Small Disturbances Can Trigger Cascading Failures in Power Grids

arXiv:1907.12965v1 [eess.SY] 30 Jul 2019 eta oe.Teefaue r ossetwt h empir the the to with practice. propagate in consistent outages subsequently are of and features observation nodes lar These edge incidence, nodes. in central low usuall first it include occur And mode speed. to propagation failure fast that new and summarized destructiveness, this we Through grid, of Spanish process. What’ features the conversion of failu networks. analysis equilibriums overload simulation the unstable the during accompanied in usually lines sta failures failure traditional such cascading ac in worse, disturbances stable trigger small that is detected can then network and the a models abandon failure We that proposed networks. assumption we complex dynamica the in dynamics, the failures analyze network cascading to Motivat induced of stability users. Lyapunov to advances based power fa framework recent of the supply restrain the stable to by a policy ensure efficient the further the and design around to in frequently conducive mechanism is cascade out occur network complicated of the causes revealing grids main Therefore, the power are failures Cascading in world. blackouts scale n alrs ypnvstablity. Lyapunov failures, ing oguiest,Saga 020 hn Emi:huangyub (E-mail: China [email protected],cn). 200240, [email protected]; Shanghai university, Tong 6438U5916671) n ainlKyRDProgram R&D Key (SQ2017YFGH001005). National and (61473183U150921161627810), de eg h al fpat rtasiso ie caused lines transmission or plants or nodes of entir few3 fault of the the breakdown (e.g. of the by edges paralysis can triggered we the often cases, network that outages power conclude listed straightforwardly the seri From caused blackouts power loss. and These people of economic [7]. of period millions India affected In peak in negatively have [6]. blackout the outages a during power caused overload into consumption fall circuit caused to and the Brazil substations 2012, in [5]. several people China destroyed million led Province, storm 67 snowstorms Hunan the by in 2009, caused outages In fault power plant large-scale the to 2008, In [4]. 2006 xml stepwrotg.Frisac,teGra grid German the typical instance, most For The outage. a crash. closed power networks so the when are is troubled We example tha be [3]; networks will man-made properly or we function natural ne these to Protein on dependent body [2]; heavily have travel the of enable networks convenience works Transportation the exchanges [1]; increased cultural greatly regions and distant flow between information promote networks T ml itracscntigrcsaigfiue in failures cascading trigger can disturbances Small h uhr r ihteDprmn fAtmto,Shanghai Automation, of Department the with are authors The hsppri atyspotdb h ainlSineFound Science National the by supported partly is paper This ne Terms Index Abstract eaal rmavreyo ewrs Communication networks. in- of is variety individuals a and from society of separable operation efficient HE 380 Wt h hr nraeo oe ead large- demand, power of increase sharp the —With , 000 cmlxntok,saldsubne,cascad- disturbances, small networks, —complex V orsodn uhr edn Zhang Weidong author: Corresponding al htcue lcoti uoein Europe in blackout a caused that cable .I I. NTRODUCTION uoHag ugoL,WiogZhang Weidong Lu, Junguo Huang, Yubo oe grids power [email protected]; to fChina of ation . fChina of tends y tually ilures grids eof re ages. ous ical Jiao the the tic lly ed ed ge t- e s t ih a tlzdt ov h qiiru ftenetwork. the networks complex of of equilibrium stability Lyapunov the algo- the solve defined downhill we Newton to Then, the utilized nodes. equation, of was dynamic dynamics rithm coupling the equatio the on swing describe Based the to First, introduced failures. was cascading propagati and of occurrence mechanisms complicate the reveal to dynamics trigg clearly may failures. th which cascading can and behaivors network dynamic a model exceptional entire the the to captures this of dynamics network transient Therefore, as the the describe [32]. regarded sinusoida direct a state is spontaneously by node synchronous can coupled each are which nodes model, function different this and oscillator In an [31]. most model) the (Kuramo equation and like swing grids coarse-scale solve the power is AC to To accepted of proposed widely [24–26]. dynamics are transient [27–30] flows the models study exceptional and dynamic the many nodes problem, ignored this of fail they all behaviors since detect outage of dynamic to power fail topology indeed the yet the methods during results, desirable static optimizing some topology-based by obtained These failure [23]. propos ER cascading networks are (e.g. resist strategies networks numerous atta to homogeneous Therefore, and [22]. error to The networks) equivalent attacks. failures is intentional random to tolerance For to vulnerable [21]. is robustness (SF but network unexpected scale-free the as display such of networks networks structure heterogeneous rand the the or example, attacks on intentional depends the to that failures network found the and failur of [20] duo cascading topologies vulnerability collapse network on on may grid research focused is network Early mainly the state the propagation. that Then sync cascade [19]. to The so fault [17]. [18]) locked plants attacks users (i.e. cause sync is factors to external In node to flows susceptible ends. highly each steady both of generate at can phase nodes the the frequency state, between standard difference the phase with equilibrium Ω the at chronically dynamics line of [13–15]. perspective or advances significant the node made from to have one questions and attempt iss two or of researchers controversial the many nodes two failure answer Recently, still networks. of the are complex failure how neighbors in its the and [10]. to cause 12] failure propagates global can [11, to