ1 + λ2 + λc)π2(t) (3.22)
π′3(t) = λ2π1(t) + µ1π4(t)− (µ2 + λ1 + λc)π3(t) (3.23)
π′4(t) = λcπ1(t) + (λc + λ2)π2(t) + (λc + λ1)π3(t)− (µ1 + µ2)π4(t) (3.24)
(3.25)
If negative consequences are associated with some states (e.g. state 4 if components are in parallel),
this set of linear and homogeneous equations can be simply solved (with the initial condition π(0) =
(1, 0, 0, 0) if we assume that both components are initially in service) and risk can be computed
according to the negative consequences in each state. We should note again that it is then well a
“state-based” estimation of the risk: the risk due to a state is the product of the probability of this
state by the consequences of this state. This estimation strongly differs from the ET/FT one, which
is a “scenario-based” estimation of the risk. The stationary state π∞ can be found by nulling all
derivatives, which gives an algebraic set of equations with the condition that the sum of all π∞,i is
43
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
equal to 1. In particular for the two-state repairable component showed in Figure 3.7 with a failure
rate λ and a repair rate µ, the stationary equations are
µπ∞,D − λπ∞,U = 0, (3.26)
λπ∞,U − µπ∞,D = 0, (3.27)
π∞,U + π∞,D = 1. (3.28)
where π∞,U and π∞,D are the asymptotic probability to find the component in state up and in state
down, respectively. The solution is given by
π∞,U =µ
λ+ µ, (3.29)
π∞,D =λ
λ+ µ. (3.30)
Once the π∞,i of a system are computed, the overall (steady-state) risk R can be estimated by
R =∑i
π∞,iCi (3.31)
where the Ci are the consequences (or index function), such as load curtailment, associated with
state i. Note that non-failure system states have a zero value of the index function and do not make
contributions to R, although their probabilities are not equal to zero.
Equations 3.20 can be also written in integral form as
πi(t) = πi(0) exp[−λit] +∑j 6=i
∫ t
0
pj→iπj(t− τ) exp[−λiτ ]dτ (3.32)
where
λi =∑j 6=i
pi→j . (3.33)
3.3.4 Semi-Markovian and non-Markovian systems
The Markovian hypothesis is not adequate for all systems: all components do not have con-
stant failure rates and constant repair rates. However, previous modeling can be extended to semi-
Markovian systems (each entry into a new state is a regeneration point) and non-Markovian systems
(no specific regeneration points). In these case, a steady-state risk like the equation (3.31) cannot
be defined. If we are interested in the behavior of the system during a time period T , the mean
probability to find the system is state i is given by
< πi >=1
T
∫ T
0
πi(t)dt, (3.34)
where πi(t) is the probability to find the system at time t in state i, and the risk is then given by
R =∑i
1
T
∫ T
0
πi(t)dtCi. (3.35)
3.3.5 State enumeration approaches
Most reliability evaluations of power systems are based on the Markovian hypothesis (constant
failure rates and repair rates) [34, 11]. However, the (asymptotic) probability of a system state i is
rarely computed from the stationary form of (3.20). The analytical state enumeration method of
a system computes the probability to find the system in a specific state through the probability to
44
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
find each of its components in the corresponding state. If all N components are independent, the
probability to find the system in state i is simply given by
πS∞,i =
N∏j=1
πC∞,Sj(i) (3.36)
where Sj(i) indicates the state of component j in system state i. In case of dependencies, this
equation must be adapted. A complete state enumeration method computes exactly the sum (3.31)
by estimating the probability and the consequences of each system state. For large systems, it
is however quasi-impossible to analyze all states in a reasonable amount of time. A partial state
enumeration method uses a criterion to limit the number of states considered in the sum (3.31) and
thus the complexity. The simplest criterion is to limit the number of contingencies in each state
analyzed to a maximum number of k contingencies (with k = 1, 2, 3, ...). It supposes then implicitly
that the situations most contributing to the risk have a small number of contingencies (if all events
are independent, the probability is quickly decreasing with the number of contingencies).
3.3.6 Monte Carlo simulation
When the number of states is so large that it is impossible to analyze all states (even with a
partial state enumeration), Monte Carlo simulations are preferred [34, 11]. It consists of using only
a sample of states in the set of all possible states, and of approximating the sum in equation (3.31)
by
R ≈ 1
M
M∑j=1
Cj = R (3.37)
where M is the total number of sampled states and Cj are the consequences associated with the
sampled state j. It is based on the fact that, when the number of samples is sufficiently large, the
sampling frequency of the system state i can be used as an unbiased estimate of its probability. In
general, each state is sampled by sampling the state of each component, independently or depen-
dently in case of common mode failures (the sampling of a system system is equivalent to sample
the state of each component). There are two types of Monte Carlo simulations: sequential and
non-sequential.
The aim of a sequential Monte Carlo simulation is to estimate the risk by simulating the stochastic
evolution2 at fixed discrete time steps. Each sampled state is then linked to the previous one
according to specific evolution laws (transition rates). A sequential Monte Carlo can then be applied
easily to Markovian, semi-Markovian or non-Markovian processes. The “component state duration”
approach consists in sampling the transition times of each component and in constructing then
system states according to the state of each component, as shown in Figure 3.11. The “system state
duration” approach consists in sampling directly the transition times of the system.
On the contrary, the aim of a non-sequential Monte Carlo simulation, sometimes called the state
sampling approach, is to estimate the risk by sampling different system states, but each independent
from the others. As for a sequential Monte Carlo simulation, the states can be sampled directly, or
through the individual sampling of components’ states.
The main problem when using approximation (3.37) is to known the number of samples M needed
to reach a satisfactory precision. The key parameter to estimate the precision is the sample variance
2It can be surprising to simulate the stochastic evolution in a “state-based risk estimation”. However, one should
remember that the name “state-based” is the estimation of the risk through the estimation of probability of feared
state (and their consequences) which is still the case here.
45
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
Figure 3.11: Chronological components and resulting system state transition processes.
S2 (unbiased estimator of the variance σ2),
S2 =1
M − 1
M∑j=1
(Cj − R)2 =1
M − 1
M∑j=1
C2j −
M
M − 1R2. (3.38)
Indeed, it can be proven [35] that[R − tα/2,M−1
√S2
M, R+ tα/2,M−1
√S2
M
](3.39)
is a 100(1− α)% confidence interval for R, where tα/2,M−1 is defined by
Pr[T ≤ tα/2,M−1] = 1− α
2(3.40)
where the random variable T has a Student’s t-distribution with M − 1 degrees of freedom, T ∼tM−1
3. Therefore, any confidence interval is proportional to√S2/M . The precision can then be
controlled a posteriori and the number of MC runs needed to reach a given precision is proportional
to the sample variance. Variance reduction techniques have been developed to reduce this number.
However, the efficiency is not directly given by the total number of MC runs but more by the total
computing time needed to reach a given precision. We can then quantify the efficiency of a MC
algorithm by the figure of merit ε defined by
ε =1
S2t, (3.41)
where t is the mean time per MC run.
3.4 Dynamic reliability
The two previous sections described what we call here “classical” probabilistic studies. Scenario
frequencies or state probabilities are computed independently of process variables (like tempera-
tures, pressures, currents, voltages, ...) evolution. These process variables can then be computed
a posteriori (either in a dynamic way for a scenario based risk estimation, or in a static way for a
situation/state based risk estimation4) to perform the consequence analysis. In both cases, a system
is described by discrete states and transition rates, or transition probabilities, between these states.
Each transition rate/probability can only depend on initial and final states and possibly on time.
3When M →∞, a Student’s t-distribution converges towards a standard normal distribution.4In general in a static way for an asymptotic Markovian approach, but sometimes in a purely dynamic way or a
dynamic way for some process variables and a static way for the other for others state-based risk estimation approaches.
46
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
This modeling cannot consider correctly the variation of transition rates/probabilities (e.g. failure
rates) with the evolution of process variables in a system state. The analysis of past blackouts in
Chapter 2 showed that the loss of one of several elements can induce a thermal transient and can
thus increase failure rates/probabilities of lines, cables and transformers. Moreover, during the fast
cascade, transitions between states due to protections are directly triggered by electrical variables.
Classical PRA is unable to model correctly these phenomena.
On the contrary, dynamic reliability or dynamic PRA describes a system not only by discrete
states, but also by a set of process variables x, in a coupled way [36]. As it is the case in classical
probabilistic studies, for each system state i, the evolution of process variables is characterized by
specific dynamic equations,dx
dt= qi(x, t), (3.42)
or, in an equivalent explicit form,
x(t) = gi(t, x0) (3.43)
where
x0 = x(0) = gi(0, x0) (3.44)
The originality of dynamic reliability is to allow transition rates to be dependent upon some of the
process variables, while still considering a specific evolution of process variables x in each system
state. We denote by p(i → j|x) the transition rate from state i to state j and by π(x, i, t) the
probability density function to find the system with process variables in dx about x in state i at
time t. This distribution is normalized as follows,∑i
∫RN
π(x, i, t)dx = 1. (3.45)
The conservation equation (3.19) must be adapted for these partly discrete (i), partly continuous
(x) states in the form∂
∂t(density) +∇(flux) = sources (3.46)
The probability flux can easily be obtained by observing that, in the process variables space, dynam-
ics qi(x) can be understood as generalized velocities of the process variables in configuration i. Still
in the Markovian case, this leads to the Chapman-Kolmogorov equation which rules the evolution
of the probability density, as an adaptation of equation (3.20),
∂π(x, i, t)
∂t+∇x[qi(x, t).π(x, i, t)] = −
∑j 6=i
p(i→ j|x)π(x, i, t) +∑j 6=i
p(j → i|x)π(x, j, t), (3.47)
which can be also written in integral form as
π(x, i, t) =
∫RN
π(u, i, 0)δ(x− gi(t, u)) exp
[−∫ t
0
λi(gi(s, u))ds
]du
+∑j 6=i
∫ t
0
∫RN
p(j → i|u)π(u, j, t− τ)δ(x− gi(τ, u)) exp
[−∫ τ
0
λi(gi(s, u))ds
]dudτ
(3.48)
where
λi(x) =∑j 6=i
p(i→ j|x). (3.49)
The interpretation of equation (3.48) is the following: the system is in state i at time t with process
variables x either if it has been in state i from the beginning of the transient with process variables
u, following dynamics gi(t, u) with a survival probability given by exp[−∫ t
0λi(gi(s, u))ds], or if the
47
CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES
last transition to state i took place at time τ < t with process variables u, where the system left
state j following dynamics gi(τ, u) with a survival probability given by exp[−∫ t−τ
0λi(gi(s, u))ds].
A possible system evolution is sketched in Figure 3.12: after an initiating event, the system leaves
Figure 3.12: A possible system evolution due to configuration changes. From [37].
its steady-state conditions and enters a first state i1 where process variables x evolve according to
a first set of differential equations; the variation of these variables can influence transition rates to
other system states; if a transition to state i2 occurs, process variables evolve according to another
set of differential equations with initial conditions, corresponding to the process variables values at
the time state i1 is left; etc. Such a piecewise-deterministic stochastic process either leads the system
to final safe conditions or to an undesired damage state, the latter corresponding to exiting a safe
region in the process variable space. The two main problems to solve before solving the equations
themselves are then to identify adequate process variables and their evolution in all system states,
and to know transition rates p(i→ j|x).
When using dynamic reliability, a classical event tree is modified into a Dynamic Event Tree
(DET), or a Continuous Event Tree (CET), so that configuration changes triggered by the evolution
of process variables create the possible branch points of the tree. Discrete Dynamic Event Trees
(DDET) denotes a family of similar methods providing discrete, hence finite, approximations of a
DET. After the occurrence of an initiating event, process variables follow evolution laws associated
to the resulting system configuration. The corresponding deterministic transient evolution defines a
mother branch. Process variables evolution is computed by simulation. New branches are generated
from this mother branch at user-specified discrete time intervals due to all possible events causing the
system to branch off and according to branching rules (e.g. crossing on a demand-related hardware
setpoint or probabilistic thresholds). New branches are generated from the secondary branches, and
this branching process is carried on from each branch. The development of a scenario (or a branch)
is stopped as soon as an absorbing state is reached (either a damage state or a safe situation).
Finally, the frequency of the user-specified absorbing state can be calculated as they develop in the
simulation, and related scenarios are identified.
3.5 Conclusions
This Chapter introduced a formal definition of risk, as the combination of likelihood and gravity of
something bad happening. There are two different paradigms available for a mathematical definition
of the risk: a situation-based paradigm and a scenario-based paradigm. In the first case, the risk of a
feared situation is given by the product of its probability and its consequences and the aim of a PRA
approach is then to identify the triplets s,p,c. In the second case, the risk of an accidental scenario
is given by the product of its frequency and its consequences and the aim of a PRA approach is
then to identify the triplets s,f,c. Depending on the paradigm, specific methodologies have been
developed to estimate these triplets. Dynamic reliability methodologies extend them by allowing to
consider the mutual interaction between system states transitions and evolution of process variables.
In nuclear safety, PRA is in general decomposed in three levels, on the basis of different physical
phenomena that could occur in an accidental transient leading to off-site consequences.
48
Chapter 4
Reliability of electrical grids - state
of the art
4.1 Introduction
The reliability of an electrical grid is the degree of performance (expressed as a probability) of
delivering the electricity to customers within accepted standards and in the amount desired. As
we saw in Chapter 1, there are three functional zones in a power system: generation, transport
and distribution. In this PhD thesis, we focus only on the first two functional zones, generation
and transport (HLII). Power system reliability is in general divided into the two basic aspects of
adequacy and security, but definitions slightly differ from one reference to another. We propose to
use the definition given by the IEEE Power Systems Engineering Committee in [38]: “Adequacy may
be defined as a system’s capability to meet system demand within major component ratings and in
the presence of scheduled and unscheduled1 outages of generation and transmission components or
facilities. Security may be defined as a system’s capability to withstand disturbances arising from
faults and unscheduled removal of bulk power supply equipment without further loss of facilities or
cascading.”. As the expression “major component” is not precise, we propose to modify slightly this
definition. The adequacy is the ability of the electric system to satisfy the consumer demand and
system operational constraints at any time, in the presence of scheduled and unscheduled outages
of generation and transmission components or facilities. Adequacy is therefore limited to static
conditions which do not include system dynamics and transient disturbances (situation/state based
risk estimation methodologies). On the contrary, the security relates to the ability of the system to
respond to dynamic or transient disturbances arising in the system, from a loss of an element, or a
fault, or a fault and a loss of the faulted element (scenario based risk estimation methodologies).
The security analysis of the transmission grid has to rest on both deterministic and probabilis-
tic approaches, displaying strong conceptual similarities with safety analysis performed for nuclear
power plants. The deterministic approach rely on the assumption that an electrical grid will be re-
liable if it can endure several sets of contingencies while continuing to satisfy the consumer demand
and system operational constraints. Adequacy or security deterministic studies deal therefore with
a set of predefined situations or scenarios, respectively. As it is not possible to consider all situations
and scenarios that could occur, a residual risk of load shedding or power system collapse exists,
despite the deterministic approach. Probabilistic studies can then be used to assess the residual risk
of the grid, in order to optimally reduce this risk. Both state-based and scenario-based probabilistic
risk assessment can be used, to address adequacy and security, respectively. As shown in Figure
1NERC uses the expression “reasonably unscheduled outages”, but it introduces confusion between adequacy and
security.
49
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
4.1, the distinction between deterministic and probabilistic studies should not be confused with the
distinction between adequacy and security studies. These classifications should be understood as
different but complementary. In this Chapter, we describe briefly deterministic studies and prob-
abilistic studies from both adequacy and security point of view, especially in the context of major
system disturbances.
Figure 4.1: Reliability studies of electrical grids - classification.
4.2 Deterministic studies
Deterministic studies rely on the assumption that the electrical grid will be reliable if it can con-
tinue to satisfy the consumer demand and system operational constraints for a set of dangerous
situations. Each situation is based on an initial state with N active elements and a set of k un-
scheduled outages and all situations are considered with equal importance, independently of their
likelihood. This is called “N − k criterion”: a grid presenting N elements initially in service has to
be proven to be correctly dimensioned (in terms of mesh structure and line capacity) to successfully
face the loss of any set of k elements, by still satisfying given operational constraints. Only genera-
tion facilities are considered in a HLI study (the N − k criterion is then equivalent to require that
the generation capacity minus the k largest units must be superior to the load), while both gener-
ation and transmission facilities are considered in a HLII study. Initial states are taken as critical
solicitation states, for example the peak load or outside the peak load but with several elements
in maintenance. All active elements are included in the sets of k unscheduled outages because de-
terministic approaches do not consider outages likelihood2. Consequently, due to the combinatorial
explosion of scenarios for large k3, deterministic studies are usually limited to the N − 1 situations,
and sometimes extended to N − 2 cases.
Such deterministic approaches can address both aspects of reliability (adequacy and security),
according to the analysis performed. If the N − k criterion is only checked through a static analysis
(the system demand can be met within component ratings and in the presence of k scheduled or
unscheduled outages of generation and transmission components or facilities), a part of adequacy is
addressed, while if it is also checked through a dynamic analysis, a part of security is also addressed.
Deterministic studies are strongly used for networks sizing and reinforcement by TSOs. Moreover,
the N − 1 criterion is applied by operators both in planning (long-term, medium-term and short-
term) and in real time to guarantee that elements remaining in operation after failure of a single
network element must be capable of accommodating the change of flows in the network caused by
that single failure.
2However, a distinction is sometimes made between links (lines, cables and transformers) and power plants.3Number of sets of k contingencies: N !/[k!(N − k)!] with large N .
50
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
Even if the deterministic approach gives a high level of reliability, its purpose is obviously not to
estimate the risk of blackout or major load shedding. However, a blackout PRA should consider
pre-contingency states coherent with the N − 1 criterion.
4.3 Probabilistic studies - HLI
Probabilistic studies for the HLI are used to evaluate the ability of the system generating capacity
to satisfy the total system load. As it does not make any sense to study the electrical dynamic
response of power plants after the loss of a generating unit without the dynamic network response,
they are conducted only in a static way. Therefore, a probabilistic study for the HLI is a generating
system adequacy assessment. The basic risk indices in these studies are [34, 11]
• Loss Of Load Expectation (LOLE) which is the probability that the system generating capacity
cannot satisfy the total system load (unavaibility). The definition (3.16) can be adapted by
considering undesired consequences equal to 1 when the system load cannot be satisfied and
equal to 0 in the opposite case:
LOLE =∑i∈Sn
Pi (4.1)
where Sn is the set of all system states associated with loss of load (negative consequences).
The LOLE is in general expressed as the average number of days or hours per one year during
which the load is expected to exceed the available generating capacity.
• Loss Of Energy Expectation (LOEE) which is the mean energy not supplied in a specific period
of time (or the mean power). The definition (3.16) can be adapted by considering undesired
consequences equal to the difference between the system load and the generating capacity when
the system load cannot be satisfied and equal to 0 in the opposite case:
LOEE =∑i∈Sn
Pi × (Li −Gi) (4.2)
where Li and Gi are the system load and the generating capacity in state i, respectively
(Li −Gi is the loss of load for system state i).
• Loss Of Load Frequency (LOLF) which is the frequency of entering (or leaving) a state where
the system generating capacity cannot satisfy the total system load. Even if one can think
that it corresponds more to a scenario-based analysis, it is computed from a state-based risk
estimation with the definition (3.16) by considering undesired consequences Ci equal to the
sum of the transition rates towards states without loss of load,
Ci =∑
j∈S\Sn
pi→j , (4.3)
where S is the set of all system states. This risk can therefore be estimated by
LOLF =∑i∈Sn
Pi ×∑
j∈S\Sn
pi→j . (4.4)
• Loss Of Load Duration (LOLD) which is the mean duration of an interruption and can be
computed by
LOLD =LOLE
LOLF(4.5)
The first two indices are the most widely used. As described in the previous Chapter, several
methodologies are available to estimate these risk indices, which can be divided into exact method-
ologies (analytical, complete state enumeration, ...) and approximate methodologies (Monte Carlo
51
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
methods). When the number of power plants is high, or in presence of renewable energy (contin-
uous states), exact methodologies become unmanageable and Monte Carlo methods are preferred.
A sequential simulation should be preferred when variations imposed by load and renewable energy
sources to classical units are so abrupt that they cannot necessarily be endured by them (a sequential
simulation can then involve some aspects of security). For each system state, consequences can be
estimated quickly and simply by summing the power of all generation facilities available at one side,
the power of all loads at the other side, and by comparing them.
Such probabilistic studies for the generating system adequacy are beginning to be applied to real
systems, in order to check the “security of supply of electricity”4 of countries, especially because the
non-dispatchable renewable energy sources are becoming important. For example, in Belgium, the
FPS5 Economy studied in 2012 the adequacy of the generating capacity over the period 2012-2017
both in a deterministic and in a probabilistic approach. The HLI probabilistic study was based on a
Monte Carlo simulation software called “Antares”. A sequential simulation was used. The purpose
of this study was to estimate the additional generating capacity needed to keep a LOLE less or equal
to 16 hours/year (LOLE ≤ 1.8× 10−3) without considering electricity imports from other countries
and a LOLE less then or equal to 3 hours/year (LOLE ≤ 3.4 × 10−4) with possible electricity
imports. In July 2012, the Belgian government admitted a 10-year life extension for Tihange 1 (962
MW) and imposed the closure of the 2×433 MW Doel 1 and 2 units, based on these LOLEs.
4.4 Probabilistic studies - HLII
4.4.1 Static methodologies
This Subsection addresses composite system probabilistic studies based on static analyses of the
grid. It addresses then mainly the adequacy aspect of reliability. The adequacy index concepts used
in HLI studies can be adapted and extended to composite system adequacy assessment. Their names
are however changed to avoid confusion, as the way they are computed is completely different. The
basic risk indices in these studies are [34, 11]
• Probability of Load Curtailment (PLC) which is the probability that the generation and trans-
mission system cannot satisfy the system load (unavaibility). The definition (3.16) can be
adapted by considering undesired consequences equal to 1 when the system load cannot be
satisfied and equal to 0 in the opposite case:
PLC =∑i∈Sn
Pi (4.6)
where Sn is the set of all system states associated with load curtailment (negative conse-
quences). The PLC is in general expressed as the average number of days or hours per one
year during which the load is expected to be curtailed, but then under the name Expected
Duration of Load Curtailments (EDLC).
• Expected Energy Not Supplied (EENS) which is the mean energy not supplied in a specific
period of time (or the mean power). The definition (3.16) can be adapted by considering
undesired consequences equal to the minimum load shedding necessarily when the system load
cannot be satisfied and equal to 0 in the opposite case:
EENS =∑i∈Sn
PiLSi (4.7)
where LSi is the load shedding in state i.
4The term “security” is not used in this expression in its technical meaning defined previously, but in a common
meaning.5Federal Public Service
52
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
Consequences are then more difficult to estimate than in a HLI study. Indeed, even if the generation
available is sufficient to cover the demand, network constraints can be such that all the load cannot
be covered. The minimum load shedding necessary can be estimated through an OPF, where the
objective function is the total load shedding. However, this approach requires a lot of computations
and is useless when an acceptable steady state without load shedding “clearly” exists. A classical
LF can be performed before an OPF to have a first check. This basic procedure is shown in Figure
4.2.
Figure 4.2: Typical flowchart for composite system risk evaluation. From [34].
Such approaches have been widely implemented in commercial software. Tractebel developed the
software SCANNER to analyze a composite generation-transmission power system with regard to
reliability assessment and operating cost estimation [39]. The power system evaluation is based
on power system states generated by the Monte-Carlo probabilistic method. The PowerFactory
software developed by DIgSILENT has a reliability analysis function using the partial analytical
state enumeration approach [40].
4.4.2 Cascading failure simulation
4.4.2.1 CASCADE model
Dobson et al. proposed in [41] an analytical model of load-dependent cascading failure called CAS-
CADE. The model has n identical components initially in service with random loads. Components
fail when their load exceeds a threshold. When a component fails, a fixed and positive amount of
load is transferred to each of the other elements. To start the cascade, an additional load is applied
to the load of each component, as initial disturbance. The aim of this model is to capture some of
the salient features of large blackouts. Consequences analyzed are the number of components failed,
for example as a function of the average initial component loading.
53
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
4.4.2.2 ORNL-PSerc-Alaska (OPA) model
Carreras et al. proposed in [42] a model able to take into account outages due to overloads and
the reconfiguration of the power flows in the grid after the loss of one or several elements. For
different load patterns, the steady state of the grid is computed through a DC OPF. An overloaded
line has then a probability p to suffer an outage6. If an outage occurs, the steady state of the
grid is recomputed through a DC OPF, etc. This model can give the probability distribution of
total load shed. Thermal failure of lines caused by a tree flashover due to current increase after the
previous losses of elements are included in the OPA model explicitly in [44]. The time evolution of
line temperature, its sag and the vegetation height are modeled explicitly: a line is tripped when
the sag and the vegetation are such that a tree flashover occurs.
4.4.2.3 TRELSS model
One of the most well-known industrial reliability analysis programs for grid analysis is the Trans-
mission Reliability Evaluation of Large-Scale Systems (TRELSS) software developed for the EPRI
[45]. The simulation approach included in this software package was developed to deal with cas-
cading outages. The program begins with a steady state of an electrical grid. After an initiating
event, then the steady state is re-computed by solving load-flow (LF) equations. Then, if a load bus
voltage, a generator voltage or a circuit power flow is beyond operational limits, the corresponding
component is tripped, the steady state is re-computed, etc. If no voltage or current threshold is
exceeded, the procedure is restarted with the next initiating event.
Figure 4.3: Flowchart of the TRELSS simulation approach. From [45].
6In the original paper, the influence of the numerical value of p was studied, but no indication was given on a
“realistic” value. Further developments estimated p between 0.05 and 0.1 for the Western Electricity Coordinating
Council (WECC) electrical transmission system by data fitting [43].
54
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
4.4.2.4 Manchester model
An AC power blackout model was developed at the University of Manchester during the early 2000s
in order to represent a range of interactions occurring in cascading failures leading to a blackout
(cascade and sympathetic7 tripping of transmission lines, generator instability, load shedding, post-
contingency redispatch of active and reactive sources, etc.) [46]. The analysis is based on a MC
simulation. For each MC run, an initial disturbance is created by simulating random outages of
system components. If some of the faults which are the cause of these outages induce transient
instability of one or more generators, the latter are disconnected. The impact of hidden failures in
the protection system, which cause intact equipment to be unnecessarily disconnected following a
fault on a neighboring component (sympathetic tripping), is then simulated: the tripping or not of
each component whose vulnerability region contains the original faulted element is sampled. After
restoring the generation-load balance if necessary, the new steady state of the system is calculated
by solving LF equations. In case of voltage instability, the iterations do not converge and the model
assumes that operators shed specific load blocks to stop this voltage collapse. This load shedding
is repeated until convergence of the load flow iterations. The tripping of overloaded lines is then
sampled. As there is a competition between operators attempts to eliminate the overload and the
thermal transient, the probability that the operator is unable to eliminate the overload before the
protection operates can be modeled as a function of the overload. If there is a trip, the LF equations
are solved (with further load shedding if needed), etc. Once there is no more contingency, the ENS
is then computed.
Figure 4.4: Simulation flowchart of Manchester model. From [46].
Several extensions and variations of the Manchester model actually exist, based on three main
modifications. First, if the frequency deviation is outside a specific range after the restoration of the
7Due to hidden failures.
55
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
generation-load balance, the simulation algorithm considers that the system is collapsed. Secondly,
in order to take into account operators corrective actions modeling, an OPF can be used to minimize
the load shedding when the steady state of the system is calculated, instead of shedding specific load
blocks. Thirdly, DC LF and/or DC OPF can be used to accelerate calculations, according to the
importance given to voltage stability.
4.4.2.5 Stochastic model
The first attempt to model in details the competition between operators’ corrective actions and
additional failures seems to appear in [47]. Random line failures are modeled through constant failure
rates, overloaded-line failures occur when the temperature (computed through a time-dependent
equation) reaches the equilibrium temperature corresponding to a power flow equal to the line rating
for reference weather conditions, line restoration is modeled (constant repair rate after a constant
time delay), such as a simple model for the utility response (when a line is overloaded, probability
p1 to shut it down, probability p2 to do nothing and probability p3 to perform a partial generation
dispatch and load shedding to alleviate the overload, with p1 + p2 + p3 = 1). The same model is
used to cover all cascading failures.
4.4.2.6 Fault tree analysis
Instead of a “top-down” approach as in other methodologies, a “bottom-up” approach is proposed
in [48]. Fault trees (as described in Subsection 3.2.3) are developed for each load point of the
power system. Quantitative evaluation of the fault trees includes overload checking. During this
procedure, flows through the lines are compared with their continuous load rating which is the load
rating corrected by a correction factor kcorr in order to take into account the impact of the ambient
temperature Tamb on the line’s load rating,
kcorr =
√80− Tamb
40, (4.8)
where Tamb is in C. This expression is justified by a maximum conductor temperature of 80C and
a load rating estimated for an ambient temperature of 40C. The general idea is then to consider
the variability of the real capacity of the line with weather conditions in a simplified way.
4.4.2.7 Discussion
In models presented above, the CASCADE model is to be classified in a specific category. Indeed,
the aim of this model is not to reveal blackout scenarios in an actual power system, but to capture
some key features of the cascading process (e.g. blackout size distributions). It is classified by [49]
as a high-level statistical model. All the other models presented are probabilistic simulations, but
with different levels of details and different mechanisms taken into account. The OPA model can
be viewed as the simplest model where the lines’ loadings are computed at each step through a DC
OPF. The TRELSS model also considers the tripping of overloaded lines, but the steady state is
computed at each step through a classical power flow and loads/generators whose voltage is outside
limits are disconnected. The Manchester model is able to deal with a lot of phenomena occurring in
cascading failures leading to blackouts. In particular, the tripping of overloaded lines can be done
in a probabilistic way, in order to model the competition between operators’ corrective actions and
the thermal transient.
The problem of bulk parameters estimation for methodologies using a probability that an over-
loaded line trips before corrective actions are carried out is important. Indeed, such a probability
is difficult to estimate because it depends on the actual corrective scheme to eliminate overloads
and the competition between operators and the thermal transient, but it is a key point to estimate
56
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
frequencies of dangerous scenarios. Nedic showed in [50] that the parameters used in the probability
function giving the tripping probability as a function of load can significantly change the risk and
the ranking of scenarios. If such a function giving the tripping probability as a function of load
relies on a small number of parameters8, the latter can be estimated through statistics of observed
blackouts by data fitting. This method needs in general data from several networks (to reach a
satisfactory statistical precision) and neglects therefore their specificities. Moreover, correlations
between load, wind and solar generation and the cooling of the lines (influenced by weather condi-
tions) can strongly influence the risk of blackout. It can be crucial to consider these correlations in
order to solve specific questions, for example when a unit should be maintained to limit the risk of
blackout (see further) and this cannot be done based on this probability.
The biggest limitations of these models based on a one-level PRA are due to the confusion between
the two phases of a cascading failure leading to a blackout. Indeed, either the system is electrically
stable and the operators can react to the situation, or the system is electrically unstable and the
operators cannot do anything before the fast cascade ends, so both cannot be mixed. In particular,
performing a consequence analysis through an OPF when the system becomes electrically unstable
does not seem to reflect the behavior of past blackouts.
4.4.3 Probabilistic methodologies and dynamic simulation
Coupling a dynamic grid treatment with a probabilistic analysis has recently appeared in two
approaches, which were inspired by nuclear PSA methods. The first one [51, 52] combines standard
event trees built as a result of a fault line occurrence considered as initiating event, with dynamic grid
simulations performed to systematically assess the consequences of the different scenarios induced
by such a fault. This study is repeated on each line of the grid, for three different locations of the
fault9. The event trees are standardized, as they are limited to scenarios developing according to the
response of the protections (correct working or failure) located in the stations at the end of a line.
Protections failure probabilities are computed through fault trees. A typical event tree and a typical
fault tree are shown in Figure 4.5. The dynamic behavior of the grid is then simulated for about
20 seconds for all relevant branches of each event tree to perform the consequence analysis. Since
the events considered in an event tree are limited to protection actions at the end of the faulted line
and these actions are independent of the actual evolution of the electrical variables, the ordering
of events is fixed independently of the dynamic simulation and is depending only on protection
specifications. This methodology considers additional failures in the course of the transient, but all
protections present in the network are not taken into account. Moreover, the consequence analysis
was performed manually first for one load pattern and analyzing different load patterns requires a
long time. The second approach [53, 54] makes use of Dynamic Event Trees (DET), a systematic
simulation approach of CET introduced in dynamic PRA, as described in the previous Chapter (see
Section 3.4). In this approach, the scenario identification is based on a hybrid discrete-continuous
system, which is obtained by considering, in an integrated fashion, both the power system dynamics
and the possible events that could occur in the development of the transient (i.e. the dynamic
evolution during the transient can influence the transitions and vice-versa). Taking into account
this double interaction is the idea of dynamic PRA and is necessary to analyze cascading events.
However, in the referenced works, the DET construction is limited to setpoint-based events and not
to events whose occurrence time is random, hence restricting the analysis to a subset of the possible
scenarios. Indeed, the success or failure of actions and the occurrence or not of events is considered
only when crossing thresholds on the values of the electrical variables. Reference [54] considers
breakers actions only when a trip condition (setpoint) is reached (protections), while Reference [53]
8For example, a tripping probability equal to p1 when the current is less than its nominal value and equal to p2 in
the opposite case, or with an exponential increase for currents greater than the nominal value, ...9Since a distance protection operates in different ways for different fault locations.
57
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
Figure 4.5: Typical event tree for substation events after a line fault and fault tree for the failure of
the two main protection distance to send a zone 1 trip signal to circuit breaker trip coils. From [51].
focuses on operators’ corrective actions (most effective redispatch and load curtailment actions), as
shown in Figure 4.6. Grid component failures are thus only taken into account either in the definition
of the initiating event, or for on-demand solicitations defining branch points in the DET.
Figure 4.6: Illustration of halting voltage collapse by dynamic event tree. From [53].
4.5 Conclusions
To analyze the reliability of an electrical grid, there are two different types of approaches: deter-
ministic studies that guarantee that the grid continues to satisfy the consumer demand and system
operational constraints in normal and predefined dangerous situations or scenarios, and probabilistic
studies that estimate the residual risk of power cut-off. Obviously, only probabilistic studies are able
to estimate the risk of blackout or major system disturbance. Probabilistic studies can be divided
into adequacy studies and security studies. The purpose of adequacy studies is not to consider
interdependencies between successive events and cascading failures. Several security studies were
developed to estimate the risk of cascading failures. They are mainly based on cascading failure
58
CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART
simulations. However, as the electric state of the grid is computed in a purely static way after
each event, they do not consider correctly the fast cascade (more generally, they are mainly based
on an unique global approach which tries to cover all thermal and electrical phenomena leading to
additional contingencies in one model - one-level PRA). Few methods based on dynamic PRA were
developed to take into account interactions between the electrical grid’s state (electrical variables)
and failure events. However, these methods are not able to take into account successive line failures,
due to thermal effects or independent. Therefore, none of these methods are able to treat the entire
cascade leading to a blackout. Thus, there is a need to develop such an approach, to model the entire
cascade as realistically as possible. The next Chapter presents such a two-level blackout PRA. As
many different phenomena occur in a cascading failure leading to a blackout, the proposed method-
ology should be understood as a general framework able to model these phenomena by splitting
them into two groups, for the slow and the fast cascade, respectively. However, some aspects of this
methodology are inspired by the approaches presented in this Chapter.
