A two-level Probabilistic Risk Assessment of cascading ...student.ulb.ac.be/~phenneau/These.pdf · l’ electricit e est disponible a ... especially about the fast cascade and failures

Annee academique 2012 - 2013Universite libre de Bruxelles

Ecole polytechnique de Bruxelles

These presentee en vue de

l’obtention du grade de

Docteur en Sciences de l’Ingenieur

Promoteur : Prof. Pierre-Etienne Labeau

Co-Promoteur : Prof. Jean-Claude Maun

Membres du jury :

Prof. Michel Kinnaert (President)

Prof. Benjamin Genet (Secretaire)

Prof. Damien Ernst

Dr. Jonathan Sprooten

Dr. Andrija Volkanovski

A two-levelProbabilistic Risk Assessment

of cascading failures leading to blackoutin transmission power systems

Pierre Henneaux

II

Resume

Dans notre societe, les activites privees et industrielles reposent sur l’hypothese implicite que

l’electricite est disponible a tout moment et a cout raisonnable. Bien que le retour d’experience du

secteur electrique est tres favorable, la production, la transmission et la distribution de l’electricite ne

peuvent pas etre considerees comme des activites totalement fiables. Un risque residuel de blackout

ou de delestage de charge indesire dans certaines zones demeure. L’occurrence d’un tel evenement a

des consequences economiques directes et indirectes desastreuses. L’evaluation de ce risque residuel

et l’identification des scenarios susceptibles d’y contribuer sont cruciaux pour controler et reduire

de maniere optimale ce risque de blackout ou de perturbation majeure. L’objectif de cette these est

le developpement d’une methodologie capable de reveler les scenarios conduisant a un blackout et

d’estimer leurs frequences et leurs consequences avec une precision satisfaisante.

Un blackout est un effondrement du reseau electrique sur une zone geographique etendue, con-

duisant a une coupure de courant, et est du a des defaillances en cascade. Une telle cascade est

composee de deux phases : une cascade lente, debutant avec l’occurrence d’un evenement initiateur

et de temps caracteristiques entre evenements successifs de quelques minutes a quelques heures, et

une cascade rapide, de temps caracteristiques entre evenements successifs de quelques millisecondes

a quelques dizaines de secondes. Dans des defaillances en cascade, il y a un grand couplage entre

evenements : la perte d’un element augmente le stress sur les autres elements et, ainsi, la probabilite

d’avoir une autre defaillance. Il apparaıt que les methodes probabilistes precedemment proposees

ne prennent pas en compte correctement cette dependance entre defaillances, essentiellement car

les deux phases tres differentes sont analysees avec le meme modele. Il y a donc un besoin de

developper une approche probabiliste integree conceptuellement satisfaisante, capable de prendre en

compte toutes les dependances, en utilisant des modeles differents pour la cascade lente et la cascade

rapide. C’est le but de cette these de doctorat.

Ce travail se concentre d’abord sur le niveau I, l’analyse de la progression de la cascade lente

jusqu’a la transition vers la cascade rapide. Nous proposons d’adapter les methodes de la fiabilite

dynamique, developpees initialement pour le domaine nucleaire, au cas des reseaux de transport

electriques. Cette methodologie prendra en compte la double interaction entre la dynamique du

reseau electrique et les changements d’etat des elements du reseau. Cette these introduit egalement

le developement du niveau II pour analyser la cascade rapide, jusqu’a la transition vers un etat

operationnel avec de la charge delestee ou un blackout. La methode proposee est appliquee a deux

reseaux tests. Les resultats montrent que les effets thermiques peuvent jouer un role important

dans les defaillances en cascade, durant la premiere phase. Ils montrent aussi qu’une analyse de

niveau II apres une analyse de niveau I est necessaire pour avoir une estimation de la puissance non

fournie auquel un scenario peut conduire : deux types de scenarios de niveau I de frequence similaire

peuvent induire des risques (en termes de puissance non fournie) et des frequences de blackout tres

differents. L’analyse du processus de restauration (niveau III), est cependant necessaire pour avoir

une estimation du risque en termes d’energie non fournie. Cette these presente egalement plusieurs

perspectives pour ameliorer l’approche afin de pouvoir etendre les applications a des reseaux reels.

i

Summary

In our society, private and industrial activities increasingly rest on the implicit assumption that

electricity is available at any time and at an affordable price. Even if operational data and feedback

from the electrical sector is very positive, a residual risk of blackout or undesired load shedding

in critical zones remains. The occurrence of such a situation is likely to entail major direct and

indirect economical consequences, as observed in recent blackouts. Assessing this residual risk and

identifying scenarios likely to lead to these feared situations is crucial to control and optimally reduce

this risk of blackout or major system disturbance. The objective of this PhD thesis is to develop

a methodology able to reveal scenarios leading to a blackout or a major system disturbance and to

estimate their frequencies and their consequences with a satisfactory accuracy.

A blackout is a collapse of the electrical grid on a large area, leading to a power cutoff, and is due

to a cascading failure. Such a cascade is composed of two phases: a slow cascade, starting with the

occurrence of an initiating event and displaying characteristic times between successive events from

minutes to hours, and a fast cascade, displaying characteristic times between successive events from

milliseconds to tens of seconds. In cascading failures, there is a strong coupling between events: the

loss of an element increases the stress on other elements and, hence, the probability to have another

failure. It appears that probabilistic methods proposed previously do not consider correctly these

dependencies between failures, mainly because the two very different phases are analyzed with the

same model. Thus, there is a need to develop a conceptually satisfying probabilistic approach, able

to take into account all kinds of dependencies, by using different models for the slow and the fast

cascades. This is the aim of this PhD thesis.

This work first focuses on the level-I which is the analysis of the slow cascade progression up to

the transition to the fast cascade. We propose to adapt dynamic reliability, an integrated approach

of Probabilistic Risk Analysis (PRA) developed initially for the nuclear sector, to the case of trans-

mission power systems. This methodology will account for the double interaction between power

system dynamics and state transitions of the grid elements. This PhD thesis also introduces the

development of the level-II to analyze the fast cascade, up to the transition towards an operational

state with load shedding or a blackout. The proposed method is applied to two test systems. Results

show that thermal effects can play an important role in cascading failures, during the first phase.

They also show that the level-II analysis after the level-I is necessary to have an estimation of the loss

of supplied power that a scenario can lead to: two types of level-I scenarios with a similar frequency

can induce very different risks (in terms of loss of supplied power) and blackout frequencies. The

level-III, i.e. the restoration process analysis, is however needed to have an estimation of the risk in

terms of loss of supplied energy. This PhD thesis also presents several perspectives to improve the

approach in order to scale up applications to real grids.

ii

Acknowledgments

First of all, I would like to thank my two supervisors, Pierre-Etienne Labeau and Jean-Claude

Maun. They proposed together this PhD thesis topic, “blackout probabilistic risk assessment”, and

they were very complementary. I am grateful to Pierre-Etienne Labeau for his absolutely invaluable

help, especially for his precious advices and his detailed answers to my questions in reliability, and

for his careful reading of scientific papers and this PhD thesis. Almost each sentence has been

commented and several paragraphs have been criticized. These comments were very interesting and

helped me to improve this PhD thesis. I am grateful to Jean-Claude Maun, incredibly knowledgeable

about power systems, for his precious advices and his detailed answers to my questions in this field.

I would like also to thank mnhp1 for its large contribution to results presented here, and all

the “Service de Metrologie Nucleaire”. In particular, I want to acknowledge Julien Callant and

Artem Napov for technical advices in numerical analysis. Special thanks to all my office fellows for

their company (Julien, Julien, Marie-Carmen, Nicolas, Husein), to Farshid for our common work,

to Laetitia for the administrative support and Alain for the Wednesday lunch.

Kiitos to Liisa Haarla for welcoming me in Finland for two months and for interesting discussions,

especially about the fast cascade and failures of protection systems.

I would like to express my gratitude to my family for providing me with continuous support

throughout my life.

Finally, I would like to thank the Fonds de la Recherche Scientifique - FNRS for my Research

Fellowship.

iii

Contents

Resume i

Summary ii

Acknowledgments iii

Contents v

List of figures viii

List of tables xii

List of acronyms xv

Introduction 1

1 Introduction to electric energy systems 5

1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.2 Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.2.1 Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.2.2 Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1.3 Static analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.3.1 Components models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.3.2 Load flow analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.3.3 Optimal power flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.4 Dynamic analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.4.1 Components models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.4.2 Protection systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.4.3 Eigenvalue analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.4.4 Dynamic simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.4.5 Angle, voltage and frequency stability . . . . . . . . . . . . . . . . . . . . . . 15

2 Blackouts and major system disturbances 19

2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

2.2 United States, 1996 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

2.3 United States & Canada, 2003 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

2.4 Sweden & Denmark, 2003 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

2.5 Italy, 2003 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

2.6 Europe, 2006 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

2.7 Typical blackout development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

v

3 Introduction on reliability analysis methodologies 33

3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

3.1.1 Reliability of components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

3.1.2 Formal definitions of risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

3.1.3 Nuclear safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

3.1.4 Organization of this Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

3.2 Scenario based risk estimation methodologies . . . . . . . . . . . . . . . . . . . . . . 38

3.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

3.2.2 Event trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

3.2.3 Fault trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

3.3 State based risk estimation methodologies . . . . . . . . . . . . . . . . . . . . . . . . 41

3.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

3.3.2 State graph . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

3.3.3 Markovian systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

3.3.4 Semi-Markovian and non-Markovian systems . . . . . . . . . . . . . . . . . . 44

3.3.5 State enumeration approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

3.3.6 Monte Carlo simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

3.4 Dynamic reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

3.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

4 Reliability of electrical grids - state of the art 49

4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

4.2 Deterministic studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

4.3 Probabilistic studies - HLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

4.4 Probabilistic studies - HLII . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

4.4.1 Static methodologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

4.4.2 Cascading failure simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

4.4.3 Probabilistic methodologies and dynamic simulation . . . . . . . . . . . . . . 57

4.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

5 Blackout PRA in 3 levels 61

5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.2 Decomposition of the power system PRA in 3 levels . . . . . . . . . . . . . . . . . . 61

5.3 Level-I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5.3.1 General modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5.3.2 Temperature evolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

5.3.3 Thermal failure models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

5.3.4 Operator actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

5.3.5 Transition criteria between level-I and level-II . . . . . . . . . . . . . . . . . . 69

5.3.6 Analog simulation algorithm for the slow cascade . . . . . . . . . . . . . . . . 69

5.3.7 Biasing techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

5.4 Clustering between level-I and level-II . . . . . . . . . . . . . . . . . . . . . . . . . . 75

5.5 Level-II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

5.5.1 General modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

5.5.2 Transitions due to electrical variables . . . . . . . . . . . . . . . . . . . . . . 76

5.5.3 Fast cascade simulation algorithm . . . . . . . . . . . . . . . . . . . . . . . . 77

5.6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

6 Applications 79

6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

6.2 One-level blackout PRA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

6.2.1 Test case: data and modeling assumptions . . . . . . . . . . . . . . . . . . . . 79

6.2.2 Results for the base case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

6.2.3 Impact of vegetation height . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

6.2.4 Impact of changes in generation . . . . . . . . . . . . . . . . . . . . . . . . . . 89

6.3 Two-level blackout PRA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

6.3.1 Test case: data and modeling assumptions . . . . . . . . . . . . . . . . . . . . 93

6.3.2 Level-I: results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

6.3.3 Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

6.3.4 Level-II: results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

6.3.5 First two levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

6.4 Level-I blackout PRA efficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

6.4.1 Independent simulation algorithm . . . . . . . . . . . . . . . . . . . . . . . . 100

6.4.2 Dependent simulation algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 101

6.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

7 Perspectives 105

7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

7.2 Operators’ actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

7.3 Electrical instability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

7.4 Protection systems failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

7.5 Load modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

7.6 Level-III . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

7.7 Application to real grids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

Conclusions 111

A Failure rate of underground cables 113

A.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

A.2 State of the art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

A.2.1 PHI2 method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

A.2.2 The Weibull law for power cables . . . . . . . . . . . . . . . . . . . . . . . . . 116

A.3 Proposed modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

A.3.1 Failure rate and outcrossing rate . . . . . . . . . . . . . . . . . . . . . . . . . 117

A.3.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

A.3.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

A.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

B Test systems 123

B.1 Level-I test system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

B.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

B.1.2 Voltage and power basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

B.1.3 Lines, cables and transformers . . . . . . . . . . . . . . . . . . . . . . . . . . 124

B.1.4 Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

B.1.5 Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

B.1.6 Wind farms and wind speeds . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

B.1.7 Ambient temperature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

B.2 Two-level test system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

B.2.1 General data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

B.2.2 Thermal and mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

B.2.3 Dynamic data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

B.2.4 Relays and protections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

C Transition criteria between level-I and level-II 139

C.1 Angular transient stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

C.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

C.1.2 Simplified model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

C.1.3 Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

C.1.4 Shortcomings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

C.2 Frequency stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

C.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

C.2.2 Simplified model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

C.2.3 Steady state frequency deviation . . . . . . . . . . . . . . . . . . . . . . . . . 144

C.3 Voltage stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

D Failure probability of overhead lines 147

D.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

D.2 State of the art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

D.2.1 Cascading failures methodologies . . . . . . . . . . . . . . . . . . . . . . . . . 148

D.2.2 Increasing thermal rating by risk analysis . . . . . . . . . . . . . . . . . . . . 151

D.3 Physical bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

D.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

D.3.2 Influence of ambient temperature . . . . . . . . . . . . . . . . . . . . . . . . . 152

D.3.3 Influence of wind . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

D.3.4 Total influence of weather conditions . . . . . . . . . . . . . . . . . . . . . . . 154

D.3.5 Influence of vegetation height . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

D.3.6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

D.4 Numerical results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

D.4.1 Test systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

D.4.2 Models used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

D.4.3 Modeling assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

D.4.4 Mini Test System - weak corrective actions model . . . . . . . . . . . . . . . 159

D.4.5 Blackout Test System - weak corrective actions model . . . . . . . . . . . . . 160

D.4.6 Mini Test System - strong corrective actions model . . . . . . . . . . . . . . . 160

D.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Bibliography 169

List of Figures

1.1 Electric power system configuration and structure. . . . . . . . . . . . . . . . . . . . 6

1.2 Power transformer in a substation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1.3 Double circuit 400-kV overhead line. . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.4 Configurations of underground cables. . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.5 Typical design of underground cables. . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.6 Line equivalent model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.7 Links equivalent circuit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.8 Elements connected to a bus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.9 Power plant powering a load through one line. . . . . . . . . . . . . . . . . . . . . . . 11

1.10 P-V characteristics of the one-line system. . . . . . . . . . . . . . . . . . . . . . . . . 12

1.11 Three-zone step distance relaying to protect 100% of a line, and back up the neigh-

boring line. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

1.12 IEEE-CIGRE classification of power system stability. . . . . . . . . . . . . . . . . . . 16

1.13 Power plant powering a load through two lines. . . . . . . . . . . . . . . . . . . . . . 16

1.14 Collapse process on PV curves. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

2.1 Sequence of significant events and islands formed on August 10, 1996. . . . . . . . . 20

2.2 Rate of events during the cascade. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

2.3 Northern California island frequency during major system disturbance on August 10,

1996. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

2.4 Southern island frequency during major system disturbance on August 10, 1996. . . 22

2.5 Geography of the FirstEnergy area in August 2003. . . . . . . . . . . . . . . . . . . . 22

2.6 Cumulative effects of sequential outages on remaining 345-kV lines during cascading

failure on August 14, 2003. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

2.7 Simulated effect of prior outages on 138-kV line loadings during cascading failure on

August 14, 2003. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

2.8 Rate of line and generator trips during cascading failure on August 14, 2003. . . . . 24

2.9 Faulty disconnector in Horred during cascading failure on September 23, 2003. . . . 25

2.10 Registration of voltage in the north of Sweden during cascading failure on September

23, 2003. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

2.11 Line of separation from UCTE during cascading failure on September 28, 2003. . . . 26

2.12 Frequency versus imbalances during cascading failure on September 28, 2003. . . . . 27

2.13 Frequency recordings until area splitting during cascading failure on November 4, 2006. 27

2.14 Schematic map of the UCTE area split into three areas during cascading failure on

November 4, 2006. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

2.15 Frequency recordings after the split during cascading failure on November 4, 2006. . 29

2.16 Important characteristic times in a cascading failure. . . . . . . . . . . . . . . . . . . 29

2.17 Phases of a blackout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

2.18 Event tree after an initiating event. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

ix

3.1 Bathtub curve. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

3.2 Steam cycle for pressurized-water reactor (PWR). . . . . . . . . . . . . . . . . . . . 37

3.3 The three PRA levels in nuclear safety. . . . . . . . . . . . . . . . . . . . . . . . . . . 38

3.4 From an initiating event to the risk estimation. . . . . . . . . . . . . . . . . . . . . . 39

3.5 An event tree for a pipe-break initiating event. . . . . . . . . . . . . . . . . . . . . . 40

3.6 Example of a fault tree. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

3.7 State space diagram of a repairable component. . . . . . . . . . . . . . . . . . . . . . 42

3.8 State space diagram of a three-state repairable component with a derated state. . . . 42

3.9 State space diagram of two repairable components with a common mode failure. . . 42

3.10 Markovian state graph of two repairable components with a common mode failure. . 43

3.11 Chronological components and resulting system state transition processes. . . . . . . 46

3.12 A possible system evolution due to configuration changes. . . . . . . . . . . . . . . . 48

4.1 Reliability studies of electrical grids - classification. . . . . . . . . . . . . . . . . . . . 50

4.2 Typical flowchart for composite system risk evaluation. . . . . . . . . . . . . . . . . . 53

4.3 Flowchart of the TRELSS simulation approach. . . . . . . . . . . . . . . . . . . . . . 54

4.4 Simulation flowchart of Manchester model. . . . . . . . . . . . . . . . . . . . . . . . . 55

4.5 Typical event tree for substation events after a line fault and fault tree for the failure

of the two main protection distance to send a zone 1 trip signal to circuit breaker trip

coils. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

4.6 Illustration of halting voltage collapse by dynamic event tree. . . . . . . . . . . . . . 58

5.1 Decomposition of the power system PRA in 3 levels. . . . . . . . . . . . . . . . . . . 63

5.2 Thermal model of an underground power cable. . . . . . . . . . . . . . . . . . . . . . 65

5.3 Life distribution at constant stress of high voltage cables with extruded isolation. . . 68

5.4 Dielectric strength as a function of temperature. . . . . . . . . . . . . . . . . . . . . 68

5.5 Transformer failure rate as a function of temperature. . . . . . . . . . . . . . . . . . 69

5.6 Algorithm diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

5.7 Mother branch and new branches of a DDET. . . . . . . . . . . . . . . . . . . . . . . 77

6.1 Blackout Test System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

6.2 Mean load as a function of day hour for the four season. . . . . . . . . . . . . . . . . 80

6.3 Mean ambient temperature. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

6.4 Mean wind speed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

6.5 Distribution of line outages during dynamic level-I PRA cascades. . . . . . . . . . . 84

6.6 Total frequency of dangerous scenarios as a function of the ambient temperature. . . 86

6.7 Total frequency of dangerous scenarios as a function of the mean wind speed. . . . . 87

6.8 Total frequency of dangerous scenarios as a function of the load. . . . . . . . . . . . 87

6.9 Total frequency of dangerous scenarios as a function of the hour. . . . . . . . . . . . 87

6.10 Blackout Test System - Critical area (base case). . . . . . . . . . . . . . . . . . . . . 88

6.11 Influence of cross-border power flows on the total frequency of dangerous scenarios. . 91

6.12 Critical area for a mean power flow from NYPS to NETS of 195 MW. . . . . . . . . 91

6.13 Influence of total installed wind power on the total frequency of dangerous scenarios. 92

6.14 Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in

the NYPS (10,12) on the total frequency of dangerous scenarios - Dynamic level-I PRA. 92

6.15 Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in

the NYPS (10,12) on the total frequency of dangerous scenarios - Independent method. 93

6.16 Impact of a four-week maintenance of one unit for each NETS power plant on the

total frequency of dangerous scenarios - Dynamic level-I PRA. . . . . . . . . . . . . 94

6.17 Impact of a four-week maintenance of one unit for each NETS power plan on the total

frequency of dangerous scenarios - Independent method. . . . . . . . . . . . . . . . . 94

6.18 Test system for a two-level blackout risk analysis. . . . . . . . . . . . . . . . . . . . . 94

6.19 Electrical instabilities per type of level-I dangerous scenarios. . . . . . . . . . . . . . 96

6.20 Probability of total load per type of level-I dangerous scenarios. . . . . . . . . . . . . 96

6.21 DET main branches for type 1 scenarios, cluster 3. . . . . . . . . . . . . . . . . . . . 98

6.22 Voltage evolution for type 1 scenarios, cluster 3, example 1. . . . . . . . . . . . . . . 99

6.23 Voltage evolution for type 1 scenarios, cluster 3, example 2. . . . . . . . . . . . . . . 99

6.24 Distribution of the loss of supplied power. . . . . . . . . . . . . . . . . . . . . . . . . 100

6.25 Mean times per MC run - biased independent simulations. . . . . . . . . . . . . . . . 101

6.26 Sample variances - biased independent simulations. . . . . . . . . . . . . . . . . . . . 101

6.27 Figures of merit - biased independent simulations. . . . . . . . . . . . . . . . . . . . 102

6.28 Mean times per MC run - dependent simulations with biased transition times. . . . . 102

6.29 Sample variances - dependent simulations with biased transition times. . . . . . . . . 102

6.30 Figures of merit - dependent simulations with biased transition times. . . . . . . . . 103

6.31 Biased normal law, with nI = 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

A.1 Dielectric strength as a function of temperature. . . . . . . . . . . . . . . . . . . . . 116

A.2 Acceleration factor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

A.3 Failure rate as a function of temperature in stationary conditions. . . . . . . . . . . 120

A.4 Failure rate as a function of temperature in stationary conditions. . . . . . . . . . . 120

A.5 Stationary and non-stationary failure rates for the test case (increasing temperature). 121

A.6 Stationary and non-stationary failure rates for the test case (decreasing temperature). 122

A.7 Stationary and non-stationary failure rates for a slow transient. . . . . . . . . . . . . 122

B.1 68-buses, 16-machine, 5-area test system. . . . . . . . . . . . . . . . . . . . . . . . . 123

B.2 3L2 and 5L2 structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

B.3 Blackout test system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

B.4 Map of KNMI stations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

B.5 Test system for a two-level blackout risk analysis. . . . . . . . . . . . . . . . . . . . . 133

B.6 Excitation system - type AC4A. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

B.7 Model of a power system stabilizer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

B.8 Quadrilateral distance relay characteristic. . . . . . . . . . . . . . . . . . . . . . . . . 138

C.1 Excitation system - type AC4A. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

C.2 Representation of a multi-machine system. . . . . . . . . . . . . . . . . . . . . . . . . 141

C.3 Steady state phasor diagram of the synchronous machine. . . . . . . . . . . . . . . . 143

C.4 The third-order system frequency response model. . . . . . . . . . . . . . . . . . . . 144

D.1 Line overload modelling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

D.2 Probability of the line trip as a function of its loading. . . . . . . . . . . . . . . . . . 150

D.3 Probability of the line trip as a function of its loading. . . . . . . . . . . . . . . . . . 150

D.4 Map of the Netherlands showing the station 278 Heino. . . . . . . . . . . . . . . . . 153

D.5 Cdf of the critical current - influence of the ambient temperature. . . . . . . . . . . . 154

D.6 Cdf of the critical current - influence of the wind speed. . . . . . . . . . . . . . . . . 154

D.7 Cdf of the critical current - influence of the wind. . . . . . . . . . . . . . . . . . . . . 154

D.8 Cdf of the critical current - influence of weather conditions. . . . . . . . . . . . . . . 155

D.9 Critical temperature in function of critical sag. . . . . . . . . . . . . . . . . . . . . . 155

D.10 Standard deviation of the critical current in function of the standard deviation of the

critical temperature. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

D.11 Standard deviation of the critical current in function of the standard deviation of the

vegetation height. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

D.12 Mini Test System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

D.13 Blackout Test System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

D.14 Probability of line tripping in function of load - Mini Test System. . . . . . . . . . . 159

D.15 Three models for the probability of line tripping in function of load - Mini Test System.159

D.16 Probability of line tripping in function of load - Blackout Test System. . . . . . . . . 160

D.17 Three models for the probability of line tripping in function of load - Blackout Test

System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

D.18 Probability of line tripping in function of load - Mini Test System with strong correc-

tive actions model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

D.19 Four models for the probability of line tripping in function of load - Mini Test System

with strong corrective actions model. . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

List of Tables

2.1 Main system states transition phenomena and mechanisms occurring in slow and fast

cascades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

6.1 Cross-border power flows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

6.2 Most frequent dangerous scenarios (base case) . . . . . . . . . . . . . . . . . . . . . . 84

6.3 Fussell-Vesely factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

6.4 Lambert factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

6.5 Probability to have a dangerous scenario after a link trip as initiating event . . . . . 86

6.6 Seasons’ importance (frequencies given are conditional frequencies per season). . . . 87

6.7 Estimations of the total frequency of dangerous scenarios for different vegetation heights. 88

6.8 Dangerous scenarios and their frequencies for different vegetation heights. . . . . . . 89

6.9 Dangerous scenarios and their frequencies for different vegetation heights. . . . . . . 89

6.10 Vesely-Fussel factors for different vegetation heights. . . . . . . . . . . . . . . . . . . 90

6.11 Lambert factors for different vegetation heights. . . . . . . . . . . . . . . . . . . . . . 90

6.12 Most frequent dangerous scenarios for a mean power flow from NETS to NYPS of

398 MW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

6.13 Most frequent dangerous scenarios for a mean power flow from NYPS to NETS of

195 MW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

6.14 Most frequent dangerous scenarios after shutdown of the power plant 2 (NETS) when

the lost power is compensated by all areas. . . . . . . . . . . . . . . . . . . . . . . . 93

6.15 Most frequent dangerous scenarios after shutdown of the power plant 12 (NYPS) when

the lost power is compensated by the NETS. . . . . . . . . . . . . . . . . . . . . . . 93

6.16 Most frequent dangerous scenarios revealed by level-I blackout PRA. . . . . . . . . . 95

6.17 Level-II results by clusters for level-I type 1 (as denoted in Table 6.16) scenarios. . . 97




6.21 Risk and frequency of blackout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

A.1 Parameters of the PHI2 method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

B.1 Power plants data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

B.2 Bus Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

B.3 Weekly peak load in percentage of annual peak. . . . . . . . . . . . . . . . . . . . . . 127

B.4 Daily peak load in percentage of weakly peak. . . . . . . . . . . . . . . . . . . . . . . 127

B.5 Hourly peak load in percentage of daily peak. . . . . . . . . . . . . . . . . . . . . . . 128

B.6 Links Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

B.7 Links Data (continued). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

B.8 Thermal data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

B.9 Mechanica data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

xiii

B.10 Thermal data of underground cables. . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

B.11 Thermal data of power transformers. . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

B.12 Mean ambient temperature (C) for each season and each hour. . . . . . . . . . . . . 133

B.13 Standard deviation of the ambient temperature (C) for each season and each hour. 134

B.14 Power plants general data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

B.15 Bus Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

B.16 Links Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

B.17 Thermal data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

B.18 Mechanica data of overhead lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

B.19 Thermal data of power transformers. . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

B.20 Wind speed parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

B.21 Dynamic parameters of synchronous machines. . . . . . . . . . . . . . . . . . . . . . 137

B.22 Parameters for excitation system model. . . . . . . . . . . . . . . . . . . . . . . . . . 137

B.23 Parameters for PSS model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

D.1 Assumption on probability of trip as a function of line loading. . . . . . . . . . . . . 150

D.2 Best parameters for the Mini Test System. . . . . . . . . . . . . . . . . . . . . . . . . 159

D.3 Best parameters for the Blackout Test System. . . . . . . . . . . . . . . . . . . . . . 160

D.4 Best parameters for the Mini Test System with strong corrective actions model. . . . 161

List of Acronyms

AIT Average Interruption Time

BO Blackout

CET Continuous Event Tree

DDET Discrete Dynamic Event Tree

DET Dynamic Event Tree

EDT Eastern Daylight Time

ENS Energy Not Supplied

ENTSO-E European Network of Transmission System Operators for Electricity

ET Event Tree

FORM First Order Reliability Method

FT Fault Tree

IAEA International Atomic Energy Agency

IEEE Institute of Electrical and Electronics Engineers

LF Load Flow

MC Monte Carlo

MAPE Mean Absolute Percentage Error

MISO Midwest Independent System Operator

NERC North America Reliability Corporation

NETS New England Test System

NYPS New York Power System

OPF Optimal Power Flow

PDT Pacific Daylight Time

PRA Probabilistic Risk Assessment

RTS Reliability Test System

TSO Transmission System Operator

UCTE Union for the Coordination of the Transmission of Electricity

UTC Coordinated Universal Time

xv

Introduction



from the electrical sector is very positive, generation, transmission and distribution of electricity

can in no way be considered as totally reliable activities. A residual risk of blackout or undesired

load shedding in critical zones remains. One can think that the most important risk of power cut

does not come from large disturbances like blackout because they are rare, but from local events

which are more frequent. However, previous blackouts showed that, despite their low occurrence,

their contributions to mean reliability indices are very important. For example, in Italy, the Average

Interruption Time (AIT) and the Energy Not Supplied (ENS) are, in average on the period 2007-

2011, respectively 0.73 min/year and 460 MWh/year [1]. The targets are maximum 1.00 min/year

and 550 MWh/year. As a comparison, the 2003 blackout in Italy caused an AIT of several hundreds

of minutes (50% of the load was re-supplied after 6.5 hours and 99% after 15 hours) and an estimated

ENS of 177 GWh [2]. Moreover, the occurrence of such a situation is likely to entail major direct

and indirect economical consequences, due to the amplitude of the event, as observed in recent

blackouts. For example, the economic losses of the blackout that happened in the Northeastern area

of the United States and in Canada on August 14, 2003 were about $4-$10 billion (approximately

50 million people affected) [3]. Assessing this residual risk and identifying scenarios likely to lead

to these feared situations is crucial to control and optimally reduce this risk of blackout or major

system disturbance. These issues become even more crucial when considering the current evolution

of the electrical sector. Renewable generation, which is inherently variable, must be absorbed - or

compensated - in all circumstances by the grid, increases the variability - in time and magnitude - of

the power flows. In the liberalization context, the transmission power system is required to operate

more intensively, even though the grid infrastructure is aging. All these elements are in addition

to the usual characteristics of the electricity supply security assessment issues (load variability,

scheduled line outages due to maintenance, as well as random equipment failures) and motivate

the development and the use of probabilistic tools complementary with the tradionnal deterministic

tools.

The objective of this PhD thesis was to develop a methodology able to reveal scenarios leading to

a blackout or a major system disturbance and to estimate their frequencies and their consequences

with a satisfactory accuracy. A blackout is a collapse of the electrical grid on a large area, leading

to a power cutoff, and is due to a cascading failure. Such a cascade is composed of two phases. The

first one is a slow cascade, starting with the occurrence of an initiating event (e.g. line fault or loss of

a power plant) and displaying characteristic times between successive events from minutes to hours.

Events are mainly due to independent failures, operators’ actions or thermal failures. The second

phase is a fast cascade, displaying characteristic times between successive events from milliseconds

to tens of seconds. Events are mainly due to the triggering of element protections when electrical

variables reach their associated setpoints. The restoration of the grid after a blackout or a major

load shedding can be viewed as an additional and last third phase. In cascading failures, there

is a strong coupling between events. Indeed, the loss of an element increases the stress on other

1

INTRODUCTION

elements and, hence, the probability to have another failure or to have elements disconnections

through their protections. It appears that previous probabilistic methods do not consider correctly

these dependencies between failures, mainly because the two very different phases are analyzed

with the same model. Thus, there is a need to develop a conceptually satisfying probabilistic

approach, able to take into account all kind of dependencies, by using different models for the slow

and the fast cascades. We propose to adapt dynamic reliability to the case of transmission power

systems. Dynamic reliability was initially developed, among others, for nuclear power plants and is an

integrated approach of Probabilistic Risk Analysis (PRA) allowing to consider the mutual interaction

between system states transition and process variables evolution. As well as in the nuclear sector, we

propose to decompose the blackout risk analysis in levels, according to the different blackout phases.

This decomposition allows to adapt differently dynamic reliability to each level. This PhD thesis

first focuses on the slow cascade progression up to the transition to the fast cascade. The proposed

methodology will account for the double interaction between power system dynamics and state

transition of the grid elements, as well as for variations in cross-border fluxes, in wind generation

and in the grid load, and for operator actions in the course of a transient. This PhD thesis also

introduces the development of a methodology to analyze the fast cascade, up to an operational state

with load shedding or a blackout.

This PhD thesis presents the first steps towards a three-level PRA of the blackout risk in transmis-

sion power systems. Chapter 1 introduces power systems. Chapter 2 analyzes some recent blackouts

or major system perturbations in order to understand the typical development of a blackout and

important phenomena to consider. Chapter 3 introduces reliability concepts that are used in this

PhD thesis. Chapter 4 presents existing reliability studies of power systems, especially the risk

assessment of cascading failures. Chapter 5 is devoted to the presentation and the development of

the proposed 3-level methodology, especially for the slow cascade. Then, Chapter 6 presents the

numerical results obtained by applying the methodology (level-I and two first levels) on two test

systems. Finally, Chapter 7 suggests some ideas for future work, before general conclusions.

The research work presented in this PhD thesis, started in October 2009, led to the following

communications:

1. Articles in international peer-reviewed journals

• “A level-1 probabilistic risk assessment to blackout hazard in transmission power systems”

in Reliability Engineering & System Safety, vol. 102, 2012 [4].

• “Blackout probabilistic risk assessment and thermal effects: impacts of changes in gener-

ation” in IEEE Transactions on Power Systems, 2013 [5].

2. Oral communications at international conferences with publication in the proceedings:

• “Towards an integrated probabilistic analysis of the blackout risk in transmission power

systems” at 2011 International Topical Meeting on Probabilistic Safety Analysis - Wilm-

ington, USA - March 2011 [6].

• “Role of Thermal Effects in Blackout Probabilistic Risk Assessment” at 2011 Electrical

Power and Energy Conference - Winnipeg, Canada - October 2011 [7].

• “Blackout PRA based identification of critical initial conditions and contingencies” at 12th

International Conference on Probabilistic Methods Applied to Power Systems - Istanbul,

Turkey - June 2012 [8].

• “Towards a 3-level blackout probabilistic risk assessment: achievements and challenges”

at 2013 IEEE PES General Meeting - Vancouver, Canada - July 2013 [9].

• “Two-level blackout probabilistic risk analysis: application to a test system” at ESREL

2013 conference - Amsterdam, Netherlands - October 2013.

2

INTRODUCTION

3. Oral communications at national conferences with publication in the proceedings:

• “PHI2 method and failure rate: application to power cables” at 18e congres de Maıtrise

des risques et de Surete de Fonctionnement - Tours, France - October 2012.

• “ Two-level integrated probabilistic analysis of the blackout risk in transmission power

systems” at 18e congres de Maıtrise des risques et de Surete de Fonctionnement - Tours,

France - October 2012.

3

Chapter 1

Introduction to electric energy

systems

1.1 Introduction

Electricity is a fundamental ingredient of modern society and has become a favorite form of energy

usage at the consumer end. Indeed, for the consumer, electricity is versatile, available (quasi) at

any time and clean. But electricity has a strong differentiation compared to other energies: it is

not susceptible, in practice, to being stored or inventoried. Electricity can be stored in batteries,

but price, efficiency, and size make this impractical for handling the amounts of electricity needed

every day in the world. Moreover, for several reasons (efficiency, cost, pollution, safety), electricity is

generated in power plants whose power (from some MW to 1.5 GW) is larger than individual needs.

Therefore, electricity must be generated in power plants and transmitted through the electrical grid

as it is consumed.

This Chapter explains basic notions that are used in this PhD thesis. It is mainly addressed to

people with limited background in electric energy systems.

1.2 Structure

1.2.1 Levels

The typical electrical grid structure, based on a three-phase system, is nearly the same in all

countries and is shown in Figure 1.1. It is the combination of three areas of operation including two

types of grids [10]:

1. Generation system: facilities for the generation of electricity from energy sources.

2. Transmission system/grid: facilities for the transport of the electrical energy from the power

plants to consumption areas through High-Voltage (HV) lines or cables. Several voltage lev-

els (typically from 30 kV to 500 kV) are used and transformers connect these levels. The

transmission network is a highly meshed grid: several different paths connect one point to

another.

3. Distribution system/grid: facilities for the delivery of the electricity from the transmission

system to individual consumers (e.g. residential, commercial, etc.) within a specific geograph-

ical area. Medium voltages are used (typically from 220 V to tens of kV). The distribution

networks are radial (there is one path to go from one point to another) or weakly meshed.

5

CHAPTER 1. INTRODUCTION TO ELECTRIC ENERGY SYSTEMS

Figure 1.1: Electric power system configuration and structure. From [10].

These functional zones can be combined to give three hierarchical levels used in reliability evaluation

[11]. Hierarchical Level I (HLI) is concerned only with the adequacy between generation and load

(generation system studies). Hierarchical Level II (HLII) further includes the transmission system

(composite system studies). The purpose of the Hierarchical Level III is to include all the three

functional zones in an assessment of consumer load point reliability. However, due to the complexity

of the problem, HLIII studies are not directly conducted. As mutual interactions between the

distribution grid and the transmission grid are usually weak1, the distribution system reliability is

assessed independently.

In the actual liberalized European electricity sector, there are four different types of companies:

• The producers, generating electricity in power plants.

• The Transmission System Operators (TSOs) (one per geographical area), owning and operating

the transmission networks.

• The Distribution System Operators (DSOs) (one per geographical area), owning and operating

the distribution networks.

• The retailers or suppliers, buying electrical energy on wholesale market and reselling this

energy to consumers.

All these companies are implied in the reliability of the overall electrical grid.

In case of major system disturbances like blackouts, problems are mainly due to the generation

and the transmission grid. Consequently, this PhD thesis focuses on these two areas of operation

(HLII reliability analysis).

1.2.2 Elements

1.2.2.1 Power plants

There are many electrical generation technologies, but all facilities generate a three-phase, sinu-

soidal voltage system, with a controlled wave frequency and amplitude. Conventional power plants

1The actual implementation of renewable sources on the distribution side can reinforce this interaction.

6


include hydroelectric, thermal (fuel-oil/coal/gas), and nuclear power plants. They are connected to

the transmission grid. The hydraulic energy or the high pressure steam is converted into mechanical

rotating energy in the turbine. This mechanical energy is then converted into electric power by a

synchronous generator. The nominal power of these conventional power plants vary typically from

1 MWe (run-of-the-river plants) to 1600 MWe (largest nuclear units in the world). Other types

of power plants, often called alternative plants, are more and more implemented in electric grids.

They are mainly characterized by the use of renewable sources of energy: wind and solar energy.

Wind power plants convert wind energy to electrical energy through synchronous AC generators or

asynchronous machines. They are connected either to the transmission or to the distribution grid.

Their nominal power varies typically from 1 MWe to 5 MWe. Solar energy is mainly exploited by

photovoltaic cells which convert this energy into DC current. Combined heat and power (or co-

generation) plants, based on synchronous machines and connected to the distribution grid, are also

acquiring significance.

In a HLII analysis, power plants connected to the distribution grid can be viewed as negative

loads.

1.2.2.2 Transformers

Raising the electric current to high voltage is necessary to transmit large amounts of electric

power over long distances using reasonably inexpensive line or cable technology without having

unreasonable losses. However, the electrical energy cannot be generated directly and delivered at

too high voltages, due to limited dielectric strength of insulators and security reasons. Transformers

are then needed to raise or lower voltage. A transformer is constituted by two sets of coils around a

ferromagnetic core, immersed in oil to ensure optimum conductor insulation and cooling. A power

transformer in a substation is shown in Figure 1.2.

Figure 1.2: Power transformer in a substation. From [12].

1.2.2.3 Overhead lines

Transmission overhead lines consist of aluminium conductor steel-reinforced cables that rest on

towers. A set of insulators attaches the cables to the towers. To reduce the inductance of the line,

each phase of it is generally divided into two, three or four cables (duplex, triplex or quadruplex

cables). Two triplex overhead lines supported by a Beaubourg tower are shown in Figure 1.3.

7


Figure 1.3: Double circuit 400-kV overhead line. From [12].

1.2.2.4 Underground cables

The transmission system also relies on underground cables. It is mostly the case in urban areas

(due to specific constraints) and with low operating voltages (several tens of kV). Due to the high

voltages used, one cable per phase has to be used2, so cables are installed by groups of three, either

in trefoil or in flat formation (horizontal or vertical), as shown in Figure 1.4. The typical design

is shown in Figure 1.5. Initially, the insulation system was constituted by oil-impregnated paper.

However, since the 1960s, crosslinked polyethylene (XLPE) insulated power cables have increasingly

come into use [13].

Figure 1.4: Configurations of underground cables.

1.3 Static analysis

1.3.1 Components models

1.3.1.1 Power plants and loads

Power plants are usually modeled in static analysis by a source of active (PG) and reactive (QG)

powers. These powers can be set under specific limits, as well as the output voltage. Loads are

usually modeled by a consumption of active (PL) and reactive (QL) powers, which can vary or not

as a function of voltage.

2It is not the case for distribution systems, where the three phases can be grouped into one cable due to lower

voltages.

8


Figure 1.5: Typical design of underground cables. Adapted from [13].

1.3.1.2 Links

We will call “link” in this thesis either an overhead line, an underground cable or a power trans-

former. In steady-state conditions, a link can be modeled by a two-port network. In general, a

symmetric Pi-Network is used to represent such a two-port network [10], as shown in Figure 1.6.

The series impedance can be decomposed into a resistance which models the electrical resistivity

Figure 1.6: Line equivalent model.

of the link (Joule losses), and an inductance. The shunt impedance is in general dominated by

capacitive effects and we will neglect in our work the shunt resistance (line conductance). The shunt

impedance is then simply given by the shunt susceptance, also called “line charging”. The situation

can be slightly more complex for a transformer, since the complex tap ratio µ is not always equal

to one. The adaptation of the Pi-Network, including the simplification of the shunt impedance, is

shown in Figure 1.7. The tap bus (from bus) is on the left and the Z bus (to bus) on the right.

The complex current injections If and It at the from and to ends of the branch, respectively, can

be expressed in terms of the respective terminal voltages Vf and Vt:(IfIt

)=

((YS + jB/2)/τ2 −YS/µ∗−YS/µ YS + jB/2

)(VfVt

)= Yl

(VfVt

)(1.1)

where Yl is the admittance matrix for the link and ∗ denotes the complex conjugate. For an overhead

line or an underground cable, the tap ratio τ = 1 and the phase shift ϕPS = 0, so:

Yl =

(YS + jB/2 −YS−YS YS + jB/2

)(1.2)

9


Figure 1.7: Links equivalent circuit.

1.3.2 Load flow analysis

The load flow problem consists in finding the steady-state operating point of an electric power

system, given the load demanded at consumption buses and the assumed generation levels at specified

supply voltages [10]. Finding the steady-state operating point means obtaining all bus voltages. The

technique presented here relies on the Kirchhoff’s current law for each bus. If we consider a generic

bus i connected by links to a set Si of other buses and to the neutral or ground node through a

shunt admittance as shown in Figure 1.8, the net current injected to the bus by generators or loads

is Ii = IG,i− IL,i, where IG,i and IL,i are the complex currents injected by generating elements and

absorbed by loads, respectively. The Kirchhoff’s current law can be written

Ii =∑j∈Si

yij(Vi − Vj) + yiVi =

[ ∑j∈Si

yij + yi

]Vi −

∑j∈Si

yij Vj =

N∑j=1

YijVj (1.3)

where Y is the global admittance matrix (N ×N complex matrix, where N is the number of buses

in the network) whose elements Yij = Gij + jBij can be computed on the basis of link admittance

matrices discussed previously. As the loads and the generations are not given in terms of currents,

Figure 1.8: Elements connected to a bus.

but in terms of power, the load flow equations are based on the complex power,

Si = ViI∗i , (1.4)

where Si is the net complex power injected to bus i. The Kirchhoff’s law can then be written in

terms of complex powers by

SG,i − SL,i = Si = Vi

N∑j=1

Y ∗ij V∗j (1.5)

10


where SG,i and SL,i are the complex power injected by generating elements and that absorbed

by loads, respectively. By expressing the complex power in terms of active and reactive power,

S = P + jQ, and voltages in polar form, Vi = Vi∠θi, the active power balance equation at bus i can

then be written

PG,i − PL,i = Pi = Vi

N∑j=1

Vj(Gij cos(θij) +Bij sin(θij)), (1.6)

and the reactive power balance equation,

QG,i −QL,i = Qi = Vi

N∑j=1

Vj(Gij sin(θij)−Bij cos(θij)), (1.7)

where θij = θi − θj . These are the load flow equations.

Each node provides two load flow equations and four unknowns (Vi,θi,Pi,Qi), which means that

two quantities per node have to be specified to solve the resulting set of equations. In a power

system, there are two different types of nodes:

• Those where a classical power plant is connected to. A power plant regulates the voltage and

injects a precise value of active power. On the contrary, reactive power is produced to maintain

the voltage to its nominal value. They are then called generation buses or PV buses (active

power and voltage are fixed).

• Those where no power plant is connected to. Both active and reactive power absorbed by the

sum of loads connected at the bus are specified. They are then called load buses or PQ buses.

The idea of the load flow analysis is to set voltage magnitudes Vi and generated active powers PG,iat all generation buses except one, the swing bus (or the slack bus), where the voltage and the angle

are set. Variables are the voltage angles at PV and PQ buses θi and voltage magnitudes at PQ buses.

These values are computed on the basis of balance equations for active power at PV and PQ buses

and reactive power at PQ buses. If we have m PV buses and n PQ buses, there are m+2n non-linear

equations to solve with m+2n state variables ((θPV1 , .., θPVm ) and (θPQ1 , .., θPQn , V PQ1 , ..., V PQn )). Once

these m+ 2n equations are solved, the m+ 2 other equations (reactive power balance equations at

PV buses and active/reactive power balance equation at the swing bus) are used to find the reactive

power generation at PV buses and the power generation at the swing bus.

As an example, we can study a power plant powering a load through one line, as shown in Figure

1.9. We consider the line as purely inductive. Bus 1 is naturally defined as the swing bus (only

Figure 1.9: Power plant powering a load through one line.

one generating node) and bus 2 as a PQ bus. The bus 1 voltage is fixed to the reference voltage,

V1 = Vref , and its angle to a null reference value, θ1 = 0. The active power equation for bus 2 can

be written as

− PL,2 = V2Vref−1

XLsin θ2 (1.8)

11


and the reactive power equation as

−QL,2 = V2

[Vref

−1

XLcos θ2 + V2

1

XL

]. (1.9)

These equations are non-linear and an analytical solution for V2 and θ2 is difficult to obtain in a

general case. However, we propose to solve them in the specific case QL,2 = 0. In this case, we have

V 22 (V 2

ref − V 22 ) = X2

LP2L,2, (1.10)

and

sin(2θ2) =2PL,2XL

V 2ref

. (1.11)

These equations show that a maximal power can be demanded at bus 2, given by

PmaxL,2 =V 2ref

2XL. (1.12)

In other words, the line inductance limits the power transfer. The P-V curves in a general case for

QL,2 6= 0 but for different power factors are given in Figure 1.10. The power factor is defined by

P/|S| and the maximal active power varies with it. As the typical instantaneous behavior of loads

active power is an increasing function of voltage, the upper part of each curve refers to a stable

operation mode and the lower part to an unstable operation mode.

Figure 1.10: P-V characteristics of the one-line system. From [14].

1.3.3 Optimal power flow

In the classical load flow problem exposed above, the steady state of the grid is computed by

fixing a priori the active power generation at the voltage magnitude at generation buses. One can

be interested in exploiting these degrees of freedom in order to

• Minimize the cost of generation in a secure state,

• Minimize the load shedding needed to reach a secure state from an insecure state.