factors lines indicate failure in external studies culprit local What Many main from the 9]. network is 8, inducing mechanism [4, propagation cascading factors) that natural or human nti ril,w rpsdafaeokbsdo network on based framework a proposed we article, this In syn- operates (plants) nodes all normally, grids, power In 1] h o fatasiso iedpnso the on depends line transmission a of flow The [16]. htcan that ures ues om to- on en ck ed es er n 1 ) l 2 and derived the criterions of Lyapunov stability to judge the stability of an equilibrium. We found that small disturbances can induce the shutdown of the nodes with exceptional dynamics and further trigger cascade in unstable networks. Through the simulation analysis of the Spanish grid, we concluded that this kind of failure was difficult to occur but could cause power outages throughout the grid once it happens. Faults tended to occur first in less-degree nodes and then indirectly cause the failure of hub nodes through cascade propagation. The propagation speed of the cascade was so quick that it can easily escape the grid protection mechanism, and that implies most control methods are useless for this failure mode. Furthermore, such failure usually accompanied the other failure mode named overload failure of lines during the Fig. 1. The schematic diagram of a small power grid: a The graph of the equilibria conversion process and it accelerates the paralysis of small grid with two generators (squares) and three consumers (circles). In our simulation, Mi = 1, Di = 0.6, K = 1.63 b The green points (rotating the network. Finally, the dynamic framework discussed above machines) run synchronously with frequency Ω, whereas the red points lose is not limited to power grids and can apply to other networks, synchronization. c The power generated by generator G includes damping such as communication networks, micro-circuit networks, etc., dissipation and transmission to consumer C. The flow I is determined by the phase difference of node G and node M. d-f, Re(λ1, λ2, ··· , λn) are the just with appropriate modifications. real parts of the eigenvalues of matrix H, θ0 denotes the initial state of the e system and θ denotes the equilibrium of the system. Sε is the restricted area 0 of f(θ(t)) and Sδ is the restricted area of the initial equilibrium θ . d is II. THE STABILITY ANALYSIS OF POWER GRIDS the state track of the stable network. e is the state track of the asymptotically stable network and f is the state track of the unstable network. In this section, the swing equation is introduced to describe the dynamics of power grids and we subsequently utilize the power exchanged with its neighbors (Fig. 1c). Here, we use Newton downhill method to solve the equilibria of grids based −2 on the swing equation. Afterward, the Lyapunov method is per unit (p.u.) to quantify Pi, where Pp.u. =1s = 100MW . used for determining the stability of the obtained equilibria. d2 d f(θ,t)= M θ (t)+ D θ (t) i dt2 i i dt i N (1) A. Modeling power grids = Pi + Kij sin(θj (t) − θi(t)) j=1 A power grid can be abstracted into a weighted graph X G = (V, E) (Fig. 1a), where V (|V | = N) is the vertices set After establishing the dynamic equation of each oscillator, the and E(|E| = L) is the edges set of G. One vertex can be a flow on Eij at time t can be computed by: generator (generating power) or consumer (consuming power) but they are all regarded as rotating machines (oscillators) in Fij (t)= Kij sin(θj (t) − θi(t)) (2) swing equation (Fig. 1b). If two vertices are linked (through From the above analysis, we can summarize the prerequisite the transmission line), G(i, j)=1, otherwise, G(i, j)=0. for stable operation of the power system is that the phases of The state of oscillators i is completely characterized by its all oscillators are locked and it means the system is in sync at ˙ phase θi and the phase velocity ωi = θi relative to the refer- the reference Ω. The desired synchronous state of the system ence frequency of the electric system. θe e e e Ω=2π = 50/60Hz is denoted as = [θ1,θ2, ··· ,θN ]. In control theory, this The flow of Eij depends on the phase difference ∆θij of Vi state is also called the equilibrium duo to ∀i, θ¨ = θ˙ = 0. and Vj (Fig. 1c). Thereby, to guarantee steady power flows in Therefore, the swing equation becomes: grids, all oscillators should run at the same frequency (∀i,ωi = 0= P + N K sin(θe − θe) 0. In this state, the phases of all machines are locked), i j=1 ij j i (3) s.t. N P =0 which is called synchronization. How to force all machines ( P i=1 i to operate synchronously? The answer is the coupling effect For large-scale networks, solvingP these nonlinear equations between linked oscillators. In the swing equation [31], the presents challenge duo to the strict restriction1. In this paper, sufficiently large coupling strength Kij = kij Gij , governed by we use Newton downhill algorithm (Algorithm 1) to solve the topology Gij of the network and the interaction strength these equations, where f is the Eq. (3), ε1 and ε2 are the kij of oscillators (In power grids, kij = Bij UiUj , where Bij is error coefficients, and δ is a small random vector used for the susceptance between two machines and U is the voltage of avoiding the infinite loops. the grid), will urge the local group of oscillators to be in step and further direct the entire network to synchronize. Mi is the B. Lyapunov stability analysis of power grids inertia term of oscillator i which is usually assumed to be 1. Di is damping constant of the oscillator i and we will prove that it Roughly, a power system is inevitable to suffer external determines the transition time of the oscillator from one state small disturbances, and an equilibrium is considering stable to another in subsection III-B. Pi denotes the power generated 1For small network, this equations can be solve by the @fslove tool in (consumed) by the machine including damping and electric MATLAB 3