59
Chapter 5
Blackout PRA in 3 levels
5.1 Introduction
As seen in Chapter 4, no current methodology appears to be satisfying to reveal blackout scenarios
and estimate their frequencies. Indeed, during an accidental transient, transition rates can increase
by several orders of magnitude depending on the change in the values of physical variables. Cascading
outages simulations developed these last ten years are based on an unique global approach which
tries to cover all thermal and electrical phenomena leading to additional contingencies in one model
(one-level PRA). If a model does not take into account these modifications, the estimation of the
frequency of a cascade involving several transitions can be completely false and thus misleading.
In particular, dangerous cascading failure could not be correctly identified. In this Chapter, we
propose such an approach based on dynamic PRA initially developed for the nuclear sector. Only
the general principles of this approach are presented in this Chapter and particularities linked to
specific applications are given in the following Chapter. Section 5.2 proposes a decomposition of the
blackout risk analysis in levels. Sections 5.3 and 5.5 develop the modeling for the slow cascade and
the fast cascade, respectively. Section 5.4 is devoted to a proposal of a clustering technique for the
scenarios between the Level I and the Level II.
5.2 Decomposition of the power system PRA in 3 levels
As previously seen (see Section 2.7), a typical cascade leading to a blackout can be split into
two different phases. We will adapt dynamic PRA methods differently for these two phases, by
accounting for the different time and process characteristics. The analysis of the slow cascade, ruled
mainly by the competition between thermal transients and operators’ actions, is the level I of the
power system PRA. Consequently, the level I begins with the initiating event and stops when the
system becomes thermally stable or electrically unstable. In the latter case, the analysis of the fast
cascade, ruled mainly by electrical transients and protection actions, is the level II of the power
system PRA. We can also view the modeling of the restoration as the level III, but we do not
describe the restoration process in this PhD thesis.
The level-I analysis is the assessment of the slow cascade: it starts with an initiating event and
ends either when the electrical dynamics of the system becomes dominant1 or when the system is
put back into a secure state. In this level, we have to take into account the competition between
additional failures, due to thermal effects (depending on the thermal transient) or independent, and
corrective actions: operators will try to eliminate overloads and to bring the grid back to a secure
1i.e. if the system is locally or globally subject to voltage instability, frequency instability or angle instability
(transient or small-signal) or if electrical variables violate one or several protection set points.
61
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
state. Electrical time constants are very small compared to thermal time constants and character-
istic times of operator actions. This means that, after each change in system state during the slow
cascade, electrical variables reach their stationary values in a negligible time compared to thermal
transients and operators’ actions. However, if variations in the values of the electrical variables
become important, the power system could become electrically unstable and the fast cascade simu-
lation could then be starting. In conclusion, after any event occurring during the slow cascade (level
I), we suppose that electrical variables instantaneously reach their stationary values (if the system
remains electrically stable). The process variables which influence failure rates are only the link
temperatures, xT ∈ Rn where xT = (T1, ..., Tn) and Ti is the temperature of link i.
The level-II analysis is the assessment of the fast cascade. It starts when the electrical dynamics of
the system becomes dominant (the system can then be subject to electrical instability and the steady-
state simulation does not capture anymore the grid behavior) and it finishes when the system reaches
an electrically stable state (blackout state or operational state with load shedding). Interactions
between electrical variables and protections and load-shedding relays have to be taken into account,
but since the mean time between events is then much smaller than thermal characteristic times,
the variation of the temperatures of the grid elements during this phase can be neglected. This
time, dynamic PRA must be adapted in order to include the effect of electrical variables (currents,
voltages, frequencies ...) on transition rates. Consequently, we suppose that temperatures are
constant, that the variation of electrical variables does not depend on thermal variables and that
transition rates only depend on electrical variables xE ∈ Rm. On the contrary, an algorithm for
the level-II PRA has to simulate the evolution of electrical variables, and simulate the tripping of
elements when the setpoints of their protections are reached by the electrical variables. Misoperation
of distance protection systems, involved in the propagation of disturbances, has to be integrated into
the approach to provide more trustworthy results. There are globally four kinds of misoperations of
distance protections: a relay can fail to trip, the setpoint of a relay can differ from its nominal value,
measurement errors can occur, and a distance protection seeing a faulted line in its backup zone can
trip instantaneously instead of doing it after a delay. These misoperations make the evolution of the
power system stochastic.
If an operational state with load shedding is reached at the end of the level II, the level I should
be restarted. Indeed, any operational state could continue to endure additional failures even if the
system was electrically stabilized thanks to load shedding. When the system reaches an electrically
stable and thermally stable state, the level-III PRA, which is the assessment of the restoration,
starts. The restoration is mainly ruled by operators’ actions, through procedures, and electrical
transients.
Therefore, level-I PRA reveals vulnerability paths (including critical initial conditions and critical
initiating events) of an electrical grid, level-II PRA gives the magnitude of possible blackouts (in
terms of loss of supplied power) and level-III PRA the consequences (in terms of energy not served).
These three levels are shown in Figure 5.1.
In the specific case of a two-level blackout PRA, the vector of process variables is then composed bythe union of a vector of electrical variables and of a vector of thermal variables, x = (xE , xT ) ∈ RNwith N = m + n. The Chapman-Kolmogorov equations (3.48) (see Section 3.4) can be written
62
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
Figure 5.1: Decomposition of the power system PRA in 3 levels.
according to this decomposition as
π(xE , xT , i, t) =
∫RN
π(uE , uT , i, 0)δ(xE − gi,E(t, uE , uT ))δ(xT − gi,T (t, uE , uT ))
× exp
[−∫ t
0
λi(gi,E(s, uE , uT ), gi,T (s, uE , uT ))ds
]du
+∑j 6=i
∫ t
0
∫RN
p(j → i|uE , uT )π(uE , uT , j, t− τ)δ(xE − gi(τ, uE , uT ))
× δ(xT − gi(τ, uE , uT )) exp
[−∫ τ
0
λi(gi,E(s, uE , uT ), gi,T (s, uE , uT ))ds
]dudτ
(5.1)
The interpretation of equation (5.1) is the same as the interpretation of equation (3.48): the system
is in state i at time t with process variables (xE , xT ) either if it has been in state i from the
beginning of the transient with process variables (uE , uT ), following dynamics gi,E(t, uE , uT ) with
a survival probability given by exp[−∫ t
0λi(gi,E(s, uE , uT ))ds], or if the last transition to state i
took place at time τ < t, where the system left state j with process variables (uE , uT ), following
dynamics gi,E(τ, uE , uT ) with a survival probability given by exp[−∫ t−τ
0λi(gi,E(s, uE , uT ))ds]. The
next Sections show how these equations can be adapted, simplified and solved for the first two levels.
5.3 Level-I
5.3.1 General modeling
Electrical time constants are very small compared to thermal time constants and characteristic
times of operator actions. This means that, after each transition in the system state space, electrical
variables reach their stationary values in a negligible time compared to thermal transients and
operators’ actions. Moreover, the direct impact of an electrical transient on thermal variables is in
general negligible. However, if variations in the values of the electrical variables become important,
the power system could become electrically unstable and the fast cascade simulation should then be
started. In conclusion, after any event occurring during the slow cascade (level I), we suppose that
63
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
electrical variables instantaneously reach their stationary values (if the system remains electrically
stable). If we have a transition from state (or dynamics) j to state (or dynamics) i, the electrical
process variables are affected by this transition as follows:
x+E = yji(x
−E) (5.2)
where x+E and x−E denote the values of the process variables after and before the transition, respec-
tively. On the contrary, links’ failure rates can strongly evolve due to a thermal transient, inducedby the reconfiguration of the flows in the grid. After the loss of an element, a competition startsbetween the evolution of these temperatures and corrective actions: operators will try to eliminateoverloads and bring the grid back to a N−1 secure state. The evolution of thermal variables and thecorrective actions both depend on the value of electrical variables. Equation (5.1) then becomes:
π(xE , xT , i, t) =
∫Rnπ(xE , uT , i, 0)δ(xT − gi,T (t, uT |xE)) exp
[−∫ t
0
λi(xE , gi,T (s, uT |xE))ds
]duT
+∑j 6=i
∫ t
0
∫Rm
∫Rnp(j → i|uE , uT )π(uE , uT , j, t− τ)δ(xE − yji(uE))
× δ(xT − gi,T (τ, uT |xE)) exp
[−∫ τ
0
λi(xE , gi,T (s, uT |xE))ds
]duEduT dτ
(5.3)
If we use the transformation
x∗E = yji(uE), (5.4)
we also have
duE = Jy−1ji
(x∗E)dx∗E , (5.5)
where Jy−1ji
represents the Jacobian of y−1ji , the inverse function of yji. The equation can then also
be expressed by
π(xE , xT , i, t) =
∫Rnπ(xE , uT , i, 0)δ(xT − gi,T (t, uT |xE)) exp
[−∫ t
0
λi(xE , gi,T (s, uT |xE))ds
]duT
+∑j 6=i
∫ t
0
∫Rnp(j → i|y−1
ji (xE), uT )π(y−1ji (xE), uT , j, t− τ)δ(xT − gi,T (τ, uT |xE))
× exp
[−∫ τ
0
λi(xE , gi,T (s, uT |xE))ds
]Jy−1ji
(xE)duT dτ
(5.6)
Before solving these equations, we have to define differential equations describing the temperature
evolution with the load (qi(t, xT |xE) as described by equation (3.42) in Section 3.4) for each type of
link, to model the dependence of failure rate on temperature (p(i→ j|xT ) when the transition from
state i to state j is due to a failure) for each type of link, to model the operators actions2 (p(i→ j|xE)
when the transition from state i to state j is due to an operator action), and to define transition
criteria from level I to level II (when are these equations no longer valid?). Subsection 5.3.2 reminds
models widely used to compute overhead lines, cables and transformers temperature evolution,
while Subsection 5.3.3 proposes thermal failure models. Subsection 5.3.4 discusses operators actions
during the slow cascade and 5.3.5 transition criteria. Finally, Subsection 5.3.6 proposes a Monte
Carlo simulation algorithm to solve these equations and 5.3.7 biaising techniques to improve the
simulation efficiency of this simulation.
5.3.2 Temperature evolution
This Subsection describes well-known models used to compute the temperature evolution of the
grid elements.
2However, the Markovian hypothesis does not reflect perfectly operators’ behavior in all cases. A semi-Markovian
approach should be preferred, but these equations can be easily extended in this way.
64
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
5.3.2.1 Overhead lines
We are interested in the mean conductor temperature in order to deduce the sag of the line.
The evolution of a line temperature is ruled by the time-dependent heat balance [55] depending on
convective and radiation heat losses, heat gain from sun and Joule losses.
qc + qr +mCpdT
dt= qs + I2r(T ) (5.7)
where qc is the convective heat loss rate, qr the radiation heat loss rate, mCp the total heat capacity
of the conductor, qs the heat gain rate from sun, r(T ) the AC resistance of the conductor at
temperature T , all of them per unit length, and I the current in the conductor.
5.3.2.2 Underground cables
We are interested in the dielectric temperature, even if this temperature is not uniform. However,
we can define a “mean” dielectric temperature by using a two-layer thermal model, as shown in
Figure 5.2, where Cth1 and Cth2 represent the thermal capacity of the central conductor and that
of the dielectric, respectively, P the power losses in the central conductor, Rth1 half of the thermal
resistance of the dielectric, and Rth2 the other half of this thermal resistance plus the ground thermal
resistance [13]. Temperatures in the cable are then described by a set of two first-order differential
equations depending on thermal capacities, thermal resistances and Joule losses,
Cth1dT1
dt(t) = P − T1(t)− T2(t)
Rth1(5.8)
Cth2dT2
dt(t) =
T1(t)− T2(t)
Rth1− T2(t)− Ta
Rth2, (5.9)
where T1(t) is the temperature of the central conductor at time t, T2(t) is the temperature of
dielectric at time t and Ta is the ground (ambient) temperature.
Figure 5.2: Thermal model of an underground power cable.
5.3.2.3 Power transformers
We are interested in the hottest spot temperature. Reference [56], based on IEEE/ANSI C57.91,
presents the entire heat transfer process. The hottest spot temperature is calculated as the sum of
the ambient temperature, the top-oil temperature rise over ambient temperature and the hottest-
spot conductor rise over top-oil temperature. The ultimate steady-state top-oil temperature rise
∆Tu,∞ over ambient temperature Ta is expressed as
∆Tu,∞ = ∆Tu,rl
(K2 + 1
R+ 1
)n, (5.10)
where ∆Tu,rl is the transformer top-oil temperature rise over ambient temperature at rated load,
K the ratio of load to rated load, R the ratio of the loss at rated load on the no-load loss, and n is
65
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
called the “exponential power of loss versus top-oil temperature rise”. The evolution of the top-oil
temperature rise ∆Tu(t) is ruled by
τud∆Tudt
(t) = ∆Tu,∞ −∆Tu(t) (5.11)
where τu is the oil thermal time constant. The temperature rise of the hottest spot above oil
temperature rise, ∆Th, is given by
∆Th = ∆Th,rlK2m, (5.12)
where ∆Th,rl is the temperature rise of the hottest spot over top-oil temperature at rated load
and m is called the “exponential power of winding loss versus winding gradient”. The hottest spot
temperature, Th(t), can then be calculated by
Th(t) = Ta + ∆Tu(t) + ∆Th (5.13)
5.3.3 Thermal failure models
To estimate the frequencies of dangerous scenarios, we need to model the evolution of failure
rates (or failure probabilities) with temperature. The effect of a temperature increase is different
for overhead lines, for underground cables and for power transformers. For lines, the problem is
the sag increase, possibly leading to a short circuit with the ground. For cables and transformers,
the problem is the dielectric strength decrease, possibly leading to a dielectric breakdown. We use
failure rates in “reference conditions” that means in nominal loading.
5.3.3.1 Overhead lines
When the temperature of a line increases, its sag will also increase, possibly leading to a short
circuit between the line and the vegetation. As shown in Chapter 2, this phenomenon was very
important during the cascading failure leading to the blackout in the USA in 2003. If S is the
sag of the line, HL is the height of the suspension point, HV is the height of the vegetation, EDis the breakdown electric field of ambient air and V is the phase-to-ground voltage of the line, a
short-circuit will occur when
HL − S ≤ HV +V
ED(5.14)
The state change equation of the conductor is developed and given in [57], as
T 2
[T − Tref +
EA(mrefg)2
24T 2ref
+ EAαt(T − Tref )
]=EA(mg)2
24(5.15)
where T is the conductor tensile force, E is its modulus of elasticity, A its cross section, αt the coeffi-
cient of thermal expansion, mg the conductor weight per unit length, Tref the reference temperature,
mrefg the reference conductor weight per unit length and Tref the conductor tensile force in ref-
erence conditions (Tref ,mrefg). Therefore, if (Tref ,mrefg, Tref ) are known, and if the conductor
weight per unit length does not change3, the conductor tensile force is a function of its temperature,
T ≡ T (T ), implicitly defined by the equation (5.15). When the conductor tensile force is known,
the sag can be deduced from the relation
S(T ) ≈ mgl2
8T (T )(5.16)
Consequently, for a specific line, the sag is a function of the mean temperature T of the line. So,
the trip of the line occurs when
S(T ) = HL −HV −V
ED(5.17)
3Or, more precisely, does not change significantly, because the dilatation changes the weight per unit lenght.
66
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
When vegetation is present below a line, it’s height can be modeled by a random variable whose
distribution depends on maintenance policy, climate, soil properties, and season. The breakdown
electric field of ambient air depends on temperature, pressure, humidity, pollution and can also be
modeled by a random variable. Probabilistic laws governing these random variables have to be
estimated by statistical inference on the basis of operational feedback.
It is important to notice that a line trip can occur even if the line is not overloaded: it depends
only on the sag and the vegetation’s height.
5.3.3.2 Underground cables
The main failure mode for cables is dielectric breakdown. There are two dominant types of cables
used nowadays: oil-filled cables and extruded isolation cables (Ethylene Propylene Rubber - EPR,
Cross-Linked PolyEthelene - XLPE). For the oil-filled cables, the literature reports no modification
of dielectric strength with temperature [58], but only an accelerated aging. Consequently, the failure
rate in temporary overload conditions will not significantly change. Contrarily, experimental studies
show a reduction of the dielectric strength with temperature for extruded isolation cables [59]. The
two-dimensional Weibull distribution is generally used to model the distribution of the lifetime of
cables [60]. Therefore, the cumulative distribution function (cdf) of the random variable describing
the failure time tf of a cable subject to a dielectric stress E can be written as
F (tf ) = 1− exp
[−(τ(tf )
t0
)a(E
E0
)b](5.18)
where t0, a and b are constants depending on material and cable dimensions, and E0 is the stress
leading to a nominal breakdown probability. In other words, E0 can be viewed as the dielectric
strength. τ(t) is the effective age of the cable at the calendar time t (accelerated aging in overload
conditions). In nominal conditions, dτ/dt = 1. Parameter b is usually high, between 8 and 12
[60]. Parameter a changes during the cable life, from a < 1 (infant mortality) to a > 2 (end of life
wear-out) [60, 61]. In reality, there is a superposition of several Weibull laws with a change in the
value of parameter a [60, 61]:
• The first law (a < 1) models the infant mortality (first part of the bathtub curve presented in
Subection 3.1.1),
• The second law (a ≈ 1) models the useful life (second part of the bathtub curve presented in
Subection 3.1.1),
• The third law (a > 2) models the end of life wear-out (last part of the bathtub curve presented
in Subection 3.1.1).
The first law and the beginning of the second law are shown in Figure 5.3. The literature reports [59]
a decrease of the dielectric strength with temperature, as shown in Figure 5.4. If the temperature
T of the cable is constant, the failure rate at calendar time t and temperature T can be written as
λ(t, T ) = λref [τ(t)]
(E0(Tref )
E0(T )
)b× dτ
dt(t), (5.19)
where λref [τ(t)] is the failure rate at the reference temperature Tref and the age τ(t). Rigorously,
equation (5.19) is only valid for a constant temperature. In the specific problem of cascading
failure, we choose therefore to disjoin contributions of wear-out and temporary reduction of dielectric
strength in the failure rate:
• The wear-out is considered through the age and the reference failure rate. As the variations
of the latter quantities take place on long time scales, the age is considered at the time of the
initial contingency occurrence, and is kept constant during a cascading event. Therefore, the
reference failure rate is taken as constant.
67
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
Figure 5.3: Life distribution at constant stress of high voltage cables with extruded isolation. From
[60].
Figure 5.4: Dielectric strength as a function of temperature. From [59].
• The temporary reduction of dielectric strength, as a result of temperature evolution, is con-
sidered through (5.19).
It should be noted however that equation (5.19) is derived from a constant temperature assumption,
because of the lack of accurate knowledge of the failure rate variation in transient conditions. It
provides a reasonable approximation of the failure rate behavior if the temperature transient is
slow or moderately fast. Another approach able to consider all kinds of transients is proposed in
Appendix A.
5.3.3.3 Power transformers
Literature reports a temporary reduction of the dielectric strength with temperature due to ther-
mally induced gas bubbles above about 90C [62]. Reference [58] suggests modeling dielectric stress
and transformer withstand voltage as normal random variables, respectively VS ∼ N(µS , σS) and
VR ∼ N(µR, σR) (in normal conditions). It proposes the hypothesis that the dielectric failure rate λdis proportional to the probability of the dielectric stress being higher than the transformer withstand
voltage:
λd ∝ P (VS > VR) = 1− φ[(µR − µS)/(σ2S + σ2
R)1/2], (5.20)
where φ(x) is the normal cumulative distribution function. If the mean of the transformer withstand
voltage decreases with temperature, the dielectric failure rate λd(T ) of an overloaded transformer
can be calculated by
λd(T ) = λd(Tref )1− φ[(µR(T )− µS)/(σ2
S + σ2R)1/2]
1− φ[(µR(Tref )− µS)/(σ2S + σ2
R)1/2](5.21)
68
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
where T is the hottest spot temperature (the winding which will normally fail first is the one sub-
mitted to the highest temperature) and Tref is the hottest spot temperature in reference conditions.
The transformer failure rate as a function of temperature is shown in Figure 5.5, with parameters
values given in [58]. We should however note that power transformers could have thermal overload
Figure 5.5: Transformer failure rate as a function of temperature.
protections such as winding hot-spot temperature protection to provide tripping when unacceptable
degradation of the transformer winding insulation is occurring.
5.3.4 Operator actions
During the slow cascade, operators can take corrective actions: they will try to eliminate overloads,
to bring the system back to a N−1 secure state as soon as possible (redispatching of the generation,
topology modifications, load shedding), and to come back to the initial international exchange
program between areas if the loss of a power plant entailed a perturbation. In the modeling, operator
actions should be considered because they influence both failure times and consequences. This
modeling is a really important but complex issue of the proposed approach. In Chapter 6, only a
very simple model is used, but future possibilities are explored in Chapter 7.
5.3.5 Transition criteria between level-I and level-II
The modeling developed for the level-I is based on the assumption that the impact of the precise
electrical transient (between an initial electrical steady state and a final electrical steady state) on
possible transitions is negligible: only transitions due to thermal failures, independent failures, or
operators actions based on the electrical steady state are considered. Therefore, this assumption is
obviously no longer valid if the electrical dynamics of the system starts to rule the transition, i.e. if it
becomes dominant. There are several phenomena that can entail the electrical dynamics to become
dominant: if the system is locally or globally subject to voltage instability, frequency instability or
angle instability (transient or small-signal) or if electrical variables violate one or several protection
set points. In these cases, the steady-state simulation does not capture anymore the grid behavior,
the level-I analysis has to be stopped and the level-II analysis has to be started. For each system
state i, we can define a domain Di ∈ Rm where the electrical variables xE are such that the electrical
dynamics becomes dominant. The equations (5.6) are then only valid for xE /∈ Di and y−1ji (xE) /∈ Dj ,
∀j 6= i. Specific criteria to detect these instabilities must be implemented in any approach to solve
these equations.
5.3.6 Analog simulation algorithm for the slow cascade
In previous Sections, we suggested to adapt dynamic PRA to analyze the slow cascade, which
allows us to consider the dependency of link failure rates on temperature. We introduced thermal
69
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
failure models and equations ruling evolution of the temperatures. The resulting set of equations
cannot be solved analytically. In this Section, we present an analog Monte Carlo (MC) simula-
tion algorithm in order to identify scenarios possibly leading to a blackout and to estimate their
frequencies (computed over a large number of histories, depending on the accuracy needed).
Figure 5.6: Algorithm diagram.
The general simulation scheme is the following for each MC run (see Figure 5.6):
1. Initial conditions are sampled4. This includes load and generation pattern, climatic conditions,
elements in maintenance, ... Because of the correlation between the load and the climatic
conditions (wind speeds, air temperature and ground temperature) through the day in the year
(seasonal effects) and the hour, the latter values are first sampled (from uniform probability
laws). The load and climatic conditions can then be sampled conditionally to the day and
4Specific details about the sampling of initial conditions for the example developed in Chapter 7 are given in
Chapter 7.
70
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
the hour. If the network includes wind farms, their generation must be computed using wind
speeds, sampled in a way taking into account the correlation between them. The vegetation
heights below each overhead line also have to be sampled before the beginning of each history
(random variables whose distributions depend on soil properties, climate and the season).
2. The electrical and thermal steady state is then computed. The electrical steady state is ob-
tained through the resolution of the load flow equation, typically with the Newton-Raphson
method (a reference state can be used as starting point). The thermal steady state is then com-
puted on the basis of currents obtained through the stationary form of temperature equations
given in Subsection 5.3.2.
3. The first contingency is sampled. It can be the loss of a link or a power plant. The sampling is
based on mean failure rates of elements λi: the probability pi that the element i fails knowing
that an element fails is given by
pi =λi∑i λi
(5.22)
4. The transient stability is assessed. In case of transient instability, the MC run is called “dan-
gerous”, the slow cascade simulation is stopped and the level-II analysis should be started.
However, if the grid is supposed to be in N − 1 security, this step could be ignored for the
initiating event.
5. If a power plant is lost or in case of a system split, the generation modification has to be
computed, according to the primary regulation policy in power plants. The frequency stability
is then assessed on this primary regulation basis.
6. The electrical steady state is again computed by solving the load flow equations. The previous
state can be used as starting point for any iterative method such as Newton-Raphson.
7. The voltage stability is evaluated based on the load flow equations solution. In particular, a
non-convergence of the iterations could indicate a voltage instability. The small-disturbance
angular instability is evaluated. The possibility that the steady state of one or several electrical
variables triggered one or several protections is also checked. If one of these problem occurs,
the MC run is dangerous, the slow cascade simulation is stopped and the level-II should be
started.
8. The thermal stability is then evaluated, through the competition between operators’ corrective
actions and thermal transients. There are two possibilities for an overhead line failure: thermal
failure or independent failure. The time of a thermal line trip is the time at which condition
(5.17) is satisfied. The time of an independent failure can be sampled from the mean failure
rate, as the independent failure time cdf of line i is given by
Fi(t) = 1− exp(−λit). (5.23)
The minimum time between the thermal failure time and the sampled independent failure
time is the next trip time. The times of thermal failure for cables and transformers have to be
sampled from cdf’s based on failure rates (5.19) and (5.21), respectively. Independent failures
must also be considered. As the temperature evolution can be used in these failure rates to
have the failure rate evolution with time, the failure time cdf of cable/transformer i is then
given by
Fi(t) = 1− exp
(−∫ t
0
λi(s)ds
)(5.24)
where λi(t) is the total failure rate of cable/transformer i (including thermal failures and
independent failures). The failure times of cables and transformers can be directly sampled
71
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
from this expression. The thermal stability, and thus the further development of the cascading
failure, depends not only on failure times sampled on the basis of the steady state post-
contingency, but also on operator actions. Operator action times must also be computed or
sampled at this step.
9. If a new failure occurs, which means that the system is thermally unstable, or if an action
is taken by the operators before the mission time, the simulation continues with this new
contingency from step 4 on. If nothing occurs before a time limit Tm, the system is considered
to be thermally stable, the slow cascade simulation is stopped and the history is safe (non-
dangerous).
This algorithm is repeated for a number of runs sufficient for the precision needed, taking into account
computation time limitations. Interesting results are saved for each MC run. As no evaluation of
consequences is performed during the level-I, only the frequency participates in the definition of the
risk indicator for the level-I (like in the nuclear sector). Therefore, the consequence of a scenario is
equal to 1 if it is a dangerous scenario and equal to 0 if it is a safe scenario. As all MC runs are
based on the sampling of an initiating event, the estimated risk (risk of a specific dangerous scenario
which is its frequency or overall risk which is the total frequency of dangerous scenarios) by such
an analog method is given by the product of the overall frequency of initiating events by a binomial
random variable with parameters N (number of MC runs) and p (probability to have a dangerous
scenario after an initiating event). The mean of this binomial distribution is simply given by
n = Np, (5.25)
and its variance by
σ2 = Np(1− p). (5.26)
If we suppose that p << 1 (which is the case for real grids), the variance is simply given by
σ2 ≈ Np = n. Therefore, the relative standard deviation is given by 1/√n, which means that the
relative precision is inversely proportional to the square root of the simulated number of dangerous
MC runs.
5.3.7 Biasing techniques
In a reliable electric grid such as real power systems, the probability to have a cascading failure
leading to loss of supplied energy after an initiating event is very small. Therefore, the analog
algorithm described previously will need a huge amount of MC runs to reach a satisfactory precision
and will waste a lot of computing time in the simulation of safe histories. Variance reduction
techniques such as biased schemes must be developed in order to improve the simulation efficiency.
In such techniques, random variables are not sampled from the normal pdf’s, but from biased
(modified) pdf’s to increase the apparition rate of interesting events. Results must then be corrected
by statistical weights to keep non-biased estimators of interesting variables. This Subsection presents
the particularization of two of these techniques to our problem: favoring failures during the cascade
by forcing them to occur before a time limit and favoring thermal failures by biasing the sampling
of weather conditions.
When new contingencies are sampled, the system reliability is such that too few MC runs are
likely to have failure events sampled within the time limit Tm. A classical way to overcome this
problem consists in forcing the occurrence of the next event before a time T [63]. The biased cdf
used to sample the failure time of each element (component-based approach) is then
Fi(t) =
Fi(t)Fi(T ) 0 < t ≤ T1 t > T
(5.27)
72
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
where Fi(t) is the initial cdf, given, for cables and transformers, by
Fi(t) = 1− exp
[−∫ t
0
λi(s)ds
](5.28)
and, for overhead lines, by
Fi(t) =
1− exp[−λit] 0 < t ≤ τi1 t > τi
(5.29)
if a tree flashover occurs at the time τi <∞, or
Fi(t) = 1− exp[−λit] (5.30)
otherwise. The weight can then be modified while using biased cdf (5.27) because the same statistical
expected value must be kept. If non-biased cdf’s are used to sample component failure times, the
probability that the component i has the minimum failure time in the time interval dτ arount the
time τ is given by
p = fi(τ)dτ∏j 6=i
Sj(τ), (5.31)
where fi(t) is the component i’s failure time pdf and
Sj(t) = 1− Fj(t). (5.32)
The same probability from biased cdf’s is given by
p = fi(τ)dτ∏j 6=i
Sj(τ). (5.33)
The weight is therefore given by
w =p
p=fi(τ)
fi(τ)
∏j 6=i
Sj(τ)
Sj(τ). (5.34)
With the expression (5.27), we find for the biased pdf
fi(t) =dFidt
(t) =fi(t)
1− Si(T ), (5.35)
for the complements of the biased cdf,
Sj(t) = 1− Fj(t) = 1− 1− Sj(t)1− Sj(T )
=1− Sj(T )− 1 + Sj(t)
1− Sj(T )=Sj(t)− Sj(T )
1− Sj(T ), (5.36)
and, finally, for the weight,
w = [1− Si(T )]∏j 6=i
Sj(τ)1− Sj(T )
Sj(τ)− Sj(T )= [1− Si(T )]
∏j 6=i
1− Sj(T )
1− Sj(T )Sj(τ)
. (5.37)
One can think that time T should be chosen equal to Tm in order to sample all failures before this
time limit. In this case, as a new failure occurs until an electrical instability is reached, and as an
electrical stability is guarantee when all components are out-of-service, all MC runs will contribute,
in fine, to the statistics of dangerous scenarios. However, the weight of some MC runs can be huge
and will increase the variance. Indeed, if we consider for example n components with constant failure
rates and λiT << 1 (reliable components), the weight can be approximated by
w ≈ λiT(
T
T − t
)n−1
. (5.38)
73
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
If t << T , w ≈ λiT << 1, but for t→ T , w →∞. Therefore, it is necessary to keep a small variance
to eliminate MC runs with a sampled failure time “near” T , by using T > Tm. The variance can
also be deteriorated when a tree flashover occurs at time τi < Tm. Using biased cdf, if the first
sampled failure is due to this tree flashover, the weight will increase. Consequently, we suggest to
test before each sampling if a tree flashover occurs, to use an analog sampling if it is the case, and
to apply this biasing only in the opposite case. Moreover, it is useless to continue to use a biased
sampling when the weight of a MC run is becoming very low: its contribution to the score will be
insignificant while it will continue to require computing resources. We propose to use this biased
sampling only if the weight is higher than a cut-off weight pC , otherwise a non-biased sampling is
used (variant of the Russian roulette).
Forcing failures to occur before a time limit improves the statistic of cascading failures due to
independent events, but do not improve the statistic of cascading failures due to tree flashover.
A way to favor such thermal failures is to bias the sampling of weather conditions, i.e. favoring
the sampling of high ambient temperatures θi and low wind speeds vi. If temperature and wind
speeds are sampled from independent laws, the marginal pdf functions of the ambient temperatures
fΘ,i(θi) and wind speeds fV,i(vi) can be modified into fΘ,i(θi) and fV,i(vi) to favor high ambient
temperatures and low wind speeds and, thus, low cooling of links and thermal failures. The weight
must then be multiplied by
w =
nθ∏i=1
fΘ,i(θi)
fΘ,i(θi)(5.39)
for the temperatures at the various temperature domains, and by
w =
nv∏i=1
fV,i(vi)
fV,i(vi)(5.40)
for the wind speeds at the various wind speed domains. However, if some of these variables are
sampled from dependent laws, this weight is not correct. For example, if wind speeds are sampled
a dependent way to account for the correlations5, the weight is given by
w =fV (v1, ..., vnv )
fV (v1, ..., vnv )(5.41)
When dependent random variables are sampled to model wind speeds, the joint cdf FV (v1, ..., vnV )
is in general modeled by a Copula C(u1, ..., un) which is a function of the marginal cdf’s FV,i(vi)
[64],
FV (v1, ..., vnV ) = C(FV,1(v1), ..., FV,nV (vnV )). (5.42)
The joint pdf is then given by
fV (v1, ..., vnV ) =∂nC(u1, ..., unV )
∂u1...∂unV
∣∣∣∣u1=FV,1(v1),...,un=FV,nV vnV
fV,1(v1)..., (5.43)
and, by denoting c the Copula density,
fV (v1, ..., vnV ) = c(F1(v1), ..., Fn(vn))fV,1(v1)...fnV (vnV ). (5.44)
The weight is therefore given by
w =f(v1, ..., vnV )
f(v1, ..., vnV )=c(FV,1(v1), ..., FV,nV (vnV ))fV,1(v1)...fV,nV (vnV )
c(FV,1(v1), ..., FnV (vnV ))fV,1(v1)...fV,nV (vnV ). (5.45)
The presence of the Copula densities does not allow to control the global weight, even if the marginal
weights fi/fi are controlled. This can lead to huge weights for some MC runs, and thus possibly
5They can be sampled directly from their joint cdf to account for the correlations, or indirectly.
74
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
to a variance increase (instead of a variance reduction). Therefore, if dependent random variables
are sampled through the sampling independent random variables by a specific transformation, the
biasing technique should be applied directly to the independent random variables to avoid the impact
of Copula density.
