Reliability analysis of power system based on generalized stochastic petri nets

Reliability Analysis of Power System based onGeneralized Stochastic Petri Nets Juliano S.. In the present work, we address the reliability analysis of power systems using the Generalized

Reliability Analysis of Power System based on

Generalized Stochastic Petri Nets

Juliano S A Carneiro, Luca Ferrarini

Dipartimento di Elettronica e Informazione

Politecnico di Milano Piazza Leonardo da Vinci 32, 20133, Milan, Italy

Abstract— Hidden failures in protection schemes, the

tradi-tional N − 1 security criterion and the introduction of the

electricity market are usually major causes in the recent wide

area blackouts In the present work, we address the reliability

analysis of power systems using the Generalized Stochastic

Petri Nets (GSPN) The proposed modeling approach considers

not only the most common failures of power system elements,

i.e short-circuit, breakdown, lightning, but also the improper

operations of protection schemes In addition, the dependency on

the system operating conditions has been introduced according

to the GSPN formalism (marking-dependency), which allows for

the propagation of harmful events At last, well-known techniques

such as reachability graph might be used to retrieve the reliability

information of the system under investigation

I INTRODUCTION

The reliability of electric power systems is currently

under-going numerous investigations, mainly after the latest wide

area blackouts Essentially, the introduction of electricity

market and also the old-fashioned protection schemes have

been recognized as the major causes of catastrophic events

In fact, the electrical market trends toward a more efficient

production, transmission and distribution of energy, and thus

exploiting fully the electric resources On the other side, such

a concept shortens drastically the safety guards of power

systems and requires novel operating criteria to keep them

safe Nevertheless, the protection schemes are still based on

the classical “N-1 criterion”, once extremely efficient, but

currently inadequate to face with critical operating conditions

created by this modern market-driven organization

Studies conduced by NERC, UTCE and others revealed that

protection system failures are often involved in the most

seri-ous blackouts Generally, the impact of a particular hazardseri-ous

event is minimized if the occurrence is promptly identified and

eliminated as soon as possible [2] This procedure helps to

prevent “N-k contingencies” caused by cascading effects [1],

[4], [10], and then it reduces the probability of catastrophic

failures in power systems Clearly, the protection system

plays an important role in this scenario, since it avoids the

disturbance propagation by removing the damaged component

and/or section from the rest of the grid

There are two sorts of safety requirements concerning the

protection systems: the dependability, which is the ability to

operate correctly when required, and the security, which means

the ability to refrain from unnecessary tripping (undesired

tripping) The dependability is achieved by redundant

protec-tion schemes and has often taken priority with respect to the security However, security aspects have become particularly important after the introduction of the electricity market For example, the line power flows during either heavy load conditions or maintenance operations can induce undesired tripping of distance protections In this case, a line tripping will lead to an additional stress in the system that might contribute

to widespread blackouts This simple example illustrates a

case of hidden failures, defined in [11] as: a defect such as a component failure, inappropriate setting or incorrect external connection that remains undetected until some other system event causes the hidden failure to initiate a cascading outage.

It is worth noting that hidden failures cannot be easily de-tected and frequently lead to large outages [5], [9] Moreover, the example shows that a given disturbance might produce different consequences depending on the power system state

In conclusion, the reliability of protection schemes, understood

as the union of dependability and security, and its dependency

on the system operating conditions, deserve all attention when analyzing and designing modern power systems [12] The Petri Net (PN) paradigm is suitable to represent event-driven systems, which are characterized by a set of states (configurations) and a set of evolution rules (events) Many authors used different types of PNs to model reliability aspects

in wide application fields [4], [6], [7] In this paper, we present a formal model based on Generalized Stochastic Petri Nets (GPSN) for the reliability analysis of transmission power systems

II GENERALIZEDSTOCHASTICPETRINETS

Petri Nets are extremely useful for performance evaluation and description of distributed systems characterized by sequen-tiality, concurrency, synchronization, among others Specifi-cally, the GSPN [8] is one of the several extension of standard PNs and is obtained by allowing transitions to belong to two

different classes: immediate transitions and timed transitions.

