QuantifyingResilienceofElectricityDistributionNetworkstoCyberphysical Disruptions

Devendra ShelarJointworkwithSaurabh AminandIanHiskens

December14,2017

Outline

•Motivation•Modeling• Networkmodel• Generalizeddisruptionmodel• Multi-regimeSystemOperator(defender)model

• Grid-connected,cascade,islanding

• Bilevel formulation• Bendersdecomposition

• Resourcedispatch• ControllableDGs,islandingcapabilities• Trilevelformulation– solutionapproach

2

Cyberphysical disruptions

HurricaneMaria(September2017)• Customersfacing

blackoutsformonths

3

MetcalfSubstation(April2013)• Sniperattackon17

transformers• Telecommunicationcablescut• 15million$worthofdamage• 100mn $forsecurityupgrades

Ukraineattack(Dec2015-2016)• Firsteverblackouts

causedbyhackers• Controllersdamagedfor

months

Attackscenarios

8

=>supply-demandimbalance(sudden/prolonged)

ThreeregimesofSOoperation

Distributionsubstation

𝑃"#, 𝑄"#

𝑉"#

𝑃"', 𝑄"'

𝑉"'

Transmissionnetwork

−Δ𝑉

TNleveldisturbance

Attack-inducedDNlevelsupply-demandimbalance

SOresponse

DERdisconnect-- cascade

loaddisconnect

Microgridislanding

WhenTNandDNleveldisturbancesclear,thesystemcanreturntoitsnominalregime

5

Grid-connectedregime• Canabsorbtheimpactof

disturbances

Islandingmoderegime• Largerdisturbancesmay

forcemicrogrid islanding

Cascaderegime• Highseverityvoltage

excursions,thenmoreDERdisconnects(cascades),moreloadshedding

Ourapproach

Mostattacker-defenderinteractionscanbemodeledas• Supply-demandimbalanceinducedbyattacker• Control(reactiveandproactive)bythesystemoperator

• Abstraction:Bilevel (ormultilevel)optimizationproblems• Flexibletoallowforbothcontinuousanddiscretevariables• Goodsolutionapproaches:Duality,KKTconditions,Benderscut,MILP• Providepracticallyusefulinsightstodeterminecriticalscenarios

• Supplementssimulationbasedapproaches• Forexample,co-simulationofcyberandpowersimulators

Ourcontributions

Bilevel problem

Regime?

7

[1]Shelar D.andAmin.S- "SecurityassessmentofelectricitydistributionnetworksunderDERnodecompromises”[2]Shelar D.,Amin.SandHiskens I.– “TowardsResilience-AwareResourceAllocationandDispatchinElectricityDistributionNetworks”[3]Shelar D.,SunP.,Amin.SandZonouz S.- “CompromisingSecurityofEconomicDispatchsoftware”

Attackermodel Regulationobjectives

Defendermodel

Grid-Connected regime Cascade/Islanding regimes

DERdisruptions• GreedyApproach• IEEETCNS2016[1]

DNvulnerability tosimultaneousEVovercharging [2]

SecurityofEconomicDispatch• KKTbasedreformulation• DSN2017[3]

Multiple regimes• Innerproblem:mixed-integervars• Bendersdecomposition

RelatedWork(partial)(T1)Interdictionandcascadingfailureanalysisofpowergrids• R.Baldick,K.Wood,D.Bienstock:NetworkInterdiction,Cascades• A.Verma,D.Bienstock:N-kvulnerabilityproblem• D.Papageorgiou,R.Alvarez,etal.:Powernetworkdefense• X.Wu,A.Conejo:GridDefensePlanning

(T2)Cyber-physicalsecurityofnetworkedcontrolsystems• E.Bitar,K.Poolla,AGiani:Dataintegrity,Observability• H.Sandberg,K.Johansson:Securecontrol,networkedcontrol• B.Sinopoli,J.Hespanha:Secureestimationanddiagnosis• T.Basar,C.Langbort:Networksecuritygames