5.4 Clustering between level-I and level-II
Applying the level-II analysis on each scenario given by the level-I PRA (which could be viewed
as the equivalent of an integrated level 1 - level 2 approach in the nuclear sector) can lead to analyze
separately two quasi-identical (or identical) scenarios (if a large set of MC runs are simulated during a
level-I analysis, the successive samplings can give two quasi-identical scenarios). As electric dynamic
simulations need important computing times (especially for large power systems), it is important
to limit the level-II analysis to a minimum set of scenarios while keeping a satisfying accuracy on
results. Therefore, we propose not to analyze each scenario given by the level-I PRA, but to group
scenarios into clusters and to analyze only the “equivalent scenario” to each cluster (equivalent to
the grouping of level 1 scenarios in “plant damage states” in nuclear PRA [65]).
Only electrical properties are important for the fast cascade (not the ambient temperatures, the
wind speeds, ...). Scenarios can be grouped into clusters on the basis of two considerations. First,
the sequence of events during the slow cascade must be the same for all scenarios of a cluster. The
clustering can then be applied separately to each sequence of events. Secondly, the electric stationary
states before the triggering event must be “similar” for all scenarios of a cluster, which is equivalent
to require that load/generation patterns must be “near”. This notion of proximity must indeed
be defined precisely. The load/generation pattern depends on the active/reactive power generation
Pg/Qg and active/reactive power consumption Pl/Ql at each bus. The load/generation pattern can
then be represented in a 4×Nb-dimension space, where Nb is the number of buses with non-null load
and/or generation. The proximity can then be quantified on the basis of distance between points in
this space.
Several clustering techniques were developed in order to group into clusters points in any multi-
dimensional space, on the basis on distance between points. They are used in the nuclear sector
in a similar context to “make the dynamic analysis manageable from both a computational and
phenomenological viewpoint” [66] when a PRA methodology is used (especially dynamic PRA, but
also classical PRA). In particular, it is impractical both in the nuclear and the electric sectors to
perform a level-II analysis for all generated level-I sequences. Different clustering techniques are
analyzed in [67] and the Mean-Shift technique is proven to be well suited for the scenario analysis.
5.5 Level-II
5.5.1 General modeling
For the fast cascade, interactions between electrical variables and protections and load-shedding
relays have to be taken into account, but since the mean time between events is then much smaller
than the thermal characteristic times, the variation of the temperatures of the grid elements during
this phase can be neglected. This time, dynamic PRA must be adapted in order to include the effect
of electrical variables (currents, voltages, frequencies ...) on transition rates/probabilities. Conse-
quently, we suppose that the temperatures are constant, that the variation of electrical variables
does not depend on thermal variables and that transition rates depend only on electrical variables.
75
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
The equations (5.1) then become
π(xE , xT , i, t) =
∫Rm
π(uE , xT , i, 0)δ(xE − gi,E(t, uE)) exp
[−∫ t
0
λi(gi,E(s, uE))ds
]duE
+∑j 6=i
∫ t
0
∫Rm
p(j → i|uE)π(uE , xT , j, t− τ)δ(xE − gi,E(τ, uE))
× exp
[−∫ τ
0
λi(gi,E(s, uE))ds
]duEdτ.
(5.46)
We can eliminate the dependency on thermal variables xT by integration on these variables and by
denoting by π(xE , i, t) the probability density function to find the system in state i at time t with
electrical variables xE , which gives
π(xE , i, t) =
∫Rm
π(uE , i, 0)δ(xE − gi,E(t, uE)) exp
[−∫ t
0
λi(gi,E(s, uE))ds
]duE
+∑j 6=i
∫ t
0
∫Rm
p(j → i|uE)π(uE , j, t− τ)δ(xE − gi,E(τ, uE))
× exp
[−∫ τ
0
λi(gi,E(s, uE))ds
]duEdτ,
(5.47)
because
π(xE , i, t) =
∫Rnπ(xE , xT , i, t)dxT . (5.48)
Before solving these equations, we have to define differential equations describing the electrical vari-
ables evolution in each system state (gi(t, xE)) and to model the dependence of transition rate on
electrical variables (p(i→ j|xE)) for each element. The evolution of electrical variables corresponds
to the dynamic equations presented in Chapter 1. They are not furthermore developed in this
Section. As the duration of a fast cascade is much smaller than the mean time between two inde-
pendent failures, we propose to neglect independent failures during the fast cascade. Therefore, only
transitions due to electrical variables are considered. Subsection 5.5.2 discusses these transitions.
Subsection 5.5.3 proposes a simulation algorithm for the fast cascade.
5.5.2 Transitions due to electrical variables
Contrarily to thermal variables which entail failures during the slow cascade, electrical variables
entail transitions through protection systems of the grid elements during the fast cascade. Indeed,
several relays can disconnect elements operating in unacceptable conditions in order to protect them:
• For lines: over-current relays, distance relays (apparent impedance as criterion), ...
• For power plants: over-excitation relays, over/under-voltage relays, over/under-frequency re-
lays, loss-of-synchronism, ...
Moreover, under-voltage and under-frequency load shedding can help to stabilize the system in case
of voltage and frequency instabilities, respectively. If protection systems were perfectly reliable,
transitions should occur only when the setpoint of a protection is crossed. Mathematically, if the
transition from state i to state j is due to the action of protection k, the corresponding transition
rate is given by
p(i→ j|xE) = δ(xE,l − sk)dxE,ldt
, (5.49)
where xE,l is the monitored electrical variable and sk is the setpoint. Time-delay (intentional or not)
can be considered by the stimulus-driven theory of probabilistic dynamics [68]. If the protection k
must act when xE,l > sk, the stimulus Gk associated to this protection is activated (IGk = + where
76
CHAPTER 5. BLACKOUT PRA IN 3 LEVELS
IGk is the label associated with the stimulus Gk) as soon as xE,l > sk and deactivated (IGk = −)
as soon as xE,l < sk. However, misoperations of protection systems can occur: a relay can fail to
trip, the setpoint of a relay can differ from its nominal value, measurement errors can occur, and a
distance protection seeing a faulted line in its backup zone can trip instantaneously instead of doing
it after a delay. These misoperations make the evolution of the power system stochastic.
5.5.3 Fast cascade simulation algorithm
Discrete Dynamic Event Trees (DDET) were proposed in [69] to be the core of the scheme used
for the fast cascade. After the occurrence of the triggering event (i.e. the last event of the slow
cascade), the process variables follow evolution laws associated to the resulting configuration. The
corresponding deterministic transient evolution defines a so-called mother branch. The evolution
of the process variables is traced by simulation and new branches are generated from this mother
branch at user-specified discrete time intervals due to branching rules (on setpoints, on probabilistic
thresholds,...), as shown in Figure 5.7 where the variability of setpoints is considered. The devel-
opment of a scenario is stopped according to specific criteria. Two main stopping criteria are used.
First, a maximum time between two successive events is considered to end up the simulation if
nothing new occurs during a certain period of time. Secondly, a cut-off probability is defined so that
the branches carrying a lower probability than it are truncated. Finally, the frequency of the user-
specified absorbing state can be calculated and related scenarios are identified. The method used
for the risk analysis of the fast cascade was split in two steps. The first step consists in building a
so-called skeleton (i.e. a purely setpoint-based DDET), while the second step consists in integrating
the stochastic behavior of distance relays into this skeleton. Finally scenarios leading to blackout
are identified and their frequencies are calculated, considering both setpoint-based performance of
relays and distance protection misoperations.
Figure 5.7: Mother branch and new branches of a DDET. Adapted from [69].
5.6 Conclusions
We proposed in this Chapter a methodology able to analyze the risk of blackout in a power
system. This approach is based on the decomposition of the cascading failure PRA in two levels.
The restoration of the power system after a blackout or a major load shedding can be viewed as
a third level of the blackout PRA, but the purpose of this PhD thesis is not to develop this level.
We developed this approach mainly for the first phase of cascading failure (PRA level I), with a
Monte Carlo simulation able to reveal dangerous scenarios. Developing the previous work of Farshid
Faghihi [69], we also proposed an approach for the second phase (PRA level II) based on dynamic
PRA techniques previously developed for the nuclear sector. We introduced a way of grouping the
scenarios between the level I and the level II in order to reduce the complexity of the level II analysis.
The next Chapter applies these two levels to test systems with several simplifications.
77
Chapter 6
Applications
6.1 Introduction
This Chapter presents results obtained by the application of the methodology proposed in the
previous Chapter to test system. Section 6.2 develops first an example for the level-I of the blackout
PRA, which was the main part of this PhD thesis. A base state of a test system is studied, as well
as several variants. Then, Section 6.3 presents an example of a two-level blackout PRA on a very
simple test system. Finally, Section 6.4 applies variance reduction methods proposed in the previous
Chapter for the level-I.
6.2 One-level blackout PRA
Results obtained with the dynamic level-I PRA method are each time compared to a so-called
“independent method”, based on the same simulation scheme, but neglecting thermal effects. This
means neglecting the impact that a failure has on the failure rates of other elements (failures are
sampled independently of the previous events on the basis of average failure rates). Results are
expressed in terms of frequency of dangerous scenarios. As previously stated, a so-called “dangerous
scenario” is a scenario leading to an electrical instability and thus possibly leading to a major
system disturbance or a blackout, depending on the fast cascade. The frequency is the inverse
of the expected time between two dangerous scenarios: if the frequency is 10−2/year, a dangerous
scenario is expected every 100 years in average. If scenarios are grouped according to the sequence of
occurring events, a large amount of different situations (characterized by different timings, different
load/generation patterns, different climatic conditions) are behind each sequence. A large variability
in the loss of power supplied could be revealed by a level-II analysis for the same sequence of events
identified during the level-I analysis, depending on the load/generation pattern. Moreover, a level-I
scenario whose frequency is lower than another one could induce a bigger loss of supplied power and
thus a greater risk. Consequently, level-I results give a first indication of vulnerability paths, but the
level-II analysis is important to estimate the risk induced by each vulnerability path. The computing
time required per MC run is approximately 4.7 ms for this network on a Intel(R) Xeon(R) CPU
L5420 @ 2.50GHz1.
6.2.1 Test case: data and modeling assumptions
6.2.1.1 Blackout test system
To apply the proposed methodology, we need a complete test system with electrical parameters
for each machine and electrical, geometrical and thermal properties for each link. Initial states have
1All computing times cited in this Chapter refer to this CPU.
79
CHAPTER 6. APPLICATIONS
also to be N − 1 secure to respect TSO’s actual requirements. To have such a blackout test system,
we adapted a classical test system which is a reduced-order equivalent of the interconnected New
England Test System (NETS) and New York Power System (NYPS) with three other neighboring
regions introduced initially in [70], in order to have a 69-bus test system. The purpose of the
adaptation is not only to have all parameters needed (electrical parameters for each machine and
electrical, geometrical and thermal properties for each link), but also to have coherency between
these properties (geometrical and material properties determine electrical and thermal properties).
Initial states have also to be N − 1 secure to respect TSO’s actual requirements. Each power plant
in NETS and NYPS has two identical units, except power plant 1 which has only one unit. The load
is modulated along the day and the day hour, according to load factors2 given in the IEEE-RTS [71]
and reproduced in Appendix B. The mean load as a function of hour for the four season is given
in Figure 6.2. We also implemented two wind farms of 150 MW and seven wind farms of 200 MW.
The modified network is shown in Figure 6.1. Complete details are given in Appendix B.
Figure 6.1: Blackout Test System.
Figure 6.2: Mean load as a function of day hour for the four season.
2We call here load factor the total actual load divided by the total peak load.
80
CHAPTER 6. APPLICATIONS
6.2.1.2 Meteorological data
In a modern power system, weather conditions are important for two main reasons: wind gen-
eration depends on the wind speed and temperatures of overhead lines depend on the wind speed
and angle, air temperature, ... Parameters describing random variables for wind speeds and tem-
peratures are computed on the basis of data provided by the Koninklijk Nederlands Meteorologisch
Instituut (KNMI) [72]. The ambient temperature is modeled by a normal random variable whose
parameters depend on the moment of the season and day hour. The mean ambient temperature and
mean wind speed as a function of the day hour for the four seasons are shown in Figures 6.3 and
6.4, respectively.
Figure 6.3: Mean ambient temperature.
Figure 6.4: Mean wind speed.
To consider the correlation between production in different wind farms, the joint normal distribu-
tion method is used to sample wind speeds [64], so that the rank correlations are kept. The main
idea of this algorithm is
1. To sample standard normal dependent variables, in two steps:
(a) The sampling of normal independent variables,
(b) The transformation of the sample into a sample of dependent variables through the cor-
relation matrix,
2. To apply a transformation to get samples distributed according to the desired marginals, in
two steps:
81
CHAPTER 6. APPLICATIONS
(a) Transformation of the previous sample into a sample distributed along uniform laws
(through standard normal cdf),
(b) transformation into a sample distributed along the desired marginals (through desired
inverse cdf’s).
To sample dependent variables V = [V1, ..., Vn] describing wind speeds in the n subareas, we can
therefore use the following algorithm:
1. Independent sampling of n standard normal distributions Z = [Z1, ..., Zn] to get z = [z1, ..., zn].
2. Transformation y = Tz to get a sample from n dependent standard normal distributions,
where T is a lower triangular matrix such that R = T × T t (Cholesky decomposition) and R
is the correlation matrix.
3. Transformation ui = FN (yi), i = 1, ..., n where FN is the standard normal cdf. The samples
ui are then distributed along uniform laws on [0, 1].
4. Transformation vi = F−1i (ui), i = 1, ..., n, where Fi is the cdf of vi.
The correlation matrix R used to compute matrix T is not the correlation matrix of the standard
normal distributions Yi = F−1N [Fi(Vi)]. In order to simplify calculations, the rank correlation matrix
can be used. The rank correlation ρr of random variables X,Y with cdf FX and FY , respectively,
is:
ρr(X,Y ) = ρ(FX(X), FY (Y )) (6.1)
where ρ denotes the correlation. Rank correlations of random variables Y and V are the same
because Fi(Vi) = Ui = FN (Yi). Moreover, if X,Y are standard normal distributions,
ρ(X,Y ) = 2 sin
[π
6ρr(X,Y )
]. (6.2)
To compute the correlation matrix R for random variables Y , we can compute the rank correlation
of random variables V and apply the previous relationship. Therefore, this method keeps rank corre-
lation between wind speeds, but not necessarily direct correlations. Nevertheless, direct correlations
are nearly kept. This is a way to sample wind speeds using a Gaussian Copula [64] (see Subsection
5.3.7).
To model the marginal distributions, the two-parameter Weibull distribution is commonly used[73].
Cdf’s are then given by
Fi(vi) = 1− exp[−(vi/ηi)βi ], (6.3)
and the inverse
F−1i (ui) = ηi.[− ln(1− ui)]βi . (6.4)
We also have to emphasize that the wind speed distribution is not constant along the year (parame-
ters of the Weibull law vary) as well as the air temperature and the load. Consequently, these values
need to be sampled according to the specific moment (day and hour) in the year.
To extrapolate the wind speed at wind power plant height, we use the logarithmic wind profile
[74] which gives a simple relation between the wind speed v(h1) at height h1 and the wind speed
v(h2) at height h2:v(h1)
v(h2)=
ln(h1/h0)
ln(h2/h0)(6.5)
where h0 is the aerodynamic roughness length of the surface.
82
CHAPTER 6. APPLICATIONS
6.2.1.3 Modeling assumptions
In order to improve the efficiency of the simulation, we will use some simplifications:
• The load is taken constant for a specific sampled moment (day and hour) in the year.
• The ambient temperature is modeled by a normal random variable with a mean and a standard
deviation depending on the moment of the year. The ground temperature has two different
values, depending on the season (one for winter and spring, the other for summer and fall).
• We choose a unique vegetation height for all lines and all MC runs, such that the probability
of having a short circuit with the ground in all normal situations (no contingency) is 10−5
(constant air breakdown electric field)3.
• For the electrical instability of the system, we consider only voltage instability (through the
non-convergence of the load-flow iterations) and frequency instability. The models used for
these two transition criteria are described in Appendix C.
• We consider the system thermally stable if there is no new contingency within 60 minutes.
• Average failure rates are taken as their nominal values in nominal conditions.
• Initial conditions (load pattern and climatic conditions, sampled at the beginning of each
history) are kept constant during each MC run.
6.2.2 Results for the base case
We give in this Subsection detailed results obtained by applying our methodology to the base case
(100 million MC runs - computing time: 131 hours), in order to identify the vulnerabilities of the
blackout test system. Mean cross-border power flows between the five areas in normal conditions are
given in Table 6.1. The variability in load and wind generation induces variability in power flows.
Power flows (MW) Mean Min Max Std
NETS→NYPS 140 -140 525 117
NYPS→3 -13 -150 182 69
NYPS→5 57 -105 360 110
3→4 229 117 382 51
4→5 93 -13 180 31
Table 6.1: Cross-border power flows
6.2.2.1 Dangerous scenarios
The estimation of the total frequency of dangerous scenarios is 8.1 × 10−3/year (with a good
precision: the standard deviation is given by σ = 1.2%) by the dynamic level-I PRA method and
4.6× 10−3/year (σ = 1.7%) by the independent method. Table 6.2 lists dangerous scenarios whose
events correspond to the trip of line i − j and compares their frequencies ranked according to
both dynamic level-I PRA estimation and the independent estimation (σ is between 2 and 10% for
each scenario for dynamic level-I PRA, and between 3 and 10% for each scenario with a frequency
higher than 10−4/yr for independent method). We observe from these results that some scenarios
have a frequency an order of magnitude higher when we include dependencies on temperature. In
particular, a four-event scenario has a high frequency, due to reorganization of flows in the grid and
cascading overloads. For other scenarios, considering the dependencies between events seems to be
3The impact of vegetation height and, thus, of this value are studied in Subsection 6.2.3.
83
CHAPTER 6. APPLICATIONS
negligible, compared to the classical estimation. It can be surprising that some scenarios have a
slightly higher frequency by the classical method than by our method. It simply means that another
event occurs before the second event. For example, taking into account thermal effects implies that
line 57-58 will trip shortly after line 58-59. This is the first observation: the classical method gives
wrong estimations of some dangerous scenario frequencies by neglecting the impact of the primary
contingency on the failures of other elements. The distribution of lines outages for the dynamic
level-I PRA method is shown in Figure 6.5. All cascading failures have at least 2 events during the
slow cascade (N − 1 security rule). Most cascades comprise from 2 to 4 events. It can be surprising
to have short cascades with few events. However, the aim of the level-I analysis is to model the slow
cascade: a level-I scenario indicates how the system can reach an electrical instable state. These
numbers of events are in concordance with those observed in recorded slow cascades (see Chapter
2).
Init. event Event 2 Event 3 Event 4 Level-I PRA freq. (/yr) Ind. method freq. (/yr)
58-59 57-58 62-65 65-66 2.2× 10−3 < 10−5
65-66 57-58 59-60 2.3× 10−4 < 10−5
58-59 57-58 65-66 1.8× 10−4 < 10−5
59-60 57-58 62-65 65-66 1.5× 10−4 < 10−5
38-46 46-49 1.1× 10−4 1.4× 10−4
23-24 68-24 1.4× 10−4 1.4× 10−4
49-18 46-69 1.2× 10−4 1.3× 10−4
46-69 49-18 1.1× 10−4 1.3× 10−3
Table 6.2: Most frequent dangerous scenarios (base case)
Figure 6.5: Distribution of line outages during dynamic level-I PRA cascades.
6.2.2.2 Criticality of links
In order to optimally control (through maintenance) and reduce the risk, importance measures
are defined to evaluate a component contribution to the risk [75, 76]. Different importance factors
where proposed, but we use only two of them. The Fussell-Vesely factor of diagnosis FVi is the
probability that element i is failed, knowing that the scenario is dangerous [75, 76],
FVi =F0 − F−iF−i
(6.6)
where F−i is the dynamic level-I PRA frequency of dangerous scenarios without failure of element
i and F0 is the base (reference) case overall dynamic level-I PRA frequency of dangerous scenarios.
84
CHAPTER 6. APPLICATIONS
Table 6.3 compares Fussell-Vesely factors of links, ranked according to both dynamic PRA level-
I estimation and the independent estimation. The Lambert factor of critical importance Ci is the
probability that element i causes the electrical instability, knowing that the scenario is dangerous[75,
76],
Ci =F+i − F
−i
F+i
Pi (6.7)
where F−i is the dynamic level-I PRA frequency of dangerous scenarios with failure of element i and
Pi is the probability that element i is failed in a dangerous scenario. Table 6.4 compares Lambert
factors of links, ranked according to both dynamic PRA level-I estimation and the independent
estimation. A large value of the Fussell-Vesely factor for a specific line indicates that this line is
sensitive to the reorganization of the flows after another line trip and the trip of this line increases
the thermal instability of the grid or entails an electrical instability. A large value of the Lambert
factor for a specific line indicates that this line is sensitive to the reorganization of the flows after
another line trip and the trip of this line entails directly an electrical instability.
Link FVi (%) Independent FVi (%)
57-58 42.5 <1.0
65-66 42.3 <1.0
58-59 37.0 4.5
62-65 34.5 <1.0
59-60 11.8 4.6
35-45 8.0 15.3
35-45 8.0 15.3
69-18 5.6 11.3
46-49 6.8 11.3
50-51 5.6 10.9
Table 6.3: Fussell-Vesely factors
Link Ci (%) Independent Ci (%)
65-66 32.3 <1.0
59-60 4.5 1.9
17-43 4.1 6.6
35-45 3.7 7.1
46-49 3.7 6.2
33-34 3.6 <1.0
35-45 3.7 7.1
17-43 4.1 6.6
46-49 3.7 6.2
69-18 2.7 6.2
Table 6.4: Lambert factors
6.2.2.3 Importance of initial conditions
The total frequency of dangerous scenarios as a function of the ambient temperature, as a function
of the mean wind speed, as a function of load and as a function of day hour, both in a dynamic
level-I PRA approach and in an independent approach, are represented in Figures 6.6, 6.7, 6.8 and
6.9, respectively. In concordance with common sense, the model gives higher frequencies for high
85
CHAPTER 6. APPLICATIONS
Link Probability Independent probability
58-59 2.7× 10−3 8.6× 10−5
59-60 4.9× 10−4 1.2× 10−4
65-66 4.3× 10−4 1.3× 10−6
35-45 3.4× 10−4 3.7× 10−4
35-45 3.4× 10−4 3.7× 10−4
69-18 2.3× 10−4 2.9× 10−4
50-51 2.4× 10−4 2.8× 10−4
38-46 2.2× 10−4 2.4× 10−4
Table 6.5: Probability to have a dangerous scenario after a link trip as initiating event
ambient temperatures and low wind speeds, because the cooling is weak in these cases. Intuitively,
the frequency should also be monotonically increasing as a function of load, to reach a maximum
when the load is maximum, as the independent reliability analysis shows. Surprisingly, in the
dynamic level-I PRA analysis, even if the frequency is increasing when the load goes from 40%
of the annual peak load to about 90%, it is decreasing after. In fact, higher loads are reached in
winter, when the cooling of lines is strong (low ambient temperatures and high wind speeds). It is in
concordance with observed past blackouts where thermal effect was present (August and September),
as explained in Chapter 2. Even if the wind speed is higher during the day, the combination of the
load, the temperature and the heat gain rate from the sun gives a higher risk of blackout during the
day for this test system.
Figure 6.6: Total frequency of dangerous scenarios as a function of the ambient temperature.
6.2.2.4 Discussion
Results given either by a dynamic level-I PRA simulation or an independent simulation are very
different. Indeed, the impact of thermal effects influences not only the value of the frequency of
most dangerous scenarios but also their ranking and the critical lines. In particular, the dynamic
level-I PRA simulation reveals a critical area, located approximately between buses 2, 3 and 56, as
shown in Figure 6.10. The importance of thermal effects is higher in summer, when the temperature
is high and the mean wind speed low, even if the load is lower than in winter, as Table 6.6 shows it.
86
CHAPTER 6. APPLICATIONS
Figure 6.7: Total frequency of dangerous scenarios as a function of the mean wind speed.
Figure 6.8: Total frequency of dangerous scenarios as a function of the load.
Figure 6.9: Total frequency of dangerous scenarios as a function of the hour.
Season Level-I PRA Ind. method Mean load
freq. (/year) freq. (/year) (% of annual peak)
Winter 5.8× 10−3 5.1× 10−3 67.11
Spring 5.2× 10−3 4.4× 10−3 55.52
Summer 1.6× 10−2 4.4× 10−3 63.70
Fall 5.0× 10−3 4.2× 10−3 56.35
Table 6.6: Seasons’ importance (frequencies given are conditional frequencies per season).
6.2.3 Impact of vegetation height
To study the influence of the vegetation management policy on the risk of blackout, we will now
estimate the frequency of most frequent dangerous scenarios for different vegetation heights. In
87
CHAPTER 6. APPLICATIONS
Figure 6.10: Blackout Test System - Critical area (base case).
each case, the vegetation height is the same for all lines and all MC runs. These vegetation heights
are chosen such as to have the probabilities of having a short circuit with the ground in a normal
situation (no contingency) equal to 10−4 (high vegetation height), 10−5 (medium-high vegetation
height), 10−6 (medium-low vegetation height) and 10−7 (low vegetation height). The estimations
of the total frequency of dangerous scenarios are given in Table 6.7 (40 millions MC runs for each
vegetation height, which means that σ is less than 2% for each vegetation height). We observe
that the total frequency is converging to the total frequency given by the independent method, as
the vegetation height decreases (or the probability decreases). The four most frequent dangerous
scenarios for each vegetation height are given in Table 6.8. The “E*” (for Event) columns contain
the departure and arrival bus numbers of links that failed. “E0” is the initiating event. The most
frequent dangerous scenarios are very different between a high and a low vegetation height. When
the vegetation is high, scenarios with several events can appear with a high frequency because the
conditional probability to lose an additional link knowing that other links were lost is high. In the
opposite, this conditional probability is low when the vegetation height is low, or when thermal effects
are neglected. That is why only two-event scenarios appear in the four most frequent dangerous
scenarios for a probability of having a short circuit with the ground of 10−7. However, one scenario
(the cascading failure 58-59,57-58,62-65,65-66) stays important, even when the vegetation height
decreases. Our model also allows us to study the sensitivity of the two main areas (NETS and
Freq. (/yr) @10−4 Freq. (/yr) @10−5 Freq. (/yr) @10−6 Freq. (/yr) @10−7
2.2× 10−2 8.3× 10−3 5.4× 10−3 4.8× 10−3
Table 6.7: Estimations of the total frequency of dangerous scenarios for different vegetation heights.
NYPS) to the vegetation management policy through two hypotheses:
• High vegetation height for the NETS and low vegetation height for the NYPS (hypothesis H1).
• Low vegetation height for the NYPS and high vegetation height for the NYPS (hypothesis
H2).
The high vegetation height corresponds to the probability of having a short circuit with the ground
in a normal situation (no contingency) of 10−4 if this height is applied to the whole network (and not
only to the concerned area), and the low vegetation height to 10−7. The estimations of the total fre-
quency of dangerous scenarios for H1 and H2 are respectively 1.85×10−2/year and 6.23×10−3/year.
The four most frequent dangerous scenarios for these two hypotheses are given in Table 6.9. We can
deduce from these results that both areas are sensitive to thermal effects, but the NETS much more
88
CHAPTER 6. APPLICATIONS
E0 E1 E2 E3 Freq. @10−4 Freq. @10−5 Freq. @10−6 Freq. @10−7
(/yr) (/yr) (/yr) (/yr)
58-59 57-58 62-65 65-66 9.7× 10−3 2.4× 10−3 4.4× 10−4 6.9× 10−5
65-66 57-58 59-60 1.4× 10−3 2.4× 10−4 3.4× 10−5 < ×10−5
59-60 57-58 62-65 65-66 1.1× 10−3 1.6× 10−4 1.9× 10−5 < ×10−5
58-59 57-58 65-66 8.5× 10−4 1.9× 10−4 4.4× 10−5 1.9× 10−5
58-59 57-58 62-65 65-66 9.7× 10−3 2.4× 10−3 4.4× 10−4 6.9× 10−5
65-66 57-58 59-60 1.4× 10−3 2.4× 10−4 3.4× 10−5 < ×10−5
58-59 57-58 65-66 1.1× 10−3 1.6× 10−4 1.9× 10−5 < ×10−5
26-28 28-29 1.5× 10−4 1.6× 10−4 1.3× 10−4 1.4× 10−4
58-59 57-58 62-65 65-66 9.7× 10−3 2.4× 10−3 4.4× 10−4 6.9× 10−5
41-40 48-40 1.0× 10−4 1.0× 10−4 1.5× 10−4 1.6× 10−4
59-60 58-59 1.1× 10−4 1.3× 10−4 1.5× 10−4 1.5× 10−4
68-24 23-24 1.0× 10−4 1.3× 10−4 1.5× 10−4 1.3× 10−4
41-40 48-40 1.0× 10−4 1.0× 10−4 1.5× 10−4 1.6× 10−4
55-52 37-52 1.5× 10−4 1.3× 10−4 1.5× 10−4 1.5× 10−4
58-59 59-60 1.2× 10−4 1.5× 10−4 1.4× 10−4 1.5× 10−4
59-60 58-59 1.1× 10−4 1.3× 10−4 1.5× 10−4 1.5× 10−4
Table 6.8: Dangerous scenarios and their frequencies for different vegetation heights.
than the NYPS. The most frequent scenarios are more complex when the vegetation is high in the
NYPS. The criticality of the lines strongly depends on the vegetation height: the most critical lines
E0 E1 E2 E3 E4 E5 E6 Freq. - H1 (/yr) Freq. - H2 (/yr)
58-59 57-58 62-65 65-66 9.4× 10−3 < ×10−5
65-66 57-58 59-60 1.5× 10−3 < ×10−5
59-60 57-58 62-65 65-66 1.1× 10−3 < ×10−5
58-59 57-58 65-66 8.2× 10−4 < ×10−5
23-24 68-24 1.3× 10−3 1.8× 10−4
32-33 32-33’ 31-38 30-32 34-36 61-36 61-36’ < ×10−5 1.6× 10−4
59-60 58-59 1.1× 10−4 1.5× 10−4
32-33’ 32-33 31-38 30-32 34-36 61-36 61-36’ < ×10−5 1.5× 10−4
Table 6.9: Dangerous scenarios and their frequencies for different vegetation heights.
are very different for a high height and for a low height. We can see from Tables 6.10 and 6.11 that,
for a high vegetation height, line 57-58 is sensitive to the reorganization of the flows after another
trip, increases the thermal instability, but does not entail an electrical instability. On the contrary,
also for a high vegetation height, line 65-66 is sensitive to the reorganization of the flows, but entails
an electrical instability.
6.2.4 Impact of changes in generation
6.2.4.1 Cross-border power flows
The total frequency of dangerous scenarios for different mean cross-border power flows from NETS
to NYPS is shown in Figure 6.11 (40 millions MC runs for each point, which means that σ is less
than 2% for each point). Cross-border power flows are modified by decreasing the generation in one
zone (the power of each unit is decreased proportionally to its peak power in the base case) and
increasing it in the other (in the same way) by the same total amount. As shown in Table 6.1, the
89
CHAPTER 6. APPLICATIONS
Link V Fi @10−4 (%) V Fi @10−5 (%) V Fi @10−6 (%) V Fi @10−7 (%)
57-58 76.4 42.5 12.0 2.2
65-66 75.9 42.4 11.9 2.1
62-65 60.5 34.8 9.5 1.6
58-59 57.3 37.3 15.4 8.3
59-60 21.2 11.9 7.2 6.3
35-45 3.1 8.0 13.0 14.0
46-49 2.5 7.1 10.4 12.1
69-18 2.4 6.1 9.0 10.5
49-18 1.9 5.2 8.4 9.9
38-46 2.4 5.9 8.4 9.1
Table 6.10: Vesely-Fussel factors for different vegetation heights.
Link Li @10−4 (%) Li @10−5 (%) Li @10−6 (%) Li @10−7 (%)
65-66 54.7 32.9 9.4 1.8
33-34 9.1 3.6 <1 <1
59-60 7.0 4.8 3.2 3.1
34-36 2.8 1.0 <1 <1
58-59 2.1 2.2 3.3 3.4
46-49 1.5 3.8 6.2 7.1
17-43 1.7 3.9 5.9 6.5
35-45 1.2 3.7 4.8 5.2
69-18 1.1 3.0 4.5 5.2
50-51 1.1 2.7 4.3 4.4
Table 6.11: Lambert factors for different vegetation heights.
mean cross-border power flow from NETS to NYPS in the base case is 140 MW. The independent
method does not reveal a sensitivity of frequency to cross-border power flows. In the opposite case,
the dynamic level-I PRA method reveals an important sensitivity when the power flow goes from
NETS to NYPS, but not when the power flow goes from NYPS to NETS. This can be explained by
two factors. First, the superposition between local power flows and cross-border power flows induces
a non-symmetrical behavior for cross-border power flows: a flow from NYPS to NETS is opposed
to local flows and, consequently, it decreases the frequency of dangerous cascading scenarios in this
region when the flow from NYPS to NETS increases (until the two are equal and opposite). On
the contrary, when the mean power flow from NETS to NYPS grows, the frequency of dangerous
scenarios in the critical region revealed by the base case increases, as shown in Table 6.12. Secondly,
a second critical area appears between buses 30, 33 and 36 (NYPS), as the power flow from NYPS
to NETS increases, leading to the emergence of new dangerous scenarios, as shown in Table 6.13
and in Figure 6.12. As the two effects balance each other, the total frequency of dangerous scenarios
is nearly constant.
6.2.4.2 Installed wind power
The total frequency of dangerous scenarios for different installed wind powers4 is shown in Figure
6.13 (40 million MC runs for each point). Above 2000 MW, frequencies of dangerous scenarios
slightly increase. The absolute variation rate is nearly the same for both methods. These increases
are not due to specific scenarios, but are due to a global increase of all scenarios.
4The power installed in each wind farm is increased proportionally to the initial installed power.
90
CHAPTER 6. APPLICATIONS
Figure 6.11: Influence of cross-border power flows on the total frequency of dangerous scenarios.
E0 E1 E2 E3 Freq. (/yr)
58-59 57-58 62-65 65-66 5.2× 10−3
58-59 57-58 65-66 8.1× 10−4
59-60 57-58 62-65 65-66 7.7× 10−4
65-66 57-58 59-60 7.6× 10−4
Table 6.12: Most frequent dangerous scenarios for a mean power flow from NETS to NYPS of 398
MW
E0 E1 E2 E3 E5 Freq. (/yr)
58-59 57-58 62-65 65-66 6.5× 10−4
32-33 32-33’ 30-32 61-36 61-36’ 6.2× 10−4
Table 6.13: Most frequent dangerous scenarios for a mean power flow from NYPS to NETS of 195
MW
Figure 6.12: Critical area for a mean power flow from NYPS to NETS of 195 MW.
