probabilistic approach

Document Sample
probabilistic approach Powered By Docstoc
					IEEE TRANSACTIONS O W (IRCCITS .\\D 5> STFSIS. V o l .   37. NO. 6. J l ’ N r 1990                                                             787

                  A Probabilistic Approach To Dynamic
                         Power System Security

   Abstract --In this paper, the problem of dynamic power system secu-               critical system state variables, i.e., generator frequency,
rity is investigated. A probabilistic approach is chosen ayd an appropri-            line currents, bus voltages, etc., which exceed the safe
ate power system model is developed for analyzing the dynamic behavior
of the different operational modes of the system. The model includes the
                                                                                     operating limits of the system and ultimately cause inter-
transients induced by primary and secondary disturbance events. Pri-                 ruptions in supply and loss of load. Cascading disturbance
mary events are defined to be state-independent disturbances such as                 events may persist until the system completely separates
line and unit faults and load changes and are modeled by random                      (a black out) [l]. There is a need for evaluating the
switches in the power system model. Secondary events are state-depen-                dynamic security of the system and using this information
dent variations in the structure such a s forced line and unit outages and
load shedding actions. They are modeled by switches in the model whose
                                                                                     to develop timely control strategies to circumvent a possi-
states depend on the instantaneous balues of certain system variables.               ble system collapse. In this context, security is an instanta-
The power system model developed characterizes the interaction between               neous time varying measure of the robustness of the
the dynamic state of the system and the network topology a s defined by              system relative to imminent disturbances [2].
the status of the various protective relays in the system. A dynamic                    In a normal operating state the frequency and bus
security region is defined a s a subset of state-structure space of the
power system such that at any moment in time a n operating point within
                                                                                     voltage are kept at prescribed values. The frequency and
the region satisfies all the constraints required for secure power system            voltage constancy results from a carefully maintained bal-
operation.                                                                           ance.
   Given a n initial probability distribution of the system state and of the            Dy Liacco first introduced the concept of (steady-state)
system structure, a fixed control policy, and a statistical characteriza-            security in [3]as related to a multilevel decomposition of
tion of the primary events, the probabilistic evolution of the state and
structure is computed a s the solution of a system of linear partial                 the power system. Security was defined in terms of satisfy-
differential equations with matching conditions at the switching bound-              ing a set of equality and inequality constraints over a
aries. A dynamic security measure is defined a s the integral of the joint           subset of the possible disturbances called the “next con-        a
probability density of the state and structure of the system over the                tingency set”. Dy Liacco’s approach [3] and a probabilistic
dynamic security region for all possible structural bariations. This                 formulation of steady-state security by Patton [4] are
computation yields the probability that the power system remains yecure
for the range of primary events considered. Computer simulations for an
                                                                                     pointwise approaches to the problem; security is assessed
example power system are presented to illustrate the utility of the                  at specific sets of operating points. The work discussed in
approach developed.                                                                  [5]-[7] reduces the number of contingencies to be consid-
                                                                                     ered using a performance index which measures the im-
                          I.   INTRODUCTION                                          pact of a contingency on the system. The contingencies
                                                                                     are rank ordered according to the performance index.
T    H E PRIMARY function of an electric power system
     is the reliable generation, transmission, and distribu-
tion of electric power to meet a randomly variable de-
                                                                                        An alternative methodology, the so-called regionwise
                                                                                     approach, evaluates security of a particular operating
                                                                                     point by verifying membership in an appropriate set.
mand. These objectives must be accomplished at the                                   Regionwise approaches are discussed in [8]-[12].
lowest possible cost over a wide range of operating condi-                              The concept of a security corridor was introduced in
tions and random disturbances. A disturbance may be the                              1131. A security corridor is composed of a number of
result of environmental effects, equipment malfunctions.                             overlapping security sets covering a predicted daily trajec-
or human operator error. Such disturbances, regardless of                            tory. As long as the actual trajectory stays inside a secu-
their origin, can initiate transients and fluctuations in                            rity corridor, security is guaranteed and no additional
                                                                                     computations are required.
  Manuscript received August 29, 1988. This work was supported by the
                                                                                        Galiana [ 141, [15], investigated the limitations imposed
U S . Department of Energy under Contract DE-ACOl-79-ET 29363.                       by the structure of a power network on the values of the
This paper was recommended by Associate Editor M. Ilic.                              state variables of the system. The results led to the
  K. A. Loparo is with the Department of Systems Engineering, Case
Western University. Cleveland. OH 44106.                                             determination of a feasible region of bus injections for the
  F. Abdel-Malek is with the Department of Electrical Engineering.                   system. Wu [16] refined the definition of a steady-state
Trenton State College. Trenton. NJ 08650.
  IEEE Log Number 8931168.                                                           security region in terms of a set of inequality constraints

                                                0098-4094/9O/O600-0787$01 .OO 01990 IEEE
    788                                                             IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMS, VOL.   37, NO. 6, JUNE 1990

    in the space of power injections. These constraints char-       include continuous and jump process random distur-
    acterized the values of the state variables of the system       bances which model the probabilistic aspects of the sys-
    for which a real load flow solution exists.                     tem. In the papers by DeMarco and Bergen [36] and [37],
       The regionwise approach has the following adcantages         nonlinear wideband noise models are proposed for the
    over the pointwise approach.                                    study of power systems security. The basic assumption is
       1) It requires fewer computations compared to the            that small signal instabilities can result from the “shrink-
    pointwise approach.                                             ing” of the region of attraction of a particular equilibrium
       2) The location of a specific operating point inside the     point; for example, the small-signal instabilities can be
    security region can be determined, hence a security mea-        caused by voltage instabilities or voltage collapse. In [38],
    sure for an operating point can be computed.                    we proposed an alternate model for small signal instabil-
       3) It can identify which constraint has the most effect      ity which was based on a linearized model of the power
    on the security at each operating point. This information       system and parametric random fluctuations, possibly re-
    can be used in security enhancement to select the control       sulting from perturbations in the load.
    which reduces the likelihood of the violation of that              The work described in this paper is an outgrowth of
    constraint for a given set of contingencies.                    some of our earlier work [381, and other previous research
       All the methods discussed above relate only to steady        efforts including [17], [MI, and [34]-1371. The problem
    state assessment. The limitations of steady-state analysis      formulation presented here focuses on modeling the dis-
    are as follows.                                                 turbances as finite state jump processes. Continuous pro-
t      1) Only initial disturbances are studied. The probabil-      cesses can be included without any conceptional diffi-
    ity that other disturbance events may result from an initial    culty; refer to [24] for more details.
    event, for example, network topological changes resulting          Patton in [4] proposed another form of the security
    from protective relay actions, are ignored.                     function which takes into account both steady state and
       2) It is assumed that the steady state (equilibrium)         transient breaches of security.
    operating point determined by solving the post-fault flow          The use of pattern recognition techniques [19], [201, for
    equations is reachable. Transient stability analysis ad-        off-line computation of security functions is an effort to
    dresses this point.                                             characterize the boundary of the set of steady state or
       In a recent set of papers, Wu and his coworkers [17],        transient secure operating points. This method is in fact
    [181, have developed a procedure for constructing dy-           an automated extension of the conventional techniques
    namic security regions and a probabilistic framework for        used in power utilities to separate stable and unstable
    addressing the problem of dynamic security assessment.          conditions. The pattern recognition techniques were not
    In this paper, power system dynamic security refers to the      initially well received because of the excessive computa-
    following situation. Given that the power system is in a        tional requirements involved in finding an adequate train-
    particular operating state at the time of a disturbance, the    ing set for large scale power systems. Recent improve-
    system is dynamically secure if the initial operating point     ments of these methods [21], coupled with the rapid
    is in the domain of attraction of a “secure” post-fault         progress of computers however, have renewed optimism
    equilibrium state. In this context, the concepts of dynamic     in their use in power system security analysis.
    security and asymptotic stability are considered to be             A review of the works in both steady state and transient
    equivalent. Affine approximations are used to derive ap-        security assessment of power systems are provided in [22].
    proximate boundaries of the prefault angles which guar-         These include methods for the construction of mathemat-
    antee transient stability. This region of dynamic security is   ical models and dynamic equivalents and on line transient
    used along with a probabilistic model of the power system       security analysis based on digital simulation, hybrid com-
    dynamics to estimate the evolution of the probability to        puter simulation, and Lyapunov methods.
    insecurity. The model incorporates a finite state continu-         Stability is a narrower condition of security and a more
    ous time (FSCT) Markov process which models the ran-            general analysis of the dynamic security problem has been
    dom changes (state-independent) in system structure and         proposed by Loparo et al. [23]-[251. The uncertainty in
    a smooth system of differential equations which describe        the power system security problem is characterized by
    the evolution of the continuous state variables between         considering the network structure itself to be uncertain.
    structural changes. This framework is used to develop           Using the classical model of a multimachine power sys-
    lower and upper bounds on the distribution of the time to       tem, the coupling between machines that is represented
    insecurity.                                                     by the transmission network, is considered to be random
       In [33], Blankenship and Fink presented a probabilistic      in nature. However, the processes under consideration
    formulation of the dynamic security assessment problem          are switching processes, representing both the primary
    motivating much of the work which followed in this area.        disturbance events, faults, etc., and the operator or state-
    For example. in [34] and [35] probabilistic security assess-    controlled secondary disturbance events, breaker opera-
    ment was studied in the context of transient stability.         tion, etc. The effect of disturbances on the generators are
    Here, exit times or exit time probabilities from stability      also modeled in a similar manner by modifying the power
    regions are computed. or estimated as measures of the           output of each machine. Therefore, the state of the
    security of the power s!stem. The power system models           system is dependent upon the evolving structure of the
L O P 4 R O A%UD ABDEI UALEK: APPROACH TO DYNAMIC POWER SYSTEM SECURITY                                                                      789