Immediate transitions fire in zero time once they are enabled Timed transitions fire after a random, exponentially distributed enabling time Formally, a GPSN can be defined as follows:

Definition 1: A GSPN is an 8-tuple:

N = {P, T, Π, I, O, H, W, M0}

where:

• P is the set of places;

• T is the set of transitions,

T = T im ∪ T tim ; T im ∩ T tim = ∅

whereT immeans immediate transitions andT tim means

timed transitions;

• Π : T → N is the priority function that maps transitions

onto natural numbers representing their priority levels,

∀t k ∈ T tim , Π(t k ) = 0; ∀t k ∈ T im , Π(t k ) > 0;

• I, O, H : T → Bag(P ), are the input, output and

inhibition functions, respectively.Bag(P ) is the multiset

on P;

• W : (T × M) → + is the stochastic function that maps

transitions onto real numbers representing their firing

rates depending on the marking M,

W (t k , M) =



λ k , if t k ∈ T tim

ω k , if t k ∈ T im

• M0 : P → N is the initial marking, a function that

associates each place with a natural number

The dynamic evolution of the PN marking that is governed

by transition firings that, once enabled, remove tokens from

upstream places and add them to downstream places In short,

a transition t k has concession if and only if (i) each input

place contains a number of tokens greater or equal than a given

threshold, and (ii) each inhibitor place contains a number of

tokens strictly smaller than a given threshold

Definition 2 (Concession): Transition t k has concession in

marking M if and only if:

∀p ∈ • t k , M(p) ≥ I(t k , p) ∧ ∀p ∈ ◦ t k , M(p) ≤ H(t k , p)

Instead, a transitiont kis said to be enabled if it has concession

in marking M, and if no other transition t j ∈ T of priority

Πj > Π k exists that has concession in the same markingM.

Definition 3 (Enabling): Transition t k is enabled in

mark-ing M if and only if:

• t k has concession in marking M and,

• Π(t k ) > Π(t j ), ∀t j ∈ T that have concession.

When transitiont kfires, it deletes from each place in its input

set• t kas many tokens as the multiplicity of the arc connecting

that place to t k, and adds to each place in its output sett k

as many tokens as the multiplicity of the arc connectingt k to

that place

Definition 4 (Firing): The firing of transition t k, enabled in

markingM, produces marking M  such that:

M  = M + O(t k ) − I(t k) The GSPN just introduced consists in a powerful tool to

model power systems Phenomena like component failure,

short-circuit, lightning, etc, are always present in real systems

and occur randomly Such events, together with control and

protection actions, can be suitable represented through the

GSPN, as described in the following sections

III GENERALMODELSTRUCTURE

The general model representing the power system under

investigation is composed of three major blocks: Electrical Topology Network (ETN), Stochastic Model Network (SMN) and Current Evaluation Network (CEN) These sub-networks

communicate and exchange the required information to repre-sent and describe the power system evolution Basically, the SMN acts as the “core” of the general model, while ETN and CEN support the logical and stochastic evolution of the SMN

A Electrical Topology Network

The Electrical Topology Network computes the electrical connectivity of each component of the system Essentially, the ETN operates based on the information regarding the states of the components, e.g open/closed for circuit breakers, out-of-order/working for lines and transformers Such information come from the SMN though appropriate signal connectors, as will be discussed later In addition, the ETN has the physical location of generation groups in order to identify the supplied components

Informally, the strategy used to compute the electrical connectivity can be so outlined: starting from the generation groups (GEN), the search algorithm identifies step by step the graphs representing lines (L), station bars (SB) and trans-formers (T) connected to at least one generation point For such scope, we created a modular basic element that contains two places: the electrical state (E ST) and the physical state (P ST), as shown in the box of Fig 1 The former place

is marked when the component is connected to a generation point, whereas the latter place is marked if the the component state permits the electrical connectivity (data available in the SMN) Beside the places, the basic element is endowed with immediate transitions that propagate the token representing the electrical connection as far as possible In short, the evolution

of ETN1, illustrated in Fig 1, can be described as follows: 1) A message is sent to the ETN after changing the state

of a component of the SMN;

2) The ETN clears all electrical places once the message from the ETN is received;

3) A token diffusion starts from the generation points and establishes a new electrical topology

B Stochastic Model Network

The Stochastic Model Network is composed of several sub-blocks interconnected among them Such sub-sub-blocks represent the different components of the transmission grid, whereas their interconnections symbolize the logical interactions The construction rule for each sub-block follows two steps: 1) Identification and description of states (configurations); 2) Specification of transitions (events)

The result of such a procedure can be then synthesized in a Markov Chain enriched by extra elements The function of such elements regards the conditioning of internal transitions