The general idea of Optimal Power Flow (OPF) is to find a solution of the power system operating

state to optimize a given objective (the cost of generation or the load shedding) while satisfying

load flow equations, as well as all given feasibility and security requirements [10]. OPF is then an

optimization problem and can be mathematically formulated as

minuf(x, u) subject to

h(x, u) = 0

g(x, u) ≥ 0(1.13)

12


where u is the set of decision variables (e.g. active power injection and voltage magnitude at

generation buses and load shedding at load buses), x is the set of dependent variables (e.g. voltage

angles at generation buses and voltage magnitudes and angles at load buses), f is the scalar objective

function, h(x, u) = 0 is the set of network equations, and g(x, u) ≥ 0 is the set of operational and

security constraints.

1.4 Dynamic analysis

1.4.1 Components models

In dynamic analysis at the transmission system level, the same models are usually kept for links

as in the static analysis, but dynamic models are adopted for generators and loads.

The basic component of a power plant is the synchronous machine, which can be described by

a set of mechanical and electrical differential equations between mechanical angle, voltages and

currents. The size of this set can vary from 2 equations to 7, according to the complexity needed.

The generator excitation system consists of an exciter and an automatic voltage regulator and is

necessary to supply the generator with DC field current. This excitation system can be modeled

by a set of differential equations. In a conventional power plant, the synchronous generator is

driven by either a steam turbine, a gas turbine or a hydro turbine. The turbine is equipped with a

governing system to regulate the power input. This turbine-governor system is also modeled by a

set of differential equations. Except for specific simplified developments in Appendix C, this PhD

thesis does not develop these dynamic equations. The reader can find detailed information on this

topic in [14].

Load modeling at the transmission grid side is a complex problem, since loads are composite

(induction motors, discharge lighting, heating, electronic devices, ...). Most models used are quasi-

static: they model the load as an algebraic function of voltage and frequency [15, 16]. They implicitly

suppose that the equilibrium is instantaneously reached during a voltage/frequency transient. For

example, the ZIP3 model decomposes the load as a fraction of constant impedance, a fraction of

constant current and a fraction of constant power. As we will discuss in the perspectives Chap-

ter, such models can lead to non-convergence during dynamic simulations. Consequently, they are

not convenient to model specific electrical transients. Other models were developed to model the

time-dependent evolution of the load in case of voltage and/or frequency transient. They lead to

differential equations.

1.4.2 Protection systems

When a fault occurs, the faulty circuit must be disconnected quickly in order to keep the conti-

nuity and quality of service. This is one important aim of protection systems. Independently of a

fault occurrence, specific electrical transients could result in extreme working conditions for certain

elements. The other aim of protection systems is to disconnect elements operating in unacceptable

conditions in order to protect them.

A protection system includes all components that allow the fault to be detected, analyzed and

removed: battery, measurement devices (instrument transformers such as voltage transformers and

current transformers), protection relay and automatic circuit breaker. A network protection system

is in general structured into two forms: primary relaying, responsible for initially removing the fault,

and back-up relaying, responsible for removing the fault if primary relaying fails.

3Z for impedance, I for current, P for power.

13


Several categories of protection systems exist, according to the element to protect [17, 18]:

• Over-current protections. An over-current relay is simply a relay that operates or picks up

when the current exceeds a pre-determined value. It can help to protect an element from faults

or from an abnormal overload without fault. Over-current relays are not inherently directional.

Over-current relays can be instantaneous, or with an intentional constant time delay, or with a

time delay depending on the overload such as the higher the current, the smaller the operating

time (e.g. inverse time characteristics).

• Distance protections. They respond to the complex apparent impedance Z (“electrical dis-

tance”, Z = V /I, where V is the element complex voltage and I its complex current) between

the relay location and the fault location. They are usually using three zones with different

tripping times, as shown in Figure 1.11. The aim of zone 1 is to protect the line section instan-

taneously, but not to trip the protected line if a default occur on an adjacent line. Therefore,

zone 1 must not overreach the end of the line section. As errors in the fault location prediction

could occur (e.g. measurement errors), zone 1 should underreach the end of the line section. It

is set usually between 85 and 90% of the line length and it has to be operated instantaneously.

Thus, zone 1 does not protect the entire area between the end of zone 1 and bus B. The

purpose of zone 2 is then to cover this area and it deliberately overreaches beyond the remote

terminal of the transmission line to 120-150% of the line length AB. This zone 2 has a time

delay of about 300 ms. It also backs up the distance relay of the neighboring line. Zone 3 is

applied as a remote backup to zones 1 and 2 of an adjacent line.

Figure 1.11: Three-zone step distance relaying to protect 100% of a line, and back up the neighboring

line. From [18].

• Differential protections. A differential relay is intended to respond to the difference between

incoming and outgoing electrical quantities associated with protective apparatus. The purpose

of such a protection is then specifically to detect faults and not overloads.

• Over-excitation protections. Over-excitation, due to a combination of low frequency and high

voltage, can cause thermal distress in power transformers and generators. Therefore, the ratio

of the voltage to frequency (Volts/Hertz) must be monitored and the over-excitation protection

must trip the generator/transformer if this ratio exceeds a pre-determined value. Such as the

over-current relays, they can be instantaneous, or with an intentional constant time delay, or

with a time delay depending on the overload such as the higher the current, the smaller the

operating time.

• Under-voltage and over-voltage protections. Protections for generator overvoltage have in

general both an instantaneous unit and a time delay unit with an inverse time characteristic.

Under-voltage can be a problem for auxiliary equipment and can then cause indirectly the trip

of the generator.

• Under-frequency and over-frequency protections. The operation of generators at abnormal

frequencies (either over-frequency or under-frequency) can induce mechanical resonances in

the many stages of turbine blades. The abnormal frequencies protections trip the turbine,

with a time delay depending on the speed deviation.

14


• Loss-of-field or loss-of excitation protections. The source of excitation for a generator can

be completely or partially removed and this kind of event can induce dangerous operating

conditions for both the generator and the system. The detection method is based on the

variation of impedance viewed from the generator terminals (through distance relays).

• Loss-of-synchronism. When a generator looses synchronism, the resulting high peak currents

and off-frequency operation can cause damage to the generator. The generator thus should be

tripped without delay. The conventional relaying approach for detecting a loss-of-synchronism

condition also relies on the analysis of complex apparent impedance as viewed from the gen-

erator terminals.

• ...

All transmission systems are not using all these protections. For example, over-current protections

are not used in the Belgian transmission system.

In order to help to stabilize the system in particular situation, under-frequency and/or under-

voltage (depending on the country) load-shedding relays are installed on the grid. Defense plans

give specific voltage and/or frequency steps for these load shedding relays (load percentage to shed

with a time delay for each step). Only these relays are designed to protect the overall system in

order to avoid to reach a feared situation. All other protection systems are designed to protect a

particular component or a particular subsystem. The latter can thus have a negative effect on the

overall system (e.g. power plants under-frequency protections).

1.4.3 Eigenvalue analysis

The dynamic model of the grid leads to a set of non-linear algebraic and differential equations.

These equations can be linearized around the working point in order to study the system response

to small perturbations. The eigenvalues and eigenvectors of the matrix representing this set of linear

differential equations can then be computed. They indicate the oscillation modes that could occur

in the network, and their damping [14].

1.4.4 Dynamic simulation

Obviously, the eigenvalue analysis is not convenient to study the power system response to a

severe transient disturbance such as a fault on transmission facilities, loss of generation, loss of a

large load, ... In these cases, a dynamic simulation based on the solution of non-linear algebraic

and differential equations is used. Several approaches for solving numerically (based on a time-

discretization scheme) these equations have been developed, depending on the numerical methods

and modeling details used [14]. These approaches have been implemented in commercial software

codes, such as Eurostag (Tractebel) and PSS/E (Siemens).

1.4.5 Angle, voltage and frequency stability

Different types of electrical instabilities can occur in a power system : rotor angle instability,

frequency instability and voltage instability, as shown in Figure 1.12. All these instabilities can lead

to a collapse of the power system and, then, to a blackout. We briefly present these instabilities

here, but the reader can find more details on this topic in [19].

1.4.5.1 Rotor angle instability

Rotor angle stability refers to the ability of the synchronous machines of an interconnected sys-

tem to remain in synchronism. It depends on the ability to maintain/restore equilibrium between

15


Figure 1.12: IEEE-CIGRE classification of power system stability. From [19].

electromagnetic torque and mechanical torque of each synchronous machine in the system. There

are two types of angle instabilities: transient and small-disturbance. Transient stability (or large-

disturbance rotor angle stability) refers to the rotor angle stability after the system was subject to a

severe disturbance, such as a short-circuit in the grid. Small-disturbance stability refers to the rotor

angle stability after the system was subject to a disturbance sufficiently small so that linearization

of the power system around its equilibrium point before the disturbance is acceptable for purposes

of analysis.

1.4.5.2 Voltage instability

Voltage stability refers to the ability of a power system to maintain steady voltages at all buses

(inside operational limits). It is strongly linked with the physical limitation of the transmitted power

through a power line by its impedance. This corresponds to the P-V characteristic curve developed

in Subsection 1.3.2 and to the unstable lower part. A transition from the upper stable part to the

unstable lower part (voltage collapse) can occur after the loss of a grid element. We can consider for

example a simple system with a power plant powering a load through two identical lines, as shown

in Figure 1.13. A possible collapse process after the loss of one line is illustrated in Figure 1.14.

Figure 1.13: Power plant powering a load through two lines.

From an initial stable operating point, another operating point is instantaneously reached after the

contingency, if we assume that the load follows instantaneously a constant impedance characteristic.

However, this new operating point corresponds to a consumed power lower than previously. A load

recovery transient thus begins to recover the same consumed power. During this transient, the

critical point is reached because it is impossible to recover the initial power, and a voltage collapse

occurs. A voltage instability can also occur when an operating point is reached on the upper part

of the P-V curve, but outside operational limits of elements. The disconnection of the concerned

elements can deteriorate the situation. The reader can find more details on this instability in [15].

16


Figure 1.14: Collapse process on PV curves.

1.4.5.3 Frequency instability

Frequency stability refers to the ability of a power system to maintain its frequency around its

nominal value (inside operational limits). In an electrical grid, the generation must be equal to the

consumption at any time (active power). A non-equilibrium between the mechanical power produced

in power plants and the electrical power consumed in the network implies a frequency change. This

can be easily understood through the motion equation of the generator rotor [10],

JdΩ

dt= Tm − Te (1.14)

where J is the inertia momentum of the rotating masses, Ω the mechanical angular speed, Tmthe net mechanical torque (mechanical torque at the turbine minus damping torque), and Te the

electrical torque due to the synchronous machine. Because the electrical energy is generated through

a synchronous machine, the voltage frequency is proportional to the mechanical angular speed. At

the equilibrium, Tm = Te and the angular speed (and, hence, the frequency) is constant (dΩdt = 0).

A frequency decrease (dΩdt < 0) means that the load is higher than the generation (Te > Tm) and

a frequency increase (dΩdt > 0) that the load is smaller than the generation (Te < Tm). Thus, the

generation in power plants is regulated according to the frequency. The automatic generation control,

called primary control, acts in some seconds and increases the generation proportionally to the

frequency mismatch to the frequency reference. Protections are also present at the level of loads to

prevent a frequency collapse. These protections shed load when the frequency is too low. Frequency

stability is then associated with the recovery of system frequency through automatic generation

control and automatic load shedding after large active power imbalances between generation and

load due to system disturbances (for example system splitting).

17

Chapter 2

Blackouts and major system

disturbances

2.1 Introduction

The blackout state is defined by the ENTSO-E1 as the interruption of electricity generation,

transmission, distribution and consumption processes, when operation of the transmission system

or a part thereof is terminated. Blackout state is always qualified as “wide” [20]. A blackout is

due to a cascading failure, following the occurence of an initiating event (e.g. line fault or loss

of a power plant). The first step in developing a methodology able to reveal dangerous scenarios

leading to blackout is to know major phenomena occurring during such a cascading failure in order

to include them in the modeling. This Chapter reviews selected recent blackouts or major power

system disturbance in order to establish a typical blackout development. Additional information

about these blackouts and other recent blackouts can also be found in [21]. Section 2.2 analyzes the

major system disturbance that occurred in the Western area of the United States on August 10, 1996;

Section 2.3 the blackout that happened in the Northeastern area of the United States and in the

Southeastern area of Canada on August 14, 2003; Section 2.4 the blackout that happened in Southern

Sweden and Eastern Denmark on September 23, 2003; Section 2.5 the blackout that happened in

Italy on September 28, 2003 and Section 2.6 the major system disturbance that occurred in Europe

on 4 November, 2006. Finally, Section 2.7 tries to derive a typical blackout development from the

previous analyses and describes important phenomena that should be considered in a blackout PRA.

2.2 United States, 1996

On August 10, 1996, at 15:48 Pacific Daylight Time (PDT), a major disturbance occurred in

the Western Interconnection resulting in the interconnection separating into four electrical islands

(as shown in Figure 2.1), and in the loss of over 28,000 MW of load (approximately 6.5 million

customers) in the West [22]. Even if a huge number of customers endured power outages, the

blackout was avoided in each of these islands. Outages lasted from a few minutes to as long as nine

hours (last customer re-supplied at 01:00 on August 11). The initiating event was the tripping of

the 500 kV Big Eddy - Ostrander line at 14:06 PDT because it flashed (arced) and grounded to a

tree. Two other 500 kV lines (John Day - Marion and Keeler - Allston) opened and locked out at

14:52 and 15:42 after flashing and grounding to a tree. Because a Marion circuit breaker was out

of service, the 500 kV Marion - Lane line was forced out of service when the John Day - Marion

flashed and grounded to a tree. At 15:47:36 PDT, the 230 kV Ross-Lexington line opened when

1European Network of Transmission System Operators for Electricity

19

CHAPTER 2. BLACKOUTS AND MAJOR SYSTEM DISTURBANCES

it flashed to a tree. This fault resulted in system protection also removing the Swift hydroelectric

power plant (207 MW). Between 15:47:36 and 15:48:09 PDT, all hydroelectric McNary generating

units were removed from service as a result of erroneous operation of a relay. A mild negatively

damped oscillation then began on the transmission system, and voltages collapsed. Several tens of

lines opened between 15:48:52 and 15:50:00 due to out-of-step and low voltage (via distance relays)

conditions, which led to the separation of the WSCC network into four islands (North, Northern

California, Southern and Alberta). The cumulative number of events as a function of time is shown

in Figure 2.2.

Figure 2.1: Sequence of significant events and islands formed on August 10, 1996. From [22].

Figure 2.2: Rate of events during the cascade.

North island experienced acceptable over-frequency, but several remaining lines opened, which

led to the loss of about 450 MW of customer demand (about 154,000 customers). Electricity was

restored to these customers between 16:20 and 17:01. Frequency within the Northern California

20


island dropped, as shown in Figure 2.3. This drop caused the loss of 7,937 MW of generation

and the automatic under frequency load shedding program to remove within this island blocks of

customer demand. This automatic load shedding stabilized the frequency. However, dispatchers

had to manually shed load from 17:22 to 17:32 to bring the frequency back to normal. In total, the

Northern California island lost 11,602 MW of demand (about 2.9 million customers). All customers

had electric service restored by 01:00 on August 11 in this island. The Southern island endured also

a low frequency, as shown in Figure 2.4. Generation summing up to 13,497 MW was disconnected

and 15,820 MW of customer demand (about 4.2 millions customers) were removed from service

(both by under frequency relays and manual load shedding). By 21:42, all the demand shed in the

Southern island was restored. After the separation, the frequency slightly dipped in the Alberta

island, which led to the removing from service of 146 MW of generation and to the shedding of 968

MW of demand (about 192,000 customers) by under frequency relays. Electric service was restored

to all customers in this island by 17:39.

Figure 2.3: Northern California island frequency during major system disturbance on August 10,

1996. From [22].

2.3 United States & Canada, 2003

On August 14, 2003, a few minutes after 4:00 pm Eastern Daylight Time (16:00 EDT), a blackout

occurred in the Northeastern area of the United States and in the Southeastern area of Canada.

Approximately 50 million people were affected and the economic losses in the United States were in

a range between $4 billion and $10 billion [3]. The power was restored only after four days in some

parts of the United States. The blackout started in Ohio, in the FirstEnergy (FE) area (see Figure

2.5), and rippled in the last part of the cascading failure from the Cleveland-Akron area across

much of the northeast United States and Canada. The initiating event was the tripping of Eastlake

Unit 5 (rated at 597 MW) in northern Ohio connected to FE’s 345-kV transmission system at 13:31

EDT. Transmission line loadings were then notably higher but well within normal ratings. Three

345-kV lines tripped at 15:05, 15:32 and 15:41 EDT (see Figure 2.6), due to a contact between the

line conductor and a tree. Two of them were not overloaded (respectively 44% and 88% of rated

values). Between 15:42:53 EDT and 16:05:55 EDT, several (about 13) 138-kV lines tripped (see

Figure 2.7), due to short circuits with ground. A problem with the tripping of a circuit breaker

induced the loss of the Canton Central 345/138-kV transformer at 15:45 EDT and another circuit

21


Figure 2.4: Southern island frequency during major system disturbance on August 10, 1996. From

[22].

breaker failure on West Akron transformer #1 causes the five remaining 138-kV lines connected to

the West Akron substation to open. At 16:05:57 EDT a 345-kV line (Sammis-Star) tripped on too

low apparent impedance (depressed voltage divided by abnormally high line current) in protective

zone 3. At 16:06 and 16:08 EDT, three more overloaded 138-kV lines tripped. With another loss of

a 345-kV line at 16:08:59 EDT, the rate of trips increased (see Figure 2.8) and the cascade spread

beyond the Cleveland-Akron area. At 16:13 EDT, the cascading sequence was essentially complete.

Many of the key lines which tripped during this phase operated on zone 3 impedance relays (or zone

2 relays set to operate like zone 3s) which responded to overloads rather than to true faults on the

grid. Power plants tripped mainly on low voltages or over-excitations, but also on under-frequency

and over-current.

Figure 2.5: Geography of the FirstEnergy area in August 2003. From [3].

22


Figure 2.6: Cumulative effects of sequential outages on remaining 345-kV lines during cascading

failure on August 14, 2003. From [3].

Figure 2.7: Simulated effect of prior outages on 138-kV line loadings during cascading failure on

August 14, 2003. From [3].

During this cascade, the Midwest Independent System Operator (MISO) state estimator (a system

monitoring tool) was unable to assess system conditions for most of the period between 12:15 EDT

and the end of the cascading failure, due to a combination of human errors (inaccurate input data)

and computer problems. MISO is the reliability coordinator for FirstEnergy. At 14:02 EDT, a 345-

kV line tripped due to a tree contact. This loss had no significant electrical effect on power flows

and voltages in the FE area, but it contributed to the failure of MISO’s state estimator to operate

effectively (no immediate update of its status in the state estimator). Consequently, operators did

not identify fast enough problems on the network to take adequate corrective actions.

At 16:13 EDT, approximately 61,800 MW of customer load were lost in an area that covers 50

million people. The total load restored was about 1,340 MW at 19:30 EDT, 21,300 MW at 23:00

EDT, 41,100 MW at 5:00 EDT (August 15) and at least 48,600 MW at 11:00 EDT. On August 16

23


Figure 2.8: Rate of line and generator trips during cascading failure on August 14, 2003. From [3].

at 11:00 EDT, the North American Electric Reliability Corporation (NERC) stated “Virtually all

customers have been returned to electric service, although some customers will continue to experience

rotating outages due to generating capacity availability.”2. On Sunday August 17 at 17:00 EDT,

the NERC stated “The electric transmission system is now operating reliably. All electric power

transmission lines that were removed from service during the blackout on August 14, 2003, have

been returned to service with one exception. The lines between Michigan and Ontario remain out

of service due to operational security reasons; however, they are expected to be returned to service

later this evening. Most of the electric generating units that were removed from service during the

blackout have now been returned to service (the exact number of units that went out of service is

not yet known). Twenty-one of these remain out of service. A number of these generating units are

expected to return to service either this evening or Monday morning. All but one of the units are

expected to return to service during the coming week. No rotating blackouts are currently underway

and none are expected for Monday.”3.

To summarize, the cascading failure leading to the blackout started with the loss of a power plant

at 13:31 EDT (August 14, 2003). From this initiating event to 16:09 EDT, the rate of trips was low

(time between events from tens of seconds to tens of minutes). Then, the rate of trips increased

after the loss of a 345-kV line (time between events from milliseconds to some seconds). At 16:13

EDT the blackout state was reached on a large area. The complete restoration took some days.

2.4 Sweden & Denmark, 2003

On September 23, 2003, at 12:36 (local time), a blackout occurred in Southern Sweden and

Eastern Denmark (total non-supplied demand: 10 GWh) [23]. The total demand in Sweden was

quite moderate (15,000 MW) due to the unusually warm weather for the season, but four nuclear

units were out of service (on-going annual overhaul and delayed restarts due to safety requirements),

as well as two 400 kV lines (scheduled maintenance) and HVDC links to Poland and Germany. The

initiating event was the loss of a nuclear power plant (1,250 MW) at 12:30 on the eastern coast.

Five minutes later, a double busbar fault occurred in a 400-kV substation on the western coast of

Sweden, as shown in Figure 2.9. The reason was a thermal damage to one disconnector device: one

2NERC Press Release, 8/16/2003 11 a.m. EDT3NERC Press Release, Sunday August 17, 2003, 5:00 p.m.

24


of the mechanical joints had been disrupted as a result of overheating. The loading current of the

isolator had increased from around 1,000 A to some 1,500 A following the initiating event (rating

for maximum load: 3100 A). About 90 seconds after the busbar fault, the situation developed into a

Figure 2.9: Faulty disconnector in Horred during cascading failure on September 23, 2003. From

[23].

voltage collapse in a section of the grid, as shown in Figure 2.10. Very low levels of voltage entailed

distance protections reaching the low impedance criteria to trip circuit breakers. Thereby, the grid

split up into two parts, leading to the isolation of the Southern part, comprising the South of Sweden

and Eastern Denmark. The latter subsystem suffered from an important imbalance between power

injection to the system and system load. Within seconds, the frequency and voltage had dropped

to unacceptable levels for generators which led the entire area to blackout. The immediate basis for

the restoration was the intact grid north of the split: lines and substations were energized to build

up the grid from north towards the south. By 19:00, almost all loads were re-supplied.

Figure 2.10: Registration of voltage in the north of Sweden during cascading failure on September

23, 2003. From [23].

2.5 Italy, 2003

On September 28, 2003, a few seconds after 03:28 (local time), a blackout occurred in Italy (about

57 million people affected) [2]. The power was restored only after 18 hours in some part of Italy.

The initiating event was the tripping of a 380-kV line between Switzerland and Italy at 03:01:42

(line 1 in Figure 2.11), due to a tree flashover. This line was loaded at approximately 86% of its

maximum capacity. Indeed, all tie-lines4 between the Italian grid and the rest of the European

grid were highly loaded just before the initiating event because Italy was importing 6,651 MW from

the northern border (France, Switzerland, Austria and Slovenia). The attempts of reclosing failed

due to an overly high phase angle (42). After the loss of this line, the load on the neighboring

lines increased. At 03:25:21, a second 380-kV line tripped (line 2 in Figure 2.11), after flashover

4A tie-line is a circuit (e.g. a transmission line) connecting two or more control area or systems of an electric

system.

25


with a tree. This line was operating at around 110% of its nominal capacity just after the loss

of the first line. From 03:02 to 03:25, operators tried to eliminate the overload: imports from the

northern border were reduced to 6,326 MW. Unfortunetely, the thermal transient was faster than

operators. At 03:25:25, 03:25:26 and 03:25:28, three 220-kV lines tripped (lines 3.1, 3.2 and 4 on

Figure 2.11) due to high overloads (trip on high current according to protection devices). The

Italian grid then lost its synchronism with the UCTE main grid which entailed the disconnection

of all remaining connecting lines between Italy and UCTE by regular function of the protection

devices. In fact, the isolated area was not exactly Italy (see Figure 2.11) and the total imbalance of

this isolated area just after the separation was about 6,646 MW. This negative imbalance between

power injection to the system and system load caused an abrupt frequency drop (see Figure 2.12).

The primary control operation of the generating units increased the generation of about 1,465 MW

a few seconds after the event, but the frequency felt by 1.5 Hz in this time. All the pumping units in

service were automatically disconnected between 49.720 and 48.985 Hz, shedding about 3,220 MW.

Moreover, starting from 49.70 Hz, 7,710 MW were automatically shed during the frequency transient

(about 85% of 1300 frequency relays functioned normally). But about 7,532 MW of generation were

also lost during the transient for many reasons (turbine tripping, underfrequency relay operation,

undervoltage relay operation, ...). Therefore, frequency felt below 47.5 Hz, resulting in the tripping

of the generating units that were still in operation, leading to a blackout at 03:28:05. Eight power

plants switched in isolated operation on house-load, which improved the restoration phase. From

the splitting from the UCTE network to the blackout, the transient last for 2.5 minutes.

Figure 2.11: Line of separation from UCTE during cascading failure on September 28, 2003. From

[2].

The restoration stage started just after the diagnosis. 50% of the load was re-supplied after 6 hours

and 30 minutes, 70% after 10 hours, 99% after 15 hours and the last customer was re-connected

after 18 hours and 12 minutes.

2.6 Europe, 2006

On November 4, 2006, around 22:10 UTC+1, the UCTE European interconnected electric grid

was affected by a major system disturbance that led to power supply disruptions for more than 15

million households [24]. However, the blackout was avoided. The problem started from the North

German transmission grid with a manual opening of a double 380-kV line at 21:38. At this time, a

26


Figure 2.12: Frequency versus imbalances during cascading failure on September 28, 2003. From [2].

large power flow was going from East to West. After the manual switch-off, this flow was transferred

to other lines. In particular, the current in another 380-kV line was very near its tripping current

(2,100 A). Operators expected that coupling two busbars in a substation would end up in a reduction

of the current by about 80 A. This maneuver was done at 22:10:11 UTC+1 but the current in the

line increased by 67 A (instead of decreasing) and the line was automatically tripped at 22:10:13

UTC+1 by the distance relays due to overloading. At this time, under-damped oscillations appeared

inside the UCTE electric grid (see Figure 2.13). Between 22:10:15 UTC+1 and 22:10:27 UTC+1,

four 220-kV lines and nine 380-kV lines tripped on overcurrent (distance protection), increasing the

oscillations. Between 22:10:28 and 22:10:29, sixteen more lines tripped, leading to a splitting of the

UCTE network in three areas (see Figures 2.13 and 2.14).

Figure 2.13: Frequency recordings until area splitting during cascading failure on November 4, 2006.

From [24].

27


Figure 2.14: Schematic map of the UCTE area split into three areas during cascading failure on

November 4, 2006. From [24].

After this separation, the Western area (composed of Spain, Portugal, France, Italy, Belgium,

Luxemburg, The Netherlands, a part of Germany, Switzerland, a part of Austria, Slovenia and a part

of Croatia) faced significant supply-demand imbalance (about 8,940 MW over a generation of 182,700

MW). The frequency then dropped quickly to about 49 Hz (see Figure 2.15). According to defense

plans, a total of about 17,000 MW of consumption and 1,600 MW of pumps were automatically shed

on frequency set points during the transient. There is a difference between the initial imbalance and

the total load shed because power plants tripped during the frequency transient. About 10,200 MW

of wind and combined-heat-and-power generation and a thermal generation unit of about 700 MW

of nominal power tripped, increasing the imbalance. In order to quickly restore the balance and

the frequency to its nominal value of 50 Hz, TSOs manually started generation units (mainly hydro

ones) for a total of about 16,800 MW.

In the opposite, the Northeastern area faced severe imbalance conditions with a generation surplus

of more than 10,000 MW (approximately 17% of total generation in this area before the splitting).

The frequency then rose quickly to about 51.4 Hz (see Figure 2.15). However, in few seconds, this

frequency was reduced to the range of about 50.3 Hz by primary control and automatic tripping

of the generating units sensitive to high frequency value (mainly windmills). At this stage, the

new steady-state situation in this area 2 resulted in power flows within acceptable limits without

serious danger for power systems operation. But the windmills slowly started being automatically

reconnected to the power systems (in Germany and Austria) thus gradually increasing generation

in these control areas. To compensate, thermal generation decreased. The consequence of this

overall process was the overloading of some lines. Fortunately, the successful resynchronization of

the Western area with the Northeastern area at 22:47 UTC+1 decreased the flows to acceptable

levels within half an hour.

2.7 Typical blackout development

Before outlining a typical blackout development scheme, it is important to remind the important

characteristic times in an electrical grid, as illustrated in Figure 2.16. Electrical transients occur

28


Figure 2.15: Frequency recordings after the split during cascading failure on November 4, 2006.

From [24].

with a large range of time constants, ranging from some milliseconds for electromagnetic transients

to some tens of seconds for voltage transients involving load tap changers. Operators reaction times

are in general from several minutes to some tens of minutes. Thermal transients occur in electric

grids with time constants ranging from some tens of minutes (for overhead lines) to some hours

(for underground cables and power transformers). The mean time between two independent failures

varies from some hours to some weeks, depending on the grid’s reliability and size.

Figure 2.16: Important characteristic times in a cascading failure.

As shown before, a blackout is due to a cascading failure, following the occurrence of an initiating

event (e.g. line fault or loss of a power plant). However, the N − 1 security rule applied by

Transmission System Operators (TSOs) is a rule according to which elements remaining in operation

after a fault of transmission system element must be capable of accommodating the new operational

situation without violating operational security limits [20]. Therefore, one unique contingency should

not entail a fast collapse of the electric grid and at least one more contingency is necessary. Obviously,

a second event, independent of the first one, can occur before any corrective action, as it seemed

to be the case for the Swedish/Danish blackout5. But, as the mean time between two independent

failures is high compared to the operators characteristic times, the probability of such a succession

of independent events is usually very low. Some blackouts can be due to multiple initiating events

whose occurrence makes directly the N−1 security rule no longer valid. Earthquakes, storms, tower

failures, ... can be the cause of the simultaneous (or quasi-simultaneous) loss of several elements.

5Even if [23] states “The probability of such a coincidence is extremely low as the interrelation between the faults

in the two separate locations was either zero or very weak”, it is not obvious for us that the initiating event did not

increase the probability of failure of the mechanical joint.

29


For example, the blackout which occurred in November 2009 in Brazil and Paraguay was due to

heavy rains and strong winds which caused short-circuits in a power transformer, leading to the

loss of the Itaipu hydroelectric power plant. A hidden failure is a permanent defect that will cause

one or several protection systems to incorrectly remove corresponding circuit element(s) as a direct

consequence of a fault in the grid6: a protection can trip an element although it should not trip.

Moreover, a protection system can fail to trip a faulted element, what entails the trip of other

elements by distance relays. Such protection systems failures revealed by an initiating event can

be the cause of the quasi-simultaneous loss of several elements and make quasi-directly the N − 1

security rule no longer valid. Additional contingencies can also be due to thermal effects. Following

the occurrence of a first event, the reconfiguration of the power flows in the grid can induce a thermal

transient which increases the temperatures of overhead lines, underground cables and transformers.

When the temperature of a line increases, its sag also increases, possibly leading to a short circuit

between the line and the vegetation. When the temperature of a cable or a transformer increases,

the dielectric strength decreases, possibly leading to a dielectric breakdown. If another element

undergoes a thermal failure, the thermal effect on other elements will be reinforced, possibly leading

to a cascade. The most famous example of such a thermal and slow cascade is the 2003 blackout

in the Northeastern area of the United States and in the Southeastern area of Canada, where about

20 high-voltage overhead lines sagged low enough to enter in contact with something below them

between 3 PM and 4 PM [3]. In this case, operators were not able to take fast enough corrective

actions due to a lack of situational awareness. After each short-circuit occurring in a cascade, the

problem of hidden failures can lead to the removal of several elements. An operator action can also

trigger a collapse, as it was the case in the major system perturbation in November 2006 in Europe:

based on an incorrect state estimation, a busbar coupling caused a line tripping.

Based on the analysis of these past blackouts and major system disturbances, and of other recent

past blackouts [26], the typical development of a cascading failure leading to a blackout can be

split in two phases, as illustrated in Figures 2.17 and 2.18. Following the occurrence of an initial

perturbation (initiating(s) event(s): the loss of one or several elements), two possibilities arise. If

this perturbation causes the simultaneous loss of several elements (due to a common mode failure or

a protection system failure) the N − 1 rule directly ends up and the system can become electrically

unstable (the initiating events are also the triggering events). A fast collapse of the electrical grid

can then start. But, in most cases, thanks to the N − 1 rule, the grid stays electrically stable after

the initiating event. A competition then starts between operators corrective actions and possible

additional failures, either due to thermal effects or independent. In particular, insufficient situa-

tion awareness for the operators during this phase results in a delayed or incorrect response, and

then increases the probability to loose additional elements. This phase is called slow cascade (or

steady-state progression), because it displays characteristic times between successive events rang-

ing from tens of seconds to hours. The occurrence of additional events during this slow cascade

can trigger (after the triggering event) an electrical instability (violation of protection set points,

angular instability, etc.). Then a second phase called fast cascade (or high-speed cascade) occurs,

ruled by electrical transients, displaying characteristic times between successive events ranging from

milliseconds to tens of seconds. This phase is too fast to allow operators to take corrective actions

and is characterized by a rapid succession of electrical events (additional failures, protection actions,

etc.) whose occurrence order and timing are driven by the power system’s dynamic evolution in the

course of this transient. After this fast cascade, the electrical grid reaches a stable state: a possible

collapse of the power system in some zones, or a major load shedding. Once a blackout or a major

load shedding has occurred, the recovery period, which might last for several hours to several days,

6A hidden failure is sometimes defined as “a permanent defect that will cause a relay or a relay system to incorrectly

remove a circuit element(s) as a direct consequence of another switching event” [25]. We do not completely agree

we this definition since we think that it is not another switching event which is the cause of a trip due to an hidden

failure, but a fault.

30


can be viewed as an additional (and last) phase. The terms “slow” and “fast” cascades are directly

inspired by the comparison between the mean time between events in each phase and the operator

characteristic times, as shown in Figure 2.16.

Figure 2.17: Phases of a blackout. From [26].

Figure 2.18: Event tree after an initiating event.

We should note that events occurring during the slow and the fast cascades, respectively, can be

very different in number and in type. During the slow cascade, only a small number of elements

are lost, typically from two to about twenty. There were 4 elements lost before the fast cascade in

the major disturbance which occurred in the Western Interconnection (United States) in August 10,

1996. There were 22 elements lost before the fast cascade in the 2003 US/Canada blackout. The

slow cascade was very short during the 2003 Sweden/Denmark blackout: 3 elements were lost in

5 minutes, the last two simultaneously (double busbar fault due to a disconnector damage). Only

2 elements were lost during the slow cascade of the blackout which occurred in September 2003 in

Italy. The fast cascade was triggered by 3 events in the major system perturbation in November

2006 in Europe. On the contrary, as the overall network collapses during a fast cascade leading to

a blackout, several hundreds of elements can be lost. This is illustrated in Figure 2.8 for the 2003

US/Canada blackout (the fast cascade began at 16:06). Elements trip mainly due to failures during

the slow cascade. On the contrary, elements trip mainly because electrical variables crossed their

protections’ setpoints without additional fault during the fast cascade.

Previous examples showed also that a large variety of mechanisms are involved in cascading

outages: common mode failures and protection systems failures which cause several initial outages7,

high static loads after power flow redistribution which can lead to additional thermal failures, no

corrective actions or wrong operators actions due to lack of situational awareness, static currents or

7This Chapter does not develop examples where protection system failures play a significant role during the slow

cascade. However, it caused several blackouts or major system disturbances (e.g. system disturbances in the US on

April 16 and July 2-3, 1996, and blackout in Croatia on January 12, 2003).

31


apparent impedances triggering relays, voltage/small-disturbance/transient/frequency instabilities,

... We propose to separate the main phenomena occurring in cascading failures in three subsets,

according to whether they are dominant during the slow or the fast cascade, or important for the

transition between the slow and the fast cascades:

• For the slow cascade: additional failures, either independent, or due to thermal effects (in

particular, trip of overhead lines due to a tree flashover, which can occur even if the load is under

the nominal value), several simultaneous outages caused by protection systems failures (e.g.

hidden failures), and (remedial) operators’ actions (which should improve but can deteriorate

the grid stability and are strongly linked with the reliability of the ICT infrastructure).

• For the transition between the slow and the fast cascades: all kinds of electrical instabilities

(violations of protection limits, voltage, frequency, transient and small-signal instabilities) can

trigger the fast cascade.

• For the fast cascade: the triggering of protections due to the value of electrical variables

during the transient, and possible failures of relays. We insist that only load shedding relays

are designed to protect the overall system in order to avoid to reach a feared situation, and

that all other protection systems are designed to protect a particular component or a particular

subsystem8. The latter can thus have a negative effect on the overall system.

Main system state transition phenomena and mechanisms occurring in slow and fast cascades are

summarized in Table 2.1. The word “transition” refers here to the transition from one system state

to another one and not to the transition between the slow cascade and the fast cascade. As it is

complex to model all these mechanisms in one model, the approach proposed in Chapter 5 should

be understood as a general framework able to take into account these phenomena, even if only a

subset of these mechanisms will be modeled in practice.

Phase Main transition phenomena Main failure mechanisms

Slow Failures Independent, thermal,

Cascade Operators actions and protection systems failures

Fast Protections systems Protections systems failures

Cascade Load shedding relays (relays, circuit breakers, ...)

Table 2.1: Main system states transition phenomena and mechanisms occurring in slow and fast

cascades.

8It is completely different in nuclear power plants, where the aim of all protection systems is to avoid to reach a

feared situation at the system level.

32

Chapter 3

Introduction on reliability analysis

methodologies

3.1 Introduction

As seen in the previous Chapter, blackouts are due to cascading failures. The estimation of

scenarios that could lead to blackout, their frequencies, their consequences and the risk they induce,

has to rely on reliability analysis methodologies. These methods were initially developed for other

sectors (nuclear engineering, aviation and space, ...) but they are progressively transposed to power

systems. The aim of this Chapter is to present briefly the main methodologies that are used in this

PhD thesis. Reliability properties of complex systems cannot be estimated directly from operational

feedback. Indeed, as they are designed in a reliable way, failures of one system are too rare to

apply statistical inference. Moreover, it is inconceivable to build several identical complex systems

to collect better statistics. However, as system failures are caused by combinations of component

failures, the reliability properties of systems can be computed from the reliability properties of basic

components. The latter properties can be estimated directly from operational feedback or from

test campaigns by statistical inference. This introduction thus begins with the development of the

reliability properties of basic components (Subsection 3.1.1). Reliability methodologies can then be

used to estimate the “risk” induced by systems. However, risk is a word with various definitions. It is

thus necessary to clarify the definition used in this PhD thesis to avoid confusion. This introduction

then clarifies the definition of risk used in this PhD thesis (Subsection 3.1.2). As the blackout PRA

methodology developed in this PhD thesis are inspired by three PRA levels used for safety analysis of

nuclear power plants, the latter are presented in Subsection 3.1.3. The organization of the following

Sections of this Chapter is described in 3.1.4.

3.1.1 Reliability of components

The aim of this Subsection is to introduce reliability properties of basic components. The reliability

of an item is defined by the International Electrical Commission as “the probability that it can

perform a required function under given conditions for a given time interval” (by assuming in general

that the item is in a state to perform this required function at the beginning of the time interval)

[27]. Mathematically, the reliability R(t) of item I at time t can be expressed as [28]

R(t) = Pr[I not failing on [0, t]]. (3.1)

If the random variable representing the lifetime (or the first failure time) is denoted by Tf , we have

R(t) = Pr[Tf > t]. (3.2)

33

CHAPTER 3. INTRODUCTION ON RELIABILITY ANALYSIS METHODOLOGIES

The reliability R(t) is then a non-increasing function on [0,∞[, with R(0) = 1 and limt→∞R(t) = 0.

Similarly, the unreliability F (t) of item I at time t is the probability that this item has failed on

[0, t],

F (t) = Pr[Tf ≤ t] = 1−R(t). (3.3)

The failure density f(t) is the probability density function of the random variable Tf ,

f(t) =dF (t)

dt= −dR(t)

dt. (3.4)

The probability of failure during a small time interval [t, t+dt] is given by f(t)dt = F (t+dt)−F (t).

A useful parameter in reliability studies is the failure rate, a conditional failure density. The failure

rate λ(t) is the probability of failure per time unit at time t, given the item has not failed on [0, t],

λ(t) =f(t)

1− F (t)=f(t)

R(t)= −R

′(t)

R(t). (3.5)

From (3.5), the reliability can be expressed as a function of the failure rate by

R(t) = exp

[−∫ t

0

λ(s)ds

]. (3.6)

The Mean Time To Failure (MTTF), i.e. the expected value of Tf , is simply given by

MTTF =

∫ ∞0

R(t)dt. (3.7)

The bathtub curve concept is widely used to represent the evolution in time of the failure rate of

many components or systems, as shown in Figure 3.1. The bathtub curve consists of three successive

Figure 3.1: Bathtub curve. From [21].

parts [21]:

• An infant mortality period with a decreasing failure rate, mostly caused by inner defects. As

these defects should cause quickly the failure of the component/system (early failures), the

failure rate decreases quickly during this period.

• A normal/useful life period with a low and approximately constant failure rate (mainly due to

random failures).

• A wear-out period that exhibits an increasing failure rate (due to an increasing ageing and

wear-out).

34


During the useful life of a component, when the failure rate is approximately constant, λ(t) ≈ λ,

the random variable representing the lifetime of the item follows an exponential law with

R(t) = exp(−λt) (3.8)

and

MTTF =1

λ(3.9)

An analog modeling can be developed for the repair process, which can be described by a repair

rate µ(t), similar to the failure rate. For repairable components, availability is another important

property. The availability of an item is defined by the International Electrical Commission as “the

probability that an item is in a state to perform a required function under given conditions at a given

instant of time, assuming that the required external resources are provided ” [27]. Mathematically,

the availability A(t) of item I at time t can be expressed as [28]

A(t) = Pr[I not failing in t]. (3.10)

Obviously, the availability of a non-repairable component is simply given by its reliability. In general,

the availability of a component depends on the combined aspects of its reliability performance, its

maintainability performance and its maintenance support performance.

Some components can fail only when they are triggered (e.g. switches). In these case, an on-

demand failure probability (or failure rate on demand) can be used [21].

Components’ failures data can be collected through a test campaign or operational feedback.

Based on these data, the failure rate can be estimated by statistical inference:

1. A parametric law is selected a priori on a qualitative analysis of failures data and prior

knowledge of typical laws for the concerned component

2. The parameters of this law are adjusted through statistical inference (e.g. maximum likelihood

estimation)

3. The likelihood of the adjusted parametric law is evaluated through a statistical hypothesis test

(e.g. Chi-squared test)

3.1.2 Formal definitions of risk

Risk is a word with various definitions. It is thus necessary to clarify the definition used in this PhD

thesis to avoid confusion. Risk is defined by [29] (Oxford University Press dictionary) as “possibility

of something bad happening at some time in the future; a situation that could be dangerous or have

a bad result”. This definition is close to the definition of hazard: “a thing that can be dangerous

or cause damage” [29]. This definition of risk is limited since the idea of likelihood of something

bad happening is not considered. From this definition, one can say that the risk of a major nuclear

accident exists, as well as the risk of an electric blackout, but the idea of quantification or ranking

of the risks does not appear. The International Electrical Commission defines the electrical risk

as the “combination of the probability of occurrence of electrical harm and the severity of that

harm when electric energy is present in an electrical installation” [27]. This definition introduces

the idea of likelihood of something bad happening, through the probability of occurrence. We can

generalize this definition for the risk as the “combination of a probability for an accident occurrence

and the resulting negative consequences”. If we assume that there are n different potential source

of accidents, the latter definition leads to a preliminary definition for the overall risk as a collection

of n pairs,

Risk ≡ (P1, C1), ..., (Pi, Ci), ...(Pn, Cn), (3.11)

35


where Pi and Ci denote the probability of occurrence of the accident i and its consequences, respec-

tively. However, it is confusing to speak about “probability of accident occurrence” if a time interval

on which the accident is likely to take place is not specified. The last definition can thus be adapted

either by speaking about probability of a feared situation/state, or by speaking about occurrence

frequency Fi of an accident i ,

Risk ≡ (F1, C1), ..., (Fi, Ci), ...(Fn, Cn). (3.12)

The concept of accident occurrence frequency can be sometimes difficult to understand. We can

simply remind that the frequency of the consequence of an event is the inverse of the mean time

after which this consequence takes place (for a sufficiently large population). Since one can be

interested in many different consequences (the number of fatalities, the number of injuries, the

amount of radionuclide release, the amount of money or property or other resources lost, the loss

of supplied power, the energy not served, ...), there are many risk definitions, one per consequence

definition.

They are therefore two ways to estimate the risk: a “situation/state-based” approach which has to

estimate the probability of a feared situation/state, and a “scenario-based” approach which has to

estimate the frequency of a feared scenario. The selection of one of these approaches depends on the

type of events and the time scale studied. A situation-based approach studies mean properties of the

system since it relies on the probability to find the system in each state, and it is thus concerned by

long time scales. On the contrary, a scenario-based approach studies the development of accidental

scenarios and it is thus concerned by short time scales.

The previous preliminary definition of risk as a collection of pairs is interesting for a small n, since

it gives detailed information on potential accidents. However, it does not allow to rank1 accidents

or different system configurations according to their risk contribution to the global risk. The most

common practice in engineering consists in taking the product of the frequency (or probability) and

consequences as the measure of risk. It corresponds to the “mean negative consequences”. The risk

Ri of the potential accident i is then

Ri = Fi × Ci, (3.13)

and the risk associated with the feared situation/state i,

Ri = Pi × Ci. (3.14)

The overall risk R is then simply given by the sum on all potential accidents of their individual risk,

R =

n∑i=1

Ri =

n∑i=1

Fi × Ci, (3.15)

or by the sum on all potential feared situations/states of their individual risk,

R =

n∑i=1

Ri =

n∑i=1

Pi × Ci. (3.16)

The purpose of a risk study is not only to compute this overall risk, but to identify the triplet

scenario,frequency,consequence for each potential accident or the triplet situation,probability,

consequence for each feared situation, according to the approach selected. The scenario knowledge

(identification of accident progression) or the situation knowledge (identification of the set of failures)

is necessary to improve protection. From the frequency, or the probability, and consequences, the

risk can be computed, and scenarios or situations can be ranked according to it (or according to

frequency or probability or consequences). Again, there are as many definitions of risk as definitions

of consequences, and interesting consequences should be clearly defined before any risk analysis.

1Except by using multicriteria ranking.

36


3.1.3 Nuclear safety

The safe design of nuclear installations is based on a deterministic approach and the concept of

defence in depth. The deterministic approach rely on the assumption that a nuclear power plant will

be reliable if it can endure several sets of dangerous problems (loss of off-site power, loss-of-coolant,

...) without core damage. The list of accidents a nuclear power plant must endure is set by public

authorities in each country (design basis accidents). The defence in depth concept was stated by

the IAEA by “All safety activities, whether organizational, behavioural or equipment related, are

subject to layers of overlapping provisions, so that if a failure should occur it would be compensated

for or corrected without causing harm to individuals or the public at large. This idea of multiple

levels of protection is the central feature of defence in depth...” [30]. One implication of this defence

in depth concept is the implementation of several successive physical barriers for the confinement of

radioactive material in a nuclear power plant. In such a nuclear installation, radioactive material is

produced in the fuel matrix by fission or activation. As shown in Figure 3.2, for pressurized water

reactors, the barriers confining the fission products are typically [31]:

• The fuel matrix and the fuel cladding,

• The boundary of the reactor coolant system (the primary circuit),

• The reactor containment system.

Figure 3.2: Steam cycle for pressurized-water reactor (PWR). Adapted from [32].

