UE Project N Global risk assessment. RSE, Alstom Grid, City University London, JRC, SINTEF, Univ. Genoa. D. Cirio, RSE. AFTER Final Workshop

Transcription

1 F T ER UE Project N Global risk assessment RSE, Alstom Grid, City University London, JRC, SINTEF, Univ. Genoa D. Cirio, RSE AFTER Final Workshop Rome, 27 November 2014

2 Outline Background & Motivations AFTER Risk assessment tools Results & Conclusions 2

3 Severe disturbances in power systems Multiple initiating events Geographic dependencies Functional dependencies 3

4 Severe disturbances in power systems Inadvertent system response Fiber optics damaged by rodents Wrong settings of protections Circuit breaker failure Cyber security issues 4

5 Severe disturbances in power systems Cascading effects Cascading phenomena simulation with Statistical PF Model on Colombian case: 17 Oct 2013

6 Multi-layer perspective of the Power & ICT Systems 6

7 Threat classification Power External Internal Natural Human related e.g. lightnings, fires, ice/snow storms, solar storms e.g. unintentional damage by operating a crane; Sabotage, terrorism outsider errors e.g. Component faults, strained operating conditions e.g. Employee errors Malicious actions by unfaithful employees ICT External Internal Natural Human related e.g. Ice and snow, flood, Fire and high temperature, Geomagnetic storm e.g. Hacker, Sabotage, Malicious outsider 7 e.g. ICT component internal faults Operation out of range, Ageing e.g. Employee errors, Malicious actions by unfaithful employees, SW bugs

8 Results Methods and Tools Global Risk Assessment Tool (RSE) Preliminary Interdependency Analysis (PIA+) (City University) Statistical Power Flow Tool with Self- Organised Criticality (SOC) (Alstom Grid) Tool for predicting renewable power generation (Alstom Grid) 8

9 Approach: The bow tie model How to handle high impact low probability (HILP) contingencies? Risk approach => Probabilistic models 9

10 F T ER Risk of what? Initiating event(s) Loss of load Current violation Voltage instability Voltage violation Frequency instability Angle instability Cascading Uncontrolled islanding Black out Uncertainties 10

11 AFTER Global Risk Assessment tool Application contexts: Quasi on-line operation Operational planning (Security analyses in planning) From threats and component vulnerability probabilistic modeling km FULP211 FULP311 PNAP211 PNAP311 PNAP312 BLLP211 BLLP311 BLLP312 PRRP211 TIMP211 TIMP711 TIMP811 CRCP211 CRCP311 CRCP312 CRCP313 CMRP211 CMRP311 CMRP312 PTRP111 PTRP311 MSBP211 MSBP311 MSBP312 CORP211 CORP311 SFMP211 SFMP212 SFMP221 SFMP231 SFMP711 SFMP821 SFMP831 SRGP111 SRGP211 SRGP311 SRGP312 RIZN111 RIZN311 RIZN Stress distribution and vulnerability for element nr 16 of line Novelties: Threat & Vulnerability models to evaluate component failure probability Link to actual weather conditions for contingency identification Multiple, dependent contingencies Effect of hidden failure and operator delays on cascading risk Dependency of risk on forecast uncertainties (renewables & loads) FAVP211 FAVP311 FAVP km SB_B03I301 SSB1_B15Y211_PP SSB2_B15Y211_PP SB_B24Y221 SSB1_B09Q301 SSB2_B09Q301 N-1_B15Y211_B24Y221 N-1_B03I301_B09Q301 N-2_Ln_10 _Ln_36 N-2_Ln_10 _2WND_B24YT2 N-1_B24YT2 N-1_B24YT2 N-1_B01I301_B03I301 N-2_Ln_36 _2WND_B24YT2 N-3_Ln_10 _Ln_36 _2WND_B24YT2 SB_B03I301_BDP_OOS SSB1_B09Q301_stuckCB_FAULT_ON_T_B12Q212T3 SSB1_B09Q301_stuckCB_FAULT_ON_L_IQ36 SSB1_B09Q301_stuckCB_FAULT_ON_L_KQ311 SSB2_B15Y211_PP_stuckCB_FAULT_ON_L_YY27 SSB2_B15Y211_PP_stuckCB_FAULT_ON_L_YW29 SSB1_B15Y211_PP_stuckCB_FAULT_ON_L_YW28 SSB1_B15Y211_PP_stuckCB_FAULT_ON_L_YY210 SB_B03I301_stuckCB_FAULT_ON_T_B24Y224T2 SSB2_B09Q301_stuckCB_FAULT_ON_L_IQ37 SB_B03I301_stuckCB_FAULT_ON_L_IQ36 SB_B03I301_stuckCB_FAULT_ON_L_II32 SSB2_B09Q301_stuckCB_FAULT_ON_T_B11Q211T1 SB_B24Y221_BDP_OOS SB_B24Y221_stuckCB_FAULT_ON_L_YY210 SSB2_B15Y211_PP_BUSFAULT_stuckCB_L_YY27 SB_B03I301_BUSFAULT_stuckCB_T_B24Y224T2 SB_B24Y221_BUSFAULT_stuckCB_L_YY210 SB_B03I301_BUSFAULT_stuckCB_L_IQ36 SSB2_B15Y211_PP_no_signal_to_one_CB CHGP111 CHGP211 CHGP311 RAGP211 RAGP311 ANPP211 ANPP212 ANPP731 ANPP741 MLLP211 MLLP311 MLLP312 MLLP313 ISBA111 ISBA811 ISBA821 ISBA822 ISBA831 PRGP211 PRGP711 PRGP811 Angle instability Risk (dt = 10 minutes)- TOTAL Risk= db (Level O = 1e-015) through critical component identification stress variable to risk based contingency ranking 0 11