1 Note the station bar contains only the electrical state That because we decided to not consider the bus breaking.

Fig 1 An example of the Electrical Topology Network

according to external events To clarify these concepts, we

proceed with some modeling examples of the most important

components of transmission systems: power lines, protection

schemes, circuit breakers, bus bars and transformers

1) Transmission Line Model: The model takes into account

the fact that the line can be short-circuited temporally(L SC)

or permanently(L SC P) Furthermore, the line can be either

hit by lightnings(L F LASH ), or it can be broken (L F AIL), or

clearly it can be in normal state (L OK) Note that the states

just introduced are mutually exclusive, which means that

short-circuit, lightning and breaking cannot happen

contemporane-ously

The evolution of line model (Fig 2 (a)) is governed by the

following discrete events (temporized/immediate transitions):

T L F LASH Line is struck by a lightning;

T L F OK Lightning extinguishes autonomously and

the line returns to normal state;

T L SC Line goes from the normal state to

short-circuit with ground;

T L SC OK Short-circuit extinguishes autonomously;

tL 

SC E Short-circuit extinguishes after the

interven-tion of protecinterven-tions (immediate transiinterven-tion);

T L SC P Line goes from normal state to permanent

short-circuit with ground;

T L SC REP Line is repaired to eliminate the permanent

short-circuit;

T L F AIL Line failure (normally caused by an object);

T L REP Line is restored to normal state;

T L F SC Line goes to short-circuit because of a

light-ning The energy of the lightning is consid-ered to be discharged to the ground;

T L F F AIL Line failure caused by a lightning The

effect of the lightning is extinguished;

T L SC F AIL Line failure due to short-circuit (normally

caused by the breaking of an insulator)

2) Protection Model: The protection model is unique for

all components It recognizes a failure in the element under

control and commands the associated breaker to open As mentioned before, the protection model must describe both dependability and security aspects Therefore, the protection not only can be damaged (failure to operate), but also can be subjected to undesired tripping (operate when not required)

In addition, the protection model includes the Breaker Failure Device (BFD) This element, located in every bus of the system, recognizes failures in a breaker opening and orders the remaining interrupters connected to that particular bus station

to open The overall behavior of the protection model, as well

as its resultant Petri Net (Fig 2 (b)), can be summarized as follows:

T P F AIL Protection failure;

T P REP Protection is repaired;

T P T RIP Protection identifies properly a failure in

the component under control;

T P UT Protection commands the breaker opening

in absence of failure (undesired tripping);

T P READY Protection returns to normal state when the

fault is eliminated;

T BF D F AIL BFD failure;

T BF D REP Protection is repaired;

T BF D T RIP BDF identifies a failure in the breaker

opening and commands the remaining in-terruptors to open;

T BF D READY BFD returns to normal state when the fault

is eliminated;

The Fig 2 exemplifies some of the interconnections among the internal blocks of the SMN In particular, the place

(P OK ) is used to condition the protection tripping (T P T RIP) Moreover, it imposes constraints to the resetting of both pro-tection (T P READY ) and BFD (T BF D READY) The place

(I OP EN), instead, indicates an open breaker and it is used to coordinate the protection and the BFD operation

3) Circuit Breaker Model: The breaker has been modeled

with a similar approach It consists of four main logical states: open, closed, stuck closed and stuck open Automatic circuit reclosers (I RECLOSE) are also considered and have been included inside the breaker model The reclosers interrupt and reclose an ac circuit with a preset sequence of trip-ping/reclosing to eliminate temporally faults After the first opening, the breaker is automatic closed by the fast recloser

(T I CLOSE) If the breaker opens again (permanent fault), then it can be closed only through the transition(T I CLOSE2) Such a transition will be conditioned to the fact that the lines attached to it are in normal state The PN model of the circuit breaker is sketched in Fig 2 (c) and the transitions from one state to another one are reported below:

T I OP EN Breaker opening triggered by the associated

protection;

T I CLOSE Fast reclosure of the breaker;

T I CLOSE2 Reclosure of the breaker conditioned by the

normal state of connected elements;

T I ST UCK O Breaker stuck in open condition;

T I REP O Breaker reparation (set to open state);

Fig 2 Stochastic Model Network (a) Line model (b) Protection model (c) Circuit breaker model.