network which is in turn, dependent to a degree on the
state of the system.
   In this paper, for all possible structural variations of a
power system, a dynamic security region is defined in
terms of the system state variables. A system of quasi-lin-
ear partial differential equations which describes the evo-           trix. Then the elements         Y , ( f )have the form:
lution of the joint probability distribution of the state and                                /   nh
the system structure is presented. A probabilistic security
measure is introduced as the probability that the system is
in the dynamic security region. If the computed security                                                                         i#j
measure is found to be below a required security thresh-
old then it is necessary to apply control actions to improve          where Y, are the network parameters, S,,(t> is an inter-
the situation.                                                        connection function such that:
   A detailed simulation example is presented for a sam-
ple power system model to illustrate the results.                                            if nodes i and j are connected at time t
                11.   A POWERSYSTEM
                                                                          S,,(t)   =
                                                                                       (il   otherwise

   The main features of a probabilistic power system model            for i, j = 1,2; . . ,nh and YL,(t)is the time-varying admit-
are:                                                                  tance of the load connected to the ith bus. YLf(t) be can
   (1) A detailed generator model for studying post-dis-              written as
turbance transient behavior of the machine.
   (2) Load variations and faults are modeled as stochas-                      YL, t ) = ( t ) + Y,, ( t ) ,
                                                                                 (                               i = 1 , 2 , 3 , . . . ,nb
tic processes capturing the random nature of primary                  where y ( t ) models the deterministic component of the
events.                                                               load based on the projected nominal load for standard
   ( 3 ) Secondary events are modeled through an aggre-               voltage and frequency conditions and Y,,(t) is the ran-
gate representation of the protection system.                         dom component of the load modeled as a continuous time
   (4) A set of admissible controls is defined to include             finite state Markov jump process with known transition
all essential preventive and corrective security control              probabilities and initial probability distribution.
   The most general form of a mathematical model which                A. Disturbance Models
includes the above characteristics is                                    The primary events are defined as those disturbances
                            = F(x(t),u(t),A(t)) dt               (1) which occur randomly independent of the system operat-
                                                                     ing conditions. Other than random changes in the load,
where x ( t ) denotes the state of the system, u ( t ) is the the set of primary events includes generating unit outages
input of the system, and A ( t ) , which takes values in a and line outages. These events may occur due to environ-
finite set, encodes the various structures that the system mental effects, equipment failure or human error. The
can have as a result of primary and secondary disturbance primary events are used to model the availability or
events. For the power system model we can specialize (1) unavailability of power elements resulting from uncontrol-
to the following form:                                               lable events. These are modeled by random switches at
                                                                     each generator or transmission line (Fig. 1).
                                                                         It is assumed that the switches are normally closed
                                                                     (availability of the element) and that Vgl and 1/1,, take
                                                                     either the value 0 or 1 according to
Here the state vector x ( t ) includes generator rotor angles
and velocities measured relative to a reference angle and                       1,    i th generator available
synchronous speed, the direct axis flux, quadrature axis               I/gr = ( 0 ,   otherwise            i = 1,2; . . ,ng
flux, and field flux. The input vector u ( t ) includes me-
chanical power input to each generator and the field                            1     line ij available    i , j = 1,2;. . ,n b , i # j
circuit voltage, $ ( x ( t ) ) is a nonlinear term which includes     Vrrr = (0:      otherwise.
the flux linkages for each machine, and f ( x ( t ) , A ( t ) ) is a
nonlinear function of the system state variables, in partic- VRf           and V I ,are random processes and historical data on
ular the rotor angles of the machines and the network the time and duration of transmission line and generator
parameters. i.e., the admittances and susceptances; A ( t ) outages is assumed to be available and can be updated at
then accounts for the changes in the network structure as any time if the external factors (i.e., expected weather
a result of primary and secondary events. This requires conditions, scheduled maintenance circumstances, etc.)
more elaboration. Let n R and n b denote the number of indicate a change in the likelihood of occurrence of these
generators and busses in the overall system, and let Y ( t ) events. The probability of the opening and closing time
 = { y , ( t ) ]i ; j = 1.7: . . . n b denote the bus admittance ma-
                  ,                                                  for these switches is derived from this data.
790                                                              IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMS, VOL.        37,   NO.   6, J U N E 1990

                                                                 rated values, i.e., if I, denotes the current in generator i ,

                                                                                  1 I
                                                                                 1, G 1 1 max >   i=l,...
                                                                                                                   7   nK