12 Threat & Vulnerability modeling Lightnings Solar storms Landslides Earthquakes ageing Human errors Malicious attacks Sabotage Theft Statistical analyses on historical data + real time monitoring systems Experts knowledge Probability of occurrence of threats Fragility curves from records and ad hoc tests Knowledge on physical protection systems Assumptions on reactions to terrorist attacks Statistical analyses on historical data Experts knowledge Vulnerability distribution function 12

13 Contingency selection Threat modeling Vulnerability modeling Calculating probability of failure for power/ict components Critical components screening (cumulative sum screening method based on probability) Defining N-1, N-k contingencies (including component dependencies) Calculation of contingency probability Calculation of ex-ante impact (i.e. prior to detailed analysis) Complete set of N-1 ctgs, some N-2 ctgs selected by operators Calculation of ex-ante risk Contingency screening based on ex-ante risk Set of contingencies for analyses 13

14 System response Quasi-static cascading engine (enhanced power flow with steady state response of regulation, protection & operator action) Event tree (hidden failure and relay setting uncertainties) Probabilistic Cascading Time domain simulation, to evaluate the dynamic response by detailed dynamic model Different time sequences of protection intervention (primary / backup) 14

15 Impact Impact & Risk indicators Indices based on immediate post-fault steady-state quantities (currents and voltages) Indices based on cascading outcome (loss of load, cost of unsupplied energy) Indices related to instability mechanisms (angle and voltage deviations) Severity function, Sev(I) Sev j, tot ( i ) Nbranches Sev j, k k= 1 = Nbranches A A nom k k= 1 Proximity base severity function continuous function N=15, M=12 ramp-wise function nom k Risk = {Contingency, Probability, Impact} Risk indicators are defined as Expected Value of Impact current, I [p.u.] e.g. Expected cost of energy not supplied 15