6.2.4.3 Definitive shut-down
We study here a definitive shutdown of all units of the same power plant. The lost generated power
can be compensated either in the same area, or by the other developed area (NETS or NYPS), or by
all areas. Figures 6.14 and 6.15 give the relative augmentation of the total frequency of dangerous
scenarios (40 million MC runs for each power plant). Surprisingly, in the dynamic level-I PRA
91
CHAPTER 6. APPLICATIONS
Figure 6.13: Influence of total installed wind power on the total frequency of dangerous scenarios.
approach, the shutdown of power plant 2 decreases this frequency. It can be explained by the
congestion revealed by the base case in the critical area between buses 2, 3 and 56: the shutdown of
this power plant decreases the production and consequently decreases the thermal cascading failure.
This is confirmed by Table 6.14: most frequent dangerous scenarios which were in the critical area
in the base case disappear from the top of the ranking. On the contrary, the shutdown of power
plants 5, 7, 8, 10 or 12 increases significantly the frequency when the lost power is compensated by
the NETS. Indeed, the frequency of dangerous scenarios in the critical area increases in these cases,
as shown in Table 6.15. To summarize the output of Figure 6.14, we can say that, in the dynamic
level-I approach, situations increasing the congestion in the critical area lead to a significant rise of
the total frequency of dangerous scenarios, and vice-versa. In the independent approach, variations
can be significant when the lost power is compensated only by one area, but does not have the same
behavior as in the dynamic level-I approach.
Figure 6.14: Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in
the NYPS (10,12) on the total frequency of dangerous scenarios - Dynamic level-I PRA.
6.2.4.4 Maintenance
This Subsection studies the impact of power plant maintenance on the risk of blackout. Figures
6.16 and 6.17 give the relative augmentation of the total frequency of dangerous scenarios for a
4-week maintenance of one unit in each NETS power plant, according to the season in which the
power plant is maintained (40 million MC runs for each power plant). The lost power is compensated
in the same area. In the dynamic level-I PRA approach, for the majority of them, a maintenance
in the summer increases significantly the frequency of dangerous scenarios and a maintenance in
92
CHAPTER 6. APPLICATIONS
Figure 6.15: Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in
the NYPS (10,12) on the total frequency of dangerous scenarios - Independent method.
E0 E1 Freq. (/yr)
23-24 68-24 1.6× 10−4
28-29 26-28 1.4× 10−4
39-44 39-45 1.4× 10−4
48-40 41-40 1.4× 10−4
53-52 37-52 1.4× 10−4
Table 6.14: Most frequent dangerous scenarios after shutdown of the power plant 2 (NETS) when
the lost power is compensated by all areas.
E0 E1 E2 E3 Freq. (/yr)
58-59 57-58 62-65 65-66 6.1× 10−3
59-60 57-58 62-65 65-66 1.1× 10−3
58-59 57-58 65-66 1.1× 10−3
65-66 57-58 59-60 7.7× 10−4
Table 6.15: Most frequent dangerous scenarios after shutdown of the power plant 12 (NYPS) when
the lost power is compensated by the NETS.
another season increases it slightly. However, the maintenance of an unit of power plant 2 or 3
decreases this frequency. As previously, it can be explained by the congestion in the critical area
between buses 2, 3 and 56: the maintenance decreases the production and consequently decreases
the thermal cascading failure. In the independent approach, variations are not significant.
6.3 Two-level blackout PRA
6.3.1 Test case: data and modeling assumptions
The test system used is shown in Figure 6.18. It is an adaptation of the Kundur’s Two-Area
System [14]. There are 8 power plants with a maximal power of 400 MW for each of them. The
peak load connected is 971 MW (and 100 MVAr) into bus 11 and 1787 MW (and 200 MVAr) into
bus 13. At peak load, the generated power is 350 MW in each power plant. As for the previous
example, the load is modulated along the day and the hour what is mentioned in the IEEE-RTS [71]
and reproduced in Appendix B. The same load factor is applied to each load and each power plant.
Overhead lines are protected with overcurrent and distance relays. There are under-frequency and
93
CHAPTER 6. APPLICATIONS
Figure 6.16: Impact of a four-week maintenance of one unit for each NETS power plant on the total
frequency of dangerous scenarios - Dynamic level-I PRA.
Figure 6.17: Impact of a four-week maintenance of one unit for each NETS power plan on the total
frequency of dangerous scenarios - Independent method.
under-voltage load shedding as system protection scheme. Generators are modeled by synchronous
machines equipped with IEEE-AC4A excitation systems, power system stabilizers and a gas turbine-
governor system. Power plants are protected with over-excitation, under-voltage, under-frequency,
over-frequency and loss-of-synchronism relays. Complete details are given in Appendix B.
Figure 6.18: Test system for a two-level blackout risk analysis.
For the level-I, some simplifications are adopted to reduce the complexity of the analysis, nearly
the same as for the previous example. We choose a unique vegetation height for all lines and all
MC runs. For the electrical instability of the system, we do not consider small-signal angular insta-
bility. Voltage instability is detected through the non-convergence of load-flow equations, frequency
94
CHAPTER 6. APPLICATIONS
instability through the steady-state frequency deviation, and transient angular instability through
the simulation of a simplified dynamic model5 during several seconds and static violation of overcur-
rent protections6. The models used for voltage stability, frequency stability and transient angular
instability transition criteria are described in Appendix C. We consider the system thermally stable
if there is no new contingency within 60 minutes. Average failure rates are taken as their nominal
values in nominal conditions. Initial conditions (load pattern and climatic conditions, sampled at
the beginning of each history) are kept constant during each MC run.
For the level-II, some simplifications are also adopted here to reduce the complexity of the analysis.
We consider that the setpoint of a relay is equal to its nominal value (i.e. setpoints are not distributed
according to a probabilistic law) and we neglect measurement errors. Power plant protections are
considered perfectly reliable. The on-demand failure probability of line protections and load shedding
relays are taken respectively to 10−2 and 10−1. The maximum time between events (transition or
relay failure) is limited to 8 seconds, which means that the system is considered to be electrically
stable if nothing new occurs within 8 seconds. The simulation of a DDET branch (see Subsection
5.5.3) is stopped when its probability goes under a threshold equal to 10−7 (cut-off probability).
The dynamic modeling of the loads7 can be crucial to give realistic results in case of voltage and/or
frequency instabilities. The dynamic behavior depends on the equipments behind the load (motors,
discharge lighting, electronics, ...). Then, it varies according to the consumer type (industrial areas,
residential areas, commercial areas, ...) and according to the season, the day and the hour. We
consider here a simplified model with 30% constant impedance and 70% constant power for both
loads at any time. However, in order to solve convergence problems, this constant power is simulated
through the re-computation of admittances at each time step according to the voltage at the previous
time step.
6.3.2 Level-I: results
The “most dangerous scenarios”, i.e. scenarios leading to electrical instability with the highest
frequency, are given in Table 6.16. These scenarios are very simple: they are all two-event scenarios,
which means that the second event is the “triggering event”, and they lead to a system splitting. We
must note that scenarios are grouped in this Table according to the sequence of occurring events, but
a large amount of different situations (characterized by different timings, different load/generation
patterns, different climatic conditions) are behind each sequence. The electrical instabilities triggered
by the last event are shown in Figure 6.19 for each type of level-I scenario. We should note that these
electrical instabilities are different from one type to another, but at each time, frequency instability
occurs.
Scenario type Initiating event Triggering event Frequency (/yr)
1 14-15 14-15’ 1.3× 10−3
2 9-10 9-10’ 1.2× 10−3
3 12-13 12-13’ 2.3× 10−4
4 11-12 11-12’ 2.3× 10−4
Table 6.16: Most frequent dangerous scenarios revealed by level-I blackout PRA. Each event is a
trip of a line after a permanent line fault. Each line is referred to the two buses it connects.
5A one-axis model for the synchronous machine, with the modeling of the excitation system, and constant-
impedance loads.6In case of voltage instability, this “overcurrent instability” is not checked since it is not relevant if load flow
iterations did not converge.7How the power consumption varies with the frequency and the voltage.
95
CHAPTER 6. APPLICATIONS
Figure 6.19: Electrical instabilities per type of level-I dangerous scenarios.
6.3.3 Clustering
In the present case, the complexity of the clustering problem is greatly reduced, since all loads
and generations are proportional to the load factor. We can then group level-I scenarios into clusters
according to only one variable, this load factor or the total load. We propose to use 10 intervals of
equal size between the minimum and the maximum loads for each type to serve as clusters. The
probability distribution of these 10 clusters per type of level-I dangerous scenarios is shown in Figure
6.20.
Figure 6.20: Probability of total load per type of level-I dangerous scenarios.
6.3.4 Level-II: results
The level-II results for each type of level-I scenarios according to the clusters in Figure 6.20 are
given in Tables 6.17, 6.18, 6.19 and 6.20. The column “Loss of power (MW)” gives the mean
loss of power supplied (either due to load shedding or a blackout) in MW, the columns “Area 1
BO probability” and “Area 2 BO probability” the probability to have a blackout respectively in
area 1 and in area 2 (including a total blackout) and the column “Area 1+2 BO probability” the
probability to have a total blackout. For low loads, blackout is always avoided, even in case of failure
of one or several load shedding relays. On the contrary, for high loads, a total blackout cannot be
avoided, even if all load shedding relays work perfectly. Between these two extreme cases, there are
transition loads for which a partial and/or a total blackout can occur with a probability lower than
1. These probabilities globally seem to be an increasing function of load, but not monotonously.
The transition between low loads and high loads is different for each level-I type of scenarios: for
types 1 and 3, it occurs between clusters 3 and 7, but for types 2 and 4, it occurs between clusters
96
CHAPTER 6. APPLICATIONS
6 and 9.
Cluster Loss of power Area 1 BO Area 2 BO Area 1+2 BO
# (MW) probability probability probability
1 144 0.0000 0.0000 0.0000
2 205 0.0000 0.0000 0.0000
3 289 0.0163 0.1175 0.0163
4 1155 0.0000 0.9997 0.0000
5 1330 0.0059 0.9997 0.0059
6 1659 0.2789 1.0000 0.2789
7 2120 0.9999 1.0000 0.9999
8 2302 1.0000 1.0000 1.0000
9 2485 1.0000 1.0000 1.0000
10 2667 1.0000 1.0000 1.0000
Table 6.17: Level-II results by clusters for level-I type 1 (as denoted in Table 6.16) scenarios.
Cluster Loss of power Area 1 BO Area 2 BO Area 1+2 BO
# (MW) probability probability probability
1 142 0.0000 0.0000 0.0000
2 182 0.0000 0.0000 0.0000
3 236 0.0000 0.0000 0.0000
4 296 0.0000 0.0000 0.0000
5 340 0.0000 0.0000 0.0000
6 391 0.0000 0.0000 0.0000
7 465 0.0007 0.0009 0.0007
8 586 0.0199 0.0361 0.0195
9 2475 1.0000 0.9880 0.9880
10 2667 1.0000 1.0000 1.0000
Table 6.18: Level-II results by clusters for level-I type 2 (as denoted in Table 6.16) scenarios.
Cluster Loss of power Area 1 BO Area 2 BO Area 1+2 BO
# (MW) probability probability probability
1 121 0.0000 0.0000 0.0000
2 256 0.0000 0.0000 0.0000
3 324 0.0000 0.0279 0.0000
4 583 0.0004 0.2704 0.0001
5 1307 0.0026 0.9997 0.0026
6 1505 0.0644 0.9997 0.0644
7 1927 0.7268 1.0000 0.7268
8 2203 1.0000 1.0000 1.0000
9 2371 1.0000 1.0000 1.0000
10 2538 1.0000 1.0000 1.0000
Table 6.19: Level-II results by clusters for level-I type 3 (as denoted in Table 6.16) scenarios.
The five branches with the highest risk (product of the probability by the loss of supplied power)
of the DET for cluster 3 of level-I type 1 scenarios are depicted in Figure 6.21. The voltages at buses
97
CHAPTER 6. APPLICATIONS
Cluster Loss of power Area 1 BO Area 2 BO Area 1+2 BO
# (MW) probability probability probability
1 90 0.0000 0.0000 0.0000
2 220 0.0000 0.0000 0.0000
3 244 0.0000 0.0000 0.0000
4 294 0.0000 0.0000 0.0000
5 374 0.0000 0.0000 0.0000
6 436 0.0027 0.0000 0.0000
7 834 0.6721 0.0000 0.0000
8 1033 0.9776 0.0000 0.0000
9 1123 1.0000 0.0000 0.0000
10 2517 1.0000 1.0000 1.0000
Table 6.20: Level-II results by clusters for level-I type 4 (as denoted in Table 6.16) scenarios.
9-15 for the top scenario and for the bottom scenario are given respectively in Figures 6.22 and 6.23.
In both cases, power plants 5 and 6 are isolated and trip after some seconds (loss of synchronism
and over-excitation) at the beginning of the fast cascade. The example 1 corresponds to the scenario
where all relays work perfectly. Thanks to several load shedding steps, a partial or a total blackout
can be avoided. On the contrary, a load shedding relay failure at the beginning of the example 2
entails a partial blackout in area 2.
Figure 6.21: DET main branches for type 1 scenarios, cluster 3. A relay action is represented by a
vertical transition. If the relay fails, the branch continues horizontally. The flags “Line x− y trip”,
“PP x trip”, “LS x” and “BO x” indicate respectively that the transition is due to the trip of the
line between buses x and y, the trip of the power plant x, a load shedding at bus x or the notification
of a blackout state at bus x.
6.3.5 First two levels
From the combination of the first two levels, we can compute the total risk of the loss of power
supplied per year and the frequency of a blackout or major load shedding. Table 6.21 gives the
overall risk and the contribution of each level-I type of scenarios. Two main observations emerge
from the comparison between this Table and Table 6.16. First, two level-I types of scenarios with
98
CHAPTER 6. APPLICATIONS
Figure 6.22: Voltage evolution for type 1 scenarios, cluster 3, example 1. No relay fails and no
element (except power plants 5 and 6) is lost. Even if oscillations occur, the voltages are stabilized
quickly between 0.9 and 1.0 pu thanks to several load shedding steps. A blackout is avoided.
Figure 6.23: Voltage evolution for type 1 scenarios, cluster 3, example 2. A load shedding relay
failure entails very low voltage and high currents, such that distance relays operating in zone 2
disconnect the lines between buses 12 and 13. Over-current relays then trip lines between buses 13
and 14, leading to a BO in area 2.
a similar frequency can induce very different risks and blackout frequencies. Secondly, even if the
level-I type 3 scenarios have a frequency one order of magnitude below level-I type 2 scenarios, the
blackout frequencies in area 1 are nearly the same for these two types. Therefore, it seems not
relevant to rank scenarios only according to the frequency given by level-I PRA, since consequences
can be very different from one type to another. The distribution of the loss of supplied power for
these four level-I types of scenarios is given in Figure 6.24.
6.4 Level-I blackout PRA efficiency
The algorithm efficiency for the results presented in Section 6.2 is a strong limitation to its
application to larger grids: it requires approximately 4.7 ms per MC run and only approximately
99
CHAPTER 6. APPLICATIONS
Type Risk Area 1 BO Area 2 BO Area 1+2 BO
(MW/year) frequency (/yr) frequency (/yr) frequency (/yr)
1 2.537 9.74×10−4 1.21×10−3 9.74×10−4
2 0.832 1.40×10−4 1.44×10−4 1.39×10−4
3 0.264 5.95×10−5 1.36×10−4 5.94×10−5
4 0.121 5.60×10−5 5.19×10−6 5.19×10−6
Total 3.754 1.23×10−3 1.50×10−3 1.18×10−3
Table 6.21: Risk and frequency of blackout.
Figure 6.24: Distribution of the loss of supplied power.
1 MC run out of 16000 leads to a dangerous scenario and therefore contributes to the statistics.
The time per MC run can be easily improved by using optimized tools instead of a simple Gaussian
elimination routine for the load flow iterations. By using UMFPACK (unsymmetric multifrontal
sparse LU factorization method) [77] which relies on sparse matrices, the time per MC run is reduced
to 1.85 ms. This Section focuses on the increase of the number of MC runs participating in the
statistics, using variance reduction techniques presented in 5.3.7. As these techniques could imply
not only the reduction of the variance, but also the increasing of the time per MC run (i.e. if more
events are simulated per MC run), the global efficiency is characterized by the merit figure defined
in Section 3.3. Two techniques were proposed: favoring failures during the cascade by forcing them
to occur before a time limit and favoring thermal failures by biasing weather conditions sampling.
Subsection 6.4.1 focuses only on the first one by applying it to the independent simulation algorithm
(i.e. same algorithm, but neglecting thermal failures) in order to avoid the specific problem of thermal
failures of overhead lines. Subsection 6.4.2 combines then these two techniques to the dependent
simulation algorithm developed in this PhD thesis.
6.4.1 Independent simulation algorithm
We showed in 5.3.7 that the maximum sampling time T should be greater than the time limit Tmused in the simulation algorithm (equal to 1 hour for results presented in this Chapter). We define
the biasing time factor α as
α =T
Tm. (6.8)
This Subsection studies the simulation efficiency for α ≥ 1 and for four cut-off weights8, pC =
10−4, 10−3, 10−2, 10−1. The mean times per MC run, the sample variances and the figures of merit
8The biasing technique is applied only if the current weight of the MC run is higher than the cut-off weight.
100
CHAPTER 6. APPLICATIONS
are shown in Figures 6.25, 6.26, and 6.27, respectively. They are compared to the characteristics
of the unbiased simulation. For α < 10, even if the figure of merit is higher in some cases than for
the unbiased case, it can also be strongly lower. Indeed, some MC runs can get a high weight, as
explained in Subsection 5.3.7, and then induce a high variance. On the contrary, for α > 10, the
figure of merit is higher than the unbiased case. It is stabilized for all cut-off probabilities for α ≥ 25
to values ten to thirty times higher than the unbiased one. Therefore, favoring failures during the
cascade by forcing them to occur before a time limit allows to strongly improve the efficiency of an
independent simulation algorithm. We should also note that the sensitivity to the precise values of
the biasing time factor α and the cut-off probability pC is low for 25 ≤ α ≤ 100.
Figure 6.25: Mean times per MC run - biased independent simulations.
Figure 6.26: Sample variances - biased independent simulations.
6.4.2 Dependent simulation algorithm
This Subsection first studies the impact of favoring failures by forcing them to occur before a
time limit on the dependent simulation efficiency for α ≥ 1 and for four cut-off weights, pC =
10−4, 10−3, 10−2, 10−1. The mean times per MC run, the sample variances and the figures of merit
are shown in Figures 6.28, 6.29, and 6.30, respectively. The efficiency is improved only for α ≥ 100,
and the gain is then limited to several tens of percents. The efficiency is deteriorated for smaller
values of α, especially when the cut-off weight is low. Indeed, the simulation time per MC run is
increased in these cases, while the variance is not strongly reduced. The small gain for the variance
101
CHAPTER 6. APPLICATIONS
Figure 6.27: Figures of merit - biased independent simulations.
can be explained by cascading failures entirely due to thermal failures of overhead lines: in these
cases, the final weight is not reduced and equal to 1.
Figure 6.28: Mean times per MC run - dependent simulations with biased transition times.
Figure 6.29: Sample variances - dependent simulations with biased transition times.
102
CHAPTER 6. APPLICATIONS
Figure 6.30: Figures of merit - dependent simulations with biased transition times.
Therefore, it is necessary to increase the number of cascading failures entirely due to thermal
failures of overhead lines while reducing their weight by favoring thermal failures by biasing weather
conditions sampling. The definition of biased probability distributions is complex because the num-
ber of dangerous histories must be significantly increased while the weight of dangerous histories
must be controlled (to not deteriorate the variance). In order to keep a bounded weight, we propose
to divide the sampling interval into subintervals and to apply in each subinterval the same pdf as
the unbiased one, but with a scale factor Ei (different for each subinterval). Obviously, these scale
factors must be chosen so that a well-defined pdf is kept. The weight is simply given by the inverse
of the scale factor in the sampled subinterval. We propose to divide the sampling interval into nIsubinterval with the same unbiased probability. In this case, the sum of the scale factors must be
equal to nI so that a well-defined pdf is kept. If we want to favor high values of the random variable
sampled, the scale factor has to increase with the random variable values. Different simple laws can
then be used for the scale factor, for example a linear law with a scale factor given by
Ei =2i
nI + 1(6.9)
for the subinterval i, or a quadratic law with a scale factor given by
Ei =6i2
(nI + 1)(2nI + 1). (6.10)
This concept is illustrated in Figure 6.31 for two subintervals. This technique can be simply applied
Figure 6.31: Biased normal law, with nI = 2.
to the ambient temperature to favor high values, since a unique temperature is sampled for the
103
CHAPTER 6. APPLICATIONS
entire network. However, it is a bit more complex for wind speeds, since several correlated random
variables are used. To avoid the uncontrolled effect of the Copula density, we propose to apply this
technique directly to the n initial independent standard normal distributions Z = [Z1, ..., Zn] in the
joint normal distribution method described in Subsubsection 6.2.1.2. Moreover, if the correlations
between wind speeds are high, we can apply this biasing technique only for the first random variable
Z1 in order to limit the weight variability. If we want to favor thermal failures, the biasing must
favor low wind speeds.
If we use pC = 10−1, α = 200, four subintervals with a linear law for the temperature and four
subintervals with a quadratic law for the wind speed, we can reach a figure of merit equal to 2.674
ms−1 (time per MC run and sample variance: 2.40 ms and 1.56×10−5) which corresponds to an
improvement by a factor 3, compared to an unbiased simulation. Even if this gain is significant, it
is not as high as for the independent simulation.
6.5 Conclusions
We first applied a simplified level-I dynamic PRA methodology to a test system in order to study
the impact of several changes in the electric grid, such as variation of vegetation height, cross-border
power flows, wind generation penetration, maintenance and shut-down of power plants. Even if the
modeling adopted for the vegetation height does not reflect perfectly the reality, we showed that
thermal effects can play an important role in cascading failure, during the first phase (the slow cas-
cade). It was well-known that only dependencies between events could explain statistical properties
of blackouts which occurred regularly, and we showed in this PhD thesis an approach to simulat-
ing and estimating the impact of dependent thermal failures. A comparison with a methodology
neglecting these thermal failures showed that not only the overall frequency of level-I dangerous sce-
narios is not the same if thermal effects are taken into account or not, but the same conclusion holds
for their ranking according to their respective frequencies. Moreover, conclusions on the impact of
changes in the electric grid on the risk of blackout can be strongly different according to whether an
independent analysis is performed or a dynamic level-I PRA analysis.
We applied then a two-level blackout PRA to a small test system in order to study in a coupled
way the two phases of a cascading failure. As the level I is needed to have an estimation of the
frequency of dangerous scenarios and the level II for their magnitudes in terms of loss of supplied
power (due to load shedding or blackout), the coupling between these two levels can lead to an
estimation of the triplets scenario,frequency,magnitude for the scenarios leading to an undesirable
situation. We showed that the level-II analysis after that level-I is necessary to have an estimation
of the loss of supplied power that a scenario can lead to.
Finally, we applied biasing methodologies to improve the efficiency of the level-I. We showed that
the variance linked to independent failures can be strongly reduced by favoring failures during the
cascade by forcing them to occur before a time limit. The variance linked to thermal failures of
overhead lines is more difficult to reduce. However, we can favor them by biasing weather conditions
sampling. The combination of the two techniques can lead to a efficiency gain equal to 3 (in terms of
figure of merit). This result must be combined to the computing time reduction obtained by using
more efficient solution algorithm for the load-flow equations.
104
Chapter 7
Perspectives
7.1 Introduction
A lot of open questions remain to reach a satisfactory 3-level blackout PRA. We propose in this
Chapter to enlighten only few of them, which seem to us the most complex pending issues. Sections
7.2, 7.4, 7.3, 7.5, 7.6 and 7.7 discuss the modeling of operators actions, the integration of protec-
tion systems failures, the modeling of electrical instabilities, the dynamic modeling of loads, the
development of the level-III and the application to real grids, respectively. We could add to this
list the integration of other cascading failure mechanisms like common mode failures in the level-I,
the simulation of time-varying conditions (load, weather conditions) during the slow cascade, the
development of the level-II using professional software for dynamic simulation, ...
7.2 Operators’ actions
We saw in Chapter 6 that the operators’ corrective actions are only considered for the moment
through a time limit after each event to continue the simulation. Indeed, we considered the system
thermally stable if there is no contingency for 60 minutes. It is obviously a too simple way to take
into account operators actions. They can be very important during the slow cascade to eliminate
possible overloads, to return to the initial international exchange program and to put back the system
in N − 1 security. Wrong actions can also lead to a fast cascade, as observed in the major system
perturbation in Europe in 2006. Transmission system operators have typically several possibilities:
busbars coupling or de-coupling, modification of the active and/or reactive power generated in
power plants (indirectly), connection or disconnection of capacitor banks. As described in Chapter
4, the traditional way to model operators’ corrective actions is to perform an OPF at each step
of the cascading failure simulation (e.g. with a minimization of the load shedding, inspired by
adequacy study methodologies). The possibility of overloaded lines tripping before corrective actions
is modeled through a line tripping probability (this probability can be a function of the line loading).
However, we are not convinced that it is a realistic modeling for a main reason: an OPF can lead to
a situation completely different from the initial one which is not in concordance with the idea that
the operators take only a few set of actions in such a situation. Moreover, such a model is not able
to consider partial corrective actions which are taken, but are insufficient to avoid other line trips,
such in Italy in 2003. These partial corrective actions can be important for the next development of
the cascading outage (especially the fast cascade). The purpose of such an OPF is not to re-compute
a steady-state to continue the cascade simulation, but to evaluate consequences, in the same way as
in adequacy studies.
105
CHAPTER 7. PERSPECTIVES
If an OPF is not convenient, a satisfactory modeling of operators’ corrective actions is still an open
question. The framework presented in this PhD thesis allows to consider a set of corrective actions
with a probability distribution of their respective action times (e.g. a busbar coupling within an
action time described by a Weibull random variable with a mean equal to 15 minutes). An example
of a simple model considering corrective actions can be found in Appendix D. The methodology
to determine what action operators can take in a specific situation (and their characteristic times)
should be developed by consulting real transmission system operators.
7.3 Electrical instability
We saw that the cascading failure is ruled by the electrical transient instead of the thermal transient
when the system becomes electrically unstable. Consequently, after each event, the electrical stability
must be assessed in order to switch to the fast cascade simulation when it is necessary. For results
presented in Chapter 6, we implemented
• A test of transient angular instability through a simplified dynamic simulation on several
seconds (only for the small test system),
• A test of frequency stability through the steady-state value of the frequency deviation after
primary regulation,
• A test of voltage stability through the convergence of the load flow iterations,
• A test to check if all the (steady-state) currents are under the setpoints of overcurrent protec-
tions.
These tests did not account for the small-disturbance angular instability and are thus not perfect.
The validity of the proposed simplified dynamic simulation over the time period considered should
be investigated, including the way the synchronous machine is modeled (the impact of ignoring its
saliency and the model order) and power plant systems are taken into account. It is not really the
steady-state value of the frequency deviation after primary regulation which should be considered
in the frequency stability test, but the extreme frequencies endured during the primary regulation
transient. A simplified model for the turbine-governor system can lead to a quick approximation of
these extreme frequencies [78, 79]. The non-convergence of the load flow iterations with the basis
method used (Newton-Raphson) does not necessarily imply a voltage instability. Other ways to
solve these equations should be tested before ending the level-I to enter the level-II in this case. A
fast but reliable method to test the small-disturbance angular instability should be developed and
implemented (equivalent to finding on which side of the imaginary axis is the rightest eigenvalue of
the linearized system).
7.4 Protection systems failures
There are mainly two types of protection system failures [52]:
1. Unwanted trips:
(a) Spontaneous trips: a healthy line can be tripped erroneously and spontaneously (not due
to a grid fault or a switching event) due to the failure of its protection system.
(b) Unselective trips (trips due to “hidden failures”): a healthy line can be tripped erroneously
after a grid fault due to the failure of its protection system.
2. Missing trips: a faulted line could not be tripped in due time, due to the failure of its protection
system.
106
CHAPTER 7. PERSPECTIVES
Due to unwanted unselective and missing trips, a line fault can induce the loss of several lines.
Moreover, missing trips can cause the fault being cleared after the critical clearing time and, thus,
stability problems. Unwanted unselective and missing trips were implied in several past blackouts.
We can cite in particular:
• Southwestern Public Service Company System Disturbance - April 16, 1996 [22]. A fault
occurred and was cleared in 5 cycles (no missing trip). A 230 kV bus backup relay (zone 3)
saw the fault and operated after 1.27 seconds because the timer did not drop out after the
fault was cleared (unselective trip). All breakers on the 230 kV bus controlled by this backup
relay opened due to this relay mis-operation. This misoperation removed a power plant and
two major lines. It entailed a fast cascade (voltage collapse).
• Western Interconnection (WSCC) System Disturbances - July 2-3, 1996 [22]. A protection
system removed a healthy line (the same on July 2 and July 3) after a fault due to misoperation
of a local delay timer in the ground element of a relay (unselective trip).
• WSCC Disturbance - July 2, 1996. A protection system opened a healthy line after a fault
due to misoperation of a zone 3 relay (faulty phase-to-phase impedance element, unselective
trip) [22]. This failure entailed a fast cascade.
• Croatia blackout - January 12, 2003 [80]. One pole of a circuit breaker did not trip a faulted line
(missing trip). This missing trip entailed a fast cascade (angular instability and unsymmetrical
conditions).
Protection system failures can thus play an important role in cascading failures.
The idea that hidden failures (unwanted unselective trips) can lead a simple event to a widespread
outage was introduced in the 90’s [81, 25, 82]. Only protections which have the fault in their
“vulnerability region” can trip lines due to hidden failures. This problem of hidden failures has been
used in numerous papers to simulate cascading failures: after a fault on a line, protections which
have this line in their vulnerability region can trip lines due to hidden failures. If an additional
line is trip due to a hidden failure, protections which have this line in their vulnerability region can
again trip lines due to hidden failures, etc... However, this approach appears to us to be incorrect:
the dynamic electrical behavior of a fault followed by a line trip is not the same as the dynamic
electrical behavior of only a line trip. For example, hidden failures can lead distance relays to
incorrectly trip elements in zone 3 because the apparent impedance goes inside the zone 3 due to
a fault. This is in general not the case if we have only a line trip (or it can be possible according
to the electrical transient, but probably with a low likelihood). It is probably due to the confusion
between an unwanted trip due to a grid fault and a hidden failure, and an correct trip of a line
on zone 3 due to low apparent impedance without a grid fault. Cascading outages due to hidden
failures are sometimes integrated in simulations considering also other cascading outages schemes.
In particular, the Manchester model integrates hidden failures in a one-level blackout PRA, as well
as other failure mechanisms, as described in Subsection 4.4.2.
The probabilities to have missing trips and their consequences where studied in [83, 51, 84, 52].
After a fault, dynamic simulations are performed for the different branches of the event tree generated
by considering different failures that could occur in the protection system (including failures of auto-
reclosing relay). If the fault is not cleared after the “normal” time delay, dynamic instability can be
induced, as well as the loss of other lines (due to distance relays operating in zone 2 or zone 3).
During the slow cascade, protection systems failures can lead to the loss of additional elements
after a grid fault and induce transient instability. The different timings that could occur have been
carefully studied in the case of missing trips, but are not considered in works studying the impact
107
CHAPTER 7. PERSPECTIVES
of unselective trips. The temporal aspect of hidden failures should be studied and both missing and
unselective trips should be integrated in our two-level blackout PRA.
7.5 Load modeling
An important problem for the level-II analysis is the dynamic load modeling. The chosen load
model should be sufficiently realistic, while guaranteeing a convergence of the dynamic simulation at
each time step. This requirement of convergence seems to be specific to our blackout PRA approach.
Indeed, when a non-convergence situation occurs in a dynamic simulation in other contexts where
the purpose is not to evaluate the loss of load, it is simply classified as voltage collapse. The 2003
Swedish/Danish blackout showed that low voltages can induce a grid splitting before a blackout
(due to distance relays working in zone 3). Therefore, as the purpose of the level-II analysis is to
estimate consequences in terms of loss of load, it is crucial to have an accurate estimation of the
electrical variables at each time step. If the network does not converge at one or several time steps,
the obtained estimation is not reliable.
A complete review of load models can be found in [15, 16]. The simplest model is a decomposition
of loads in three fractions: fraction of constant active/reactive impedance a1/b1, fraction of constant
active/reactive current a2/b2 and fraction of constant active/reactive power a3/b3,
P (t) = P0
[a1
(V (t)
V0
)2
+ a2
(V (t)
V0
)+ a3
], (7.1)
and
Q(t) = Q0
[b1
(V (t)
V0
)2
+ b2
(V (t)
V0
)+ b3
], (7.2)
where V0 is the reference voltage (pre-disturbance voltage), P0/Q0 the reference (pre-disturbance)
active/reactive power, V (t) the actual voltage and P (t)/Q(t) the actual active/reactive power. It is
called the ZIP load model (impedance-current-power). It requires only two independent parameters
for active power (a1 +a2 +a3 = 1) and two independent parameters for reactive power (b1 +b2 +b3 =
1). A linear frequency dependency can be simply added to this model with a multiplicative term,
P (t) = P0
[a1
(V (t)
V0
)2
+ a2
(V (t)
V0
)+ a3
]× [1 + cf (f(t)− f0)], (7.3)
where f0 is the reference (pre-disturbance) frequency (in general the nominal frequency), f(t) the
actual frequency and cf the frequency dependence coefficient. However, this ZIP model is not
convenient to represent loads in case of extreme voltage decrease, as it could occur in cascading
failures leading to blackout, as it is assuming an instantaneous equilibrium for each load. Moreover,
the convergence is guaranteed only for a purely constant impedance model. Another common analog
model is the exponential load model where the active/reactive power is proportional to the voltage
raise to the power α/β,
P (t) = P0
(V (t)
V0
)α, (7.4)
and
Q(t) = Q0
(V (t)
V0
)β. (7.5)
It suffers from the same limitations as those of the ZIP model. Composite load models consider
that each load is an assembly of different load types: induction motors, discharge lighting, constant
power, constant inductance and constant impedance (see for example [85]). However, it is again
a static load modeling for dynamic simulation. On the contrary, Hill in [86] and Karlsson in [87]
108
CHAPTER 7. PERSPECTIVES
presented a simple time-dependent model, initially to represent the load tap changers and other
control devices which act to restore the load. Different forms of the differential equation describing
the total load exist, but the two main are the additive load model and the multiplicative load
model. They are based on a static load behavior (load behavior when the steady-state is reached)
and a transient load behavior (“instantaneous” load behavior) through steady-state load functions
Ps(V )/Qs(V ) and transient load functions Pt(V )/Qt(V ), respectively. In the additive load model,
the load characteristic is written as [15]
P = Pt(V ) + P0zP (7.6)
Q = Qt(V ) +Q0zQ (7.7)
where zP and zQ are load state variables, driven by the differential equations
TP zP = −zP +1
P0[Ps(V )− Pt(V )], (7.8)
TQzQ = −zQ +1
Q0[Qs(V )−Qt(V )], (7.9)
where TP and TQ are the time constants. When the system is in its steady-state before the distur-
bance, V = V0 and thus
zP =1
P0[Ps(V0)− Pt(V0)] = 0. (7.10)
The instantaneous load behavior corresponds then well to the transient load behavior (e.g. constant
impedance). However, as soon as zP 6= 0, a fraction of the instantaneous load behavior corresponds
to the steady-state load behavior (e.g. constant power), which can introduce nonphysical singularity
problems in the response of the system. In the multiplicative load model, the load characteristic is
written as [15]
P = zPPt(V ) (7.11)
Q = zQQt(V ) (7.12)
where zP and zQ are load state variables, driven by the differential equations
TP zP =1
P0[Ps(V )− zPPt(V )], (7.13)
TQzQ =1
Q0[Qs(V )− zQQt(V )], (7.14)
where TP and TQ are the time constants. When the system is in its steady-state before the distur-
bance, V = V0 and thus
zP =Ps(V0)
Pt(V0)= 1. (7.15)
The instantaneous load behavior corresponds then well to the transient load behavior (e.g. constant
impedance). Moreover, even if zP 6= 1, the instantaneous load behavior continues to correspond
to this transient load behavior. When the transient load behavior is constant impedance, this
multiplicative load model guarantees the convergence of the dynamic simulation at each time step.
