Discovering Vulnerabilities in Power Grids

Daniel Bienstock

Columbia University, New York

Madison, 2009

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 1 / 9

The Problem

Background. National-scale blackouts in North America andEurope since Summer/Fall 2003 due to cascading power gridfailures, specifically, cascading failures of transmission systems.Experts agree: more failures inevitable in the future; potentialeconomic and social impact enormous.

The Rub. Modern power grids are robust but not perfect. Hidden,“complex” vulnerabilities remain. We want to discover suchvulnerabilities without becoming excessively conservative

Methodology? The N − k problem: in a grid with N lines, isthere a set of k lines whose simultaneous outage will create asystem instability?

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 2 / 9

The Problem

Background. National-scale blackouts in North America andEurope since Summer/Fall 2003 due to cascading power gridfailures, specifically, cascading failures of transmission systems.Experts agree: more failures inevitable in the future; potentialeconomic and social impact enormous.

The Rub. Modern power grids are robust but not perfect. Hidden,“complex” vulnerabilities remain. We want to discover suchvulnerabilities without becoming excessively conservative

Methodology? The N − k problem: in a grid with N lines, isthere a set of k lines whose simultaneous outage will create asystem instability?

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 2 / 9

The Problem

Background. National-scale blackouts in North America andEurope since Summer/Fall 2003 due to cascading power gridfailures, specifically, cascading failures of transmission systems.Experts agree: more failures inevitable in the future; potentialeconomic and social impact enormous.

The Rub. Modern power grids are robust but not perfect. Hidden,“complex” vulnerabilities remain. We want to discover suchvulnerabilities without becoming excessively conservative

Methodology? The N − k problem: in a grid with N lines, isthere a set of k lines whose simultaneous outage will create asystem instability?

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 2 / 9

Is it the Right Problem?

It is fundamentally a static model – but the sequence of eventscould matter.

The context almost certainly does matter – what is the distributionof demand (and not just in aggregate form). How about generationcapacity? Is the grid “stressed”, impeded or diminished to asignificant degree?

Difficult to explicitly (and accurately) model such stress – lots ofnoise.

The N − k methodology is too slow. Difficult to scale well withincreasing N and, especially, k (e.g. huge jump from 2 to 3).

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 3 / 9

Is it the Right Problem?

It is fundamentally a static model – but the sequence of eventscould matter.

The context almost certainly does matter – what is the distributionof demand (and not just in aggregate form). How about generationcapacity? Is the grid “stressed”, impeded or diminished to asignificant degree?

Difficult to explicitly (and accurately) model such stress – lots ofnoise.

The N − k methodology is too slow. Difficult to scale well withincreasing N and, especially, k (e.g. huge jump from 2 to 3).

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 3 / 9

Is it the Right Problem?

It is fundamentally a static model – but the sequence of eventscould matter.

The context almost certainly does matter – what is the distributionof demand (and not just in aggregate form). How about generationcapacity? Is the grid “stressed”, impeded or diminished to asignificant degree?

Difficult to explicitly (and accurately) model such stress – lots ofnoise.

The N − k methodology is too slow. Difficult to scale well withincreasing N and, especially, k (e.g. huge jump from 2 to 3).

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 3 / 9

Is it the Right Problem?

It is fundamentally a static model – but the sequence of eventscould matter.

The context almost certainly does matter – what is the distributionof demand (and not just in aggregate form). How about generationcapacity? Is the grid “stressed”, impeded or diminished to asignificant degree?

Difficult to explicitly (and accurately) model such stress – lots ofnoise.

The N − k methodology is too slow. Difficult to scale well withincreasing N and, especially, k (e.g. huge jump from 2 to 3).

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 3 / 9

What should we expect from a vulnerability model?

It should be agnostic – ideally, it should be assumption-free, sothat we don’t just find the vulnerabilities we expect to find.

Annoying is a better term. We need out-of-the-box thinking.