Algorithm 1 Newton Downhill Algorithm θ is deﬁned as: Input: Network G, f, ε1, ε2, δ N N e 1 Output: θ V (θ)= − P θ − K cos(θ − θ ) (4) i i 2 ij i j 1: for i =1 to N do i=1 i,j=1 0 X X 2: θ = 0; % Initialization; θi can also be randomly i ∂V e θe generated From Eq. (3), ∂θ |θi = θi =0, ∀i and thus is a extremum θ i 3: end for of V ( ). The Hesse matrix H of the potential function V is: 4: λ =1, k =0; % λ is the downhill factor ∂f1 ∂f1 ··· ∂f1 5: for i =1 to N do ∂θ1 ∂θ2 ∂θN k k+1 k fi(θ ) 6: ′ ; % Newton iteration θi = θi − λ f (θk)  ∂f2 ∂f2 ∂f2  i ··· 7: end for ∂f ∂θ1 ∂θ2 ∂θN k+1 k e   8: if |f(θ )| < |f(θ )| then DF = |θ=θ =   (5) ∂θ  . . . .  9: if |θk+1 − θk| <ε then  . . . .  1  . . . .  10: θe = θk+1, Return; % satisfy the termination con-     dition  ∂fN ∂fN ∂fN   ∂θ1 ∂θ2 ··· ∂θ  11: else  N  k k+1 k+1   12: θ = θ ,θ = 0, k = k +1; % Enter the next −σij e e Aij cos(θ − θ ) i = j iteration j=6 i N j i DFij = 13: back to step 5  Pσij e e (6) Aij cos(θj − θi ) Otherwise 14: end if  N H = −DF 15: end if  k+1 k 16: if |f(θ )| >= |f(θ )| then Based on the Hesse matrix H, the Lyapunov stability criterion k+1 17: if λ<ελ and |f(x )| <= ε2 then of power systems is derived in Lemma 1. e k 18: θ = θ , Return; % Satisfy the termination condi- Lemma 1: For a given system (network) G and a equilibrium tion e θ , λ = [λ1, λ2, ··· , λN ] are the eigenvalues of H and are 19: else ranked by their real part such that λ =0 [17] and λ < λ < k+1 1 2 3 20: if λ<ελ and |f(x )| >ε2 then ··· < λN . 21: θk = θk+1 + δ, back to step 5; % Avoid inﬁnite • If , the system is asymptotically stable loops Re(λ2 > 0) (Fig. 1c). lim kθ(t) − θek =0. 22: end if t→∞ 23: end if • If Re(λ2 = 0), the system G is stable in the sense of e k+1 Lyapunov (Fig. 1d). lim kθ(t) − θ k≤ ε. 24: if λ>= ελ and |f(θ )| >ε2 then t→∞ λ 25: λ = , back to step 5; % Newton downhill iteration • If Re(λ2 < 0), the system G is unstable (Fig. 1f). 2 e 26: end if lim kθ(t) − θ k >ε. t→∞ 27: end if