Complementary to deterministic and defence in depth approaches for the design, probabilistic

studies are performed to assess the residual risk. Due to this defence in depth concept, nuclear power

plant PRA is not an easy matter. It is based on a scenario analysis and is in general decomposed in

three levels, as illustrated in Figure 3.3 [33]:

• A Level 1 PRA estimates the frequency of accidents that cause damage to the nuclear reactor

core. In that way, the Level 1 PRA provides the first measure of risk, the Core Damage

Frequency (CDF). It is the accident frequency analysis. It starts with an initiating event and

it ends either when a core damage state is reached, or a safe situation. In other words, a Level

1 PRA reveals the vulnerability paths of the power plant leading to a core damage.

• A Level 2 PRA estimates the frequency of accidents that release radioactivity from the nu-

clear power plant due to the loss of integrity of the primary circuit and the containment. A

consequence analysis can also estimate how much radioactivity is released. In that way, the

Level 2 PRA provides second measures of risk, the Large (Early) Release Frequency (L(E)RF).

Eventually, it can also provides the “mean” radioactivity release. It is the accident progression

and source term analysis. It starts at the end of Level 1 (from a core damage state) and it

37


ends either when a release of radioactivity occurs or when a safe situation is reached. In other

words, a Level 2 PRA reveals the vulnerability paths of the power plant leading to off-site

consequences and can also quantifies the radioactivity release after a core damage.

• A Level 3 PRA estimates the “mean” consequences in terms of doses to the public and damage

to the environment. In that way, the Level 3 PRA provides the final measure of risk. It is the

offsite consequences analysis. It starts at the end of Level 2 (from a radioactivity release) and

it ends when health effects resulting from the radiation doses to the population around the

plant or the land contamination resulting from radioactive material released in the accident

are estimated.

This decomposition is motivated, among other, by the different physical phenomena that occur in

each level. Level 1 focuses on the first barrier integrity, while level 2 is concerned by the second and

the third barriers integrity. No barrier is associated with level 3.

Figure 3.3: The three PRA levels in nuclear safety.

3.1.4 Organization of this Chapter

Sections 3.2 and 3.3 present widely used scenario-based and state-based risk estimation method-

ologies, respectively. As the approach developed for blackout PRA in this PhD thesis relies on

dynamic reliability methodologies, Section 3.4 introduces the concept of dynamic reliability. Finally,

Section 3.5 concludes.

3.2 Scenario based risk estimation methodologies

3.2.1 Introduction

As specified in Subsection 3.1.2, the purpose of a scenario-based risk study is to compute the

triplets scenario,frequency, consequence for each potential accident. The typical analysis scheme

used to compute these triplets is given in Figure 3.4 [28]. There can be no feared consequences if

there is not unexpected event, called initiating event, which initiates an accidental sequence. Each

accident then starts with an initiating event. After identifying initiating events, the second phase

begins for each of them with the task of identifying the accident sequences: the potential courses of

events that might follow an initiating event are then examined. Indeed, the occurrence of an initiating

event can trigger protection systems (including human actions) to avoid/limit feared consequences,

or can trigger additional failures. The accident sequence analysis consists therefore in identifying

all possible sequences initiated by the initiating event, according to events that could occur. It

is the first element of the triplets s,f,c. The other two elements are then computed in parallel,

on the basis of the scenario. The scenarios variability is due to the possible failures of the solicited

systems. To quantify the frequency, the frequency of the initiating event and the failure probabilities

of each system have to be quantified. This is the objective of the system analysis. Since the accident

development also depends on human actions, the estimation of the accident frequency also relies

38


on human reliability analysis. In parallel, consequences are estimated for each scenario through a

consequence model which relies on a physical model of the system. Frequency and consequences can

then be combined to give a risk estimation.

Figure 3.4: From an initiating event to the risk estimation.

3.2.2 Event trees

Following a particular initiating event, the Event Tree (ET) analysis is a technique used to find

potential accident sequences [28, 21]. The ET is a diagram that shows the initiating event and

the failures or successes of the systems triggered in the progression of the accidental transient.

Event trees are thus based on inductive/forward logic on the chronology (or at least ordering) of

events. Figure 3.5 shows an ET for a Loss Of Cooling Accident (LOCA) in a typical nuclear power

plant. The accident starts with a coolant pipe break having a frequency of occurrence FA. The

potential course of events and all possible alternatives that might follow such a coolant pipe break

are then successively examined. At the first branching, the status of the electric power is considered.

The unavaibility (with a probability PB) results in very large release. If it is available (with a

probability 1− PB), the Emergency Core Cooling System (ECCS) is studied. Failure of the ECCS

(with a probability PC1) results in fuel meltdown and varying amounts of fission product release,

depending on the success or failure of the fission product removal systems. If the ECCS succeeds

(with a probability 1 − PC1), the fission product removal system is studied. Failure of the fission

product removal system (with a probability PD1) results in small and medium fission product releases

depending on the conservation or not of the containment integrity. The success of the fission product

removal system can avoid fission product release if the containment integrity is kept, or can limit

the release if the containment integrity is not kept. The frequency of an ET branch is simply given

by the product of the initiating event frequency by the successive branching probabilities. In case of

dependencies between events, conditional branching probabilities must be used. The consequences

of each branch have to be estimated on a physical modeling basis. For example, simulations of the

plant response can be performed for each branch to estimate the amount of fission product releases.

3.2.3 Fault trees

If all data used in an ET are known, the triplets scenario,frequence, consequence can be directly

obtained from the ET. However, the branchings in the ET are due to complex systems and branching

probabilities have to be computed. Fault Tree (FT) analysis can then be used. It is an analytical

technique, where an undesired state of the system is specified (top event) and then the system is

analyzed to find all combinations of basic events leading to the occurrence of the undesired state

[28, 21]. The FT is a graphic model in which logical gates integrate the primary events (i.e. basic

39


Figure 3.5: An event tree for a pipe-break initiating event. Adapted from [28].

events and the house events) to the top event. A basic event is a random event whose occurrence

probability can be directly quantified. House events represent those basic eventss forced to be either

in their true or false state. Fault trees are thus based on deductive/backward logic and analyze a

unique and well-defined undesired event. The FT of a system that has a principal power system

and a standby power supply is shown in Figure 3.6. The standby power is switched into operation

by an automatic switch when the principal power supply fails. Power is unavailable in the system

if the principal and standby units both fail (first entry of the OR gate under the top event), or if

the switch controller fails and the principal units fail and the switch controller failure exists when

principal unit fails (second entry of the OR gate under the top event).

Figure 3.6: Example of a fault tree. From [28].

When the inputs of an OR gate are independent, the probability of the output is given by the

sum of the input probabilities minus their product. When inputs of an AND gate are independent,

the probability of the output is given by the product of the input probabilities. However, interde-

pendencies in complex systems entail in general dependencies between inputs of several gates, even

if all basic events are independent (e.g. if a basic event is the entry of two different gates). The

quantification of the top event probability from basic event probabilities relies then on more complex

techniques such as minimal cut sets and minimal path sets (sometimes called tie sets). A cut set is

a collection of basic events such as, if all basic events occur, the top event is guaranteed to occur.

A path set is the dual concept of a cut set: it is a collection of basic events such as, if none of the

events in the set occurs, the non-occurrence of the top event is guaranteed. A minimal cut set is a

cut set containing no other cut set (i.e. if any basic event is removed from the set, the remaining

40


events collectively are no longer a cut set). A minimal path set is a path set containing no other path

set (i.e. if any basic event is removed from the set, the remaining events collectively are no longer

a path set). The quantification of the probability of the top event relies on the description of the

state of the basic event or the system by a binary indicator variable. If we assign a binary indicator

variable Yi to the basic event i, then Yi = 1 when the basic event exists and Yi = 0 on the contrary.

Similarly, we assign the binary indicator variable ψ(Y ) to the top event, where Y = (Y1, ..., Yn).

This function ψ(Y ) is known as the structure function for the top event. The probability of the top

event is the expected value of the structure function. If we consider a fault tree having m minimal

cut sets with cut set i containing ni basic events Bi,j , the structure function is given by [28]

ψ(Y ) =

m∨i=1

[ ni∧j=1

Yi,j

], (3.17)

where Yi,j is the indicator variable for Bi,j . In the same way, if we consider a fault tree having m

minimal path sets with path set i containing ni basic events Bi,j , the structure function is given by

[28]

ψ(Y ) =

m∧i=1

[ ni∨j=1

Yi,j

]. (3.18)

For a reasonable number of basic events, the structure function can then be expanded and simplified

using the specific properties of Boole’s algebra (idempotence law, absorption law, ...), resulting in

a polynomial form whose expected value can be easily computed from the basic event probabilities

when they are independent.

3.2.3.1 Conclusions

They are several steps to compute the triplets s,f,c for each potential accident in a scenario-

based risk study: identifying initiating events, identifying dangerous scenarios they can initiate,

estimating their frequencies through the successive failure or success probabilities and estimating

the consequences of each scenario through a consequence model. Event tree and fault tree analyses

are then complementary techniques to be combined for identifying accident sequences that could

occur in a complex system and estimate their consequences. Event trees are developed by asking

questions such as “What happens if the pipe breaks?”, and fault trees such as “How could the

electric power fail?” [28]. If an ET branching is not due to a single component, but to a subsystem,

a FT has to be used to compute branching probabilities.

3.3 State based risk estimation methodologies

3.3.1 Introduction

As specified in Subsection 3.1.2, the purpose of a state-based risk study is to compute the triplets

state,probability, consequence for each feared state. As for scenario based risk estimation method-

ologies, consequences are estimated for each state through a consequence model which relies on a

physical model of the system. According to the size of the system and the type of transitions be-

tween states, different methodologies are to be used to identify feared situations and to compute

their probabilities. For a small number of system states, a state graph can be useful to understand

the general mathematical modeling. Therefore, next Subsection presents this tool. Subsections 3.3.3

and 3.3.4 develop the mathematical modeling for Markovian and semi-Markovian processes, respec-

tively. Finally, Subsections 3.3.5 and 3.3.6 introduce two methods widely used for power systems,

state enumeration and Monte Carlo simulation, respectively.

41


3.3.2 State graph

The state graph (or system state transition diagram, or state space diagram) represents all possible

exclusive states of a system based on the states of its components, as well as all possible transitions

between system states [34]. The state space diagram of a system is constructed according to com-

binations of individual components’ states, their individual transitions, their common transitions

(e.g. common mode failure), but also from operational constraints which can entail dependencies

(e.g. only one repairman available). A state transition diagram of a repairable component with two

states (up and down) is shown in Figure 3.7. The transition from the up state to the down state is

due to a failure and the transition from the down state to the up state is due to a repair. Obviously,

Figure 3.7: State space diagram of a repairable component.

this state graph allows to represent easily components with more than two states. For example,

when a non-severe failure occurs, some components can still operate in a degraded state (or derated

state for electrical components) due to a partial failure mode, as shown in Figure 3.8. Multi-state

Figure 3.8: State space diagram of a three-state repairable component with a derated state.

component state space diagrams can also be used to model a preoutage state (a degradation which

does not entail the immediate failure), to separate forced down state and planned outage state, ...

Figure 3.9 shows the five states and their transitions for a system of two repairable components with

a common mode failure (direct transition from state 1 to state 4). The main advantage of state

space diagram is the clear picture of all states and transitions between them. It is extremely useful

in modeling individual multi-state components. However, such a diagram is not applicable to large

systems: if a system contains N components without dependencies, each of them having two states

(operational or failed), the number of system states is 2N , which is quickly unmanageable for large

N .

Figure 3.9: State space diagram of two repairable components with a common mode failure.

3.3.3 Markovian systems

A Markovian process can be defined as “a continuous stochastic process in which future states

are conditional only on the present state and are independent of previous states” [21]. The future

evolution of a Markovian system depends only on the actual state, and not on the system’s past

42


history. In stochastic processes theory, a regeneration time is such that at this time, the future of

the process is independent from the past. In a Markovian process, each time is a regeneration time.

If we denote by πi(t) the probability to find the system at time t in state i, the derivative π′i(t) is

given by the conservation equations

π′i(t) = (inflow to state i)− (outflow out of state i)

=∑j 6=i[rate of transition to state i from state j]× [probability to be in state j]

−∑j 6=i[rate of transition from state i to state j]× [probability to be in state i].

(3.19)

Due to the Markovian hypothesis, the rate of transition from one state to another is constant. If we

denote by pi→j the transition rate from state i to state j (probability per unit time that the system

goes from state i to state j), this equation can be re-written

π′i(t) =∑j 6=i

pj→iπj(t)−∑j 6=i

pi→jπi(t) (3.20)

If the failure of an element k entails the transition from state i to state j, the corresponding transition

rate pi→j is the failure rate of this element λk. If the transition from state i to state j is due to

the repair of element k, the corresponding transition rate pi→j is the repair rate of this element µk.

These equations can therefore be written without a state space diagram, even if it is easier with.

The transition rates are in general indicated on the state graph of a Markovian system. The state

space diagram of the Markovian system constituted by two repairable components with a common

mode failure is then given in Figure 3.10, where λ1 and λ2 are the failure rates of components 1 and

2, respectively, µ1 and µ2 are the repair rates of components 1 and 2, respectively, and λc is the

common mode failure rate. It leads directly to the equations

Figure 3.10: Markovian state graph of two repairable components with a common mode failure.

π′1(t) = µ1π2(t) + µ2π3(t)− (λ1 + λ2 + λc)π1(t) (3.21)

π′2(t) = λ1π1(t) + µ2π4(t)− (µ1 + λ2 + λc)π2(t) (3.22)

π′3(t) = λ2π1(t) + µ1π4(t)− (µ2 + λ1 + λc)π3(t) (3.23)

π′4(t) = λcπ1(t) + (λc + λ2)π2(t) + (λc + λ1)π3(t)− (µ1 + µ2)π4(t) (3.24)

(3.25)

If negative consequences are associated with some states (e.g. state 4 if components are in parallel),

this set of linear and homogeneous equations can be simply solved (with the initial condition π(0) =

(1, 0, 0, 0) if we assume that both components are initially in service) and risk can be computed

according to the negative consequences in each state. We should note again that it is then well a

“state-based” estimation of the risk: the risk due to a state is the product of the probability of this

state by the consequences of this state. This estimation strongly differs from the ET/FT one, which

is a “scenario-based” estimation of the risk. The stationary state π∞ can be found by nulling all

derivatives, which gives an algebraic set of equations with the condition that the sum of all π∞,i is

43


equal to 1. In particular for the two-state repairable component showed in Figure 3.7 with a failure

rate λ and a repair rate µ, the stationary equations are

µπ∞,D − λπ∞,U = 0, (3.26)

λπ∞,U − µπ∞,D = 0, (3.27)

π∞,U + π∞,D = 1. (3.28)

where π∞,U and π∞,D are the asymptotic probability to find the component in state up and in state

down, respectively. The solution is given by

π∞,U =µ

λ+ µ, (3.29)

π∞,D =λ

λ+ µ. (3.30)

Once the π∞,i of a system are computed, the overall (steady-state) risk R can be estimated by

R =∑i

π∞,iCi (3.31)

where the Ci are the consequences (or index function), such as load curtailment, associated with

state i. Note that non-failure system states have a zero value of the index function and do not make

contributions to R, although their probabilities are not equal to zero.

Equations 3.20 can be also written in integral form as

πi(t) = πi(0) exp[−λit] +∑j 6=i

∫ t

0

pj→iπj(t− τ) exp[−λiτ ]dτ (3.32)

where

λi =∑j 6=i

pi→j . (3.33)

3.3.4 Semi-Markovian and non-Markovian systems

The Markovian hypothesis is not adequate for all systems: all components do not have con-

stant failure rates and constant repair rates. However, previous modeling can be extended to semi-

Markovian systems (each entry into a new state is a regeneration point) and non-Markovian systems

(no specific regeneration points). In these case, a steady-state risk like the equation (3.31) cannot

be defined. If we are interested in the behavior of the system during a time period T , the mean

probability to find the system is state i is given by

< πi >=1

T

∫ T

0

πi(t)dt, (3.34)

where πi(t) is the probability to find the system at time t in state i, and the risk is then given by

R =∑i

1

T

∫ T

0

πi(t)dtCi. (3.35)

3.3.5 State enumeration approaches

Most reliability evaluations of power systems are based on the Markovian hypothesis (constant

failure rates and repair rates) [34, 11]. However, the (asymptotic) probability of a system state i is

rarely computed from the stationary form of (3.20). The analytical state enumeration method of

a system computes the probability to find the system in a specific state through the probability to

44


find each of its components in the corresponding state. If all N components are independent, the

probability to find the system in state i is simply given by

πS∞,i =

N∏j=1

πC∞,Sj(i) (3.36)

where Sj(i) indicates the state of component j in system state i. In case of dependencies, this

equation must be adapted. A complete state enumeration method computes exactly the sum (3.31)

by estimating the probability and the consequences of each system state. For large systems, it

is however quasi-impossible to analyze all states in a reasonable amount of time. A partial state

enumeration method uses a criterion to limit the number of states considered in the sum (3.31) and

thus the complexity. The simplest criterion is to limit the number of contingencies in each state

analyzed to a maximum number of k contingencies (with k = 1, 2, 3, ...). It supposes then implicitly

that the situations most contributing to the risk have a small number of contingencies (if all events

are independent, the probability is quickly decreasing with the number of contingencies).

3.3.6 Monte Carlo simulation

When the number of states is so large that it is impossible to analyze all states (even with a

partial state enumeration), Monte Carlo simulations are preferred [34, 11]. It consists of using only

a sample of states in the set of all possible states, and of approximating the sum in equation (3.31)

by

R ≈ 1

M

M∑j=1

Cj = R (3.37)

where M is the total number of sampled states and Cj are the consequences associated with the

sampled state j. It is based on the fact that, when the number of samples is sufficiently large, the

sampling frequency of the system state i can be used as an unbiased estimate of its probability. In

general, each state is sampled by sampling the state of each component, independently or depen-

dently in case of common mode failures (the sampling of a system system is equivalent to sample

the state of each component). There are two types of Monte Carlo simulations: sequential and

non-sequential.

The aim of a sequential Monte Carlo simulation is to estimate the risk by simulating the stochastic

evolution2 at fixed discrete time steps. Each sampled state is then linked to the previous one

according to specific evolution laws (transition rates). A sequential Monte Carlo can then be applied

easily to Markovian, semi-Markovian or non-Markovian processes. The “component state duration”

approach consists in sampling the transition times of each component and in constructing then

system states according to the state of each component, as shown in Figure 3.11. The “system state

duration” approach consists in sampling directly the transition times of the system.

On the contrary, the aim of a non-sequential Monte Carlo simulation, sometimes called the state

sampling approach, is to estimate the risk by sampling different system states, but each independent

from the others. As for a sequential Monte Carlo simulation, the states can be sampled directly, or

through the individual sampling of components’ states.

The main problem when using approximation (3.37) is to known the number of samples M needed

to reach a satisfactory precision. The key parameter to estimate the precision is the sample variance

2It can be surprising to simulate the stochastic evolution in a “state-based risk estimation”. However, one should

remember that the name “state-based” is the estimation of the risk through the estimation of probability of feared

state (and their consequences) which is still the case here.

45


Figure 3.11: Chronological components and resulting system state transition processes.

S2 (unbiased estimator of the variance σ2),

S2 =1

M − 1

M∑j=1

(Cj − R)2 =1

M − 1

M∑j=1

C2j −

M

M − 1R2. (3.38)

Indeed, it can be proven [35] that[R − tα/2,M−1

√S2

M, R+ tα/2,M−1

√S2

M

](3.39)

is a 100(1− α)% confidence interval for R, where tα/2,M−1 is defined by

Pr[T ≤ tα/2,M−1] = 1− α

2(3.40)

where the random variable T has a Student’s t-distribution with M − 1 degrees of freedom, T ∼tM−1

3. Therefore, any confidence interval is proportional to√S2/M . The precision can then be

controlled a posteriori and the number of MC runs needed to reach a given precision is proportional

to the sample variance. Variance reduction techniques have been developed to reduce this number.

However, the efficiency is not directly given by the total number of MC runs but more by the total

computing time needed to reach a given precision. We can then quantify the efficiency of a MC

algorithm by the figure of merit ε defined by

ε =1

S2t, (3.41)

where t is the mean time per MC run.

3.4 Dynamic reliability

The two previous sections described what we call here “classical” probabilistic studies. Scenario

frequencies or state probabilities are computed independently of process variables (like tempera-

tures, pressures, currents, voltages, ...) evolution. These process variables can then be computed

a posteriori (either in a dynamic way for a scenario based risk estimation, or in a static way for a

situation/state based risk estimation4) to perform the consequence analysis. In both cases, a system

is described by discrete states and transition rates, or transition probabilities, between these states.

Each transition rate/probability can only depend on initial and final states and possibly on time.

3When M →∞, a Student’s t-distribution converges towards a standard normal distribution.4In general in a static way for an asymptotic Markovian approach, but sometimes in a purely dynamic way or a

dynamic way for some process variables and a static way for the other for others state-based risk estimation approaches.

46


This modeling cannot consider correctly the variation of transition rates/probabilities (e.g. failure

rates) with the evolution of process variables in a system state. The analysis of past blackouts in

Chapter 2 showed that the loss of one of several elements can induce a thermal transient and can

thus increase failure rates/probabilities of lines, cables and transformers. Moreover, during the fast

cascade, transitions between states due to protections are directly triggered by electrical variables.

Classical PRA is unable to model correctly these phenomena.

On the contrary, dynamic reliability or dynamic PRA describes a system not only by discrete

states, but also by a set of process variables x, in a coupled way [36]. As it is the case in classical

probabilistic studies, for each system state i, the evolution of process variables is characterized by

specific dynamic equations,dx

dt= qi(x, t), (3.42)

or, in an equivalent explicit form,

x(t) = gi(t, x0) (3.43)

where

x0 = x(0) = gi(0, x0) (3.44)

The originality of dynamic reliability is to allow transition rates to be dependent upon some of the

process variables, while still considering a specific evolution of process variables x in each system

state. We denote by p(i → j|x) the transition rate from state i to state j and by π(x, i, t) the

probability density function to find the system with process variables in dx about x in state i at

time t. This distribution is normalized as follows,∑i

∫RN

π(x, i, t)dx = 1. (3.45)

The conservation equation (3.19) must be adapted for these partly discrete (i), partly continuous

(x) states in the form∂

∂t(density) +∇(flux) = sources (3.46)

The probability flux can easily be obtained by observing that, in the process variables space, dynam-

ics qi(x) can be understood as generalized velocities of the process variables in configuration i. Still

in the Markovian case, this leads to the Chapman-Kolmogorov equation which rules the evolution

of the probability density, as an adaptation of equation (3.20),

∂π(x, i, t)

∂t+∇x[qi(x, t).π(x, i, t)] = −

∑j 6=i

p(i→ j|x)π(x, i, t) +∑j 6=i

p(j → i|x)π(x, j, t), (3.47)

which can be also written in integral form as

π(x, i, t) =

∫RN

π(u, i, 0)δ(x− gi(t, u)) exp

[−∫ t

0

λi(gi(s, u))ds

]du

+∑j 6=i

∫ t

0

∫RN

p(j → i|u)π(u, j, t− τ)δ(x− gi(τ, u)) exp

[−∫ τ

0

λi(gi(s, u))ds

]dudτ

(3.48)

where

λi(x) =∑j 6=i

p(i→ j|x). (3.49)

The interpretation of equation (3.48) is the following: the system is in state i at time t with process

variables x either if it has been in state i from the beginning of the transient with process variables

u, following dynamics gi(t, u) with a survival probability given by exp[−∫ t

0λi(gi(s, u))ds], or if the

47


last transition to state i took place at time τ < t with process variables u, where the system left

state j following dynamics gi(τ, u) with a survival probability given by exp[−∫ t−τ

0λi(gi(s, u))ds].

A possible system evolution is sketched in Figure 3.12: after an initiating event, the system leaves

Figure 3.12: A possible system evolution due to configuration changes. From [37].

its steady-state conditions and enters a first state i1 where process variables x evolve according to

a first set of differential equations; the variation of these variables can influence transition rates to

other system states; if a transition to state i2 occurs, process variables evolve according to another

set of differential equations with initial conditions, corresponding to the process variables values at

the time state i1 is left; etc. Such a piecewise-deterministic stochastic process either leads the system

to final safe conditions or to an undesired damage state, the latter corresponding to exiting a safe

region in the process variable space. The two main problems to solve before solving the equations

themselves are then to identify adequate process variables and their evolution in all system states,

and to know transition rates p(i→ j|x).

When using dynamic reliability, a classical event tree is modified into a Dynamic Event Tree

(DET), or a Continuous Event Tree (CET), so that configuration changes triggered by the evolution

of process variables create the possible branch points of the tree. Discrete Dynamic Event Trees

(DDET) denotes a family of similar methods providing discrete, hence finite, approximations of a

DET. After the occurrence of an initiating event, process variables follow evolution laws associated

to the resulting system configuration. The corresponding deterministic transient evolution defines a

mother branch. Process variables evolution is computed by simulation. New branches are generated

from this mother branch at user-specified discrete time intervals due to all possible events causing the

system to branch off and according to branching rules (e.g. crossing on a demand-related hardware

setpoint or probabilistic thresholds). New branches are generated from the secondary branches, and

this branching process is carried on from each branch. The development of a scenario (or a branch)

is stopped as soon as an absorbing state is reached (either a damage state or a safe situation).

Finally, the frequency of the user-specified absorbing state can be calculated as they develop in the

simulation, and related scenarios are identified.

3.5 Conclusions

This Chapter introduced a formal definition of risk, as the combination of likelihood and gravity of

something bad happening. There are two different paradigms available for a mathematical definition

of the risk: a situation-based paradigm and a scenario-based paradigm. In the first case, the risk of a

feared situation is given by the product of its probability and its consequences and the aim of a PRA

approach is then to identify the triplets s,p,c. In the second case, the risk of an accidental scenario

is given by the product of its frequency and its consequences and the aim of a PRA approach is

then to identify the triplets s,f,c. Depending on the paradigm, specific methodologies have been

developed to estimate these triplets. Dynamic reliability methodologies extend them by allowing to

consider the mutual interaction between system states transitions and evolution of process variables.

In nuclear safety, PRA is in general decomposed in three levels, on the basis of different physical

phenomena that could occur in an accidental transient leading to off-site consequences.

48

Chapter 4

Reliability of electrical grids - state

of the art

4.1 Introduction

The reliability of an electrical grid is the degree of performance (expressed as a probability) of

delivering the electricity to customers within accepted standards and in the amount desired. As

we saw in Chapter 1, there are three functional zones in a power system: generation, transport

and distribution. In this PhD thesis, we focus only on the first two functional zones, generation

and transport (HLII). Power system reliability is in general divided into the two basic aspects of

adequacy and security, but definitions slightly differ from one reference to another. We propose to

use the definition given by the IEEE Power Systems Engineering Committee in [38]: “Adequacy may

be defined as a system’s capability to meet system demand within major component ratings and in

the presence of scheduled and unscheduled1 outages of generation and transmission components or

facilities. Security may be defined as a system’s capability to withstand disturbances arising from

faults and unscheduled removal of bulk power supply equipment without further loss of facilities or

cascading.”. As the expression “major component” is not precise, we propose to modify slightly this

definition. The adequacy is the ability of the electric system to satisfy the consumer demand and

system operational constraints at any time, in the presence of scheduled and unscheduled outages

of generation and transmission components or facilities. Adequacy is therefore limited to static

conditions which do not include system dynamics and transient disturbances (situation/state based

risk estimation methodologies). On the contrary, the security relates to the ability of the system to

respond to dynamic or transient disturbances arising in the system, from a loss of an element, or a

fault, or a fault and a loss of the faulted element (scenario based risk estimation methodologies).

The security analysis of the transmission grid has to rest on both deterministic and probabilis-

tic approaches, displaying strong conceptual similarities with safety analysis performed for nuclear

power plants. The deterministic approach rely on the assumption that an electrical grid will be re-

liable if it can endure several sets of contingencies while continuing to satisfy the consumer demand

and system operational constraints. Adequacy or security deterministic studies deal therefore with

a set of predefined situations or scenarios, respectively. As it is not possible to consider all situations

and scenarios that could occur, a residual risk of load shedding or power system collapse exists,

despite the deterministic approach. Probabilistic studies can then be used to assess the residual risk

of the grid, in order to optimally reduce this risk. Both state-based and scenario-based probabilistic

risk assessment can be used, to address adequacy and security, respectively. As shown in Figure

1NERC uses the expression “reasonably unscheduled outages”, but it introduces confusion between adequacy and

security.

49

CHAPTER 4. RELIABILITY OF ELECTRICAL GRIDS - STATE OF THE ART

4.1, the distinction between deterministic and probabilistic studies should not be confused with the

distinction between adequacy and security studies. These classifications should be understood as

different but complementary. In this Chapter, we describe briefly deterministic studies and prob-

abilistic studies from both adequacy and security point of view, especially in the context of major

system disturbances.

Figure 4.1: Reliability studies of electrical grids - classification.

4.2 Deterministic studies

Deterministic studies rely on the assumption that the electrical grid will be reliable if it can con-

tinue to satisfy the consumer demand and system operational constraints for a set of dangerous

situations. Each situation is based on an initial state with N active elements and a set of k un-

scheduled outages and all situations are considered with equal importance, independently of their

likelihood. This is called “N − k criterion”: a grid presenting N elements initially in service has to

be proven to be correctly dimensioned (in terms of mesh structure and line capacity) to successfully

face the loss of any set of k elements, by still satisfying given operational constraints. Only genera-

tion facilities are considered in a HLI study (the N − k criterion is then equivalent to require that

the generation capacity minus the k largest units must be superior to the load), while both gener-

ation and transmission facilities are considered in a HLII study. Initial states are taken as critical

solicitation states, for example the peak load or outside the peak load but with several elements

in maintenance. All active elements are included in the sets of k unscheduled outages because de-

terministic approaches do not consider outages likelihood2. Consequently, due to the combinatorial

explosion of scenarios for large k3, deterministic studies are usually limited to the N − 1 situations,

and sometimes extended to N − 2 cases.

Such deterministic approaches can address both aspects of reliability (adequacy and security),

according to the analysis performed. If the N − k criterion is only checked through a static analysis

(the system demand can be met within component ratings and in the presence of k scheduled or

unscheduled outages of generation and transmission components or facilities), a part of adequacy is

addressed, while if it is also checked through a dynamic analysis, a part of security is also addressed.

Deterministic studies are strongly used for networks sizing and reinforcement by TSOs. Moreover,

the N − 1 criterion is applied by operators both in planning (long-term, medium-term and short-

term) and in real time to guarantee that elements remaining in operation after failure of a single

network element must be capable of accommodating the change of flows in the network caused by

that single failure.

2However, a distinction is sometimes made between links (lines, cables and transformers) and power plants.3Number of sets of k contingencies: N !/[k!(N − k)!] with large N .

50


Even if the deterministic approach gives a high level of reliability, its purpose is obviously not to

estimate the risk of blackout or major load shedding. However, a blackout PRA should consider

pre-contingency states coherent with the N − 1 criterion.

4.3 Probabilistic studies - HLI

Probabilistic studies for the HLI are used to evaluate the ability of the system generating capacity

to satisfy the total system load. As it does not make any sense to study the electrical dynamic

response of power plants after the loss of a generating unit without the dynamic network response,

they are conducted only in a static way. Therefore, a probabilistic study for the HLI is a generating

system adequacy assessment. The basic risk indices in these studies are [34, 11]

• Loss Of Load Expectation (LOLE) which is the probability that the system generating capacity

cannot satisfy the total system load (unavaibility). The definition (3.16) can be adapted by

considering undesired consequences equal to 1 when the system load cannot be satisfied and

equal to 0 in the opposite case:

LOLE =∑i∈Sn

Pi (4.1)

where Sn is the set of all system states associated with loss of load (negative consequences).

The LOLE is in general expressed as the average number of days or hours per one year during

which the load is expected to exceed the available generating capacity.

• Loss Of Energy Expectation (LOEE) which is the mean energy not supplied in a specific period

of time (or the mean power). The definition (3.16) can be adapted by considering undesired

consequences equal to the difference between the system load and the generating capacity when

the system load cannot be satisfied and equal to 0 in the opposite case:

LOEE =∑i∈Sn

Pi × (Li −Gi) (4.2)

where Li and Gi are the system load and the generating capacity in state i, respectively

(Li −Gi is the loss of load for system state i).

• Loss Of Load Frequency (LOLF) which is the frequency of entering (or leaving) a state where

the system generating capacity cannot satisfy the total system load. Even if one can think

that it corresponds more to a scenario-based analysis, it is computed from a state-based risk

estimation with the definition (3.16) by considering undesired consequences Ci equal to the

sum of the transition rates towards states without loss of load,

Ci =∑

j∈S\Sn

pi→j , (4.3)

where S is the set of all system states. This risk can therefore be estimated by

LOLF =∑i∈Sn

Pi ×∑

j∈S\Sn

pi→j . (4.4)

• Loss Of Load Duration (LOLD) which is the mean duration of an interruption and can be

computed by

LOLD =LOLE

LOLF(4.5)

The first two indices are the most widely used. As described in the previous Chapter, several

methodologies are available to estimate these risk indices, which can be divided into exact method-

ologies (analytical, complete state enumeration, ...) and approximate methodologies (Monte Carlo

51


methods). When the number of power plants is high, or in presence of renewable energy (contin-

uous states), exact methodologies become unmanageable and Monte Carlo methods are preferred.

A sequential simulation should be preferred when variations imposed by load and renewable energy

sources to classical units are so abrupt that they cannot necessarily be endured by them (a sequential

simulation can then involve some aspects of security). For each system state, consequences can be

estimated quickly and simply by summing the power of all generation facilities available at one side,

the power of all loads at the other side, and by comparing them.

Such probabilistic studies for the generating system adequacy are beginning to be applied to real

systems, in order to check the “security of supply of electricity”4 of countries, especially because the

non-dispatchable renewable energy sources are becoming important. For example, in Belgium, the

FPS5 Economy studied in 2012 the adequacy of the generating capacity over the period 2012-2017

both in a deterministic and in a probabilistic approach. The HLI probabilistic study was based on a

Monte Carlo simulation software called “Antares”. A sequential simulation was used. The purpose

of this study was to estimate the additional generating capacity needed to keep a LOLE less or equal

to 16 hours/year (LOLE ≤ 1.8× 10−3) without considering electricity imports from other countries

and a LOLE less then or equal to 3 hours/year (LOLE ≤ 3.4 × 10−4) with possible electricity

imports. In July 2012, the Belgian government admitted a 10-year life extension for Tihange 1 (962

MW) and imposed the closure of the 2×433 MW Doel 1 and 2 units, based on these LOLEs.

4.4 Probabilistic studies - HLII

4.4.1 Static methodologies

This Subsection addresses composite system probabilistic studies based on static analyses of the

grid. It addresses then mainly the adequacy aspect of reliability. The adequacy index concepts used

in HLI studies can be adapted and extended to composite system adequacy assessment. Their names

are however changed to avoid confusion, as the way they are computed is completely different. The

basic risk indices in these studies are [34, 11]

• Probability of Load Curtailment (PLC) which is the probability that the generation and trans-

mission system cannot satisfy the system load (unavaibility). The definition (3.16) can be

adapted by considering undesired consequences equal to 1 when the system load cannot be

satisfied and equal to 0 in the opposite case:

PLC =∑i∈Sn

Pi (4.6)

where Sn is the set of all system states associated with load curtailment (negative conse-

quences). The PLC is in general expressed as the average number of days or hours per one

year during which the load is expected to be curtailed, but then under the name Expected

Duration of Load Curtailments (EDLC).

• Expected Energy Not Supplied (EENS) which is the mean energy not supplied in a specific

period of time (or the mean power). The definition (3.16) can be adapted by considering

undesired consequences equal to the minimum load shedding necessarily when the system load

cannot be satisfied and equal to 0 in the opposite case:

EENS =∑i∈Sn

PiLSi (4.7)

where LSi is the load shedding in state i.

4The term “security” is not used in this expression in its technical meaning defined previously, but in a common

meaning.5Federal Public Service

52


Consequences are then more difficult to estimate than in a HLI study. Indeed, even if the generation

available is sufficient to cover the demand, network constraints can be such that all the load cannot

be covered. The minimum load shedding necessary can be estimated through an OPF, where the

objective function is the total load shedding. However, this approach requires a lot of computations

and is useless when an acceptable steady state without load shedding “clearly” exists. A classical

LF can be performed before an OPF to have a first check. This basic procedure is shown in Figure

4.2.

Figure 4.2: Typical flowchart for composite system risk evaluation. From [34].

Such approaches have been widely implemented in commercial software. Tractebel developed the

software SCANNER to analyze a composite generation-transmission power system with regard to

reliability assessment and operating cost estimation [39]. The power system evaluation is based

on power system states generated by the Monte-Carlo probabilistic method. The PowerFactory

software developed by DIgSILENT has a reliability analysis function using the partial analytical

state enumeration approach [40].

4.4.2 Cascading failure simulation

4.4.2.1 CASCADE model

Dobson et al. proposed in [41] an analytical model of load-dependent cascading failure called CAS-

CADE. The model has n identical components initially in service with random loads. Components

fail when their load exceeds a threshold. When a component fails, a fixed and positive amount of

load is transferred to each of the other elements. To start the cascade, an additional load is applied

to the load of each component, as initial disturbance. The aim of this model is to capture some of

the salient features of large blackouts. Consequences analyzed are the number of components failed,

for example as a function of the average initial component loading.

53


4.4.2.2 ORNL-PSerc-Alaska (OPA) model

Carreras et al. proposed in [42] a model able to take into account outages due to overloads and

the reconfiguration of the power flows in the grid after the loss of one or several elements. For

different load patterns, the steady state of the grid is computed through a DC OPF. An overloaded

line has then a probability p to suffer an outage6. If an outage occurs, the steady state of the

grid is recomputed through a DC OPF, etc. This model can give the probability distribution of

total load shed. Thermal failure of lines caused by a tree flashover due to current increase after the

previous losses of elements are included in the OPA model explicitly in [44]. The time evolution of

line temperature, its sag and the vegetation height are modeled explicitly: a line is tripped when

the sag and the vegetation are such that a tree flashover occurs.

4.4.2.3 TRELSS model

One of the most well-known industrial reliability analysis programs for grid analysis is the Trans-

mission Reliability Evaluation of Large-Scale Systems (TRELSS) software developed for the EPRI

[45]. The simulation approach included in this software package was developed to deal with cas-

cading outages. The program begins with a steady state of an electrical grid. After an initiating

event, then the steady state is re-computed by solving load-flow (LF) equations. Then, if a load bus

voltage, a generator voltage or a circuit power flow is beyond operational limits, the corresponding

component is tripped, the steady state is re-computed, etc. If no voltage or current threshold is

exceeded, the procedure is restarted with the next initiating event.

Figure 4.3: Flowchart of the TRELSS simulation approach. From [45].

6In the original paper, the influence of the numerical value of p was studied, but no indication was given on a

“realistic” value. Further developments estimated p between 0.05 and 0.1 for the Western Electricity Coordinating

Council (WECC) electrical transmission system by data fitting [43].

54


4.4.2.4 Manchester model

An AC power blackout model was developed at the University of Manchester during the early 2000s

in order to represent a range of interactions occurring in cascading failures leading to a blackout

(cascade and sympathetic7 tripping of transmission lines, generator instability, load shedding, post-

contingency redispatch of active and reactive sources, etc.) [46]. The analysis is based on a MC

simulation. For each MC run, an initial disturbance is created by simulating random outages of

system components. If some of the faults which are the cause of these outages induce transient

instability of one or more generators, the latter are disconnected. The impact of hidden failures in

the protection system, which cause intact equipment to be unnecessarily disconnected following a

fault on a neighboring component (sympathetic tripping), is then simulated: the tripping or not of

each component whose vulnerability region contains the original faulted element is sampled. After

restoring the generation-load balance if necessary, the new steady state of the system is calculated

by solving LF equations. In case of voltage instability, the iterations do not converge and the model

assumes that operators shed specific load blocks to stop this voltage collapse. This load shedding

is repeated until convergence of the load flow iterations. The tripping of overloaded lines is then

sampled. As there is a competition between operators attempts to eliminate the overload and the

thermal transient, the probability that the operator is unable to eliminate the overload before the

protection operates can be modeled as a function of the overload. If there is a trip, the LF equations

are solved (with further load shedding if needed), etc. Once there is no more contingency, the ENS

is then computed.

Figure 4.4: Simulation flowchart of Manchester model. From [46].

Several extensions and variations of the Manchester model actually exist, based on three main

modifications. First, if the frequency deviation is outside a specific range after the restoration of the

7Due to hidden failures.

55


generation-load balance, the simulation algorithm considers that the system is collapsed. Secondly,

in order to take into account operators corrective actions modeling, an OPF can be used to minimize

the load shedding when the steady state of the system is calculated, instead of shedding specific load

blocks. Thirdly, DC LF and/or DC OPF can be used to accelerate calculations, according to the

importance given to voltage stability.

4.4.2.5 Stochastic model

The first attempt to model in details the competition between operators’ corrective actions and

additional failures seems to appear in [47]. Random line failures are modeled through constant failure

rates, overloaded-line failures occur when the temperature (computed through a time-dependent

equation) reaches the equilibrium temperature corresponding to a power flow equal to the line rating

for reference weather conditions, line restoration is modeled (constant repair rate after a constant

time delay), such as a simple model for the utility response (when a line is overloaded, probability

p1 to shut it down, probability p2 to do nothing and probability p3 to perform a partial generation

dispatch and load shedding to alleviate the overload, with p1 + p2 + p3 = 1). The same model is

used to cover all cascading failures.

4.4.2.6 Fault tree analysis

Instead of a “top-down” approach as in other methodologies, a “bottom-up” approach is proposed

in [48]. Fault trees (as described in Subsection 3.2.3) are developed for each load point of the

power system. Quantitative evaluation of the fault trees includes overload checking. During this

procedure, flows through the lines are compared with their continuous load rating which is the load

rating corrected by a correction factor kcorr in order to take into account the impact of the ambient

temperature Tamb on the line’s load rating,

kcorr =

√80− Tamb

40, (4.8)

where Tamb is in C. This expression is justified by a maximum conductor temperature of 80C and

a load rating estimated for an ambient temperature of 40C. The general idea is then to consider

the variability of the real capacity of the line with weather conditions in a simplified way.

4.4.2.7 Discussion

In models presented above, the CASCADE model is to be classified in a specific category. Indeed,

the aim of this model is not to reveal blackout scenarios in an actual power system, but to capture

some key features of the cascading process (e.g. blackout size distributions). It is classified by [49]

as a high-level statistical model. All the other models presented are probabilistic simulations, but

with different levels of details and different mechanisms taken into account. The OPA model can

be viewed as the simplest model where the lines’ loadings are computed at each step through a DC

OPF. The TRELSS model also considers the tripping of overloaded lines, but the steady state is

computed at each step through a classical power flow and loads/generators whose voltage is outside

limits are disconnected. The Manchester model is able to deal with a lot of phenomena occurring in

cascading failures leading to blackouts. In particular, the tripping of overloaded lines can be done

in a probabilistic way, in order to model the competition between operators’ corrective actions and

the thermal transient.

The problem of bulk parameters estimation for methodologies using a probability that an over-

loaded line trips before corrective actions are carried out is important. Indeed, such a probability

is difficult to estimate because it depends on the actual corrective scheme to eliminate overloads

and the competition between operators and the thermal transient, but it is a key point to estimate

56


frequencies of dangerous scenarios. Nedic showed in [50] that the parameters used in the probability

function giving the tripping probability as a function of load can significantly change the risk and

the ranking of scenarios. If such a function giving the tripping probability as a function of load

relies on a small number of parameters8, the latter can be estimated through statistics of observed

blackouts by data fitting. This method needs in general data from several networks (to reach a

satisfactory statistical precision) and neglects therefore their specificities. Moreover, correlations

between load, wind and solar generation and the cooling of the lines (influenced by weather condi-

tions) can strongly influence the risk of blackout. It can be crucial to consider these correlations in

order to solve specific questions, for example when a unit should be maintained to limit the risk of

blackout (see further) and this cannot be done based on this probability.

The biggest limitations of these models based on a one-level PRA are due to the confusion between

the two phases of a cascading failure leading to a blackout. Indeed, either the system is electrically

stable and the operators can react to the situation, or the system is electrically unstable and the

operators cannot do anything before the fast cascade ends, so both cannot be mixed. In particular,

performing a consequence analysis through an OPF when the system becomes electrically unstable

does not seem to reflect the behavior of past blackouts.

4.4.3 Probabilistic methodologies and dynamic simulation

Coupling a dynamic grid treatment with a probabilistic analysis has recently appeared in two

approaches, which were inspired by nuclear PSA methods. The first one [51, 52] combines standard

event trees built as a result of a fault line occurrence considered as initiating event, with dynamic grid

simulations performed to systematically assess the consequences of the different scenarios induced

by such a fault. This study is repeated on each line of the grid, for three different locations of the

fault9. The event trees are standardized, as they are limited to scenarios developing according to the

response of the protections (correct working or failure) located in the stations at the end of a line.

Protections failure probabilities are computed through fault trees. A typical event tree and a typical

fault tree are shown in Figure 4.5. The dynamic behavior of the grid is then simulated for about

20 seconds for all relevant branches of each event tree to perform the consequence analysis. Since

the events considered in an event tree are limited to protection actions at the end of the faulted line

and these actions are independent of the actual evolution of the electrical variables, the ordering

of events is fixed independently of the dynamic simulation and is depending only on protection

specifications. This methodology considers additional failures in the course of the transient, but all

protections present in the network are not taken into account. Moreover, the consequence analysis

was performed manually first for one load pattern and analyzing different load patterns requires a

long time. The second approach [53, 54] makes use of Dynamic Event Trees (DET), a systematic

simulation approach of CET introduced in dynamic PRA, as described in the previous Chapter (see

Section 3.4). In this approach, the scenario identification is based on a hybrid discrete-continuous

system, which is obtained by considering, in an integrated fashion, both the power system dynamics

and the possible events that could occur in the development of the transient (i.e. the dynamic

evolution during the transient can influence the transitions and vice-versa). Taking into account

this double interaction is the idea of dynamic PRA and is necessary to analyze cascading events.

However, in the referenced works, the DET construction is limited to setpoint-based events and not

to events whose occurrence time is random, hence restricting the analysis to a subset of the possible

scenarios. Indeed, the success or failure of actions and the occurrence or not of events is considered

only when crossing thresholds on the values of the electrical variables. Reference [54] considers

breakers actions only when a trip condition (setpoint) is reached (protections), while Reference [53]

8For example, a tripping probability equal to p1 when the current is less than its nominal value and equal to p2 in

the opposite case, or with an exponential increase for currents greater than the nominal value, ...9Since a distance protection operates in different ways for different fault locations.

57


Figure 4.5: Typical event tree for substation events after a line fault and fault tree for the failure of

the two main protection distance to send a zone 1 trip signal to circuit breaker trip coils. From [51].

focuses on operators’ corrective actions (most effective redispatch and load curtailment actions), as

shown in Figure 4.6. Grid component failures are thus only taken into account either in the definition

of the initiating event, or for on-demand solicitations defining branch points in the DET.

Figure 4.6: Illustration of halting voltage collapse by dynamic event tree. From [53].

4.5 Conclusions

To analyze the reliability of an electrical grid, there are two different types of approaches: deter-

ministic studies that guarantee that the grid continues to satisfy the consumer demand and system

operational constraints in normal and predefined dangerous situations or scenarios, and probabilistic

studies that estimate the residual risk of power cut-off. Obviously, only probabilistic studies are able

to estimate the risk of blackout or major system disturbance. Probabilistic studies can be divided

into adequacy studies and security studies. The purpose of adequacy studies is not to consider

interdependencies between successive events and cascading failures. Several security studies were

developed to estimate the risk of cascading failures. They are mainly based on cascading failure

58


simulations. However, as the electric state of the grid is computed in a purely static way after

each event, they do not consider correctly the fast cascade (more generally, they are mainly based

on an unique global approach which tries to cover all thermal and electrical phenomena leading to

additional contingencies in one model - one-level PRA). Few methods based on dynamic PRA were

developed to take into account interactions between the electrical grid’s state (electrical variables)

and failure events. However, these methods are not able to take into account successive line failures,

due to thermal effects or independent. Therefore, none of these methods are able to treat the entire

cascade leading to a blackout. Thus, there is a need to develop such an approach, to model the entire

cascade as realistically as possible. The next Chapter presents such a two-level blackout PRA. As

many different phenomena occur in a cascading failure leading to a blackout, the proposed method-

ology should be understood as a general framework able to model these phenomena by splitting

them into two groups, for the slow and the fast cascade, respectively. However, some aspects of this

methodology are inspired by the approaches presented in this Chapter.