8

NetworkmodelPowerflowontreenetworks- Baran andWumodel(1989):• 𝒢 = (𝒩, ℰ)– treenetworkofnodesandedges• 𝑝𝑐2 , 𝑞𝑐2 - realandreactivenominalpowerdemandatnode𝑖• 𝑝𝑔2, 𝑞𝑔2 - realandreactivenominalpowerfromuncontrollablegenerationatnode𝑖

• 𝑉2- voltagemagnitudeatnode𝑖• z28 = r28 + 𝐣x28 - impedanceonline(𝑖, 𝑗)• 𝑃28, 𝑄28 - realandreactivepowerfromnode𝑖 to node𝑗• 𝑝2, 𝑞2 - netrealandreactivepowerconsumedatnode𝑖

9

GeneralizeddisruptionmodelAttackerstrategy:𝑎 = 𝛿, 𝑝𝑑A,𝑞𝑑A, Δ𝑉"• 𝛿:attackvector,with𝛿2 = 1 ifnode𝑖 isattackedand0otherwise• Satisfy∑ 𝛿22 ≤ 𝑀 (attacker’sresourcebudget)

• 𝑝𝑑2A, 𝑞𝑑2A - attacker’sactive/reactivepowerdisturbanceatnode𝑖(generalmodel:capturesvariousattackscenarios)

• Δ𝑉": voltagedropatsubstationnode• DuetophysicaldisturbanceortemporaryfaultintheTN

Attackerstrategy:• Whichnodestocompromise?• Whatset-pointstochoose?

10

Defendermodel:Grid-connectedregime

Defenderresponse:𝑑 = 𝛽

• 𝛽2 ∈ 𝛽2,1 :loadcontrolparameteratnode𝑖• 𝑝𝑐2 = 𝛽2𝑝𝑐2, 𝑞𝑐2 = 𝛽2𝑞𝑐2

Defenderresponse:Howmuchloadcontrolshouldbeexercised? 11

𝑝𝑐2 , 𝑞𝑐2 - nominalpowerdemandatnode𝑖

Defendermodel:Cascaderegime

Defenderresponse:𝑑 = 𝛽, 𝑘𝑐, 𝑘𝑔

• 𝑘𝑐2 =0ifloadisconnected,1otherwise.• 𝑘𝑔2 =0ifuncontrolledDGisconnected,1otherwise.

• Voltageconstraintsforconnectivity:𝑘𝑐2 = 0 ⟹ 𝑉2 ∈ 𝑉'2,𝑉'

L2

𝑘𝑔2 = 0 ⟹ 𝑉2 ∈ 𝑉M2, 𝑉ML 2

Defenderresponse:

WhichloadsandDGstodisconnect? 12

voltageboundsforload(resp.generation)connectivity

Defendermodel:Islandingregime

Defenderresponse:𝑑 = 𝛽, 𝑘𝑐, 𝑘𝑔, 𝑝𝑟, 𝑞𝑟, 𝑘𝑚

• 𝑝𝑟, 𝑞𝑟 - dispatchofresources(DERs)• 𝑘𝑚28 =1,ifline 𝑖, 𝑗 ∈ 𝜒isopen,0otherwise.

• Microgrid formationaffectspowerflowsandvoltages:

𝑘𝑚28 = 1 ⟹ Q𝑃28 = 𝑄28 = 0𝑉8 = 𝑉RST

𝑘𝑚28 = 0 ⟹ 𝑝𝑟8 = 0, 𝑞𝑟8 = 0

Defenderresponse:

Whichlinestodisconnect? 13

𝜒 - setoflineswhichcanbedisconnectedtoformmicrogrids

Powerflowconstraintsbeforedisruption

• Netpowerconsumedatanode

• LinearPowerflows(LPF)