T I ST UCK C Breaker stuck in closed condition;

T I REP C Breaker reparation (set to closed state);

T I REC END Fast recloser resetting

4) Station bus and transformers: Similarly, also bars and

transformers have been modeled In short, the station bus

can be either hit by lightning or short-circuited, whereas the

transformers can be short-circuited or broken down Details

are here omitted for the sake of simplicity

To the present time, the stochastic transitions were supposed

to have constant probability of firing However, there is a

strong correlation between the operating conditions of power

systems and the probability of harmful events To consider this

dependency, we developed the CEN described next

C Current Evaluation Network

The scope of the Current Evaluation Network is to condition

the firing probability of stochastic transition defined in the

SMN according to the current flowing in the transmission

system That could be done by associating a piecewise

con-stant function to the firing rate of stochastic transitions with

dependency on the electrical topology

In the GSPN formalism, it is possible to work with

parame-ters of transitions that are marking-dependent In other words,

the firing rate λ k of timed transitions, as well the weightω k

of immediate transitions, can be evaluated as the product of a

nominal rate (or weight in the case of immediate transitions)

and a dependency function defined in terms of the marking of

the places that are connected to a transition through its input

and inhibition functions

The idea here consists in introducing a new place p s in

the SMN for each component that contains a transition with

marking-dependency Such a place summarizes, by means of

its markingM(p s), the marking of a finite generic set of places

C = {p n , p n−1 , · · · , p1, p0} Afterwards, it can be used to

condition the parameters of a transition according to the GSPN

formalism

TABLE I

E NCODING EXAMPLE

M(C) = (M p2, Mp1, Mp0) M(p s)

· · · ·

For simplicity, let us suppose to work with safe Petri Nets (1-bounded places) and that M0 is the initial marking, then the number of tokens in the placep sis computed by (1):

∀M ∈ M0 | M(p s) = 1 +n

i=0

M(p i ) · 2 i (1)

which is nothing more than the binary encoding of the string

M(C) = (M(p n ), M(p n−1 ), · · · , M(p1), M(p0)) plus 1 As

an example, letM(C) be a set of three places Then, we have

the mapping reported in Table I

Once defined the encoding strategy, the GPSN should be extended to introduced the marking-dependency Essentially,

we must include the place p s and an appropriate set of arcs such that the following relations hold true:

M0(p s) = 1 +

n



i=0

M0(p i ) · 2 i (2)

∀p i ∈ C

⎧

⎨

⎩(∀t ∈

• p i ) t −→ p2i s (3)

(∀t ∈ p i • ) p s −→ t2i (4) The initial marking of the placep sis given by (2), while the number of tokens is updated as: (3) for input arcs, and (4) for output arcs A graphic interpretation is shown in the Fig 3

Fig 3 An example of conditioned transition Dashed elements represent the

extra placep sand the auxiliary arcs inserted for conditioning procedure.

Fig 4 Firing rate of timed transitions as a function of current.

The Table I defines an auxiliary functionf i that associates

the current level flowing in a component with the marking of

place p s Such a function will to be used later as the input

of another function, calledf t, which specifies the firing rating

according to the current in the component:

Electrical Topology≡ M(p s)−→ i fi −→ λ ft t

One possible alternative to describe the functionf tis depicted

in Fig 4 The firing rate λ k grows monotonically from zero

to the maximum value according to the measured current

By changing dynamically the firing rate of stochastic

tran-sitions, we are able to describe not only the dependency

of operating conditions, but also the cascading effects The

transitions to be conditioned are listed in Table II Uparrow

and downarrow indicate that the firing probability increases

and decreases proportionally to the current, respectively

In the next section we present an illustrative example

summarizing the introduced concepts The purpose here is

to provide some implementation/simulation hints rather than

present a real case study The subsequent reliability assessment

can be done using reachabiliy graphs obtained from a GSPN

simulation tool, such as GreatSPN [3].

IV AN ILLUSTRATIVE EXAMPLE

In this section we provide a guide to exemplify the most

important features of the proposed modeling approach In

TABLE II

C ONDITIONED TRANSITIONS

Component Transition Firing Rate

Line

T L SC ↑

Transformer

T T SC ↑

Protection T P UP ↑

Breaker T I ST UCK C ↑

particular, we illustrate the dependency of undesired tripping

on the current flowing in the component under control Let us consider the network shown in the left bottom of Fig 5 It is composed of: 6 transmission lines, 5 bars, 13 circuit breaker, 11 protection modules, 5 BFDs and pair of generator/load Note that BFDs, protections and reclosures have been omitted for clearness, as well as the interconnections with the SMN counterpart The Fig 5 illustrates also the equivalent ETN of the example

Due to the large dimension of SMN, just a small section of the overall network is depicted in Fig 2 Specifically, Fig 2 reports the stochastic model of the line L1 and its associated protection, besides the breakerI2 The interconnections among the three components is also evidenced, but those with the ETN have been removed for clarity