59

Chapter 5

Blackout PRA in 3 levels

5.1 Introduction

As seen in Chapter 4, no current methodology appears to be satisfying to reveal blackout scenarios

and estimate their frequencies. Indeed, during an accidental transient, transition rates can increase

by several orders of magnitude depending on the change in the values of physical variables. Cascading

outages simulations developed these last ten years are based on an unique global approach which

tries to cover all thermal and electrical phenomena leading to additional contingencies in one model

(one-level PRA). If a model does not take into account these modifications, the estimation of the

frequency of a cascade involving several transitions can be completely false and thus misleading.

In particular, dangerous cascading failure could not be correctly identified. In this Chapter, we

propose such an approach based on dynamic PRA initially developed for the nuclear sector. Only

the general principles of this approach are presented in this Chapter and particularities linked to

specific applications are given in the following Chapter. Section 5.2 proposes a decomposition of the

blackout risk analysis in levels. Sections 5.3 and 5.5 develop the modeling for the slow cascade and

the fast cascade, respectively. Section 5.4 is devoted to a proposal of a clustering technique for the

scenarios between the Level I and the Level II.

5.2 Decomposition of the power system PRA in 3 levels

As previously seen (see Section 2.7), a typical cascade leading to a blackout can be split into

two different phases. We will adapt dynamic PRA methods differently for these two phases, by

accounting for the different time and process characteristics. The analysis of the slow cascade, ruled

mainly by the competition between thermal transients and operators’ actions, is the level I of the

power system PRA. Consequently, the level I begins with the initiating event and stops when the

system becomes thermally stable or electrically unstable. In the latter case, the analysis of the fast

cascade, ruled mainly by electrical transients and protection actions, is the level II of the power

system PRA. We can also view the modeling of the restoration as the level III, but we do not

describe the restoration process in this PhD thesis.

The level-I analysis is the assessment of the slow cascade: it starts with an initiating event and

ends either when the electrical dynamics of the system becomes dominant1 or when the system is

put back into a secure state. In this level, we have to take into account the competition between

additional failures, due to thermal effects (depending on the thermal transient) or independent, and

corrective actions: operators will try to eliminate overloads and to bring the grid back to a secure

1i.e. if the system is locally or globally subject to voltage instability, frequency instability or angle instability

(transient or small-signal) or if electrical variables violate one or several protection set points.

61

CHAPTER 5. BLACKOUT PRA IN 3 LEVELS

state. Electrical time constants are very small compared to thermal time constants and character-

istic times of operator actions. This means that, after each change in system state during the slow

cascade, electrical variables reach their stationary values in a negligible time compared to thermal

transients and operators’ actions. However, if variations in the values of the electrical variables

become important, the power system could become electrically unstable and the fast cascade simu-

lation could then be starting. In conclusion, after any event occurring during the slow cascade (level

I), we suppose that electrical variables instantaneously reach their stationary values (if the system

remains electrically stable). The process variables which influence failure rates are only the link

temperatures, xT ∈ Rn where xT = (T1, ..., Tn) and Ti is the temperature of link i.

The level-II analysis is the assessment of the fast cascade. It starts when the electrical dynamics of

the system becomes dominant (the system can then be subject to electrical instability and the steady-

state simulation does not capture anymore the grid behavior) and it finishes when the system reaches

an electrically stable state (blackout state or operational state with load shedding). Interactions

between electrical variables and protections and load-shedding relays have to be taken into account,

but since the mean time between events is then much smaller than thermal characteristic times,

the variation of the temperatures of the grid elements during this phase can be neglected. This

time, dynamic PRA must be adapted in order to include the effect of electrical variables (currents,

voltages, frequencies ...) on transition rates. Consequently, we suppose that temperatures are

constant, that the variation of electrical variables does not depend on thermal variables and that

transition rates only depend on electrical variables xE ∈ Rm. On the contrary, an algorithm for

the level-II PRA has to simulate the evolution of electrical variables, and simulate the tripping of

elements when the setpoints of their protections are reached by the electrical variables. Misoperation

of distance protection systems, involved in the propagation of disturbances, has to be integrated into

the approach to provide more trustworthy results. There are globally four kinds of misoperations of

distance protections: a relay can fail to trip, the setpoint of a relay can differ from its nominal value,

measurement errors can occur, and a distance protection seeing a faulted line in its backup zone can

trip instantaneously instead of doing it after a delay. These misoperations make the evolution of the

power system stochastic.

If an operational state with load shedding is reached at the end of the level II, the level I should

be restarted. Indeed, any operational state could continue to endure additional failures even if the

system was electrically stabilized thanks to load shedding. When the system reaches an electrically

stable and thermally stable state, the level-III PRA, which is the assessment of the restoration,

starts. The restoration is mainly ruled by operators’ actions, through procedures, and electrical

transients.

Therefore, level-I PRA reveals vulnerability paths (including critical initial conditions and critical

initiating events) of an electrical grid, level-II PRA gives the magnitude of possible blackouts (in

terms of loss of supplied power) and level-III PRA the consequences (in terms of energy not served).

These three levels are shown in Figure 5.1.

In the specific case of a two-level blackout PRA, the vector of process variables is then composed bythe union of a vector of electrical variables and of a vector of thermal variables, x = (xE , xT ) ∈ RNwith N = m + n. The Chapman-Kolmogorov equations (3.48) (see Section 3.4) can be written

62


Figure 5.1: Decomposition of the power system PRA in 3 levels.

according to this decomposition as

π(xE , xT , i, t) =

∫RN

π(uE , uT , i, 0)δ(xE − gi,E(t, uE , uT ))δ(xT − gi,T (t, uE , uT ))

× exp

[−∫ t

0

λi(gi,E(s, uE , uT ), gi,T (s, uE , uT ))ds

]du

+∑j 6=i

∫ t

0

∫RN

p(j → i|uE , uT )π(uE , uT , j, t− τ)δ(xE − gi(τ, uE , uT ))

× δ(xT − gi(τ, uE , uT )) exp

[−∫ τ

0

λi(gi,E(s, uE , uT ), gi,T (s, uE , uT ))ds

]dudτ

(5.1)

The interpretation of equation (5.1) is the same as the interpretation of equation (3.48): the system

is in state i at time t with process variables (xE , xT ) either if it has been in state i from the

beginning of the transient with process variables (uE , uT ), following dynamics gi,E(t, uE , uT ) with

a survival probability given by exp[−∫ t

0λi(gi,E(s, uE , uT ))ds], or if the last transition to state i

took place at time τ < t, where the system left state j with process variables (uE , uT ), following

dynamics gi,E(τ, uE , uT ) with a survival probability given by exp[−∫ t−τ

0λi(gi,E(s, uE , uT ))ds]. The

next Sections show how these equations can be adapted, simplified and solved for the first two levels.

5.3 Level-I

5.3.1 General modeling

Electrical time constants are very small compared to thermal time constants and characteristic

times of operator actions. This means that, after each transition in the system state space, electrical

variables reach their stationary values in a negligible time compared to thermal transients and

operators’ actions. Moreover, the direct impact of an electrical transient on thermal variables is in

general negligible. However, if variations in the values of the electrical variables become important,

the power system could become electrically unstable and the fast cascade simulation should then be

started. In conclusion, after any event occurring during the slow cascade (level I), we suppose that

63


electrical variables instantaneously reach their stationary values (if the system remains electrically

stable). If we have a transition from state (or dynamics) j to state (or dynamics) i, the electrical

process variables are affected by this transition as follows:

x+E = yji(x

−E) (5.2)

where x+E and x−E denote the values of the process variables after and before the transition, respec-

tively. On the contrary, links’ failure rates can strongly evolve due to a thermal transient, inducedby the reconfiguration of the flows in the grid. After the loss of an element, a competition startsbetween the evolution of these temperatures and corrective actions: operators will try to eliminateoverloads and bring the grid back to a N−1 secure state. The evolution of thermal variables and thecorrective actions both depend on the value of electrical variables. Equation (5.1) then becomes:

π(xE , xT , i, t) =

∫Rnπ(xE , uT , i, 0)δ(xT − gi,T (t, uT |xE)) exp

[−∫ t

0

λi(xE , gi,T (s, uT |xE))ds

]duT

+∑j 6=i

∫ t

0

∫Rm

∫Rnp(j → i|uE , uT )π(uE , uT , j, t− τ)δ(xE − yji(uE))

× δ(xT − gi,T (τ, uT |xE)) exp

[−∫ τ

0


]duEduT dτ

(5.3)

If we use the transformation

x∗E = yji(uE), (5.4)

we also have

duE = Jy−1ji

(x∗E)dx∗E , (5.5)

where Jy−1ji

represents the Jacobian of y−1ji , the inverse function of yji. The equation can then also

be expressed by

π(xE , xT , i, t) =

∫Rnπ(xE , uT , i, 0)δ(xT − gi,T (t, uT |xE)) exp

[−∫ t

0


]duT

+∑j 6=i

∫ t

0

∫Rnp(j → i|y−1

ji (xE), uT )π(y−1ji (xE), uT , j, t− τ)δ(xT − gi,T (τ, uT |xE))

× exp

[−∫ τ

0


]Jy−1ji

(xE)duT dτ

(5.6)

Before solving these equations, we have to define differential equations describing the temperature

evolution with the load (qi(t, xT |xE) as described by equation (3.42) in Section 3.4) for each type of

link, to model the dependence of failure rate on temperature (p(i→ j|xT ) when the transition from

state i to state j is due to a failure) for each type of link, to model the operators actions2 (p(i→ j|xE)

when the transition from state i to state j is due to an operator action), and to define transition

criteria from level I to level II (when are these equations no longer valid?). Subsection 5.3.2 reminds

models widely used to compute overhead lines, cables and transformers temperature evolution,

while Subsection 5.3.3 proposes thermal failure models. Subsection 5.3.4 discusses operators actions

during the slow cascade and 5.3.5 transition criteria. Finally, Subsection 5.3.6 proposes a Monte

Carlo simulation algorithm to solve these equations and 5.3.7 biaising techniques to improve the

simulation efficiency of this simulation.

5.3.2 Temperature evolution

This Subsection describes well-known models used to compute the temperature evolution of the

grid elements.

2However, the Markovian hypothesis does not reflect perfectly operators’ behavior in all cases. A semi-Markovian

approach should be preferred, but these equations can be easily extended in this way.

64



We are interested in the mean conductor temperature in order to deduce the sag of the line.

The evolution of a line temperature is ruled by the time-dependent heat balance [55] depending on

convective and radiation heat losses, heat gain from sun and Joule losses.

qc + qr +mCpdT

dt= qs + I2r(T ) (5.7)

where qc is the convective heat loss rate, qr the radiation heat loss rate, mCp the total heat capacity

of the conductor, qs the heat gain rate from sun, r(T ) the AC resistance of the conductor at

temperature T , all of them per unit length, and I the current in the conductor.


We are interested in the dielectric temperature, even if this temperature is not uniform. However,

we can define a “mean” dielectric temperature by using a two-layer thermal model, as shown in

Figure 5.2, where Cth1 and Cth2 represent the thermal capacity of the central conductor and that

of the dielectric, respectively, P the power losses in the central conductor, Rth1 half of the thermal

resistance of the dielectric, and Rth2 the other half of this thermal resistance plus the ground thermal

resistance [13]. Temperatures in the cable are then described by a set of two first-order differential

equations depending on thermal capacities, thermal resistances and Joule losses,

Cth1dT1

dt(t) = P − T1(t)− T2(t)

Rth1(5.8)

Cth2dT2

dt(t) =

T1(t)− T2(t)

Rth1− T2(t)− Ta

Rth2, (5.9)

where T1(t) is the temperature of the central conductor at time t, T2(t) is the temperature of

dielectric at time t and Ta is the ground (ambient) temperature.

Figure 5.2: Thermal model of an underground power cable.

5.3.2.3 Power transformers

We are interested in the hottest spot temperature. Reference [56], based on IEEE/ANSI C57.91,

presents the entire heat transfer process. The hottest spot temperature is calculated as the sum of

the ambient temperature, the top-oil temperature rise over ambient temperature and the hottest-

spot conductor rise over top-oil temperature. The ultimate steady-state top-oil temperature rise

∆Tu,∞ over ambient temperature Ta is expressed as

∆Tu,∞ = ∆Tu,rl

(K2 + 1

R+ 1

)n, (5.10)

where ∆Tu,rl is the transformer top-oil temperature rise over ambient temperature at rated load,

K the ratio of load to rated load, R the ratio of the loss at rated load on the no-load loss, and n is

65


called the “exponential power of loss versus top-oil temperature rise”. The evolution of the top-oil

temperature rise ∆Tu(t) is ruled by

τud∆Tudt

(t) = ∆Tu,∞ −∆Tu(t) (5.11)

where τu is the oil thermal time constant. The temperature rise of the hottest spot above oil

temperature rise, ∆Th, is given by

∆Th = ∆Th,rlK2m, (5.12)

where ∆Th,rl is the temperature rise of the hottest spot over top-oil temperature at rated load

and m is called the “exponential power of winding loss versus winding gradient”. The hottest spot

temperature, Th(t), can then be calculated by

Th(t) = Ta + ∆Tu(t) + ∆Th (5.13)

5.3.3 Thermal failure models

To estimate the frequencies of dangerous scenarios, we need to model the evolution of failure

rates (or failure probabilities) with temperature. The effect of a temperature increase is different

for overhead lines, for underground cables and for power transformers. For lines, the problem is

the sag increase, possibly leading to a short circuit with the ground. For cables and transformers,

the problem is the dielectric strength decrease, possibly leading to a dielectric breakdown. We use

failure rates in “reference conditions” that means in nominal loading.


When the temperature of a line increases, its sag will also increase, possibly leading to a short

circuit between the line and the vegetation. As shown in Chapter 2, this phenomenon was very

important during the cascading failure leading to the blackout in the USA in 2003. If S is the

sag of the line, HL is the height of the suspension point, HV is the height of the vegetation, EDis the breakdown electric field of ambient air and V is the phase-to-ground voltage of the line, a

short-circuit will occur when

HL − S ≤ HV +V

ED(5.14)

The state change equation of the conductor is developed and given in [57], as

T 2

[T − Tref +

EA(mrefg)2

24T 2ref

+ EAαt(T − Tref )

]=EA(mg)2

24(5.15)

where T is the conductor tensile force, E is its modulus of elasticity, A its cross section, αt the coeffi-

cient of thermal expansion, mg the conductor weight per unit length, Tref the reference temperature,

mrefg the reference conductor weight per unit length and Tref the conductor tensile force in ref-

erence conditions (Tref ,mrefg). Therefore, if (Tref ,mrefg, Tref ) are known, and if the conductor

weight per unit length does not change3, the conductor tensile force is a function of its temperature,

T ≡ T (T ), implicitly defined by the equation (5.15). When the conductor tensile force is known,

the sag can be deduced from the relation

S(T ) ≈ mgl2

8T (T )(5.16)

Consequently, for a specific line, the sag is a function of the mean temperature T of the line. So,

the trip of the line occurs when

S(T ) = HL −HV −V

ED(5.17)

3Or, more precisely, does not change significantly, because the dilatation changes the weight per unit lenght.

66


When vegetation is present below a line, it’s height can be modeled by a random variable whose

distribution depends on maintenance policy, climate, soil properties, and season. The breakdown

electric field of ambient air depends on temperature, pressure, humidity, pollution and can also be

modeled by a random variable. Probabilistic laws governing these random variables have to be

estimated by statistical inference on the basis of operational feedback.

It is important to notice that a line trip can occur even if the line is not overloaded: it depends

only on the sag and the vegetation’s height.


The main failure mode for cables is dielectric breakdown. There are two dominant types of cables

used nowadays: oil-filled cables and extruded isolation cables (Ethylene Propylene Rubber - EPR,

Cross-Linked PolyEthelene - XLPE). For the oil-filled cables, the literature reports no modification

of dielectric strength with temperature [58], but only an accelerated aging. Consequently, the failure

rate in temporary overload conditions will not significantly change. Contrarily, experimental studies

show a reduction of the dielectric strength with temperature for extruded isolation cables [59]. The

two-dimensional Weibull distribution is generally used to model the distribution of the lifetime of

cables [60]. Therefore, the cumulative distribution function (cdf) of the random variable describing

the failure time tf of a cable subject to a dielectric stress E can be written as

F (tf ) = 1− exp

[−(τ(tf )

t0

)a(E

E0

)b](5.18)

where t0, a and b are constants depending on material and cable dimensions, and E0 is the stress

leading to a nominal breakdown probability. In other words, E0 can be viewed as the dielectric

strength. τ(t) is the effective age of the cable at the calendar time t (accelerated aging in overload

conditions). In nominal conditions, dτ/dt = 1. Parameter b is usually high, between 8 and 12

[60]. Parameter a changes during the cable life, from a < 1 (infant mortality) to a > 2 (end of life

wear-out) [60, 61]. In reality, there is a superposition of several Weibull laws with a change in the

value of parameter a [60, 61]:

• The first law (a < 1) models the infant mortality (first part of the bathtub curve presented in

Subection 3.1.1),

• The second law (a ≈ 1) models the useful life (second part of the bathtub curve presented in

Subection 3.1.1),

• The third law (a > 2) models the end of life wear-out (last part of the bathtub curve presented

in Subection 3.1.1).

The first law and the beginning of the second law are shown in Figure 5.3. The literature reports [59]

a decrease of the dielectric strength with temperature, as shown in Figure 5.4. If the temperature

T of the cable is constant, the failure rate at calendar time t and temperature T can be written as

λ(t, T ) = λref [τ(t)]

(E0(Tref )

E0(T )

)b× dτ

dt(t), (5.19)

where λref [τ(t)] is the failure rate at the reference temperature Tref and the age τ(t). Rigorously,

equation (5.19) is only valid for a constant temperature. In the specific problem of cascading

failure, we choose therefore to disjoin contributions of wear-out and temporary reduction of dielectric

strength in the failure rate:

• The wear-out is considered through the age and the reference failure rate. As the variations

of the latter quantities take place on long time scales, the age is considered at the time of the

initial contingency occurrence, and is kept constant during a cascading event. Therefore, the

reference failure rate is taken as constant.

67


Figure 5.3: Life distribution at constant stress of high voltage cables with extruded isolation. From

[60].

Figure 5.4: Dielectric strength as a function of temperature. From [59].

• The temporary reduction of dielectric strength, as a result of temperature evolution, is con-

sidered through (5.19).

It should be noted however that equation (5.19) is derived from a constant temperature assumption,

because of the lack of accurate knowledge of the failure rate variation in transient conditions. It

provides a reasonable approximation of the failure rate behavior if the temperature transient is

slow or moderately fast. Another approach able to consider all kinds of transients is proposed in

Appendix A.

5.3.3.3 Power transformers

Literature reports a temporary reduction of the dielectric strength with temperature due to ther-

mally induced gas bubbles above about 90C [62]. Reference [58] suggests modeling dielectric stress

and transformer withstand voltage as normal random variables, respectively VS ∼ N(µS , σS) and

VR ∼ N(µR, σR) (in normal conditions). It proposes the hypothesis that the dielectric failure rate λdis proportional to the probability of the dielectric stress being higher than the transformer withstand

voltage:

λd ∝ P (VS > VR) = 1− φ[(µR − µS)/(σ2S + σ2

R)1/2], (5.20)

where φ(x) is the normal cumulative distribution function. If the mean of the transformer withstand

voltage decreases with temperature, the dielectric failure rate λd(T ) of an overloaded transformer

can be calculated by

λd(T ) = λd(Tref )1− φ[(µR(T )− µS)/(σ2

S + σ2R)1/2]

1− φ[(µR(Tref )− µS)/(σ2S + σ2

R)1/2](5.21)

68


where T is the hottest spot temperature (the winding which will normally fail first is the one sub-

mitted to the highest temperature) and Tref is the hottest spot temperature in reference conditions.

The transformer failure rate as a function of temperature is shown in Figure 5.5, with parameters

values given in [58]. We should however note that power transformers could have thermal overload

Figure 5.5: Transformer failure rate as a function of temperature.

protections such as winding hot-spot temperature protection to provide tripping when unacceptable

degradation of the transformer winding insulation is occurring.

5.3.4 Operator actions

During the slow cascade, operators can take corrective actions: they will try to eliminate overloads,

to bring the system back to a N−1 secure state as soon as possible (redispatching of the generation,

topology modifications, load shedding), and to come back to the initial international exchange

program between areas if the loss of a power plant entailed a perturbation. In the modeling, operator

actions should be considered because they influence both failure times and consequences. This

modeling is a really important but complex issue of the proposed approach. In Chapter 6, only a

very simple model is used, but future possibilities are explored in Chapter 7.

5.3.5 Transition criteria between level-I and level-II

The modeling developed for the level-I is based on the assumption that the impact of the precise

electrical transient (between an initial electrical steady state and a final electrical steady state) on

possible transitions is negligible: only transitions due to thermal failures, independent failures, or

operators actions based on the electrical steady state are considered. Therefore, this assumption is

obviously no longer valid if the electrical dynamics of the system starts to rule the transition, i.e. if it

becomes dominant. There are several phenomena that can entail the electrical dynamics to become

dominant: if the system is locally or globally subject to voltage instability, frequency instability or

angle instability (transient or small-signal) or if electrical variables violate one or several protection

set points. In these cases, the steady-state simulation does not capture anymore the grid behavior,

the level-I analysis has to be stopped and the level-II analysis has to be started. For each system

state i, we can define a domain Di ∈ Rm where the electrical variables xE are such that the electrical

dynamics becomes dominant. The equations (5.6) are then only valid for xE /∈ Di and y−1ji (xE) /∈ Dj ,

∀j 6= i. Specific criteria to detect these instabilities must be implemented in any approach to solve

these equations.

5.3.6 Analog simulation algorithm for the slow cascade

In previous Sections, we suggested to adapt dynamic PRA to analyze the slow cascade, which

allows us to consider the dependency of link failure rates on temperature. We introduced thermal

69


failure models and equations ruling evolution of the temperatures. The resulting set of equations

cannot be solved analytically. In this Section, we present an analog Monte Carlo (MC) simula-

tion algorithm in order to identify scenarios possibly leading to a blackout and to estimate their

frequencies (computed over a large number of histories, depending on the accuracy needed).

Figure 5.6: Algorithm diagram.

The general simulation scheme is the following for each MC run (see Figure 5.6):

1. Initial conditions are sampled4. This includes load and generation pattern, climatic conditions,

elements in maintenance, ... Because of the correlation between the load and the climatic

conditions (wind speeds, air temperature and ground temperature) through the day in the year

(seasonal effects) and the hour, the latter values are first sampled (from uniform probability

laws). The load and climatic conditions can then be sampled conditionally to the day and

4Specific details about the sampling of initial conditions for the example developed in Chapter 7 are given in

Chapter 7.

70


the hour. If the network includes wind farms, their generation must be computed using wind

speeds, sampled in a way taking into account the correlation between them. The vegetation

heights below each overhead line also have to be sampled before the beginning of each history

(random variables whose distributions depend on soil properties, climate and the season).

2. The electrical and thermal steady state is then computed. The electrical steady state is ob-

tained through the resolution of the load flow equation, typically with the Newton-Raphson

method (a reference state can be used as starting point). The thermal steady state is then com-

puted on the basis of currents obtained through the stationary form of temperature equations

given in Subsection 5.3.2.

3. The first contingency is sampled. It can be the loss of a link or a power plant. The sampling is

based on mean failure rates of elements λi: the probability pi that the element i fails knowing

that an element fails is given by

pi =λi∑i λi

(5.22)

4. The transient stability is assessed. In case of transient instability, the MC run is called “dan-

gerous”, the slow cascade simulation is stopped and the level-II analysis should be started.

However, if the grid is supposed to be in N − 1 security, this step could be ignored for the

initiating event.

5. If a power plant is lost or in case of a system split, the generation modification has to be

computed, according to the primary regulation policy in power plants. The frequency stability

is then assessed on this primary regulation basis.

6. The electrical steady state is again computed by solving the load flow equations. The previous

state can be used as starting point for any iterative method such as Newton-Raphson.

7. The voltage stability is evaluated based on the load flow equations solution. In particular, a

non-convergence of the iterations could indicate a voltage instability. The small-disturbance

angular instability is evaluated. The possibility that the steady state of one or several electrical

variables triggered one or several protections is also checked. If one of these problem occurs,

the MC run is dangerous, the slow cascade simulation is stopped and the level-II should be

started.

8. The thermal stability is then evaluated, through the competition between operators’ corrective

actions and thermal transients. There are two possibilities for an overhead line failure: thermal

failure or independent failure. The time of a thermal line trip is the time at which condition

(5.17) is satisfied. The time of an independent failure can be sampled from the mean failure

rate, as the independent failure time cdf of line i is given by

Fi(t) = 1− exp(−λit). (5.23)

The minimum time between the thermal failure time and the sampled independent failure

time is the next trip time. The times of thermal failure for cables and transformers have to be

sampled from cdf’s based on failure rates (5.19) and (5.21), respectively. Independent failures

must also be considered. As the temperature evolution can be used in these failure rates to

have the failure rate evolution with time, the failure time cdf of cable/transformer i is then

given by

Fi(t) = 1− exp

(−∫ t

0

λi(s)ds

)(5.24)

where λi(t) is the total failure rate of cable/transformer i (including thermal failures and

independent failures). The failure times of cables and transformers can be directly sampled

71


from this expression. The thermal stability, and thus the further development of the cascading

failure, depends not only on failure times sampled on the basis of the steady state post-

contingency, but also on operator actions. Operator action times must also be computed or

sampled at this step.

9. If a new failure occurs, which means that the system is thermally unstable, or if an action

is taken by the operators before the mission time, the simulation continues with this new

contingency from step 4 on. If nothing occurs before a time limit Tm, the system is considered

to be thermally stable, the slow cascade simulation is stopped and the history is safe (non-

dangerous).

This algorithm is repeated for a number of runs sufficient for the precision needed, taking into account

computation time limitations. Interesting results are saved for each MC run. As no evaluation of

consequences is performed during the level-I, only the frequency participates in the definition of the

risk indicator for the level-I (like in the nuclear sector). Therefore, the consequence of a scenario is

equal to 1 if it is a dangerous scenario and equal to 0 if it is a safe scenario. As all MC runs are

based on the sampling of an initiating event, the estimated risk (risk of a specific dangerous scenario

which is its frequency or overall risk which is the total frequency of dangerous scenarios) by such

an analog method is given by the product of the overall frequency of initiating events by a binomial

random variable with parameters N (number of MC runs) and p (probability to have a dangerous

scenario after an initiating event). The mean of this binomial distribution is simply given by

n = Np, (5.25)

and its variance by

σ2 = Np(1− p). (5.26)

If we suppose that p << 1 (which is the case for real grids), the variance is simply given by

σ2 ≈ Np = n. Therefore, the relative standard deviation is given by 1/√n, which means that the

relative precision is inversely proportional to the square root of the simulated number of dangerous

MC runs.

5.3.7 Biasing techniques

In a reliable electric grid such as real power systems, the probability to have a cascading failure

leading to loss of supplied energy after an initiating event is very small. Therefore, the analog

algorithm described previously will need a huge amount of MC runs to reach a satisfactory precision

and will waste a lot of computing time in the simulation of safe histories. Variance reduction

techniques such as biased schemes must be developed in order to improve the simulation efficiency.

In such techniques, random variables are not sampled from the normal pdf’s, but from biased

(modified) pdf’s to increase the apparition rate of interesting events. Results must then be corrected

by statistical weights to keep non-biased estimators of interesting variables. This Subsection presents

the particularization of two of these techniques to our problem: favoring failures during the cascade

by forcing them to occur before a time limit and favoring thermal failures by biasing the sampling

of weather conditions.

When new contingencies are sampled, the system reliability is such that too few MC runs are

likely to have failure events sampled within the time limit Tm. A classical way to overcome this

problem consists in forcing the occurrence of the next event before a time T [63]. The biased cdf

used to sample the failure time of each element (component-based approach) is then

Fi(t) =

Fi(t)Fi(T ) 0 < t ≤ T1 t > T

(5.27)

72


where Fi(t) is the initial cdf, given, for cables and transformers, by

Fi(t) = 1− exp

[−∫ t

0

λi(s)ds

](5.28)

and, for overhead lines, by

Fi(t) =

1− exp[−λit] 0 < t ≤ τi1 t > τi

(5.29)

if a tree flashover occurs at the time τi <∞, or

Fi(t) = 1− exp[−λit] (5.30)

otherwise. The weight can then be modified while using biased cdf (5.27) because the same statistical

expected value must be kept. If non-biased cdf’s are used to sample component failure times, the

probability that the component i has the minimum failure time in the time interval dτ arount the

time τ is given by

p = fi(τ)dτ∏j 6=i

Sj(τ), (5.31)

where fi(t) is the component i’s failure time pdf and

Sj(t) = 1− Fj(t). (5.32)

The same probability from biased cdf’s is given by

p = fi(τ)dτ∏j 6=i

Sj(τ). (5.33)

The weight is therefore given by

w =p

p=fi(τ)

fi(τ)

∏j 6=i

Sj(τ)

Sj(τ). (5.34)

With the expression (5.27), we find for the biased pdf

fi(t) =dFidt

(t) =fi(t)

1− Si(T ), (5.35)

for the complements of the biased cdf,

Sj(t) = 1− Fj(t) = 1− 1− Sj(t)1− Sj(T )

=1− Sj(T )− 1 + Sj(t)

1− Sj(T )=Sj(t)− Sj(T )

1− Sj(T ), (5.36)

and, finally, for the weight,

w = [1− Si(T )]∏j 6=i

Sj(τ)1− Sj(T )

Sj(τ)− Sj(T )= [1− Si(T )]

∏j 6=i

1− Sj(T )

1− Sj(T )Sj(τ)

. (5.37)

One can think that time T should be chosen equal to Tm in order to sample all failures before this

time limit. In this case, as a new failure occurs until an electrical instability is reached, and as an

electrical stability is guarantee when all components are out-of-service, all MC runs will contribute,

in fine, to the statistics of dangerous scenarios. However, the weight of some MC runs can be huge

and will increase the variance. Indeed, if we consider for example n components with constant failure

rates and λiT << 1 (reliable components), the weight can be approximated by

w ≈ λiT(

T

T − t

)n−1

. (5.38)

73


If t << T , w ≈ λiT << 1, but for t→ T , w →∞. Therefore, it is necessary to keep a small variance

to eliminate MC runs with a sampled failure time “near” T , by using T > Tm. The variance can

also be deteriorated when a tree flashover occurs at time τi < Tm. Using biased cdf, if the first

sampled failure is due to this tree flashover, the weight will increase. Consequently, we suggest to

test before each sampling if a tree flashover occurs, to use an analog sampling if it is the case, and

to apply this biasing only in the opposite case. Moreover, it is useless to continue to use a biased

sampling when the weight of a MC run is becoming very low: its contribution to the score will be

insignificant while it will continue to require computing resources. We propose to use this biased

sampling only if the weight is higher than a cut-off weight pC , otherwise a non-biased sampling is

used (variant of the Russian roulette).

Forcing failures to occur before a time limit improves the statistic of cascading failures due to

independent events, but do not improve the statistic of cascading failures due to tree flashover.

A way to favor such thermal failures is to bias the sampling of weather conditions, i.e. favoring

the sampling of high ambient temperatures θi and low wind speeds vi. If temperature and wind

speeds are sampled from independent laws, the marginal pdf functions of the ambient temperatures

fΘ,i(θi) and wind speeds fV,i(vi) can be modified into fΘ,i(θi) and fV,i(vi) to favor high ambient

temperatures and low wind speeds and, thus, low cooling of links and thermal failures. The weight

must then be multiplied by

w =

nθ∏i=1

fΘ,i(θi)

fΘ,i(θi)(5.39)

for the temperatures at the various temperature domains, and by

w =

nv∏i=1

fV,i(vi)

fV,i(vi)(5.40)

for the wind speeds at the various wind speed domains. However, if some of these variables are

sampled from dependent laws, this weight is not correct. For example, if wind speeds are sampled

a dependent way to account for the correlations5, the weight is given by

w =fV (v1, ..., vnv )

fV (v1, ..., vnv )(5.41)

When dependent random variables are sampled to model wind speeds, the joint cdf FV (v1, ..., vnV )

is in general modeled by a Copula C(u1, ..., un) which is a function of the marginal cdf’s FV,i(vi)

[64],

FV (v1, ..., vnV ) = C(FV,1(v1), ..., FV,nV (vnV )). (5.42)

The joint pdf is then given by

fV (v1, ..., vnV ) =∂nC(u1, ..., unV )

∂u1...∂unV

∣∣∣∣u1=FV,1(v1),...,un=FV,nV vnV

fV,1(v1)..., (5.43)

and, by denoting c the Copula density,

fV (v1, ..., vnV ) = c(F1(v1), ..., Fn(vn))fV,1(v1)...fnV (vnV ). (5.44)

The weight is therefore given by

w =f(v1, ..., vnV )

f(v1, ..., vnV )=c(FV,1(v1), ..., FV,nV (vnV ))fV,1(v1)...fV,nV (vnV )

c(FV,1(v1), ..., FnV (vnV ))fV,1(v1)...fV,nV (vnV ). (5.45)

The presence of the Copula densities does not allow to control the global weight, even if the marginal

weights fi/fi are controlled. This can lead to huge weights for some MC runs, and thus possibly

5They can be sampled directly from their joint cdf to account for the correlations, or indirectly.

74


to a variance increase (instead of a variance reduction). Therefore, if dependent random variables

are sampled through the sampling independent random variables by a specific transformation, the

biasing technique should be applied directly to the independent random variables to avoid the impact

of Copula density.

5.4 Clustering between level-I and level-II

Applying the level-II analysis on each scenario given by the level-I PRA (which could be viewed

as the equivalent of an integrated level 1 - level 2 approach in the nuclear sector) can lead to analyze

separately two quasi-identical (or identical) scenarios (if a large set of MC runs are simulated during a

level-I analysis, the successive samplings can give two quasi-identical scenarios). As electric dynamic

simulations need important computing times (especially for large power systems), it is important

to limit the level-II analysis to a minimum set of scenarios while keeping a satisfying accuracy on

results. Therefore, we propose not to analyze each scenario given by the level-I PRA, but to group

scenarios into clusters and to analyze only the “equivalent scenario” to each cluster (equivalent to

the grouping of level 1 scenarios in “plant damage states” in nuclear PRA [65]).

Only electrical properties are important for the fast cascade (not the ambient temperatures, the

wind speeds, ...). Scenarios can be grouped into clusters on the basis of two considerations. First,

the sequence of events during the slow cascade must be the same for all scenarios of a cluster. The

clustering can then be applied separately to each sequence of events. Secondly, the electric stationary

states before the triggering event must be “similar” for all scenarios of a cluster, which is equivalent

to require that load/generation patterns must be “near”. This notion of proximity must indeed

be defined precisely. The load/generation pattern depends on the active/reactive power generation

Pg/Qg and active/reactive power consumption Pl/Ql at each bus. The load/generation pattern can

then be represented in a 4×Nb-dimension space, where Nb is the number of buses with non-null load

and/or generation. The proximity can then be quantified on the basis of distance between points in

this space.

Several clustering techniques were developed in order to group into clusters points in any multi-

dimensional space, on the basis on distance between points. They are used in the nuclear sector

in a similar context to “make the dynamic analysis manageable from both a computational and

phenomenological viewpoint” [66] when a PRA methodology is used (especially dynamic PRA, but

also classical PRA). In particular, it is impractical both in the nuclear and the electric sectors to

perform a level-II analysis for all generated level-I sequences. Different clustering techniques are

analyzed in [67] and the Mean-Shift technique is proven to be well suited for the scenario analysis.

5.5 Level-II

5.5.1 General modeling

For the fast cascade, interactions between electrical variables and protections and load-shedding

relays have to be taken into account, but since the mean time between events is then much smaller

than the thermal characteristic times, the variation of the temperatures of the grid elements during

this phase can be neglected. This time, dynamic PRA must be adapted in order to include the effect

of electrical variables (currents, voltages, frequencies ...) on transition rates/probabilities. Conse-

quently, we suppose that the temperatures are constant, that the variation of electrical variables

does not depend on thermal variables and that transition rates depend only on electrical variables.

75


The equations (5.1) then become

π(xE , xT , i, t) =

∫Rm

π(uE , xT , i, 0)δ(xE − gi,E(t, uE)) exp

[−∫ t

0

λi(gi,E(s, uE))ds

]duE

+∑j 6=i

∫ t

0

∫Rm

p(j → i|uE)π(uE , xT , j, t− τ)δ(xE − gi,E(τ, uE))

× exp

[−∫ τ

0

λi(gi,E(s, uE))ds

]duEdτ.

(5.46)

We can eliminate the dependency on thermal variables xT by integration on these variables and by

denoting by π(xE , i, t) the probability density function to find the system in state i at time t with

electrical variables xE , which gives

π(xE , i, t) =

∫Rm

π(uE , i, 0)δ(xE − gi,E(t, uE)) exp

[−∫ t

0

λi(gi,E(s, uE))ds

]duE

+∑j 6=i

∫ t

0

∫Rm

p(j → i|uE)π(uE , j, t− τ)δ(xE − gi,E(τ, uE))

× exp

[−∫ τ

0

λi(gi,E(s, uE))ds

]duEdτ,

(5.47)

because

π(xE , i, t) =

∫Rnπ(xE , xT , i, t)dxT . (5.48)

Before solving these equations, we have to define differential equations describing the electrical vari-

ables evolution in each system state (gi(t, xE)) and to model the dependence of transition rate on

electrical variables (p(i→ j|xE)) for each element. The evolution of electrical variables corresponds

to the dynamic equations presented in Chapter 1. They are not furthermore developed in this

Section. As the duration of a fast cascade is much smaller than the mean time between two inde-

pendent failures, we propose to neglect independent failures during the fast cascade. Therefore, only

transitions due to electrical variables are considered. Subsection 5.5.2 discusses these transitions.

Subsection 5.5.3 proposes a simulation algorithm for the fast cascade.

5.5.2 Transitions due to electrical variables

Contrarily to thermal variables which entail failures during the slow cascade, electrical variables

entail transitions through protection systems of the grid elements during the fast cascade. Indeed,

several relays can disconnect elements operating in unacceptable conditions in order to protect them:

• For lines: over-current relays, distance relays (apparent impedance as criterion), ...

• For power plants: over-excitation relays, over/under-voltage relays, over/under-frequency re-

lays, loss-of-synchronism, ...

Moreover, under-voltage and under-frequency load shedding can help to stabilize the system in case

of voltage and frequency instabilities, respectively. If protection systems were perfectly reliable,

transitions should occur only when the setpoint of a protection is crossed. Mathematically, if the

transition from state i to state j is due to the action of protection k, the corresponding transition

rate is given by

p(i→ j|xE) = δ(xE,l − sk)dxE,ldt

, (5.49)

where xE,l is the monitored electrical variable and sk is the setpoint. Time-delay (intentional or not)

can be considered by the stimulus-driven theory of probabilistic dynamics [68]. If the protection k

must act when xE,l > sk, the stimulus Gk associated to this protection is activated (IGk = + where

76


IGk is the label associated with the stimulus Gk) as soon as xE,l > sk and deactivated (IGk = −)

as soon as xE,l < sk. However, misoperations of protection systems can occur: a relay can fail to

trip, the setpoint of a relay can differ from its nominal value, measurement errors can occur, and a

distance protection seeing a faulted line in its backup zone can trip instantaneously instead of doing

it after a delay. These misoperations make the evolution of the power system stochastic.

5.5.3 Fast cascade simulation algorithm

Discrete Dynamic Event Trees (DDET) were proposed in [69] to be the core of the scheme used

for the fast cascade. After the occurrence of the triggering event (i.e. the last event of the slow

cascade), the process variables follow evolution laws associated to the resulting configuration. The

corresponding deterministic transient evolution defines a so-called mother branch. The evolution

of the process variables is traced by simulation and new branches are generated from this mother

branch at user-specified discrete time intervals due to branching rules (on setpoints, on probabilistic

thresholds,...), as shown in Figure 5.7 where the variability of setpoints is considered. The devel-

opment of a scenario is stopped according to specific criteria. Two main stopping criteria are used.

First, a maximum time between two successive events is considered to end up the simulation if

nothing new occurs during a certain period of time. Secondly, a cut-off probability is defined so that

the branches carrying a lower probability than it are truncated. Finally, the frequency of the user-

specified absorbing state can be calculated and related scenarios are identified. The method used

for the risk analysis of the fast cascade was split in two steps. The first step consists in building a

so-called skeleton (i.e. a purely setpoint-based DDET), while the second step consists in integrating

the stochastic behavior of distance relays into this skeleton. Finally scenarios leading to blackout

are identified and their frequencies are calculated, considering both setpoint-based performance of

relays and distance protection misoperations.

Figure 5.7: Mother branch and new branches of a DDET. Adapted from [69].

5.6 Conclusions

We proposed in this Chapter a methodology able to analyze the risk of blackout in a power

system. This approach is based on the decomposition of the cascading failure PRA in two levels.

The restoration of the power system after a blackout or a major load shedding can be viewed as

a third level of the blackout PRA, but the purpose of this PhD thesis is not to develop this level.

We developed this approach mainly for the first phase of cascading failure (PRA level I), with a

Monte Carlo simulation able to reveal dangerous scenarios. Developing the previous work of Farshid

Faghihi [69], we also proposed an approach for the second phase (PRA level II) based on dynamic

PRA techniques previously developed for the nuclear sector. We introduced a way of grouping the

scenarios between the level I and the level II in order to reduce the complexity of the level II analysis.

The next Chapter applies these two levels to test systems with several simplifications.

77

Chapter 6

Applications

6.1 Introduction

This Chapter presents results obtained by the application of the methodology proposed in the

previous Chapter to test system. Section 6.2 develops first an example for the level-I of the blackout

PRA, which was the main part of this PhD thesis. A base state of a test system is studied, as well

as several variants. Then, Section 6.3 presents an example of a two-level blackout PRA on a very

simple test system. Finally, Section 6.4 applies variance reduction methods proposed in the previous

Chapter for the level-I.

6.2 One-level blackout PRA

Results obtained with the dynamic level-I PRA method are each time compared to a so-called

“independent method”, based on the same simulation scheme, but neglecting thermal effects. This

means neglecting the impact that a failure has on the failure rates of other elements (failures are

sampled independently of the previous events on the basis of average failure rates). Results are

expressed in terms of frequency of dangerous scenarios. As previously stated, a so-called “dangerous

scenario” is a scenario leading to an electrical instability and thus possibly leading to a major

system disturbance or a blackout, depending on the fast cascade. The frequency is the inverse

of the expected time between two dangerous scenarios: if the frequency is 10−2/year, a dangerous

scenario is expected every 100 years in average. If scenarios are grouped according to the sequence of

occurring events, a large amount of different situations (characterized by different timings, different

load/generation patterns, different climatic conditions) are behind each sequence. A large variability

in the loss of power supplied could be revealed by a level-II analysis for the same sequence of events

identified during the level-I analysis, depending on the load/generation pattern. Moreover, a level-I

scenario whose frequency is lower than another one could induce a bigger loss of supplied power and

thus a greater risk. Consequently, level-I results give a first indication of vulnerability paths, but the

level-II analysis is important to estimate the risk induced by each vulnerability path. The computing

time required per MC run is approximately 4.7 ms for this network on a Intel(R) Xeon(R) CPU

L5420 @ 2.50GHz1.

6.2.1 Test case: data and modeling assumptions

6.2.1.1 Blackout test system

To apply the proposed methodology, we need a complete test system with electrical parameters

for each machine and electrical, geometrical and thermal properties for each link. Initial states have

1All computing times cited in this Chapter refer to this CPU.

79

CHAPTER 6. APPLICATIONS

also to be N − 1 secure to respect TSO’s actual requirements. To have such a blackout test system,

we adapted a classical test system which is a reduced-order equivalent of the interconnected New

England Test System (NETS) and New York Power System (NYPS) with three other neighboring

regions introduced initially in [70], in order to have a 69-bus test system. The purpose of the

adaptation is not only to have all parameters needed (electrical parameters for each machine and

electrical, geometrical and thermal properties for each link), but also to have coherency between

these properties (geometrical and material properties determine electrical and thermal properties).

Initial states have also to be N − 1 secure to respect TSO’s actual requirements. Each power plant

in NETS and NYPS has two identical units, except power plant 1 which has only one unit. The load

is modulated along the day and the day hour, according to load factors2 given in the IEEE-RTS [71]

and reproduced in Appendix B. The mean load as a function of hour for the four season is given

in Figure 6.2. We also implemented two wind farms of 150 MW and seven wind farms of 200 MW.

The modified network is shown in Figure 6.1. Complete details are given in Appendix B.

Figure 6.1: Blackout Test System.

Figure 6.2: Mean load as a function of day hour for the four season.

2We call here load factor the total actual load divided by the total peak load.

80


6.2.1.2 Meteorological data

In a modern power system, weather conditions are important for two main reasons: wind gen-

eration depends on the wind speed and temperatures of overhead lines depend on the wind speed

and angle, air temperature, ... Parameters describing random variables for wind speeds and tem-

peratures are computed on the basis of data provided by the Koninklijk Nederlands Meteorologisch

Instituut (KNMI) [72]. The ambient temperature is modeled by a normal random variable whose

parameters depend on the moment of the season and day hour. The mean ambient temperature and

mean wind speed as a function of the day hour for the four seasons are shown in Figures 6.3 and

6.4, respectively.

Figure 6.3: Mean ambient temperature.

Figure 6.4: Mean wind speed.

To consider the correlation between production in different wind farms, the joint normal distribu-

tion method is used to sample wind speeds [64], so that the rank correlations are kept. The main

idea of this algorithm is

1. To sample standard normal dependent variables, in two steps:

(a) The sampling of normal independent variables,

(b) The transformation of the sample into a sample of dependent variables through the cor-

relation matrix,

2. To apply a transformation to get samples distributed according to the desired marginals, in

two steps:

81


(a) Transformation of the previous sample into a sample distributed along uniform laws

(through standard normal cdf),

(b) transformation into a sample distributed along the desired marginals (through desired

inverse cdf’s).

To sample dependent variables V = [V1, ..., Vn] describing wind speeds in the n subareas, we can

therefore use the following algorithm:

1. Independent sampling of n standard normal distributions Z = [Z1, ..., Zn] to get z = [z1, ..., zn].

2. Transformation y = Tz to get a sample from n dependent standard normal distributions,

where T is a lower triangular matrix such that R = T × T t (Cholesky decomposition) and R

is the correlation matrix.

3. Transformation ui = FN (yi), i = 1, ..., n where FN is the standard normal cdf. The samples

ui are then distributed along uniform laws on [0, 1].

4. Transformation vi = F−1i (ui), i = 1, ..., n, where Fi is the cdf of vi.

The correlation matrix R used to compute matrix T is not the correlation matrix of the standard

normal distributions Yi = F−1N [Fi(Vi)]. In order to simplify calculations, the rank correlation matrix

can be used. The rank correlation ρr of random variables X,Y with cdf FX and FY , respectively,

is:

ρr(X,Y ) = ρ(FX(X), FY (Y )) (6.1)

where ρ denotes the correlation. Rank correlations of random variables Y and V are the same

because Fi(Vi) = Ui = FN (Yi). Moreover, if X,Y are standard normal distributions,

ρ(X,Y ) = 2 sin

[π

6ρr(X,Y )

]. (6.2)

To compute the correlation matrix R for random variables Y , we can compute the rank correlation

of random variables V and apply the previous relationship. Therefore, this method keeps rank corre-

lation between wind speeds, but not necessarily direct correlations. Nevertheless, direct correlations

are nearly kept. This is a way to sample wind speeds using a Gaussian Copula [64] (see Subsection

5.3.7).