16 Risk assessment tool applications (I) Identifying most risky multiple contingencies in short term combining component failure probabilities complementing traditional N-1 criterion Identifying most vulnerable components in current weather/environment conditions probabilistic models of threats and component vulnerability Evaluating sensitivity of specific component parameters on the probability of failure of ICT/Power components to improve vulnerability with targeted interventions To quantify the reduction of expected costs Contingency Ranking lists Contingency ID of threat 320 magnitude km SSB2_B09Q301 N-1_B15Y211_B24Y221 N-1_B03I301_B09Q301 N-2_Ln_10 _Ln_36 N-2_Ln_10 _2WND_B24YT2 N-1_B24YT2 N-1_B24YT2 N-1_B01I301_B03I301 N-2_Ln_36 _2WND_B24YT2 N-3_Ln_10 _Ln_36 _2WND_B24YT2 SB_B03I301_BDP_OOS SSB1_B09Q301_stuckCB_FAULT_ON_T_B12Q212T3 SSB1_B09Q301_stuckCB_FAULT_ON_L_IQ36 SSB1_B09Q301_stuckCB_FAULT_ON_L_KQ311 SSB2_B15Y211_PP_stuckCB_FAULT_ON_L_YY27 SSB2_B15Y211_PP_stuckCB_FAULT_ON_L_YW29 SSB1_B15Y211_PP_stuckCB_FAULT_ON_L_YW28 SSB1_B15Y211_PP_stuckCB_FAULT_ON_L_YY210 SB_B03I301_stuckCB_FAULT_ON_T_B24Y224T2 SSB2_B09Q301_stuckCB_FAULT_ON_L_IQ37 SB_B03I301_stuckCB_FAULT_ON_L_IQ36 SB_B03I301_stuckCB_FAULT_ON_L_II32 SSB2_B09Q301_stuckCB_FAULT_ON_T_B11Q211T1 SB_B24Y221_BDP_OOS SB_B24Y221_stuckCB_FAULT_ON_L_YY210 SSB2_B15Y211_PP_BUSFAULT_stuckCB_L_YY27 SB_B03I301_BUSFAULT_stuckCB_T_B24Y224T2 SB_B24Y221_BUSFAULT_stuckCB_L_YY210 SB_B03I301_BUSFAULT_stuckCB_L_IQ36 SSB2_B15Y211_PP_no_signal_to_one_CB SSB2_B15Y211_PP_no_signal_to_one_CB SSB1_B15Y211_PP_no_signal_to_one_CB SSB1_B15Y211_PP_no_signal_to_one_CB SSB1_B09Q301_BUSFAULT_stuckCB_T_B12Q212T3 SB_B03I301_BUSFAULT_stuckCB_L_II32 SB_B24Y221_stuckCB_FAULT_ON_T_B24Y224T2 SSB1_B09Q301_BUSFAULT_stuckCB_L_IQ36 SSB2_B15Y211_PP_BUSFAULT_stuckCB_L_YW29 SSB1_B15Y211_PP_BUSFAULT_stuckCB_L_YW28 SSB1_B09Q301_BUSFAULT_stuckCB_L_KQ311 SB_B24Y221_BUSFAULT_stuckCB_T_B24Y224T2 SSB1_B15Y211_PP_BUSFAULT_stuckCB_L_YY210 SSB2_B09Q301_BUSFAULT_stuckCB_T_B11Q211T1 SSB2_B09Q301_BUSFAULT_stuckCB_L_IQ37 SB_B03I301_no_signal_to_one_CB SB_B03I301_no_signal_to_one_CB FULP211 FULP311 PNAP211 PNAP311 PNAP312 SB_B03I301 SSB1_B15Y211_PP SSB2_B15Y211_PP SB_B24Y221 SSB1_B09Q301 Spatial distribution BLLP211 BLLP311 BLLP312 PRRP211 TIMP211 TIMP711 TIMP811 CRCP211 CRCP311 CRCP312 CRCP313 CMRP211 CMRP311 CMRP FAVP211 FAVP311 FAVP312 Angle instability Risk (dt = 10 minutes)- TOTAL Risk= db (Level O = 1e-015) CHGP111 CHGP211 CHGP311 RAGP211 RAGP311 PTRP111 PTRP311 MSBP211 MSBP311 MSBP312 CORP211 CORP311 SFMP211 SFMP212 SFMP221 SFMP231 SFMP711 SFMP821 SFMP831 SRGP111 SRGP211 SRGP311 SRGP312 ANPP211 ANPP212 ANPP731 ANPP741 MLLP211 MLLP311 MLLP312 MLLP313 ISBA111 ISBA811 ISBA821 ISBA822 ISBA831 PRGP211 PRGP711 PRGP811 RIZN111 RIZN311 RIZN km Component failure probability vs threat magnitude 16