The realism of such a dynamic load model should therefore be investigated, as well as typical values
of parameters. If this realism is satisfying, these models can be used in level-II simulations.
7.6 Level-III
The purpose of this PhD thesis was not to study the restoration process and to develop a modeling
for its PRA (level-III blackout PRA). Nevertheless, this level-III is necessary to have the final
109
CHAPTER 7. PERSPECTIVES
consequence estimation, in terms of energy not supplied. Due to the complexity of the restoration
process, and if the purpose is only to associate a risk measure to each level-I/level-II scenario, it is
probably more feasible to use a “bulk” estimation of the power restored as a function of time, than
to simulate the restoration. A simple estimation of the load restored as a function of time based
on previous blackouts/major system disturbances is given in [88]. A distinction should be made
between partial load shedding, partial blackout and total blackout.
7.7 Application to real grids
Beside previous challenges, several difficulties are present to apply the proposed approach to real
grids. The level-I requires a lot of different parameters, especially for overhead lines, which are not
directly available. A way to reduce this number of parameters should be investigated. By using
directly a critical temperature instead of using a critical sag (function of the vegetation height),
mechanical parameters can be eliminated. Thermal parameters could probably be combined into
a small set of characteristic values permitting to compute quickly steady-state temperature and
thermal time constants when the current, the ambient temperature and the wind speed are known.
The huge computing time needed for the level-I is another limitation. The development of specific
techniques inspired by what has been done for particle transport problems (e.g. neutron transport
problems in nuclear engineering) [89] should improve the required computing time. In particular,
the technique of stratified sampling (or quota sampling) could be applied. This technique divides
the Γ domain of initial conditions into J sub-domains Γj such that
J⋃j=1
Γj = Γ, (7.16)
and
Γi ∪ Γj = 0 (7.17)
if i 6= j. The number of samples to be taken from each subdomain is selected to obtain a near-
minimum variance (idea of importance sampling). In particular, regions of large variances should
be sampled more frequently.
The possibility of having a dynamic simulation including a complete set of relevant protections
for the level-II should also be investigated.
110
Conclusions
In our society, private and industrial activities increasingly rest on the implicit assumption that
electricity is available at any time and at an affordable price. Even if operational data and feedback
from the electrical sector is very positive, a residual risk of blackout or undesired load shedding in
critical zones remains. Previous blackouts showed that, despite their low occurrence, their contribu-
tions to mean reliability indices are very important. Moreover, the occurrence of such a situation is
likely to entail major direct and indirect economical consequences, as observed in recent blackouts.
Assessing this residual risk and identifying scenarios likely to lead to these feared situations is crucial
to control and optimally reduce this risk of blackout or major system disturbance. The objective of
my PhD thesis was to develop a methodology able to reveal scenarios leading to a blackout or a ma-
jor system disturbance and to estimate their frequencies and their consequences with a satisfactory
accuracy.
A blackout is a collapse of the electrical grid on a large area, leading to a power cutoff, and is
due to cascading failure. Based on the analysis of past blackouts and major system disturbances,
we showed that the typical development of a cascading failure leading to a blackout can be split
in two phases. Following the occurrence of an initial perturbation (initiating(s) event(s): the loss
of one or several elements), two possibilities arise. If this perturbation causes the simultaneous
loss of several elements, the N − 1 rule no longer holds and the system can become electrically
unstable (the initiating events are also the triggering events) if the system is not in security N − 2
or N − 3. A fast collapse of the electrical grid can then start. But, in most cases, thanks to
the N − 1 rule, the grid stays electrically stable after the initiating event. A competition then
starts between operators corrective actions and possible additional failures, either due to thermal
effects or independent. This phase is called slow cascade (or steady-state progression), because it
displays characteristic times between successive events ranging from tens of seconds to hours. The
occurrence of additional events during this phase can trigger (after the triggering event) an electrical
instability (violation of protections set points, angular instability, etc.). Then a second phase called
fast cascade (or high-speed cascade) occurs, ruled by electrical transients, displaying characteristic
times between successive events ranging from milliseconds to tens of seconds. This phase is too fast
to allow operators to take corrective actions and is characterized by a rapid succession of electrical
events (additional failures, protection actions, etc.) whose occurrence order and timing are driven
by the power system dynamic evolution in the course of this transient. After this fast cascade, the
electrical grid reaches a stable state: a possible collapse of the power system in some zones, or a
major load shedding. Once a blackout or a major load shedding occurred, the recovery period, which
might last for several hours to several days, can be viewed as an additional (and last) phase.
Several security studies were developed to estimate the risk of cascading failures. They are mainly
based on an unique global approach which tries to cover all thermal and electrical phenomena leading
to additional contingencies in one model (one-level PRA). However, as the electric state of the grid
is computed in a purely static way after each event, they do not consider correctly the fast cascade
(one-level blackout PRA). Few methods based on dynamic PRA were developed to take into account
111
CONCLUSIONS
interactions between the electrical grid state (electrical variables) and failure events. However, these
methods are not able to take into account successive line failures (failures due to thermal effects or
independent failures). Therefore, none of these methods are able to treat the entire cascade leading
to a blackout. Thus, there was a need to develop such an approach, to model the entire cascade as
realistically as possible.
We proposed in this PhD thesis such a new methodology to reveal cascading scenarios leading to
a blackout (or a major system disturbance) in a power system and to estimate their frequencies and
their consequences. This methodology was adapted from dynamic PRA, initially developed for the
nuclear sector, and is able to consider interactions between failure rates (or failure probabilities) and
process variables. We suggested to divide the analysis in three levels (as in the nuclear sector, even
if physical phenomena are obviously completely different): the slow cascade, the fast cascade and
the restoration. We developed the methodology mainly for the level-I (the slow cascade) in order
to estimate frequencies of cascading failures leading to an electrical instability. In particular, we
developed an analog Monte Carlo simulation and biasing techniques to improve its efficiency. We
proposed to use clustering techniques as in the nuclear sector to group scenarios at the end of the
level-I to enter the level-II. We started also the development of this methodology for the level-II,
which can be based on DET techniques.
We applied this method on two test systems. We applied only the level-I on the larger test system
through Monte Carlo simulation and we studied several variants (vegetation height, changes in the
generation pattern), each time in comparison with a similar approach, but neglecting dependencies
between events. This example showed that our method can reveal dangerous scenarios neglected
or underestimated by independent methods because they do not take into account the increase of
failure rates in stress conditions. The importance of specific links in cascading failures can also be
misleadingly estimated by independent methods. In other words, we showed that thermal effects can
play an important role in cascading failure, during the first phase. We applied a two-level approach
on a smaller test system. It showed in particular that the level-II analysis after the level-I is necessary
to have an estimation of the loss of supplied power that a scenario can lead to: two level-I types of a
scenario with a similar frequency can induce very different risks (in terms of loss of supplied power)
and blackout frequencies. The level-III is however needed to have an estimation of the risk in terms
of loss of supplied energy and blackout duration. We applied also biasing techniques to the level-I
which led to improving the simulation efficiency by a factor 3.
The proposed approach should be viewed more as a general framework than as a close methodology.
In particular, it should be improved in order to consider operators’ corrective actions, all kinds of
electrical instabilities, the restoration, ... The problem of dynamic load modeling, as well as dynamic
simulation with a complete set of protections, seem to be specific for the level-II and should be studied
to compute the loss of supplied load in a realistic way. In order to scale up applications to real grids,
the efficiency of the simulation should be improved more and the set of parameters to estimate
should be reduced.
112
Appendix A
Failure rate of underground cables
A.1 Introduction
Components used in real systems endure time-variable solicitations. Loading and other stresses
(temperature, voltage, current...) may be varying in time. Moreover, their resistance may also be
varying in time. For example, material properties may be degrading. These time-variant conditions
impact the reliability of a component, which is in general defined as its ability to perform its required
functions under stated conditions for a specified period of time. The impact of different working
conditions is in general evaluated through tests (like accelerated tests), but with conditions kept
constant during each test. Failure rates can then be evaluated for a large range of conditions through
Arrhenius or Erying laws [90]. However, these failure rates may only be used in quasi steady-state
situations (slow variation of the conditions). In accidental situations, conditions can quickly change,
implying a significant change in the value of failure rates. For example, during the slow cascade
of a cascading failure leading to a blackout, dielectric insulation of underground cables can endure
a progressive temperature increase due to the abrupt increase of Joule losses. But the dielectric
strength of the insulator decreases as the temperature increases. The failure rate of these cables will
then significantly increase during such a cascading failure. In order to have a good estimation of
the frequency of cascading failures leading to a blackout, a good approximation of the failure rate
increase is necessary.
Reliability analysis approaches for time-variant reliability problems were developed to consider
the time dependency of stresses and strengths. In particular, the PHI2 method is based on the
outcrossing rate and allows solving these problems using classical time-invariant reliability tools
such as First Order Reliability Method (FORM) [91]. The PHI2 method gives an upper bound
and a lower bound on the cumulated distribution function (cdf) of the time of failure, based on the
computation of an outcrossing rate which is not directly linked to the failure rate. In the literature,
confusion persists between outcrossing rate and failure rate.
The first objective of this Appendix is the establishment of exact and approximate links between
outcrossing rate and failure rate. The second objective is the development of a hybrid method
based on the PHI2 model and accelerated tests in order to compute the failure rate of a component
submitted to time-variable stresses and strengths. The developed approach is applied to a power
underground cable with a variable temperature applied to the insulator. Consequently, the next
Section presents the state of the art on both the PHI2 method and the modeling usually adopted
for power cables’ failure. We discuss next the links between outcrossing rate and failure rate. Then,
the above mentioned hybrid methodology and the results are presented. Finally, some conclusions
are drawn.
113
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
A.2 State of the art
A.2.1 PHI2 method
In time-variant reliability problems, we are interested in the evolution in time of random variables.
For instance, loading, other stress and resistance parameters can be viewed as random variables
which can evolve with time. We are then interested in random processes, or stochastic processes. If
ω designates the outcome (or the realization) of the random variable, with all possible outcomes of
the random variable being gathered on the sample space Ω, and t the time, a stochastic process Pis defined by a collection of random variables P = P (t, ω), t ∈ T where T designates the set of
times (discrete or continuous). In the sequel of this Appendix, we will only consider continuous sets
of times and we will denote a stochastic process simply by P (, ω). Consequently, for any instant
t0, P (t0, ω) ≡ Pt0(ω) is a random variable. Conversely, a realization (or trajectory) of the random
process is obtained by fixing the outcome to ω0 and is denoted using small letters by P (t, ω0) ≡ pω0(t).
The PHI2 method is based on the approach of the limit state: the failure of a component occurs
when a limit state surface is crossed. The simplest example is the stress/strength approach. If we
denote by S the stress and by R the strength, the limit state is defined by R − S = 0 and a failure
occurs as soon as S > R: the limit state surface is crossed. In time-variant reliability problems, both
stress and resistance should be considered as stochastic processes. So, we denote them respectively
as R(t, ω) and S(t, ω). The limit state function associated with this problem is then
G(t, R(t, ω), S(t, ω)) = R(t, ω)− S(t, ω) (A.1)
where positive values correspond to the safe domain and negative values to the failure domain. In
a general way, we can have several stresses and several strengths and a complex limit state function
combining these stochastic processes. Let us then denote by X(t, ω) the vector of stochastic processes
describing the randomness in the problem under consideration (both stresses and strengths) and by
G(t, X(t, ω) the limit state function.
The failure of the component within interval [0, t] is then represented by the event
E = ∃τ ∈ [0, t]|G(τ, X(τ, ω)) ≤ 0. (A.2)
The cumulative failure probability Pf,c(0, t) of the component within interval [0, t] is defined by
Pf,c(0, t) = Pr(E) = Pr[∃τ ∈ [0, t]|G(τ, X(τ, ω)) ≤ 0]. (A.3)
If we suppose that the component is initially in service, this failure probability can be viewed as the
cdf of the failure time. We can also define the instantaneous probability to be in the failure domain
at time t, Pf,i(t), as
Pf,i(t) = Pr[G(t, X(t, ω)) ≤ 0]. (A.4)
This probability is in general called simply instantaneous failure probability, but this name is ambigu-
ous: this quantity represents only the probability to be in the failure domain at a precise moment.
Since the failure of a component occurs at the first time the limit state is crossed, the physical
meaning of this probability is fuzzy. The outcrossing rate ν(t) is defined as the following limit:
ν(t) = lim∆t→0
Pr[G(t, X(t, ω)) > 0 ∩ G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0]∆t
. (A.5)
The quantity ν(t)∆t is then the probability to be in the safe domain at instant t and in the failure
domain at instant t+ ∆t (or the probability to cross the limit state surface from the safe domain to
114
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
the failure domain between t and t+ ∆t). From this outcrossing rate, we can obtain bounds for the
cumulative failure probability [92]:
maxτ∈[0,t]
Pf,i(τ) ≤ Pf,c(0, t) ≤ Pf,i(0) +
∫ t
0
ν(τ)dτ. (A.6)
The reliability index β(t) is defined as the algebraic distance of the design point (point of the failure
domain closest to the origin in the standard normal space) to the origin, counted as positive if the
origin is in the safe domain, or negative in the other case. The FORM approximation leads to the
following expression of the reliability index:
β(t) = −Φ−1(Pf,i(t)), (A.7)
where Φ(x) is the normal cdf.
The basis of the PHI2 method is to approximate the outcrossing rate using a FORM approximation
both for Pr[G(t, X(t, ω)) > 0] and Pr[G(t + δt, X(t + ∆t, ω)) ≤ 0]. This leads to the following
expression [92]:
ν(t) = lim∆t→0
Φ2(β(t),−β(t+ ∆t); ρ(t, t+ ∆t))
∆t(A.8)
where Φ2 is the binormal cdf and ρ(t, t + ∆t) is the correlation coefficient between the two events
G(t, X(t, ω)) > 0 and G(t + δt, X(t + ∆t, ω)) ≤ 0. This expression is developed in [91] for a
specific case:
• The limit state function is given by equation (A.1),
• The strength can be expressed as
R(ω, t) = R(ω) + f(t), (A.9)
where R(ω) is a normal random variable (mean value µR, standard deviation σR) and f(t) is
a deterministic function (deterministic change of the resistance),
• The stress S(t, ω) is a stationary normal random process (mean value µS , standard deviation
σS), with an autocorrelation coefficient function ρS(t) given by
ρS(t) = exp
[−(t
λ
)2], (A.10)
where λ is the correlation length (or correlation time).
The instantaneous failure probability is then given by
Pf,i(t) = Φ
(− µR + f(t)− µS√
σ2R + σ2
S
)= 1− Φ
(µR + f(t)− µS√
σ2R + σ2
S
). (A.11)
The outcrossing rate can then be computed analytically by
ν(t) = ω0Ψ
(f ′(t)
ω0σS
)σS√
σ2R + σ2
S
ϕ
(µR + f(t)− µS√
σ2R + σ2
S
)(A.12)
where ϕ(x) is the normal probability distribution function, Ψ(x) = ϕ(x)− xΦ(x) and the cycle rate
ω0 is defined by
ω20 = −ρ′′S(0). (A.13)
Therefore, the cycle rate represents the variation speed of the stress. In particular, if the stress
autocorrelation coefficient function is given by the equation (A.10), the cycle rate is given by ω0 =√2/λ.
115
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
A.2.2 The Weibull law for power cables
The main failure mode for cables is dielectric breakdown. There are two dominant types of cables
used nowadays: oil-filled cables and extruded isolation cables (EPR, XLPE). For the oil-filled cables,
the literature reports no modification of dielectric strength with temperature, but only an accelerated
aging. Consequently, the failure rate in temporary overload conditions will not significantly change.
Contrarily, experimental studies show a reduction of the dielectric strength with temperature for
extruded isolation cables [59]. The two-dimensional Weibull distribution is generally used to model
the distribution of the lifetime of cables [60]. Therefore, the cdf of the failure time Tf of a cable
subject to a dielectric stress E can be written as
FTf (tf ) = Pr[Tf ≤ tf ] = 1− exp
[−(τ(tf )
t0
)a(E
E0
)b], (A.14)
where t0, a and b are constants depending on material and cable dimensions, and E0 is the stress
leading to a nominal breakdown probability. In other words, E0 can be viewed as the dielectric
strength. τ(t) is the effective age of the cable at the calendar time t (accelerated aging in overload
conditions). In nominal conditions, dτ/dt = 1. Parameter is usually high, between 8 and 12 [60].
The value of parameter is in general near 1, but increases during the cable’s life (going from a < 1
to a > 1). In reality, there is a superposition of several Weibull laws with a change in the value of
parameter a [60, 61]:
• The first law (a < 1) models the infant mortality (first part of the bathtub curve),
• The second law (a ≈ 1) models the useful life (second part of the bathtub curve),
• The third law (a > 2) models the end of life wear-out (last part of the bathtub curve).
The literature reports [59] a decrease of the dielectric strength with temperature, as shown in Figure
A.1.
Figure A.1: Dielectric strength as a function of temperature. From [59].
The failure rate is defined as
λ(tf ) = lim∆t→0
Pr[tf < Tf ≤ tf + ∆t|Tf ≥ tf ]
∆t. (A.15)
This failure rate is therefore linked to the cdf by
λ(t) =F ′(t)
1− F (t). (A.16)
116
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
If the temperature T of the cable is constant, the failure rate in stationary conditions at calendar
time t and temperature T in stationary conditions can then be written as
λ(t, T ) = λref [τ(t)]
(E0(Tref )
E0(T )
)b(A.17)
by using equations (A.14) and (A.16), where λref [τ(t)] is the failure rate at the reference temperature
Tref and age τ(t). We should note that a failure rate in non-stationary conditions cannot be deduced
from (A.14). Indeed, in non-stationary conditions, there is no guarantee that the equation (A.14) is
a monotonically increasing function of time, which obviously means that we cannot use this function
as a cdf when the electric strength varies with time.
A.3 Proposed modeling
A.3.1 Failure rate and outcrossing rate
The outcrossing rate and the failure rate introduced previously are two different quantities which
are not equal in a general case. However, in the literature, confusion persists between outcrossing
rate and failure rate. The aim of this section is therefore to discuss exact and approximate links
between outcrossing rate and failure rate.
The failure rate (A.15) can also be defined with the limit state function by
λ(t) = lim∆t→0
Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]∆t
(A.18)
From this expression, we can deduce an upper bound on the failure rate in function of the outcrossing
rate from the following bound:
Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]
=Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0 ∩ G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]
Pr[G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]
≤ Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0 ∩ G(t, X(t, ω)) > 0]Pr[G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]
,
(A.19)
because
G(t, X(t, ω) > 0 ⊆ G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]. (A.20)
Then,
λ(t) ≤ lim∆t→0
Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0 ∩ G(t, X(t, ω)) > 0]Pr[G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]∆t
=ν(t)
1− Pf,c(0, t). (A.21)
We cannot deduce exactly the failure rate from the outcrossing rate. However, we suggest here to
use as a first approximation
Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]≈ Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(t, X(t, ω)) > 0],
(A.22)
which means that the probability to cross the limit state surface from the safe domain to the failure
domain between t and t + ∆t does not depend on all the past of the trajectory. In particular, it is
the case for reliable components, as in the critical working states method [93], which means that
Pf,c(0, t) << 1. (A.23)
117
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
This is a sufficient but not necessarily condition. From this approximation, we can write a relation
between the failure rate and the outcrossing rate:
λ(t) ≈ ν(t)
1− Pf,i(t)(A.24)
We should note that this approximation respects the inequality (A.21).
In particular, we can deduce an equality exact for a constant failure rate because, in this case,
λ(t) = λ(0) = lim∆t→0
Pr[G(∆t, X(∆t, ω)) ≤ 0|G(0, X(0, ω) > 0]∆t
(A.25)
and
Pr[G(∆t, X(∆t, ω)) ≤ 0|G(0, X(0, ω)) > 0] =Pr[G(∆t, X(∆t, ω)) ≤ 0 ∩ G(0, X(0, ω)) > 0]
Pr[G(0, X(0, ω)) > 0],
(A.26)
so
λ ≡ λ(0) =ν(0)
1− Pf,i(0). (A.27)
Furthermore, if we are in the case of stationary time-variant reliability problems, which are based
on the following assumptions:
• The random processes X(t, ω) are stationary processes,
• There is no direct time dependence in the limit state function, i.e. it can be formally written
as G(X(t, ω)),
we have ν(t) ≡ ν and Pf,i(t) ≡ Pf,i (constant values), but also
λ(t) = lim∆t→0
Pr[G(X(t+ ∆t, ω)) ≤ 0|G(X(τ, ω)) > 0∀τ ∈ [0, t]]∆t
= lim∆t→0
Pr[G(X(∆t, ω)) ≤ 0|G(X(τ, ω)) > 0∀τ ∈ [−t, 0]]∆t
= lim∆t→0
Pr[G(X(∆t, ω)) ≤ 0|G(X(0, ω)) > 0]∆t
= λ(0) ≡ λ
(A.28)
because we suppose that the component is initially in service. Consequently, if we have stationary
processes for both stress and strength, the outcrossing rate, the instantaneous probability to be in
the failure domain and the failure rate are constant and relation (A.24) is exact. In particular, if the
instantaneous probability to be in the failure domain is very small (Pf,i << 1), which is the case in
reliable systems, we can use the approximation λ ≈ ν.
For a case where the stresses and/or the strengths are not stationary processes, the quality of
the approximation (A.24) must be evaluated. This can be done through Monte Carlo simulations,
where a strategy to generate trajectories of the stochastic processes has to be selected. The usual
approach is based on the random process discretization, i.e. its representation by a finite set of
random variables, as explained in [92].
A.3.2 Methodology
Our hybrid methodology is based on the complementarities between the PHI2 model and the
accelerated tests in order to compute the failure rate of a component submitted to time-variable
stresses and strengths. Indeed, the PHI2 model is based on a set of parameters difficult to estimate,
but it can give the outcrossing rate (and an approximation of the failure rate) for any kind of transient
118
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
when these parameters are known. Conversely, accelerated tests give directly the failure rate at any
temperature in stationary conditions, but we cannot easily deduce from these tests the failure rate
in transient conditions. So, the general idea of our methodology is to “mix” both approaches in
order to compute the failure rate in transient conditions.
If we use the approximation (A.24) for the failure rate, the expression (A.12) for the outcrossing
rate and the expression (A.11) for the instantaneous probability to be in the failure domain, we get
λ(t) ≈ ω0Ψ
(f ′(t)
ω0σS
)σS√
σ2R + σ2
S
ϕ
(µR + f(t)− µS√
σ2R + σ2
S
)1
Φ(µR+f(t)−µS√
σ2R+σ2
S
) . (A.29)
If we suppose that the mean of the strength µR varies with temperature T , we can rewrite this
equation as
λ(T (t)) ≈ ω0σS√
σ2R + σ2
S
ϕ
(µR(T (t))− µS√
σ2R + σ2
S
)1
Φ(µR(T (t))−µS√
σ2R+σ2
S
)Ψ
(1
ω0σS
dµRdT
(T (t))T ′(t)
). (A.30)
When temperature T is constant, the failure rate in stationary conditions is given by
λ(T () ≈ ω0σS√
σ2R + σ2
S
ϕ
(µR(T )− µS√σ2R + σ2
S
)1
Φ(µR(T )−µS√
σ2R+σ2
S
) 1√2π. (A.31)
We can note that we have to multiply the stationary failure rate by the (acceleration) factor
√2πΨ
(1
ω0σS
dµRdT
(T (t))T ′(t)
)(A.32)
in order to obtain the non-stationary failure rate. Function√
2πΨ(x) is represented in Figure A.2.
This factor is greater than 1 if x < 0, which is the case when T ′(t) > 0 (temperature increase)
because µ′R < 0, and lower than 1 in the opposite case. It simply means that a temperature increase
contributes to go from the safe domain to the failure domain, and a temperature decrease to go from
the failure domain to the safe domain.
Figure A.2: Acceleration factor.
In previous expressions, we have several unknowns: ω0, µR(T ) − µS , σR and σS . We propose
to determine these parameters by fitting the stationary failure rate computed on these parameters
(A.31) to the stationary failure rate given by (A.17), for several temperatures in the range of interest.
This fitting can be done through a least square estimation. Once parameters are determined, the
non-stationary failure rate can be computed by multiplying the stationary failure rate by the factor
(A.32).
119
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
A.3.3 Results
We apply the methodology for the range [20C,120C] with a computation of the failure rate made
degree by degree. We chose a reference failure rate of 0.1/year at 20C and a parameter b = 10.
The variation of the dielectric strength E0(T ) in equation (A.17) is given in Figure 5.4. The fitting
is very good (see Figure A.3): the mean error between the failure rates given by (A.17) and by 32
respectively, is 1.9E-7/year. Parameters obtained by the least square method are given in Table A.1
and Figure A.4. We can note that the dielectric strength E0(T ) given by tests could not be the same
as the strength µR(T ) used in the PHI2 model: in the first case the decrease with temperature is
linear (Figure 5.4) and in the second case the decrease is not linear (Figure A.4). As an example,
Figure A.3: Failure rate as a function of temperature in stationary conditions.
ω0 [/hour] σR [a.u.] σS [a.u.]
7.66E-2 0.681 0.466
Table A.1: Parameters of the PHI2 method.
Figure A.4: Failure rate as a function of temperature in stationary conditions.
we propose to compute the failure rates given by the stationary approximation and our estimation
(acceleration factor (A.32)) for a typical case in cascading failure in power system. After the loss of
an element, the current in power cables can have a prompt jump and the temperature will increase
with time. Consider a cable, with the following properties:
120
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
• The current before the perturbation is Ii and the stationary temperature corresponding to this
current is Ti,
• The temperature of the cable just before the perturbation is equal to Ti,
• The current after the perturbation is If and the stationary temperature corresponding to this
current is Tf
• The temperature transient is ruled by the law
T (t) = Tf − (Tf − Ti) exp(−t/θ) (A.33)
where θ is the thermal time constant.
Figure A.5: Stationary and non-stationary failure rates for the test case (increasing temperature).
Figure A.5 compares the stationary approximation and our estimation for an initial temperature
Ti = 60C, a final temperature Tf = 120C and a thermal time constant θ = 3 hours. We observe
that the stationary approximation strongly underestimates the failure rate during the beginning of
the transient. Indeed, the argument of the acceleration factor is proportional to
T ′(t) =Tf − Ti
θexp(−t/θ) (A.34)
which is the largest in the beginning of the transient. Figure A.6 compares also these failure rates,
but in the opposite case, where the initial temperature Ti = 120C, and final temperature Tf = 60C.
In this case, the stationary approximation overestimates the failure rates.
In order to estimate the quality of the stationary approximation for a specific case, we can observe
that the acceleration factor√
2πΨ(x) ≈ 1 for |x| << 1 and√
2πΨ(x) >> 1 for |x| >> 1. Therefore,
if 1ω0σS
µ′R(T (t))T ′(t) << 1 during the whole transient, the stationary approximation should not be
used. We can evaluate the maximum value of the argument of the acceleration factor by
1
ω0σS
∆µR∆T
∆T
∆t=
∆µRω0σSθ
. (A.35)
In other words, if
θ >>∆µRω0σS
, (A.36)
the stationary approximation is a good approximation, as shown in Figure A.7, which compares
the stationary approximation and our estimation for an initial temperature Ti = 60C, a final
temperature Tf = 120C and a thermal time constant θ = 100 hours with θ >> ∆µRω0σS
≈ 22.4 hours.
121
APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES
Figure A.6: Stationary and non-stationary failure rates for the test case (decreasing temperature).
Figure A.7: Stationary and non-stationary failure rates for a slow transient.
A.4 Conclusions
We proposed in this Appendix a hybrid methodology able to give an approximation of failure
rates for components enduring transient conditions. This methodology uses the PHI2 modeling and
data from accelerated tests conducted under stationary conditions. In a general case, an exact link
was established between the outcrossing rate obtained from the PHI2 method and the failure rate
obtained from accelerated tests. Consequently, our methodology is based on a hypothesis whose
validity should be checked by benchmarks (e.g. Monte Carlo simulations) for different test cases.
We showed that the difference between the failure rate in stationary conditions and in transient
conditions is proportional to an acceleration factor. The parameters appearing in this factor can
be found by fitting the failure rate found by accelerated tests to the failure rate found by the PHI2
method. We applied this methodology to a test case, which was a high voltage underground cable
enduring a temperature transient. We showed that the fitting gave good results and a significant
difference between the stationary approximation and our estimation can appear. We proposed a
simple criterion in order to know if the stationary approximation is acceptable or not.
122
Appendix B
Test systems
B.1 Level-I test system
B.1.1 Introduction
To apply blackout PRA level-I to a test system, this one should include following data: classical data
for the resolution of load-flow equations (bus types, active and reactive power generation and load
at each bus, resistance, reactance, line charging, tap ratio for each line), simplified dynamic machine
data (according to models used for electrical stability assessment), thermal and mechanical data of
overhead power lines (length, section, suspension height, distance between pylons, thermal capacity
and weight per unit length, modulus of elasticity, coefficient of thermal expansion), thermal data of
transformers, thermal data of cables, reliability data, ... To have a test system near real electrical
grids, the basis states of the system should be also N − 1 secure. A standard test system with all
these characteristics doesn’t yet exist, but we can adapt a existing one to include consistent data1
The original test system is 68-buses and 87-links modeling the transport network of the North East
of US (see for example [94] for original data), developed in the 70’s by Dick Schulz (General Electric).
It is composed by two developed areas modeling New England (NETS) and New York (NYPS) and
three neighboring areas (Ontario, Michigan, Pennsylvania) are approximated by equivalent generator
models. This Appendix explains the main modifications applied to this network and presents final
data.
Figure B.1: 68-buses, 16-machine, 5-area test system.
1For example, overhead lines’ geometric data (length, section) have to be consistent with electrical data (resistance,
reactance, line charging).
123
APPENDIX B. TEST SYSTEMS
B.1.2 Voltage and power basis
The power base is 100 MVA. The test network is based on a real network whose the voltage is
mainly 345 kV, so the majority of buses are at 345 kV. However, some buses are at 500 kV.
B.1.3 Lines, cables and transformers
Overhead lines’ data are taken from [95]. For 345 kV lines, the reference is the line Watertown-
Sioux City (Western Area Power Administration). The pylons are the 3L2 type, as shown in Figure
B.2 and the conductors are ACSR 45/7 type, 2 per phase. For 500 kV lines, the reference is the line
Ashe-Hanford (Bonneville Power Administration). The pylons are the 5L2 type, as shown in Figure
B.2 and the conductors are ACSR 84/19 type, 2 per phase.
Figure B.2: 3L2 and 5L2 structures. From [95].
The voltage of cables is only 345 kV. We choose XLPE cables 400/230 kV of Brugg Cables with
a copper conductor cross-section of 630 mm2, in flat formation.
Electrical parameters of transformers are not modified, but thermal parameters are taken from
IEEE/ANSI C57.115-1991, appendix C.
B.1.4 Modifications
Total resistance of lines and cables are kept, and impedance and line charging are modified ac-
cording to characteristics of chosen elements. A bus 69 is inserted between buses 50 and 18 to have
a separation between the 345 kV network and the 500 kV network. To have a N − 1 secure network
and to respect operational constraints (current limits on links), some links are doubled, FACTS
controllers are included to produce reactive power and the voltage of specific generators is reduced.
The adapted network is shown on figure B.3.
B.1.5 Data
B.1.5.1 Power plants data
Power plants data are given in Table B.1. Since the transient stability was not assessed for this
test system, corresponding data are not given. Generation data are given for the peak load.
B.1.5.2 Bus data
Main bus data are given in Table B.2. Generation data and power flow data are given for the
peak load. The type is equal to 1 for the swing bus, to 2 for PV buses and to 3 for PQ buses. The
124
APPENDIX B. TEST SYSTEMS
Figure B.3: Blackout test system.
# Bus Power Maximum Damping coefficient Regulation factor Failure rate Inertia
(pu) power (pu) D (pu) 1/R (pu) (/year) constant (s)
1 1 2.5 4 10 20 2 30
2 2 2.725 3 10 20 2 30
3 2 2.725 3 10 20 2 30
4 3 3.25 4 10 20 2 30
5 3 3.25 4 10 20 2 30
6 4 3.16 4 10 20 2 30
7 4 3.16 4 10 20 2 30
8 5 2.525 3 10 20 2 30
9 5 2.525 3 10 20 2 30
10 6 3.5 4 10 20 2 30
11 6 3.5 4 10 20 2 30
12 7 2.8 3 10 20 2 30
13 7 2.8 3 10 20 2 30
14 8 2.7 3 10 20 2 30
15 8 2.7 3 10 20 2 30
16 9 4 5 10 20 2 30
17 9 4 5 10 20 2 30
18 10 2.5 3 10 20 2 30
19 10 2.5 3 10 20 2 30
20 11 4 5 10 20 2 30
21 11 4 5 10 20 2 30
22 12 2.5 3 10 20 2 30
23 12 2.5 3 10 20 2 30
24 13 7.86 9 10 20 2 30
25 13 7.86 9 10 20 2 30
26 14 15 18 10 20 0 30
27 15 10 12 10 20 0 30
28 16 25 30 10 20 0 30
Table B.1: Power plants data.
conductance and the susceptance shunt are equal to zero for all buses. The minimum bus voltage is
0.9 pu and the maximum bus voltage 1.1 pu.