III. DYNAMICALLY INDUCED CASCADING FAILURES IN POWER GRIDS if the system can restore to the original equilibrium with In this section, we focus on analyzing cascading failures sufficient accuracy after small disturbances disappear (Fig. 1d- e). If the system moves away from the equilibrium after small after the network is attacked from a dynamic perspective. disturbances, then the equilibrium is unstable (Fig. 1f). In There are two types of failures: overload failures and unstable this subsection, we will definite the Lyapunov stability of the failures. The former mainly occurs in transmission lines and power system and subsequently derive the stability criteria. the latter always induce the malfunction of machines. The mathematical definition of Lyapunov stability of power systems is: ∀ ε > 0, ∃ δ(ε,t0), if any point θ(t) on the A. Overload failures of lines trajectory staring from any initial state in the set {θ0 : kθ0 − e 0 The original network G is usually assumed running stably at θ satisfies: θ t θ , 0 k <δ(ε,t0)} kf( ( ); ,t0)k≤ ε,t0 ≤ t ≤ ∞ the equilibria θ (N-0 stable). The steady flow of G is denoted the system is stable (Fig. 1d). If θ t θe , limt→∞ k ( ) − k = 0 as F old. After the network is attacked and subsequently causes e the system is asymptotically stable (Fig. 1 ). Otherwise, the line failure, Scähfer et al. [33] studied the case that the residual system is unstable (Fig. 1f). From the definition, we can ′ network G′ will stably operate at the new equilibria θ (N- summarize that the Lyapunov stability requires the trajectory 1 stable) and the network flow is F new. They found the of the stable system from any point near the equilibria always conversion process of the steady flow (F old F new) is not stays a certain range of the equilibria rather than restores to abrupt but the oscillations converge. Hence this process can be the original equilibria. Therefore, it is more extensive than the approximated by a damped sinusoidal function of time [33]: traditional stability. new −Dt Then, we will introduce the Lyapunov stability criterion of Fij (t) ≈ F − ∆Fij cos(νij t)e ij (7) power system at equilibrium θe and the potential function for new old ∆Fij = Fij − Fij 4

for power systems to suffer the external small disturbance

∆θ(k∆θk < ε) and machine i is considering reliable if it F(t) Fnew F(t) Fnew Fold FC1 Fold FC2 can return to the original equilibrium after small disturbance ∆θi. If the state trajectory θ(t)i is divergent after applying the

disturbance ∆θi, the machine (node) i will be damaged and the lines connected with node i will shutdown duo to overload