17 Risk assessment tool applications (II) Quantifying the effects of hidden failures and operators delay on the cascading risk and in the future linking the contingency probabilities to real time data from monitoring systems to improve vulnerability with targeted interventions LOL Risk Index Cumulative Curve (time interval = 10 minutes) 1% Hidden failures one path (no hidden failures) Contingency Cumulative curves for loss of load risk indicators as a function of hidden failure probability Loss of load severity [MW] - ctg: N-2_Ln_B01-B03_Ln_B03-B09 Loss of load severity of a specific N-2 contingency for different values of operators delay MW lost no control S_d1200 S_d180 S_d60 S_d30 Loss of load severity [MW] operators' delay scenario 17

18 SB_B03I301 SSB1_B15Y211_PP SSB2_B15Y211_PP SB_B24Y221 SSB1_B09Q301 SSB2_B09Q301 N-1_B15Y211_B24Y221 N-1_B03I301_B09Q301 N-2_Ln_10 _Ln_36 N-2_Ln_10 _2WND_B24YT2 N-1_B24YT2 N-2_Ln_36 _2WND_B24YT2 N-3_Ln_10 _Ln_36 _2WND_B24YT2 SB_B03I301_BDP_OOS SSB1_B09Q301_stuckCB_FAULT_ON_T_B12Q212T3 SSB1_B09Q301_stuckCB_FAULT_ON_L_IQ36 SSB1_B09Q301_stuckCB_FAULT_ON_L_KQ311 SSB2_B15Y211_PP_stuckCB_FAULT_ON_L_YY27 SSB2_B15Y211_PP_stuckCB_FAULT_ON_L_YW29 SSB1_B15Y211_PP_stuckCB_FAULT_ON_L_YW28 SSB1_B15Y211_PP_stuckCB_FAULT_ON_L_YY210 SB_B03I301_stuckCB_FAULT_ON_T_B24Y224T2 SSB2_B09Q301_stuckCB_FAULT_ON_L_IQ37 SB_B03I301_stuckCB_FAULT_ON_L_IQ36 SB_B03I301_stuckCB_FAULT_ON_L_II32 SSB2_B09Q301_stuckCB_FAULT_ON_T_B11Q211T1 SB_B24Y221_BDP_OOS SB_B24Y221_stuckCB_FAULT_ON_L_YY210 SSB2_B15Y211_PP_BUSFAULT_stuckCB_L_YY27 SB_B03I301_BUSFAULT_stuckCB_T_B24Y224T2 SB_B24Y221_BUSFAULT_stuckCB_L_YY210 SB_B03I301_BUSFAULT_stuckCB_L_IQ36 SSB2_B15Y211_PP_no_signal_to_one_CB SSB2_B15Y211_PP_no_signal_to_one_CB SSB1_B15Y211_PP_no_signal_to_one_CB SSB1_B15Y211_PP_no_signal_to_one_CB SSB1_B09Q301_BUSFAULT_stuckCB_T_B12Q212T3 SB_B03I301_BUSFAULT_stuckCB_L_II32 SB_B24Y221_stuckCB_FAULT_ON_T_B24Y224T2 SSB1_B09Q301_BUSFAULT_stuckCB_L_IQ36 SSB2_B15Y211_PP_BUSFAULT_stuckCB_L_YW29 SSB1_B15Y211_PP_BUSFAULT_stuckCB_L_YW28 SSB1_B09Q301_BUSFAULT_stuckCB_L_KQ311 SB_B24Y221_BUSFAULT_stuckCB_T_B24Y224T2 SSB1_B15Y211_PP_BUSFAULT_stuckCB_L_YY210 SSB2_B09Q301_BUSFAULT_stuckCB_T_B11Q211T1 SSB2_B09Q301_BUSFAULT_stuckCB_L_IQ37 SB_B03I301_no_signal_to_one_CB SB_B03I301_no_signal_to_one_CB Angle instability Risk (dt = 10 minutes)- TOTAL Risk= db (Level O = 1e-015) Application for control center: risk assessment of a system state (uncertainty on contingencies) Security Assessment Contingency selection Conventional security assessment N-1 s Some N-2 s Risk based security assessment N-1 s N-2 s «Risky» N-k s x 10-4 High current Risk Index Cumulative Curve (time interval = 10 minutes) ctg: N-2-Ln-10 -Ln-36 ( cum % risk: 94.3) ctg: N-1-B15Y211-B24Y221 ( cum % risk: 32.0) N-1_B24YT2 N-1_B01I301_B03I301 Contingency Contingency ID EMS On-line alert systems ctg: SB-B24Y221 ( cum % risk: 99.6) Alarms/alerts/ (suggested control actions) State Estimation / Power flow SCADA Security level requirements Power system RTU s, PMU s Control actions operator 18