                                                                 and if   e,, is the angle between machines                 i and j , then
                                                                                                i j
                                                                          @ ~ ' " G ~ @ , , ) Q ~ , ~=, l ; . - , n , ; i # j .
             Fig. 2.   Protective relays in the network.
                                                                 The magnitude of the bus voltages should not exceed
                                                                 certain values in order that the power transmission capac-
                                                                 ity of the lines is not exceeded during the operation of the
                                                                 system (i.e., to prevent overloading any of the transmis-
                                                                 sion lines of the system). This defines an upper limit for
                                                                 the bus voltage magnitudes. Also, the magnitude of the
                                                                 bus voltages should not be below a certain limit during
                                                                 faults such as short circuits; this is a simplified model for
            Fig. 3. Controlled switches in the network.
                                                                 the maintenance of transient stability in the system in the
                                                                 following sense. A short circuit is generally accompanied
                                                                 by an instantaneous collapse of the bus voltages and
                                                                 consequently a sudden reduction of the generator power
B. Protection System
                                                                 output. Since the power input to the generator can be
   A n aggregate model of the protection system is shown         assumed to be constant during the first instants before
in Fig. 2. The operation of the protection system induces        the mechanical turbine controllers respond, each faulty
structural changes in the power system network referred          generator will be subject to a surplus accelerating torque.
to as secondary events. These secondary events include           Therefore, to dissipate the mechanical oscillations of the
the triggering of generator (Rg,), line ( R f l , ) , and load   synchronous machine rotors that result from a surplus
(R,,) relays. The detailed operational characteristics of        accelerating torque and maintain transient stability, the
the relays are defined in terms of switching surfaces in the     bus voltage levels should not be below a lower limit. Even
state space of the power system. The determination of the        though transient stability limits are in reality much more
relay operating policies, in terms of the switching surfaces     complicated, this formulation will suffice to illustrate our
and possibly other time dependent phenomena, is part of          approach and we will refer to these voltage limits as the
the determination of the operating policy for the system.        transient stability limit of the system. Therefore, the bus
                                                                 voltage magnitudes throughout the system must be within
C. Modeling of Operator Initiated Control Actions                certain limits for secure operation, i.e., if E, denotes the
                                                                 voltage at bus i then
   Operator initiated controls refer to those switching
control activities which energize or deenergize power or              E,""" G E, Q E,"'ax, i = 1,2; . . ,nh.
load elements [26]. Fig. 3 illustrates how these types of
                                                           These constraints on the operating variables of the power
switching actions are accounted for in the power system
model. Here U,,, Ufrl and U,, are operator controlled system can be written as
switching devices which can be used to alter the generator  ,Fin(x ,A j ) G ck(X , A j ) Q CY(
                                                                                             x, A,),   k = 1 2 , . . . ,K
mix, the distribution of load on the transmission lines,
and the load being served by the network, respectively.    where ck(.,l) is a map from the state-structure space of
   In summary, the availability of a generating unit or a the power system to the real numbers. Here, x denotes
transmission line is determined by the state of an equiva- the system state and A, is the structure descriptor for the
lent switching element which accounts for the primary system, j = 1,2,3; . ., NP, where NP is the number of
event status, the secondary event status, and the operator possible system structures. If X denotes the state space of
initiated control action. The generator (or transmission the system and A denotes the set of possible system
line) is in service if and only if the switches V (V,,,), structures then the constraints on the operating variables
Rgl(R,,,)and U,,(U,,,) are all closed. The connection of define a subset, W , of the state-structure space ( X X A).
the load to the network is determined by R,, and U,,, a It is assumed in our model that keeping the bus voltage
load is connected if and only if the switches R,, and U,, levels in the system at their prescribed values will satisfy
are closed.                                                the reactive power balance requirements.
                                                             Remark: The most realistic way of incorporating tran-
                                                           sient stability constraints in the dynamic power system
             111. DYNAMIC   SECURITY   REGION              model is to associate a domain attraction (DOA) with
   During secure normal operation of a power system, the each system structure; see [17] for some results along
operating variables have to be within certain limits. The these lines. In this way, the set W , is the set of ordered
currents in the senerating units should not exceed their pairs ( x , A ) E ( X x A), the state/structure space, such
LOPARO A N D ABDEL MALEK: APPROACH TO DYNAMIC POWER SYSTEM S E C U R l n                                                                   7Y 1

that if the system has structure A and if x is an element of                 iii) A , , ( x , t ) < 0     i =j;
the DOA associated with the structure, the system is                          iv> C,N_,A,,(x,t)=0;
transiently stable. This is consistent with our computation                    v> A , , ( x , t ) is continuous and uniformly bounded on
of the security index as will become evident in Section V.                         x x[t,,m).
    The frequency is closely related to the stability of the
overall network. Under normal and secure operating con-                      The process s(t> is intended to model the so-called
ditions there is a balance in the system; generating units primary disturbance events such as generator outages,
are supplying the system loads in addition to the real transmission line faults, etc. The matrix { A , , ( x ,t>)charac-
transmission losses. Should this balance be disrupted, the terizes the rate at which the process s ( t ) evolves on S .
difference would increase or decrease the kinetic energy Even though s(t> denotes a primary disturbance event,
of the system. Since kinetic energy depends upon genera- the transition rates A , , ( x , t ) depend upon the state x ( t ) .
tor speed, an imbalance will thus translate into a speed This is because the system structure is also random and if
and frequency deviation. Therefore, keeping the fre- a generator is already out of service we do not want to
quency within certain limits during the operation will allow any other primary disturbance events for this gener-
guarantee such a balance condition for the system. This ator to occur. Also, the time dependence allows the
inequality constraint is written as follows:                              modeling of nonstationary random behavior such as
                                                                          storms, equipment in need of maintenance, equipment
             0;'" < 0,,< by"", i, j = 1; . . , n g .                      close to operating limits, etc.
                                                                             Let r ( t ) be a random process taking values in the finite
Denote by W, the collection of all pairs ( x , A) in ( X X A ) set R = { r I , r 2 ;. ., rM).r ( t ) models the structural changes
at which the active power balance of the system is satis- in the power system network which are state dependent.
fied at all times.                                                        Partition the state space X into a set of open subsets of
    Let                                                                   X denoted by X I , i = 1,2; . ., M such that:
                                 W, = W , n W ,
                                                                              i) X = ( U E I X l , ) ' here ( >'        denotes closure of the
then W, defines a dynamic security region of the power                            set ( );
system as a subset of the state-structure space of the                       ii) X , n X , = @ for i , j = 1 , 2 ; . . , M , i z j .
    The system is said to be in the normal operating state if The evolution of r ( t ) on R is as follows: If the state
the operating point remains within the dynamic secure x ( t ) E X I then r ( t > r,; i = 1,2; . ., M. Let b,, denote the

region defined above. The violation of the operating                      boundary separating the sets X I and X I ; i.e., b,, = XfC         n
constraints, i.e., being outside of the set W,, is referred to X f , i # j , i,j = 1,2; . ., M. If x ( t >E X I and crosses b,, at
as an emergency operating state. The violation of frequency some time T > t and enters the set X I , then r(t>jumps                               a
constraints, i.e., being outside of W,, is referred to as a from r, to r,. The boundary b,, can thus be interpreted as
partial load operating state. Transitions between these op- a switching surface.for the process r(t>.The evolution of
erating states are possible.                                              the two processes s ( t ) and r ( t >are combined to define
                                                                          the process A ( t ) on its state space A. To be more precise,
                                                         OF               for each subset X I of X we define a subset A, of A which
                       WITH RANDOM            STRUCTURE                   is the range of s ( t ) on S , i.e., the set of values in S that
    A probabilistic model of the power system with fixed                  the process s(t>can attain when x ( t >E X , . Then, when
operating policy subject to primary and secondary distur- x ( ~ ) X I , s ( t ) evolves on A , as a finite state continuous
bances can be written in the general form:                                time Markov process. Let X , and X I be neighboring
                                                                          regions, i.e., Xf n X f is not empty and is equal to b,,. If
                        &(t) =F(x(t),A(t))               dt               A , and A, denote the subsets of A associated with the
                                                                          range of s ( t ) when x ( t ) is restricted to X I and X , respec-
where x ( t > EX and A ( ~ ) E A, t > r o . A ( t ) models the
                                                                          tively, we partition A, and A, into an equal number of
random changes in the system structure as a result of
                                                                          disjoint subsets             and A , , k , for k E K,,, an index set.
disturbances to the system. The primary disturbance
                                                                          Before defining the partitions, some additional clarifica-
events are modeled by a continuous time finite state
                                                                          tion is necessary. When r ( t ) crosses the boundary b,,
process s ( t ) . Let S = {sI; . .,s N ) denote the state space of
                                                                          from X , to X , because there has been a change in system
d f ) ; the probabilistic evolution of s ( t )on S is determined
                                                                          structure, it is necessary to properly initialize the struc-
by a continuous, bounded infinitesimal generator [30]. In
                                                                          tural evolution on A,. That is, if for example the crossing
matrix form, the infinitesimal generator is an N x N
                                                                          of a switching surface b,, causes a transmission line in the
matrix whose elements are the transition rates of the
                                                                          network to go out of service, then all primary events
process s ( t ) . We assume that the transition rates are time
                                                                          which effect this transmission line are no longer admissi-
and state dependent and that they satisfy the following
                                                                          ble in the current structure. We must account for this in
properties for all x E X , t 2 to:
                                                                          defining the set A, and the probabilistic evolution of s ( t )
      i) A ( x , t ) = { A , , ( x , t ) ) ,   i, ~ = 1 , 2 ; . . , 1 % ; on A, when x ( t ) is restricted to X I . If we define a
     ii) A , , ( x , t ) > 0         i zj ;                               boundary transition map p,, which defines how the struc-