To model the marginal distributions, the two-parameter Weibull distribution is commonly used[73].

Cdf’s are then given by

Fi(vi) = 1− exp[−(vi/ηi)βi ], (6.3)

and the inverse

F−1i (ui) = ηi.[− ln(1− ui)]βi . (6.4)

We also have to emphasize that the wind speed distribution is not constant along the year (parame-

ters of the Weibull law vary) as well as the air temperature and the load. Consequently, these values

need to be sampled according to the specific moment (day and hour) in the year.

To extrapolate the wind speed at wind power plant height, we use the logarithmic wind profile

[74] which gives a simple relation between the wind speed v(h1) at height h1 and the wind speed

v(h2) at height h2:v(h1)

v(h2)=

ln(h1/h0)

ln(h2/h0)(6.5)

where h0 is the aerodynamic roughness length of the surface.

82


6.2.1.3 Modeling assumptions

In order to improve the efficiency of the simulation, we will use some simplifications:

• The load is taken constant for a specific sampled moment (day and hour) in the year.

• The ambient temperature is modeled by a normal random variable with a mean and a standard

deviation depending on the moment of the year. The ground temperature has two different

values, depending on the season (one for winter and spring, the other for summer and fall).

• We choose a unique vegetation height for all lines and all MC runs, such that the probability

of having a short circuit with the ground in all normal situations (no contingency) is 10−5

(constant air breakdown electric field)3.

• For the electrical instability of the system, we consider only voltage instability (through the

non-convergence of the load-flow iterations) and frequency instability. The models used for

these two transition criteria are described in Appendix C.

• We consider the system thermally stable if there is no new contingency within 60 minutes.

• Average failure rates are taken as their nominal values in nominal conditions.

• Initial conditions (load pattern and climatic conditions, sampled at the beginning of each

history) are kept constant during each MC run.

6.2.2 Results for the base case

We give in this Subsection detailed results obtained by applying our methodology to the base case

(100 million MC runs - computing time: 131 hours), in order to identify the vulnerabilities of the

blackout test system. Mean cross-border power flows between the five areas in normal conditions are

given in Table 6.1. The variability in load and wind generation induces variability in power flows.

Power flows (MW) Mean Min Max Std

NETS→NYPS 140 -140 525 117

NYPS→3 -13 -150 182 69

NYPS→5 57 -105 360 110

3→4 229 117 382 51

4→5 93 -13 180 31

Table 6.1: Cross-border power flows

6.2.2.1 Dangerous scenarios

The estimation of the total frequency of dangerous scenarios is 8.1 × 10−3/year (with a good

precision: the standard deviation is given by σ = 1.2%) by the dynamic level-I PRA method and

4.6× 10−3/year (σ = 1.7%) by the independent method. Table 6.2 lists dangerous scenarios whose

events correspond to the trip of line i − j and compares their frequencies ranked according to

both dynamic level-I PRA estimation and the independent estimation (σ is between 2 and 10% for

each scenario for dynamic level-I PRA, and between 3 and 10% for each scenario with a frequency

higher than 10−4/yr for independent method). We observe from these results that some scenarios

have a frequency an order of magnitude higher when we include dependencies on temperature. In

particular, a four-event scenario has a high frequency, due to reorganization of flows in the grid and

cascading overloads. For other scenarios, considering the dependencies between events seems to be

3The impact of vegetation height and, thus, of this value are studied in Subsection 6.2.3.

83


negligible, compared to the classical estimation. It can be surprising that some scenarios have a

slightly higher frequency by the classical method than by our method. It simply means that another

event occurs before the second event. For example, taking into account thermal effects implies that

line 57-58 will trip shortly after line 58-59. This is the first observation: the classical method gives

wrong estimations of some dangerous scenario frequencies by neglecting the impact of the primary

contingency on the failures of other elements. The distribution of lines outages for the dynamic

level-I PRA method is shown in Figure 6.5. All cascading failures have at least 2 events during the

slow cascade (N − 1 security rule). Most cascades comprise from 2 to 4 events. It can be surprising

to have short cascades with few events. However, the aim of the level-I analysis is to model the slow

cascade: a level-I scenario indicates how the system can reach an electrical instable state. These

numbers of events are in concordance with those observed in recorded slow cascades (see Chapter

2).

Init. event Event 2 Event 3 Event 4 Level-I PRA freq. (/yr) Ind. method freq. (/yr)

58-59 57-58 62-65 65-66 2.2× 10−3 < 10−5

65-66 57-58 59-60 2.3× 10−4 < 10−5

58-59 57-58 65-66 1.8× 10−4 < 10−5

59-60 57-58 62-65 65-66 1.5× 10−4 < 10−5

38-46 46-49 1.1× 10−4 1.4× 10−4

23-24 68-24 1.4× 10−4 1.4× 10−4

49-18 46-69 1.2× 10−4 1.3× 10−4

46-69 49-18 1.1× 10−4 1.3× 10−3

Table 6.2: Most frequent dangerous scenarios (base case)

Figure 6.5: Distribution of line outages during dynamic level-I PRA cascades.

6.2.2.2 Criticality of links

In order to optimally control (through maintenance) and reduce the risk, importance measures

are defined to evaluate a component contribution to the risk [75, 76]. Different importance factors

where proposed, but we use only two of them. The Fussell-Vesely factor of diagnosis FVi is the

probability that element i is failed, knowing that the scenario is dangerous [75, 76],

FVi =F0 − F−iF−i

(6.6)

where F−i is the dynamic level-I PRA frequency of dangerous scenarios without failure of element

i and F0 is the base (reference) case overall dynamic level-I PRA frequency of dangerous scenarios.

84


Table 6.3 compares Fussell-Vesely factors of links, ranked according to both dynamic PRA level-

I estimation and the independent estimation. The Lambert factor of critical importance Ci is the

probability that element i causes the electrical instability, knowing that the scenario is dangerous[75,

76],

Ci =F+i − F

−i

F+i

Pi (6.7)

where F−i is the dynamic level-I PRA frequency of dangerous scenarios with failure of element i and

Pi is the probability that element i is failed in a dangerous scenario. Table 6.4 compares Lambert

factors of links, ranked according to both dynamic PRA level-I estimation and the independent

estimation. A large value of the Fussell-Vesely factor for a specific line indicates that this line is

sensitive to the reorganization of the flows after another line trip and the trip of this line increases

the thermal instability of the grid or entails an electrical instability. A large value of the Lambert

factor for a specific line indicates that this line is sensitive to the reorganization of the flows after

another line trip and the trip of this line entails directly an electrical instability.

Link FVi (%) Independent FVi (%)

57-58 42.5 <1.0

65-66 42.3 <1.0

58-59 37.0 4.5

62-65 34.5 <1.0

59-60 11.8 4.6

35-45 8.0 15.3

35-45 8.0 15.3

69-18 5.6 11.3

46-49 6.8 11.3

50-51 5.6 10.9

Table 6.3: Fussell-Vesely factors

Link Ci (%) Independent Ci (%)

65-66 32.3 <1.0

59-60 4.5 1.9

17-43 4.1 6.6

35-45 3.7 7.1

46-49 3.7 6.2

33-34 3.6 <1.0

35-45 3.7 7.1

17-43 4.1 6.6

46-49 3.7 6.2

69-18 2.7 6.2

Table 6.4: Lambert factors

6.2.2.3 Importance of initial conditions

The total frequency of dangerous scenarios as a function of the ambient temperature, as a function

of the mean wind speed, as a function of load and as a function of day hour, both in a dynamic

level-I PRA approach and in an independent approach, are represented in Figures 6.6, 6.7, 6.8 and

6.9, respectively. In concordance with common sense, the model gives higher frequencies for high

85


Link Probability Independent probability

58-59 2.7× 10−3 8.6× 10−5

59-60 4.9× 10−4 1.2× 10−4

65-66 4.3× 10−4 1.3× 10−6

35-45 3.4× 10−4 3.7× 10−4

35-45 3.4× 10−4 3.7× 10−4

69-18 2.3× 10−4 2.9× 10−4

50-51 2.4× 10−4 2.8× 10−4

38-46 2.2× 10−4 2.4× 10−4

Table 6.5: Probability to have a dangerous scenario after a link trip as initiating event

ambient temperatures and low wind speeds, because the cooling is weak in these cases. Intuitively,

the frequency should also be monotonically increasing as a function of load, to reach a maximum

when the load is maximum, as the independent reliability analysis shows. Surprisingly, in the

dynamic level-I PRA analysis, even if the frequency is increasing when the load goes from 40%

of the annual peak load to about 90%, it is decreasing after. In fact, higher loads are reached in

winter, when the cooling of lines is strong (low ambient temperatures and high wind speeds). It is in

concordance with observed past blackouts where thermal effect was present (August and September),

as explained in Chapter 2. Even if the wind speed is higher during the day, the combination of the

load, the temperature and the heat gain rate from the sun gives a higher risk of blackout during the

day for this test system.

Figure 6.6: Total frequency of dangerous scenarios as a function of the ambient temperature.

6.2.2.4 Discussion

Results given either by a dynamic level-I PRA simulation or an independent simulation are very

different. Indeed, the impact of thermal effects influences not only the value of the frequency of

most dangerous scenarios but also their ranking and the critical lines. In particular, the dynamic

level-I PRA simulation reveals a critical area, located approximately between buses 2, 3 and 56, as

shown in Figure 6.10. The importance of thermal effects is higher in summer, when the temperature

is high and the mean wind speed low, even if the load is lower than in winter, as Table 6.6 shows it.

86


Figure 6.7: Total frequency of dangerous scenarios as a function of the mean wind speed.

Figure 6.8: Total frequency of dangerous scenarios as a function of the load.

Figure 6.9: Total frequency of dangerous scenarios as a function of the hour.

Season Level-I PRA Ind. method Mean load

freq. (/year) freq. (/year) (% of annual peak)

Winter 5.8× 10−3 5.1× 10−3 67.11

Spring 5.2× 10−3 4.4× 10−3 55.52

Summer 1.6× 10−2 4.4× 10−3 63.70

Fall 5.0× 10−3 4.2× 10−3 56.35

Table 6.6: Seasons’ importance (frequencies given are conditional frequencies per season).

6.2.3 Impact of vegetation height

To study the influence of the vegetation management policy on the risk of blackout, we will now

estimate the frequency of most frequent dangerous scenarios for different vegetation heights. In

87


Figure 6.10: Blackout Test System - Critical area (base case).

each case, the vegetation height is the same for all lines and all MC runs. These vegetation heights

are chosen such as to have the probabilities of having a short circuit with the ground in a normal

situation (no contingency) equal to 10−4 (high vegetation height), 10−5 (medium-high vegetation

height), 10−6 (medium-low vegetation height) and 10−7 (low vegetation height). The estimations

of the total frequency of dangerous scenarios are given in Table 6.7 (40 millions MC runs for each

vegetation height, which means that σ is less than 2% for each vegetation height). We observe

that the total frequency is converging to the total frequency given by the independent method, as

the vegetation height decreases (or the probability decreases). The four most frequent dangerous

scenarios for each vegetation height are given in Table 6.8. The “E*” (for Event) columns contain

the departure and arrival bus numbers of links that failed. “E0” is the initiating event. The most

frequent dangerous scenarios are very different between a high and a low vegetation height. When

the vegetation is high, scenarios with several events can appear with a high frequency because the

conditional probability to lose an additional link knowing that other links were lost is high. In the

opposite, this conditional probability is low when the vegetation height is low, or when thermal effects

are neglected. That is why only two-event scenarios appear in the four most frequent dangerous

scenarios for a probability of having a short circuit with the ground of 10−7. However, one scenario

(the cascading failure 58-59,57-58,62-65,65-66) stays important, even when the vegetation height

decreases. Our model also allows us to study the sensitivity of the two main areas (NETS and

Freq. (/yr) @10−4 Freq. (/yr) @10−5 Freq. (/yr) @10−6 Freq. (/yr) @10−7

2.2× 10−2 8.3× 10−3 5.4× 10−3 4.8× 10−3

Table 6.7: Estimations of the total frequency of dangerous scenarios for different vegetation heights.

NYPS) to the vegetation management policy through two hypotheses:

• High vegetation height for the NETS and low vegetation height for the NYPS (hypothesis H1).

• Low vegetation height for the NYPS and high vegetation height for the NYPS (hypothesis

H2).

The high vegetation height corresponds to the probability of having a short circuit with the ground

in a normal situation (no contingency) of 10−4 if this height is applied to the whole network (and not

only to the concerned area), and the low vegetation height to 10−7. The estimations of the total fre-

quency of dangerous scenarios for H1 and H2 are respectively 1.85×10−2/year and 6.23×10−3/year.

The four most frequent dangerous scenarios for these two hypotheses are given in Table 6.9. We can

deduce from these results that both areas are sensitive to thermal effects, but the NETS much more

88


E0 E1 E2 E3 Freq. @10−4 Freq. @10−5 Freq. @10−6 Freq. @10−7

(/yr) (/yr) (/yr) (/yr)

58-59 57-58 62-65 65-66 9.7× 10−3 2.4× 10−3 4.4× 10−4 6.9× 10−5

65-66 57-58 59-60 1.4× 10−3 2.4× 10−4 3.4× 10−5 < ×10−5

59-60 57-58 62-65 65-66 1.1× 10−3 1.6× 10−4 1.9× 10−5 < ×10−5

58-59 57-58 65-66 8.5× 10−4 1.9× 10−4 4.4× 10−5 1.9× 10−5

58-59 57-58 62-65 65-66 9.7× 10−3 2.4× 10−3 4.4× 10−4 6.9× 10−5

65-66 57-58 59-60 1.4× 10−3 2.4× 10−4 3.4× 10−5 < ×10−5

58-59 57-58 65-66 1.1× 10−3 1.6× 10−4 1.9× 10−5 < ×10−5

26-28 28-29 1.5× 10−4 1.6× 10−4 1.3× 10−4 1.4× 10−4

58-59 57-58 62-65 65-66 9.7× 10−3 2.4× 10−3 4.4× 10−4 6.9× 10−5

41-40 48-40 1.0× 10−4 1.0× 10−4 1.5× 10−4 1.6× 10−4

59-60 58-59 1.1× 10−4 1.3× 10−4 1.5× 10−4 1.5× 10−4

68-24 23-24 1.0× 10−4 1.3× 10−4 1.5× 10−4 1.3× 10−4

41-40 48-40 1.0× 10−4 1.0× 10−4 1.5× 10−4 1.6× 10−4

55-52 37-52 1.5× 10−4 1.3× 10−4 1.5× 10−4 1.5× 10−4

58-59 59-60 1.2× 10−4 1.5× 10−4 1.4× 10−4 1.5× 10−4

59-60 58-59 1.1× 10−4 1.3× 10−4 1.5× 10−4 1.5× 10−4

Table 6.8: Dangerous scenarios and their frequencies for different vegetation heights.

than the NYPS. The most frequent scenarios are more complex when the vegetation is high in the

NYPS. The criticality of the lines strongly depends on the vegetation height: the most critical lines

E0 E1 E2 E3 E4 E5 E6 Freq. - H1 (/yr) Freq. - H2 (/yr)

58-59 57-58 62-65 65-66 9.4× 10−3 < ×10−5

65-66 57-58 59-60 1.5× 10−3 < ×10−5

59-60 57-58 62-65 65-66 1.1× 10−3 < ×10−5

58-59 57-58 65-66 8.2× 10−4 < ×10−5

23-24 68-24 1.3× 10−3 1.8× 10−4

32-33 32-33’ 31-38 30-32 34-36 61-36 61-36’ < ×10−5 1.6× 10−4

59-60 58-59 1.1× 10−4 1.5× 10−4

32-33’ 32-33 31-38 30-32 34-36 61-36 61-36’ < ×10−5 1.5× 10−4

Table 6.9: Dangerous scenarios and their frequencies for different vegetation heights.

are very different for a high height and for a low height. We can see from Tables 6.10 and 6.11 that,

for a high vegetation height, line 57-58 is sensitive to the reorganization of the flows after another

trip, increases the thermal instability, but does not entail an electrical instability. On the contrary,

also for a high vegetation height, line 65-66 is sensitive to the reorganization of the flows, but entails

an electrical instability.

6.2.4 Impact of changes in generation

6.2.4.1 Cross-border power flows

The total frequency of dangerous scenarios for different mean cross-border power flows from NETS

to NYPS is shown in Figure 6.11 (40 millions MC runs for each point, which means that σ is less

than 2% for each point). Cross-border power flows are modified by decreasing the generation in one

zone (the power of each unit is decreased proportionally to its peak power in the base case) and

increasing it in the other (in the same way) by the same total amount. As shown in Table 6.1, the

89


Link V Fi @10−4 (%) V Fi @10−5 (%) V Fi @10−6 (%) V Fi @10−7 (%)

57-58 76.4 42.5 12.0 2.2

65-66 75.9 42.4 11.9 2.1

62-65 60.5 34.8 9.5 1.6

58-59 57.3 37.3 15.4 8.3

59-60 21.2 11.9 7.2 6.3

35-45 3.1 8.0 13.0 14.0

46-49 2.5 7.1 10.4 12.1

69-18 2.4 6.1 9.0 10.5

49-18 1.9 5.2 8.4 9.9

38-46 2.4 5.9 8.4 9.1

Table 6.10: Vesely-Fussel factors for different vegetation heights.

Link Li @10−4 (%) Li @10−5 (%) Li @10−6 (%) Li @10−7 (%)

65-66 54.7 32.9 9.4 1.8

33-34 9.1 3.6 <1 <1

59-60 7.0 4.8 3.2 3.1

34-36 2.8 1.0 <1 <1

58-59 2.1 2.2 3.3 3.4

46-49 1.5 3.8 6.2 7.1

17-43 1.7 3.9 5.9 6.5

35-45 1.2 3.7 4.8 5.2

69-18 1.1 3.0 4.5 5.2

50-51 1.1 2.7 4.3 4.4

Table 6.11: Lambert factors for different vegetation heights.

mean cross-border power flow from NETS to NYPS in the base case is 140 MW. The independent

method does not reveal a sensitivity of frequency to cross-border power flows. In the opposite case,

the dynamic level-I PRA method reveals an important sensitivity when the power flow goes from

NETS to NYPS, but not when the power flow goes from NYPS to NETS. This can be explained by

two factors. First, the superposition between local power flows and cross-border power flows induces

a non-symmetrical behavior for cross-border power flows: a flow from NYPS to NETS is opposed

to local flows and, consequently, it decreases the frequency of dangerous cascading scenarios in this

region when the flow from NYPS to NETS increases (until the two are equal and opposite). On

the contrary, when the mean power flow from NETS to NYPS grows, the frequency of dangerous

scenarios in the critical region revealed by the base case increases, as shown in Table 6.12. Secondly,

a second critical area appears between buses 30, 33 and 36 (NYPS), as the power flow from NYPS

to NETS increases, leading to the emergence of new dangerous scenarios, as shown in Table 6.13

and in Figure 6.12. As the two effects balance each other, the total frequency of dangerous scenarios

is nearly constant.

6.2.4.2 Installed wind power

The total frequency of dangerous scenarios for different installed wind powers4 is shown in Figure

6.13 (40 million MC runs for each point). Above 2000 MW, frequencies of dangerous scenarios

slightly increase. The absolute variation rate is nearly the same for both methods. These increases

are not due to specific scenarios, but are due to a global increase of all scenarios.

4The power installed in each wind farm is increased proportionally to the initial installed power.

90


Figure 6.11: Influence of cross-border power flows on the total frequency of dangerous scenarios.

E0 E1 E2 E3 Freq. (/yr)

58-59 57-58 62-65 65-66 5.2× 10−3

58-59 57-58 65-66 8.1× 10−4

59-60 57-58 62-65 65-66 7.7× 10−4

65-66 57-58 59-60 7.6× 10−4

Table 6.12: Most frequent dangerous scenarios for a mean power flow from NETS to NYPS of 398

MW

E0 E1 E2 E3 E5 Freq. (/yr)

58-59 57-58 62-65 65-66 6.5× 10−4

32-33 32-33’ 30-32 61-36 61-36’ 6.2× 10−4

Table 6.13: Most frequent dangerous scenarios for a mean power flow from NYPS to NETS of 195

MW

Figure 6.12: Critical area for a mean power flow from NYPS to NETS of 195 MW.

6.2.4.3 Definitive shut-down

We study here a definitive shutdown of all units of the same power plant. The lost generated power

can be compensated either in the same area, or by the other developed area (NETS or NYPS), or by

all areas. Figures 6.14 and 6.15 give the relative augmentation of the total frequency of dangerous

scenarios (40 million MC runs for each power plant). Surprisingly, in the dynamic level-I PRA

91


Figure 6.13: Influence of total installed wind power on the total frequency of dangerous scenarios.

approach, the shutdown of power plant 2 decreases this frequency. It can be explained by the

congestion revealed by the base case in the critical area between buses 2, 3 and 56: the shutdown of

this power plant decreases the production and consequently decreases the thermal cascading failure.

This is confirmed by Table 6.14: most frequent dangerous scenarios which were in the critical area

in the base case disappear from the top of the ranking. On the contrary, the shutdown of power

plants 5, 7, 8, 10 or 12 increases significantly the frequency when the lost power is compensated by

the NETS. Indeed, the frequency of dangerous scenarios in the critical area increases in these cases,

as shown in Table 6.15. To summarize the output of Figure 6.14, we can say that, in the dynamic

level-I approach, situations increasing the congestion in the critical area lead to a significant rise of

the total frequency of dangerous scenarios, and vice-versa. In the independent approach, variations

can be significant when the lost power is compensated only by one area, but does not have the same

behavior as in the dynamic level-I approach.

Figure 6.14: Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in

the NYPS (10,12) on the total frequency of dangerous scenarios - Dynamic level-I PRA.

6.2.4.4 Maintenance

This Subsection studies the impact of power plant maintenance on the risk of blackout. Figures

6.16 and 6.17 give the relative augmentation of the total frequency of dangerous scenarios for a

4-week maintenance of one unit in each NETS power plant, according to the season in which the

power plant is maintained (40 million MC runs for each power plant). The lost power is compensated

in the same area. In the dynamic level-I PRA approach, for the majority of them, a maintenance

in the summer increases significantly the frequency of dangerous scenarios and a maintenance in

92


Figure 6.15: Impact of the definitive shutdown of some power plants in the NETS (2,5,7,8) and in

the NYPS (10,12) on the total frequency of dangerous scenarios - Independent method.

E0 E1 Freq. (/yr)

23-24 68-24 1.6× 10−4

28-29 26-28 1.4× 10−4

39-44 39-45 1.4× 10−4

48-40 41-40 1.4× 10−4

53-52 37-52 1.4× 10−4

Table 6.14: Most frequent dangerous scenarios after shutdown of the power plant 2 (NETS) when

the lost power is compensated by all areas.

E0 E1 E2 E3 Freq. (/yr)

58-59 57-58 62-65 65-66 6.1× 10−3

59-60 57-58 62-65 65-66 1.1× 10−3

58-59 57-58 65-66 1.1× 10−3

65-66 57-58 59-60 7.7× 10−4

Table 6.15: Most frequent dangerous scenarios after shutdown of the power plant 12 (NYPS) when

the lost power is compensated by the NETS.

another season increases it slightly. However, the maintenance of an unit of power plant 2 or 3

decreases this frequency. As previously, it can be explained by the congestion in the critical area

between buses 2, 3 and 56: the maintenance decreases the production and consequently decreases

the thermal cascading failure. In the independent approach, variations are not significant.

6.3 Two-level blackout PRA

6.3.1 Test case: data and modeling assumptions

The test system used is shown in Figure 6.18. It is an adaptation of the Kundur’s Two-Area

System [14]. There are 8 power plants with a maximal power of 400 MW for each of them. The

peak load connected is 971 MW (and 100 MVAr) into bus 11 and 1787 MW (and 200 MVAr) into

bus 13. At peak load, the generated power is 350 MW in each power plant. As for the previous

example, the load is modulated along the day and the hour what is mentioned in the IEEE-RTS [71]

and reproduced in Appendix B. The same load factor is applied to each load and each power plant.

Overhead lines are protected with overcurrent and distance relays. There are under-frequency and

93


Figure 6.16: Impact of a four-week maintenance of one unit for each NETS power plant on the total

frequency of dangerous scenarios - Dynamic level-I PRA.

Figure 6.17: Impact of a four-week maintenance of one unit for each NETS power plan on the total

frequency of dangerous scenarios - Independent method.

under-voltage load shedding as system protection scheme. Generators are modeled by synchronous

machines equipped with IEEE-AC4A excitation systems, power system stabilizers and a gas turbine-

governor system. Power plants are protected with over-excitation, under-voltage, under-frequency,

over-frequency and loss-of-synchronism relays. Complete details are given in Appendix B.

Figure 6.18: Test system for a two-level blackout risk analysis.

For the level-I, some simplifications are adopted to reduce the complexity of the analysis, nearly

the same as for the previous example. We choose a unique vegetation height for all lines and all

MC runs. For the electrical instability of the system, we do not consider small-signal angular insta-

bility. Voltage instability is detected through the non-convergence of load-flow equations, frequency

94


instability through the steady-state frequency deviation, and transient angular instability through

the simulation of a simplified dynamic model5 during several seconds and static violation of overcur-

rent protections6. The models used for voltage stability, frequency stability and transient angular

instability transition criteria are described in Appendix C. We consider the system thermally stable

if there is no new contingency within 60 minutes. Average failure rates are taken as their nominal

values in nominal conditions. Initial conditions (load pattern and climatic conditions, sampled at

the beginning of each history) are kept constant during each MC run.

For the level-II, some simplifications are also adopted here to reduce the complexity of the analysis.

We consider that the setpoint of a relay is equal to its nominal value (i.e. setpoints are not distributed

according to a probabilistic law) and we neglect measurement errors. Power plant protections are

considered perfectly reliable. The on-demand failure probability of line protections and load shedding

relays are taken respectively to 10−2 and 10−1. The maximum time between events (transition or

relay failure) is limited to 8 seconds, which means that the system is considered to be electrically

stable if nothing new occurs within 8 seconds. The simulation of a DDET branch (see Subsection

5.5.3) is stopped when its probability goes under a threshold equal to 10−7 (cut-off probability).

The dynamic modeling of the loads7 can be crucial to give realistic results in case of voltage and/or

frequency instabilities. The dynamic behavior depends on the equipments behind the load (motors,

discharge lighting, electronics, ...). Then, it varies according to the consumer type (industrial areas,

residential areas, commercial areas, ...) and according to the season, the day and the hour. We

consider here a simplified model with 30% constant impedance and 70% constant power for both

loads at any time. However, in order to solve convergence problems, this constant power is simulated

through the re-computation of admittances at each time step according to the voltage at the previous

time step.

6.3.2 Level-I: results

The “most dangerous scenarios”, i.e. scenarios leading to electrical instability with the highest

frequency, are given in Table 6.16. These scenarios are very simple: they are all two-event scenarios,

which means that the second event is the “triggering event”, and they lead to a system splitting. We

must note that scenarios are grouped in this Table according to the sequence of occurring events, but

a large amount of different situations (characterized by different timings, different load/generation

patterns, different climatic conditions) are behind each sequence. The electrical instabilities triggered

by the last event are shown in Figure 6.19 for each type of level-I scenario. We should note that these

electrical instabilities are different from one type to another, but at each time, frequency instability

occurs.

Scenario type Initiating event Triggering event Frequency (/yr)

1 14-15 14-15’ 1.3× 10−3

2 9-10 9-10’ 1.2× 10−3

3 12-13 12-13’ 2.3× 10−4

4 11-12 11-12’ 2.3× 10−4

Table 6.16: Most frequent dangerous scenarios revealed by level-I blackout PRA. Each event is a

trip of a line after a permanent line fault. Each line is referred to the two buses it connects.

5A one-axis model for the synchronous machine, with the modeling of the excitation system, and constant-

impedance loads.6In case of voltage instability, this “overcurrent instability” is not checked since it is not relevant if load flow

iterations did not converge.7How the power consumption varies with the frequency and the voltage.

95


Figure 6.19: Electrical instabilities per type of level-I dangerous scenarios.

6.3.3 Clustering

In the present case, the complexity of the clustering problem is greatly reduced, since all loads

and generations are proportional to the load factor. We can then group level-I scenarios into clusters

according to only one variable, this load factor or the total load. We propose to use 10 intervals of

equal size between the minimum and the maximum loads for each type to serve as clusters. The

probability distribution of these 10 clusters per type of level-I dangerous scenarios is shown in Figure

6.20.

Figure 6.20: Probability of total load per type of level-I dangerous scenarios.

6.3.4 Level-II: results

The level-II results for each type of level-I scenarios according to the clusters in Figure 6.20 are

given in Tables 6.17, 6.18, 6.19 and 6.20. The column “Loss of power (MW)” gives the mean

loss of power supplied (either due to load shedding or a blackout) in MW, the columns “Area 1

BO probability” and “Area 2 BO probability” the probability to have a blackout respectively in

area 1 and in area 2 (including a total blackout) and the column “Area 1+2 BO probability” the

probability to have a total blackout. For low loads, blackout is always avoided, even in case of failure

of one or several load shedding relays. On the contrary, for high loads, a total blackout cannot be

avoided, even if all load shedding relays work perfectly. Between these two extreme cases, there are

transition loads for which a partial and/or a total blackout can occur with a probability lower than

1. These probabilities globally seem to be an increasing function of load, but not monotonously.

The transition between low loads and high loads is different for each level-I type of scenarios: for

types 1 and 3, it occurs between clusters 3 and 7, but for types 2 and 4, it occurs between clusters

96


6 and 9.

Cluster Loss of power Area 1 BO Area 2 BO Area 1+2 BO

# (MW) probability probability probability

1 144 0.0000 0.0000 0.0000

2 205 0.0000 0.0000 0.0000

3 289 0.0163 0.1175 0.0163

4 1155 0.0000 0.9997 0.0000

5 1330 0.0059 0.9997 0.0059

6 1659 0.2789 1.0000 0.2789

7 2120 0.9999 1.0000 0.9999

8 2302 1.0000 1.0000 1.0000

9 2485 1.0000 1.0000 1.0000

10 2667 1.0000 1.0000 1.0000

Table 6.17: Level-II results by clusters for level-I type 1 (as denoted in Table 6.16) scenarios.



1 142 0.0000 0.0000 0.0000

2 182 0.0000 0.0000 0.0000

3 236 0.0000 0.0000 0.0000

4 296 0.0000 0.0000 0.0000

5 340 0.0000 0.0000 0.0000

6 391 0.0000 0.0000 0.0000

7 465 0.0007 0.0009 0.0007

8 586 0.0199 0.0361 0.0195

9 2475 1.0000 0.9880 0.9880

10 2667 1.0000 1.0000 1.0000




1 121 0.0000 0.0000 0.0000

2 256 0.0000 0.0000 0.0000

3 324 0.0000 0.0279 0.0000

4 583 0.0004 0.2704 0.0001

5 1307 0.0026 0.9997 0.0026

6 1505 0.0644 0.9997 0.0644

7 1927 0.7268 1.0000 0.7268

8 2203 1.0000 1.0000 1.0000

9 2371 1.0000 1.0000 1.0000

10 2538 1.0000 1.0000 1.0000


The five branches with the highest risk (product of the probability by the loss of supplied power)

of the DET for cluster 3 of level-I type 1 scenarios are depicted in Figure 6.21. The voltages at buses

97




1 90 0.0000 0.0000 0.0000

2 220 0.0000 0.0000 0.0000

3 244 0.0000 0.0000 0.0000

4 294 0.0000 0.0000 0.0000

5 374 0.0000 0.0000 0.0000

6 436 0.0027 0.0000 0.0000

7 834 0.6721 0.0000 0.0000

8 1033 0.9776 0.0000 0.0000

9 1123 1.0000 0.0000 0.0000

10 2517 1.0000 1.0000 1.0000


9-15 for the top scenario and for the bottom scenario are given respectively in Figures 6.22 and 6.23.

In both cases, power plants 5 and 6 are isolated and trip after some seconds (loss of synchronism

and over-excitation) at the beginning of the fast cascade. The example 1 corresponds to the scenario

where all relays work perfectly. Thanks to several load shedding steps, a partial or a total blackout

can be avoided. On the contrary, a load shedding relay failure at the beginning of the example 2

entails a partial blackout in area 2.

Figure 6.21: DET main branches for type 1 scenarios, cluster 3. A relay action is represented by a

vertical transition. If the relay fails, the branch continues horizontally. The flags “Line x− y trip”,

“PP x trip”, “LS x” and “BO x” indicate respectively that the transition is due to the trip of the

line between buses x and y, the trip of the power plant x, a load shedding at bus x or the notification

of a blackout state at bus x.

6.3.5 First two levels

From the combination of the first two levels, we can compute the total risk of the loss of power

supplied per year and the frequency of a blackout or major load shedding. Table 6.21 gives the

overall risk and the contribution of each level-I type of scenarios. Two main observations emerge

from the comparison between this Table and Table 6.16. First, two level-I types of scenarios with

98


Figure 6.22: Voltage evolution for type 1 scenarios, cluster 3, example 1. No relay fails and no

element (except power plants 5 and 6) is lost. Even if oscillations occur, the voltages are stabilized

quickly between 0.9 and 1.0 pu thanks to several load shedding steps. A blackout is avoided.

Figure 6.23: Voltage evolution for type 1 scenarios, cluster 3, example 2. A load shedding relay

failure entails very low voltage and high currents, such that distance relays operating in zone 2

disconnect the lines between buses 12 and 13. Over-current relays then trip lines between buses 13

and 14, leading to a BO in area 2.

a similar frequency can induce very different risks and blackout frequencies. Secondly, even if the

level-I type 3 scenarios have a frequency one order of magnitude below level-I type 2 scenarios, the

blackout frequencies in area 1 are nearly the same for these two types. Therefore, it seems not

relevant to rank scenarios only according to the frequency given by level-I PRA, since consequences

can be very different from one type to another. The distribution of the loss of supplied power for

these four level-I types of scenarios is given in Figure 6.24.

6.4 Level-I blackout PRA efficiency

The algorithm efficiency for the results presented in Section 6.2 is a strong limitation to its

application to larger grids: it requires approximately 4.7 ms per MC run and only approximately

99


Type Risk Area 1 BO Area 2 BO Area 1+2 BO

(MW/year) frequency (/yr) frequency (/yr) frequency (/yr)

1 2.537 9.74×10−4 1.21×10−3 9.74×10−4

2 0.832 1.40×10−4 1.44×10−4 1.39×10−4

3 0.264 5.95×10−5 1.36×10−4 5.94×10−5

4 0.121 5.60×10−5 5.19×10−6 5.19×10−6

Total 3.754 1.23×10−3 1.50×10−3 1.18×10−3

Table 6.21: Risk and frequency of blackout.

Figure 6.24: Distribution of the loss of supplied power.

1 MC run out of 16000 leads to a dangerous scenario and therefore contributes to the statistics.

The time per MC run can be easily improved by using optimized tools instead of a simple Gaussian

elimination routine for the load flow iterations. By using UMFPACK (unsymmetric multifrontal

sparse LU factorization method) [77] which relies on sparse matrices, the time per MC run is reduced

to 1.85 ms. This Section focuses on the increase of the number of MC runs participating in the

statistics, using variance reduction techniques presented in 5.3.7. As these techniques could imply

not only the reduction of the variance, but also the increasing of the time per MC run (i.e. if more

events are simulated per MC run), the global efficiency is characterized by the merit figure defined

in Section 3.3. Two techniques were proposed: favoring failures during the cascade by forcing them

to occur before a time limit and favoring thermal failures by biasing weather conditions sampling.

Subsection 6.4.1 focuses only on the first one by applying it to the independent simulation algorithm

(i.e. same algorithm, but neglecting thermal failures) in order to avoid the specific problem of thermal

failures of overhead lines. Subsection 6.4.2 combines then these two techniques to the dependent

simulation algorithm developed in this PhD thesis.

6.4.1 Independent simulation algorithm

We showed in 5.3.7 that the maximum sampling time T should be greater than the time limit Tmused in the simulation algorithm (equal to 1 hour for results presented in this Chapter). We define

the biasing time factor α as

α =T

Tm. (6.8)

This Subsection studies the simulation efficiency for α ≥ 1 and for four cut-off weights8, pC =

10−4, 10−3, 10−2, 10−1. The mean times per MC run, the sample variances and the figures of merit

8The biasing technique is applied only if the current weight of the MC run is higher than the cut-off weight.

100


are shown in Figures 6.25, 6.26, and 6.27, respectively. They are compared to the characteristics

of the unbiased simulation. For α < 10, even if the figure of merit is higher in some cases than for

the unbiased case, it can also be strongly lower. Indeed, some MC runs can get a high weight, as

explained in Subsection 5.3.7, and then induce a high variance. On the contrary, for α > 10, the

figure of merit is higher than the unbiased case. It is stabilized for all cut-off probabilities for α ≥ 25

to values ten to thirty times higher than the unbiased one. Therefore, favoring failures during the

cascade by forcing them to occur before a time limit allows to strongly improve the efficiency of an

independent simulation algorithm. We should also note that the sensitivity to the precise values of

the biasing time factor α and the cut-off probability pC is low for 25 ≤ α ≤ 100.

Figure 6.25: Mean times per MC run - biased independent simulations.

Figure 6.26: Sample variances - biased independent simulations.

6.4.2 Dependent simulation algorithm

This Subsection first studies the impact of favoring failures by forcing them to occur before a

time limit on the dependent simulation efficiency for α ≥ 1 and for four cut-off weights, pC =

10−4, 10−3, 10−2, 10−1. The mean times per MC run, the sample variances and the figures of merit

are shown in Figures 6.28, 6.29, and 6.30, respectively. The efficiency is improved only for α ≥ 100,

and the gain is then limited to several tens of percents. The efficiency is deteriorated for smaller

values of α, especially when the cut-off weight is low. Indeed, the simulation time per MC run is

increased in these cases, while the variance is not strongly reduced. The small gain for the variance

101


Figure 6.27: Figures of merit - biased independent simulations.

can be explained by cascading failures entirely due to thermal failures of overhead lines: in these

cases, the final weight is not reduced and equal to 1.

Figure 6.28: Mean times per MC run - dependent simulations with biased transition times.

Figure 6.29: Sample variances - dependent simulations with biased transition times.

102


Figure 6.30: Figures of merit - dependent simulations with biased transition times.

Therefore, it is necessary to increase the number of cascading failures entirely due to thermal

failures of overhead lines while reducing their weight by favoring thermal failures by biasing weather

conditions sampling. The definition of biased probability distributions is complex because the num-

ber of dangerous histories must be significantly increased while the weight of dangerous histories

must be controlled (to not deteriorate the variance). In order to keep a bounded weight, we propose

to divide the sampling interval into subintervals and to apply in each subinterval the same pdf as

the unbiased one, but with a scale factor Ei (different for each subinterval). Obviously, these scale

factors must be chosen so that a well-defined pdf is kept. The weight is simply given by the inverse

of the scale factor in the sampled subinterval. We propose to divide the sampling interval into nIsubinterval with the same unbiased probability. In this case, the sum of the scale factors must be

equal to nI so that a well-defined pdf is kept. If we want to favor high values of the random variable

sampled, the scale factor has to increase with the random variable values. Different simple laws can

then be used for the scale factor, for example a linear law with a scale factor given by

Ei =2i

nI + 1(6.9)

for the subinterval i, or a quadratic law with a scale factor given by

Ei =6i2

(nI + 1)(2nI + 1). (6.10)

This concept is illustrated in Figure 6.31 for two subintervals. This technique can be simply applied

Figure 6.31: Biased normal law, with nI = 2.

to the ambient temperature to favor high values, since a unique temperature is sampled for the

103


entire network. However, it is a bit more complex for wind speeds, since several correlated random

variables are used. To avoid the uncontrolled effect of the Copula density, we propose to apply this

technique directly to the n initial independent standard normal distributions Z = [Z1, ..., Zn] in the

joint normal distribution method described in Subsubsection 6.2.1.2. Moreover, if the correlations

between wind speeds are high, we can apply this biasing technique only for the first random variable

Z1 in order to limit the weight variability. If we want to favor thermal failures, the biasing must

favor low wind speeds.

If we use pC = 10−1, α = 200, four subintervals with a linear law for the temperature and four

subintervals with a quadratic law for the wind speed, we can reach a figure of merit equal to 2.674

ms−1 (time per MC run and sample variance: 2.40 ms and 1.56×10−5) which corresponds to an

improvement by a factor 3, compared to an unbiased simulation. Even if this gain is significant, it

is not as high as for the independent simulation.

6.5 Conclusions

We first applied a simplified level-I dynamic PRA methodology to a test system in order to study

the impact of several changes in the electric grid, such as variation of vegetation height, cross-border

power flows, wind generation penetration, maintenance and shut-down of power plants. Even if the

modeling adopted for the vegetation height does not reflect perfectly the reality, we showed that

thermal effects can play an important role in cascading failure, during the first phase (the slow cas-

cade). It was well-known that only dependencies between events could explain statistical properties

of blackouts which occurred regularly, and we showed in this PhD thesis an approach to simulat-

ing and estimating the impact of dependent thermal failures. A comparison with a methodology

neglecting these thermal failures showed that not only the overall frequency of level-I dangerous sce-

narios is not the same if thermal effects are taken into account or not, but the same conclusion holds

for their ranking according to their respective frequencies. Moreover, conclusions on the impact of

changes in the electric grid on the risk of blackout can be strongly different according to whether an

independent analysis is performed or a dynamic level-I PRA analysis.

We applied then a two-level blackout PRA to a small test system in order to study in a coupled

way the two phases of a cascading failure. As the level I is needed to have an estimation of the

frequency of dangerous scenarios and the level II for their magnitudes in terms of loss of supplied

power (due to load shedding or blackout), the coupling between these two levels can lead to an

estimation of the triplets scenario,frequency,magnitude for the scenarios leading to an undesirable

situation. We showed that the level-II analysis after that level-I is necessary to have an estimation

of the loss of supplied power that a scenario can lead to.

Finally, we applied biasing methodologies to improve the efficiency of the level-I. We showed that

the variance linked to independent failures can be strongly reduced by favoring failures during the

cascade by forcing them to occur before a time limit. The variance linked to thermal failures of

overhead lines is more difficult to reduce. However, we can favor them by biasing weather conditions

sampling. The combination of the two techniques can lead to a efficiency gain equal to 3 (in terms of

figure of merit). This result must be combined to the computing time reduction obtained by using

more efficient solution algorithm for the load-flow equations.

104

Chapter 7

Perspectives

7.1 Introduction

A lot of open questions remain to reach a satisfactory 3-level blackout PRA. We propose in this

Chapter to enlighten only few of them, which seem to us the most complex pending issues. Sections

7.2, 7.4, 7.3, 7.5, 7.6 and 7.7 discuss the modeling of operators actions, the integration of protec-

tion systems failures, the modeling of electrical instabilities, the dynamic modeling of loads, the

development of the level-III and the application to real grids, respectively. We could add to this

list the integration of other cascading failure mechanisms like common mode failures in the level-I,

the simulation of time-varying conditions (load, weather conditions) during the slow cascade, the

development of the level-II using professional software for dynamic simulation, ...

7.2 Operators’ actions

We saw in Chapter 6 that the operators’ corrective actions are only considered for the moment

through a time limit after each event to continue the simulation. Indeed, we considered the system

thermally stable if there is no contingency for 60 minutes. It is obviously a too simple way to take

into account operators actions. They can be very important during the slow cascade to eliminate

possible overloads, to return to the initial international exchange program and to put back the system

in N − 1 security. Wrong actions can also lead to a fast cascade, as observed in the major system

perturbation in Europe in 2006. Transmission system operators have typically several possibilities:

busbars coupling or de-coupling, modification of the active and/or reactive power generated in

power plants (indirectly), connection or disconnection of capacitor banks. As described in Chapter

4, the traditional way to model operators’ corrective actions is to perform an OPF at each step

of the cascading failure simulation (e.g. with a minimization of the load shedding, inspired by

adequacy study methodologies). The possibility of overloaded lines tripping before corrective actions

is modeled through a line tripping probability (this probability can be a function of the line loading).

However, we are not convinced that it is a realistic modeling for a main reason: an OPF can lead to

a situation completely different from the initial one which is not in concordance with the idea that

the operators take only a few set of actions in such a situation. Moreover, such a model is not able

to consider partial corrective actions which are taken, but are insufficient to avoid other line trips,

such in Italy in 2003. These partial corrective actions can be important for the next development of

the cascading outage (especially the fast cascade). The purpose of such an OPF is not to re-compute

a steady-state to continue the cascade simulation, but to evaluate consequences, in the same way as

in adequacy studies.

105

CHAPTER 7. PERSPECTIVES

If an OPF is not convenient, a satisfactory modeling of operators’ corrective actions is still an open

question. The framework presented in this PhD thesis allows to consider a set of corrective actions

with a probability distribution of their respective action times (e.g. a busbar coupling within an

action time described by a Weibull random variable with a mean equal to 15 minutes). An example

of a simple model considering corrective actions can be found in Appendix D. The methodology

to determine what action operators can take in a specific situation (and their characteristic times)

should be developed by consulting real transmission system operators.

7.3 Electrical instability

We saw that the cascading failure is ruled by the electrical transient instead of the thermal transient

when the system becomes electrically unstable. Consequently, after each event, the electrical stability

must be assessed in order to switch to the fast cascade simulation when it is necessary. For results

presented in Chapter 6, we implemented

• A test of transient angular instability through a simplified dynamic simulation on several

seconds (only for the small test system),

• A test of frequency stability through the steady-state value of the frequency deviation after

primary regulation,

• A test of voltage stability through the convergence of the load flow iterations,

• A test to check if all the (steady-state) currents are under the setpoints of overcurrent protec-

tions.

These tests did not account for the small-disturbance angular instability and are thus not perfect.

The validity of the proposed simplified dynamic simulation over the time period considered should

be investigated, including the way the synchronous machine is modeled (the impact of ignoring its

saliency and the model order) and power plant systems are taken into account. It is not really the

steady-state value of the frequency deviation after primary regulation which should be considered

in the frequency stability test, but the extreme frequencies endured during the primary regulation

transient. A simplified model for the turbine-governor system can lead to a quick approximation of

these extreme frequencies [78, 79]. The non-convergence of the load flow iterations with the basis

method used (Newton-Raphson) does not necessarily imply a voltage instability. Other ways to

solve these equations should be tested before ending the level-I to enter the level-II in this case. A

fast but reliable method to test the small-disturbance angular instability should be developed and

implemented (equivalent to finding on which side of the imaginary axis is the rightest eigenvalue of

the linearized system).

7.4 Protection systems failures

There are mainly two types of protection system failures [52]:

1. Unwanted trips:

(a) Spontaneous trips: a healthy line can be tripped erroneously and spontaneously (not due

to a grid fault or a switching event) due to the failure of its protection system.

(b) Unselective trips (trips due to “hidden failures”): a healthy line can be tripped erroneously

after a grid fault due to the failure of its protection system.

2. Missing trips: a faulted line could not be tripped in due time, due to the failure of its protection

system.

106


Due to unwanted unselective and missing trips, a line fault can induce the loss of several lines.

Moreover, missing trips can cause the fault being cleared after the critical clearing time and, thus,

stability problems. Unwanted unselective and missing trips were implied in several past blackouts.

We can cite in particular:

• Southwestern Public Service Company System Disturbance - April 16, 1996 [22]. A fault

occurred and was cleared in 5 cycles (no missing trip). A 230 kV bus backup relay (zone 3)

saw the fault and operated after 1.27 seconds because the timer did not drop out after the

fault was cleared (unselective trip). All breakers on the 230 kV bus controlled by this backup

relay opened due to this relay mis-operation. This misoperation removed a power plant and

two major lines. It entailed a fast cascade (voltage collapse).