• Voltagedropequation

14

𝑃28 = U 𝑃8VV:8→V

+ 𝑝2

𝑄28 = U 𝑄8VV:8→V

+ 𝑞2

𝑉8 = 𝑉2 − (r28𝑃28 + x28𝑄28)

𝑝2 = 𝑝𝑐2 − 𝑝𝑔2𝑞2 = 𝑞𝑐2 − 𝑞𝑔2

𝑉" = 𝑉"RST

Powerflowconstraintsafterdisruption

• Netpowerconsumedatanode

• LinearPowerflows(LPF)

• Voltagedropequation

15

𝑃28 = U 𝑃8VV:8→V

+ 𝑝2

𝑄28 = U 𝑄8VV:8→V

+ 𝑞2

𝑉8 = 𝑉2 − (r28𝑃28 + x28𝑄28)

𝑝2 = 𝑝𝑐2 − 𝑝𝑔2 + 𝛿2𝑝𝑑A2⋆

𝑞2 = 𝑞𝑐2 − 𝑞𝑔2 + 𝛿2𝑞𝑑A2⋆

𝑉" = 𝑉"RST − Δ𝑉"

PowerflowconstraintsafterSOdispatch

• Netpowerconsumedatanode

• LinearPowerflows(LPF)

• Voltagedropequation

16

𝑃28 = U 𝑃8VV:8→V

+ 𝑝2

𝑄28 = U 𝑄8VV:8→V

+ 𝑞2

𝑉8 = 𝑉2 − (r28𝑃28 + x28𝑄28)

𝑝2 = 𝑝𝑐2 − 𝑝𝑔2 + 𝛿2𝑝𝑑A2⋆ − 𝑝𝑟2

𝑞2 = 𝑞𝑐2 − 𝑞𝑔2 + 𝛿2𝑞𝑑A2⋆ − 𝑞𝑟2

𝑉" = 𝑉"#YZ − Δ𝑉"

Losses

Costofactivepowersupply:

Lossofvoltageregulation:where𝑡2 ≥ 𝑉2 − 𝑉RST

Costincurredduetoloadcontrol:

LossinGrid-Connectedregime:

17

𝐿^_ 𝑥 ≡ 𝑊cd𝑃"

𝐿ef 𝑥 ≡ 𝑊efU𝑡22∈g

,

𝐿h_ 𝑥 ≡U𝑊h_,2(1 − 𝛽2)2∈g

𝐿idjkM2Zk 𝑥 = 𝐿^_ 𝑥 + 𝐿ef 𝑥 + 𝐿h_(𝑥)

Attacker-Defenderproblem[AD] - Bilevel formulation

AD ℒ ∶= maxA∈𝒜

minw∈𝒟

𝐿y_z{|}T{ 𝑥 𝑎, 𝑑

• Powerflows,DERcapabilities,voltagebounds• Defendermodel(resourcesandcapabilities)• Attackermodel(resourcesandcapabilities)

18

SystemState𝑥 = (𝑝, 𝑞, 𝑃, 𝑄, 𝑉)

Attacker-Defenderproblem[AD] – Cascaderegime

AD ℒ ∶= maxA∈𝒜

minw∈𝒟

𝐿_~z{|}T{ 𝑥 𝑎, 𝑑

• Powerflows,DERcapabilities,voltagebounds• Defendermodel(resourcesandcapabilities)• Attackermodel(resourcesandcapabilities)

19

Where 𝐿_~z{|}T{ 𝑥 ≡ 𝐿y_z{|}T{ 𝑥 + 𝐿~� 𝑥• Costofloadshedding

𝐿~� 𝑥 ≡ U𝑊~�,2𝑘𝑐22∈𝒩

• 𝑊~�,2 :costofunitloadshedding

Attacker-Defenderproblem[AD] – Islandingregime

AD ℒ ∶= maxA∈𝒜

minw∈𝒟

𝐿��z{|}T{ 𝑥 𝑎, 𝑑

• Powerflows,DERcapabilities,voltagebounds• Defendermodel(resourcesandcapabilities)• Attackermodel(resourcesandcapabilities)