    792                                                                                                            IEEE TRANSACTIONS ON CIRCUITL A N D SYSTEMS, VOL. 3 7 , NO.               6, J U N E 1990

                                                                                                                                      +       6      F    ,     m      B     L


                                                                                                                                          i-.166HZ       -75O Ba           +.166HZ
                                                                                                                                                         113 Her; 1-

                          Fig. 4. The example power s y s t e m .                                                                  Fig. 5. Security measure p versus                 time.

                                                                                                                                                TABLE IV
                                                                                                                                           CODING PRIMARY
                                                                                                                                                OF       EVENTS
                  Generalor   ,    .Y'             .YT                   H                Rating
                     So       '   ip.u)           (pu.)           (MW.S./YVA)             (!dVA)

                      1           028             008                    5                    50

                      2       1 0 2 5
                                                                         4            1


                             Line No.                              3              4                 5
                                                                                                                   network model and the computer analysis which were
                   X,,     to 100 MVA bare                I       0008       1   0003     I    0.13
                                                                                                                   used to obtain the dynamic security region illustrated in
                                                                                                                   Fig. 5 can be found in [29].
                                           TABLE I 1 1                                                               The system model is in the general mathematical form
                                         LOADFI ON D \T.X                                                          of a system with random structure. The primary and
     Bru   I         Voltage                  I           Load                        I             Generator      secondary events are modeled in terms of the switches
     So.       mag.(p.u.)    angle                 M.W.    S1.V.A.R.                      M.W.          M.V.A.R.
      1             1.030           0                   0          0                       30.0             23.1   S1-S9 as indicated in Tables IV and V, respectively.
      2             1.020         -0.5               80.0        09
                                                                4.                        100.0             37.8
      3             1.018.        -1.0               50.0       20.0                        0.0              0.0
                                                                                                                   There are seven primary events indexed by "i".
                                                                                                                     The state of the six switches S1-S6 are modeled as a
                                                                                                                   continuous time two-state jump process taking values in
    tural evolution is modified when x ( f ) crosses b,, from X ,                                                  the set (0,l) as follows:
    to X,, then formally:
                                                                                                                             1    switch closed, no fault in T.L. 5
                                          PI,:           A , + -1,                                                           0    switch opened, fault occurs, T.L. 5 is tripped

                                          P,,: A,                      -2,                                                   1    switch closed, no fault in T.L. 4.

                                                                                                                             0    switch opened, fault occurs, T.L. 4 is tripped
    and the partitions                        and A,,k have the following prop-
    erties:                                                                                                              1        switch closed, no fault in T.L. 3
                                                                                                                    s3-( 0        switch opened, fault occurs, T.L. 3 is tripped
        i, PI,: ' 1 . k '1.k
                                                                                                                        0         switch opened, no fault in Generator 1
       ii) P,r: ' , , k 'i,k                                                                                        s4={
      iii) no other proper subsets of A ,                                             and A,.k satisfy i)                    1    switch closed, fault occurs, G1 is tripped
           and ii).                                                                                                          0    switch opened, no fault in Generator 2
       Example 1: To illustrate the development of a power                                                                   1    switch closed, fault occurs, G2 is tripped
    system model in the appropriate mathematical form, con-                                                                  0    switch opened, normal value of load 3.
    sider the two machine power system illustrated in Fig. 4;                                                       S6={
                                                                                                                             1    switch closed, jump change in load 3.
    Tables 1-111, respectively, give the specific generator,
    transmission line, and load flow data that are used in the                                                       Define the open, disjoint subsets X , of R 2 as follows:
    example. Generator dynamics are modeled using the clas-                                                             X,, { x I , x z : lxll < 0.166 and -75"< x2 < 45")
    sical swing equations with uniform damping. We recog-
                                                                                                                        XI = { x I , x 2 :x , > 0.166 and -75"< x 2 < 45")
    nize the limits of such a generator model for predicting
    long term system behavior, but our only interest at this                                                            X , = { x , , x 2 : lxll < 0.166 and x 2 > 45")
    point is to illustrate the basic concepts of our approach to                                                        X , = { x I , x 2 :x I < -0.166 and -7S0< x 2 < 45")
    dynamic security evaluation.
                                                                                                                        X , = { x I , x 2 :lxll < 0.166 and x2 < -75")
       Let 6, denote the rotor angle of the ith machine
    measured relative to a shaft rotating at synchronous speed                                                          X,= { x l , x 2 :x 1> 0.166 and x 2 > 45")
    and let d,,, denote a stable equilibrium rotor angle for the                                                         X 6 = { x I , x 2 :x l < - 0 . 1 6 6 a n d x , < - 7 5 " }
    ith machine. A choice for state variables of the example
                                                                                                                        X,=(x,,x,: xl>0.166and x,<-7So)
    system. which is convenient for our purposes, is x 1 =
    ( 8 , - 8:) and sI= ( 6 , - 62)-(610- d2(,). Details of the                                                         X,   = { x 1,x 2 :    xI   < - 0.166 and            x 2 > 45").
        LOPARO A N D ABDEL MALEK: APPROACH T O DYNAMIC POWER SYSTEM SECURITY                                                                 193

                                  TABLE V                                                                 TABLE VI
                                    EVENTSCODING                                                    FAILURE
                                                                                                          RATESOF THE SYSTEM