• Western Interconnection (WSCC) System Disturbances - July 2-3, 1996 [22]. A protection

system removed a healthy line (the same on July 2 and July 3) after a fault due to misoperation

of a local delay timer in the ground element of a relay (unselective trip).

• WSCC Disturbance - July 2, 1996. A protection system opened a healthy line after a fault

due to misoperation of a zone 3 relay (faulty phase-to-phase impedance element, unselective

trip) [22]. This failure entailed a fast cascade.

• Croatia blackout - January 12, 2003 [80]. One pole of a circuit breaker did not trip a faulted line

(missing trip). This missing trip entailed a fast cascade (angular instability and unsymmetrical

conditions).

Protection system failures can thus play an important role in cascading failures.

The idea that hidden failures (unwanted unselective trips) can lead a simple event to a widespread

outage was introduced in the 90’s [81, 25, 82]. Only protections which have the fault in their

“vulnerability region” can trip lines due to hidden failures. This problem of hidden failures has been

used in numerous papers to simulate cascading failures: after a fault on a line, protections which

have this line in their vulnerability region can trip lines due to hidden failures. If an additional

line is trip due to a hidden failure, protections which have this line in their vulnerability region can

again trip lines due to hidden failures, etc... However, this approach appears to us to be incorrect:

the dynamic electrical behavior of a fault followed by a line trip is not the same as the dynamic

electrical behavior of only a line trip. For example, hidden failures can lead distance relays to

incorrectly trip elements in zone 3 because the apparent impedance goes inside the zone 3 due to

a fault. This is in general not the case if we have only a line trip (or it can be possible according

to the electrical transient, but probably with a low likelihood). It is probably due to the confusion

between an unwanted trip due to a grid fault and a hidden failure, and an correct trip of a line

on zone 3 due to low apparent impedance without a grid fault. Cascading outages due to hidden

failures are sometimes integrated in simulations considering also other cascading outages schemes.

In particular, the Manchester model integrates hidden failures in a one-level blackout PRA, as well

as other failure mechanisms, as described in Subsection 4.4.2.

The probabilities to have missing trips and their consequences where studied in [83, 51, 84, 52].

After a fault, dynamic simulations are performed for the different branches of the event tree generated

by considering different failures that could occur in the protection system (including failures of auto-

reclosing relay). If the fault is not cleared after the “normal” time delay, dynamic instability can be

induced, as well as the loss of other lines (due to distance relays operating in zone 2 or zone 3).

During the slow cascade, protection systems failures can lead to the loss of additional elements

after a grid fault and induce transient instability. The different timings that could occur have been

carefully studied in the case of missing trips, but are not considered in works studying the impact

107


of unselective trips. The temporal aspect of hidden failures should be studied and both missing and

unselective trips should be integrated in our two-level blackout PRA.

7.5 Load modeling

An important problem for the level-II analysis is the dynamic load modeling. The chosen load

model should be sufficiently realistic, while guaranteeing a convergence of the dynamic simulation at

each time step. This requirement of convergence seems to be specific to our blackout PRA approach.

Indeed, when a non-convergence situation occurs in a dynamic simulation in other contexts where

the purpose is not to evaluate the loss of load, it is simply classified as voltage collapse. The 2003

Swedish/Danish blackout showed that low voltages can induce a grid splitting before a blackout

(due to distance relays working in zone 3). Therefore, as the purpose of the level-II analysis is to

estimate consequences in terms of loss of load, it is crucial to have an accurate estimation of the

electrical variables at each time step. If the network does not converge at one or several time steps,

the obtained estimation is not reliable.

A complete review of load models can be found in [15, 16]. The simplest model is a decomposition

of loads in three fractions: fraction of constant active/reactive impedance a1/b1, fraction of constant

active/reactive current a2/b2 and fraction of constant active/reactive power a3/b3,

P (t) = P0

[a1

(V (t)

V0

)2

+ a2

(V (t)

V0

)+ a3

], (7.1)

and

Q(t) = Q0

[b1

(V (t)

V0

)2

+ b2

(V (t)

V0

)+ b3

], (7.2)

where V0 is the reference voltage (pre-disturbance voltage), P0/Q0 the reference (pre-disturbance)

active/reactive power, V (t) the actual voltage and P (t)/Q(t) the actual active/reactive power. It is

called the ZIP load model (impedance-current-power). It requires only two independent parameters

for active power (a1 +a2 +a3 = 1) and two independent parameters for reactive power (b1 +b2 +b3 =

1). A linear frequency dependency can be simply added to this model with a multiplicative term,

P (t) = P0

[a1

(V (t)

V0

)2

+ a2

(V (t)

V0

)+ a3

]× [1 + cf (f(t)− f0)], (7.3)

where f0 is the reference (pre-disturbance) frequency (in general the nominal frequency), f(t) the

actual frequency and cf the frequency dependence coefficient. However, this ZIP model is not

convenient to represent loads in case of extreme voltage decrease, as it could occur in cascading

failures leading to blackout, as it is assuming an instantaneous equilibrium for each load. Moreover,

the convergence is guaranteed only for a purely constant impedance model. Another common analog

model is the exponential load model where the active/reactive power is proportional to the voltage

raise to the power α/β,

P (t) = P0

(V (t)

V0

)α, (7.4)

and

Q(t) = Q0

(V (t)

V0

)β. (7.5)

It suffers from the same limitations as those of the ZIP model. Composite load models consider

that each load is an assembly of different load types: induction motors, discharge lighting, constant

power, constant inductance and constant impedance (see for example [85]). However, it is again

a static load modeling for dynamic simulation. On the contrary, Hill in [86] and Karlsson in [87]

108


presented a simple time-dependent model, initially to represent the load tap changers and other

control devices which act to restore the load. Different forms of the differential equation describing

the total load exist, but the two main are the additive load model and the multiplicative load

model. They are based on a static load behavior (load behavior when the steady-state is reached)

and a transient load behavior (“instantaneous” load behavior) through steady-state load functions

Ps(V )/Qs(V ) and transient load functions Pt(V )/Qt(V ), respectively. In the additive load model,

the load characteristic is written as [15]

P = Pt(V ) + P0zP (7.6)

Q = Qt(V ) +Q0zQ (7.7)

where zP and zQ are load state variables, driven by the differential equations

TP zP = −zP +1

P0[Ps(V )− Pt(V )], (7.8)

TQzQ = −zQ +1

Q0[Qs(V )−Qt(V )], (7.9)

where TP and TQ are the time constants. When the system is in its steady-state before the distur-

bance, V = V0 and thus

zP =1

P0[Ps(V0)− Pt(V0)] = 0. (7.10)

The instantaneous load behavior corresponds then well to the transient load behavior (e.g. constant

impedance). However, as soon as zP 6= 0, a fraction of the instantaneous load behavior corresponds

to the steady-state load behavior (e.g. constant power), which can introduce nonphysical singularity

problems in the response of the system. In the multiplicative load model, the load characteristic is

written as [15]

P = zPPt(V ) (7.11)

Q = zQQt(V ) (7.12)

where zP and zQ are load state variables, driven by the differential equations

TP zP =1

P0[Ps(V )− zPPt(V )], (7.13)

TQzQ =1

Q0[Qs(V )− zQQt(V )], (7.14)

where TP and TQ are the time constants. When the system is in its steady-state before the distur-

bance, V = V0 and thus

zP =Ps(V0)

Pt(V0)= 1. (7.15)

The instantaneous load behavior corresponds then well to the transient load behavior (e.g. constant

impedance). Moreover, even if zP 6= 1, the instantaneous load behavior continues to correspond

to this transient load behavior. When the transient load behavior is constant impedance, this

multiplicative load model guarantees the convergence of the dynamic simulation at each time step.

The realism of such a dynamic load model should therefore be investigated, as well as typical values

of parameters. If this realism is satisfying, these models can be used in level-II simulations.

7.6 Level-III

The purpose of this PhD thesis was not to study the restoration process and to develop a modeling

for its PRA (level-III blackout PRA). Nevertheless, this level-III is necessary to have the final

109


consequence estimation, in terms of energy not supplied. Due to the complexity of the restoration

process, and if the purpose is only to associate a risk measure to each level-I/level-II scenario, it is

probably more feasible to use a “bulk” estimation of the power restored as a function of time, than

to simulate the restoration. A simple estimation of the load restored as a function of time based

on previous blackouts/major system disturbances is given in [88]. A distinction should be made

between partial load shedding, partial blackout and total blackout.

7.7 Application to real grids

Beside previous challenges, several difficulties are present to apply the proposed approach to real

grids. The level-I requires a lot of different parameters, especially for overhead lines, which are not

directly available. A way to reduce this number of parameters should be investigated. By using

directly a critical temperature instead of using a critical sag (function of the vegetation height),

mechanical parameters can be eliminated. Thermal parameters could probably be combined into

a small set of characteristic values permitting to compute quickly steady-state temperature and

thermal time constants when the current, the ambient temperature and the wind speed are known.

The huge computing time needed for the level-I is another limitation. The development of specific

techniques inspired by what has been done for particle transport problems (e.g. neutron transport

problems in nuclear engineering) [89] should improve the required computing time. In particular,

the technique of stratified sampling (or quota sampling) could be applied. This technique divides

the Γ domain of initial conditions into J sub-domains Γj such that

J⋃j=1

Γj = Γ, (7.16)

and

Γi ∪ Γj = 0 (7.17)

if i 6= j. The number of samples to be taken from each subdomain is selected to obtain a near-

minimum variance (idea of importance sampling). In particular, regions of large variances should

be sampled more frequently.

The possibility of having a dynamic simulation including a complete set of relevant protections

for the level-II should also be investigated.

110

Conclusions



from the electrical sector is very positive, a residual risk of blackout or undesired load shedding in

critical zones remains. Previous blackouts showed that, despite their low occurrence, their contribu-

tions to mean reliability indices are very important. Moreover, the occurrence of such a situation is

likely to entail major direct and indirect economical consequences, as observed in recent blackouts.

Assessing this residual risk and identifying scenarios likely to lead to these feared situations is crucial

to control and optimally reduce this risk of blackout or major system disturbance. The objective of

my PhD thesis was to develop a methodology able to reveal scenarios leading to a blackout or a ma-

jor system disturbance and to estimate their frequencies and their consequences with a satisfactory

accuracy.

A blackout is a collapse of the electrical grid on a large area, leading to a power cutoff, and is

due to cascading failure. Based on the analysis of past blackouts and major system disturbances,

we showed that the typical development of a cascading failure leading to a blackout can be split

in two phases. Following the occurrence of an initial perturbation (initiating(s) event(s): the loss

of one or several elements), two possibilities arise. If this perturbation causes the simultaneous

loss of several elements, the N − 1 rule no longer holds and the system can become electrically

unstable (the initiating events are also the triggering events) if the system is not in security N − 2

or N − 3. A fast collapse of the electrical grid can then start. But, in most cases, thanks to

the N − 1 rule, the grid stays electrically stable after the initiating event. A competition then

starts between operators corrective actions and possible additional failures, either due to thermal

effects or independent. This phase is called slow cascade (or steady-state progression), because it

displays characteristic times between successive events ranging from tens of seconds to hours. The

occurrence of additional events during this phase can trigger (after the triggering event) an electrical

instability (violation of protections set points, angular instability, etc.). Then a second phase called

fast cascade (or high-speed cascade) occurs, ruled by electrical transients, displaying characteristic

times between successive events ranging from milliseconds to tens of seconds. This phase is too fast

to allow operators to take corrective actions and is characterized by a rapid succession of electrical

events (additional failures, protection actions, etc.) whose occurrence order and timing are driven

by the power system dynamic evolution in the course of this transient. After this fast cascade, the

electrical grid reaches a stable state: a possible collapse of the power system in some zones, or a

major load shedding. Once a blackout or a major load shedding occurred, the recovery period, which

might last for several hours to several days, can be viewed as an additional (and last) phase.

Several security studies were developed to estimate the risk of cascading failures. They are mainly

based on an unique global approach which tries to cover all thermal and electrical phenomena leading

to additional contingencies in one model (one-level PRA). However, as the electric state of the grid

is computed in a purely static way after each event, they do not consider correctly the fast cascade

(one-level blackout PRA). Few methods based on dynamic PRA were developed to take into account

111

CONCLUSIONS

interactions between the electrical grid state (electrical variables) and failure events. However, these

methods are not able to take into account successive line failures (failures due to thermal effects or

independent failures). Therefore, none of these methods are able to treat the entire cascade leading

to a blackout. Thus, there was a need to develop such an approach, to model the entire cascade as

realistically as possible.

We proposed in this PhD thesis such a new methodology to reveal cascading scenarios leading to

a blackout (or a major system disturbance) in a power system and to estimate their frequencies and

their consequences. This methodology was adapted from dynamic PRA, initially developed for the

nuclear sector, and is able to consider interactions between failure rates (or failure probabilities) and

process variables. We suggested to divide the analysis in three levels (as in the nuclear sector, even

if physical phenomena are obviously completely different): the slow cascade, the fast cascade and

the restoration. We developed the methodology mainly for the level-I (the slow cascade) in order

to estimate frequencies of cascading failures leading to an electrical instability. In particular, we

developed an analog Monte Carlo simulation and biasing techniques to improve its efficiency. We

proposed to use clustering techniques as in the nuclear sector to group scenarios at the end of the

level-I to enter the level-II. We started also the development of this methodology for the level-II,

which can be based on DET techniques.

We applied this method on two test systems. We applied only the level-I on the larger test system

through Monte Carlo simulation and we studied several variants (vegetation height, changes in the

generation pattern), each time in comparison with a similar approach, but neglecting dependencies

between events. This example showed that our method can reveal dangerous scenarios neglected

or underestimated by independent methods because they do not take into account the increase of

failure rates in stress conditions. The importance of specific links in cascading failures can also be

misleadingly estimated by independent methods. In other words, we showed that thermal effects can

play an important role in cascading failure, during the first phase. We applied a two-level approach

on a smaller test system. It showed in particular that the level-II analysis after the level-I is necessary

to have an estimation of the loss of supplied power that a scenario can lead to: two level-I types of a

scenario with a similar frequency can induce very different risks (in terms of loss of supplied power)

and blackout frequencies. The level-III is however needed to have an estimation of the risk in terms

of loss of supplied energy and blackout duration. We applied also biasing techniques to the level-I

which led to improving the simulation efficiency by a factor 3.

The proposed approach should be viewed more as a general framework than as a close methodology.

In particular, it should be improved in order to consider operators’ corrective actions, all kinds of

electrical instabilities, the restoration, ... The problem of dynamic load modeling, as well as dynamic

simulation with a complete set of protections, seem to be specific for the level-II and should be studied

to compute the loss of supplied load in a realistic way. In order to scale up applications to real grids,

the efficiency of the simulation should be improved more and the set of parameters to estimate

should be reduced.

112

Appendix A

Failure rate of underground cables

A.1 Introduction

Components used in real systems endure time-variable solicitations. Loading and other stresses

(temperature, voltage, current...) may be varying in time. Moreover, their resistance may also be

varying in time. For example, material properties may be degrading. These time-variant conditions

impact the reliability of a component, which is in general defined as its ability to perform its required

functions under stated conditions for a specified period of time. The impact of different working

conditions is in general evaluated through tests (like accelerated tests), but with conditions kept

constant during each test. Failure rates can then be evaluated for a large range of conditions through

Arrhenius or Erying laws [90]. However, these failure rates may only be used in quasi steady-state

situations (slow variation of the conditions). In accidental situations, conditions can quickly change,

implying a significant change in the value of failure rates. For example, during the slow cascade

of a cascading failure leading to a blackout, dielectric insulation of underground cables can endure

a progressive temperature increase due to the abrupt increase of Joule losses. But the dielectric

strength of the insulator decreases as the temperature increases. The failure rate of these cables will

then significantly increase during such a cascading failure. In order to have a good estimation of

the frequency of cascading failures leading to a blackout, a good approximation of the failure rate

increase is necessary.

Reliability analysis approaches for time-variant reliability problems were developed to consider

the time dependency of stresses and strengths. In particular, the PHI2 method is based on the

outcrossing rate and allows solving these problems using classical time-invariant reliability tools

such as First Order Reliability Method (FORM) [91]. The PHI2 method gives an upper bound

and a lower bound on the cumulated distribution function (cdf) of the time of failure, based on the

computation of an outcrossing rate which is not directly linked to the failure rate. In the literature,

confusion persists between outcrossing rate and failure rate.

The first objective of this Appendix is the establishment of exact and approximate links between

outcrossing rate and failure rate. The second objective is the development of a hybrid method

based on the PHI2 model and accelerated tests in order to compute the failure rate of a component

submitted to time-variable stresses and strengths. The developed approach is applied to a power

underground cable with a variable temperature applied to the insulator. Consequently, the next

Section presents the state of the art on both the PHI2 method and the modeling usually adopted

for power cables’ failure. We discuss next the links between outcrossing rate and failure rate. Then,

the above mentioned hybrid methodology and the results are presented. Finally, some conclusions

are drawn.

113

APPENDIX A. FAILURE RATE OF UNDERGROUND CABLES

A.2 State of the art

A.2.1 PHI2 method

In time-variant reliability problems, we are interested in the evolution in time of random variables.

For instance, loading, other stress and resistance parameters can be viewed as random variables

which can evolve with time. We are then interested in random processes, or stochastic processes. If

ω designates the outcome (or the realization) of the random variable, with all possible outcomes of

the random variable being gathered on the sample space Ω, and t the time, a stochastic process Pis defined by a collection of random variables P = P (t, ω), t ∈ T where T designates the set of

times (discrete or continuous). In the sequel of this Appendix, we will only consider continuous sets

of times and we will denote a stochastic process simply by P (, ω). Consequently, for any instant

t0, P (t0, ω) ≡ Pt0(ω) is a random variable. Conversely, a realization (or trajectory) of the random

process is obtained by fixing the outcome to ω0 and is denoted using small letters by P (t, ω0) ≡ pω0(t).

The PHI2 method is based on the approach of the limit state: the failure of a component occurs

when a limit state surface is crossed. The simplest example is the stress/strength approach. If we

denote by S the stress and by R the strength, the limit state is defined by R − S = 0 and a failure

occurs as soon as S > R: the limit state surface is crossed. In time-variant reliability problems, both

stress and resistance should be considered as stochastic processes. So, we denote them respectively

as R(t, ω) and S(t, ω). The limit state function associated with this problem is then

G(t, R(t, ω), S(t, ω)) = R(t, ω)− S(t, ω) (A.1)

where positive values correspond to the safe domain and negative values to the failure domain. In

a general way, we can have several stresses and several strengths and a complex limit state function

combining these stochastic processes. Let us then denote by X(t, ω) the vector of stochastic processes

describing the randomness in the problem under consideration (both stresses and strengths) and by

G(t, X(t, ω) the limit state function.

The failure of the component within interval [0, t] is then represented by the event

E = ∃τ ∈ [0, t]|G(τ, X(τ, ω)) ≤ 0. (A.2)

The cumulative failure probability Pf,c(0, t) of the component within interval [0, t] is defined by

Pf,c(0, t) = Pr(E) = Pr[∃τ ∈ [0, t]|G(τ, X(τ, ω)) ≤ 0]. (A.3)

If we suppose that the component is initially in service, this failure probability can be viewed as the

cdf of the failure time. We can also define the instantaneous probability to be in the failure domain

at time t, Pf,i(t), as

Pf,i(t) = Pr[G(t, X(t, ω)) ≤ 0]. (A.4)

This probability is in general called simply instantaneous failure probability, but this name is ambigu-

ous: this quantity represents only the probability to be in the failure domain at a precise moment.

Since the failure of a component occurs at the first time the limit state is crossed, the physical

meaning of this probability is fuzzy. The outcrossing rate ν(t) is defined as the following limit:

ν(t) = lim∆t→0

Pr[G(t, X(t, ω)) > 0 ∩ G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0]∆t

. (A.5)

The quantity ν(t)∆t is then the probability to be in the safe domain at instant t and in the failure

domain at instant t+ ∆t (or the probability to cross the limit state surface from the safe domain to

114


the failure domain between t and t+ ∆t). From this outcrossing rate, we can obtain bounds for the

cumulative failure probability [92]:

maxτ∈[0,t]

Pf,i(τ) ≤ Pf,c(0, t) ≤ Pf,i(0) +

∫ t

0

ν(τ)dτ. (A.6)

The reliability index β(t) is defined as the algebraic distance of the design point (point of the failure

domain closest to the origin in the standard normal space) to the origin, counted as positive if the

origin is in the safe domain, or negative in the other case. The FORM approximation leads to the

following expression of the reliability index:

β(t) = −Φ−1(Pf,i(t)), (A.7)

where Φ(x) is the normal cdf.

The basis of the PHI2 method is to approximate the outcrossing rate using a FORM approximation

both for Pr[G(t, X(t, ω)) > 0] and Pr[G(t + δt, X(t + ∆t, ω)) ≤ 0]. This leads to the following

expression [92]:

ν(t) = lim∆t→0

Φ2(β(t),−β(t+ ∆t); ρ(t, t+ ∆t))

∆t(A.8)

where Φ2 is the binormal cdf and ρ(t, t + ∆t) is the correlation coefficient between the two events

G(t, X(t, ω)) > 0 and G(t + δt, X(t + ∆t, ω)) ≤ 0. This expression is developed in [91] for a

specific case:

• The limit state function is given by equation (A.1),

• The strength can be expressed as

R(ω, t) = R(ω) + f(t), (A.9)

where R(ω) is a normal random variable (mean value µR, standard deviation σR) and f(t) is

a deterministic function (deterministic change of the resistance),

• The stress S(t, ω) is a stationary normal random process (mean value µS , standard deviation

σS), with an autocorrelation coefficient function ρS(t) given by

ρS(t) = exp

[−(t

λ

)2], (A.10)

where λ is the correlation length (or correlation time).

The instantaneous failure probability is then given by

Pf,i(t) = Φ

(− µR + f(t)− µS√

σ2R + σ2

S

)= 1− Φ

(µR + f(t)− µS√

σ2R + σ2

S

). (A.11)

The outcrossing rate can then be computed analytically by

ν(t) = ω0Ψ

(f ′(t)

ω0σS

)σS√

σ2R + σ2

S

ϕ


σ2R + σ2

S

)(A.12)

where ϕ(x) is the normal probability distribution function, Ψ(x) = ϕ(x)− xΦ(x) and the cycle rate

ω0 is defined by

ω20 = −ρ′′S(0). (A.13)

Therefore, the cycle rate represents the variation speed of the stress. In particular, if the stress

autocorrelation coefficient function is given by the equation (A.10), the cycle rate is given by ω0 =√2/λ.

115


A.2.2 The Weibull law for power cables

The main failure mode for cables is dielectric breakdown. There are two dominant types of cables

used nowadays: oil-filled cables and extruded isolation cables (EPR, XLPE). For the oil-filled cables,

the literature reports no modification of dielectric strength with temperature, but only an accelerated

aging. Consequently, the failure rate in temporary overload conditions will not significantly change.

Contrarily, experimental studies show a reduction of the dielectric strength with temperature for

extruded isolation cables [59]. The two-dimensional Weibull distribution is generally used to model

the distribution of the lifetime of cables [60]. Therefore, the cdf of the failure time Tf of a cable

subject to a dielectric stress E can be written as

FTf (tf ) = Pr[Tf ≤ tf ] = 1− exp

[−(τ(tf )

t0

)a(E

E0

)b], (A.14)

where t0, a and b are constants depending on material and cable dimensions, and E0 is the stress

leading to a nominal breakdown probability. In other words, E0 can be viewed as the dielectric

strength. τ(t) is the effective age of the cable at the calendar time t (accelerated aging in overload

conditions). In nominal conditions, dτ/dt = 1. Parameter is usually high, between 8 and 12 [60].

The value of parameter is in general near 1, but increases during the cable’s life (going from a < 1

to a > 1). In reality, there is a superposition of several Weibull laws with a change in the value of

parameter a [60, 61]:

• The first law (a < 1) models the infant mortality (first part of the bathtub curve),

• The second law (a ≈ 1) models the useful life (second part of the bathtub curve),

• The third law (a > 2) models the end of life wear-out (last part of the bathtub curve).

The literature reports [59] a decrease of the dielectric strength with temperature, as shown in Figure

A.1.

Figure A.1: Dielectric strength as a function of temperature. From [59].

The failure rate is defined as

λ(tf ) = lim∆t→0

Pr[tf < Tf ≤ tf + ∆t|Tf ≥ tf ]

∆t. (A.15)

This failure rate is therefore linked to the cdf by

λ(t) =F ′(t)

1− F (t). (A.16)

116


If the temperature T of the cable is constant, the failure rate in stationary conditions at calendar

time t and temperature T in stationary conditions can then be written as

λ(t, T ) = λref [τ(t)]

(E0(Tref )

E0(T )

)b(A.17)

by using equations (A.14) and (A.16), where λref [τ(t)] is the failure rate at the reference temperature

Tref and age τ(t). We should note that a failure rate in non-stationary conditions cannot be deduced

from (A.14). Indeed, in non-stationary conditions, there is no guarantee that the equation (A.14) is

a monotonically increasing function of time, which obviously means that we cannot use this function

as a cdf when the electric strength varies with time.

A.3 Proposed modeling

A.3.1 Failure rate and outcrossing rate

The outcrossing rate and the failure rate introduced previously are two different quantities which

are not equal in a general case. However, in the literature, confusion persists between outcrossing

rate and failure rate. The aim of this section is therefore to discuss exact and approximate links

between outcrossing rate and failure rate.

The failure rate (A.15) can also be defined with the limit state function by

λ(t) = lim∆t→0

Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]∆t

(A.18)

From this expression, we can deduce an upper bound on the failure rate in function of the outcrossing

rate from the following bound:

Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]

=Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0 ∩ G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]

Pr[G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]

≤ Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0 ∩ G(t, X(t, ω)) > 0]Pr[G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]

,

(A.19)

because

G(t, X(t, ω) > 0 ⊆ G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]. (A.20)

Then,

λ(t) ≤ lim∆t→0

Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0 ∩ G(t, X(t, ω)) > 0]Pr[G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]∆t

=ν(t)

1− Pf,c(0, t). (A.21)

We cannot deduce exactly the failure rate from the outcrossing rate. However, we suggest here to

use as a first approximation

Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(τ, X(τ, ω)) > 0∀τ ∈ [0, t]]≈ Pr[G(t+ ∆t, X(t+ ∆t, ω)) ≤ 0|G(t, X(t, ω)) > 0],

(A.22)

which means that the probability to cross the limit state surface from the safe domain to the failure

domain between t and t + ∆t does not depend on all the past of the trajectory. In particular, it is

the case for reliable components, as in the critical working states method [93], which means that

Pf,c(0, t) << 1. (A.23)

117


This is a sufficient but not necessarily condition. From this approximation, we can write a relation

between the failure rate and the outcrossing rate:

λ(t) ≈ ν(t)

1− Pf,i(t)(A.24)

We should note that this approximation respects the inequality (A.21).

In particular, we can deduce an equality exact for a constant failure rate because, in this case,

λ(t) = λ(0) = lim∆t→0

Pr[G(∆t, X(∆t, ω)) ≤ 0|G(0, X(0, ω) > 0]∆t

(A.25)

and

Pr[G(∆t, X(∆t, ω)) ≤ 0|G(0, X(0, ω)) > 0] =Pr[G(∆t, X(∆t, ω)) ≤ 0 ∩ G(0, X(0, ω)) > 0]

Pr[G(0, X(0, ω)) > 0],

(A.26)

so

λ ≡ λ(0) =ν(0)

1− Pf,i(0). (A.27)

Furthermore, if we are in the case of stationary time-variant reliability problems, which are based

on the following assumptions:

• The random processes X(t, ω) are stationary processes,

• There is no direct time dependence in the limit state function, i.e. it can be formally written

as G(X(t, ω)),

we have ν(t) ≡ ν and Pf,i(t) ≡ Pf,i (constant values), but also

λ(t) = lim∆t→0

Pr[G(X(t+ ∆t, ω)) ≤ 0|G(X(τ, ω)) > 0∀τ ∈ [0, t]]∆t

= lim∆t→0

Pr[G(X(∆t, ω)) ≤ 0|G(X(τ, ω)) > 0∀τ ∈ [−t, 0]]∆t

= lim∆t→0

Pr[G(X(∆t, ω)) ≤ 0|G(X(0, ω)) > 0]∆t

= λ(0) ≡ λ

(A.28)

because we suppose that the component is initially in service. Consequently, if we have stationary

processes for both stress and strength, the outcrossing rate, the instantaneous probability to be in

the failure domain and the failure rate are constant and relation (A.24) is exact. In particular, if the

instantaneous probability to be in the failure domain is very small (Pf,i << 1), which is the case in

reliable systems, we can use the approximation λ ≈ ν.

For a case where the stresses and/or the strengths are not stationary processes, the quality of

the approximation (A.24) must be evaluated. This can be done through Monte Carlo simulations,

where a strategy to generate trajectories of the stochastic processes has to be selected. The usual

approach is based on the random process discretization, i.e. its representation by a finite set of

random variables, as explained in [92].

A.3.2 Methodology

Our hybrid methodology is based on the complementarities between the PHI2 model and the

accelerated tests in order to compute the failure rate of a component submitted to time-variable

stresses and strengths. Indeed, the PHI2 model is based on a set of parameters difficult to estimate,

but it can give the outcrossing rate (and an approximation of the failure rate) for any kind of transient

118


when these parameters are known. Conversely, accelerated tests give directly the failure rate at any

temperature in stationary conditions, but we cannot easily deduce from these tests the failure rate

in transient conditions. So, the general idea of our methodology is to “mix” both approaches in

order to compute the failure rate in transient conditions.

If we use the approximation (A.24) for the failure rate, the expression (A.12) for the outcrossing

rate and the expression (A.11) for the instantaneous probability to be in the failure domain, we get

λ(t) ≈ ω0Ψ

(f ′(t)

ω0σS

)σS√

σ2R + σ2

S

ϕ


σ2R + σ2

S

)1

Φ(µR+f(t)−µS√

σ2R+σ2

S

) . (A.29)

If we suppose that the mean of the strength µR varies with temperature T , we can rewrite this

equation as

λ(T (t)) ≈ ω0σS√

σ2R + σ2

S

ϕ

(µR(T (t))− µS√

σ2R + σ2

S

)1

Φ(µR(T (t))−µS√

σ2R+σ2

S

)Ψ

(1

ω0σS

dµRdT

(T (t))T ′(t)

). (A.30)

When temperature T is constant, the failure rate in stationary conditions is given by

λ(T () ≈ ω0σS√

σ2R + σ2

S

ϕ

(µR(T )− µS√σ2R + σ2

S

)1

Φ(µR(T )−µS√

σ2R+σ2

S

) 1√2π. (A.31)

We can note that we have to multiply the stationary failure rate by the (acceleration) factor

√2πΨ

(1

ω0σS

dµRdT

(T (t))T ′(t)

)(A.32)

in order to obtain the non-stationary failure rate. Function√

2πΨ(x) is represented in Figure A.2.

This factor is greater than 1 if x < 0, which is the case when T ′(t) > 0 (temperature increase)

because µ′R < 0, and lower than 1 in the opposite case. It simply means that a temperature increase

contributes to go from the safe domain to the failure domain, and a temperature decrease to go from

the failure domain to the safe domain.

Figure A.2: Acceleration factor.

In previous expressions, we have several unknowns: ω0, µR(T ) − µS , σR and σS . We propose

to determine these parameters by fitting the stationary failure rate computed on these parameters

(A.31) to the stationary failure rate given by (A.17), for several temperatures in the range of interest.

This fitting can be done through a least square estimation. Once parameters are determined, the

non-stationary failure rate can be computed by multiplying the stationary failure rate by the factor

(A.32).

119


A.3.3 Results

We apply the methodology for the range [20C,120C] with a computation of the failure rate made

degree by degree. We chose a reference failure rate of 0.1/year at 20C and a parameter b = 10.

The variation of the dielectric strength E0(T ) in equation (A.17) is given in Figure 5.4. The fitting

is very good (see Figure A.3): the mean error between the failure rates given by (A.17) and by 32

respectively, is 1.9E-7/year. Parameters obtained by the least square method are given in Table A.1

and Figure A.4. We can note that the dielectric strength E0(T ) given by tests could not be the same

as the strength µR(T ) used in the PHI2 model: in the first case the decrease with temperature is

linear (Figure 5.4) and in the second case the decrease is not linear (Figure A.4). As an example,

Figure A.3: Failure rate as a function of temperature in stationary conditions.

ω0 [/hour] σR [a.u.] σS [a.u.]

7.66E-2 0.681 0.466

Table A.1: Parameters of the PHI2 method.

Figure A.4: Failure rate as a function of temperature in stationary conditions.

we propose to compute the failure rates given by the stationary approximation and our estimation

(acceleration factor (A.32)) for a typical case in cascading failure in power system. After the loss of

an element, the current in power cables can have a prompt jump and the temperature will increase

with time. Consider a cable, with the following properties:

120


• The current before the perturbation is Ii and the stationary temperature corresponding to this

current is Ti,

• The temperature of the cable just before the perturbation is equal to Ti,

• The current after the perturbation is If and the stationary temperature corresponding to this

current is Tf

• The temperature transient is ruled by the law

T (t) = Tf − (Tf − Ti) exp(−t/θ) (A.33)

where θ is the thermal time constant.

Figure A.5: Stationary and non-stationary failure rates for the test case (increasing temperature).

Figure A.5 compares the stationary approximation and our estimation for an initial temperature

Ti = 60C, a final temperature Tf = 120C and a thermal time constant θ = 3 hours. We observe

that the stationary approximation strongly underestimates the failure rate during the beginning of

the transient. Indeed, the argument of the acceleration factor is proportional to

T ′(t) =Tf − Ti

θexp(−t/θ) (A.34)

which is the largest in the beginning of the transient. Figure A.6 compares also these failure rates,

but in the opposite case, where the initial temperature Ti = 120C, and final temperature Tf = 60C.

In this case, the stationary approximation overestimates the failure rates.

In order to estimate the quality of the stationary approximation for a specific case, we can observe

that the acceleration factor√

2πΨ(x) ≈ 1 for |x| << 1 and√

2πΨ(x) >> 1 for |x| >> 1. Therefore,

if 1ω0σS

µ′R(T (t))T ′(t) << 1 during the whole transient, the stationary approximation should not be

used. We can evaluate the maximum value of the argument of the acceleration factor by

1

ω0σS

∆µR∆T

∆T

∆t=

∆µRω0σSθ

. (A.35)

In other words, if

θ >>∆µRω0σS

, (A.36)

the stationary approximation is a good approximation, as shown in Figure A.7, which compares

the stationary approximation and our estimation for an initial temperature Ti = 60C, a final

temperature Tf = 120C and a thermal time constant θ = 100 hours with θ >> ∆µRω0σS

≈ 22.4 hours.

121


Figure A.6: Stationary and non-stationary failure rates for the test case (decreasing temperature).

Figure A.7: Stationary and non-stationary failure rates for a slow transient.

A.4 Conclusions

We proposed in this Appendix a hybrid methodology able to give an approximation of failure

rates for components enduring transient conditions. This methodology uses the PHI2 modeling and

data from accelerated tests conducted under stationary conditions. In a general case, an exact link

was established between the outcrossing rate obtained from the PHI2 method and the failure rate

obtained from accelerated tests. Consequently, our methodology is based on a hypothesis whose

validity should be checked by benchmarks (e.g. Monte Carlo simulations) for different test cases.

We showed that the difference between the failure rate in stationary conditions and in transient

conditions is proportional to an acceleration factor. The parameters appearing in this factor can

be found by fitting the failure rate found by accelerated tests to the failure rate found by the PHI2

method. We applied this methodology to a test case, which was a high voltage underground cable

enduring a temperature transient. We showed that the fitting gave good results and a significant

difference between the stationary approximation and our estimation can appear. We proposed a

simple criterion in order to know if the stationary approximation is acceptable or not.

122

Appendix B

Test systems

B.1 Level-I test system

B.1.1 Introduction

To apply blackout PRA level-I to a test system, this one should include following data: classical data

for the resolution of load-flow equations (bus types, active and reactive power generation and load

at each bus, resistance, reactance, line charging, tap ratio for each line), simplified dynamic machine

data (according to models used for electrical stability assessment), thermal and mechanical data of

overhead power lines (length, section, suspension height, distance between pylons, thermal capacity

and weight per unit length, modulus of elasticity, coefficient of thermal expansion), thermal data of

transformers, thermal data of cables, reliability data, ... To have a test system near real electrical

grids, the basis states of the system should be also N − 1 secure. A standard test system with all

these characteristics doesn’t yet exist, but we can adapt a existing one to include consistent data1

The original test system is 68-buses and 87-links modeling the transport network of the North East

of US (see for example [94] for original data), developed in the 70’s by Dick Schulz (General Electric).

It is composed by two developed areas modeling New England (NETS) and New York (NYPS) and

three neighboring areas (Ontario, Michigan, Pennsylvania) are approximated by equivalent generator

models. This Appendix explains the main modifications applied to this network and presents final

data.

Figure B.1: 68-buses, 16-machine, 5-area test system.

1For example, overhead lines’ geometric data (length, section) have to be consistent with electrical data (resistance,

reactance, line charging).

123

APPENDIX B. TEST SYSTEMS

B.1.2 Voltage and power basis

The power base is 100 MVA. The test network is based on a real network whose the voltage is

mainly 345 kV, so the majority of buses are at 345 kV. However, some buses are at 500 kV.

B.1.3 Lines, cables and transformers

Overhead lines’ data are taken from [95]. For 345 kV lines, the reference is the line Watertown-

Sioux City (Western Area Power Administration). The pylons are the 3L2 type, as shown in Figure

B.2 and the conductors are ACSR 45/7 type, 2 per phase. For 500 kV lines, the reference is the line

Ashe-Hanford (Bonneville Power Administration). The pylons are the 5L2 type, as shown in Figure

B.2 and the conductors are ACSR 84/19 type, 2 per phase.

Figure B.2: 3L2 and 5L2 structures. From [95].

The voltage of cables is only 345 kV. We choose XLPE cables 400/230 kV of Brugg Cables with

a copper conductor cross-section of 630 mm2, in flat formation.

Electrical parameters of transformers are not modified, but thermal parameters are taken from

IEEE/ANSI C57.115-1991, appendix C.

B.1.4 Modifications

Total resistance of lines and cables are kept, and impedance and line charging are modified ac-

cording to characteristics of chosen elements. A bus 69 is inserted between buses 50 and 18 to have

a separation between the 345 kV network and the 500 kV network. To have a N − 1 secure network

and to respect operational constraints (current limits on links), some links are doubled, FACTS

controllers are included to produce reactive power and the voltage of specific generators is reduced.

The adapted network is shown on figure B.3.

B.1.5 Data

B.1.5.1 Power plants data

Power plants data are given in Table B.1. Since the transient stability was not assessed for this

test system, corresponding data are not given. Generation data are given for the peak load.

B.1.5.2 Bus data

Main bus data are given in Table B.2. Generation data and power flow data are given for the

peak load. The type is equal to 1 for the swing bus, to 2 for PV buses and to 3 for PQ buses. The

124


Figure B.3: Blackout test system.

# Bus Power Maximum Damping coefficient Regulation factor Failure rate Inertia

(pu) power (pu) D (pu) 1/R (pu) (/year) constant (s)

1 1 2.5 4 10 20 2 30

2 2 2.725 3 10 20 2 30

3 2 2.725 3 10 20 2 30

4 3 3.25 4 10 20 2 30

5 3 3.25 4 10 20 2 30

6 4 3.16 4 10 20 2 30

7 4 3.16 4 10 20 2 30

8 5 2.525 3 10 20 2 30

9 5 2.525 3 10 20 2 30

10 6 3.5 4 10 20 2 30

11 6 3.5 4 10 20 2 30

12 7 2.8 3 10 20 2 30

13 7 2.8 3 10 20 2 30

14 8 2.7 3 10 20 2 30

15 8 2.7 3 10 20 2 30

16 9 4 5 10 20 2 30

17 9 4 5 10 20 2 30

18 10 2.5 3 10 20 2 30

19 10 2.5 3 10 20 2 30

20 11 4 5 10 20 2 30

21 11 4 5 10 20 2 30

22 12 2.5 3 10 20 2 30

23 12 2.5 3 10 20 2 30

24 13 7.86 9 10 20 2 30

25 13 7.86 9 10 20 2 30

26 14 15 18 10 20 0 30

27 15 10 12 10 20 0 30

28 16 25 30 10 20 0 30

Table B.1: Power plants data.

conductance and the susceptance shunt are equal to zero for all buses. The minimum bus voltage is

0.9 pu and the maximum bus voltage 1.1 pu.

125


# Type V (pu) θ () Pg (pu) Qg (pu) Pl (pu) Ql (pu) Qming (pu) Qmaxg (pu) Vrated (kV)

1 2 1.0455 -6.853 2.500 1.475 0.000 0.000 -10.00 16.00 13.8

2 2 0.9800 -5.711 5.450 2.575 0.000 0.000 -10.00 16.00 13.8

3 2 0.9830 -3.333 6.500 1.862 0.000 0.000 -10.00 16.00 13.8

4 2 0.9970 1.586 6.320 0.713 0.000 0.000 -10.00 16.00 13.8

5 2 1.0110 -3.009 5.050 1.585 0.000 0.000 -10.00 16.00 13.8

6 2 1.0500 -1.337 7.000 1.981 0.000 0.000 -10.00 16.00 13.8

7 2 1.0630 -1.902 5.600 0.987 0.000 0.000 -10.00 16.00 13.8

8 2 1.0300 -0.701 5.400 -0.068 0.000 0.000 -10.00 16.00 13.8

9 2 1.0250 2.792 8.000 0.093 0.000 0.000 -10.00 16.00 13.8

10 2 1.0000 -6.385 5.000 -1.847 0.000 0.000 -10.00 16.00 13.8

11 2 1.0000 -3.799 8.000 -1.778 0.000 0.000 -10.00 16.00 13.8

12 2 1.0000 -4.775 5.000 -0.407 0.000 0.000 -10.00 16.00 13.8

13 1 1.0000 0.000 15.700 0.905 0.000 0.000 -10.00 16.00 13.8

14 2 1.0000 -5.734 15.000 1.400 0.000 0.000 -10.00 16.00 13.8

15 2 1.0000 -14.093 10.000 2.597 0.000 0.000 -10.00 16.00 13.8

16 2 1.0000 -14.998 25.000 2.489 0.000 0.000 -10.00 16.00 13.8

17 3 0.9986 -6.767 0.000 0.000 11.500 2.500 0.00 0.00 345

18 3 0.9954 -19.320 0.000 0.000 24.700 1.230 0.00 0.00 345

19 3 1.0555 -3.620 0.000 0.000 0.000 0.000 0.00 0.00 345

20 3 0.9994 -5.148 0.000 0.000 6.800 1.030 0.00 0.00 345

21 3 1.0487 -5.535 0.000 0.000 2.740 1.150 0.00 0.00 345

22 3 1.0571 -4.092 0.000 0.000 0.000 0.000 0.00 0.00 345

23 3 1.0562 -4.041 0.000 0.000 2.480 0.850 0.00 0.00 345

24 3 1.0459 -7.397 0.000 0.000 3.090 -0.920 0.00 0.00 345

25 3 1.0513 -2.888 0.000 0.000 2.240 0.470 0.00 0.00 345

26 3 1.0442 -5.884 0.000 0.000 1.390 0.170 0.00 0.00 345

27 3 1.0351 -8.422 0.000 0.000 2.810 0.760 0.00 0.00 345

28 3 1.0433 -2.956 0.000 0.000 2.060 0.280 0.00 0.00 345

29 3 1.0457 -0.481 0.000 0.000 2.840 0.270 0.00 0.00 345

30 3 1.0219 -9.021 0.000 0.000 0.000 0.000 0.00 0.00 345

31 3 1.0141 -8.515 0.000 0.000 0.000 0.000 0.00 0.00 345

32 3 1.0143 -7.200 0.000 0.000 0.000 0.000 0.00 0.00 345

33 3 1.0183 -8.714 0.000 0.000 1.120 0.000 0.00 0.00 345

34 3 1.0300 -11.638 0.000 0.000 0.000 0.000 0.00 0.00 345

35 2 1.0100 -16.576 0.000 2.505 0.000 0.000 -3.00 6.00 500

36 3 1.0033 -6.920 0.000 0.000 1.020 -0.195 0.00 0.00 345

37 3 1.0393 -8.285 0.000 0.000 0.000 0.000 0.00 0.00 345

38 3 1.0137 -10.311 0.000 0.000 0.000 0.000 0.00 0.00 345

39 3 1.0128 -24.842 0.000 0.000 2.670 0.126 0.00 0.00 345

40 3 1.0392 -12.510 0.000 0.000 0.656 0.235 0.00 0.00 345

41 3 0.9982 -7.026 0.000 0.000 10.000 2.500 0.00 0.00 345

42 3 0.9962 -14.956 0.000 0.000 11.500 2.500 0.00 0.00 345

43 3 0.9932 -9.398 0.000 0.000 0.000 0.000 0.00 0.00 345

44 3 1.0137 -24.086 0.000 0.000 2.676 0.048 0.00 0.00 500

45 3 1.0155 -23.566 0.000 0.000 2.080 0.210 0.00 0.00 500

46 3 1.0048 -14.873 0.000 0.000 1.507 0.285 0.00 0.00 345

47 3 1.0373 -12.448 0.000 0.000 2.031 0.326 0.00 0.00 345

48 2 1.0500 -13.524 0.000 1.438 2.412 0.022 -3.00 6.00 345

49 3 1.0043 -17.101 0.000 0.000 1.640 0.290 0.00 0.00 345

50 2 1.0139 -24.227 0.000 0.298 1.000 1.470 -3.00 6.00 500

51 3 1.0134 -25.068 0.000 0.000 3.370 1.220 0.00 0.00 500

52 3 1.0372 -9.139 0.000 0.000 1.580 0.300 0.00 0.00 345

53 3 1.0266 -9.875 0.000 0.000 2.527 1.186 0.00 0.00 345

54 3 1.0555 -7.838 0.000 0.000 0.000 0.000 0.00 0.00 345

55 3 1.0378 -9.568 0.000 0.000 3.220 0.020 0.00 0.00 345

56 3 1.0225 -9.590 0.000 0.000 5.000 1.840 0.00 0.00 345

57 3 1.0247 -8.686 0.000 0.000 0.000 0.000 0.00 0.00 345

58 3 1.0279 -8.184 0.000 0.000 0.000 0.000 0.00 0.00 345

59 3 1.0167 -9.452 0.000 0.000 2.340 0.840 0.00 0.00 345

60 3 1.0135 -9.806 0.000 0.000 5.220 1.770 0.00 0.00 345

61 3 1.0102 -8.604 0.000 0.000 1.040 1.250 0.00 0.00 345

62 3 1.0372 -6.254 0.000 0.000 0.000 0.000 0.00 0.00 345

63 3 1.0328 -6.950 0.000 0.000 0.000 0.000 0.00 0.00 345

64 3 1.0266 -6.952 0.000 0.000 0.090 0.880 0.00 0.00 345

65 3 1.0333 -6.914 0.000 0.000 0.000 0.000 0.00 0.00 345

66 3 1.0282 -8.398 0.000 0.000 0.000 0.000 0.00 0.00 345

67 3 1.0278 -8.688 0.000 0.000 3.200 1.530 0.00 0.00 345

68 3 1.0425 -7.356 0.000 0.000 3.290 0.320 0.00 0.00 345

69 3 0.9959 -21.335 0.000 0.000 1.000 1.470 0.00 0.00 500

Table B.2: Bus Data.

126


B.1.5.3 Load data

The basic annual peak load for the test system is 13484 MW. The load is modulated along the

day and the hour according to load factors given in the IEEE-RTS [71], and reproduced here. Table

B.3 gives data on weekly peak loads in percentage of the annual peak load, with the week 1 taken

as the first week of January (winter peaking system). Table B.4 gives a daily peak load cycle, in

percentage of the weekly peak. Table B.5 gives weekday and weekend hourly load models for each

of four seasons. The seasons used here are not completely the same as the meteorological seasons,

since the winter goes from week 1 to week 8 and to week 44 to week 52, the spring goes from week

9 to 17, the summer from week 18 to 30 and the fall from week 31 to 43.