125
APPENDIX B. TEST SYSTEMS
# Type V (pu) θ () Pg (pu) Qg (pu) Pl (pu) Ql (pu) Qming (pu) Qmaxg (pu) Vrated (kV)
1 2 1.0455 -6.853 2.500 1.475 0.000 0.000 -10.00 16.00 13.8
2 2 0.9800 -5.711 5.450 2.575 0.000 0.000 -10.00 16.00 13.8
3 2 0.9830 -3.333 6.500 1.862 0.000 0.000 -10.00 16.00 13.8
4 2 0.9970 1.586 6.320 0.713 0.000 0.000 -10.00 16.00 13.8
5 2 1.0110 -3.009 5.050 1.585 0.000 0.000 -10.00 16.00 13.8
6 2 1.0500 -1.337 7.000 1.981 0.000 0.000 -10.00 16.00 13.8
7 2 1.0630 -1.902 5.600 0.987 0.000 0.000 -10.00 16.00 13.8
8 2 1.0300 -0.701 5.400 -0.068 0.000 0.000 -10.00 16.00 13.8
9 2 1.0250 2.792 8.000 0.093 0.000 0.000 -10.00 16.00 13.8
10 2 1.0000 -6.385 5.000 -1.847 0.000 0.000 -10.00 16.00 13.8
11 2 1.0000 -3.799 8.000 -1.778 0.000 0.000 -10.00 16.00 13.8
12 2 1.0000 -4.775 5.000 -0.407 0.000 0.000 -10.00 16.00 13.8
13 1 1.0000 0.000 15.700 0.905 0.000 0.000 -10.00 16.00 13.8
14 2 1.0000 -5.734 15.000 1.400 0.000 0.000 -10.00 16.00 13.8
15 2 1.0000 -14.093 10.000 2.597 0.000 0.000 -10.00 16.00 13.8
16 2 1.0000 -14.998 25.000 2.489 0.000 0.000 -10.00 16.00 13.8
17 3 0.9986 -6.767 0.000 0.000 11.500 2.500 0.00 0.00 345
18 3 0.9954 -19.320 0.000 0.000 24.700 1.230 0.00 0.00 345
19 3 1.0555 -3.620 0.000 0.000 0.000 0.000 0.00 0.00 345
20 3 0.9994 -5.148 0.000 0.000 6.800 1.030 0.00 0.00 345
21 3 1.0487 -5.535 0.000 0.000 2.740 1.150 0.00 0.00 345
22 3 1.0571 -4.092 0.000 0.000 0.000 0.000 0.00 0.00 345
23 3 1.0562 -4.041 0.000 0.000 2.480 0.850 0.00 0.00 345
24 3 1.0459 -7.397 0.000 0.000 3.090 -0.920 0.00 0.00 345
25 3 1.0513 -2.888 0.000 0.000 2.240 0.470 0.00 0.00 345
26 3 1.0442 -5.884 0.000 0.000 1.390 0.170 0.00 0.00 345
27 3 1.0351 -8.422 0.000 0.000 2.810 0.760 0.00 0.00 345
28 3 1.0433 -2.956 0.000 0.000 2.060 0.280 0.00 0.00 345
29 3 1.0457 -0.481 0.000 0.000 2.840 0.270 0.00 0.00 345
30 3 1.0219 -9.021 0.000 0.000 0.000 0.000 0.00 0.00 345
31 3 1.0141 -8.515 0.000 0.000 0.000 0.000 0.00 0.00 345
32 3 1.0143 -7.200 0.000 0.000 0.000 0.000 0.00 0.00 345
33 3 1.0183 -8.714 0.000 0.000 1.120 0.000 0.00 0.00 345
34 3 1.0300 -11.638 0.000 0.000 0.000 0.000 0.00 0.00 345
35 2 1.0100 -16.576 0.000 2.505 0.000 0.000 -3.00 6.00 500
36 3 1.0033 -6.920 0.000 0.000 1.020 -0.195 0.00 0.00 345
37 3 1.0393 -8.285 0.000 0.000 0.000 0.000 0.00 0.00 345
38 3 1.0137 -10.311 0.000 0.000 0.000 0.000 0.00 0.00 345
39 3 1.0128 -24.842 0.000 0.000 2.670 0.126 0.00 0.00 345
40 3 1.0392 -12.510 0.000 0.000 0.656 0.235 0.00 0.00 345
41 3 0.9982 -7.026 0.000 0.000 10.000 2.500 0.00 0.00 345
42 3 0.9962 -14.956 0.000 0.000 11.500 2.500 0.00 0.00 345
43 3 0.9932 -9.398 0.000 0.000 0.000 0.000 0.00 0.00 345
44 3 1.0137 -24.086 0.000 0.000 2.676 0.048 0.00 0.00 500
45 3 1.0155 -23.566 0.000 0.000 2.080 0.210 0.00 0.00 500
46 3 1.0048 -14.873 0.000 0.000 1.507 0.285 0.00 0.00 345
47 3 1.0373 -12.448 0.000 0.000 2.031 0.326 0.00 0.00 345
48 2 1.0500 -13.524 0.000 1.438 2.412 0.022 -3.00 6.00 345
49 3 1.0043 -17.101 0.000 0.000 1.640 0.290 0.00 0.00 345
50 2 1.0139 -24.227 0.000 0.298 1.000 1.470 -3.00 6.00 500
51 3 1.0134 -25.068 0.000 0.000 3.370 1.220 0.00 0.00 500
52 3 1.0372 -9.139 0.000 0.000 1.580 0.300 0.00 0.00 345
53 3 1.0266 -9.875 0.000 0.000 2.527 1.186 0.00 0.00 345
54 3 1.0555 -7.838 0.000 0.000 0.000 0.000 0.00 0.00 345
55 3 1.0378 -9.568 0.000 0.000 3.220 0.020 0.00 0.00 345
56 3 1.0225 -9.590 0.000 0.000 5.000 1.840 0.00 0.00 345
57 3 1.0247 -8.686 0.000 0.000 0.000 0.000 0.00 0.00 345
58 3 1.0279 -8.184 0.000 0.000 0.000 0.000 0.00 0.00 345
59 3 1.0167 -9.452 0.000 0.000 2.340 0.840 0.00 0.00 345
60 3 1.0135 -9.806 0.000 0.000 5.220 1.770 0.00 0.00 345
61 3 1.0102 -8.604 0.000 0.000 1.040 1.250 0.00 0.00 345
62 3 1.0372 -6.254 0.000 0.000 0.000 0.000 0.00 0.00 345
63 3 1.0328 -6.950 0.000 0.000 0.000 0.000 0.00 0.00 345
64 3 1.0266 -6.952 0.000 0.000 0.090 0.880 0.00 0.00 345
65 3 1.0333 -6.914 0.000 0.000 0.000 0.000 0.00 0.00 345
66 3 1.0282 -8.398 0.000 0.000 0.000 0.000 0.00 0.00 345
67 3 1.0278 -8.688 0.000 0.000 3.200 1.530 0.00 0.00 345
68 3 1.0425 -7.356 0.000 0.000 3.290 0.320 0.00 0.00 345
69 3 0.9959 -21.335 0.000 0.000 1.000 1.470 0.00 0.00 500
Table B.2: Bus Data.
126
APPENDIX B. TEST SYSTEMS
B.1.5.3 Load data
The basic annual peak load for the test system is 13484 MW. The load is modulated along the
day and the hour according to load factors given in the IEEE-RTS [71], and reproduced here. Table
B.3 gives data on weekly peak loads in percentage of the annual peak load, with the week 1 taken
as the first week of January (winter peaking system). Table B.4 gives a daily peak load cycle, in
percentage of the weekly peak. Table B.5 gives weekday and weekend hourly load models for each
of four seasons. The seasons used here are not completely the same as the meteorological seasons,
since the winter goes from week 1 to week 8 and to week 44 to week 52, the spring goes from week
9 to 17, the summer from week 18 to 30 and the fall from week 31 to 43.
Week Peak load Week Peak load Week Peak load Week Peak load
1 86.2 14 75.0 27 75.5 40 72.4
2 90.0 15 72.1 28 81.6 41 74.3
3 87.8 16 80.0 29 80.1 42 74.4
4 83.4 17 75.4 30 88.0 43 80.0
5 88.0 18 83.7 31 72.2 44 88.1
6 84.1 19 87.0 32 77.6 45 88.5
7 83.2 20 88.0 33 80.0 46 90.9
8 80.6 21 85.6 34 72.9 47 94.0
9 74.0 22 81.1 35 72.6 48 89.0
10 73.7 23 90.0 36 70.5 49 94.2
11 71.5 24 88.7 37 78.0 50 97.0
12 72.7 25 89.6 38 69.5 51 100.0
13 70.4 26 86.1 39 72.4 52 95.2
Table B.3: Weekly peak load in percentage of annual peak.
Day Peak load
Monday 93
Tuesday 100
Wednesday 98
Thursday 96
Friday 94
Saturday 77
Sunday 75
Table B.4: Daily peak load in percentage of weakly peak.
B.1.5.4 Links data
General links’ data are given in Tables B.6 and B.7. The type is equal to 1 for overhead lines, to 2
for underground cables and to 3 for transformers. It is equal to 0 when thermal failures are ignored.
The minimum tap ratio for transformers is equal to 0.8 and its maximum to 1.2. The size of each
tap is set at 0.01. The nominal currents of 345 kV and 500 kV overhead lines are equal to 6.215 pu
(1040 A) and 18.273 pu (2110 A), respectively. The nominal current of 345 kV underground cables is
equal to 5.378 pu (900 A). Thermal data for overhead lines are given in Table B.8. Mechanical data
for overhead lines are given in Table B.9. The span length is the distance between two towers. The
“vegetation height” (including the dielectric breakdown distance) for the base case (probability of
having a short circuit with the ground in all normal situations (no contingency) is 10−5) is 11.94 m.
Thermal data for overground cables are given in Table B.10. Thermal data for power transformers
are given in Table B.11.
B.1.6 Wind farms and wind speeds
Two wind farms of 150 MW (buses 34 and 43) and seven wind farms of 200 MW (buses 28,
48, 59, 49, 24, 20, 64) are implemented. In order to consider correlations between wind speeds at
these wind farms, they can be sampled through the joint normal transform algorithm described in
127
APPENDIX B. TEST SYSTEMS
Hour Winter Winter Summer Summer Spring/fall Spring/fall
weekday weekend weekday weekend weekday weekend
0 67 78 64 74 63 75
1 63 72 60 70 62 73
2 60 68 58 66 60 69
3 59 66 56 65 58 66
4 59 64 56 64 59 65
5 60 65 58 62 65 65
6 74 66 64 62 72 68
7 86 70 76 66 85 74
8 95 80 87 81 95 83
9 96 88 95 86 99 89
10 96 90 99 91 100 92
11 95 91 100 93 99 94
12 95 90 99 93 93 91
13 95 88 100 92 92 90
14 93 87 100 91 90 90
15 94 87 97 91 88 86
16 99 91 96 92 90 85
17 100 100 96 94 92 88
18 100 99 93 95 96 92
19 96 97 92 95 98 100
20 91 94 92 100 96 97
21 83 92 93 93 90 95
22 73 87 87 88 80 90
23 63 81 72 80 70 85
Table B.5: Hourly peak load in percentage of daily peak.
Section 6.2. Wind speeds are modeled by Weibull laws. The parameters β (shape parameter) and
η (scale parameter) for these nine wind farms at a 10-meter height are available on the website
http://homepages.ulb.ac.be/~phenneau for each hour and each season. For wind power plants,
the wind speed is extrapolated at a height of 78 meters through the logarithmic wind profile and
an aerodynamic roughness length of the surface equal to 0.03 meter. The lower triangular matrix T
a such that R = T × T t (Cholesky decomposition) where R is the rank correlation matrix between
wind farms, is also available on this website. These probability distributions are computed from
statistical data given by KNMI (Koninklijk Nederlands Meteorologisch Instituut - http://www.knmi.
nl/klimatologie/onderzoeksgegevens/potentiele_wind/). The stations 380, 323, 210, 277, 278,
225, 286, 283 et 391 (see Figure B.4) are associated respectively to buses 20, 24, 28, 34, 43, 48, 49,
59 et 64.
B.1.7 Ambient temperature
The ambient temperature is modeled by a gaussian law, with a mean and a standard deviation
depending on the hour and the season, given in Tables B.12 and B.13, respectively. These parameters
were computed from statistical data given by KNMI.
B.2 Two-level test system
B.2.1 General data
The test system used is shown in Figure B.5. It is an adaptation of the Kundur’s Two-Area System
[14]. There are 8 power plants with a maximal power of 400 MW for each of them. The peak load
connected is 971 MW (and 100 MVAr) into bus 11 and 1787 MW (and 200 MVAr) into bus 13. At
peak load, the generated power is 350 MW in each power plant. The load is modulated along the
day and the hour, according to load factors given in the IEEE-RTS [71] and for the previous test
system. The same load factor is applied to each load and each power plant. General data for power
plants are given in Table B.14. The generated power given is for the peak load. Main bus data are
given in Table B.15. Generation data and power flow data are given for the peak load. The type
128
APPENDIX B. TEST SYSTEMS
Number Type From To Resistance Reactance Line charging Tap Tap Failure rate
bus bus (pu) (pu) (pu) ratio phase (/year)
1 0 54 1 0.0001 0.0075 0.0000 1.02 0 0
2 0 58 2 0.0001 0.0075 0.0000 1.07 0 0
3 0 62 3 0.0001 0.0075 0.0000 1.07 0 0
4 0 19 4 0.0007 0.0142 0.0000 1.07 0 0
5 0 20 5 0.0001 0.0075 0.0000 1.00 0 0
6 0 22 6 0.0001 0.0075 0.0000 1.02 0 0
7 0 23 7 0.0001 0.0075 0.0000 1.00 0 0
8 0 25 8 0.0001 0.0075 0.0000 1.02 0 0
9 0 29 9 0.0001 0.0075 0.0000 1.02 0 0
10 0 31 10 0.0001 0.0075 0.0000 1.00 0 0
11 0 32 11 0.0001 0.0075 0.0000 1.00 0 0
12 0 36 12 0.0001 0.0075 0.0000 1.00 0 0
13 0 17 13 0.0001 0.0075 0.0000 1.00 0 0
14 0 41 14 0.0000 0.0015 0.0000 1.00 0 0
15 0 42 15 0.0000 0.0015 0.0000 1.00 0 0
16 0 18 16 0.0000 0.0030 0.0000 1.00 0 0
17 2 36 17 0.0005 0.0035 0.9250 1.00 0 1
18 1 49 18 0.0076 0.0760 0.9500 1.00 0 1
19 1 68 19 0.0016 0.0160 0.2000 1.00 0 1
20 3 19 20 0.0007 0.0150 0.0000 1.06 0 1
21 1 68 21 0.0008 0.0080 0.1000 1.00 0 1
22 1 21 22 0.0008 0.0080 0.1000 1.00 0 1
23 1 22 23 0.0006 0.0060 0.0750 1.00 0 1
24 1 23 24 0.0022 0.0220 0.2750 1.00 0 1
25 1 68 24 0.0003 0.0030 0.0375 1.00 0 1
26 1 54 25 0.0070 0.0700 0.8750 1.00 0 1
27 1 25 26 0.0032 0.0320 0.4000 1.00 0 1
28 1 37 27 0.0013 0.0130 0.1625 1.00 0 1
29 1 26 27 0.0014 0.0140 0.1750 1.00 0 1
30 1 26 28 0.0043 0.0430 0.5375 1.00 0 1
31 1 26 29 0.0057 0.0570 0.7125 1.00 0 1
32 1 28 29 0.0014 0.0140 0.1750 1.00 0 1
33 2 53 30 0.0008 0.0056 1.4800 1.00 0 1
34 1 61 30 0.0019 0.0190 0.2375 1.00 0 1
35 1 61 30 0.0019 0.0190 0.2375 1.00 0 1
36 1 30 31 0.0013 0.0130 0.1625 1.00 0 1
37 1 53 31 0.0016 0.0160 0.2000 1.00 0 1
38 1 30 32 0.0024 0.0240 0.3000 1.00 0 1
39 1 32 33 0.0008 0.0080 0.1000 1.00 0 1
40 1 33 34 0.0011 0.0110 0.1375 1.00 0 1
41 3 35 34 0.0005 0.0130 0.0000 0.95 0 1
42 1 34 36 0.0033 0.0330 0.4125 1.00 0 1
43 1 61 36 0.0022 0.0220 0.2750 1.00 0 1
44 1 61 36 0.0022 0.0220 0.2750 1.00 0 1
45 1 68 37 0.0007 0.0070 0.0875 1.00 0 1
46 1 31 38 0.0011 0.0110 0.1375 1.00 0 1
47 1 33 38 0.0036 0.0360 0.4500 1.00 0 1
48 1 41 40 0.0060 0.0600 0.7500 1.00 0 1
49 1 48 40 0.0020 0.0200 0.2500 1.00 0 1
50 1 42 41 0.0040 0.0400 0.5000 1.00 0 1
51 1 18 42 0.0040 0.0400 0.5000 1.00 0 1
52 3 17 43 0.0007 0.0150 0.0000 1.00 0 1
53 3 39 44 0.0007 0.0150 0.0000 1.00 0 1
54 3 43 44 0.0001 0.0839 0.0000 1.00 0 1
55 1 35 45 0.0007 0.0175 1.2250 1.00 0 1
56 3 39 45 0.0005 0.0130 0.0000 1.00 0 1
57 1 44 45 0.0007 0.0175 1.2250 1.00 0 1
58 1 38 46 0.0022 0.0220 0.2750 1.00 0 1
59 1 53 47 0.0013 0.0130 0.1625 1.00 0 1
60 1 47 48 0.0025 0.0250 0.3125 1.00 0 1
61 1 47 48 0.0025 0.0250 0.3125 1.00 0 1
62 1 46 49 0.0018 0.0180 0.2250 1.00 0 1
63 1 45 51 0.0004 0.0100 0.7000 1.00 0 1
64 1 50 51 0.0009 0.0225 1.5750 1.00 0 1
65 1 37 52 0.0007 0.0070 0.0875 1.00 0 1
66 1 55 52 0.0011 0.0110 0.1375 1.00 0 1
67 1 53 54 0.0035 0.0350 0.4375 1.00 0 1
68 1 54 55 0.0013 0.0130 0.1625 1.00 0 1
Table B.6: Links Data.
129
APPENDIX B. TEST SYSTEMS
Number Type From To Resistance Reactance Line charging Tap Tap Failure rate
bus bus (pu) (pu) (pu) ratio phase (/year)
69 1 55 56 0.0013 0.0130 0.1625 1.00 0 1
70 1 56 57 0.0008 0.0080 0.1000 1.00 0 1
71 1 57 58 0.0002 0.0020 0.0250 1.00 0 1
72 1 58 59 0.0006 0.0060 0.0750 1.00 0 1
73 1 57 60 0.0008 0.0080 0.1000 1.00 0 1
74 1 59 60 0.0004 0.0040 0.0500 1.00 0 1
75 1 60 61 0.0023 0.0230 0.2875 1.00 0 1
76 1 58 63 0.0007 0.0070 0.0875 1.00 0 1
77 1 62 63 0.0004 0.0040 0.0500 1.00 0 1
78 3 64 63 0.0007 0.0150 0.0000 1.00 0 1
79 1 62 65 0.0004 0.0040 0.0500 1.00 0 1
80 3 64 65 0.0007 0.0150 0.0000 1.00 0 1
81 1 56 66 0.0008 0.0080 0.1000 1.00 0 1
82 1 65 66 0.0009 0.0090 0.1125 1.00 0 1
83 1 66 67 0.0018 0.0180 0.2250 1.00 0 1
84 1 67 68 0.0009 0.0090 0.1125 1.00 0 1
85 1 53 27 0.0032 0.0320 0.4000 1.00 0 1
86 3 69 18 0.0005 0.0130 0.0000 1.00 0 1
87 1 50 69 0.0012 0.0300 2.1000 1.00 0 1
88 2 36 17 0.0005 0.0035 0.9250 1.00 0 1
89 1 32 33 0.0008 0.0080 0.1000 1.00 0 1
90 1 21 22 0.0008 0.0080 0.1000 1.00 0 1
91 1 68 19 0.0016 0.0160 0.2000 1.00 0 1
Table B.7: Links Data (continued).
Figure B.4: Map of KNMI stations.
is equal to 1 for the swing bus, to 2 for PV buses and to 3 for PQ buses. The conductance and
the susceptance shunt are equal to zero for all buses. The minimum bus voltage is 0.9 pu and the
maximum bus voltage 1.1 pu. General links’ data are given in Table B.16. The type is equal to 1 for
overhead lines, to 2 for underground cables and to 3 for transformers. It is equal to 0 when thermal
failures are ignored. The minimum tap ratio for transformers is equal to 0.8 and its maximum to
1.2. The size of each tap is set at 0.05. The nominal currents of 230 kV overhead lines is equal to
4.94 pu.
130
APPENDIX B. TEST SYSTEMS
# Number of Total heat capacity φ Length Emissivity Orientation Elevation above
conductors/phase mCp (J/(m.K)) (mm) (km) ε () sea level He
18 2 1513 30.42 302.39 0.5 53 0
19 2 1513 30.42 63.66 0.5 33 0
21 2 1513 30.42 31.83 0.5 46 0
22 2 1513 30.42 31.83 0.5 56 0
23 2 1513 30.42 23.87 0.5 68 0
24 2 1513 30.42 87.53 0.5 62 0
25 2 1513 30.42 11.94 0.5 84 0
26 2 1513 30.42 278.51 0.5 1 0
27 2 1513 30.42 127.32 0.5 1 0
28 2 1513 30.42 51.72 0.5 83 0
29 2 1513 30.42 55.70 0.5 48 0
30 2 1513 30.42 171.09 0.5 31 0
31 2 1513 30.42 226.79 0.5 2 0
32 2 1513 30.42 55.70 0.5 40 0
34 2 1513 30.42 75.60 0.5 85 0
35 2 1513 30.42 75.60 0.5 85 0
36 2 1513 30.42 51.72 0.5 5 0
37 2 1513 30.42 63.66 0.5 21 0
38 2 1513 30.42 95.49 0.5 76 0
39 2 1513 30.42 31.83 0.5 89 0
40 2 1513 30.42 43.77 0.5 82 0
42 2 1513 30.42 131.30 0.5 31 0
43 2 1513 30.42 87.53 0.5 87 0
44 2 1513 30.42 87.53 0.5 87 0
45 2 1513 30.42 27.85 0.5 34 0
46 2 1513 30.42 43.77 0.5 89 0
47 2 1513 30.42 143.24 0.5 15 0
48 2 1513 30.42 238.73 0.5 3 0
49 2 1513 30.42 79.58 0.5 3 0
50 2 1513 30.42 159.15 0.5 83 0
51 2 1513 30.42 159.15 0.5 81 0
55 3 2551 40.70 128.02 0.5 46 0
57 3 2551 40.70 128.02 0.5 32 0
58 2 1513 30.42 87.53 0.5 1 0
59 2 1513 30.42 51.72 0.5 36 0
60 2 1513 30.42 99.47 0.5 39 0
61 2 1513 30.42 99.47 0.5 39 0
62 2 1513 30.42 71.62 0.5 81 0
63 3 2551 40.70 73.15 0.5 1 0
64 3 2551 40.70 164.59 0.5 88 0
65 2 1513 30.42 27.85 0.5 38 0
66 2 1513 30.42 43.77 0.5 46 0
67 2 1513 30.42 139.26 0.5 9 0
68 2 1513 30.42 51.72 0.5 88 0
69 2 1513 30.42 51.72 0.5 74 0
70 2 1513 30.42 31.83 0.5 90 0
71 2 1513 30.42 7.96 0.5 89 0
72 2 1513 30.42 23.87 0.5 37 0
73 2 1513 30.42 31.83 0.5 40 0
74 2 1513 30.42 15.92 0.5 73 0
75 2 1513 30.42 91.51 0.5 51 0
76 2 1513 30.42 27.85 0.5 23 0
77 2 1513 30.42 15.92 0.5 46 0
79 2 1513 30.42 15.92 0.5 89 0
81 2 1513 30.42 31.83 0.5 15 0
82 2 1513 30.42 35.81 0.5 81 0
83 2 1513 30.42 71.62 0.5 84 0
84 2 1513 30.42 35.81 0.5 20 0
85 2 1513 30.42 127.32 0.5 19 0
87 3 2551 40.70 219.46 0.5 25 0
89 2 1513 30.42 31.83 0.5 89 0
90 2 1513 30.42 31.83 0.5 56 0
91 2 1513 30.42 63.66 0.5 33 0
Table B.8: Thermal data of overhead lines.
131
APPENDIX B. TEST SYSTEMS
# Reference temperature Tensile stress Apparent EA Dilatation coef. Span length Suspension
Tref (C) @Tref (kN) weight (N/m) (kN) α (K−1) (m) height (m)
18 -17.78 53.4 17.95 46543 1.93E-05 350 20
19 -17.78 53.4 17.95 46543 1.93E-05 350 20
21 -17.78 53.4 17.95 46543 1.93E-05 350 20
22 -17.78 53.4 17.95 46543 1.93E-05 350 20
23 -17.78 53.4 17.95 46543 1.93E-05 350 20
24 -17.78 53.4 17.95 46543 1.93E-05 350 20
25 -17.78 53.4 17.95 46543 1.93E-05 350 20
26 -17.78 53.4 17.95 46543 1.93E-05 350 20
27 -17.78 53.4 17.95 46543 1.93E-05 350 20
28 -17.78 53.4 17.95 46543 1.93E-05 350 20
29 -17.78 53.4 17.95 46543 1.93E-05 350 20
30 -17.78 53.4 17.95 46543 1.93E-05 350 20
31 -17.78 53.4 17.95 46543 1.93E-05 350 20
32 -17.78 53.4 17.95 46543 1.93E-05 350 20
34 -17.78 53.4 17.95 46543 1.93E-05 350 20
35 -17.78 53.4 17.95 46543 1.93E-05 350 20
36 -17.78 53.4 17.95 46543 1.93E-05 350 20
37 -17.78 53.4 17.95 46543 1.93E-05 350 20
38 -17.78 53.4 17.95 46543 1.93E-05 350 20
39 -17.78 53.4 17.95 46543 1.93E-05 350 20
40 -17.78 53.4 17.95 46543 1.93E-05 350 20
42 -17.78 53.4 17.95 46543 1.93E-05 350 20
43 -17.78 53.4 17.95 46543 1.93E-05 350 20
44 -17.78 53.4 17.95 46543 1.93E-05 350 20
45 -17.78 53.4 17.95 46543 1.93E-05 350 20
46 -17.78 53.4 17.95 46543 1.93E-05 350 20
47 -17.78 53.4 17.95 46543 1.93E-05 350 20
48 -17.78 53.4 17.95 46543 1.93E-05 350 20
49 -17.78 53.4 17.95 46543 1.93E-05 350 20
50 -17.78 53.4 17.95 46543 1.93E-05 350 20
51 -17.78 53.4 17.95 46543 1.93E-05 350 20
55 -17.78 84.55 30.31 77704 2.03E-05 350 22.7
57 -17.78 84.55 30.31 77704 2.03E-05 350 22.7
58 -17.78 53.4 17.95 46543 1.93E-05 350 20
59 -17.78 53.4 17.95 46543 1.93E-05 350 20
60 -17.78 53.4 17.95 46543 1.93E-05 350 20
61 -17.78 53.4 17.95 46543 1.93E-05 350 20
62 -17.78 53.4 17.95 46543 1.93E-05 350 20
63 -17.78 84.55 30.31 77704 2.03E-05 350 22.7
64 -17.78 84.55 30.31 77704 2.03E-05 350 22.7
65 -17.78 53.4 17.95 46543 1.93E-05 350 20
66 -17.78 53.4 17.95 46543 1.93E-05 350 20
67 -17.78 53.4 17.95 46543 1.93E-05 350 20
68 -17.78 53.4 17.95 46543 1.93E-05 350 20
69 -17.78 53.4 17.95 46543 1.93E-05 350 20
70 -17.78 53.4 17.95 46543 1.93E-05 350 20
71 -17.78 53.4 17.95 46543 1.93E-05 350 20
72 -17.78 53.4 17.95 46543 1.93E-05 350 20
73 -17.78 53.4 17.95 46543 1.93E-05 350 20
74 -17.78 53.4 17.95 46543 1.93E-05 350 20
75 -17.78 53.4 17.95 46543 1.93E-05 350 20
76 -17.78 53.4 17.95 46543 1.93E-05 350 20
77 -17.78 53.4 17.95 46543 1.93E-05 350 20
79 -17.78 53.4 17.95 46543 1.93E-05 350 20
81 -17.78 53.4 17.95 46543 1.93E-05 350 20
82 -17.78 53.4 17.95 46543 1.93E-05 350 20
83 -17.78 53.4 17.95 46543 1.93E-05 350 20
84 -17.78 53.4 17.95 46543 1.93E-05 350 20
85 -17.78 53.4 17.95 46543 1.93E-05 350 20
87 -17.78 84.55 30.31 77704 2.03E-05 350 22.7
89 -17.78 53.4 17.95 46543 1.93E-05 350 20
90 -17.78 53.4 17.95 46543 1.93E-05 350 20
91 -17.78 53.4 17.95 46543 1.93E-05 350 20
Table B.9: Mechanica data of overhead lines.
132
APPENDIX B. TEST SYSTEMS
# Insulator thermal Environment thermal Conductor heat Insulator heat Length
resistance (m.K/W) resistance (m.K/W) capacity (J/(m.K)) capacity (J/(m.K)) (km)
17 1.11 1.26 2.17E+03 1.92E+04 17.06
33 1.11 1.26 2.17E+03 1.92E+04 27.29
88 1.11 1.26 2.17E+03 1.92E+04 17.06
Table B.10: Thermal data of underground cables.
# Tfl (K) Tgfl (K) R τ (min) n m Sn (pu) K
20 36 28.6 4.87 210 1 0.8 2 1
41 36 28.6 4.87 210 1 0.8 8 1
52 36 28.6 4.87 210 1 0.8 4 1
53 36 28.6 4.87 210 1 0.8 2 1
54 36 28.6 4.87 210 1 0.8 4 1
56 36 28.6 4.87 210 1 0.8 2 1
78 36 28.6 4.87 210 1 0.8 2 1
80 36 28.6 4.87 210 1 0.8 2 1
86 36 28.6 4.87 210 1 0.8 4 1
Table B.11: Thermal data of power transformers.
Hour Winter Spring Summer Fall
0 2.80 8.30 13.78 6.96
1 2.67 8.00 13.53 6.85
2 2.59 7.73 13.34 6.74
3 2.52 7.60 13.27 6.68
4 2.47 8.15 13.70 6.64
5 2.42 9.37 14.84 6.63
6 2.48 10.89 16.25 6.93
7 2.87 12.29 17.55 7.56
8 3.55 13.45 18.65 8.47
9 4.30 14.38 19.46 9.38
10 4.94 15.07 20.05 10.03
11 5.41 15.57 20.48 10.46
12 5.68 15.87 20.75 10.66
13 5.74 16.06 20.83 10.63
14 5.53 15.95 20.78 10.26
15 5.05 15.61 20.43 9.54
16 4.49 14.99 19.83 8.76
17 4.00 13.86 18.75 8.24
18 3.68 12.44 17.40 7.96
19 3.48 11.17 16.06 7.70
20 3.30 10.34 15.28 7.48
21 3.15 9.70 14.76 7.29
22 3.02 9.18 14.35 7.10
23 2.90 8.78 14.02 6.95
Table B.12: Mean ambient temperature (C) for each season and each hour.
Figure B.5: Test system for a two-level blackout risk analysis.
133
APPENDIX B. TEST SYSTEMS
Hour Winter Spring Summer Fall
0 4.57 4.52 3.06 4.82
1 4.60 4.54 3.12 4.84
2 4.59 4.52 3.13 4.83
3 4.60 4.59 3.13 4.84
4 4.64 4.82 3.04 4.85
5 4.64 4.99 3.00 4.88
6 4.61 4.88 2.92 4.98
7 4.47 4.89 3.01 5.10
8 4.28 4.98 3.26 5.17
9 4.12 5.10 3.57 5.21
10 4.08 5.18 3.85 5.25
11 4.04 5.28 4.01 5.27
12 4.03 5.35 4.15 5.30
13 4.05 5.33 4.19 5.35
14 4.11 5.31 4.19 5.42
15 4.17 5.26 4.13 5.39
16 4.16 5.23 3.98 5.07
17 4.16 5.16 3.78 4.81
18 4.23 4.96 3.45 4.79
19 4.29 4.63 3.10 4.79
20 4.34 4.52 3.03 4.81
21 4.43 4.53 3.01 4.83
22 4.50 4.53 3.05 4.85
23 4.54 4.53 3.09 4.83
Table B.13: Standard deviation of the ambient temperature (C) for each season and each hour.
# Bus Maximum power (MW) Power (MW) Damping coefficient (pu)
1 1 450 350 0
2 2 450 350 0
3 3 450 350 0
4 4 450 350 0
5 5 450 350 0
6 6 450 350 0
7 7 450 350 0
8 8 450 350 0
Table B.14: Power plants general data.
# Type V (pu) θ () Pg (pu) Qg (pu) Pl (pu) Ql (pu) Qming (pu) Qmaxg (pu) Vrated (kV)
1 2 1.0300 18.797 3.500 0.776 0 0 -1 2.5 20
2 2 1.0300 18.797 3.500 0.776 0 0 -1 2.5 20
3 2 1.0100 14.098 3.500 0.611 0 0 -1 2.5 20
4 2 1.0100 14.098 3.500 0.611 0 0 -1 2.5 20
5 1 1.0300 -6.800 3.497 1.067 0 0 -1 2.5 20
6 2 1.0300 -6.795 3.500 1.067 0 0 -1 2.5 20
7 2 1.0100 -11.530 3.500 1.108 0 0 -1 2.5 20
8 2 1.0100 -11.530 3.500 1.108 0 0 -1 2.5 20
9 3 1.0112 12.353 0.000 0.000 0 0 0 0 230
10 3 0.9965 7.428 0.000 0.000 0 0 0 0 230
11 3 0.9920 5.417 0.000 0.000 9.71 1 0 0 230
12 2 1.0300 -7.781 0.000 2.320 0 0 0 3 230
13 3 0.9719 -20.375 0.000 0.000 17.87 2 0 0 230
14 3 0.9802 -18.311 0.000 0.000 0 0 0 0 230
15 3 1.0019 -13.299 0.000 0.000 0 0 0 0 230
Table B.15: Bus Data.
