Cascading Failure Risk Assessment Considering Protection System Hidden Failures

Cascading failure plays an important role in blackouts. Complex network theory, with the disadvantage of ignoring some of physical features of the power systems, is often utilized to model the cascading failure evolution processes. In this paper, a new risk assessment method based on evolution procedure and dynamic fault trees (DFTs), is proposed to model cascading failures in power systems. DFTs, which extend standard fault tree by allowing the modeling of complex system components’ behaviors and interactions, are introduced to describe the cascading failure mathematical model. The power grid topologies affected by protective relays, circuit breakers and transmission lines are taken into consideration to overcome the disadvantages of complex network theory. The evolution of cascading failures of power system, which is modeled based on the DFT, is significantly closer to the actual physical system behavior. The effectiveness of the proposed risk assessment method is discussed using two test cases.


Introduction
Modern power systems are becoming more and more complex. Most electrical power infrastructures are exposed to severe weather, such as floods, intense heat, blizzards, ice storms, hurricane, or dust storms, et al, resulting in unexpected risks for power systems. In addition, the electrical facilities defects, aging equipment, and abnormal operation state introduce more uncertain vulnerabilities to the power systems [1] [2]. Great efforts have been devoted to the risks analysis in power systems with respect to these vulnerabilities in the past decades.
Risk is defined as the failure probability multiply consequence of associated events in IEEE standard dictionary [3]. Through modeling vulnerable components probability, consequence, and indices, risk analysis provides a more rational way than those determined and probabilistic methodologies. Recently, many achievements with respect to the quantify consequences were proposed. Most of the achievements can be divided into two categories. 1) Utilizing the steady-state indicators such as the generator curtailment, load outage, over current and low-voltage to quantize the consequence [4]- [5]. 2) Developing dynamic indices such as voltage stability margin, transient stability margin and reservation margin to analyze system risks [6]- [7].
However, in the proposed vulnerability assessment methods, the status of power equipment is rarely taken into consideration, which could trigger cascading failures. Firstly, in most of related publications, assumed failure probabilities for equipment are always adopted, ignoring real-time status of equipment, and this is really paradox to real condition. For instance, a heavy load transmission line or a transmission line among storms usually has a greater trip probability. Hence, the equipment online status should be contained in a fault chain to develop a more accurate cascading failure model. Zhang Jun, et al. presented a Bayesian theorem based approach to estimate the thermal overload risks of transmission lines [8]. Yu Sun et al. modeled ice flashover fault by analyzing its characteristic and introduces some vulnerability indices to estimate the risk assessment [9]. Recently, more online information was considered in the models for cascading failures.
The second category is based on the protection systems. The relays distributed in power system prevent the equipment from damage. The hidden failures caused by relays play important role in the cascading failure. De La Ree et al. introduced the hidden failure concept as "a permanent defect that would cause a relay or a relay system to incorrectly and inappropriately remove a circuit element as a direct consequence of another switching event" [10]. Markov theory and Mont-Carlo methods were employed in [11]- [12] to model the hidden failure model for relays and simulate the cascading failure procedure. However, there are usually several protection schemes to guarantee the system reliability, the behavior of power systems would be changed dramatically when hidden failure triggered. The Markov or Monte-Carlo based approach runs short of dealing with these complex protection schemes. The Dynamic Fault Tree (DFT) methodology was developed based on traditionally fault tree analysis and has been experiencing a growing success among reliability engineers [13]. By introducing the priority and-gate (PAND), functional dependency gate (FEDP), hot spare gate (HSP) and so on, it is very convenient to simulate the procedure of hidden failure with time sequence [14]. Correspondingly, the complicated relationships among power facilities online status, protection systems and bus arrangements can be figured out with less calculation and strong adaptability. In this paper, a DFT based method to deal with the fault chain evolution in cascading failures is proposed. The method covers the whole procedure from components' online monitoring status to grid topologies, and illustrates the actual physical behavior. The paper is organized as follows. Framework and methodology are put forward in section II. Transmission lines model is introduced in section III. Relay protection and power circuit breakers are formulated in section IV. Grid connectivity analysis is presented in V. Several numerical cases are given to demonstrate feasibility of the proposed method in section VI, followed by conclusions in section VII.