20

Where𝐿��z{|}T{ 𝑥 ≡ 𝐿y_z{|}T{ 𝑥 + 𝐿�y 𝑥• Costofmicrogrid islanding

𝐿�y 𝑥 ≡ U 𝑊�y,28𝑘𝑚28(2,8)∈�

• 𝑊�y,28 :costofasinglemicrogrid islandformationatnode𝑗

Benderscutapproach

2

5

6

7

8 12

11

9

1

0

3

4

10

21

ComputationalresultsforCascaderegime

22

𝑝𝑑A⋆

𝑠𝑟L

Loadsheddingvs����

23

Noresponse- (multi-round)cascade

Worst-caselossundernodefenderresponse

Analgorithm• Initialcontingency• Forr=1,2,…• Computenewpowerflows• DetermineasingleloadsorDGthatmaximallyviolatesitsvoltagebounds• Disconnectthatdeviceaccordingly

24

OnlinevsSequentialvsIslanding

25

ValueoftimelydisconnectionsValueoftimelyIslanding

DefenderResponseandAllocation:Diversification

• SomeDERscontributeto𝐿efmorethan𝐿^_,andviceversa

26

2

5

6

7

8 12

11

9

1

0

3

4

10

Left lateral (l)

AC > V R

Right lateral (r)

V R > AC

Attacked

nodes

Specialcaseof𝜒 = 0,1

DefenderResponseandAllocation:Diversification

• Diversificationholdsfor“heterogeneousallocation”withdownstreamDERswithmorereactivepower

27

2

5

6

7

8 12

11

9

1

0

3

4

10

Left lateral (l)

AC > V R

Right lateral (r)

V R > AC

Attacked

nodes

• Post-contingencylossesarethesameforuniformvs.heterogeneousresourceallocations

• Pre-contingencyvoltageprofileisbetterforheterogeneousresourceallocation

Heterogeneousresourceallocationcansupportmoreloadsthanuniformone.

DefenderResponseandAllocation:Diversification

28

2

5

6

7

8 12

11

9

1

0

3

4

10

Left lateral (l)

AC > V R

Right lateral (r)

V R > AC

Attacked

nodes

Bigpicture:Wheredoesitallfit?

minj∈ℛ

𝐶A��Y' 𝑥Y 𝑟 + maxA∈𝒜

minw∈𝒟

𝐿 𝑥' 𝑟, 𝑎, 𝑑

• Powerflows,DERcapabilities,voltagebounds• Defendermodel(resourcesandcapabilities)• Attackermodel(resourcesandcapabilities)

Resilience-AwareOptimalPowerFlow(RAOPF)

29

Voltagedeviationmodel𝑉#YZ − 𝑉"' = −𝑉jkM 𝑃"Y − 𝑃"'

Frequencydeviationmodel𝑓#YZ − 𝑓' = −𝑓jkM 𝑄"Y − 𝑄"'

Pre-contingencyresourceallocation𝑟 = (𝑝𝑟Y, 𝑞𝑟Y)

30

Resiliency-AwareOPF- Trilevelformulation

Finalexample:DNresiliencyisindeedimportant

31

DN1

DN2

DN3

DN4

60MW

60MW

60MW

60MW

𝐺�

𝐺� 240MW

120MW

DN1

DN2

DN3

DN4

60MW

60MW

60MW

60MW

𝐺�

𝐺�

120MW

120MW

0MW

𝑃� = 80MW

𝑃� = 80MW

DN1

DN2

DN3

DN4

30MW

30MW

30MW

30MW

𝐺�

𝐺�

40MW

80MW

• Normaloperatingscenario

• Lightningstrikes- recloser openstemporarily

• VoltagedropsattheDNsubstations

• Microgrid islandingreducesnetload

• InfeasiblepowerflowinTN

Summary• ResourceallocationanddispatchinelectricityDNs

• understrategiccyber-physicalfailures• trilevelmixed-integerformulation

• Multi-regimedefenderresponse• ApplicationofBenderscutapproachforsolvingbilevel MILPs• Structuralresultsonworst-caseattacksandtradeoffsfordefenderresponse