In order to simplify our analysis, we suppose that only the lines L1, L5 and L6 can break down, and the protection of

L1 can be exposed of undesired tripping For such a modeling

choice, the possible system configurations and the respective line currents, besides the marking of auxiliary place M(p s), are reported in Table III Since we decided to condition only the transition T P UT of the protection of line L1, then we only need the information contained in the column I1 of Table III This column resumes the current of L1 on each one of the possible configurations and denotes the constant piecewise functionf idefined before Concerning the function

f t representing the probability of undesired tripping of line

L1, we decided to use the example depicted in Fig 4 Note that currents in series branches of the electrical circuit are the same and so the number of columns in Table III can

be significantly reduced in real systems Furthermore, many configurations lead to identical currents and thus clustering procedures can be used to reduced the table dimension Finally, after implementing the power system model in a GSPN simulator environment, the reliability analysis can be performed straightforwardly using the reachability graph

Fig 5 Electrical Topology Network

TABLE III

P OSSIBLE CONFIGURATIONS

L1 L5 L6 I1 I2 I3 I4 I5 I6 M(p s)

0 0 0 a a0 b0 a0 c0 d0 e0 1

0 0 1 b a1 3a1 a1 a1 4a1 0 2

0 1 0 a2 a2 a2 a2 0 2a2 3

a Working b Failure

V CONCLUSION

This paper describes a modeling approach based on the

GPSN to perform reliability analyses The proposed model

is capable to represent complex phenomena of power systems

such as cascading events and protection hidden failures

The most important components of transmission systems

have been modeled in a modular fashion Such approach

enhances the usability of basic elements and allows to built

complex systems by drag-and-drop the desired components

The major drawback of the proposed methodology regards

the scalability When implementing large power systems, the

number of tangible markings (states), and consequently the

reachability graph, may grow quite fast

REFERENCES [1] Z Bie and X Wang, “Evaluation of power system cascading outages,”

in International Conference on Power System Technology, 2002 Pro-ceedings PowerCon 2002., vol 1, October 2002, pp 415–419.

[2] Q Chen, “The probability, identification, and prevention of rare events

in power systems,” Ph.D dissertation, Iowa State University, 2004 [3] G Chiola, , G.Franceschinis, R Gaeta, and M Ribaudo, “Greatspn 1.7: Graphical editor and analyzer for timed and stochastic petri nets.”

Performance Evaluation, special issue on Performance Modeling Tools,

vol 24, no 1-2, pp 47–68, 1995.

[4] I Dobson, B Carreras, V Lynch, and D Newman, “Complex systems analysis of series of blackouts: cascading failure, criticality, and

self-organization,” in Bulk Power System Dynamics and Control, August

2004, pp 438–451.

[5] D Elizondo, J de La Ree, A Phadke, and S Horowitz, “Hidden failures

in protection systems and their impact on wide-area disturbances,” in

IEEE Power Engineering Society Winter Meeting, 2001, vol 2, 2001,

pp 710–714.

[6] L Ferrarini, J Carneiro, S Radaelli, and E Ciapessoni, “Dependability analysis of power system protections using stochastic hybrid simulation

with modelica,” in IEEE International Conference on Robotics and Automation, 2007, April 2007, pp 1584–1589.

[7] N G Leveson and J L Stolzy, “Safety analysis using petri nets,” IEEE Trans Softw Eng., vol 13, no 3, pp 386–397, 1987.

[8] M A Marsan, G.Balbo, G.Conte, S.Donatelli, and G.Franceschinis,

Modelling with Generalized Stochastic Petri Nets John Wiley & Sons,

1995.

[9] A Phadke and J Thorp, “Expose hidden failures to prevent cascading

outages,” IEEE Computer Applications in Power, vol 9, no 3, pp 20–

23, 1996.

[10] J D L Ree, L Yilu, L Mili, A G Phadke, and L Dasilva, “Catas-trophic failures in power systems: causes, analyses, and

countermea-sures,” Proceedings of the IEEE, vol 93, no 5, pp 956–964, 2005.

[11] S Tamronglak, S Horowitz, A Phadke, and J Thorp, “Anatomy of

power system blackouts: preventive relaying strategies,” IEEE Transac-tion on Power Delivery, vol 11, no 2, pp 708–715, 1996.

[12] X Yu and C Singh, “A practical approach for integrated power system

vulnerability analysis with protection failures,” IEEE Transactions on Power Systems, vol 19, no 4, pp 1811–1820, 2004.