Framework and Methodology
Blackouts often start with component faults, and enlarged by hidden failures or sequential failures [15]. Addressing hidden failure models is a key aspect for successfully achieving power system cascading models. The evolution process of cascading failure with the characteristic time sequence is shown as in Fig. 1, in which line failures are originally causes for cascading failures. The relays in Fig. 1 may operate normally or failed when line failures occurred. If the relays failed, the backup relays would be triggered, and followed by local and remote breakers tripped. If the relays and breakers operated normally, a new topology is formed. But if the relays operate normally and breaker failed to operate, the backup relays triggered, local and remote breakers tripped and new topology is obtained. A simply cascading failure procedure is illustrated in Fig. 1, Monte-Carlo and Markov theory are usually introduced to simulate the behavior. However, the explosive combinations of state transition make the problem difficult to be solved. Attempts have been made to simplify the problem, the line failure probabilities used to assume invariant values, which is really different from the reality. In addition, the coordination among the relays and bus arrangement make it tremendously difficult to be solved.  The cascading failure procedure described in Fig. 1 can be formulated as in Fig. 2 based on DFT. The failure procedure in Fig.  2 contains three parts according to the route in Fig. 1, the first part is the relays and breakers tripped normally when line failures occurred, the second part is the relay operated normally and breaker failed when line failures occurred, and the last part is relay system failed when line failures occurred. To obtain the cascading failure procedure illustrated in Fig.  2, a general data platform which includes transmission line, relays and breakers online information should be built. In this paper, the historical statistics data (SD), experiment data (ED), real-time data (RD) and manufacturer data (RD), are integrated in the platform, shown as in Fig. 3, followed by fraud data detection, data analysis & transformation, then entry to probabilities calculating process (PCB). The facilities probabilities table in PCB mainly cache the latest data sources for each variable, since the data in proposed platform have different sampling density. The vulnerability calculating process generates an important transmission lines list according to the monitoring data, computes real-time failure probabilities for lines, relays and breakers. The bus configuration and relay coordination are incorporated and the new topologies which are described in detail in Section V, are considered in optimal power flow module. An index based on load curtailment are represented by megawatt (MW) is introduced in this paper.

DFT Model of Transmission Lines, Relays, and Circuit Breakers
Power transmission lines are the bulk transfer of electrical energy, from generating power plants to electrical substations located near the demand centers [16]. Due to the unbalanced primary energy resources distribution in China, the project "west to east electricity transmission" was present in 1986 and gradually put it into practice in last decade. The long distance transmission lines span broadly, and frequently suffering formidable natural conditions, such as the lightening, ice-coated and strong winds.
Huabei Power Grid, which is just a small part of Chinese power grid, had more than 150 failures for 500kV transmission lines in 2012 [17]. The power gird subjected to severe risks of damage due to these high-frequently line failures. The reasons for line failures various, and mainly can be classified into two categories, internal conditions and external conditions. The interactions between internal lines characteristic conditions and external natural conditions trip the lines, with the formalization of line droop, line sway, and line broken, shown as in Fig. 4, which account for 90% line failures according to [17].
The line droops in Fig. 4, which mostly appear in case of high thermal and ice-coated, would trip the line with a higher probability, suppose the line vertical stress greater than a thresh value which is expressed by a FDEP gate. The reasons account for thermal contains power flow (PF) and line temperature (LT), and the causes for ice-coated are LT, humidity (HU) and wind speed (WS). The line swaying are often caused by WS, line direction (LD), and tower type (TT), if the amplitude of line swaying is greater than a thresh value, the line would be tripped due to the discharge between phases. The thunder storm in Fig. 4 mainly contains insulation level (IL), connector slack (CS), ground connection (GC), and thunder density (TD). The basic events in Fig. 4 can be obtained from the data resources in Fig. 3. The transmission lines failure probabilities therefore are obtained through the DFT in Fig. 4.
Protective relays are devices designed to trip circuit breakers when a fault occurred. However, hidden failures for protective relays may lead to unexpected and severe results in power system. In fact, the hidden failures are occasionally along with the blackout according to recent studies. The reasons account for hidden failures are varied, and in this paper they are divided into CT/VT part, hardware part and logic design part, shown as in Fig. 5. The CT/VT part mainly includes CT/VT saturation (CVS) and CT/VT line break (CVB). The logic design part contains engineering design (ED), protection threshold (PS), and principle mistake (PM). The hardware part, which usually employ two mutual spare system especially in high voltage power systems, is represented by a HSP gate. For each input of HSP gate, it has six components, product quality (PQ), program abnormal (PA), man-made damage (MA), degradation (DE), electromagnetic interference (EI), and communication error (CE). There are totally 11 basic events in Fig. 5, the values of basic events have great effects on the relay operation failure probabilities.
Power circuit breakers are complex systems which sit in power systems idle for months or years until called upon by relays to change the operation configuration or clear faults in tens of milliseconds. The circuit breaker failure probabilities can be divided into three parts, mechanical features, electrical features and features related to circuit breaker types, shown as in Fig. 6. In mechanical part, it is relates to connects wears (CW), trip/close coils (TC) and auxiliary status (AS). The electrical part mainly contains the current carrying (CC) and breaker insulating (BI). The circuit breaker type part represented by exclusive-OR gate, is composed of oil breaker, vacuum breaker and SF6 breaker. The oil breaker whose arc are blow-out by oil is represented by oil status (OS), the vacuum breaker contains switch operation condition (SC) and voltage withstand (VW), the SF6 breaker have the basic events of SC and gas status (GS).