                               4           0

        Then R 2 = ( U ~ = , X k > c we define the boundaries b;,
                                 and                                                               a7

        by the formula:

                     bii = X; n X;,    i, J = 0, *   * *   ,8, i f   J     associate a subset A iof A with each region X i , i = 0;        - *,8.
        For example, the boundary b,, = { x , , x , : X , = 0.166) and
        the remaining bij are computed in a similar way.                       A,   = the set of primary events { 1,2,. . . ,7] which are
           The partitioning of the state space R 2 as defined above                  defined according to Table IV.
        is used to describe the evolution of the secondary distur-             A , = A,
        bance events. The secondary events are modeled by the                  A, = (1,2,3,4,6,7), G 2 separated from the network and
        state dependent operation of the switches S7, S8, S9. The                    the primary event corresponding to S5 is not rele-
        status of the switches is determined by the following                        vant once G 2 is separated.
                 x E X,    -S 7 = S 8 = S9 = 1
                 x ~ X , u X , - S 7 = S 8 = 1 and S 9 = 0
                                                                               A 3 = A,, A, = (1,2,3,5,6,7}, G 1 is separated from the
                                                                                     network and the primaq event S4 is not relevant
                                                                                     once G1 is separated.
                                                                               A, = A , , As = A,, A, = A,, A8 = A,.
          R3)                             S
                 x ~ X ~ - S 7 = O a n d 8=S9=1
          R4)    x ~ X ~ - S 7 = S 9 = 1 S8=0.
                                                                              The probabilistic properties of the primary disturbance
        These rules are summarized in Table V.                             events are defined according to a 7 x 7 stochastic matrix.
          The operation of the three state dependent switches              For this example each switch is modeled by a two-state
        S7-S9 is as follows:                                               Markov jump process with independent exponentially dis-
i-'                                                                        tributed switch times. Let ai denote the rate of event i,
i                     switch closed, over-current relay at G1 does                     '
                                                                           i.e., a,- is the mean time between jumps of the event i.
                      not operate                                          Then,

                      switch opened, over-current relay at G1 oper-                 a , = failure rate of T.L. 5
                      ates, separating G1
                                                                                      a , = failure rate of T.L. 4
               (,     switch closed, over-current relay at G 2 does                   cy3 =   failure rate of T.L. 3
                      not operate                                                     a , = failure rate of generator 1
                      switch opened, over-current relay at G 2 oper-
                                                                                      a,    = failure    rate of generator 2
        s8 =          ates, separating G2
                                                                                      a6 = equivalent failure rate of load 13
                      switch closed, under-frequency relay at 13 does                 a , = failure rate between T.L. 5 and T.L. 4.
                      not operate
                                                                             The numerical values used in the simulation are shown
                0 13 operates shedding part of the load.                   in Table VI.
                                                                             The infinitesimal generator of the seven-state primary
        From Table IV there are seven primary events and from              disturbance process is given by
        Table V there are four (state dependent) secondary events.                            SFR          a,     a 2 ag a4 a5 a6
        Let A denote the set of possible system structures. In
                                                                                               0         -a,      a, 0   0  0  0
        principle, A would contain 29 elements even in this simple
        example, but most of these can be eliminated by practical                                           a,   -a,  0  0  0  0
        considerations. For example, security assessment requires                              0           0       0      :
                                                                                                                          .    :
                                                                                                                               .   :
                                                                                                                                   .   :
        that the current operating mode is normal, i.e., the oper-
        ating state of the system x ( t ) E X,. If we are interested in
        evaluating the security of the system given a single pri-                       0         0             .    .    . o
        mary disturbance as an initiating event, then the cardinal-        Here a , models a multiple contingency where T.L. 4 and
        ity of A is twenty one. Given A, the set of system                 T.L. 5 both go out of service and SFR = Cp=,ai.
        structures to define the structure evolution on A , we need          The evolution of the primary disturbance process on
        to determine the subsets A , of A. In this example, there          the subsets X , is determined by eliminating the appropri-
        are a total of nine regions in R 2 which are of interest. We       ate rows and columns from the matrix A and renormaliz-
    794                                                                           ILtL. rKAN5A<TIONS O N C'IKCUITS A N D SYSTEMS, VOL.   37, N O . 6, JUNE 1990

                                                                                  The boundary transition map po2 ( p I 2 )simply models the
                                                                                  fact that in X,, the primary event 6 can not occur. The
                 -                                                                remaining partitions Ai,, are determined in a similar way.
                     - l%                       a2        a?       0,     a(>        We will return to this example later for our numerical
                      0        -a7              a,         0       0          0   studies. Next, we continue with our analysis of systems
          A,=         0             a7         -a,         0       0          0   with random structure.
                                                                                    The structural evolution is characterized by the bound-
                      0         ...            .. .       ...      ...            ary transition maps p,,, the subsets A , , and the partitions,
                 -                                                            0         The problem is to analyze the probabilistic evolution
                                                                                  of the joint Markov process ( x ( t ) , A ( t ) ) in the state-struc-
                                                                                  ture space X x A , t to. Here ( x ( t ) , A ( t ) ) satisfies the
                                                                                  differential equation
                                                                                               dx ( t ) = F ( x ( t ) ,A( t ) ) dt ,     t 2 t,,
                                                                                  and the problem is complicated because of the discontin-
                                                                                  uous behavior of the vector (or velocity) field F on
                                                                         61       X x '4.Our approach to the problem is to consider the
                                                                                  restriction of the dynamics to the set A i , or more conve-
    where p4= SFR - a,.                                                           niently. the subsets A,,, of A , where the discontinuities in
                A,   =   A ? ;A ,   =    A,; A ,      =   A,; A,   =    A2.       the velocity field result only from the primary disturbance
                                                                                  events. Let A,, E       C A , . For each hi, fixed we have
      The boundary transition maps p,, define how the pri-
    mary disturbance process evolution is affected by state                               dx ( t ) = F ( x( t ) , A,, ) dt , x( t ) E X i
    dependent events, i.e.. when the state process crosses a                      where we assume that F ( . , A , , ) is a differentiable (C')
    boundary b,,. In this example we have                                         mapping. Define the probability density
            pol = p l o is the identity map on A,,
                                                                                  Plk(x, t ) dx = Probability { x G x ( t ) G x        -tdx, A(    t ) = Ai,}.
             Po, =PI::        - 0+ - 1 2
                                                                                  Then P l k ( x t, ) has A as its support. Let Pi(x,t ) denote
                     (1.3,3,4} -+ (1,2,3,4}                                       the vector of probability density functions with compo-
                         {5,6.7) -{5,7}                                           nents P , k ( x ,t ) . From Morrison [27], P,(x, t ) satisfies the
                                                                                  linear partial differential equation
             ~ 2 =~ 2 1 :

                (1,2.3.4} (1,2,3,4}
                    (5.7) (5,6,7)


                                                                                                =   L,P,(x,t)+AiP,(x,t),                  i=1,2;..,M              S

                                                                                  on the sets XI where A , is the restriction of the forward
             po3 = pill is the identity map on A,, .
                                                                                  generator of A to X I , and L,=diagonal ( L l k } . L,, is
    The remaining p,, are defined in a similar way. The                           defined by
    partitions ,41,k.i = 0 . 1.2.. . . .8, k . suitably restricted, are
1   defined by the boundary transition maps p , , . For exam-
    ple, consider the maps p,,? and p_.o.The boundary transi-
                                                                                       L,kg(x) =                  ,
                                                                                                          F ( x ,A r k ) g ( x ) )
!   tion map po2 (pl,) defines how the primary event struc- where g ( x ) is a smooth real-valued function defined
    tural evolution is affected b- crossing the boundary h,,2 on X I .
    ( b , 2 ) . If the state trajectory crosses h,,? from X,, into X z ,    Remark: The partial differential equation for the vector
I   then the status of the state dependent switches change P , ( x , t ) is a generalization of the well-known result for
1   from S7= S8 = S9 = 1 (in X , , )to S7 = S9 = 1, S8 = 0 in smooth dynamical systems with random initial data. Con-
    (X2); is rule 4 in Table V. In this situation the sider the system
    over-current relay has actuated and generator G2 is sepa-
j   rated from the network. An examination of the primary
    disturbance events, Table I V indicates that S 5 (primary
                                                                                        dx(t)=f(x(t))dt,               t20,
                                                                         where f : R " + R" is a C' vector field and x(0) is a
    event 6) models the tripping of (72 as a result of a random variable with density p o ( x ) .Let cp,(.) denote the

i   primary event. However, if the state of the shstem r ( t ) E flow associated with the vector field f . Then, cp,(x) is the
    X,,then G2 is already separated and the priman e\'ent solution of the above differential equation initial from the
    corresponding to the tripping of G I i h not relevant and point x at t = 0. Let p , ( x ) d x = probability { x G x ( t ) < x
    must be eliminated from , Thus . partition the set .Il,nu), t 0 with x ( t > the solution of d x ( t ) = f ( x ( t ) ) , t z 0
                                        I 2we                             i
    into two subsets,               and A0,2 and .I2 into trio corre- given by x ( t ) = cp,(x(O)). It follows by an elementary calcu-
    sponding subsets               and A?,? respectively. huch that:     lation that the density p,(x) has the following representa-
                          = { 1.2,3,4},           = {5.6.'j