Futurework• Designofdecentralizeddefenderresponseusingmessagepassing• Powerrestorationovermultipletimeperiods

32

Optimalattackerset-pointsTypically,

• Smalllinelosses:incomparisontopowerflows

• Smallimpedances:sufficientlysmalllineresistances

Assumeforsimplicity:

• Noreversepowerflows:powerflowsfromsubstationtodownstream

33

Whatareoptimalattackerset-points?

Proposition:Foradefenderaction𝜙,andgivenattackerchoiceof𝛿,theoptimalattackerdisturbanceisgivenby:

𝑝𝑑A⋆ = 𝑝𝑔2Y, 𝑞𝑑A⋆ = 𝑞𝑔2Y + 𝒔𝒈𝒊 (incaseofattackonDERs)

𝑝𝑑A⋆ = 𝑝𝑐𝑒2Y, 𝑞𝑑A⋆ = 𝑞𝑐𝑒2Y (incaseofattackonEVs)

Benderscutapproach

Proposition(Bienstock 2009)Optimalvalueattackproblemforafixedattack cardinality isequivalenttoaminimumcardinalityattackproblemforafixedtargetlossvalue.

34

Benderscutapproach

AttackerMasterproblem• Initializewithnocuts

min U𝛿22

s. t. cuts𝛿2 ∈ {0,1}

Defenderproblem

minw∈𝒟

𝐿(𝑥)s.t.• Powerflows,DERcapabilities,voltagebounds• Defendermodel(resourcesandcapabilities)

Optimalvalueattack problemforafixedattackcardinality isequivalenttoaminimumcardinalityattack problemforafixedtargetloss value.

𝐿�AjMk� :minimumlossthattheattackerwantstoinflictuponthedefender

35

Benderscut• Let𝛿2�kj befixedattackerstrategyforcurrentiteration• Let𝜙�(resp.𝜙d)denoteadefenderresponsewithfixedintegervariables• Thentheinnerproblembecomesalinearprogram(LP)

min 𝑐�𝑦

𝐶𝑦 = 𝑑 + 𝑄𝛿2�kj𝑠. 𝑡. 𝐴𝑦 ≥ 𝑏

𝐿𝑃 𝛿2�kj, 𝜙� ≡

• Let(𝜆⋆, 𝛼⋆)betheoptimaldualvariablesolutiontothisLP.Benderscutisgivenby:𝜆⋆�𝑏 + 𝛼⋆� 𝑑 + 𝑄𝛿 ≥ 𝐿�AjMk�

• Thiscuteliminates𝛿2�kj fromfeasiblespaceofattackerstrategies 36

Controllabledistributedgenerationmodel

pr

qr

qr

Reactive power

Real

power

Reactive power

pr

qr

qr

Real

power

sr

37

0 ≤ 𝑝𝑟2 ≤ 𝑝𝑟2,𝑝𝑟2� + 𝑞𝑟2� ≤ 𝑠𝑟L2�𝑝𝑟2 - maximumactivepowercapacity𝑠𝑟L2 - apparentpowercapabilityofinverter