Interaction Model Among Bus Arrangement, Relays Coordination and Circuit Breakers
The reliability of power system are directly affected by the circuit breakers, bus arrangement and coordination of relays. The bus arrangement and relay coordination should be considered when analyzing the cascading failure for real power systems. However, the interactions among the circuit breakers, bus arrangement and relays are very complicated. The power system topologies in cascading failures can be obtained through interaction analysis of these facilities.
The substations, which are most important parts of power system, perform functions to connect with generation and loads and integrated with plenty of power facilities. The bus arrangement, such as one-bus one-breaker, breaker and a half et al, are employed in many substations. The protection schemes, such as transmission line protection, bus protection et al, are utilized to protect facilities in case of faults occurred, by tripping the circuit breaker coils. To analysis system topology which affected by bus arrangement and relays coordination, a detailed model is needed. Assume that breaker and a half bus arrangement in a substation is illustrated in Fig. 7 (a), in which contains 8 circuit breakers, 4 transmission lines, and 5 protection schemes. Suppose that the R i represents for the i-th protection scheme, then the protection in Fig. 7 (a) can be expressed in (1) Where m is the number of protection schemes in a substation, and n is the number of breaker controlled by R i , and B j is j-th circuit breaker controlled by R i .
Note that the relays in (1) may be triggered correctly as designed, or operated incorrectly due to various reasons, therefore, the backup protection for each R i in (1) need to be explored and shown as in (2).
Where R ib is backup protection of R i , k is the number of circuit breakers controlled by R ib , and B p is the p-th breaker for backup protection R ib .
Assume that one and a half bus arrangement is adopted in a substation, shown as in Fig. 7, in which differential protection for Bus27-A, Bus27-B, 1-st serial, 2-nd serial and 3-rd serial, and transmission line protection for lines 1-5 are adopted. The grid topologies generated by (1) and (2) can be compute through simple graph theory.

Case Studies
In this section, two cases are simulated to demonstrate the effective of proposed methodology in the paper.
A. Modified IEEE 9-bus Case A is a typical system referenced from "IEEE guide for protective relay applications", the bus arrangement and protection relay schemes are complemented, shown as Fig. 8, in which contains four types of protection, bus differential protections, serial bus differential protections for 3/2 bus arrangement, distance protection for transmission lines and malfunction protection for all circuit breakers.