LOPARO A N D ABDEL MALEK: APPROACH TO DYNAMIC POWER SYSTEM SECURITY                                                                     795

where det Dq,l,-,~,,is the determinant of the Jacobian of               a positive constant. The boundary b,, is the subset of R 2
the flow qr evaluated at q-,(x). Here, D,, is a linear map              defined by
from R“ + R“ and the det Dq,l,-,(,) can be calculated
                                                                                           b,,   ={x E   R 2 :( X , n ) = C ) .
                                                                        Even though Liouville’s equation is not valid on the whole
            det DcpJ,-,(,,= e x p l trace D f , , d ~ .                 of R 2 , at all points where x E R 2 such that the initial
                                                                        density p&’p - l ( x ) ) is continuous we have the formula:
Note the trace of Ofl, = div.           fix,    the divergence of the
vector field f . It follows that                                                   PI(X)   = P”(’p-,(x))[det            D&-,(X)]   -’
          PI ( x ) = Po (cp - I ( x ) ) exp    1 div fix
                                                -         dT.
                                                                        We will assume that p o ( . )is continuous on all of R 2 .
                                                                         It follows that
                                                                                                                 + at on XI
   From the formula given for p,(x), p , ( x > satisfies the
linear first order partial differential equation known clas-
sically as Liouville’s equation:
                                                                                              cPl(X> =   (   x
                                                                                                             x   + bt on X ,
                                                                        and similarly that
                         =   -div ( p , ( x ) f ( x ) )
                                                                                           cp-,(x)   =   i   x - ut on XI
                                                                                                             x   -   bt on   x,.
                                                                        To avoid a trival solution, we assume that the vectors
                                                                        a , b E R 2 satisfy
If p,(x) is evaluated along the flow of i I= f ( x f ) , initial
from x, then it follows that                                               i> ( a , n ) < c
                                                                          ii) ( b , n ) > c
                                                                        which guarantees that the boundary b,, is not an invari-
                                                                        ant set for the flow cp,(x) on R 2 and that neither XI or
                                                                        X , is an invariant set for the restriction of ‘ p l ( x ) to XI
                                                                        and X,, respectively.
                                                                           Let p l ( x ) and q,(t) denote the solutions of the Liouville
                                                                        equation restricted to the open sets XI and X,. The
a time variant linear ordinary differential equation. Note
                                                                        “matching condition” at the boundary b,, is determined
the solutions of 1,= f(x,) are simply the characteristic
curves associated with Liouville’s equation.                            Y
   The fact that the vector field f is C’ was used implic-         lim P l ( Y >det D’pllq,(y) lim 4 1 ( 2 ) det Dcpllq-,(z).
                                                                  y+x+                          2-x-
itly in the derivation of Liouville’s equation. If the vector
field f is C ’ , except along surfaces in R”, then Liouville’s Here, x + and x - denote the limit point X E b,, of
equation is valid only in the regions where f is C ’ . The sequences converging to x from the interior of the sets
important question is then: Given that Liouville’s equa- X , and X,, respectively.
tion holds in certain regions of the state space, how are        The matching condition requires that
solutions of the individual equations “matched” at the
boundaries of the regions? The mathematical details are                          P A X + 1 - det D’ptlv-,(x--)

discussed in [23]-[25]; we will explain the results here in                      q,(x- 1 det Dcpllvp,(x+)    .
terms of an example. A recent paper by MalhamC and
                                                                 For this problem it is possible to calculate the ratio on
Chong [28] treats a similar problem.
                                                               the right-hand side of the above equation. It follows that
   Example 2: Consider a nonlinear system evolving on R2
defined by [23]                                                                   det D’pl,qp,(x-)( b , n )

         dw(t)=f(x(t))dt,                  x(t)ER2;t>0                                        det DcpI’P-,(X+)u , n >.
where the vector field       f on R2 is given by                        This leads to the matching condition:
                   f(X)    =    ( f:       x

                                               E   x,.
                                                                                       pt(x+)(a,n) q,(x-)(b,n).

                                                                          The terms ( a , n ) and ( b ,n ) are the magnitudes of the
Let n be a vector in R 2 , and define                                   velocity field on the boundary in the direction n for the
                                                                        systems defined on XI and X , respectively, i.e., the
                  XI = { x E R 2 :( x , n ) > c)                        matching condition can be interpreted in the context of a
and                                                                     conservation law. The “flow densities” p , ( x > aand q,(x)b,
                                                                        associated with evolution in the sets XI and X,, is
                  X,   =   {x   E R 2: ( X ,n   ) <C}
                                                                        conserved along directions normal to the switching sur-
where (., .) is the standard inner product on R 2 and c is              face. In this context we recognize that Liouville’s equation
796                                                                               ILEE TKAhSAC'TIONS O N C'IRC'LJITS A N D SYSTEMS, VOI   ,   37, N O . 6. J l J N E 1990

is essentially derived from the differential of a conserva-                       acterization of contingencies, faults, disturbances, etc., in
tion law for probability mass (or volume) throughout the                          an interval [t,,,t,,+ TI; the probabilistic power system
sate space. This completes the example.                                           model is used to evaluate how the system will respond on
   The results presented in the example can be stated                             this interval. The security measure p ( t ) is calculated by
formally as a theorem.
   Theorem: Consider the dynamical system
                      & ( t ) =F(x(t),A(t))dt