ij ij F F (From Eq. (2), the ﬂow of Eij will exceed its capacity when θj

is a constant but θi diverges). The detailed algebraic derivation is shown as follows: θe e e e Let = [θ1,θ2, ··· ,θN ] be a equilibrium of unstable e system G. From Eq. (3), ∀i, θi satisfies: N e e P + K sin(θ − θ ) (10) i ij j i j=1 X Fig. 2. The conversion procession of flow in transmission line. F old is the Now, we apply a small disturbance ∆θ to network G: new flow of the original network and F is the flow of the residual network after θ θe θ e attack. F C1 and F C2 denote two different capacities of the transmission line. = + ∆ ⇒ θi = θi + ∆θi a The green solid line indicates F is smoothly converted after the network ij θ˙ = ∆θ˙ ⇒ θ˙i = ∆θ˙i (11) structure has changed. b The red solid line indicates the Eij will shutdown max since the maximal flow F exceeds the carrying capacity Cij . θ¨ = ∆θ¨ ⇒ θï = ∆θï Substitute Eq. (11) into Eq. (1): The maximal flow in this process can be roughly approximated N ¨ ˙ e e by Eq. (8). Mi∆θi+Di∆θi = Pi+ Kij sin(θj −θi +∆θj −∆θi) (12) max j=1 Fij ≈ Fij + 2∆Fij (8) X The sin term of Eq. (12) can be expanded by Taylor formula: The capacity C of line E is proportional to K : ij ij ij e e sin(θj − θi + ∆θj − ∆θi) Cij = αKij (9) e e e e 2 = sin(θj − θi ) + cos(θj − θi )(∆θj − ∆θi)+ O(∆θj − ∆θi) e e e e where α (0 <α< 1) is the tolerance parameter of lines. ≈ sin(θj − θi ) + cos(θj − θi )(∆θj − ∆θi) max Hence Eij will shutdown when the maximal flow Fij (13) exceeds its carrying capacity C . For example, the small grid ij The reason we abandon the term of O(∆θ − ∆θ )2 is that in Fig. 1 is attacked by removing E , and the conversion j i 23 the norm of the small disturbance ∆θ is quite small. Then, by procession of flow is shown in Fig. 2. In traditional static combining Eq. (10) and Eq. (13), we can deduce: network flow analysis methods, the corresponding line is safe since those methods assume that the flow jumps from F old N e e to F new and F (t) is within the limits of F C1 and F C2. Pi + Kij sin(θj − θi + ∆θj − ∆θi) j=1 Nevertheless, from Scähfer et. al.’s theory, the conversion X N process is dynamic rather than static and whether the line will e e e e failure depends on its carrying capacity C and its maximal = Pi + Kij sin(θj − θi ) + cos(θj − θi )(∆θj − ∆θi) j=1 flow F max during the dynamic oscillation process. Therefore, X N N the damped sinusoidal process of flow can detect the overload e e e e line which is ignored by the static flow methods. = Pi + Kij sin(θj − θi )+ Kij cos(θj − θi )(∆θj − ∆θi) j=1 j=1 X X N e e B. Small disturbance induced failures of nodes = Kij cos(θj − θi )(∆θj − ∆θi) j=1 In this subsection, for the sake of universality, we abandon X the assumption that the network is N-1 stable after the attack. (14) For a given network, we use Lyapunov criterion (Lemma 1) Substitute Eq. (14) to Eq. (12): to judge the stability of the network. If the network is stable, N each machine will smoothly operate at its equilibrium and the ¨ ˙ e e Mi∆θi + Di∆θi = Kij cos(θj − θi )(∆θj − ∆θi) (15) power system can generate steady flows to users. Conversely, j=1 the network will malfunction when it is unstable at the X Let β = K cos(θe − θe) and β = β . Then: equilibrium. In this case, the Lyapunov criterion can only ij ij j i j ij i judge the stability of the network but fails to identify the nodes Mi∆θï + Di∆θ˙i = Pβij ∆θj − βi∆θi (16) or lines that are invalid. In this paper, the small disturbance j analysis method is presented to overcome the drawback of X The characteristic equation of Eq. (16) is: Lemma 1 and we find a new failure mode based on this 2 method. The core idea of this method is that it is inevitable Mis + Dis + βi =0 (17) 5

The roots (poles) of this equation are:

2 −D + D − 4M β Pole distribution Phase diagram Pole distribution Phase diagram s = i i i i 1 2M p i (18) 2 −Di − Di − 4Miβi s2 = 2Mi p Central point Saddle Therefore, the solution of Eq. (16) is:

s2t • If s1 = s2; s1,s2 ∈ R, then ∆θi(t) = (C1 + C2t)e s1t s2t • If s1 6= s2; s1,s2 ∈ R, then ∆θi(t)= C1e + C2e • C If s1 = µ + νi,s2 = µ − νi; s1,s2 ∈ , ∆θi(t) = Stable focus Unstable focus µt e (C1 cos(νt)+ C2 sin(νt)) where C1 and C2 are constants. According to the distribution of poles, the corresponding phase diagrams are shown in

Fig. 3. Based on the solution of Eq. (16) and Fig. 3, we can Stable knot Unstable knot derive the following Lemma:

Lemma 2: Let θ = [θ1,θ2,...,θN ] be one equilibrium of the network G and ∆θ = [∆θ1, ∆θ2,..., ∆N ] be the small Fig. 3. Phase trajectory maps of different poles distributions. In pole distribution maps, the horizontal axis is the real axis and the vertical axis disturbance applied to G. If limt→∞ ∆θ(t)i = 0, Ni will is the imaginary axis. In phase diagram, the horizontal axis denotes θi and stably operate at θi. Conversely, if limt→∞ ∆θ(t)i = ∞, Ni the vertical axis denotes θ˙i. The green solid lines indicate the corresponding is exceptional and the divergent state trajectory will induce the node is reliable and the red solid lines indicate the corresponding node is exceptional. failure of Ni and Ei: (Eq. (2)). Let fi be the state equation of Ni and Si be the characteristic equation of fi. s1 and s2 are the roots of Si. The criterion to determine whether Ni is exceptional is:

• If Re(s1) < 0 and Re(s2) < 0, then limt→∞ ∆θ(t)i =0, TABLE I THE SIMULATION RESULTS OF THE SMALL NETWORK limt→∞ θ(t)i = θi, the corresponding node is reliable. • If Re(s1)=0 and Re(s2)=0, then limt→∞ ∆θ(t)i = c, Node Power Equilibrium Equilibrium s1 s2 limt→∞ θ(t)i = c + θi, the corresponding node is also ID Before attack After attack reliable from the perspective of Lyapunov stability (Sub- (1) -1 0.2453 2.2791 −0.3 + 0.20i −0.3 − 1.20i section II-B). (2) 1.5 0.5186 -3.9632 1.43 −2.03 − − − • If Re(s ) > 0 or Re(s ) > 0, then lim ∆θ(t) = ∞, (3) -1 0.1284 1.9240 0.3 + 1.74i 0.3 1.74i 1 2 t→∞ i − − − , the corresponding node is excep- (4) -1 0.2453 -4.4794 0.3 + 1.21i 0.3 1.21i limt→∞ θ(t)i = ∞ (5) 1.5 0.7234 3.4478 −0.3 + 1.68i −0.3 − 1.68i tional. From Eq. (18), we can deduce that the convergence or divergence rate of ∆θi determined by Di,Mi,βi. Here, we use an instance (Fig. 1a) to illustrate the existence of this failure mode. The parameters we used in this small network are shown in Table I. Originally, the network G was stably running at the θ0 equilibrium . Then, we attacked network G by erasing the ′ line E23 and the new equilibrium became θ . Nevertheless, the new equilibrium was unstable judged by Lemma 1. In particular, the dynamic behavior of N2 was exceptional after a small disturbance observed by Eq. (16), Eq. (18), Fig. 3, and Lemma 2. The state trajectory of N2 is shown in Fig. 4. The ′ curve ﬁrst oscillates to the new equilibria θ2 during t = [2, 12]. At t = 14, N2 is disturbed. The state trajectory of N2 quickly diverges and then induces the failure of N2 and E2: (the blue edges of Fig. 1a). Further, the cascade mechanism is triggered and thereupon induces the failure of N4 and N1. Finally, the network will collapse with cascade propagation. Fig. 4. The state trajectory of N2. In the original network G, the equilibrium Integrated the failure modes described in this section, the 0 of this node is θ2 = 0.5186. After the network is attacked, the node converges ′ ′ complete cascading failures process in power grids is shown in to θ2 = −3.9623. However, the new equilibrium θ is exceptional. At time Fig. 5. For the sake of simplicity, we retain the null hypothesis t = 14s, a external small disturbance is applied to this node and it quickly diverges. that the initial network is stable but the presented method is still applicable to the unstable initial network. 6

Attack Disturbance a b

Original Stable Disturbance Overload failures Network induced failures

c d

Fig. 5. Dynamically induced cascading failures of power grids. An attack on the initial stable network triggers cascading overload failures of lines and may lead to two results: the network crashes or rebalances. In the second case, the new equilibrium may unstable and some nodes will fail duo to the small disturbance. The residual network will then form a new equilibrium again. This process will loop forever until the stability condition is met, or the network is completely paralyzed.