It should be adversarial – it should allow a controller vs.adversary game.

Adversary → Controller → Adversary → . . .

From a computational standpoint, it should be fast and scale well.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 4 / 9

What should we expect from a vulnerability model?

It should be agnostic – ideally, it should be assumption-free, sothat we don’t just find the vulnerabilities we expect to find.

Annoying is a better term. We need out-of-the-box thinking.

It should be adversarial – it should allow a controller vs.adversary game.

Adversary → Controller → Adversary → . . .

From a computational standpoint, it should be fast and scale well.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 4 / 9

What should we expect from a vulnerability model?

It should be agnostic – ideally, it should be assumption-free, sothat we don’t just find the vulnerabilities we expect to find.

Annoying is a better term. We need out-of-the-box thinking.

It should be adversarial – it should allow a controller vs.adversary game.

Adversary → Controller → Adversary → . . .

From a computational standpoint, it should be fast and scale well.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 4 / 9

What should we expect from a vulnerability model?

It should be agnostic – ideally, it should be assumption-free, sothat we don’t just find the vulnerabilities we expect to find.

Annoying is a better term. We need out-of-the-box thinking.

It should be adversarial – it should allow a controller vs.adversary game.

Adversary → Controller → Adversary → . . .

From a computational standpoint, it should be fast and scale well.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 4 / 9

What should we expect from a vulnerability model?

It should be agnostic – ideally, it should be assumption-free, sothat we don’t just find the vulnerabilities we expect to find.

Annoying is a better term. We need out-of-the-box thinking.

It should be adversarial – it should allow a controller vs.adversary game.

Adversary → Controller → Adversary → . . .

From a computational standpoint, it should be fast and scale well.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 4 / 9

Why is the N − k model slow?

At the core, it is an enumerational approach.

But an astronomical amount of enumeration would be required ifexplictly carried out. Intelligent, implicit enumeration (integerprogramming) can be used, but even that method is slow.

98 nodes, 204 lines, 15 generatorsS = a vulnerability with k lines was found

F = there is no a vulnerability with ≤ k linesk

Min. throughput 2 3 40.90 193, F 6598, F 206350, S0.88 256, F 15445, F 984743, F0.84 133, F 5565, F 232525, F0.75 213, F 7550, F 100583, F

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 5 / 9

Why is the N − k model slow?

At the core, it is an enumerational approach.

But an astronomical amount of enumeration would be required ifexplictly carried out. Intelligent, implicit enumeration (integerprogramming) can be used, but even that method is slow.

98 nodes, 204 lines, 15 generatorsS = a vulnerability with k lines was found

F = there is no a vulnerability with ≤ k linesk

Min. throughput 2 3 40.90 193, F 6598, F 206350, S0.88 256, F 15445, F 984743, F0.84 133, F 5565, F 232525, F0.75 213, F 7550, F 100583, F

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 5 / 9

Why is the N − k model slow?

At the core, it is an enumerational approach.

But an astronomical amount of enumeration would be required ifexplictly carried out. Intelligent, implicit enumeration (integerprogramming) can be used, but even that method is slow.

98 nodes, 204 lines, 15 generatorsS = a vulnerability with k lines was found

F = there is no a vulnerability with ≤ k linesk

Min. throughput 2 3 40.90 193, F 6598, F 206350, S0.88 256, F 15445, F 984743, F0.84 133, F 5565, F 232525, F0.75 213, F 7550, F 100583, F

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 5 / 9

A new model

The goal: find hidden, complex vulnerabilities of varying severityin an agnostic manner

How: Place stress on the system, see what “shakes out”

A means to an end: assume an adversary has limited power tochange the laws of physics – in order to limit the amount ofsatisfied

and: Find where and to what degree the adversary wants tostress the system.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 6 / 9

A new model

The goal: find hidden, complex vulnerabilities of varying severityin an agnostic manner