Fig. 8. A typical test system diagram.
The historical statistics of wind speed, temperature, humidity et al which are illustrated in Fig. 4 can be obtained from the proposed data platform, such as SD, ED, RD and MD data sources. To analysis the relationship between transmission line failure probabilities and these statistics data, three typical curves are provided in Fig. 9, in which the statistics parameters are normalized. Fig. 9 (a) provides a bathtub curve, Fig. 9 (b) provides an exponential-like curve and Fig. 9 (c) shows a straight-line curve. The failure probabilities of transmission lines can be obtained through normalized online monitoring parameters. Specially, the basic events PF, HU, WS, IL, CS, GC can be descried in Fig. 9 (a), the basic event LT can be described in Fig. 9 (b) and the basic events LD, TT, TD can be described in Fig. 9 (c).   Protective relays for the same component always duplicated in high reliability systems, and a HSP gate is employed in dynamic faults tree and the Markov theory is employed to solve the problem.
Assume that the historical statistic for protective relays in Fig.5 is list in TABLE V, then the failure probabilities for circuit breakers are 1.15e-3, 1.15e-3 and 0.95 for oil, vacuum and SF6 breakers respectively. In this paper, the system topology not only depend on the circuit behavior, but also the state of the breakers and bus arrangement. There are totally five types of protective relays, the procedure may introduced, line 1 failure->relay 3 for line1 start->breaker A, B and I open -> breaker open failure at a certain probability->malfunction relay 4and backup relay start ->breakers J, K or C or D open->Line 1 trip->serial differential relay 2for G2 and line3 triggered incorrectly->G1 and G2 outage->blackout.
Test case simulation results are list in TABLE VI, in which line 1 failure probability is 0.3 and line 2 failure probability is 0.03, and both relay failure probability are the same. The load curtailment 1 is directly curtailment when line tripped and load curtailment 2 is curtailment considering hidden failures. The risk for line 1 is 1.92 and line 2 is 0.84. The 68-bus system is reduced order equivalent of the New England test system (NETS) and New York power system (NYPS). It is a test case carried over 68-bus, 16-machine, 86-transmission lines, and 5-area system. There are 6 tie-lines between NETS and NYPS, which located among bus60, bus61, bus27, bus54 and bus53. Now suppose the bus arrangement of bus 60 is single bus, bus61 is double-bus, and bus27-bus54-bus53 are 3/2 bus. Suppose differential protection relay and serial differential protection relays are assembled in bus27-bus54-bus53, shown as Fig. 11. Moreover, distance protection are utilized in each transmission line, and breaker failure protection is issued to trip all the bus breakers that are presently connected.
Assume that parameters of transmission lines, relays and breakers are the same with case A, then risks in Fig. 10   Note that the bus25 and bus54 are the bus rod for generators and play more important roles than bus 60 and bus 61. However, the former have less risks than the latter due to more sophisticated bus arrangement. As for bus 60 and bus 61, it is easily curtailment the entire buses for variety reasons, such as differential relay unnecessary operation or circuit breaker operation failures. To improve the reliability, more attention should pay on operation configuration and protection relays.
Actually, circuit breakers are not always closed due to maintenance or function test. In Fig. 12 (a), breaker 5312 and 5332 on bus 53 are out of service. Suppose a severe failure occurred on line bus53-bus27, breaker 5321 and 5322 would be tripped instantaneously in stage 1; then a hidden failure may happen sequentially, in Fig. 12(b), relay or breaker malfunction may trip breaker 5323, 5311, 5311 and 5341; in Fig. 12(c), bus differential relay on bus53-A and serial differential relay on the second serial active due to unknown reasons; in Fig. 12(d), bus differential relay on bus53-B and serial differential relay on the second serial active. According to the graph theory, the bus 53 maintains its integrity. However, all these may result in severe unpredictable problems, table VIII illustrates the corresponding risks results and the risks for line 6 considering maintenance is 0.4434. Fig. 11. Bus arrangement for tie-lines.

Conclusions
Analyzing the hidden failure and its influence are the most complex part in cascading failures since the state transition and time sequence make it difficult to build an accurate mathematical model. The DFT extends standard fault trees by allowing the modeling of complex system components' behaviors and interactions, and is introduced to model the behaviors of cascading failures. Based on the DFT and graph theory, a cascading failure risk assessment methodology with the merits of distinct physical meanings and decreased calculation is presented in the paper. Starting from the transmission lines and tracing the evolution of cascading failures, the methodology successfully illustrates the cascading procedure and provides the computational risk results. The numerical results verified the effectiveness of the proposed methods.