Polytopicmodelusedforcomputationalsimplicity

UncontrolledcascadevsSequential

38

Valueoftimelyresponse

N=37nodes

Microgrid islandformation

2

5

6

7

8 12

11

9

1

0

3

4

10

2

5

6

7

8 12

11

9

1

0

3

4

10

2

5

6

7

8 12

11

9

1

0

3

4

10

• 𝜒 = 0,1 , 4,5 , 4,9• 3outof8= 2 � possibleconfigurations– 13nodenetwork

39

Linearpowerflowsafterdispatch

𝑝2 = 𝑝𝑐2 − 𝑝𝑔2 − 𝑝𝑟2 + 𝛿2𝑝𝑑A2⋆

𝑞2 = 𝑞𝑐2 − 𝑞𝑔2 − 𝑞𝑟2 + 𝛿2𝑞𝑑A2⋆Netpowerconsumedatanode𝑖

Powerflowonline𝑖 → 𝑗

Voltagedropequations

40

𝑉" = 𝑉"Y − Δ𝜈

𝑃28 = U 𝑃8VV:8→V

+ 𝑝2

𝑄28 = U 𝑄8VV:8→V

+ 𝑞2

𝑉8 = 𝑉2 −(𝑟28𝑃28 + 𝑥28𝑄28)

Islandingregime(cont’d)Updatedconstraints

• An(emergency)distributedgeneratorisstartedatnode𝑗 inamicrogrid island𝑝𝑟8 ≤ 𝑠𝑟L8𝑘𝑚28𝑞𝑟 ≤ 𝑠𝑟L8𝑘𝑚28

Where𝑝𝑟8 ,𝑞𝑟8 isactiveandreactivepoweroutput;𝑠𝑟L8 istheapparentpowercapabilityoftheemergencygeneratoratnode𝑗

• Thenetpowerflowintothenode𝑗 fromthesubstationis0,i.e.𝑘𝑚28 = 1 ⟹ 𝑃28 = 𝑄28 = 0

• Thenodalvoltageatnode𝑗 isthenominalvoltage,

𝑉8 = Q𝑉2 − 𝑟28𝑃28 + 𝑥28𝑄28 , if𝑘𝑚28 = 0𝑉RST, otherwise.

41

What’snext?

42

•Whatisagoodresiliencymetric?• AllowableΔ 𝑉, 𝑝, 𝑞 withoutexceedingtarget20%𝐿µ¶

•Generalcase 𝜒 > 1• Diversification?• SolutionapproachforRAOPF(trilevel)?

Resiliency-awareResourceAllocation

StageII- Adversarialnodedisruptionsa. Whichnodestocompromise(𝛿)?b. Set-pointmanipulation(𝑠𝑝A)?

StageI- AllocationofDERsoverradialnetworksa. Sizeandlocationb. Activeandreactivepowersetpoints (𝑥#)?

StageIII- Optimaldispatch/response(𝑥')a. Maintainvoltageb. Exerciseloadcontrolornot

Goals:1. Determinethebestresourceallocation2. Identifyvulnerable/criticalnodes3. Determineoptimaldispatchpost-contingency 43

Microgrid formation(cont’d)Updatedconstraints

𝑝2 = 𝑝𝑐2 − 𝑝𝑔2 − 𝑝𝑟2 + 𝛿2𝑝𝑑A2⋆ − 𝑝𝑒2

𝑞2 = 𝑞𝑐2 − 𝑞𝑔2 − 𝑞𝑟2 + 𝛿2𝑞𝑑A2⋆ − 𝑞𝑒2

|𝑃28| ≤ 𝐶𝑎𝑝28 1− 𝑘𝑚28|𝑄28 | ≤ 𝐶𝑎𝑝28 1− 𝑘𝑚28

|𝜈8 − 𝜈#YZ | ≤ 1 − 𝑘𝑚28

|𝜈8 − 𝜈2 − 2 𝑟28𝑃28 + 𝑥28𝑄28 | ≤ 𝑘𝑚28

• Anemergencygeneratorofmicrogrid isononlyifitisinislandedstate𝑝𝑒8 ≤ 𝑠𝑒8 𝑘𝑚28𝑞𝑒8 ≤ 𝑠𝑒8 𝑘𝑚28

44