Week Peak load Week Peak load Week Peak load Week Peak load

1 86.2 14 75.0 27 75.5 40 72.4

2 90.0 15 72.1 28 81.6 41 74.3

3 87.8 16 80.0 29 80.1 42 74.4

4 83.4 17 75.4 30 88.0 43 80.0

5 88.0 18 83.7 31 72.2 44 88.1

6 84.1 19 87.0 32 77.6 45 88.5

7 83.2 20 88.0 33 80.0 46 90.9

8 80.6 21 85.6 34 72.9 47 94.0

9 74.0 22 81.1 35 72.6 48 89.0

10 73.7 23 90.0 36 70.5 49 94.2

11 71.5 24 88.7 37 78.0 50 97.0

12 72.7 25 89.6 38 69.5 51 100.0

13 70.4 26 86.1 39 72.4 52 95.2

Table B.3: Weekly peak load in percentage of annual peak.

Day Peak load

Monday 93

Tuesday 100

Wednesday 98

Thursday 96

Friday 94

Saturday 77

Sunday 75

Table B.4: Daily peak load in percentage of weakly peak.

B.1.5.4 Links data

General links’ data are given in Tables B.6 and B.7. The type is equal to 1 for overhead lines, to 2

for underground cables and to 3 for transformers. It is equal to 0 when thermal failures are ignored.

The minimum tap ratio for transformers is equal to 0.8 and its maximum to 1.2. The size of each

tap is set at 0.01. The nominal currents of 345 kV and 500 kV overhead lines are equal to 6.215 pu

(1040 A) and 18.273 pu (2110 A), respectively. The nominal current of 345 kV underground cables is

equal to 5.378 pu (900 A). Thermal data for overhead lines are given in Table B.8. Mechanical data

for overhead lines are given in Table B.9. The span length is the distance between two towers. The

“vegetation height” (including the dielectric breakdown distance) for the base case (probability of

having a short circuit with the ground in all normal situations (no contingency) is 10−5) is 11.94 m.

Thermal data for overground cables are given in Table B.10. Thermal data for power transformers

are given in Table B.11.

B.1.6 Wind farms and wind speeds

Two wind farms of 150 MW (buses 34 and 43) and seven wind farms of 200 MW (buses 28,

48, 59, 49, 24, 20, 64) are implemented. In order to consider correlations between wind speeds at

these wind farms, they can be sampled through the joint normal transform algorithm described in

127


Hour Winter Winter Summer Summer Spring/fall Spring/fall

weekday weekend weekday weekend weekday weekend

0 67 78 64 74 63 75

1 63 72 60 70 62 73

2 60 68 58 66 60 69

3 59 66 56 65 58 66

4 59 64 56 64 59 65

5 60 65 58 62 65 65

6 74 66 64 62 72 68

7 86 70 76 66 85 74

8 95 80 87 81 95 83

9 96 88 95 86 99 89

10 96 90 99 91 100 92

11 95 91 100 93 99 94

12 95 90 99 93 93 91

13 95 88 100 92 92 90

14 93 87 100 91 90 90

15 94 87 97 91 88 86

16 99 91 96 92 90 85

17 100 100 96 94 92 88

18 100 99 93 95 96 92

19 96 97 92 95 98 100

20 91 94 92 100 96 97

21 83 92 93 93 90 95

22 73 87 87 88 80 90

23 63 81 72 80 70 85

Table B.5: Hourly peak load in percentage of daily peak.

Section 6.2. Wind speeds are modeled by Weibull laws. The parameters β (shape parameter) and

η (scale parameter) for these nine wind farms at a 10-meter height are available on the website

http://homepages.ulb.ac.be/~phenneau for each hour and each season. For wind power plants,

the wind speed is extrapolated at a height of 78 meters through the logarithmic wind profile and

an aerodynamic roughness length of the surface equal to 0.03 meter. The lower triangular matrix T

a such that R = T × T t (Cholesky decomposition) where R is the rank correlation matrix between

wind farms, is also available on this website. These probability distributions are computed from

statistical data given by KNMI (Koninklijk Nederlands Meteorologisch Instituut - http://www.knmi.

nl/klimatologie/onderzoeksgegevens/potentiele_wind/). The stations 380, 323, 210, 277, 278,

225, 286, 283 et 391 (see Figure B.4) are associated respectively to buses 20, 24, 28, 34, 43, 48, 49,

59 et 64.

B.1.7 Ambient temperature

The ambient temperature is modeled by a gaussian law, with a mean and a standard deviation

depending on the hour and the season, given in Tables B.12 and B.13, respectively. These parameters

were computed from statistical data given by KNMI.

B.2 Two-level test system

B.2.1 General data

The test system used is shown in Figure B.5. It is an adaptation of the Kundur’s Two-Area System

[14]. There are 8 power plants with a maximal power of 400 MW for each of them. The peak load

connected is 971 MW (and 100 MVAr) into bus 11 and 1787 MW (and 200 MVAr) into bus 13. At

peak load, the generated power is 350 MW in each power plant. The load is modulated along the

day and the hour, according to load factors given in the IEEE-RTS [71] and for the previous test

system. The same load factor is applied to each load and each power plant. General data for power

plants are given in Table B.14. The generated power given is for the peak load. Main bus data are

given in Table B.15. Generation data and power flow data are given for the peak load. The type

128

http://homepages.ulb.ac.be/~phenneau

http://www.knmi.nl/klimatologie/onderzoeksgegevens/potentiele_wind/



Number Type From To Resistance Reactance Line charging Tap Tap Failure rate

bus bus (pu) (pu) (pu) ratio phase (/year)

1 0 54 1 0.0001 0.0075 0.0000 1.02 0 0

2 0 58 2 0.0001 0.0075 0.0000 1.07 0 0

3 0 62 3 0.0001 0.0075 0.0000 1.07 0 0

4 0 19 4 0.0007 0.0142 0.0000 1.07 0 0

5 0 20 5 0.0001 0.0075 0.0000 1.00 0 0

6 0 22 6 0.0001 0.0075 0.0000 1.02 0 0

7 0 23 7 0.0001 0.0075 0.0000 1.00 0 0

8 0 25 8 0.0001 0.0075 0.0000 1.02 0 0

9 0 29 9 0.0001 0.0075 0.0000 1.02 0 0

10 0 31 10 0.0001 0.0075 0.0000 1.00 0 0

11 0 32 11 0.0001 0.0075 0.0000 1.00 0 0

12 0 36 12 0.0001 0.0075 0.0000 1.00 0 0

13 0 17 13 0.0001 0.0075 0.0000 1.00 0 0

14 0 41 14 0.0000 0.0015 0.0000 1.00 0 0

15 0 42 15 0.0000 0.0015 0.0000 1.00 0 0

16 0 18 16 0.0000 0.0030 0.0000 1.00 0 0

17 2 36 17 0.0005 0.0035 0.9250 1.00 0 1

18 1 49 18 0.0076 0.0760 0.9500 1.00 0 1

19 1 68 19 0.0016 0.0160 0.2000 1.00 0 1

20 3 19 20 0.0007 0.0150 0.0000 1.06 0 1

21 1 68 21 0.0008 0.0080 0.1000 1.00 0 1

22 1 21 22 0.0008 0.0080 0.1000 1.00 0 1

23 1 22 23 0.0006 0.0060 0.0750 1.00 0 1

24 1 23 24 0.0022 0.0220 0.2750 1.00 0 1

25 1 68 24 0.0003 0.0030 0.0375 1.00 0 1

26 1 54 25 0.0070 0.0700 0.8750 1.00 0 1

27 1 25 26 0.0032 0.0320 0.4000 1.00 0 1

28 1 37 27 0.0013 0.0130 0.1625 1.00 0 1

29 1 26 27 0.0014 0.0140 0.1750 1.00 0 1

30 1 26 28 0.0043 0.0430 0.5375 1.00 0 1

31 1 26 29 0.0057 0.0570 0.7125 1.00 0 1

32 1 28 29 0.0014 0.0140 0.1750 1.00 0 1

33 2 53 30 0.0008 0.0056 1.4800 1.00 0 1

34 1 61 30 0.0019 0.0190 0.2375 1.00 0 1

35 1 61 30 0.0019 0.0190 0.2375 1.00 0 1

36 1 30 31 0.0013 0.0130 0.1625 1.00 0 1

37 1 53 31 0.0016 0.0160 0.2000 1.00 0 1

38 1 30 32 0.0024 0.0240 0.3000 1.00 0 1

39 1 32 33 0.0008 0.0080 0.1000 1.00 0 1

40 1 33 34 0.0011 0.0110 0.1375 1.00 0 1

41 3 35 34 0.0005 0.0130 0.0000 0.95 0 1

42 1 34 36 0.0033 0.0330 0.4125 1.00 0 1

43 1 61 36 0.0022 0.0220 0.2750 1.00 0 1

44 1 61 36 0.0022 0.0220 0.2750 1.00 0 1

45 1 68 37 0.0007 0.0070 0.0875 1.00 0 1

46 1 31 38 0.0011 0.0110 0.1375 1.00 0 1

47 1 33 38 0.0036 0.0360 0.4500 1.00 0 1

48 1 41 40 0.0060 0.0600 0.7500 1.00 0 1

49 1 48 40 0.0020 0.0200 0.2500 1.00 0 1

50 1 42 41 0.0040 0.0400 0.5000 1.00 0 1

51 1 18 42 0.0040 0.0400 0.5000 1.00 0 1

52 3 17 43 0.0007 0.0150 0.0000 1.00 0 1

53 3 39 44 0.0007 0.0150 0.0000 1.00 0 1

54 3 43 44 0.0001 0.0839 0.0000 1.00 0 1

55 1 35 45 0.0007 0.0175 1.2250 1.00 0 1

56 3 39 45 0.0005 0.0130 0.0000 1.00 0 1

57 1 44 45 0.0007 0.0175 1.2250 1.00 0 1

58 1 38 46 0.0022 0.0220 0.2750 1.00 0 1

59 1 53 47 0.0013 0.0130 0.1625 1.00 0 1

60 1 47 48 0.0025 0.0250 0.3125 1.00 0 1

61 1 47 48 0.0025 0.0250 0.3125 1.00 0 1

62 1 46 49 0.0018 0.0180 0.2250 1.00 0 1

63 1 45 51 0.0004 0.0100 0.7000 1.00 0 1

64 1 50 51 0.0009 0.0225 1.5750 1.00 0 1

65 1 37 52 0.0007 0.0070 0.0875 1.00 0 1

66 1 55 52 0.0011 0.0110 0.1375 1.00 0 1

67 1 53 54 0.0035 0.0350 0.4375 1.00 0 1

68 1 54 55 0.0013 0.0130 0.1625 1.00 0 1

Table B.6: Links Data.

129




69 1 55 56 0.0013 0.0130 0.1625 1.00 0 1

70 1 56 57 0.0008 0.0080 0.1000 1.00 0 1

71 1 57 58 0.0002 0.0020 0.0250 1.00 0 1

72 1 58 59 0.0006 0.0060 0.0750 1.00 0 1

73 1 57 60 0.0008 0.0080 0.1000 1.00 0 1

74 1 59 60 0.0004 0.0040 0.0500 1.00 0 1

75 1 60 61 0.0023 0.0230 0.2875 1.00 0 1

76 1 58 63 0.0007 0.0070 0.0875 1.00 0 1

77 1 62 63 0.0004 0.0040 0.0500 1.00 0 1

78 3 64 63 0.0007 0.0150 0.0000 1.00 0 1

79 1 62 65 0.0004 0.0040 0.0500 1.00 0 1

80 3 64 65 0.0007 0.0150 0.0000 1.00 0 1

81 1 56 66 0.0008 0.0080 0.1000 1.00 0 1

82 1 65 66 0.0009 0.0090 0.1125 1.00 0 1

83 1 66 67 0.0018 0.0180 0.2250 1.00 0 1

84 1 67 68 0.0009 0.0090 0.1125 1.00 0 1

85 1 53 27 0.0032 0.0320 0.4000 1.00 0 1

86 3 69 18 0.0005 0.0130 0.0000 1.00 0 1

87 1 50 69 0.0012 0.0300 2.1000 1.00 0 1

88 2 36 17 0.0005 0.0035 0.9250 1.00 0 1

89 1 32 33 0.0008 0.0080 0.1000 1.00 0 1

90 1 21 22 0.0008 0.0080 0.1000 1.00 0 1

91 1 68 19 0.0016 0.0160 0.2000 1.00 0 1

Table B.7: Links Data (continued).

Figure B.4: Map of KNMI stations.

is equal to 1 for the swing bus, to 2 for PV buses and to 3 for PQ buses. The conductance and

the susceptance shunt are equal to zero for all buses. The minimum bus voltage is 0.9 pu and the

maximum bus voltage 1.1 pu. General links’ data are given in Table B.16. The type is equal to 1 for

overhead lines, to 2 for underground cables and to 3 for transformers. It is equal to 0 when thermal

failures are ignored. The minimum tap ratio for transformers is equal to 0.8 and its maximum to

1.2. The size of each tap is set at 0.05. The nominal currents of 230 kV overhead lines is equal to

4.94 pu.

130


# Number of Total heat capacity φ Length Emissivity Orientation Elevation above

conductors/phase mCp (J/(m.K)) (mm) (km) ε () sea level He

18 2 1513 30.42 302.39 0.5 53 0

19 2 1513 30.42 63.66 0.5 33 0

21 2 1513 30.42 31.83 0.5 46 0

22 2 1513 30.42 31.83 0.5 56 0

23 2 1513 30.42 23.87 0.5 68 0

24 2 1513 30.42 87.53 0.5 62 0

25 2 1513 30.42 11.94 0.5 84 0

26 2 1513 30.42 278.51 0.5 1 0

27 2 1513 30.42 127.32 0.5 1 0

28 2 1513 30.42 51.72 0.5 83 0

29 2 1513 30.42 55.70 0.5 48 0

30 2 1513 30.42 171.09 0.5 31 0

31 2 1513 30.42 226.79 0.5 2 0

32 2 1513 30.42 55.70 0.5 40 0

34 2 1513 30.42 75.60 0.5 85 0

35 2 1513 30.42 75.60 0.5 85 0

36 2 1513 30.42 51.72 0.5 5 0

37 2 1513 30.42 63.66 0.5 21 0

38 2 1513 30.42 95.49 0.5 76 0

39 2 1513 30.42 31.83 0.5 89 0

40 2 1513 30.42 43.77 0.5 82 0

42 2 1513 30.42 131.30 0.5 31 0

43 2 1513 30.42 87.53 0.5 87 0

44 2 1513 30.42 87.53 0.5 87 0

45 2 1513 30.42 27.85 0.5 34 0

46 2 1513 30.42 43.77 0.5 89 0

47 2 1513 30.42 143.24 0.5 15 0

48 2 1513 30.42 238.73 0.5 3 0

49 2 1513 30.42 79.58 0.5 3 0

50 2 1513 30.42 159.15 0.5 83 0

51 2 1513 30.42 159.15 0.5 81 0

55 3 2551 40.70 128.02 0.5 46 0

57 3 2551 40.70 128.02 0.5 32 0

58 2 1513 30.42 87.53 0.5 1 0

59 2 1513 30.42 51.72 0.5 36 0

60 2 1513 30.42 99.47 0.5 39 0

61 2 1513 30.42 99.47 0.5 39 0

62 2 1513 30.42 71.62 0.5 81 0

63 3 2551 40.70 73.15 0.5 1 0

64 3 2551 40.70 164.59 0.5 88 0

65 2 1513 30.42 27.85 0.5 38 0

66 2 1513 30.42 43.77 0.5 46 0

67 2 1513 30.42 139.26 0.5 9 0

68 2 1513 30.42 51.72 0.5 88 0

69 2 1513 30.42 51.72 0.5 74 0

70 2 1513 30.42 31.83 0.5 90 0

71 2 1513 30.42 7.96 0.5 89 0

72 2 1513 30.42 23.87 0.5 37 0

73 2 1513 30.42 31.83 0.5 40 0

74 2 1513 30.42 15.92 0.5 73 0

75 2 1513 30.42 91.51 0.5 51 0

76 2 1513 30.42 27.85 0.5 23 0

77 2 1513 30.42 15.92 0.5 46 0

79 2 1513 30.42 15.92 0.5 89 0

81 2 1513 30.42 31.83 0.5 15 0

82 2 1513 30.42 35.81 0.5 81 0

83 2 1513 30.42 71.62 0.5 84 0

84 2 1513 30.42 35.81 0.5 20 0

85 2 1513 30.42 127.32 0.5 19 0

87 3 2551 40.70 219.46 0.5 25 0

89 2 1513 30.42 31.83 0.5 89 0

90 2 1513 30.42 31.83 0.5 56 0

91 2 1513 30.42 63.66 0.5 33 0

Table B.8: Thermal data of overhead lines.

131


# Reference temperature Tensile stress Apparent EA Dilatation coef. Span length Suspension

Tref (C) @Tref (kN) weight (N/m) (kN) α (K−1) (m) height (m)

18 -17.78 53.4 17.95 46543 1.93E-05 350 20

19 -17.78 53.4 17.95 46543 1.93E-05 350 20

21 -17.78 53.4 17.95 46543 1.93E-05 350 20

22 -17.78 53.4 17.95 46543 1.93E-05 350 20

23 -17.78 53.4 17.95 46543 1.93E-05 350 20

24 -17.78 53.4 17.95 46543 1.93E-05 350 20

25 -17.78 53.4 17.95 46543 1.93E-05 350 20

26 -17.78 53.4 17.95 46543 1.93E-05 350 20

27 -17.78 53.4 17.95 46543 1.93E-05 350 20

28 -17.78 53.4 17.95 46543 1.93E-05 350 20

29 -17.78 53.4 17.95 46543 1.93E-05 350 20

30 -17.78 53.4 17.95 46543 1.93E-05 350 20

31 -17.78 53.4 17.95 46543 1.93E-05 350 20

32 -17.78 53.4 17.95 46543 1.93E-05 350 20

34 -17.78 53.4 17.95 46543 1.93E-05 350 20

35 -17.78 53.4 17.95 46543 1.93E-05 350 20

36 -17.78 53.4 17.95 46543 1.93E-05 350 20

37 -17.78 53.4 17.95 46543 1.93E-05 350 20

38 -17.78 53.4 17.95 46543 1.93E-05 350 20

39 -17.78 53.4 17.95 46543 1.93E-05 350 20

40 -17.78 53.4 17.95 46543 1.93E-05 350 20

42 -17.78 53.4 17.95 46543 1.93E-05 350 20

43 -17.78 53.4 17.95 46543 1.93E-05 350 20

44 -17.78 53.4 17.95 46543 1.93E-05 350 20

45 -17.78 53.4 17.95 46543 1.93E-05 350 20

46 -17.78 53.4 17.95 46543 1.93E-05 350 20

47 -17.78 53.4 17.95 46543 1.93E-05 350 20

48 -17.78 53.4 17.95 46543 1.93E-05 350 20

49 -17.78 53.4 17.95 46543 1.93E-05 350 20

50 -17.78 53.4 17.95 46543 1.93E-05 350 20

51 -17.78 53.4 17.95 46543 1.93E-05 350 20

55 -17.78 84.55 30.31 77704 2.03E-05 350 22.7

57 -17.78 84.55 30.31 77704 2.03E-05 350 22.7

58 -17.78 53.4 17.95 46543 1.93E-05 350 20

59 -17.78 53.4 17.95 46543 1.93E-05 350 20

60 -17.78 53.4 17.95 46543 1.93E-05 350 20

61 -17.78 53.4 17.95 46543 1.93E-05 350 20

62 -17.78 53.4 17.95 46543 1.93E-05 350 20

63 -17.78 84.55 30.31 77704 2.03E-05 350 22.7

64 -17.78 84.55 30.31 77704 2.03E-05 350 22.7

65 -17.78 53.4 17.95 46543 1.93E-05 350 20

66 -17.78 53.4 17.95 46543 1.93E-05 350 20

67 -17.78 53.4 17.95 46543 1.93E-05 350 20

68 -17.78 53.4 17.95 46543 1.93E-05 350 20

69 -17.78 53.4 17.95 46543 1.93E-05 350 20

70 -17.78 53.4 17.95 46543 1.93E-05 350 20

71 -17.78 53.4 17.95 46543 1.93E-05 350 20

72 -17.78 53.4 17.95 46543 1.93E-05 350 20

73 -17.78 53.4 17.95 46543 1.93E-05 350 20

74 -17.78 53.4 17.95 46543 1.93E-05 350 20

75 -17.78 53.4 17.95 46543 1.93E-05 350 20

76 -17.78 53.4 17.95 46543 1.93E-05 350 20

77 -17.78 53.4 17.95 46543 1.93E-05 350 20

79 -17.78 53.4 17.95 46543 1.93E-05 350 20

81 -17.78 53.4 17.95 46543 1.93E-05 350 20

82 -17.78 53.4 17.95 46543 1.93E-05 350 20

83 -17.78 53.4 17.95 46543 1.93E-05 350 20

84 -17.78 53.4 17.95 46543 1.93E-05 350 20

85 -17.78 53.4 17.95 46543 1.93E-05 350 20

87 -17.78 84.55 30.31 77704 2.03E-05 350 22.7

89 -17.78 53.4 17.95 46543 1.93E-05 350 20

90 -17.78 53.4 17.95 46543 1.93E-05 350 20

91 -17.78 53.4 17.95 46543 1.93E-05 350 20

Table B.9: Mechanica data of overhead lines.

132


# Insulator thermal Environment thermal Conductor heat Insulator heat Length

resistance (m.K/W) resistance (m.K/W) capacity (J/(m.K)) capacity (J/(m.K)) (km)

17 1.11 1.26 2.17E+03 1.92E+04 17.06

33 1.11 1.26 2.17E+03 1.92E+04 27.29

88 1.11 1.26 2.17E+03 1.92E+04 17.06

Table B.10: Thermal data of underground cables.

# Tfl (K) Tgfl (K) R τ (min) n m Sn (pu) K

20 36 28.6 4.87 210 1 0.8 2 1

41 36 28.6 4.87 210 1 0.8 8 1

52 36 28.6 4.87 210 1 0.8 4 1

53 36 28.6 4.87 210 1 0.8 2 1

54 36 28.6 4.87 210 1 0.8 4 1

56 36 28.6 4.87 210 1 0.8 2 1

78 36 28.6 4.87 210 1 0.8 2 1

80 36 28.6 4.87 210 1 0.8 2 1

86 36 28.6 4.87 210 1 0.8 4 1

Table B.11: Thermal data of power transformers.

Hour Winter Spring Summer Fall

0 2.80 8.30 13.78 6.96

1 2.67 8.00 13.53 6.85

2 2.59 7.73 13.34 6.74

3 2.52 7.60 13.27 6.68

4 2.47 8.15 13.70 6.64

5 2.42 9.37 14.84 6.63

6 2.48 10.89 16.25 6.93

7 2.87 12.29 17.55 7.56

8 3.55 13.45 18.65 8.47

9 4.30 14.38 19.46 9.38

10 4.94 15.07 20.05 10.03

11 5.41 15.57 20.48 10.46

12 5.68 15.87 20.75 10.66

13 5.74 16.06 20.83 10.63

14 5.53 15.95 20.78 10.26

15 5.05 15.61 20.43 9.54

16 4.49 14.99 19.83 8.76

17 4.00 13.86 18.75 8.24

18 3.68 12.44 17.40 7.96

19 3.48 11.17 16.06 7.70

20 3.30 10.34 15.28 7.48

21 3.15 9.70 14.76 7.29

22 3.02 9.18 14.35 7.10

23 2.90 8.78 14.02 6.95

Table B.12: Mean ambient temperature (C) for each season and each hour.

Figure B.5: Test system for a two-level blackout risk analysis.

133


Hour Winter Spring Summer Fall

0 4.57 4.52 3.06 4.82

1 4.60 4.54 3.12 4.84

2 4.59 4.52 3.13 4.83

3 4.60 4.59 3.13 4.84

4 4.64 4.82 3.04 4.85

5 4.64 4.99 3.00 4.88

6 4.61 4.88 2.92 4.98

7 4.47 4.89 3.01 5.10

8 4.28 4.98 3.26 5.17

9 4.12 5.10 3.57 5.21

10 4.08 5.18 3.85 5.25

11 4.04 5.28 4.01 5.27

12 4.03 5.35 4.15 5.30

13 4.05 5.33 4.19 5.35

14 4.11 5.31 4.19 5.42

15 4.17 5.26 4.13 5.39

16 4.16 5.23 3.98 5.07

17 4.16 5.16 3.78 4.81

18 4.23 4.96 3.45 4.79

19 4.29 4.63 3.10 4.79

20 4.34 4.52 3.03 4.81

21 4.43 4.53 3.01 4.83

22 4.50 4.53 3.05 4.85

23 4.54 4.53 3.09 4.83

Table B.13: Standard deviation of the ambient temperature (C) for each season and each hour.

# Bus Maximum power (MW) Power (MW) Damping coefficient (pu)

1 1 450 350 0

2 2 450 350 0

3 3 450 350 0

4 4 450 350 0

5 5 450 350 0

6 6 450 350 0

7 7 450 350 0

8 8 450 350 0

Table B.14: Power plants general data.

# Type V (pu) θ () Pg (pu) Qg (pu) Pl (pu) Ql (pu) Qming (pu) Qmaxg (pu) Vrated (kV)

1 2 1.0300 18.797 3.500 0.776 0 0 -1 2.5 20

2 2 1.0300 18.797 3.500 0.776 0 0 -1 2.5 20

3 2 1.0100 14.098 3.500 0.611 0 0 -1 2.5 20

4 2 1.0100 14.098 3.500 0.611 0 0 -1 2.5 20

5 1 1.0300 -6.800 3.497 1.067 0 0 -1 2.5 20

6 2 1.0300 -6.795 3.500 1.067 0 0 -1 2.5 20

7 2 1.0100 -11.530 3.500 1.108 0 0 -1 2.5 20

8 2 1.0100 -11.530 3.500 1.108 0 0 -1 2.5 20

9 3 1.0112 12.353 0.000 0.000 0 0 0 0 230

10 3 0.9965 7.428 0.000 0.000 0 0 0 0 230

11 3 0.9920 5.417 0.000 0.000 9.71 1 0 0 230

12 2 1.0300 -7.781 0.000 2.320 0 0 0 3 230

13 3 0.9719 -20.375 0.000 0.000 17.87 2 0 0 230

14 3 0.9802 -18.311 0.000 0.000 0 0 0 0 230

15 3 1.0019 -13.299 0.000 0.000 0 0 0 0 230

Table B.15: Bus Data.

B.2.2 Thermal and mechanical data

Thermal data for overhead lines are given in Table B.17. Mechanical data for overhead lines are

given in Table B.9. The span length is the distance between two towers. The “vegetation height”

(including the dielectric breakdown distance) used is 11.40 m. Thermal data for power transformers

are given in Table B.19. As for the previous test system, the ambient temperature is modeled by a

gaussian law, with a mean and a standard deviation depending on the hour and the season, given

134




1 3 1 9 0 0.0334 0 1 0 0

2 3 2 9 0 0.0334 0 1 0 0

3 3 3 10 0 0.0334 0 1 0 0

4 3 4 10 0 0.0334 0 1 0 0

5 3 5 15 0 0.0334 0 1 0 0

6 3 6 15 0 0.0334 0 1 0 0

7 3 7 14 0 0.0334 0 1 0 0

8 3 8 14 0 0.0334 0 1 0 0

9 1 9 10 0.0025 0.025 0.0437 1 0 1

10 1 9 10 0.0025 0.025 0.0437 1 0 1

11 1 15 14 0.0025 0.025 0.0437 1 0 1

12 1 15 14 0.0025 0.025 0.0437 1 0 1

13 1 10 11 0.001 0.01 0.0175 1 0 1

14 1 10 11 0.001 0.01 0.0175 1 0 1

15 1 10 11 0.001 0.01 0.0175 1 0 1

16 1 10 11 0.001 0.01 0.0175 1 0 1

17 1 14 13 0.001 0.01 0.0175 1 0 1

18 1 14 13 0.001 0.01 0.0175 1 0 1

19 1 14 13 0.001 0.01 0.0175 1 0 1

20 1 14 13 0.001 0.01 0.0175 1 0 1

21 1 11 12 0.011 0.11 0.1925 1 0 1

22 1 11 12 0.011 0.11 0.1925 1 0 1

23 1 13 12 0.011 0.11 0.1925 1 0 1

24 1 13 12 0.011 0.11 0.1925 1 0 1

Table B.16: Links Data.

in Tables B.12 and B.13, respectively. An unique wind speed, modeled by a Weibull law, is used for

all the test system. The parameters β (shape parameter) and η (scale parameter) are given in Table

B.20 for each hour and each season (it corresponds to the stations 380 of the KNMI).

# Number of Total heat capacity φ Length Emissivity Orientation Elevation above

conductors/phase mCp (J/(m.K)) (mm) (km) ε () sea level He

9 2 1513 30.42 25.00 0.50 0 0

10 2 1513 30.42 25.00 0.50 0 0

11 2 1513 30.42 25.00 0.50 0 0

12 2 1513 30.42 25.00 0.50 0 0

13 2 1513 30.42 10.00 0.50 0 0

14 2 1513 30.42 10.00 0.50 0 0

15 2 1513 30.42 10.00 0.50 0 0

16 2 1513 30.42 10.00 0.50 0 0

17 2 1513 30.42 10.00 0.50 0 0

18 2 1513 30.42 10.00 0.50 0 0

19 2 1513 30.42 10.00 0.50 0 0

20 2 1513 30.42 10.00 0.50 0 0

21 2 1513 30.42 110.00 0.50 0 0

22 2 1513 30.42 110.00 0.50 0 0

23 2 1513 30.42 110.00 0.50 0 0

24 2 1513 30.42 110.00 0.50 0 0

Table B.17: Thermal data of overhead lines.

B.2.3 Dynamic data

Dynamic characteristics of each synchronous machine are given in Table B.21 on a 400 MVA

power basis. There are adapted from [14]. We propose to use the Type AC4A alternator-supplied

controlled-rectifier excitation system illustrated in Figure B.6. This high initial response excitation

system utilizes a full thyristor bridge in the exciter output circuit. Parameters used are adapted

from [96] and are given in Table B.22. To improve the angular stability, a PSS is implemented

in each generator. The PSS used is depicted in Figure B.7. In order to damp different area of

frequency, we used two sets of parameters, given in Table B.23. In each power plant, both are used:

one for each unit. The governor-turbine system is based on the following parameters:

135


# Reference temperature Tensile stress Apparent EA Dilatation coef. Span length Suspension

Tref (C) @Tref (kN) weight (N/m) (kN) α (K−1) (m) height (m)

9 -17.78 53.4 17.95 46543 1.93E-05 350 20

10 -17.78 53.4 17.95 46543 1.93E-05 350 20

11 -17.78 53.4 17.95 46543 1.93E-05 350 20

12 -17.78 53.4 17.95 46543 1.93E-05 350 20

13 -17.78 53.4 17.95 46543 1.93E-05 350 20

14 -17.78 53.4 17.95 46543 1.93E-05 350 20

15 -17.78 53.4 17.95 46543 1.93E-05 350 20

16 -17.78 53.4 17.95 46543 1.93E-05 350 20

17 -17.78 53.4 17.95 46543 1.93E-05 350 20

18 -17.78 53.4 17.95 46543 1.93E-05 350 20

19 -17.78 53.4 17.95 46543 1.93E-05 350 20

20 -17.78 53.4 17.95 46543 1.93E-05 350 20

21 -17.78 53.4 17.95 46543 1.93E-05 350 20

22 -17.78 53.4 17.95 46543 1.93E-05 350 20

23 -17.78 53.4 17.95 46543 1.93E-05 350 20

24 -17.78 53.4 17.95 46543 1.93E-05 350 20

Table B.18: Mechanica data of overhead lines.

# Tfl (K) Tgfl (K) R τ (min) n m Sn (pu) K

1 36 28.6 4.87 210 1 0.8 2 1

2 36 28.6 4.87 210 1 0.8 2 1

3 36 28.6 4.87 210 1 0.8 2 1

4 36 28.6 4.87 210 1 0.8 2 1

5 36 28.6 4.87 210 1 0.8 2 1

6 36 28.6 4.87 210 1 0.8 2 1

7 36 28.6 4.87 210 1 0.8 2 1

8 36 28.6 4.87 210 1 0.8 2 1

Table B.19: Thermal data of power transformers.

Hour η - Winter η - Spring η - Summer η - Fall β - Winter β - Spring β - Summer β - Fall

(m/s) (m/s) (m/s) (m/s)

0 6.28 4.11 3.75 5.23 1.64 1.42 1.32 1.57

1 6.24 4.10 3.76 5.21 1.66 1.41 1.30 1.53

2 6.24 4.14 3.77 5.20 1.64 1.46 1.31 1.49

3 6.19 4.15 3.76 5.25 1.64 1.45 1.30 1.53

4 6.17 4.07 3.78 5.25 1.68 1.39 1.33 1.54

5 6.26 4.38 4.03 5.30 1.73 1.52 1.45 1.50

6 6.28 4.93 4.55 5.40 1.69 1.76 1.63 1.58

7 6.37 5.49 5.15 5.52 1.71 1.97 1.90 1.64

8 6.62 5.93 5.63 5.86 1.83 2.21 2.11 1.84

9 6.93 6.28 6.02 6.22 1.91 2.34 2.28 1.92

10 7.22 6.67 6.40 6.50 2.00 2.47 2.47 2.12

11 7.48 6.97 6.72 6.70 2.16 2.62 2.65 2.16

12 7.57 7.15 6.90 6.81 2.15 2.66 2.68 2.20

13 7.63 7.26 6.95 6.79 2.20 2.77 2.71 2.25

14 7.49 7.18 6.88 6.62 2.18 2.75 2.77 2.20

15 7.26 7.00 6.74 6.26 2.11 2.68 2.63 2.05

16 6.91 6.69 6.39 5.87 2.01 2.61 2.52 1.93

17 6.73 6.16 5.84 5.65 1.90 2.43 2.24 1.77

18 6.62 5.48 5.19 5.61 1.85 2.15 1.94 1.75

19 6.55 4.85 4.57 5.55 1.72 1.82 1.67 1.72

20 6.50 4.54 4.18 5.36 1.67 1.71 1.49 1.61

21 6.48 4.36 4.01 5.27 1.69 1.57 1.42 1.56

22 6.45 4.23 3.83 5.26 1.68 1.54 1.31 1.59

23 6.36 4.12 3.81 5.26 1.65 1.44 1.30 1.59

Table B.20: Wind speed parameters.

• Speed set point: ωref = 1pu

• Steady state gain: 1/R = 20pu

• Maximum power order: Tmax = 1pu on a 400MVA basis

• Servo time constant: Ts = 0.2s

136


Leakage reactance Xl = 0.2

Resistance Ra = 0.0025

d-axis synchronous reactance Xd = 1.8

d-axis transient reactance X′d = 0.3

d-axis subtransient reactance X′′d = 0.25

d-axis open-circuit time T ′d0 = 8.0s

d-axis open-circuit subtransient time constant T ′′d0 = 0.03s

q-axis synchronous reactance Xq = 1.7

q-axis transient reactance X′q = 0.55

q-axis subtransient reactance X′′q = 0.25

q-axis open-circuit time T ′q0 = 0.4s

q-axis open-circuit subtransient time constant T ′′q0 = 0.05s

Inertia constant H = 6.0s

Table B.21: Dynamic parameters of synchronous machines.

Figure B.6: Excitation system - type AC4A.

TA = 0.015s TB = 10s TC = 1s TR = 0.01s KA = 200 KC = 0 VRmin = −5 VRmax = 6

Table B.22: Parameters for excitation system model.

KS = 20.0 T5 = 10.0s T1 = 0.05s T2 = 0.02s T3 = 3.0s T4 = 5.4s Vsmin = −1 Vsmax = 1

Table B.23: Parameters for PSS model.

• Governor time constant: Tc = 1.0s

• Transient time constant: T3 = 0s

• HP section time constant: T4 = 2.0s

• Reheater time constant: T5 = 4.0s

B.2.4 Relays and protections

The following under-frequency load shedding plan is used for each load: 5% of load shedding every

200 mHz step between 49 Hz and 47.6 Hz (8 steps) with a delay of 10 cycles or 200 ms, corresponding

to the time needed to measure the frequency. The following under-voltage load shedding plan is

used for each load: 5% of load shedding every 0.02 pu step between 0.90 pu and 0.80 pu (6 steps)

with a delay of 1.5 s at 0.90 pu, increasing by 0.25 s at each step. A reliability of 90% is used for

each load shedding relay.

For each power plant, we used an under-frequency relay at 47.5 Hz (traditionnal setpoint) with a

delay of 200 ms, an under-voltage relay at 0.7 pu with a delay of 2 s, an over-frequency relay at 52.5

Hz (traditionnal setpoint) with a delay of 1 s, an over-excitation relay for the voltage/frequency at

1.15 pu with a delay of 3 s, and in order to model the trip of a generator on loss-of-synchronism

condition, a protection which trip the generator is the apparent resistance is negative during 500

ms. All these protections are considered 100% reliable.

137


Figure B.7: Model of a power system stabilizer. From [10].

For each overhead line, we used an over-current protection at 150% of the nominal current with a

delay of 1 s, and a distance relay. For the latter, a quadrilateral characteristic was used for each of

the three zones, such as shown in Figure B.8. Only coordinates of the point P must be specified. We

propose to use P = (0.8×Rl, 0.8×Xl) with a delay of 200 ms for the zone I, P = (1.2×Rl, 1.2×Xl)

with a delay of 400 ms for the zone II and P = (1.5×Rl, 1.5×Xl) with a delay of 1 s for the zone

III.

Figure B.8: Quadrilateral distance relay characteristic.

138

Appendix C

Transition criteria between level-I

and level-II

C.1 Angular transient stability

C.1.1 Introduction

It appears from a preliminary study (see [50]) that a time domain simulation seems to be the best

way for transient stability assessment. We need a fast method able to give a good estimation of

the transient stability. The proposed model for the synchronous machine is a simplified model with

amortisseurs neglected as described in Section 5.2 of [14]. We used also a simplified modeling for

loads and exciters.

C.1.2 Simplified model

The model proposed is based on several modeling assumptions: the mechanical power input of

each synchronous machine is constant, mechanical damping is negligible, the effect of speed variation

on stator voltages is neglected, the impact of the PSSs is neglected, loads are represented by constant

impedances.

For the synchronous machine, [14] gives the following set of machine equations for simplified model

with amortisseurs neglected:

Ψd = −Ldid + EI (C.1)

Ψq = −Lqiq (C.2)

E′q = EI − (Ld − L′d)id (C.3)

pE′q =1

T ′d0

(Efd − EI) (C.4)

where Ψd is the flux linkage associated with the d-axis rotor circuit, Ld is the d-axis synchronous

inductance, EI is the, Ψq is the flux linkage associated with the q-axis rotor circuit, Lq is q-axis

synchronous inductance, E′q is the q-axis component of the voltage “behind the transient impedance”,

L′d is the d-axis transient inductance, T ′d0 is the open circuit transient time constant and Efd is the

excitation field voltage. The variable EI can be eliminated from the two last equation and, since in

per unit Xd = Ld,

dE′qdt

=1

T ′d0

[Efd − (Xd −X ′d)id − E′q] (C.5)

139

APPENDIX C. TRANSITION CRITERIA BETWEEN LEVEL-I AND LEVEL-II

Consequently, this model gives one differential equation per machine. The terminal voltage ampli-

tude can be found through its d-axis and q-axis components:

E2i = |ed|2 + |eq|2 (C.6)

These variables ed and eq are given by the equations

ed = E′d +X ′qiq −Raid, (C.7)

and

eq = E′q −X ′did −Raiq. (C.8)

These expressions show that the expression “voltage behind the transient impedance” is confusing

since an unique transient impedance cannot be defined: the transient reactance for the d-axis of the

voltage is X ′q and for the q-axis, X ′d. However, we will consider that the saliency is negligible as an

additional modeling assumption,

X ′d ≈ X ′q ≡ X ′. (C.9)

The transient impedance is then

Z ′ = Ra + jX ′ (C.10)

The simplified model to use for the exciter depends from one type of exciter to another. If we use

the Type AC4A alternator-supplied controlled-rectifier excitation system illustrated in Figure C.1,

with a time constant TR very small such it can be approximated by 0, we have then the following

equation with Y (s) = L(Efd(t)) and U(s) = L(Vref − Ei(t)),

Y (s) = U(s)1 + sTC1 + sTB

KA

1 + sTA, (C.11)

or

(1 + sTA)(1 + sTB)Y (s) = KA(1 + sTC)U(s). (C.12)

In the temporal domain:

TATBy′′(t) + (TA + TB)y′(t) + y(t) = KATCu

′(t) +KAu(t) (C.13)

or

y′′(t) +TA + TBTATB

y′(t) +1

TATBy(t) =

KATCTATB

u′(t) +KA

TATBu(t). (C.14)

This differential equation can be expressed as a set of two first-order differential equations:

x′1(t) = − 1

TATBx2(t) +

KA

TATBu(t) (C.15)

x′2(t) = x1(t)− TA + TBTATGB

x2(t) +KATCTATB

u(t) (C.16)

with y(t) = x2(t) = Efd(t) and u(t) = Vref − Ei(t).

Figure C.1: Excitation system - type AC4A.

140


The assumptions (including the saliency neglected) lead to the electrical network shown in figure

C.2 and has n nodes with active sources. Node 0 is the reference node (neutral). Nodes 1, 2, ..., n are

the terminal machine buses. Passive impedances connect the various nodes (transmission network

including transformers) and connect the nodes to the reference at load buses. The amplitude of the

terminal voltage of machine i is denoted Ei and its angle θi. The amplitude of the voltage behind

the transient impedance of machine i is denoted E′i and its angle δi. The admittance matrix of the

Figure C.2: Representation of a multi-machine system.

n-port network, looking into the network from the voltage behind the transient impedance of the

generators, is defined by

I = Y ′E′ (C.17)

where Y ′, by definition:

• Y ′ii = Y ′ii∠θ′ii = G′ii + jB′ii = driving point admittance for node i.

• Y ′ij = Y ′ij∠θ′ij = G′ij + jB′ij = negative of the transfer admittance between nodes i and j.

The power into the network at node i′, which is the gross electrical power output of machine i, is

given by

Pei = <(E′iI?i ) (C.18)

= E′2i G′ii +

n∑j=1j 6=i

E′iE′jY′ij cos(θ′ij − δi + δj) (C.19)

= E′2i G′ii +

n∑j=1j 6=i

E′iE′j [B′ij sin(δi − δj) +G′ij cos(δi − δj)] (C.20)

for i = 1, ..., n.

The swing equation of machine i is given by

2Hi

ωR

dωidt

= Pmi − Pei. (C.21)

141


The equations of motion are then given by

2Hi

ωR

dωidt

= Pmi −[E′2i G

′ii +

n∑j=1j 6=i

E′iE′jY′ij cos(θ′ij − δi + δj)

](C.22)

dδidt

= ωi (C.23)

for i = 1, ...n. The set of equations (C.22) and (C.23) is a set of 2n-coupled nonlinear first-order

differential equations.

C.1.3 Algorithm

There is 4 steps in the performance of a transient stability study:

1. Based on the pre-fault load flow steady state, which gives for each power plant i the terminal

active power Pi, the terminal reactive power Qi and the magnitude of terminal voltage Ei, the

corresponding terminal current Ii and power factor angle φi are computed by

Ii =

√P 2i +Q2

i

Ei, (C.24)

and

φi = arccos

(PiEiIi

). (C.25)

Based on the steady state phasor diagram C.3, the internal rotor angle δi is given by

δi = arctan

(XqIi cos(φi)−RaIi sin(φi)

Ei +RaIi cos(φi) +XqIi sin(φi)

). (C.26)

With δi known, the dq-axis components of stator voltage and current are given by

ed = Ei sin(δi), (C.27)

eq = Ei cos(δi), (C.28)

id = Ii sin(δi + φi), (C.29)

and

iq = Ii cos(δi + φi). (C.30)

The dq-axis components of the voltage behind the transient impedance, E′d and E′q, are then

given by equations (C.7) and (C.8). The mechanical power Pmi of the generators can be

computed by

Pmi = Pi +RaI2i . (C.31)

Finally, the machine angles in an absolute reference frame δi can be obtained by the sum of

the terminal voltage angle θi and the angle between the rotor and the terminal voltage δi,

δi = θi + δi. (C.32)

2. The Y ′ matrices for each network condition (during and after the fault) is calculated. The

equivalent impedances of the loads are obtained from the load bus data, with the pre-fault

voltages.

3. The evolution of the system is simulated for a defined time period by solving numerically the set

of 5-n coupled differential equations (C.5), (C.15), (C.16), (C.22) and (C.23). A Runge-Kutta

method can be used.

4. Machines’ angles are analyzed to determine the stability (for example, if the difference of any

of two machines’ angles does not exceed 180, the system is stable). This can be done at each

time step during the dynamic simulation, in order to stop it as soon an instability is detected.

142


Figure C.3: Steady state phasor diagram of the synchronous machine. From [14].

C.1.4 Shortcomings

This simplified model suffers from several shortcomings due to the assumptions made:

1. Neglecting the damping power. It is a “conservative” assumption since the damping power

improves the stability.

2. Constant mechanical power. It is realistic only if the primary regulation does not have the

time to change significantly the generation over the time period studied, which is the case if

this time period is smaller than primary regulation characteristic time (few seconds).

3. Representing loads by constant passive impedance. If loads have more a constant power behav-

ior, it can deteriorate the stability. However, we can assume that the recovery period is also

few seconds, so the constant impedance behavior should be valid on this time period.

C.2 Frequency stability

C.2.1 Introduction

We propose to use a simplified third-order system frequency response model analog to the model

developed in [78]. We will use only the steady state frequency deviation after primary regulation for

the frequency stability criterion. A simple way to improve that is to use the extreme values of the

frequency in each subnetwork.

C.2.2 Simplified model

The third-order system frequency response model used for each generator is shown in Figure C.4,

where ∆ω is the angular speed deviation from nominal value, M the angular momentum of the

generator, D the damping constant, R the speed regulation, ∆Pe the deviation in electrical power,

∆Pm the deviation in mechanical power, ∆Pv the change in valve position from nominal, TT the

turbine time constant and TG the governor time constant. If we consider that the most significant

time constant in the system is the reheater time constant, the model can be slightly modified: the

models for the turbine and the governor can be replaced by one model for the reheater. The Figure

C.4 is equivalent to the set of differential equations for each power plant i

d

dt

∆ωi∆Pmi∆Pvi

=

−DiMi

1Mi

0

0 − 1TTi

1TTi

− 1TGiRi

0 − 1TGi

∆ωi

∆Pmi∆Pvi

+

−∆PeiMi

0∆PSPiTGi

(C.33)

143


Figure C.4: The third-order system frequency response model.

When we are interested only in primary regulation, ∆PSPi = 0, ∀i.

C.2.3 Steady state frequency deviation

When the steady state is reached, the stationary form of the set of differential equations for each

power plant i is given by −Di∆ωi + ∆Pmi = ∆Pei−∆Pmi + ∆Pvi = 0

−∆ωi/Ri + ∆Pvi = 0

(C.34)

If we consider that the frequency is the same in each subnetwork Sj when the steady state is reached

and we sum these equations over all the power plants i, we have−D(j)∆ω(j) + ∆P

(j)m = ∆P

(j)e

−∆P(j)m + ∆P

(j)v = 0

−∆ω(j)/R(j) + ∆P(j)v = 0

(C.35)

where

D(j) =∑i∈Sj

Di (C.36)

1/R(j) =∑i∈Sj

1/Ri (C.37)

∆P (j)m =

∑i∈Sj

∆Pmi (C.38)

∆P (j)e =

∑i∈Sj

∆Pei (C.39)

∆P (j)v =

∑i∈Sj

∆Pvi (C.40)

The resolution gives

∆ω(j) = − ∆P(j)e

D(j) + 1/R(j)(C.41)

for the frequency deviation in subnetwork j. If the absolute magnitude of this value is higher than

a setpoint, a frequency instability is possible. If we neglect losses in the grid, the ∆P(j)e can be

approximated by

• If the frequency transient in subnetwork j is due to the loss of a power plant in this subnetwork:

the generated power of this power plant,

• If the frequency transient in subnetwork j is due to a grid slit: by the sum of the load minus

the sum of the generation in this subnetwork before the split.