B.2.2 Thermal and mechanical data
Thermal data for overhead lines are given in Table B.17. Mechanical data for overhead lines are
given in Table B.9. The span length is the distance between two towers. The “vegetation height”
(including the dielectric breakdown distance) used is 11.40 m. Thermal data for power transformers
are given in Table B.19. As for the previous test system, the ambient temperature is modeled by a
gaussian law, with a mean and a standard deviation depending on the hour and the season, given
134
APPENDIX B. TEST SYSTEMS
Number Type From To Resistance Reactance Line charging Tap Tap Failure rate
bus bus (pu) (pu) (pu) ratio phase (/year)
1 3 1 9 0 0.0334 0 1 0 0
2 3 2 9 0 0.0334 0 1 0 0
3 3 3 10 0 0.0334 0 1 0 0
4 3 4 10 0 0.0334 0 1 0 0
5 3 5 15 0 0.0334 0 1 0 0
6 3 6 15 0 0.0334 0 1 0 0
7 3 7 14 0 0.0334 0 1 0 0
8 3 8 14 0 0.0334 0 1 0 0
9 1 9 10 0.0025 0.025 0.0437 1 0 1
10 1 9 10 0.0025 0.025 0.0437 1 0 1
11 1 15 14 0.0025 0.025 0.0437 1 0 1
12 1 15 14 0.0025 0.025 0.0437 1 0 1
13 1 10 11 0.001 0.01 0.0175 1 0 1
14 1 10 11 0.001 0.01 0.0175 1 0 1
15 1 10 11 0.001 0.01 0.0175 1 0 1
16 1 10 11 0.001 0.01 0.0175 1 0 1
17 1 14 13 0.001 0.01 0.0175 1 0 1
18 1 14 13 0.001 0.01 0.0175 1 0 1
19 1 14 13 0.001 0.01 0.0175 1 0 1
20 1 14 13 0.001 0.01 0.0175 1 0 1
21 1 11 12 0.011 0.11 0.1925 1 0 1
22 1 11 12 0.011 0.11 0.1925 1 0 1
23 1 13 12 0.011 0.11 0.1925 1 0 1
24 1 13 12 0.011 0.11 0.1925 1 0 1
Table B.16: Links Data.
in Tables B.12 and B.13, respectively. An unique wind speed, modeled by a Weibull law, is used for
all the test system. The parameters β (shape parameter) and η (scale parameter) are given in Table
B.20 for each hour and each season (it corresponds to the stations 380 of the KNMI).
# Number of Total heat capacity φ Length Emissivity Orientation Elevation above
conductors/phase mCp (J/(m.K)) (mm) (km) ε () sea level He
9 2 1513 30.42 25.00 0.50 0 0
10 2 1513 30.42 25.00 0.50 0 0
11 2 1513 30.42 25.00 0.50 0 0
12 2 1513 30.42 25.00 0.50 0 0
13 2 1513 30.42 10.00 0.50 0 0
14 2 1513 30.42 10.00 0.50 0 0
15 2 1513 30.42 10.00 0.50 0 0
16 2 1513 30.42 10.00 0.50 0 0
17 2 1513 30.42 10.00 0.50 0 0
18 2 1513 30.42 10.00 0.50 0 0
19 2 1513 30.42 10.00 0.50 0 0
20 2 1513 30.42 10.00 0.50 0 0
21 2 1513 30.42 110.00 0.50 0 0
22 2 1513 30.42 110.00 0.50 0 0
23 2 1513 30.42 110.00 0.50 0 0
24 2 1513 30.42 110.00 0.50 0 0
Table B.17: Thermal data of overhead lines.
B.2.3 Dynamic data
Dynamic characteristics of each synchronous machine are given in Table B.21 on a 400 MVA
power basis. There are adapted from [14]. We propose to use the Type AC4A alternator-supplied
controlled-rectifier excitation system illustrated in Figure B.6. This high initial response excitation
system utilizes a full thyristor bridge in the exciter output circuit. Parameters used are adapted
from [96] and are given in Table B.22. To improve the angular stability, a PSS is implemented
in each generator. The PSS used is depicted in Figure B.7. In order to damp different area of
frequency, we used two sets of parameters, given in Table B.23. In each power plant, both are used:
one for each unit. The governor-turbine system is based on the following parameters:
135
APPENDIX B. TEST SYSTEMS
# Reference temperature Tensile stress Apparent EA Dilatation coef. Span length Suspension
Tref (C) @Tref (kN) weight (N/m) (kN) α (K−1) (m) height (m)
9 -17.78 53.4 17.95 46543 1.93E-05 350 20
10 -17.78 53.4 17.95 46543 1.93E-05 350 20
11 -17.78 53.4 17.95 46543 1.93E-05 350 20
12 -17.78 53.4 17.95 46543 1.93E-05 350 20
13 -17.78 53.4 17.95 46543 1.93E-05 350 20
14 -17.78 53.4 17.95 46543 1.93E-05 350 20
15 -17.78 53.4 17.95 46543 1.93E-05 350 20
16 -17.78 53.4 17.95 46543 1.93E-05 350 20
17 -17.78 53.4 17.95 46543 1.93E-05 350 20
18 -17.78 53.4 17.95 46543 1.93E-05 350 20
19 -17.78 53.4 17.95 46543 1.93E-05 350 20
20 -17.78 53.4 17.95 46543 1.93E-05 350 20
21 -17.78 53.4 17.95 46543 1.93E-05 350 20
22 -17.78 53.4 17.95 46543 1.93E-05 350 20
23 -17.78 53.4 17.95 46543 1.93E-05 350 20
24 -17.78 53.4 17.95 46543 1.93E-05 350 20
Table B.18: Mechanica data of overhead lines.
# Tfl (K) Tgfl (K) R τ (min) n m Sn (pu) K
1 36 28.6 4.87 210 1 0.8 2 1
2 36 28.6 4.87 210 1 0.8 2 1
3 36 28.6 4.87 210 1 0.8 2 1
4 36 28.6 4.87 210 1 0.8 2 1
5 36 28.6 4.87 210 1 0.8 2 1
6 36 28.6 4.87 210 1 0.8 2 1
7 36 28.6 4.87 210 1 0.8 2 1
8 36 28.6 4.87 210 1 0.8 2 1
Table B.19: Thermal data of power transformers.
Hour η - Winter η - Spring η - Summer η - Fall β - Winter β - Spring β - Summer β - Fall
(m/s) (m/s) (m/s) (m/s)
0 6.28 4.11 3.75 5.23 1.64 1.42 1.32 1.57
1 6.24 4.10 3.76 5.21 1.66 1.41 1.30 1.53
2 6.24 4.14 3.77 5.20 1.64 1.46 1.31 1.49
3 6.19 4.15 3.76 5.25 1.64 1.45 1.30 1.53
4 6.17 4.07 3.78 5.25 1.68 1.39 1.33 1.54
5 6.26 4.38 4.03 5.30 1.73 1.52 1.45 1.50
6 6.28 4.93 4.55 5.40 1.69 1.76 1.63 1.58
7 6.37 5.49 5.15 5.52 1.71 1.97 1.90 1.64
8 6.62 5.93 5.63 5.86 1.83 2.21 2.11 1.84
9 6.93 6.28 6.02 6.22 1.91 2.34 2.28 1.92
10 7.22 6.67 6.40 6.50 2.00 2.47 2.47 2.12
11 7.48 6.97 6.72 6.70 2.16 2.62 2.65 2.16
12 7.57 7.15 6.90 6.81 2.15 2.66 2.68 2.20
13 7.63 7.26 6.95 6.79 2.20 2.77 2.71 2.25
14 7.49 7.18 6.88 6.62 2.18 2.75 2.77 2.20
15 7.26 7.00 6.74 6.26 2.11 2.68 2.63 2.05
16 6.91 6.69 6.39 5.87 2.01 2.61 2.52 1.93
17 6.73 6.16 5.84 5.65 1.90 2.43 2.24 1.77
18 6.62 5.48 5.19 5.61 1.85 2.15 1.94 1.75
19 6.55 4.85 4.57 5.55 1.72 1.82 1.67 1.72
20 6.50 4.54 4.18 5.36 1.67 1.71 1.49 1.61
21 6.48 4.36 4.01 5.27 1.69 1.57 1.42 1.56
22 6.45 4.23 3.83 5.26 1.68 1.54 1.31 1.59
23 6.36 4.12 3.81 5.26 1.65 1.44 1.30 1.59
Table B.20: Wind speed parameters.
• Speed set point: ωref = 1pu
• Steady state gain: 1/R = 20pu
• Maximum power order: Tmax = 1pu on a 400MVA basis
• Servo time constant: Ts = 0.2s
136
APPENDIX B. TEST SYSTEMS
Leakage reactance Xl = 0.2
Resistance Ra = 0.0025
d-axis synchronous reactance Xd = 1.8
d-axis transient reactance X′d = 0.3
d-axis subtransient reactance X′′d = 0.25
d-axis open-circuit time T ′d0 = 8.0s
d-axis open-circuit subtransient time constant T ′′d0 = 0.03s
q-axis synchronous reactance Xq = 1.7
q-axis transient reactance X′q = 0.55
q-axis subtransient reactance X′′q = 0.25
q-axis open-circuit time T ′q0 = 0.4s
q-axis open-circuit subtransient time constant T ′′q0 = 0.05s
Inertia constant H = 6.0s
Table B.21: Dynamic parameters of synchronous machines.
Figure B.6: Excitation system - type AC4A.
TA = 0.015s TB = 10s TC = 1s TR = 0.01s KA = 200 KC = 0 VRmin = −5 VRmax = 6
Table B.22: Parameters for excitation system model.
KS = 20.0 T5 = 10.0s T1 = 0.05s T2 = 0.02s T3 = 3.0s T4 = 5.4s Vsmin = −1 Vsmax = 1
Table B.23: Parameters for PSS model.
• Governor time constant: Tc = 1.0s
• Transient time constant: T3 = 0s
• HP section time constant: T4 = 2.0s
• Reheater time constant: T5 = 4.0s
B.2.4 Relays and protections
The following under-frequency load shedding plan is used for each load: 5% of load shedding every
200 mHz step between 49 Hz and 47.6 Hz (8 steps) with a delay of 10 cycles or 200 ms, corresponding
to the time needed to measure the frequency. The following under-voltage load shedding plan is
used for each load: 5% of load shedding every 0.02 pu step between 0.90 pu and 0.80 pu (6 steps)
with a delay of 1.5 s at 0.90 pu, increasing by 0.25 s at each step. A reliability of 90% is used for
each load shedding relay.
For each power plant, we used an under-frequency relay at 47.5 Hz (traditionnal setpoint) with a
delay of 200 ms, an under-voltage relay at 0.7 pu with a delay of 2 s, an over-frequency relay at 52.5
Hz (traditionnal setpoint) with a delay of 1 s, an over-excitation relay for the voltage/frequency at
1.15 pu with a delay of 3 s, and in order to model the trip of a generator on loss-of-synchronism
condition, a protection which trip the generator is the apparent resistance is negative during 500
ms. All these protections are considered 100% reliable.
137
APPENDIX B. TEST SYSTEMS
Figure B.7: Model of a power system stabilizer. From [10].
For each overhead line, we used an over-current protection at 150% of the nominal current with a
delay of 1 s, and a distance relay. For the latter, a quadrilateral characteristic was used for each of
the three zones, such as shown in Figure B.8. Only coordinates of the point P must be specified. We
propose to use P = (0.8×Rl, 0.8×Xl) with a delay of 200 ms for the zone I, P = (1.2×Rl, 1.2×Xl)
with a delay of 400 ms for the zone II and P = (1.5×Rl, 1.5×Xl) with a delay of 1 s for the zone
III.
Figure B.8: Quadrilateral distance relay characteristic.
138
Appendix C
Transition criteria between level-I
and level-II
C.1 Angular transient stability
C.1.1 Introduction
It appears from a preliminary study (see [50]) that a time domain simulation seems to be the best
way for transient stability assessment. We need a fast method able to give a good estimation of
the transient stability. The proposed model for the synchronous machine is a simplified model with
amortisseurs neglected as described in Section 5.2 of [14]. We used also a simplified modeling for
loads and exciters.
C.1.2 Simplified model
The model proposed is based on several modeling assumptions: the mechanical power input of
each synchronous machine is constant, mechanical damping is negligible, the effect of speed variation
on stator voltages is neglected, the impact of the PSSs is neglected, loads are represented by constant
impedances.
For the synchronous machine, [14] gives the following set of machine equations for simplified model
with amortisseurs neglected:
Ψd = −Ldid + EI (C.1)
Ψq = −Lqiq (C.2)
E′q = EI − (Ld − L′d)id (C.3)
pE′q =1
T ′d0
(Efd − EI) (C.4)
where Ψd is the flux linkage associated with the d-axis rotor circuit, Ld is the d-axis synchronous
inductance, EI is the, Ψq is the flux linkage associated with the q-axis rotor circuit, Lq is q-axis
synchronous inductance, E′q is the q-axis component of the voltage “behind the transient impedance”,
L′d is the d-axis transient inductance, T ′d0 is the open circuit transient time constant and Efd is the
excitation field voltage. The variable EI can be eliminated from the two last equation and, since in
per unit Xd = Ld,
dE′qdt
=1
T ′d0
[Efd − (Xd −X ′d)id − E′q] (C.5)
139
APPENDIX C. TRANSITION CRITERIA BETWEEN LEVEL-I AND LEVEL-II
Consequently, this model gives one differential equation per machine. The terminal voltage ampli-
tude can be found through its d-axis and q-axis components:
E2i = |ed|2 + |eq|2 (C.6)
These variables ed and eq are given by the equations
ed = E′d +X ′qiq −Raid, (C.7)
and
eq = E′q −X ′did −Raiq. (C.8)
These expressions show that the expression “voltage behind the transient impedance” is confusing
since an unique transient impedance cannot be defined: the transient reactance for the d-axis of the
voltage is X ′q and for the q-axis, X ′d. However, we will consider that the saliency is negligible as an
additional modeling assumption,
X ′d ≈ X ′q ≡ X ′. (C.9)
The transient impedance is then
Z ′ = Ra + jX ′ (C.10)
The simplified model to use for the exciter depends from one type of exciter to another. If we use
the Type AC4A alternator-supplied controlled-rectifier excitation system illustrated in Figure C.1,
with a time constant TR very small such it can be approximated by 0, we have then the following
equation with Y (s) = L(Efd(t)) and U(s) = L(Vref − Ei(t)),
Y (s) = U(s)1 + sTC1 + sTB
KA
1 + sTA, (C.11)
or
(1 + sTA)(1 + sTB)Y (s) = KA(1 + sTC)U(s). (C.12)
In the temporal domain:
TATBy′′(t) + (TA + TB)y′(t) + y(t) = KATCu
′(t) +KAu(t) (C.13)
or
y′′(t) +TA + TBTATB
y′(t) +1
TATBy(t) =
KATCTATB
u′(t) +KA
TATBu(t). (C.14)
This differential equation can be expressed as a set of two first-order differential equations:
x′1(t) = − 1
TATBx2(t) +
KA
TATBu(t) (C.15)
x′2(t) = x1(t)− TA + TBTATGB
x2(t) +KATCTATB
u(t) (C.16)
with y(t) = x2(t) = Efd(t) and u(t) = Vref − Ei(t).
Figure C.1: Excitation system - type AC4A.
140
APPENDIX C. TRANSITION CRITERIA BETWEEN LEVEL-I AND LEVEL-II
The assumptions (including the saliency neglected) lead to the electrical network shown in figure
C.2 and has n nodes with active sources. Node 0 is the reference node (neutral). Nodes 1, 2, ..., n are
the terminal machine buses. Passive impedances connect the various nodes (transmission network
including transformers) and connect the nodes to the reference at load buses. The amplitude of the
terminal voltage of machine i is denoted Ei and its angle θi. The amplitude of the voltage behind
the transient impedance of machine i is denoted E′i and its angle δi. The admittance matrix of the
Figure C.2: Representation of a multi-machine system.
n-port network, looking into the network from the voltage behind the transient impedance of the
generators, is defined by
I = Y ′E′ (C.17)
where Y ′, by definition:
• Y ′ii = Y ′ii∠θ′ii = G′ii + jB′ii = driving point admittance for node i.
• Y ′ij = Y ′ij∠θ′ij = G′ij + jB′ij = negative of the transfer admittance between nodes i and j.
The power into the network at node i′, which is the gross electrical power output of machine i, is
given by
Pei = <(E′iI?i ) (C.18)
= E′2i G′ii +
n∑j=1j 6=i
E′iE′jY′ij cos(θ′ij − δi + δj) (C.19)
= E′2i G′ii +
n∑j=1j 6=i
E′iE′j [B′ij sin(δi − δj) +G′ij cos(δi − δj)] (C.20)
for i = 1, ..., n.
The swing equation of machine i is given by
2Hi
ωR
dωidt
= Pmi − Pei. (C.21)
141
APPENDIX C. TRANSITION CRITERIA BETWEEN LEVEL-I AND LEVEL-II
The equations of motion are then given by
2Hi
ωR
dωidt
= Pmi −[E′2i G
′ii +
n∑j=1j 6=i
E′iE′jY′ij cos(θ′ij − δi + δj)
](C.22)
dδidt
= ωi (C.23)
for i = 1, ...n. The set of equations (C.22) and (C.23) is a set of 2n-coupled nonlinear first-order
differential equations.
C.1.3 Algorithm
There is 4 steps in the performance of a transient stability study:
1. Based on the pre-fault load flow steady state, which gives for each power plant i the terminal
active power Pi, the terminal reactive power Qi and the magnitude of terminal voltage Ei, the
corresponding terminal current Ii and power factor angle φi are computed by
Ii =
√P 2i +Q2
i
Ei, (C.24)
and
φi = arccos
(PiEiIi
). (C.25)
Based on the steady state phasor diagram C.3, the internal rotor angle δi is given by
δi = arctan
(XqIi cos(φi)−RaIi sin(φi)
Ei +RaIi cos(φi) +XqIi sin(φi)
). (C.26)
With δi known, the dq-axis components of stator voltage and current are given by
ed = Ei sin(δi), (C.27)
eq = Ei cos(δi), (C.28)
id = Ii sin(δi + φi), (C.29)
and
iq = Ii cos(δi + φi). (C.30)
The dq-axis components of the voltage behind the transient impedance, E′d and E′q, are then
given by equations (C.7) and (C.8). The mechanical power Pmi of the generators can be
computed by
Pmi = Pi +RaI2i . (C.31)
Finally, the machine angles in an absolute reference frame δi can be obtained by the sum of
the terminal voltage angle θi and the angle between the rotor and the terminal voltage δi,
δi = θi + δi. (C.32)
2. The Y ′ matrices for each network condition (during and after the fault) is calculated. The
equivalent impedances of the loads are obtained from the load bus data, with the pre-fault
voltages.
3. The evolution of the system is simulated for a defined time period by solving numerically the set
of 5-n coupled differential equations (C.5), (C.15), (C.16), (C.22) and (C.23). A Runge-Kutta
method can be used.
4. Machines’ angles are analyzed to determine the stability (for example, if the difference of any
of two machines’ angles does not exceed 180, the system is stable). This can be done at each
time step during the dynamic simulation, in order to stop it as soon an instability is detected.
142
APPENDIX C. TRANSITION CRITERIA BETWEEN LEVEL-I AND LEVEL-II
Figure C.3: Steady state phasor diagram of the synchronous machine. From [14].
C.1.4 Shortcomings
This simplified model suffers from several shortcomings due to the assumptions made:
1. Neglecting the damping power. It is a “conservative” assumption since the damping power
improves the stability.
2. Constant mechanical power. It is realistic only if the primary regulation does not have the
time to change significantly the generation over the time period studied, which is the case if
this time period is smaller than primary regulation characteristic time (few seconds).
3. Representing loads by constant passive impedance. If loads have more a constant power behav-
ior, it can deteriorate the stability. However, we can assume that the recovery period is also
few seconds, so the constant impedance behavior should be valid on this time period.
C.2 Frequency stability
C.2.1 Introduction
We propose to use a simplified third-order system frequency response model analog to the model
developed in [78]. We will use only the steady state frequency deviation after primary regulation for
the frequency stability criterion. A simple way to improve that is to use the extreme values of the
frequency in each subnetwork.
C.2.2 Simplified model
The third-order system frequency response model used for each generator is shown in Figure C.4,
where ∆ω is the angular speed deviation from nominal value, M the angular momentum of the
generator, D the damping constant, R the speed regulation, ∆Pe the deviation in electrical power,
∆Pm the deviation in mechanical power, ∆Pv the change in valve position from nominal, TT the
turbine time constant and TG the governor time constant. If we consider that the most significant
time constant in the system is the reheater time constant, the model can be slightly modified: the
models for the turbine and the governor can be replaced by one model for the reheater. The Figure
C.4 is equivalent to the set of differential equations for each power plant i
d
dt
∆ωi∆Pmi∆Pvi
=
−DiMi
1Mi
0
0 − 1TTi
1TTi
− 1TGiRi
0 − 1TGi
∆ωi
∆Pmi∆Pvi
+
−∆PeiMi
0∆PSPiTGi
(C.33)
143
APPENDIX C. TRANSITION CRITERIA BETWEEN LEVEL-I AND LEVEL-II
Figure C.4: The third-order system frequency response model.
When we are interested only in primary regulation, ∆PSPi = 0, ∀i.
C.2.3 Steady state frequency deviation
When the steady state is reached, the stationary form of the set of differential equations for each
power plant i is given by −Di∆ωi + ∆Pmi = ∆Pei−∆Pmi + ∆Pvi = 0
−∆ωi/Ri + ∆Pvi = 0
(C.34)
If we consider that the frequency is the same in each subnetwork Sj when the steady state is reached
and we sum these equations over all the power plants i, we have−D(j)∆ω(j) + ∆P
(j)m = ∆P
(j)e
−∆P(j)m + ∆P
(j)v = 0
−∆ω(j)/R(j) + ∆P(j)v = 0
(C.35)
where
D(j) =∑i∈Sj
Di (C.36)
1/R(j) =∑i∈Sj
1/Ri (C.37)
∆P (j)m =
∑i∈Sj
∆Pmi (C.38)
∆P (j)e =
∑i∈Sj
∆Pei (C.39)
∆P (j)v =
∑i∈Sj
∆Pvi (C.40)
The resolution gives
∆ω(j) = − ∆P(j)e
D(j) + 1/R(j)(C.41)
for the frequency deviation in subnetwork j. If the absolute magnitude of this value is higher than
a setpoint, a frequency instability is possible. If we neglect losses in the grid, the ∆P(j)e can be
approximated by
• If the frequency transient in subnetwork j is due to the loss of a power plant in this subnetwork:
the generated power of this power plant,
• If the frequency transient in subnetwork j is due to a grid slit: by the sum of the load minus
the sum of the generation in this subnetwork before the split.
144
APPENDIX C. TRANSITION CRITERIA BETWEEN LEVEL-I AND LEVEL-II
As we have also
∆ωi = − ∆PeiDi + 1/Ri
, (C.42)
we can compute directly the ∆Pei for each power plant i when the frequency deviation is obtained.
These values can be used for the resolution of the load flow equations. We should however note that
the mechanical output power of power plants is limited. If the computation of the ∆Pei induces a
power higher than the limit, the generation can be fixed to the maximal value and the computation
is re-started for other power plants with an additional ∆P(j)e = Pei − Pmaxei in the corresponding
subnetwork.
C.3 Voltage stability
The criterion used to detect a voltage instability is simply either the non-convergence of the load
flow iterations or the convergence outside voltage limits. The most common method to solve the
load flow equations is the Newton-Raphson method. However, the non-convergence of the Newton-
Raphson iterations does not imply systematically that no solution exists.
145
Appendix D
Failure probability of overhead
lines
D.1 Introduction
Analysis of previous blackouts or major system disturbances showed that line outages due to over-
load are often the main contributors to the cascading failures leading to these undesired situations.
The most famous example is the blackout which occurred on August 14, 2003 in the Northeastern
area of the United States and in the Southeastern area of the Canada, where about twenty lines
tripped due to short circuit with ground [3]. Indeed, each of these lines sagged low enough to con-
tact something below it, even if two of them were not overloaded. As the load on other lines can
increase after the loss of an element, their failure probabilities can increase due to thermal effects
increasing their sag. If another line trips, this effect is increased, possibly leading to a cascading
failure. Therefore, it is crucial to include the dependency of the probability of trip to the load going
through the line in a cascading failures modeling. We should however note that the probability of
a fault depends not only on this load current but also on the weather (ambient temperature, wind
speed, ...), on the vegetation height, on operators corrective actions, etc.
Several models were proposed for the probability of trip as a function of the load, based on the
assumption that the more a line is overloaded, the larger is its sagging, and hence the probability that
it will be tripped. But this assumption imposes only that the probability should be a monotonically
increasing function of the load, and proposed models differ by the shape of this function. None
of them is backed up by empirical evidence or detailed analysis. In this thesis, we proposed a
decomposition in three levels of the Probabilistic Risk Assessment (PRA) to blackout hazard in
transmission power systems based on dynamic PRA. The level-I analyzes the first phase of cascading
failures leading to blackouts, the slow cascade ruled by thermal failures, on the basis of the physical
evolution of lines’ sag. The aim of this Appendix is to compare existing modeling of the probability
of trip as a function of the load to results given by a dynamic PRA level-I analysis. The comparison
is performed for two different power systems. Two different operators corrective actions models are
used for the smallest power system.
Consequently, Section D.2 presents existing models and Section D.3 presents theoretical basis.
We will then apply the level-I of blackout PRA to two test cases in Section D.4 analyzes the results.
Then, conclusions are presented in Section D.5.
147
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
D.2 State of the art
Two different kinds of studies about probability of line tripping are interesting to discuss in
this paper. First, methodologies developed to study cascading failures use various model for the
probability of trip as a function of the load. They are discussed in Subsection D.2.1. Secondly,
probabilistic methods to assess thermal capacity of lines based on the risk study also the probability
to have a flash-over to the ground in function of the load. They are presented in Subsection D.2.2.
D.2.1 Cascading failures methodologies
D.2.1.1 Introduction
In a cascading failure leading to a major system disturbance, there is a strong coupling between
events. In particular, the loss of an element can overload other lines. The temperature of an
overloaded line starts then to increase, thus increasing its sag, which may finally be so high that a
short-circuit with the ground towards trees may occur and cause the line trip. If we denote by Tithe event “Trip of the line i”, the frequency Fr of the dangerous sequence T1, ..., Tn (i.e. successive
trips of lines 1, ..., n) can be calculated by
Fr(T1, ..., Tn) = Fr(T1)× p(T2|T1)× p(T3|T1, T2)× ...× p(Tn|T1, ..., Tn−1), (D.1)
where p(Ti|T1, ..., Ti−1) is the conditional probability of the trip of the line i, knowing that lines
1, ..., i− 1 tripped. This equation can be re-write as
Fr(T1, ..., Tn) = Fr(T1)
n∏i=2
p(Ti|T1, ..., Ti−1). (D.2)
Due to the strong coupling between events in a cascading failure, the conditional probabilities can
strongly differ from the marginals ones,
p(Ti|T1, ..., Ti−1) 6= p(Ti), (D.3)
so it is crucial to have a good approximation of these probabilities in order to obtain a realistic
estimation of the risk of blackout.
In a general way, conditional probabilities p(Ti|T1, ..., Ti−1) depends on several factors: the load
of the line i, the weather (ambient temperature, wind speed, ...), on the vegetation height and on
operators corrective actions. Operators correctives actions themselves rely not only on the state of
the power system, but also on the information infrastructure. However, taking into account all these
factors in a blackout PRA is complex. Therefore, several models trying to estimate vulnerabilities
of a power system to cascading outages use conditional probabilities as a function only of the load
of the concerned line,
p(Ti|T1, ..., Ti−1) ≈ p(Ti|Ii(T1, ..., Ti−1)), (D.4)
where Ii(T1, ..., Ti−1) is the current in line i after the trip of the lines 1, ..., i− 1. The equation D.2
then becomes
Fr(T1, ..., Tn) = Fr(T1)
n∏i=2
p(Ti|Ii(T1, ..., Ti−1)). (D.5)
The assumption that the probability of line tripping in function of reduced load (actual load divided
by thermal capacity) is the same for all lines is often made as an additional approximation. If
we denote by P (x) the probability of line tripping when the reduced load is x, the frequency of a
dangerous scenario is simply given by
Fr(T1, ..., Tn) = Fr(T1)
n∏i=2
P [xi(T1, ..., Ti−1)]. (D.6)
In a general way, a line tripping can have two origins:
148
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
• The thermal expansion can result in the line dropping beneath its safety clearance, which may
cause a flashover to the ground with a probability Pth(x).
• A failure independent of the load (e.g. mechanical failure), with a probability Pind.
The total probability of line tripping is then given by
P (x) = Pind + Pth(x)[1− Pind] (D.7)
The load in each line after each loss can be easily computed through a power flow calculation. The
problem in this simplified model is then to know the function P (x), or, equivalently, Pth(x). Several
models were proposed for this, based on the assumption that the more a line is overloaded, the larger
is its sagging, and hence the probability that it will be tripped. But this assumption imposes only
that the probability should be a monotonically increasing function of the load, and proposed models
differ by the shape of this function. We present in this Section three different models.
D.2.1.2 Exponential model
In [50], Nedic presents a model to simulate large system disturbances (a variant of the Manchester
model). One of the phenomena modeled is the possible line outages due to overloads. The proposed
approach rely an the additional assumption that only if a line is overloaded it can sag beyond the
specified limits (i.e. if a line is not overloaded its tripping probability due to sagging is equal to
zero). The probabilistic function used for this purposed is shown in Figure D.1. This function is
equal to zero when the reduced load is lower than 1, has an exponential evolution when the reduced
load is between 1 and 1.5 and is equal to a constant value p2 when the reduced load is larger than
1.5.
Figure D.1: Line overload modelling. From [50].
D.2.1.3 Linear model
Zima and Andersson assumed in [97] that the probability will rather follow a curve show in Figure
D.2: the probability is equal to zero for a reduced load lower than 1, has a linear evolution when
the reduced load is between 1 and k and is equal to 1 when the reduced load is larger than k. Such
a function is inspired by [98] where a similar behavior is proposed to describe a probability of the
incorrect tripping of a line exposed to a hidden failure (i.e. a relay malfunction which entails the
trip of a “healthy” line). However, the probability function used in [98] is not equal to zero for a
load below the line limit, but is equal to a constant low value. Computations in [97] are based on
k = 1.4, as in [98].
149
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
Figure D.2: Probability of the line trip as a function of its loading. From [97].
D.2.1.4 Normal cdf model
In [99, 100], another kind of model is proposed, as shown in Figure D.3. It is assumed that when a
line loading increases above its limit, the probability of line tripping increases and eventually flatten
out to 100%. The probabilities given in these references are reproduced in Table D.1. These values
can be approximately fit by a normal cumulative distribution function (cdf) with a mean of 117.2%
and a standard deviation of 14.0%. This is why we refer this model as the “normal cdf model”.
Figure D.3: Probability of the line trip as a function of its loading. From [100].
Loading (%) Probability of trip
100 0.10
110 0.30
120 0.60
130 0.80
140 0.95
150 1.00
Table D.1: Assumption on probability of trip as a function of line loading. From [99].
D.2.1.5 Conclusions
Functions proposed in the literature to model the dependence of a line trip probability on its
loading are very different. But they are all based on the unique assumption that the more a line is
150
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
overloaded, the larger is its sagging, and hence the probability that it will be tripped. In particular,
no physical bases are used to justify the behavior of the function.
D.2.2 Increasing thermal rating by risk analysis
Thermal ratings of overhead lines are in general computed deterministically (conservative basis).
Several works proposed to use probabilistic methods to assess thermal capacity based on risk. In
these methodologies, weather conditions are represented by stochastic models in order to compute
distributions of conductor temperature, the risk in function of the loading, etc...
For example, [101] address two potential impacts of thermal overload: the too high sag which
may cause flashover to the ground (resulting in outage of the line) and the loss of strength due to
annealing. Based on the stationary thermal balance equation and on random behavior of ambient
conditions (ambient temperature and wind speed), the risk of carrying continuous overcurrent is
assessed. Short time and long time temporary overload ratings are then computed such that the
risk is equivalent to the stationary rating. This paper introduces the computation of the probability
that the conductor temperature exceeds a limiting temperature for which the line sags through all
of the designed safety margins, in function of the current. However, results do not dissociate the
sag problem to the annealing problem which is not relevant in the scope of the failure of overloaded
lines in cascading failures.
Like this example, methodologies developed to assess probabilistic (dynamic) thermal ratings of
overhead lines are based on the idea that the probability of short-circuit with the ground due a too
high sag can be evaluated through the thermal balance equation and the probability distributions
of weather conditions. However, the short-circuit probability in function of the load seems to be not
explicitly evaluated. Consequently, the next Section is devoted to a study of this probability based
on the same principle.
D.3 Physical bases
D.3.1 Introduction
We propose here to analyze the probability of line tripping in function of its loading without con-
sidering operators corrective actions. This probability can then be evaluated through the stationary
thermal balance equation per unit length [55], given by
RI2 + qs = qc + qr, (D.8)
where R, I, qs, qc, qr are respectively the AC conductor resistance1 per unit length, the conductor
current, the heat gain rate from the sun per unit length, the convected heat loss rate per unit length
and the radiated heat loss rate per unit length. The solar heating gain varies during a year because it
depends on the altitude and azimuth of the sun. The convective heat loss depends on the conductor
temperature Tc, on the ambient temperature Ta, on the wind speed Vw and on the angle between
the wind direction and the conductor axis φ,
qc ≡ qc(Tc, Ta, Vw, φ). (D.9)
The radiated heat loss depends on the conductor and ambient temperatures,
qr ≡ qr(Tc, Ta). (D.10)
1We neglect here the variation of the conductor resistance with its temperature.
151
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
The current can be expressed as a function of these variables by
I =
√qc(Tc, Ta, Vw, φ) + qr(Tc, Ta)− qs
R. (D.11)
Let be the random variable Icr the critical current, i.e. the threshold current above which the line
sags enough to have a flashover to the ground. The probability of failure Pth(i) is given by the cdf
of this random variable,
Pth(i) = P [i ≥ Icr] = P [Icr ≤ i] = FIcr (i). (D.12)
So, the problem of computing Pth(i) is then equivalent to compute FIcr (i). If we denote by Tcrthe critical temperature, i.e. the threshold temperature above which the line sags enough to have a
flashover to the ground, the critical current is given from equation (D.11) by
Icr =
√qc(Tcr, Ta, Vw, φ) + qr(Tcr, Ta)− qs
R. (D.13)
In this expression, Tcr, Ta, Vw, φ and qs are random variables. In particular, the critical temperature
is a function of the vegetation height which can be viewed as a random variable. Consequently, in
a general way, the critical current is a function of random variables p = (Tcr, Ta, Vw, φ, qs),
Icr = g(p). (D.14)
If these random variables have a joint probability distribution function (pdf) fp(p), the cdf of the
critical current is given by
FIcr (i) = P [Icr ≤ i] =
∫g(p)≤i
fp(p)dp. (D.15)
However, this integral is difficult to compute analytically: the joint pdf should be expressed and
the integration domain delimited. Consequently, we propose to numerically evaluate the cdf of the
critical current from data available on the Koninklijk Nederlands Meteorologisch Instituut website2.
The dataset used is the recording of ambient temperature, wind speed and wind direction on the
period 2001-2010 at the station 278 Heino (see Figure D.4). We study in next Subsections the
influence of the different factors, in order to estimate their relative importances. The conductor
used is an Aluminum Conductor Seel Reinforced (ACSR) 47/5.