where the structure evolution is as described above. Let                          where the sum is over all indexes ( i ,k ) which encode the
rTL(.v.t) denote the flow density associated with x E X ,                         possible structural variations of the system and where D
and A = A,, E -1,. . Then if P , ( x ,t ) is the vector of proba-
                   k                                                              is the dynamic security region D. p ( t ) is the probability
bility densities as defined previously:                                           that the system is dynamically secure at time t. This
                                                                                  requires the following steps.
       - P , ( s , t ) =diag{ -div         rjk(X,t)}       +AjP,(x,t).                1) Determine a dynamic security region D which is a
       at                                                                         subset of the state-structure space as outlined in Sec-
Subject to the matching conditions at the boundary b,,:                           tion 111.
                                                                                      2) Given the initial distributions of x(t,,), A(t,,), the                             m
       C( r i k ( x , t ) , n i j ( x ) ) = C ( r j , ( x , t > , n , , ( x ) )   probabilistic evolution of x(t), A ( t ) over [ t o , o + T ] is ob-
                                                                              7                                                       t
        k                                     I                                   tained by solving the system of partial differential equa-                                0
where the indexes k , l range over all possible values                            tions presented in Section IV. The equations are subject
encoding the state dependent structure changes across b,,                         to the conservation constraints and the use of the mathe-
and                is the normal to the boundary b,, at the point                 matical model of the system described in Section 11. The
x E blj.                                                                          solution of the partial differential equations determines
     Here, i = 1,2; . ., M , where M is the number of sets in                     the evolution of the joint probability distribution of the
the partition of the state space X . j ranges over the set of                     system for a fixed operating policy and for a given statisti-
indices encoding the shared boundaries between the par-                           cal characterization of the primary events.
tition X , and the sets X,, k = 1,2;. .. M , k # i.                                   3) A probabilistic measure of dynamic security p ( f ) is
    Remarks: 1) A similar mathematical problem formula-                           then calculated as the integral of the joint probability
tion models the development of shock waves in fluids, see                         distribution calculated in step 2) over the dynamic secu-
[311 or the propagation of electromagnetic shock waves,                           rity region ( D ) , defined in step 1). The system is said to
i.e., the Eikonal equation, see [32]. 2 ) The conservation                        be dynamically secure if this measure is above a security
law in the theorem states that even though the velocity                           threshold (determined a priori by the operator); otherwise
field of the system is discontinuous at the boundaries b,,                        it is said to be dynamically insecure and then security
which induces impulsive behavior in the gradient of the                           enhancement procedures are required.
velocity field at the boundaries, that the flow density is                           Example 1: (continued) The security measure p ( f ) is
conserved along directions normal to the boundary sur-                            defined as the probability at a time t that the system state
face bij. This of course, assumes there is no complete                            ( x , , x,) is in the interior of the dynamic security region, as
reflection or absorption at the boundary. 3) The P , k ( x , t )                  given in Fig. 5. Since only a simplified model of the
are initialized by a density P , , ( x , t , , ) which accounts for               generators is used, the results are only valid over a limited
the initial uncertainty of x(t,,) on A . 4) For example 2, the                    time interval. As defined, the security measure is an
matching conditions from the theorem requires that                                instantaneous time-varying measure of the vulnerability of
p , ( x ) ( a ,n ) = q,(x)( b, n ) , for x E b , 2 .This is the same as           the current system state and network topology to stochas-
derived in the example by analytical methods.                                     tic contingency events. Fig. 6 illustrates the results of the
                                                                                  computation for the example system being studied. All
  V.                     SECURITY
                 TO             ASSESSMENI                                        possible changes in the system structure, as a result of
  The power system can be modeled by a system of                                  primary and secondary events, were considered in the
differential equations of the form                                                determination of the security measure according to their
                                                                                  probability of occurrence. From Fig. 5 , at t = 2 s, the
                      dw ( t ) = F ( x ( t ) , A( t ) ) dt.
                                                                                  security measure is 0.849. The sensitivity of the security
A dynamic security region D c X x A is defined for the                            measure to changes in the probability of occurrence of
system such that whenever the state and structure of the                          the primary events was also studied. This was accom-
system ( . v ( f ) . A ( t ) ) E , then the system is said to be                  plished by decreasing the mean time between failures for
dvnamicallv secure. We introduce a security measure for                           each state independent failure event, one at a time, and
the system. p(r 1 which is the probability that the system is                     then recomputing the security measure. For the same
d!.namicall! secure at the time t . Our interpretation of                         system, the security measure at t = 2 s is equal t o Oh2 and
the security assessment problem is as a dynamic forecast-                         0.60 for the cases that generators 1 and 2, respectively,
ing or prediction problem. That is. given that at the                             are out of service with a failure rate of 0.2 s- for each.
current time. say r , ) . ( d r , , ) )E D. and a probabilistic char-             For the case of transmission line losses, the security
LOPARO A N D ABDEL MALEK: APPROACH TO DYNAMIC POWER SYSTEM SECURITY                                                                        797

                                                                          During emergency conditions, this measure can be
               0.9  h                                                     extremely important to identify the impact of cas-
                                                                          cading events and to further collapse of the system
                                                                          by providing an indicator the operator for timely
                                                                          preventive control actions which are necessary to
                                                I                         maintain normal operation.

               O5       015   1’0      1’5   2’0    2’5    1
                                                          30         In the way of an example, a simple power system model
                                    TIME, sec                     which includes the interaction between the dynamic state
                               Fig. 6.                            of the system and the network topology is presented. The
                                                                  model includes state independent (random) switches and
                                                                  state dependent (controlled) switches which characterize
                                                                  the primary and secondary disturbance events which are
                                                                  disrupting normal operations.
measure at t = 2 s slightly decreased to 0.84, 0.82, and             Although a simplistic model of the power system was
0.83 for the loss of transmission lines 5, 4, and 3 , respec-     used in this example, the basic concepts of the approach
tively; again a failure rate of 0.2 s - ’ is used for each.       have been tested and the results are encouraging. Even
                     VI.      CONCLUSIONS                         through a transient analysis was carried out in the exam-
                                                                  ple, the real emphasis of the work is directed toward
  The problem of dynamic security assessment of power             long-term dynamic security assessment. In this context,
systems is addressed in this paper in a rather unique and         the importance of cascading events and the interaction of
general form. In conclusion, the contributions of this            the dynamic state of the system with the network configu-
work may be outlined as follows.                                  ration is important. Also, for long-term analysis the pre-
      Develop a power system model adequate for ana-              diction horizon will be sufficiently far into the future so
      lyzing the dynamic behavior of the system. The              that the approach may be computationally feasible. The
      power system is modeled as a dynamical system               a priori information used in the method, e.g., the distribu-
      with state-dependent and state-independent varia-           tion of primary events, can be updated as necessary to
      tion of its structure; i.e., all the different possible     reflect changing environmental, weather, or operating
      changes in the structure of the system are included         conditions. This was briefly addressed in the sensitivity
      in the model. The effect of primary (state-indepen-         studies performed in the power system example.
      dent) events on the system is modeled by random
      switches. The state of these switches is governed by
      a continuous time finite state jump process, with
      state-dependent transition rates. The effect of sec-                                     REFERENCES
      ondary (state-dependent) events on the system is              [ l ] J. L. Convin and’ W. T. Miles, “Impact assessment of the 1977
                                                                          New York City blackout,” Systems Engineering for Power, Div. of
      modeled by controlled switches. The state of these                  Electrical Energy Systems, U,B. Dep. Energy, July 1978.
      switches is governed by a random process whose                [2] L. H. Fink and K. Carlsen, Operating under stress and strain,”
                                                                          IEEE Spectrum, vol. 15, Mar. 1978.
      change in time corresponds to the crossing of a               [3] T. E. D; Liacco, “Control of power systems via the multi-level
      switching surface by the state process. These                       conce t Case Western Reserve Univ., Systems Research Center,
                                                                          Rep. [RC-68-19, June 1968.
      switching surfaces, defined in the state space, cor-          [4] A. D. Patton, “A probability method for bulk power system
      respond to the setting of the protective relays. This               security assessment, I-Basic concepts,” IEEE Trans. Power App.
                                                                          Syst., vol. PAS-91, pp. 54-61, Jan./Feb. 1972.
      model of the system is an appropriate and conve-              [5] G. C. Ejebe and B. F. Wollenberg, “Automatic contingency selec-
      nient way of representing a power system for evalu-                 tion for on-line security analysis-real time tests,” IEEE Trans.
                                                                          Power App. Syst., vol. PAS-98, Sept./Oct. 1979.
      ating dynamic security.                                       [6] G. Irisarri, A. M. Sasson, and D. Levner, “Automatic contingency
      A dynamic security region was defined as a subset                   selection,” IEEE Trans. Power A p p . Syst., vol. PAS-98, Jan./Feb.
      of the state-structure space such that at any mo-             [7] G. Irisarri and A. M. Sasson, “An automatic contingency selection
                                                                          method for on-line security analysis,” IEEE Trans. Power App.
      ment, an operating point within the region satisfies                Systs.. vol. PAS-100, Apr. 1981.
      all the constraints required for secure power sys-            [8] E. Hnyilicza, S. T. Y. Lee, and F. C. Schweppe, “Steady-state
                                                                          security regions: The set theoretic approach,” in Proc. 1975 PICA
      tem operation.                                                      Conf., pp. 347-355.
      Developed the evolution equations for the distribu-           [9] J. A. DeMaio and R. Fischl, “Fast identification of the steady-state
      tion law of the joint state-structure process of a                  security regions for power system security enhancement,” pre-
                                                                          sented at the IEEE Winter Power Meeting New York, Jan. 1976.
      power system for a fixed operating policy and for           [lo] R. Fischl, G. C. Ejebe, and J. A. DeMaio, Identification of power
      given statistical data of primary events.                           system steady-state security regions under load uncertainty,” pre-
                                                                          sented at the IEEE Summer Power Meeting, Portland, OR, July
      A probabilistic measure for dynamic security of a                   1976.
      power system is introduced as the integral of the           [ l l ] R. Fischl, “The identification of feasible strategies in the presence
                                                                          of uncertainties for planning and operation of power systems,”
      probability density of the state-structure pair over                U.S. Department of Energy Rep. DOE/ET/29115-3, Sept. 1981.
      the dynamic security region. This yields an instan-         [12] F. D. Galiana and M. Banakar, “Approximation formula for
                                                                          dependent load flow variables,” IEEE Trans. Power App. Syst., vol.
      taneous measure of the vulnerability of the system.                 PAS-100, Mar. 1981.
798                                                                           IEEE TRANSACTIONS O N CIRCUITS AND SYSTEMS,    VOL. 37, NO. 6, J U N E 1990