How: Place stress on the system, see what “shakes out”

A means to an end: assume an adversary has limited power tochange the laws of physics – in order to limit the amount ofsatisfied

and: Find where and to what degree the adversary wants tostress the system.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 6 / 9

A new model

The goal: find hidden, complex vulnerabilities of varying severityin an agnostic manner

How: Place stress on the system, see what “shakes out”

A means to an end: assume an adversary has limited power tochange the laws of physics – in order to limit the amount ofsatisfied

and: Find where and to what degree the adversary wants tostress the system.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 6 / 9

A new model

The goal: find hidden, complex vulnerabilities of varying severityin an agnostic manner

How: Place stress on the system, see what “shakes out”

A means to an end: assume an adversary has limited power tochange the laws of physics – in order to limit the amount ofsatisfied

and: Find where and to what degree the adversary wants tostress the system.

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 6 / 9

Details:

Basic power flow equation for line between i and j:f ij = x ij (θi − θj ) (linear approx.)f ij = x ij sin (θi − θj ) (lossless case)

f ij = power flow, θi , θj = phase angles, x ij = “impedance”.

Adversary can change the x ij

Fact: If x ij is huge, then line effectively blocked

The adversary is constrained : each individual change isbounded, as is the cumulative change

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 7 / 9

Details:

Basic power flow equation for line between i and j:f ij = x ij (θi − θj ) (linear approx.)f ij = x ij sin (θi − θj ) (lossless case)

f ij = power flow, θi , θj = phase angles, x ij = “impedance”.

Adversary can change the x ij

Fact: If x ij is huge, then line effectively blocked

The adversary is constrained : each individual change isbounded, as is the cumulative change

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 7 / 9

Details:

Basic power flow equation for line between i and j:f ij = x ij (θi − θj ) (linear approx.)f ij = x ij sin (θi − θj ) (lossless case)

f ij = power flow, θi , θj = phase angles, x ij = “impedance”.

Adversary can change the x ij

Fact: If x ij is huge, then line effectively blocked

The adversary is constrained : each individual change isbounded, as is the cumulative change

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 7 / 9

Details:

Basic power flow equation for line between i and j:f ij = x ij (θi − θj ) (linear approx.)f ij = x ij sin (θi − θj ) (lossless case)

f ij = power flow, θi , θj = phase angles, x ij = “impedance”.

Adversary can change the x ij

Fact: If x ij is huge, then line effectively blocked

The adversary is constrained : each individual change isbounded, as is the cumulative change

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 7 / 9

Is the model fast?

Table: 600 nodes, 990 lines

Budget10 20 27 36 40

sec 11848 7500 4502 11251 7800

Its Limit 210 114 Limit 208

Problem is less overtly combinatorial

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 8 / 9

Is the model fast?

Table: 600 nodes, 990 lines

Budget10 20 27 36 40

sec 11848 7500 4502 11251 7800

Its Limit 210 114 Limit 208

Problem is less overtly combinatorial

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 8 / 9

What kind of attack pattern do we get?

Table: Attack histogram

1 ≤ x ij ≤ 20 1 ≤ x ij ≤ 10 1 ≤ x ij ≤ 10x-Range Qtty x-Range Qtty x-Range Qtty[ 1, 1 ] 8 [ 1, 1 ] 1 [ 1, 1 ] 14( 1, 2 ] 72 ( 1, 2 ] 405 ( 1, 2 ] 970( 2, 3 ] 4 ( 2, 9 ] 0 ( 2, 5 ] 3( 5, 6 ] 1 ( 9, 10 ] 3 ( 5, 6 ] 0( 6, 7 ] 1 ( 6, 7 ] 1( 7, 8 ] 4 ( 7, 9 ] 0( 8, 20 ] 0 ( 9, 10 ] 2

Daniel Bienstock ( Columbia University, New York)Discovering Vulnerabilities in Power Grids Madison, 2009 9 / 9