D.3.2 Influence of ambient temperature
We propose to study first the influence of ambient temperature. All others parameters are consid-
ered constant. We can then denote by ga the function which links the critical current to the ambient
temperature,
Icr = ga(Ta). (D.16)
The critical current’s cdf is then simply given by
FIcr (i) = P [ga(Ta) ≤ i] = P [Ta ≥ g−1a (i)] = 1− FTa(g−1
a (i)), (D.17)
where FTa is the cdf of the ambient temperature and because ga is a monotonically decreasing
function. In order to understand the behavior of FIcr (i) in this case, we propose to develop an
approximate analytically model. The first difficulty in (D.17) is the inversion of ga, due to the non-
linearity of qc3 and qr. Therefore, the first approximation step is the linearization of these terms.
The critical current can then be expressed by
Icr =√c0 − c1Ta, (D.18)
2http://www.knmi.nl/3In forced convection, the non-linearity of qc is due to the dependence of the viscosity, density and thermal
conductivity of air to ambient temperature.
152
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
Figure D.4: Map of the Netherlands showing the station 278 Heino.
where c0 and c1 are positive constants. We have then
g−1(i) =c0 − i2
c1, (D.19)
and
FIcr (i) = 1− FTa(c0 − i2
c1
). (D.20)
The second approximation consists of modeling the ambient temperature as a random normal vari-
able of mean µTa and standard deviation σTa (as it is often done, see for example [101]). For our
station, µTa = 10.06C and σTa = 7.13C. We have finally
FIcr (i) = Φ
(i2 − c0 + c1µTa
c1σTa
), (D.21)
which means that the square of the critical current follows (approximately) a normal law. The
Figure D.5 compares this approximation to a computation directly based on measurements. The
critical conductor temperature, the wind speed and the wind direction were respectively chosen to
100C, 3.1121m/s (mean wind speed at the station 278) and perpendicular to the conductor. The
heat gain rate from the sun corresponds to January 1st, midday. The two curves are very similar.
The mean critical current is 2176 A and its standard deviation 88 A (0.4%).
D.3.3 Influence of wind
The Figure D.6 represents the cdf of the critical current when only the wind speed is taken as
a random variable. The critical conductor temperature, the ambient temperature and the wind
direction were respectively chosen to 100C, 10.06C (mean ambient temperature at the station
278) and perpendicular to the conductor. The heat gain rate from the sun corresponds to January
1st, midday. The mean critical current is 2099 A and its standard deviation 389 A (18.5%). The
Figure D.7 represents the cdf of the critical current when wind speed and wind direction are taken
as a random variable. The critical conductor temperature, the ambient temperature and the mean
wind direction were respectively chosen to 100C, 10.06C and perpendicular to the conductor. The
heat gain rate from the sun corresponds to January 1st, midday. The mean critical current is 1894
A and its standard deviation 382 A (20.2%).
153
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
Figure D.5: Cdf of the critical current - influence of the ambient temperature.
Figure D.6: Cdf of the critical current - influence of the wind speed.
Figure D.7: Cdf of the critical current - influence of the wind.
D.3.4 Total influence of weather conditions
The Figure D.7 represents the cdf of the critical current when all weather conditions (including heat
gain rate from sun) are taken as a random variable. The critical conductor temperature was chosen
to 100C. The mean critical current is 2115 A and its standard deviation 383 A (18.1%).
D.3.5 Influence of vegetation height
Previous analyses were performed for a constant critical temperature, which is equivalent to a
constant vegetation height. Indeed, the critical temperature depends on the critical sag, which
154
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
Figure D.8: Cdf of the critical current - influence of weather conditions.
depends itself on the vegetation height. In reality, the vegetation height below overhead lines is not
a constant, but is a variable depending on the maintenance policy, climate, soil properties, season, ...
Therefore, it can be view also as a random variable which has an impact on the critical current. The
conductor state change equation, which gives the evolution of the sag in function of the temperature,
is a non-linear equation [57]. However, the critical temperature as a function of critical sag is nearly
linear on a credible range, as shown in Figure D.9.
Figure D.9: Critical temperature in function of critical sag.
The influence of the critical temperature on the critical current is approximately the opposite of
the influence of the ambient temperature, since the balance (D.13) depends mainly on the difference
Tcr − Ta4. The same approach as in Subsection D.3.2 could therefore be applied. If all other
parameters are considered constant and by denoting by gc the function which links the critical
current to the critical temperature,
Icr = gc(Tcr), (D.22)
the critical current’s cdf is given by
FIcr (i) = P [gc(Tcr) ≤ i] = P [Tcr ≤ g−1c (i)] = FTcr (g
−1c (i)), (D.23)
where FTcr is the cdf of the ambient temperature and because gc is a monoticaly increasing function.
By the linearization of qc and qr, the critical current can be expressed by
Icr =√c′0 + c1Tcr (D.24)
4Some properties like the viscosity, density and thermal conductivity of the air near the conductor depends however
on the film temperature which is the mean between the conductor and the ambient temperature.
155
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
where c′0 and c1 are positive constants. We have then
FIcr (i) = FTcr
(i2 − c′0c1
). (D.25)
However, no data seems to exist in the literature on the statistical distribution of the vegetation
height below overhead power lines, which means that the function FTcr is unknown. This implies
that the impact of the vegetation height dispersion on the probability of line tripping in function of
its loading cannot be known. In order to estimate the influence, we propose to compute the standard
deviation of the critical current in function of the standard deviation of the critical temperature.
If the ambient temperature is modeled as a random normal variable of mean µTcr and standard
deviation σTcr , we have
FIcr (i) = Φ
(i2 − c′0 − c1µTcr
c1σTcr
). (D.26)
The standard deviation of the critical current in function of the standard deviation of the critical
temperature, computed from this expression for a mean critical temperature of 100C is given in
Figure D.10. The ambien temperature, the wind speed and the wind direction were respectively
chosen to 10.06C, 3.1121m/s and perpendicular to the conductor. From these results and by
approximating the link between the link between the critical temperature and the vegetation height
by a linear relation (see Figure D.9), the standard deviation of the critical current in function of
the standard deviation can be computed, as shown in Figure D.11. If the standard deviation of the
vegetation height is greater than 0.5 meter5, the impact of the vegetation height distribution on
the probability of line tripping in function of its loading can become important, compared to the
influence of weather conditions.
Figure D.10: Standard deviation of the critical current in function of the standard deviation of the
critical temperature.
D.3.6 Conclusions
When the operators corrective actions are neglected, there are two main factors influencing the
critical current: the weather and the vegetation height. When only weather conditions are considered
variable, the probability distribution of the critical current looks like a Gaussian. In this case, the
main factor explaining the variability of the critical current is the wind speed. This is coherent with
the sensitivity analysis performed in [102], which shows that “the wind velocity plays a crucial role
in the thermal balance of overhead conductors”. The impact of the latter is difficult to establish
because the statistical distribution of the vegetation height below overhead lines does to seem to
be already studied. However, when one considers a credible range of variation, its influence seems
5A standard deviation equal to 0.5 meter means that the probability to find the vegetation height in an interval
of 1 meter centered on the mean is equal to 0.95.
156
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
Figure D.11: Standard deviation of the critical current in function of the standard deviation of the
vegetation height.
to be on the same order of magnitude of the weather’s influence. Consequently, we think that the
vegetation height distribution below overhead power lines should be studied.
D.4 Numerical results
D.4.1 Test systems
The first test system is an adaptation of the Kundur’s two-area test system [14] with some lines
doubled. The modified network is shown in Figure D.12. It is nearly the same that the one presented
in Appendix B.2, but not completely. The second test system is a adaptation of a reduced-order
Figure D.12: Mini Test System. Adapted from [14].
equivalent of the interconnected New England Test System (NETS) and New York Power System
(NYPS) with three other neighboring regions. It is the same that the one presented in Appendix
B.1. The modified network is shown in Figure D.13.
D.4.2 Models used
In Subsection D.2.1, we presented three behaviors of the evolution of the probability of tripping
in function of (over)load: linear, exponential and normal cdf. We propose to generalize the linear
and exponential models in the following way:
• If the load is lower than a parameter k1, the thermal probability of failure is null.
• If the load is higher than a parameter k2, the thermal probability of failure is equal to one.
• If the load is between k1 and k2, the thermal probability of failure evolves between 0 and 1
according to the corresponding law.
157
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
Figure D.13: Blackout Test System.
Consequently, the mathematical formulations of the thermal probability of failure are
Pth(x) =
0 for 0 ≤ x ≤ k1
2x−k1k2−k1 − 1 for k1 < x < k2
1 for x ≥ k2
(D.27)
for the exponential model,
Pth(x) =
0 for 0 ≤ x ≤ k1x−k1k2−k1 for k1 < x < k2
1 for x ≥ k2
(D.28)
for the linear model, and
Pth(x) = Φ
(x− µσ
)(D.29)
for the normal cdf model.
D.4.3 Modeling assumptions
In order to improve the efficiency of the simulation, we will use some simplifications:
• For the vegetation height, we will choose a unique distance between lines suspension points and
vegetation for all lines and all histories. This distance is such that the probability of having a
short circuit with the ground in a normal situation (no contingency) is 10−x for the Mini Test
System and 10−y for the BOTS.
• For the electrical instability of the system, we consider only voltage and frequency instabilities.
• Average failure rates are taken as their nominal values in nominal conditions.
• In order to model the fact that the system is put back in a secure state after a period of time,
we consider the system thermally stable if there is no new contingency during T = 60min.
In particular, this implies that the probability to have a line failure independent of its load is
given by
Pind = 1− exp(−λT ) (D.30)
where λ is the average failure rate of the line. For both test systems and all lines, λ = 1hr, so
Pind = 1.1416× 10−4. We call “weak corrective actions model” a model which considers only
this fact for operators corrective actions.
158
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
• Initial conditions (load pattern and climatic conditions, sampled at the beginning of each
history) are kept constant during each history.
D.4.4 Mini Test System - weak corrective actions model
The probability of a line tripping in function of its load given by dynamic PRA level-I methodology
is given in Figure D.14. Even if this is a monotonically increasing function of the load, saturating at
1, the behavior does not seem to reflect perfectly one of the proposed models. In order to estimate
what could be the best model, we proposed to find “best parameters” for each model and to compare
the different mean absolute percentage error (MAPE). The “best parameters” are the parameters
minimizing the MAPE under the constraint that they give the same total frequency of dangerous
scenarios as the dynamic PRA level-I methodology. They are given in Table D.2. These three models
are shown in Figure D.15. Even if the MAPE are similar, the exponential model seems graphically
to fit better results: the two others models, and particularly the linear, fit very well some points but
very bad other points.
Figure D.14: Probability of line tripping in function of load - Mini Test System.
Model Parameter 1 Parameter 2 MAPE
Exponential k1 = 80.5% k2 = 193.1% 31%
Linear k1 = 89% k2 = 14250% 35%
Normal cdf µ = 229.5% σ = 38.9% 39%
Table D.2: Best parameters for the Mini Test System.
Figure D.15: Three models for the probability of line tripping in function of load - Mini Test System.
159
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
D.4.5 Blackout Test System - weak corrective actions model
The probability of a line tripping in function of its load given by dynamic PRA level-I methodology
is given in Figure D.16. It is globally increasing function of the load, saturating at 1. However, the
Figure D.16 does not show a perfectly monotonically increasing function, because the statistic is
bad for high loads. The best parameters for the three models are given in Table D.3. These models
are shown in Figure D.17. Graphically, two models seem to be convenient: the exponential one and
the normal cdf one. The MAPE of the exponential model is slightly lower. The linear model does
not give good results compared to the two others.
Figure D.16: Probability of line tripping in function of load - Blackout Test System.
Model Parameter 1 Parameter 2 MAPE
Exponential k1 = 66% k2 = 160% 20%
Linear k1 = 116% k2 = 187% 34%
Normal cdf µ = 158% σ = 20.7% 22%
Table D.3: Best parameters for the Blackout Test System.
Figure D.17: Three models for the probability of line tripping in function of load - Blackout Test
System.
D.4.6 Mini Test System - strong corrective actions model
In addition with the fact that the system is considered thermally stable if there is no new contin-
gency during T = 60min, we propose to model the elimination of lines’ overloads by the operators
in the following way. If a the load of a line between buses 5-6 or 10-11 is higher than 90% of its
nominal current (due to the trip of the other line between the same buses), the operators can relieve
160
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
this overload by decreasing the generation in power plant 1 or 3 and increasing the generation in
power plant 2 or 4, respectively,
• After 10 minutes with a probability of 0.1,
• After 15 minutes with a probability of 0.2,
• After 20 minutes with a probability of 0.2,
• After 25 minutes with a probability of 0.2,
• After 30 minutes with a probability of 0.1.
The probability to fail to relieve the overload is then 0.2. The probability of a line tripping in
function of its load given by dynamic PRA level-I methodology in such a case is given in Figure
D.18. Compared to the Figure D.14, we can observe that the relieving of overloads with the model
proposed reduces probability of line trips. This reduction is higher for low overloads and is negligible
after approximately 150%. This fact can be explained by the competition between thermal transients
and operators corrective actions: at high overload, the critical temperature is reached so fast that
operators have not the time to change the generation in order to relieve the overload. The best
parameters for the three models are given in Table D.4. These models are shown in Figure D.19.
None of them seems to be convenient: they are not able to reproduce a increasing rate of the
probability low for weak overloads and high for strong overload. The exponential model can be
easily adapted to take into account this behavior by using the formula
Pth(x) =
0 for 0 ≤ x ≤ k1
2
(x−k1k2−k1
)α− 1 for k1 < x < k2
1 for x ≥ k2
, (D.31)
where α ≥ 1. For example, if we choose α = 2, the minimum MAPE is equal to 27% and is
reached when (k1, k2) = (65, 179). This model is shown in Figure D.19 and graphically seems to be
convenient. Therefore, we suggest to use this extended exponential model to include the effect of
operators’ actions. The exponent α is is even greater that operators take actions quickly.
Figure D.18: Probability of line tripping in function of load - Mini Test System with strong corrective
actions model.
Model Parameter 1 Parameter 2 MAPE
Exponential k1 = 72% k2 = 301% 38%
Linear k1 = 80% k2 = 69500% 39%
Normal cdf µ = 316% σ = 60.7% 39%
Table D.4: Best parameters for the Mini Test System with strong corrective actions model.
161
APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES
Figure D.19: Four models for the probability of line tripping in function of load - Mini Test System
with strong corrective actions model.
D.5 Conclusions
Line outages due to overload are often the main contributors to the cascading failures. Indeed,
the more a line is overloaded, the larger is its sagging, and hence the probability that it will be
tripped due to a short-circuit with the ground (e.g. tree flashover). It is necessary to quantify in a
realistic way the probability of trip as a function of the load in order to compute a good estimation
of the frequency of dangerous cascading outages. We reminded in this paper that several models
were proposed for this purpose, but none of them is backed up by empirical evidence or detailed
analysis. Then, we studied factors that could affect the probability of trip as a function of load. We
showed that, among climatic conditions, the wind speed has a great impact on the variability of the
tripping current, and so on the probability of trip as a function of load. The statistical distribution
of the vegetation height below overhead lines could also has an important impact on the tripping
current. Unfortunately, no data seems to exist on that. Finally, we computed this probability for
two different test systems using a temperature simulation based methodology, called dynamic PRA
level-I analysis. We showed that the extended exponential model seems to be the most convenient,
as it is the most resilient.
162
Bibliography
[1] Terna. Annual reports 2007-2011. http://www.terna.it/.
[2] Investigation Committee of UCTE. Final report of the investigation committee on the 28
September 2003 blackout in Italy. Technical report, UCTE, 2004.
[3] U.S.-Canada Power System Outage Task Force. Final report on the August 14, 2003 blackout
in the United States and Canada. Technical report, 2004.
[4] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. A level-1 probabilistic risk
assessment to blackout hazard in transmission power systems. Reliability Engineering & System
Safety, 102(0):41 – 52, 2012.
[5] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Blackout probabilistic risk
assessment and thermal effects: impacts of changes in generation. IEEE Transactions on
Power Systems, PP(99):1–10, 2013.
[6] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Towards an integrated
probabilistic analysis of the blackout risk in transmission power systems. In Proceedings of
the ANS PSA 2011 International Topical Meeting on Probabilistic Safety Assessment and
Analysis, Wilmington, NC, USA, 2011.
[7] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Role of thermal effects in
blackout probabilistic risk assessment. In 2011 IEEE Electrical Power and Energy Conference
(IEEE EPEC 2011), pages 266–271, Winnipeg, Canada, October 2011.
[8] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Blackout pra based iden-
tification of critical initial conditions and contingencies. In 12th International Conference
on Probabilistic Methods Applied to Power Systems (PMAPS 2012), pages 50–54, Istanbul,
Turkey, June 2012.
[9] Pierre Henneaux, Farshid Faghihi, Pierre-Etienne Labeau, and Jean-Claude Maun. Towards a
3-level blackout probabilistic risk assessment: achievements and challenges. In Proceedings of
the IEEE Power & Energy Society General Meeting 2013, Vancouver, BC, Canada, July 2013.
[10] Antonio Gomez Exposito, Antonio J Conejo, and Claudio Canizare. Electric Energy Systems:
Analysis and Operation. CRC Press, 2009.
[11] Roy Billinton and Ronald N. Allan. Reliability evaluation of power systems. Plenum Press,
1996.
[12] RTE Reseau de Transport d’Electricite. Media gallery of the RTE website. http://www.
rte-france.com/en/mediatheque - 12th of July, 2013.
[13] Michel Pays. Cables de transport d’energie. technologies. caracteristiques. Technical Report
D 4 520, Techniques de l’Ingenieur, 1994.
163
BIBLIOGRAPHY
[14] Prabha Kundur. Power System Stability and Control. McGraw-Hill, 1994.
[15] Thierry Van Cutsem and Costas Vournas. Voltage stability of electric power systems, volume
441. Springer, 1998.
[16] Benjamin Genet. On monitoring methods and load modeling to improve voltage stability as-
sessment efficiency. PhD thesis, Universite libre de Bruxelles, 2009.
[17] P.M. Anderson. Power System Protection. Wiley-Interscience, 1999.
[18] Stanley H. Horowitz and Arun G. Phadke. Power system relaying. Research Studies Press
Limited. John Wiley & Sons, 2008.
[19] P. Kundur, J. Paserba, V. Ajjarapu, G. Andersson, A. Bose, C. Canizares, N. Hatziargyriou,
D. Hill, A. Stankovic, C. Taylor, T. Van Cutsem, and V. Vittal. Definition and classification
of power system stability ieee/cigre joint task force on stability terms and definitions. Power
Systems, IEEE Transactions on, 19(3):1387–1401, 2004.
[20] ENTSO-E. Draft Network Code for Operational Security, 2012.
[21] Marko Cepin. Assessment of Power System Reliability – Methods and Applications. Springer
Verlag, 2011.
[22] Disturbance Analysis Working Group of the NERC. Review of selected 1996 electric system
disturbances in North America. Technical report, North American Electric Reliability Council,
2002.
[23] S. Larsson and A. Danell. The black-out in southern Sweden and eastern Denmark, September
23, 2003. In Proceedings of the 2006 IEEE PES Power Systems Conference and Exposition,
PSCE 2006, pages 309–313, 2006.
[24] Investigation Committee of UCTE. Final report - system disturbance on 4 November 2006.
Technical report, UCTE, 2007.
[25] S. Tamronglak, S.H. Horowitz, A.G. Phadke, and J.S. Thorp. Anatomy of power system
blackouts: Preventive relaying strategies. IEEE Transactions on Power Delivery, 11(2):708–
714, 1996.
[26] Wei Lu, Yvon Besanger, Eric Zamaı, and Daniel Radu. Blackouts: Description, analysis and
classification. In Proceedings of the 6th WSEAS International Conference on Power Systems,
Lisbon, Portugal, 2006.
[27] International Electrotechnical Commission. Iec 60050 - international electrotechnical vocabu-
lary. http://www.electropedia.org/ - 14th of July, 2013.
[28] Hiromitsu Kumamoto and Ernest J. Henley. Probabilistic risk assessment and management
for engineers and scientists. IEEE Press, 1996.
[29] Oxford University Press. Oxford advanced learner’s dictionary of current English, seventh
edition edition, 2005.
[30] International Nuclear Safety Advisory Group. Basic safety principles for nuclear power plants
- insag-3. Technical report, IAEA, 1988.
[31] International Nuclear Safety Advisory Group. Defence in depth in nuclear safety - insag-10.
Technical report, IAEA, 1996.
[32] David Bodansky. Nuclear Energy - Principles, Practices, and Prospects. Springer, 2005.
164
BIBLIOGRAPHY
[33] U.S. Nuclear Regulatory Commission (NRC). An approach for determining the technical ad-
equacy of probabilistic risk assessment results for risk-informed activities - Regulatory Guide
1.200, 2009.
[34] W. Li. Risk Assessment Of Power Systems: Models, Methods, and Applications. IEEE Press
Series on Power Engineering. John Wiley & Sons, 2005.
[35] Mario Lefebvre. Applied Probability and Statistics. Springer, 2006.
[36] Jacques Devooght and Carol Smidts. Probabilistic dynamics as a tool for dynamic PSA.
Reliability Engineering & System Safety, 52(3):185 – 196, 1996.
[37] Jacques Devooght and Carol Smidts. Probabilistic dynamics; the mathematical and computing
problems ahead. In Reliability and Safety Assessment of Dynamic Process Systems, volume
120 of NATO ASI Series F, pages 85–100. Springer-Verlag, 1994.
[38] Power Systems Engineering Committee. Reliability indices for use in bulk power supply ade-
quacy evaluation. IEEE Transactions on Power Apparatus and Systems, PAS-97(4):1097–1103,
1978.
[39] Tractebel Engineering GDF Suez. SCANNER - probabilistic tool. http://www.eurostag.
be/en/products/other-compatible-products/scanner/scanner-probabilistic-tool/ -
12th of July, 2013.
[40] DIgSILENT GmbH. DIgSILENT PowerFactory Version 15 - User Manual, 2013.
[41] I. Dobson, B. A. Carreras, and D. E. Newman. A loading-dependent model of probabilistic
cascading failure. Probability in the Engineering and Informational Sciences, 19(1):15–32,
2005.
[42] B.A. Carreras, V.E. Lynch, I. Dobson, and D.E. Newman. Critical points and transitions in
an electric power transmission model for cascading failure blackouts. Chaos, 12(4):985–994,
2002.
[43] Benjamin A. Carreras, David E. Newman, Ian Dobson, and Naga S. Degala. Validating OPA
with WECC data. In Proceedings of the 46th Hawaii International Conference on System
Sciences (HICSS), pages 2197–2204, 2013.
[44] Junjian Qi, Shengwei Mei, and Feng Liu. Blackout model considering slow process. IEEE
Transactions on Power Systems, 23(8):3274 – 3282, 2013.
[45] EPRI. TRELSS Application Manual: For Cascading Failure, Reliability and Deterministic
Analysis, 2003. Palo Alto, CA, 1002637.
[46] Mario A. Rios, Daniel S. Kirschen, Dilan Jayaweera, Dusko P. Nedic, and Ron N. Allan. Value
of security: Modeling time-dependent phenomena and weather conditions. IEEE Transactions
on Power Systems, 17(3):543 – 548, 2002.
[47] M. Anghel, K.A. Werley, and A.E. Motter. Stochastic model for power grid dynamics. In Pro-
ceedings of the 40th Annual Hawaii International Conference on System Sciences (HICSS’07),
page 113, Washington, DC, USA, 2007. IEEE Computer Society.
[48] Andrija Volkanovski, Marko Cepin, and Borut Mavko. Application of the fault tree analysis
for assessment of power system reliability. Reliability Engineering & System Safety, 94(6):1116
– 1127, 2009.
165
BIBLIOGRAPHY
[49] M. Vaiman, K. Bell, Y. Chen, B. Chowdhury, I. Dobson, P. Hines, M. Papic, S. Miller, and
P. Zhang. Risk assessment of cascading outages: Methodologies and challenges. IEEE Trans-
actions on Power Systems, 27(2):631–641, 2012.
[50] Dusko P. Nedic. Simulation Of Large System Disturbances. PhD thesis, University of Manch-
ester Institute for Science and Technology, 2003.
[51] Liisa Haarla, Urho Pulkkinen, Mikko Koskinen, and Jussi Jyrinsalo. A method for analysing
the reliability of a transmission grid. Reliability Engineering & System Safety, 93(2):277 – 287,
2008.
[52] Liisa Haarla, Mikko Koskinen, Pierre-Etienne Labeau, and Ritva Hirvonen. Transmission Grid
Security - A PSA approach. Springer, 2011.
[53] Qiming Chen. The probability, identification, and prevention of rare events in power systems.
PhD thesis, Iowa State University, 2004.
[54] Javier Hortal and JoseM. Izquierdo. Application of the integrated safety assessment method-
ology to the protection of electric systems. Reliability Engineering & System Safety, 52(3):315
– 326, 1996.
[55] IEEE Power Engineering Society, USA. IEEE Standard for Calculating the Current-
Temperature of Bare Overhead Conductors, 2006.
[56] Tony Weekes, Tom Molinski, and Glenn Swift. Transient transformer overload ratings and
protection. IEEE Electrical Insulation Magazine, 20(2):32 – 35, 2004.
[57] Friedrich Kiessling, Peter Nefzger, and Joao Felix Nolasco adn Ulf Kaintzyk. Overhead Power
Lines. Springer, 2003.
[58] A. F. Brandao. A model for substation reliability analysis including overload effects. Interna-
tional Journal of Electrical Power & Energy Systems, 9(4):194 – 205, 1987.
[59] G. Bahder, M. Sosnowski, C. Katz, R. Eaton, and K. Klein. Electrical breakdown charac-
teristics and testing of high voltage XLPE and EPR insulated cables. IEEE Transactions on
Power Apparatus and Systems, 102(7):2173 – 2185, 1983.
[60] P. Metra, E. Occhini, and G. Portinari. High voltage cables with extruded insulation. statistical
controls and reliability evaluation. IEEE Transactions on Power Apparatus and Systems,
94(3):967 – 976, 1975.
[61] D. Fabiani and L. Simoni. Discussion on application of the weibull distribution to electrical
breakdown of insulating materials. IEEE Transactions on Dielectrics and Electrical Insulation,
12(1):11 – 16, 2005.
[62] G.H. Kaufmann and C.J. McMillen. Gas bubble studies and impulse tests on distribution
transformers during loading above nameplate rating. IEEE Transactions on Power Apparatus
and Systems, 102(8):2531 – 2542, 1983.
[63] P.E. Labeau and E. Zio. Procedures of monte carlo transport simulation for applications in
system engineering. Reliability Engineering & System Safety, 77(3):217 – 228, 2002.
[64] Georgios Papaefthymiou. Integration of Stochastic Generation in Power Systems. PhD thesis,
Technische Universiteit Delft, 2007.
[65] U.S. Nuclear Regulatory Commission (NRC). Severe Accident Risks: An Assessment for Five
U.S. Nuclear Power Plants - NUREG 1150, 1990.
166
BIBLIOGRAPHY
[66] K. Metzroth, D. Mandelli, A. Yilmaz, R. Denning, and T. Aldemir. A comparison of scenario
binning methods for dynamic probabilistic risk assessment. In Advances in Safety, Reliability
and Risk Management - Proceedings of the European Safety and Reliability Conference, ESREL
2011, pages 261–268, 2012.
[67] Diego Mandelli. Scenario clustering and dynamic probabilistic risk assessment. PhD thesis,
The Ohio State University, 2011.
[68] P. E. Labeau and J. M. Izquierdo. Modeling PSA problems - I: The stimulus-driven theory of
probabilistic dynamics. Nuclear Science and Engineering, 150(2):115–139, 2005.
[69] Farshid Faghihi, Pierre Henneaux, and Pierre-Etienne Labeau. Dynamic probabilistic risk
analysis of the fast cascade phase of large disturbances in power system. In Proceedings of the
PSAM 11 & ESREL 2012 conference, Helsinki, Finland, June 2012.
[70] G. Rogers. Power System Oscilations. The Kluwer International Series in Engineering and
Computer Science: Power Electronics and Power Systems. Kluwer Academic, 2000.
[71] C. Grigg, P. Wong, P. Albrecht, R. Allan, M. Bhavaraju, R. Billinton, Q. Chen, C. Fong,
S. Haddad, S. Kuruganty, W. Li, R. Mukerji, D. Patton, N. Rau, D. Reppen, A. Schneider,
M. Shahidehpour, and C. Singh. The IEEE reliability test system-1996. A report prepared by
the reliability test system task force of the application of probability methods subcommittee.
IEEE Transactions on Power Systems, 14(3):1010 –1020, aug 1999.
[72] Koninklijk Nederlands Meteorologisch Instituut (KNMI). Potentiele wind in neder-
land. http://www.knmi.nl/klimatologie/onderzoeksgegevens/potentiele_wind/ - 12th
of July, 2013.
[73] J. V. Seguro and T. W. Lambert. Modern estimation of the parameters of the weibull wind
speed distribution for wind energy analysis. Journal of Wind Engineering and Industrial
Aerodynamics, 85(1):75 – 84, 2000.
[74] Yaping Shao. Physics and Modelling of Wind Erosion. Springer Science, 2008.
[75] W. E. Vesely, T. C. Davis, R. S. Denning, and N. Saltos. Measures of Risk Importance And
Their Applications - NUREG/CR-3385. U.S. Nuclear Regulatory Commission (NRC), 1986.
[76] Michael C. Cheok, Gareth W. Parry, and Richard R. Sherry. Use of importance measures in
risk-informed regulatory applications. Reliability Engineering & System Safety, 60(3):213 –
226, 1998.
[77] Timothy A. Davis. UMFPACK: unsymmetric multifrontal sparse lu factorization package.
http://www.cise.ufl.edu/research/sparse/umfpack/ - 12th of July, 2013.
[78] P.M. Anderson and M. Mirheydar. A low-order system frequency response model. IEEE
Transactions on Power Systems, 5(3):720–729, 1990.
[79] Y. Yu, D. Gan, H. Wu, and Z. Han. Frequency induced risk assessment for a power sys-
tem accounting uncertainties in operation of protective equipments. International Journal of
Electrical Power & Energy Systems, 32(6):688 – 696, 2010.
[80] N. Dizdarevic, M. Majstrovic, S. Cujic Coko, N. Mandic, and J. Benovic. Causes, analysis
and countermeasures with respect to blackout in croatia on january 12, 2003. In The CRIS
International Workshop on Power System Blackout, pages 1–21, Lund, Sweden, 2004.
[81] A.G. Phadke, S.H. Horowitz, and J.S. Thorp. Anatomy of power system blackouts and pre-
ventive strategies by rational supervision and control of protection systems. Technical report,
Oak Ridge National Laboratory, 1995.
167
BIBLIOGRAPHY
[82] J.S. Thorp, A.G. Phadke, S.H. Horowitz, and S. Tamronglak. Anatomy of power system
disturbances: Importance sampling. International Journal of Electrical Power and Energy
Systems, 20(2):147–152, 1997.
[83] Liisa Pottonen. A method for the probabilistic security analysis of transmission grids. PhD
thesis, Helsinki University of Technology, 2005.
[84] Jarno Lamponen and Liisa Haarla. Computing dynamic instability of a power system after
relay failures. In Proceedings of the 17th Power Systems Computation Conference (PSCC),
2011.
[85] IEEE Task Force on Load Representation for Dynamic Performance. Standard load models
for power flow and dynamic performance simulation. IEEE Transactions on Power Systems,
10(3):1302–1313, Aug.
[86] D.J. Hill. Nonlinear dynamic load models with recovery for voltage stability studies. IEEE
Transactions on Power Systems, 8(1):166–176, 1993.
[87] Daniel Karlsson. Voltage stability simulations using detailed models based on field measure-
ments. Technical report, Chalmers University of Technology, 1992.
[88] R.B. Duffey and Taesung Ha. The probability and timing of power system restoration. IEEE
Transactions on Power Systems, 28(1):3–9, 2013.
[89] Ivan Lux and Laszlo Koblinger. Monte Carlo particle transport methods: neutron and photon
calculations. CRC Press, 1991.
[90] W. Q. Meeker and L. A. Escobar. Statistical Methods for Reliability Data. John Wiley & Sons,
Inc., 1998.
[91] Bruno Sudret. Analytical derivation of the outcrossing rate in time-variant reliability problems.
Structure and Infrastructure Engineering, 4(5):353–362, 2008.
[92] C. Andrieu-Renaud, B. Sudret, and M. Lemaire. The PHI2 method: a way to compute time-
variant reliability. Reliability Engineering & System Safety, 84(1):75 – 86, 2004. Selected
papers from ESREL 2002.
[93] Alain Pages and Michel Gondran. Fiabilite des systemes. Eyrolles, 1980.
[94] Bikash Pal and Balarko Chaudhuri. Robust Control in Power Systems. Springer, 2005.
[95] J.J. LaForest, editor. Transmission Line Reference Book. Electric Power Research Institute,
1982.
[96] IEEE recommended practice for excitation system models for power system stability studies.
IEEE Std 421.5-2005 (Revision of IEEE Std 421.5-1992), pages 1 –85, 2006.
[97] M. Zima and G. Andersson. On security criteria in power systems operation. In Proceedings
of the 2005 IEEE Power Engineering Society General Meeting, volume 3, pages 3089 – 3093,
June 2005.
[98] Jie Chen, James S. Thorp, and Ian Dobson. Cascading dynamics and mitigation assessment
in power system disturbances via a hidden failure model. International Journal of Electrical
Power & Energy Systems, 27(4):318 – 326, 2005.
[99] Stephen T. Lee. Estimating the probability of cascading outages in a power grid. In Proceedings
of the 8th Power System Computation Conference (PSCC), Jul 2008.
168
BIBLIOGRAPHY
[100] N. Bhatt, S. Sarawgi, R. O’Keefe, P. Duggan, M. Koenig, M. Leschuk, S. Lee, K. Sun, V. Kol-
luri, S. Mandal, M. Peterson, D. Brotzman, S. Hedden, E. Litvinov, S. Maslennikov, X. Luo,
E. Uzunovic, B. Fardanesh, L. Hopkins, A. Mander, K. Carman, M.Y. Vaiman, M.M. Vaiman,
and M. M. Povolotskiy. Assessing vulnerability to cascading outages. In Proceedings of the
2009 IEEE/PES Power Systems Conference and Exposition (PSCE2009), 2009.
[101] H. Wan, J.D. McCalley, and V. Vittal. Increasing thermal rating by risk analysis. IEEE
Transactions on Power Systems, 14(3):815–828, 1999.
[102] Juliano S.A. Carneiro and Luca Ferrarini. A probabilistic protection against thermal overloads
of transmission lines. Electric Power Systems Research, 81(10):1874 – 1880, 2011.
169