      M. H. Banakar and F. D. Galiana, “Power system security corri-          [34] J. Baillieul et al., “Stochastic methods of dynamic security assess-
      dors-Concept and computation,” I€€€ Trans. Power App. Syst.,                 ment for electric energy systems,” U.S. Dep. of Energy Rep.
      vol. PAS-100, NCJY.  1981.                                                   DOR/ET/29361, Dec. 1984.
      F. D. Galiana, Power-voltage limitations imposed by network             [35] Analytic Sciences Corporation, “Research progress in dynamic
      structure of a power system,” in Proc. 1975 PICA Conf.. pp.                  security assessment,” U S . Dep. of Energy Rep. DOE/ET/29038-
      356-363.                                                                     1, Dec. 1982.
      F. D. Galiana and J. Jarjis, “Feasibility constraints in power          [36] C. L. DeMarco and A. R. Bergen, “Small noise in power system
      systems,” presented at the IEEE Summer Power Meeting, Los                    dynamics and its relation to security assessment,” in Proc. 1985
      Angeles, CA, Julv 1978.                                                      American Control Conf., Boston, MA, pp. 559-560, June 1985.
      F. F. Wu and S. Kumagai, “Steady-state security regions of power        [37] C. L. DeMarco and A. R . Bergen, “ A security measure for
      systems,” I€€€ Trans. Circuits Syst., vol. CAS-29, Nov. 1982.                random load disturbances in nonlinear power system models,”
      R. J. Kaye and F. F. Wu, “Dynamic security regions of power                  IEEE Trans. Circuits Syst., vol. CAS-34, pp, 1546-1557, Dec. 1987.
      systems.” I€€€ Trans. Circuits Syst., vol. CAS-29, Sept. 1982.          [38] K. A. Loparo and G. L. Blankenship, “A probabilistic mechanism
      F. F. Wu and Y. K. Tsai, “Probabilistic dynamic security assess-             for small disturbance instabilities in electric power systems.” IEEE
      ment of power systems: Part I-Basic model.“ IEEE Trans. Cir-                 Trans. Circuits Syst., vol. CAS-32, pp. 177-184, Feb. 1985.
      cuits Syst.. vol. CAS-30, Mar. 1983.
      C. K. Pang et al., “Security evaluation in power system using
      pattern recognition,” IEEE Trans. Pobver App. Syst., vol. PAS-93,
      May/June 1974.
      Y. H. Pao, “Feasibility of using associative memories for static
      security assessment of power system overloads,” EPRI Rep. EL-
      2343. Ap. 1982.
      D. Crevier and M. A. Nourmoussavi, ..Steady-State and transient
      stabilitv domains of power systems.” presented at the IEEE Cana-
      dian Communications and Power Conf., Montreal, P.Q., Oct.
      A. S. Debs and A. R. Benson. “Security assessment of power                                      Kenneth A. Loparo (S’75-M’77-SM’89) re-
      systems,” Systems Engineering for Power: Status and Prospects, in                               ceived the Ph.D. degree in systems and control
      Proc. ERDA Conf., 760867, Aug. 1Y75.                                                            engineering from Case Western Reserve Uni-
      A. S. Khadr and K. A. Loparo. “Variable structure stochastic                                    versity, in 1977.
      systems, conservation laws. and the method of characteristics,” in                                 He was an Assistant Professor in the Mechan-
      Proc. of Berkeley-Ames Conf. on Non-Linear Problems in Control                                  ical Engineering Department at Cleveland State
      and Fluid Dynamics, June 1983.                                                                  University from 1977 to 1978 where he received
      K. A. Loparo et al., “Probabilistic methods for dynamic power
      system security evaluation.“ U.S. Dep. of Energy Rep.,                                          the distinguished faculty award for contributions
      DOE/ET/29363-T1, Dec. 1985.                                                                     to teaching and research. From 1978 to the
      F. Maghsoodlou, “Dynamic security assessment in electric power                                  present time he has been on the faculty of Case
      systems,” Ph.D. dissertation, Dep. of Systems Engineering, Case                                 Western Reserve University where he is cur-
      Western Reserve Univ., Aug. 1983.                                       rently an Associate Professor of Systems Engineering and Mechanical
      E. W. Kimbark, “Improvements of power system stability by               and Aerospace Engineering and Associate Director of the Center for
      changes in the network.“ I€€€ Trans. Power App. Syst., vol.             Automation and Intelligent Systems. He has also received wards for
      PAS-88, May 19$9.                                                       distinguished graduate and undergraduate teaching at Case Western
      J. A. Morrison, Moment and correlation functions of solutions of        Reserve University. His research interests are in the areas of nonlinear
      some stochastic matrix differential equations,” J . Math. Phys., vol.
      13, 3, pp. 299-306, Mar. 1972.                                          and stochastic stability, nonlinear filtering and control of stochastic
      R. Malhamt and C. Y. Chong. “Electric load model synthesis by           systems with applications to large-scale electric power systems.
      diffusion approximation of a high-order hybrid-state stochastic           Dr. Loparo is a member of SIAM and AMS and is a past Associate
      system,” IEEE Trans. Automat. Corirr. A C , vol. AC-30, pp.             Editor for the IEEE TRANSACTIONS AUTOMATIC
                                                                                                                    ON              CONTROL.                e
      854-860, Sept. 1985.
      F. Abdel-Malek, “Dynamic power system security,” Ph.D. disser-
      tation, Dep. Electrical Engineering. Case Western Reserve Univ.,
      Cleveland, OH, 1985.
      E. Wong, Stochastic Processes in Information and Dynamical Sys-
      tems. Huntington, NY:Krieger. 1979.
      P. D. Lax, “The formation and decay of shock waves,” Amer.
      Math. Mthly, vol. 79, 3, p 227-241, Mar. 1972.
      Y. Choquet-Bruhat et a r , Analysis. Manrfolds, and Physics. Am-
      sterdam, The Netherlands: North-Holland. 1977, p. 455.
      G. L. Blankenship and L. H. Fink, “Statistical characterizations of
      power system stability and security,” in Proc. Second Lawrence          Fayez Abdel-Malek (M’86), photograph and biography not available at
      Symp. System and Decision Science. Berkeley, CA, 1978.                  time of publication.