144


As we have also

∆ωi = − ∆PeiDi + 1/Ri

, (C.42)

we can compute directly the ∆Pei for each power plant i when the frequency deviation is obtained.

These values can be used for the resolution of the load flow equations. We should however note that

the mechanical output power of power plants is limited. If the computation of the ∆Pei induces a

power higher than the limit, the generation can be fixed to the maximal value and the computation

is re-started for other power plants with an additional ∆P(j)e = Pei − Pmaxei in the corresponding

subnetwork.

C.3 Voltage stability

The criterion used to detect a voltage instability is simply either the non-convergence of the load

flow iterations or the convergence outside voltage limits. The most common method to solve the

load flow equations is the Newton-Raphson method. However, the non-convergence of the Newton-

Raphson iterations does not imply systematically that no solution exists.

145

Appendix D

Failure probability of overhead

lines

D.1 Introduction

Analysis of previous blackouts or major system disturbances showed that line outages due to over-

load are often the main contributors to the cascading failures leading to these undesired situations.

The most famous example is the blackout which occurred on August 14, 2003 in the Northeastern

area of the United States and in the Southeastern area of the Canada, where about twenty lines

tripped due to short circuit with ground [3]. Indeed, each of these lines sagged low enough to con-

tact something below it, even if two of them were not overloaded. As the load on other lines can

increase after the loss of an element, their failure probabilities can increase due to thermal effects

increasing their sag. If another line trips, this effect is increased, possibly leading to a cascading

failure. Therefore, it is crucial to include the dependency of the probability of trip to the load going

through the line in a cascading failures modeling. We should however note that the probability of

a fault depends not only on this load current but also on the weather (ambient temperature, wind

speed, ...), on the vegetation height, on operators corrective actions, etc.

Several models were proposed for the probability of trip as a function of the load, based on the

assumption that the more a line is overloaded, the larger is its sagging, and hence the probability that

it will be tripped. But this assumption imposes only that the probability should be a monotonically

increasing function of the load, and proposed models differ by the shape of this function. None

of them is backed up by empirical evidence or detailed analysis. In this thesis, we proposed a

decomposition in three levels of the Probabilistic Risk Assessment (PRA) to blackout hazard in

transmission power systems based on dynamic PRA. The level-I analyzes the first phase of cascading

failures leading to blackouts, the slow cascade ruled by thermal failures, on the basis of the physical

evolution of lines’ sag. The aim of this Appendix is to compare existing modeling of the probability

of trip as a function of the load to results given by a dynamic PRA level-I analysis. The comparison

is performed for two different power systems. Two different operators corrective actions models are

used for the smallest power system.

Consequently, Section D.2 presents existing models and Section D.3 presents theoretical basis.

We will then apply the level-I of blackout PRA to two test cases in Section D.4 analyzes the results.

Then, conclusions are presented in Section D.5.

147

APPENDIX D. FAILURE PROBABILITY OF OVERHEAD LINES

D.2 State of the art

Two different kinds of studies about probability of line tripping are interesting to discuss in

this paper. First, methodologies developed to study cascading failures use various model for the

probability of trip as a function of the load. They are discussed in Subsection D.2.1. Secondly,

probabilistic methods to assess thermal capacity of lines based on the risk study also the probability

to have a flash-over to the ground in function of the load. They are presented in Subsection D.2.2.

D.2.1 Cascading failures methodologies

D.2.1.1 Introduction

In a cascading failure leading to a major system disturbance, there is a strong coupling between

events. In particular, the loss of an element can overload other lines. The temperature of an

overloaded line starts then to increase, thus increasing its sag, which may finally be so high that a

short-circuit with the ground towards trees may occur and cause the line trip. If we denote by Tithe event “Trip of the line i”, the frequency Fr of the dangerous sequence T1, ..., Tn (i.e. successive

trips of lines 1, ..., n) can be calculated by

Fr(T1, ..., Tn) = Fr(T1)× p(T2|T1)× p(T3|T1, T2)× ...× p(Tn|T1, ..., Tn−1), (D.1)

where p(Ti|T1, ..., Ti−1) is the conditional probability of the trip of the line i, knowing that lines

1, ..., i− 1 tripped. This equation can be re-write as

Fr(T1, ..., Tn) = Fr(T1)

n∏i=2

p(Ti|T1, ..., Ti−1). (D.2)

Due to the strong coupling between events in a cascading failure, the conditional probabilities can

strongly differ from the marginals ones,

p(Ti|T1, ..., Ti−1) 6= p(Ti), (D.3)

so it is crucial to have a good approximation of these probabilities in order to obtain a realistic

estimation of the risk of blackout.

In a general way, conditional probabilities p(Ti|T1, ..., Ti−1) depends on several factors: the load

of the line i, the weather (ambient temperature, wind speed, ...), on the vegetation height and on

operators corrective actions. Operators correctives actions themselves rely not only on the state of

the power system, but also on the information infrastructure. However, taking into account all these

factors in a blackout PRA is complex. Therefore, several models trying to estimate vulnerabilities

of a power system to cascading outages use conditional probabilities as a function only of the load

of the concerned line,

p(Ti|T1, ..., Ti−1) ≈ p(Ti|Ii(T1, ..., Ti−1)), (D.4)

where Ii(T1, ..., Ti−1) is the current in line i after the trip of the lines 1, ..., i− 1. The equation D.2

then becomes

Fr(T1, ..., Tn) = Fr(T1)

n∏i=2

p(Ti|Ii(T1, ..., Ti−1)). (D.5)

The assumption that the probability of line tripping in function of reduced load (actual load divided

by thermal capacity) is the same for all lines is often made as an additional approximation. If

we denote by P (x) the probability of line tripping when the reduced load is x, the frequency of a

dangerous scenario is simply given by

Fr(T1, ..., Tn) = Fr(T1)

n∏i=2

P [xi(T1, ..., Ti−1)]. (D.6)

In a general way, a line tripping can have two origins:

148


• The thermal expansion can result in the line dropping beneath its safety clearance, which may

cause a flashover to the ground with a probability Pth(x).

• A failure independent of the load (e.g. mechanical failure), with a probability Pind.

The total probability of line tripping is then given by

P (x) = Pind + Pth(x)[1− Pind] (D.7)

The load in each line after each loss can be easily computed through a power flow calculation. The

problem in this simplified model is then to know the function P (x), or, equivalently, Pth(x). Several

models were proposed for this, based on the assumption that the more a line is overloaded, the larger

is its sagging, and hence the probability that it will be tripped. But this assumption imposes only

that the probability should be a monotonically increasing function of the load, and proposed models

differ by the shape of this function. We present in this Section three different models.

D.2.1.2 Exponential model

In [50], Nedic presents a model to simulate large system disturbances (a variant of the Manchester

model). One of the phenomena modeled is the possible line outages due to overloads. The proposed

approach rely an the additional assumption that only if a line is overloaded it can sag beyond the

specified limits (i.e. if a line is not overloaded its tripping probability due to sagging is equal to

zero). The probabilistic function used for this purposed is shown in Figure D.1. This function is

equal to zero when the reduced load is lower than 1, has an exponential evolution when the reduced

load is between 1 and 1.5 and is equal to a constant value p2 when the reduced load is larger than

1.5.

Figure D.1: Line overload modelling. From [50].

D.2.1.3 Linear model

Zima and Andersson assumed in [97] that the probability will rather follow a curve show in Figure

D.2: the probability is equal to zero for a reduced load lower than 1, has a linear evolution when

the reduced load is between 1 and k and is equal to 1 when the reduced load is larger than k. Such

a function is inspired by [98] where a similar behavior is proposed to describe a probability of the

incorrect tripping of a line exposed to a hidden failure (i.e. a relay malfunction which entails the

trip of a “healthy” line). However, the probability function used in [98] is not equal to zero for a

load below the line limit, but is equal to a constant low value. Computations in [97] are based on

k = 1.4, as in [98].

149


Figure D.2: Probability of the line trip as a function of its loading. From [97].

D.2.1.4 Normal cdf model

In [99, 100], another kind of model is proposed, as shown in Figure D.3. It is assumed that when a

line loading increases above its limit, the probability of line tripping increases and eventually flatten

out to 100%. The probabilities given in these references are reproduced in Table D.1. These values

can be approximately fit by a normal cumulative distribution function (cdf) with a mean of 117.2%

and a standard deviation of 14.0%. This is why we refer this model as the “normal cdf model”.

Figure D.3: Probability of the line trip as a function of its loading. From [100].

Loading (%) Probability of trip

100 0.10

110 0.30

120 0.60

130 0.80

140 0.95

150 1.00

Table D.1: Assumption on probability of trip as a function of line loading. From [99].

D.2.1.5 Conclusions

Functions proposed in the literature to model the dependence of a line trip probability on its

loading are very different. But they are all based on the unique assumption that the more a line is

150


overloaded, the larger is its sagging, and hence the probability that it will be tripped. In particular,

no physical bases are used to justify the behavior of the function.

D.2.2 Increasing thermal rating by risk analysis

Thermal ratings of overhead lines are in general computed deterministically (conservative basis).

Several works proposed to use probabilistic methods to assess thermal capacity based on risk. In

these methodologies, weather conditions are represented by stochastic models in order to compute

distributions of conductor temperature, the risk in function of the loading, etc...

For example, [101] address two potential impacts of thermal overload: the too high sag which

may cause flashover to the ground (resulting in outage of the line) and the loss of strength due to

annealing. Based on the stationary thermal balance equation and on random behavior of ambient

conditions (ambient temperature and wind speed), the risk of carrying continuous overcurrent is

assessed. Short time and long time temporary overload ratings are then computed such that the

risk is equivalent to the stationary rating. This paper introduces the computation of the probability

that the conductor temperature exceeds a limiting temperature for which the line sags through all

of the designed safety margins, in function of the current. However, results do not dissociate the

sag problem to the annealing problem which is not relevant in the scope of the failure of overloaded

lines in cascading failures.

Like this example, methodologies developed to assess probabilistic (dynamic) thermal ratings of

overhead lines are based on the idea that the probability of short-circuit with the ground due a too

high sag can be evaluated through the thermal balance equation and the probability distributions

of weather conditions. However, the short-circuit probability in function of the load seems to be not

explicitly evaluated. Consequently, the next Section is devoted to a study of this probability based

on the same principle.

D.3 Physical bases

D.3.1 Introduction

We propose here to analyze the probability of line tripping in function of its loading without con-

sidering operators corrective actions. This probability can then be evaluated through the stationary

thermal balance equation per unit length [55], given by

RI2 + qs = qc + qr, (D.8)

where R, I, qs, qc, qr are respectively the AC conductor resistance1 per unit length, the conductor

current, the heat gain rate from the sun per unit length, the convected heat loss rate per unit length

and the radiated heat loss rate per unit length. The solar heating gain varies during a year because it

depends on the altitude and azimuth of the sun. The convective heat loss depends on the conductor

temperature Tc, on the ambient temperature Ta, on the wind speed Vw and on the angle between

the wind direction and the conductor axis φ,

qc ≡ qc(Tc, Ta, Vw, φ). (D.9)

The radiated heat loss depends on the conductor and ambient temperatures,

qr ≡ qr(Tc, Ta). (D.10)

1We neglect here the variation of the conductor resistance with its temperature.

151


The current can be expressed as a function of these variables by

I =

√qc(Tc, Ta, Vw, φ) + qr(Tc, Ta)− qs

R. (D.11)

Let be the random variable Icr the critical current, i.e. the threshold current above which the line

sags enough to have a flashover to the ground. The probability of failure Pth(i) is given by the cdf

of this random variable,

Pth(i) = P [i ≥ Icr] = P [Icr ≤ i] = FIcr (i). (D.12)

So, the problem of computing Pth(i) is then equivalent to compute FIcr (i). If we denote by Tcrthe critical temperature, i.e. the threshold temperature above which the line sags enough to have a

flashover to the ground, the critical current is given from equation (D.11) by

Icr =

√qc(Tcr, Ta, Vw, φ) + qr(Tcr, Ta)− qs

R. (D.13)

In this expression, Tcr, Ta, Vw, φ and qs are random variables. In particular, the critical temperature

is a function of the vegetation height which can be viewed as a random variable. Consequently, in

a general way, the critical current is a function of random variables p = (Tcr, Ta, Vw, φ, qs),

Icr = g(p). (D.14)

If these random variables have a joint probability distribution function (pdf) fp(p), the cdf of the

critical current is given by

FIcr (i) = P [Icr ≤ i] =

∫g(p)≤i

fp(p)dp. (D.15)

However, this integral is difficult to compute analytically: the joint pdf should be expressed and

the integration domain delimited. Consequently, we propose to numerically evaluate the cdf of the

critical current from data available on the Koninklijk Nederlands Meteorologisch Instituut website2.

The dataset used is the recording of ambient temperature, wind speed and wind direction on the

period 2001-2010 at the station 278 Heino (see Figure D.4). We study in next Subsections the

influence of the different factors, in order to estimate their relative importances. The conductor

used is an Aluminum Conductor Seel Reinforced (ACSR) 47/5.

D.3.2 Influence of ambient temperature

We propose to study first the influence of ambient temperature. All others parameters are consid-

ered constant. We can then denote by ga the function which links the critical current to the ambient

temperature,

Icr = ga(Ta). (D.16)

The critical current’s cdf is then simply given by

FIcr (i) = P [ga(Ta) ≤ i] = P [Ta ≥ g−1a (i)] = 1− FTa(g−1

a (i)), (D.17)

where FTa is the cdf of the ambient temperature and because ga is a monotonically decreasing

function. In order to understand the behavior of FIcr (i) in this case, we propose to develop an

approximate analytically model. The first difficulty in (D.17) is the inversion of ga, due to the non-

linearity of qc3 and qr. Therefore, the first approximation step is the linearization of these terms.

The critical current can then be expressed by

Icr =√c0 − c1Ta, (D.18)

2http://www.knmi.nl/3In forced convection, the non-linearity of qc is due to the dependence of the viscosity, density and thermal

conductivity of air to ambient temperature.

152

http://www.knmi.nl/


Figure D.4: Map of the Netherlands showing the station 278 Heino.

where c0 and c1 are positive constants. We have then

g−1(i) =c0 − i2

c1, (D.19)

and

FIcr (i) = 1− FTa(c0 − i2

c1

). (D.20)

The second approximation consists of modeling the ambient temperature as a random normal vari-

able of mean µTa and standard deviation σTa (as it is often done, see for example [101]). For our

station, µTa = 10.06C and σTa = 7.13C. We have finally

FIcr (i) = Φ

(i2 − c0 + c1µTa

c1σTa

), (D.21)

which means that the square of the critical current follows (approximately) a normal law. The

Figure D.5 compares this approximation to a computation directly based on measurements. The

critical conductor temperature, the wind speed and the wind direction were respectively chosen to

100C, 3.1121m/s (mean wind speed at the station 278) and perpendicular to the conductor. The

heat gain rate from the sun corresponds to January 1st, midday. The two curves are very similar.

The mean critical current is 2176 A and its standard deviation 88 A (0.4%).

D.3.3 Influence of wind

The Figure D.6 represents the cdf of the critical current when only the wind speed is taken as

a random variable. The critical conductor temperature, the ambient temperature and the wind

direction were respectively chosen to 100C, 10.06C (mean ambient temperature at the station

278) and perpendicular to the conductor. The heat gain rate from the sun corresponds to January

1st, midday. The mean critical current is 2099 A and its standard deviation 389 A (18.5%). The

Figure D.7 represents the cdf of the critical current when wind speed and wind direction are taken

as a random variable. The critical conductor temperature, the ambient temperature and the mean

wind direction were respectively chosen to 100C, 10.06C and perpendicular to the conductor. The

heat gain rate from the sun corresponds to January 1st, midday. The mean critical current is 1894

A and its standard deviation 382 A (20.2%).

153


Figure D.5: Cdf of the critical current - influence of the ambient temperature.

Figure D.6: Cdf of the critical current - influence of the wind speed.

Figure D.7: Cdf of the critical current - influence of the wind.

D.3.4 Total influence of weather conditions

The Figure D.7 represents the cdf of the critical current when all weather conditions (including heat

gain rate from sun) are taken as a random variable. The critical conductor temperature was chosen

to 100C. The mean critical current is 2115 A and its standard deviation 383 A (18.1%).

D.3.5 Influence of vegetation height

Previous analyses were performed for a constant critical temperature, which is equivalent to a

constant vegetation height. Indeed, the critical temperature depends on the critical sag, which

154


Figure D.8: Cdf of the critical current - influence of weather conditions.

depends itself on the vegetation height. In reality, the vegetation height below overhead lines is not

a constant, but is a variable depending on the maintenance policy, climate, soil properties, season, ...

Therefore, it can be view also as a random variable which has an impact on the critical current. The

conductor state change equation, which gives the evolution of the sag in function of the temperature,

is a non-linear equation [57]. However, the critical temperature as a function of critical sag is nearly

linear on a credible range, as shown in Figure D.9.

Figure D.9: Critical temperature in function of critical sag.

The influence of the critical temperature on the critical current is approximately the opposite of

the influence of the ambient temperature, since the balance (D.13) depends mainly on the difference

Tcr − Ta4. The same approach as in Subsection D.3.2 could therefore be applied. If all other

parameters are considered constant and by denoting by gc the function which links the critical

current to the critical temperature,

Icr = gc(Tcr), (D.22)

the critical current’s cdf is given by

FIcr (i) = P [gc(Tcr) ≤ i] = P [Tcr ≤ g−1c (i)] = FTcr (g

−1c (i)), (D.23)

where FTcr is the cdf of the ambient temperature and because gc is a monoticaly increasing function.

By the linearization of qc and qr, the critical current can be expressed by

Icr =√c′0 + c1Tcr (D.24)

4Some properties like the viscosity, density and thermal conductivity of the air near the conductor depends however

on the film temperature which is the mean between the conductor and the ambient temperature.

155


where c′0 and c1 are positive constants. We have then

FIcr (i) = FTcr

(i2 − c′0c1

). (D.25)

However, no data seems to exist in the literature on the statistical distribution of the vegetation

height below overhead power lines, which means that the function FTcr is unknown. This implies

that the impact of the vegetation height dispersion on the probability of line tripping in function of

its loading cannot be known. In order to estimate the influence, we propose to compute the standard

deviation of the critical current in function of the standard deviation of the critical temperature.

If the ambient temperature is modeled as a random normal variable of mean µTcr and standard

deviation σTcr , we have

FIcr (i) = Φ

(i2 − c′0 − c1µTcr

c1σTcr

). (D.26)

The standard deviation of the critical current in function of the standard deviation of the critical

temperature, computed from this expression for a mean critical temperature of 100C is given in

Figure D.10. The ambien temperature, the wind speed and the wind direction were respectively

chosen to 10.06C, 3.1121m/s and perpendicular to the conductor. From these results and by

approximating the link between the link between the critical temperature and the vegetation height

by a linear relation (see Figure D.9), the standard deviation of the critical current in function of

the standard deviation can be computed, as shown in Figure D.11. If the standard deviation of the

vegetation height is greater than 0.5 meter5, the impact of the vegetation height distribution on

the probability of line tripping in function of its loading can become important, compared to the

influence of weather conditions.

Figure D.10: Standard deviation of the critical current in function of the standard deviation of the

critical temperature.

D.3.6 Conclusions

When the operators corrective actions are neglected, there are two main factors influencing the

critical current: the weather and the vegetation height. When only weather conditions are considered

variable, the probability distribution of the critical current looks like a Gaussian. In this case, the

main factor explaining the variability of the critical current is the wind speed. This is coherent with

the sensitivity analysis performed in [102], which shows that “the wind velocity plays a crucial role

in the thermal balance of overhead conductors”. The impact of the latter is difficult to establish

because the statistical distribution of the vegetation height below overhead lines does to seem to

be already studied. However, when one considers a credible range of variation, its influence seems

5A standard deviation equal to 0.5 meter means that the probability to find the vegetation height in an interval

of 1 meter centered on the mean is equal to 0.95.

156


Figure D.11: Standard deviation of the critical current in function of the standard deviation of the

vegetation height.

to be on the same order of magnitude of the weather’s influence. Consequently, we think that the

vegetation height distribution below overhead power lines should be studied.

D.4 Numerical results

D.4.1 Test systems

The first test system is an adaptation of the Kundur’s two-area test system [14] with some lines

doubled. The modified network is shown in Figure D.12. It is nearly the same that the one presented

in Appendix B.2, but not completely. The second test system is a adaptation of a reduced-order

Figure D.12: Mini Test System. Adapted from [14].

equivalent of the interconnected New England Test System (NETS) and New York Power System

(NYPS) with three other neighboring regions. It is the same that the one presented in Appendix

B.1. The modified network is shown in Figure D.13.

D.4.2 Models used

In Subsection D.2.1, we presented three behaviors of the evolution of the probability of tripping

in function of (over)load: linear, exponential and normal cdf. We propose to generalize the linear

and exponential models in the following way:

• If the load is lower than a parameter k1, the thermal probability of failure is null.

• If the load is higher than a parameter k2, the thermal probability of failure is equal to one.

• If the load is between k1 and k2, the thermal probability of failure evolves between 0 and 1

according to the corresponding law.

157


Figure D.13: Blackout Test System.

Consequently, the mathematical formulations of the thermal probability of failure are

Pth(x) =

0 for 0 ≤ x ≤ k1

2x−k1k2−k1 − 1 for k1 < x < k2

1 for x ≥ k2

(D.27)

for the exponential model,

Pth(x) =

0 for 0 ≤ x ≤ k1x−k1k2−k1 for k1 < x < k2

1 for x ≥ k2

(D.28)

for the linear model, and

Pth(x) = Φ

(x− µσ

)(D.29)

for the normal cdf model.

D.4.3 Modeling assumptions

In order to improve the efficiency of the simulation, we will use some simplifications:

• For the vegetation height, we will choose a unique distance between lines suspension points and

vegetation for all lines and all histories. This distance is such that the probability of having a

short circuit with the ground in a normal situation (no contingency) is 10−x for the Mini Test

System and 10−y for the BOTS.

• For the electrical instability of the system, we consider only voltage and frequency instabilities.

• Average failure rates are taken as their nominal values in nominal conditions.

• In order to model the fact that the system is put back in a secure state after a period of time,

we consider the system thermally stable if there is no new contingency during T = 60min.

In particular, this implies that the probability to have a line failure independent of its load is

given by

Pind = 1− exp(−λT ) (D.30)

where λ is the average failure rate of the line. For both test systems and all lines, λ = 1hr, so

Pind = 1.1416× 10−4. We call “weak corrective actions model” a model which considers only

this fact for operators corrective actions.

158


• Initial conditions (load pattern and climatic conditions, sampled at the beginning of each

history) are kept constant during each history.

D.4.4 Mini Test System - weak corrective actions model

The probability of a line tripping in function of its load given by dynamic PRA level-I methodology

is given in Figure D.14. Even if this is a monotonically increasing function of the load, saturating at

1, the behavior does not seem to reflect perfectly one of the proposed models. In order to estimate

what could be the best model, we proposed to find “best parameters” for each model and to compare

the different mean absolute percentage error (MAPE). The “best parameters” are the parameters

minimizing the MAPE under the constraint that they give the same total frequency of dangerous

scenarios as the dynamic PRA level-I methodology. They are given in Table D.2. These three models

are shown in Figure D.15. Even if the MAPE are similar, the exponential model seems graphically

to fit better results: the two others models, and particularly the linear, fit very well some points but

very bad other points.

Figure D.14: Probability of line tripping in function of load - Mini Test System.

Model Parameter 1 Parameter 2 MAPE

Exponential k1 = 80.5% k2 = 193.1% 31%

Linear k1 = 89% k2 = 14250% 35%

Normal cdf µ = 229.5% σ = 38.9% 39%

Table D.2: Best parameters for the Mini Test System.

Figure D.15: Three models for the probability of line tripping in function of load - Mini Test System.

159


D.4.5 Blackout Test System - weak corrective actions model

The probability of a line tripping in function of its load given by dynamic PRA level-I methodology

is given in Figure D.16. It is globally increasing function of the load, saturating at 1. However, the

Figure D.16 does not show a perfectly monotonically increasing function, because the statistic is

bad for high loads. The best parameters for the three models are given in Table D.3. These models

are shown in Figure D.17. Graphically, two models seem to be convenient: the exponential one and

the normal cdf one. The MAPE of the exponential model is slightly lower. The linear model does

not give good results compared to the two others.

Figure D.16: Probability of line tripping in function of load - Blackout Test System.


Exponential k1 = 66% k2 = 160% 20%

Linear k1 = 116% k2 = 187% 34%

Normal cdf µ = 158% σ = 20.7% 22%

Table D.3: Best parameters for the Blackout Test System.

Figure D.17: Three models for the probability of line tripping in function of load - Blackout Test

System.

D.4.6 Mini Test System - strong corrective actions model

In addition with the fact that the system is considered thermally stable if there is no new contin-

gency during T = 60min, we propose to model the elimination of lines’ overloads by the operators

in the following way. If a the load of a line between buses 5-6 or 10-11 is higher than 90% of its

nominal current (due to the trip of the other line between the same buses), the operators can relieve

160


this overload by decreasing the generation in power plant 1 or 3 and increasing the generation in

power plant 2 or 4, respectively,

• After 10 minutes with a probability of 0.1,




• After 30 minutes with a probability of 0.1.

The probability to fail to relieve the overload is then 0.2. The probability of a line tripping in

function of its load given by dynamic PRA level-I methodology in such a case is given in Figure

D.18. Compared to the Figure D.14, we can observe that the relieving of overloads with the model

proposed reduces probability of line trips. This reduction is higher for low overloads and is negligible

after approximately 150%. This fact can be explained by the competition between thermal transients

and operators corrective actions: at high overload, the critical temperature is reached so fast that

operators have not the time to change the generation in order to relieve the overload. The best

parameters for the three models are given in Table D.4. These models are shown in Figure D.19.

None of them seems to be convenient: they are not able to reproduce a increasing rate of the

probability low for weak overloads and high for strong overload. The exponential model can be

easily adapted to take into account this behavior by using the formula

Pth(x) =

0 for 0 ≤ x ≤ k1

2

(x−k1k2−k1

)α− 1 for k1 < x < k2

1 for x ≥ k2

, (D.31)

where α ≥ 1. For example, if we choose α = 2, the minimum MAPE is equal to 27% and is

reached when (k1, k2) = (65, 179). This model is shown in Figure D.19 and graphically seems to be

convenient. Therefore, we suggest to use this extended exponential model to include the effect of

operators’ actions. The exponent α is is even greater that operators take actions quickly.

Figure D.18: Probability of line tripping in function of load - Mini Test System with strong corrective

actions model.


Exponential k1 = 72% k2 = 301% 38%

Linear k1 = 80% k2 = 69500% 39%

Normal cdf µ = 316% σ = 60.7% 39%

Table D.4: Best parameters for the Mini Test System with strong corrective actions model.

161


Figure D.19: Four models for the probability of line tripping in function of load - Mini Test System

with strong corrective actions model.

D.5 Conclusions

Line outages due to overload are often the main contributors to the cascading failures. Indeed,

the more a line is overloaded, the larger is its sagging, and hence the probability that it will be

tripped due to a short-circuit with the ground (e.g. tree flashover). It is necessary to quantify in a

realistic way the probability of trip as a function of the load in order to compute a good estimation

of the frequency of dangerous cascading outages. We reminded in this paper that several models

were proposed for this purpose, but none of them is backed up by empirical evidence or detailed

analysis. Then, we studied factors that could affect the probability of trip as a function of load. We

showed that, among climatic conditions, the wind speed has a great impact on the variability of the

tripping current, and so on the probability of trip as a function of load. The statistical distribution

of the vegetation height below overhead lines could also has an important impact on the tripping

current. Unfortunately, no data seems to exist on that. Finally, we computed this probability for

two different test systems using a temperature simulation based methodology, called dynamic PRA

level-I analysis. We showed that the extended exponential model seems to be the most convenient,

as it is the most resilient.

162

Bibliography

[1] Terna. Annual reports 2007-2011. http://www.terna.it/.

[2] Investigation Committee of UCTE. Final report of the investigation committee on the 28

September 2003 blackout in Italy. Technical report, UCTE, 2004.

[3] U.S.-Canada Power System Outage Task Force. Final report on the August 14, 2003 blackout

in the United States and Canada. Technical report, 2004.

[4] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. A level-1 probabilistic risk

assessment to blackout hazard in transmission power systems. Reliability Engineering & System

Safety, 102(0):41 – 52, 2012.

[5] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Blackout probabilistic risk

assessment and thermal effects: impacts of changes in generation. IEEE Transactions on

Power Systems, PP(99):1–10, 2013.

[6] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Towards an integrated

probabilistic analysis of the blackout risk in transmission power systems. In Proceedings of

the ANS PSA 2011 International Topical Meeting on Probabilistic Safety Assessment and

Analysis, Wilmington, NC, USA, 2011.

[7] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Role of thermal effects in

blackout probabilistic risk assessment. In 2011 IEEE Electrical Power and Energy Conference

(IEEE EPEC 2011), pages 266–271, Winnipeg, Canada, October 2011.

[8] Pierre Henneaux, Pierre-Etienne Labeau, and Jean-Claude Maun. Blackout pra based iden-

tification of critical initial conditions and contingencies. In 12th International Conference

on Probabilistic Methods Applied to Power Systems (PMAPS 2012), pages 50–54, Istanbul,

Turkey, June 2012.

[9] Pierre Henneaux, Farshid Faghihi, Pierre-Etienne Labeau, and Jean-Claude Maun. Towards a

3-level blackout probabilistic risk assessment: achievements and challenges. In Proceedings of

the IEEE Power & Energy Society General Meeting 2013, Vancouver, BC, Canada, July 2013.

[10] Antonio Gomez Exposito, Antonio J Conejo, and Claudio Canizare. Electric Energy Systems:

Analysis and Operation. CRC Press, 2009.

[11] Roy Billinton and Ronald N. Allan. Reliability evaluation of power systems. Plenum Press,

1996.

[12] RTE Reseau de Transport d’Electricite. Media gallery of the RTE website. http://www.

rte-france.com/en/mediatheque - 12th of July, 2013.

[13] Michel Pays. Cables de transport d’energie. technologies. caracteristiques. Technical Report

D 4 520, Techniques de l’Ingenieur, 1994.

163

http://www.terna.it/

http://www.rte-france.com/en/mediatheque

http://www.rte-france.com/en/mediatheque

BIBLIOGRAPHY

[14] Prabha Kundur. Power System Stability and Control. McGraw-Hill, 1994.

[15] Thierry Van Cutsem and Costas Vournas. Voltage stability of electric power systems, volume

441. Springer, 1998.

[16] Benjamin Genet. On monitoring methods and load modeling to improve voltage stability as-

sessment efficiency. PhD thesis, Universite libre de Bruxelles, 2009.

[17] P.M. Anderson. Power System Protection. Wiley-Interscience, 1999.

[18] Stanley H. Horowitz and Arun G. Phadke. Power system relaying. Research Studies Press

Limited. John Wiley & Sons, 2008.

[19] P. Kundur, J. Paserba, V. Ajjarapu, G. Andersson, A. Bose, C. Canizares, N. Hatziargyriou,

D. Hill, A. Stankovic, C. Taylor, T. Van Cutsem, and V. Vittal. Definition and classification

of power system stability ieee/cigre joint task force on stability terms and definitions. Power

Systems, IEEE Transactions on, 19(3):1387–1401, 2004.

[20] ENTSO-E. Draft Network Code for Operational Security, 2012.

[21] Marko Cepin. Assessment of Power System Reliability – Methods and Applications. Springer

Verlag, 2011.

[22] Disturbance Analysis Working Group of the NERC. Review of selected 1996 electric system

disturbances in North America. Technical report, North American Electric Reliability Council,

2002.

[23] S. Larsson and A. Danell. The black-out in southern Sweden and eastern Denmark, September

23, 2003. In Proceedings of the 2006 IEEE PES Power Systems Conference and Exposition,

PSCE 2006, pages 309–313, 2006.

[24] Investigation Committee of UCTE. Final report - system disturbance on 4 November 2006.

Technical report, UCTE, 2007.

[25] S. Tamronglak, S.H. Horowitz, A.G. Phadke, and J.S. Thorp. Anatomy of power system

blackouts: Preventive relaying strategies. IEEE Transactions on Power Delivery, 11(2):708–

714, 1996.

[26] Wei Lu, Yvon Besanger, Eric Zamaı, and Daniel Radu. Blackouts: Description, analysis and

classification. In Proceedings of the 6th WSEAS International Conference on Power Systems,

Lisbon, Portugal, 2006.

[27] International Electrotechnical Commission. Iec 60050 - international electrotechnical vocabu-

lary. http://www.electropedia.org/ - 14th of July, 2013.

[28] Hiromitsu Kumamoto and Ernest J. Henley. Probabilistic risk assessment and management

for engineers and scientists. IEEE Press, 1996.

[29] Oxford University Press. Oxford advanced learner’s dictionary of current English, seventh

edition edition, 2005.

[30] International Nuclear Safety Advisory Group. Basic safety principles for nuclear power plants

- insag-3. Technical report, IAEA, 1988.

[31] International Nuclear Safety Advisory Group. Defence in depth in nuclear safety - insag-10.

Technical report, IAEA, 1996.

[32] David Bodansky. Nuclear Energy - Principles, Practices, and Prospects. Springer, 2005.

164

http://www.electropedia.org/

BIBLIOGRAPHY

[33] U.S. Nuclear Regulatory Commission (NRC). An approach for determining the technical ad-

equacy of probabilistic risk assessment results for risk-informed activities - Regulatory Guide

1.200, 2009.

[34] W. Li. Risk Assessment Of Power Systems: Models, Methods, and Applications. IEEE Press

Series on Power Engineering. John Wiley & Sons, 2005.

[35] Mario Lefebvre. Applied Probability and Statistics. Springer, 2006.

[36] Jacques Devooght and Carol Smidts. Probabilistic dynamics as a tool for dynamic PSA.

Reliability Engineering & System Safety, 52(3):185 – 196, 1996.

[37] Jacques Devooght and Carol Smidts. Probabilistic dynamics; the mathematical and computing

problems ahead. In Reliability and Safety Assessment of Dynamic Process Systems, volume

120 of NATO ASI Series F, pages 85–100. Springer-Verlag, 1994.

[38] Power Systems Engineering Committee. Reliability indices for use in bulk power supply ade-

quacy evaluation. IEEE Transactions on Power Apparatus and Systems, PAS-97(4):1097–1103,

1978.

[39] Tractebel Engineering GDF Suez. SCANNER - probabilistic tool. http://www.eurostag.

be/en/products/other-compatible-products/scanner/scanner-probabilistic-tool/ -

12th of July, 2013.

[40] DIgSILENT GmbH. DIgSILENT PowerFactory Version 15 - User Manual, 2013.

[41] I. Dobson, B. A. Carreras, and D. E. Newman. A loading-dependent model of probabilistic

cascading failure. Probability in the Engineering and Informational Sciences, 19(1):15–32,

2005.

[42] B.A. Carreras, V.E. Lynch, I. Dobson, and D.E. Newman. Critical points and transitions in

an electric power transmission model for cascading failure blackouts. Chaos, 12(4):985–994,

2002.

[43] Benjamin A. Carreras, David E. Newman, Ian Dobson, and Naga S. Degala. Validating OPA

with WECC data. In Proceedings of the 46th Hawaii International Conference on System

Sciences (HICSS), pages 2197–2204, 2013.

[44] Junjian Qi, Shengwei Mei, and Feng Liu. Blackout model considering slow process. IEEE

Transactions on Power Systems, 23(8):3274 – 3282, 2013.

[45] EPRI. TRELSS Application Manual: For Cascading Failure, Reliability and Deterministic

Analysis, 2003. Palo Alto, CA, 1002637.

[46] Mario A. Rios, Daniel S. Kirschen, Dilan Jayaweera, Dusko P. Nedic, and Ron N. Allan. Value

of security: Modeling time-dependent phenomena and weather conditions. IEEE Transactions

on Power Systems, 17(3):543 – 548, 2002.

[47] M. Anghel, K.A. Werley, and A.E. Motter. Stochastic model for power grid dynamics. In Pro-

ceedings of the 40th Annual Hawaii International Conference on System Sciences (HICSS’07),

page 113, Washington, DC, USA, 2007. IEEE Computer Society.

[48] Andrija Volkanovski, Marko Cepin, and Borut Mavko. Application of the fault tree analysis

for assessment of power system reliability. Reliability Engineering & System Safety, 94(6):1116

– 1127, 2009.

165

http://www.eurostag.be/en/products/other-compatible-products/scanner/scanner-probabilistic-tool/

http://www.eurostag.be/en/products/other-compatible-products/scanner/scanner-probabilistic-tool/

BIBLIOGRAPHY

[49] M. Vaiman, K. Bell, Y. Chen, B. Chowdhury, I. Dobson, P. Hines, M. Papic, S. Miller, and

P. Zhang. Risk assessment of cascading outages: Methodologies and challenges. IEEE Trans-

actions on Power Systems, 27(2):631–641, 2012.

[50] Dusko P. Nedic. Simulation Of Large System Disturbances. PhD thesis, University of Manch-

ester Institute for Science and Technology, 2003.

[51] Liisa Haarla, Urho Pulkkinen, Mikko Koskinen, and Jussi Jyrinsalo. A method for analysing

the reliability of a transmission grid. Reliability Engineering & System Safety, 93(2):277 – 287,

2008.

[52] Liisa Haarla, Mikko Koskinen, Pierre-Etienne Labeau, and Ritva Hirvonen. Transmission Grid

Security - A PSA approach. Springer, 2011.

[53] Qiming Chen. The probability, identification, and prevention of rare events in power systems.

PhD thesis, Iowa State University, 2004.

[54] Javier Hortal and JoseM. Izquierdo. Application of the integrated safety assessment method-

ology to the protection of electric systems. Reliability Engineering & System Safety, 52(3):315

– 326, 1996.

[55] IEEE Power Engineering Society, USA. IEEE Standard for Calculating the Current-

Temperature of Bare Overhead Conductors, 2006.

[56] Tony Weekes, Tom Molinski, and Glenn Swift. Transient transformer overload ratings and

protection. IEEE Electrical Insulation Magazine, 20(2):32 – 35, 2004.

[57] Friedrich Kiessling, Peter Nefzger, and Joao Felix Nolasco adn Ulf Kaintzyk. Overhead Power

Lines. Springer, 2003.

[58] A. F. Brandao. A model for substation reliability analysis including overload effects. Interna-

tional Journal of Electrical Power & Energy Systems, 9(4):194 – 205, 1987.

[59] G. Bahder, M. Sosnowski, C. Katz, R. Eaton, and K. Klein. Electrical breakdown charac-

teristics and testing of high voltage XLPE and EPR insulated cables. IEEE Transactions on

Power Apparatus and Systems, 102(7):2173 – 2185, 1983.

[60] P. Metra, E. Occhini, and G. Portinari. High voltage cables with extruded insulation. statistical

controls and reliability evaluation. IEEE Transactions on Power Apparatus and Systems,

94(3):967 – 976, 1975.

[61] D. Fabiani and L. Simoni. Discussion on application of the weibull distribution to electrical

breakdown of insulating materials. IEEE Transactions on Dielectrics and Electrical Insulation,

12(1):11 – 16, 2005.

[62] G.H. Kaufmann and C.J. McMillen. Gas bubble studies and impulse tests on distribution

transformers during loading above nameplate rating. IEEE Transactions on Power Apparatus

and Systems, 102(8):2531 – 2542, 1983.

[63] P.E. Labeau and E. Zio. Procedures of monte carlo transport simulation for applications in

system engineering. Reliability Engineering & System Safety, 77(3):217 – 228, 2002.

[64] Georgios Papaefthymiou. Integration of Stochastic Generation in Power Systems. PhD thesis,

Technische Universiteit Delft, 2007.

[65] U.S. Nuclear Regulatory Commission (NRC). Severe Accident Risks: An Assessment for Five

U.S. Nuclear Power Plants - NUREG 1150, 1990.

166

BIBLIOGRAPHY

[66] K. Metzroth, D. Mandelli, A. Yilmaz, R. Denning, and T. Aldemir. A comparison of scenario

binning methods for dynamic probabilistic risk assessment. In Advances in Safety, Reliability

and Risk Management - Proceedings of the European Safety and Reliability Conference, ESREL

2011, pages 261–268, 2012.

[67] Diego Mandelli. Scenario clustering and dynamic probabilistic risk assessment. PhD thesis,

The Ohio State University, 2011.

[68] P. E. Labeau and J. M. Izquierdo. Modeling PSA problems - I: The stimulus-driven theory of

probabilistic dynamics. Nuclear Science and Engineering, 150(2):115–139, 2005.

[69] Farshid Faghihi, Pierre Henneaux, and Pierre-Etienne Labeau. Dynamic probabilistic risk

analysis of the fast cascade phase of large disturbances in power system. In Proceedings of the

PSAM 11 & ESREL 2012 conference, Helsinki, Finland, June 2012.

[70] G. Rogers. Power System Oscilations. The Kluwer International Series in Engineering and

Computer Science: Power Electronics and Power Systems. Kluwer Academic, 2000.

[71] C. Grigg, P. Wong, P. Albrecht, R. Allan, M. Bhavaraju, R. Billinton, Q. Chen, C. Fong,

S. Haddad, S. Kuruganty, W. Li, R. Mukerji, D. Patton, N. Rau, D. Reppen, A. Schneider,

M. Shahidehpour, and C. Singh. The IEEE reliability test system-1996. A report prepared by

the reliability test system task force of the application of probability methods subcommittee.

IEEE Transactions on Power Systems, 14(3):1010 –1020, aug 1999.

[72] Koninklijk Nederlands Meteorologisch Instituut (KNMI). Potentiele wind in neder-

land. http://www.knmi.nl/klimatologie/onderzoeksgegevens/potentiele_wind/ - 12th

of July, 2013.

[73] J. V. Seguro and T. W. Lambert. Modern estimation of the parameters of the weibull wind

speed distribution for wind energy analysis. Journal of Wind Engineering and Industrial

Aerodynamics, 85(1):75 – 84, 2000.

[74] Yaping Shao. Physics and Modelling of Wind Erosion. Springer Science, 2008.

[75] W. E. Vesely, T. C. Davis, R. S. Denning, and N. Saltos. Measures of Risk Importance And

Their Applications - NUREG/CR-3385. U.S. Nuclear Regulatory Commission (NRC), 1986.

[76] Michael C. Cheok, Gareth W. Parry, and Richard R. Sherry. Use of importance measures in

risk-informed regulatory applications. Reliability Engineering & System Safety, 60(3):213 –

226, 1998.

[77] Timothy A. Davis. UMFPACK: unsymmetric multifrontal sparse lu factorization package.

http://www.cise.ufl.edu/research/sparse/umfpack/ - 12th of July, 2013.

[78] P.M. Anderson and M. Mirheydar. A low-order system frequency response model. IEEE

Transactions on Power Systems, 5(3):720–729, 1990.

[79] Y. Yu, D. Gan, H. Wu, and Z. Han. Frequency induced risk assessment for a power sys-

tem accounting uncertainties in operation of protective equipments. International Journal of

Electrical Power & Energy Systems, 32(6):688 – 696, 2010.

[80] N. Dizdarevic, M. Majstrovic, S. Cujic Coko, N. Mandic, and J. Benovic. Causes, analysis

and countermeasures with respect to blackout in croatia on january 12, 2003. In The CRIS

International Workshop on Power System Blackout, pages 1–21, Lund, Sweden, 2004.

[81] A.G. Phadke, S.H. Horowitz, and J.S. Thorp. Anatomy of power system blackouts and pre-

ventive strategies by rational supervision and control of protection systems. Technical report,

Oak Ridge National Laboratory, 1995.

167


http://www.cise.ufl.edu/research/sparse/umfpack/

BIBLIOGRAPHY

[82] J.S. Thorp, A.G. Phadke, S.H. Horowitz, and S. Tamronglak. Anatomy of power system

disturbances: Importance sampling. International Journal of Electrical Power and Energy

Systems, 20(2):147–152, 1997.

[83] Liisa Pottonen. A method for the probabilistic security analysis of transmission grids. PhD

thesis, Helsinki University of Technology, 2005.

[84] Jarno Lamponen and Liisa Haarla. Computing dynamic instability of a power system after

relay failures. In Proceedings of the 17th Power Systems Computation Conference (PSCC),

2011.

[85] IEEE Task Force on Load Representation for Dynamic Performance. Standard load models

for power flow and dynamic performance simulation. IEEE Transactions on Power Systems,

10(3):1302–1313, Aug.

[86] D.J. Hill. Nonlinear dynamic load models with recovery for voltage stability studies. IEEE


[87] Daniel Karlsson. Voltage stability simulations using detailed models based on field measure-

ments. Technical report, Chalmers University of Technology, 1992.

[88] R.B. Duffey and Taesung Ha. The probability and timing of power system restoration. IEEE


[89] Ivan Lux and Laszlo Koblinger. Monte Carlo particle transport methods: neutron and photon

calculations. CRC Press, 1991.

[90] W. Q. Meeker and L. A. Escobar. Statistical Methods for Reliability Data. John Wiley & Sons,

Inc., 1998.

[91] Bruno Sudret. Analytical derivation of the outcrossing rate in time-variant reliability problems.

Structure and Infrastructure Engineering, 4(5):353–362, 2008.

[92] C. Andrieu-Renaud, B. Sudret, and M. Lemaire. The PHI2 method: a way to compute time-

variant reliability. Reliability Engineering & System Safety, 84(1):75 – 86, 2004. Selected

papers from ESREL 2002.

[93] Alain Pages and Michel Gondran. Fiabilite des systemes. Eyrolles, 1980.

[94] Bikash Pal and Balarko Chaudhuri. Robust Control in Power Systems. Springer, 2005.

[95] J.J. LaForest, editor. Transmission Line Reference Book. Electric Power Research Institute,

1982.

[96] IEEE recommended practice for excitation system models for power system stability studies.

IEEE Std 421.5-2005 (Revision of IEEE Std 421.5-1992), pages 1 –85, 2006.

[97] M. Zima and G. Andersson. On security criteria in power systems operation. In Proceedings

of the 2005 IEEE Power Engineering Society General Meeting, volume 3, pages 3089 – 3093,

June 2005.

[98] Jie Chen, James S. Thorp, and Ian Dobson. Cascading dynamics and mitigation assessment

in power system disturbances via a hidden failure model. International Journal of Electrical

Power & Energy Systems, 27(4):318 – 326, 2005.

[99] Stephen T. Lee. Estimating the probability of cascading outages in a power grid. In Proceedings

of the 8th Power System Computation Conference (PSCC), Jul 2008.

168

BIBLIOGRAPHY

[100] N. Bhatt, S. Sarawgi, R. O’Keefe, P. Duggan, M. Koenig, M. Leschuk, S. Lee, K. Sun, V. Kol-

luri, S. Mandal, M. Peterson, D. Brotzman, S. Hedden, E. Litvinov, S. Maslennikov, X. Luo,

E. Uzunovic, B. Fardanesh, L. Hopkins, A. Mander, K. Carman, M.Y. Vaiman, M.M. Vaiman,

and M. M. Povolotskiy. Assessing vulnerability to cascading outages. In Proceedings of the

2009 IEEE/PES Power Systems Conference and Exposition (PSCE2009), 2009.

[101] H. Wan, J.D. McCalley, and V. Vittal. Increasing thermal rating by risk analysis. IEEE


[102] Juliano S.A. Carneiro and Luca Ferrarini. A probabilistic protection against thermal overloads

of transmission lines. Electric Power Systems Research, 81(10):1874 – 1880, 2011.

169

Documents

A two-level Probabilistic Risk Assessment of cascading ...student.ulb.ac.be/~phenneau/These.pdf · l’ electricit e est disponible a ... especially about the fast cascade and failures