19 1 0.5 CTG N-2-Ln-248 -Ln-249 : probability of overcoming the value of risk of high currents on x axis Probability of overcoming the value of total risk of high currents x 10 on -5 x axis standard deviation mean kurtosis skewness x 10-5 CTG N-2-Ln-248 -Ln skewness and kurtosis of ris k of high currents kurtosis skewness Probability of overcoming the value of total risk of low voltages on x axis x x CTG N-2-Ln-248 -Ln-249 : probability of overcoming the value of risk of low voltages on x axis standard deviation mean Probability of overcoming the value of total risk of loss of load on x axis x x 10-5 CTG N-2-Ln-248 -Ln skewness and kurtosis of risk of low voltages Application for operational planning: risk assessment of a forecast system state (uncertainty on contingencies and initial state) Conventional planning tools N-1 s subset of N-2 s Contingency selection Forecasting critical grid scenarios (weather forecasts, monitoring equipment conditions over days ) Risk based Operational planning support tool «Risky» N-k s global risk assessment AFTER tool SE k-hour ahead forecasts for RES and load x 10-3 EMS Allocate resources to preserve desired security levels Driving operational planning decisions Prob(Risk > Acceptable R*) > ε? operator Security level requirements 19

20 Risk assessment tool - Synthesis Possible to link the risk based security assessment prototype to real time monitoring systems Identification of most vulnerable components Assessment of effects of human behaviour (operators delays) on security Improved awareness of what is going on Helpful in operational planning studies to evaluate the impact of RES and load uncertainties on operational security Easy-to-intepret visualisation of results 20

21 Studies with PIA+ Risk of cyber attacks on the modelled power system Base case (no attacks) vs. system under attack cases (Adversary is active) Two modelled attacks were compared (switch off a power element vs. changing the protection threshold of a power line) Operator inspection restores the settings modified by the attacker, thus assuring correct protection response following component outages Increasing frequency of inspections Distribution of «average value of the load over a time series of operating states» Increasing frequency of inspections Distribution of «minimum supplied load over a time series of operating states» 21

22 PIA+: Validation of Complex Models If not countered by a suitable maintenance/inspection regime, the potency of attacks on line-protection thresholds tends to increase over time. In some cases, we observe an increasingly significant impact on the quality of service provided, with increasing certainty Statistical analysis of supplied load over a short time interval Increasing frequency of inspections Increasing frequency of inspections No inspection These time-series were also very useful model validation tools: unwanted statistical properties of our complex models were easily detected 22

23 Power Grid Statistical power flow tool with Self-Organised Criticality Identify the need for transmission enhancements over planning horizons, based on the analysis of sequences of operating states Power Grid + random events DC/AC Power Flow + optimization Power Grid + random events + environment (actions) Σ Line capacity = constant Σ Demand Statistical Estimation (cascading) + Decision support Feedback Improvements in operating policies, maintenance, equipment, controls, Self Organized Critical Power Flow model Universal behavior Real historical data Simulated with ideal dispatch Simulated with network dispatch Simulated with coordinated dispatch Mean line loading = constant Probability Shed power (MW)

24 Tool for predicting renewable power generation Elia NorthSeaOff-shore Windfarm Intermittent power generation Estimation of Intermittent resources Model MS(3)AR(2) & Bayesian technique Efficiency & Robustness over time resolution (from 15 mn to 1-4 hours) Exogenous variables for middle & long term forecast Input to the risk assessment (uncertainty of forecast state)

25 Conclusions From deterministic N-1 security assessment «smart» probabilistic N-k contingency analysis accounting for dependencies avoiding combinatorial explosion adapted to the current threat exposure (e.g. weather) accounting for uncertainties Power system response (hidden failures) Renewables & loads (forecast errors) Operational Risk Assessment Together with probabilistic tools for analysis of cyber risk exposure need for grid reinforcements due to security issues 25