IV. RESULTS Fig. 6. The distribution of secondary outages in Spanish grid. In this experiment, the inertia term Mi = 1, the coupling strength K = 8, the Above we roughly used a small network to illustrate the damping coefficient D = 0.5(the same as below). The histograms show the effectiveness of the presented method. In this section, the number of nodes or edges that failed after each attack in 121 attacks. The pies show the probability of the failed number of nodes or edges after an attack. Spanish grid is introduced to verify the applicability of our method in a real scenario. Duo to the overload failure mode has been well analyzed in Scähfer et al.’s work [33], we mainly In our experiment, the initial network stably operates focus on cascading failures induced by the small disturbance G at its equilibrium θ ( Algorithm 2 can also simulate the in our experiment. In this case, we avoid the overload failures case that the initial network is unstable). In fact, the phase by increasing the tolerance α in Eq. (9) and thereby the difference is quite small in most synchronous malfunction of nodes and lines is purely caused by the small |θj − θi|, ∀i, j states. Even if the network is attacked, the network can remain disturbance. The standard procedures for our experiment are in a new stable equilibrium with a high probability. That shown in Algorithm 2. implies cascading failures induced by small disturbances are difficult to occur. In our experiment, to observe this kind of Algorithm 2 Small disturbance induced cascading failures failure mode, we have made the network more vulnerable Input: Network G; Number of attacks T . by appropriately adjusting the model parameters (e.g. P ) to RT i Initial: The number of failed nodes FN =0,FN ∈ and increase the phase difference between different oscillators. we RT failed edges F E =0, F E ∈ . attack network G 350 times by orderly removing one line RN×T Output: J ∈ ,FN,FE. in each attack, of which 121 successfully triggered cascading 1: for i =1 to T do failures. The macro data distributions of secondary outages ′ 2: G = G; are shown in Fig. 6. On average, about 10% of the nodes ′ 3: Calculate the equilibrium θ of G (Algorithm 1); failed duo to external small disturbances in secondary outages. ′ 4: Determine whether G is stable using Lemma 1. If not, Therefore, small disturbances can cause the local malfunction back to step 8, else, continue; of the unstable network in secondary outages and cascading ′ 5: Orderly or randomly remove an edge from G ; % attack propagation will further lead to the paralysis of the entire network. In summary, cascading failures triggered by small ′ 6: Calculate the new equilibrium θ of the residual net- disturbances are extremely difficult to occur but can cause work by Algorithm 1. Calculate the overload lines in power outages throughout the grid. the conversion process: θ → θ′ based on Eqs. (7-9); ′ In Fig. 7, we have counted the degree of failed nodes in sec- 7: Determine whether G is stable using Lemma 1. If not, ondary outages. Faults tend to occur first in less-degree nodes continue, else, break; and then indirectly cause the failure of hub nodes through 8: Determine whether Nj, j ∈ [1,N] is reliable using cascade propagation. It is worth noting that the speed of Lemma 2. If exceptional, delete Nj , Jij = 1, else, cascade propagation is extremely fast and we will explain this θ′ θ Jij =0, = ; phenomenon from a microscopic perspective. We have selected 9: Count the number of failed nodes FN[i] and edges two typical nodes (N14 : d(14) = 9 and N10 : d(10) = 1) F E[i] in secondary outage; to observe their phase trajectory (Figs. 8-9) in Spanish grid. 10: Determine whether G′ paralyzes. If G′ paralyzes, N14 is reliable and it can return to a new equilibrium after break, else, back to step 6; being attacked or disturbed. The rate of convergence depends 11: end for mainly on its damping coefficient D14. N10 is exceptional 7

to reasonably allocate the power P of the failed nodes to

their neighbors to bring the network to a new equilibrium. This is also the reason that we just calculate the data of

secondary outages rather than the final outages in our experiment. There may be no equilibrium in the network because the inappropriate P may result in no solution to the swing equations (Eq. (3)). Additionally, how to force the exceptional node to the stable state before cascade propagation is also a ticklish problem. The usual solution is to design a controller to stabilize the exceptional nodes. Nonetheless, such controllers are always of low-efficiency duo to the propagation speed is extremely fast (Fig. 9). Meanwhile, when we apply control to the exceptional nodes, it will inevitably affect the equilibrium of their neighbors. How to decouple the complex system presents challenges in designing controllers. In our future Fig. 7. The degree distribution of the failed nodes in secondary outages. This work, we will aim to solve the above problems to ensure the histogram counts the degree of failed nodes in 121 attacks. safe and stable operation of power grids. and its phase trajectory will divergence exponentially after being disturbed and further lead to the failure of itself and REFERENCES its neighbors. From Fig. 9 (t> 17s), the propagation of faults [1] M. E. Newman, “The structure and function of complex along adjacent nodes is particularly fast, usually less than 0.5s. networks,” SIAM review, vol. 45, no. 2, pp. 167–256, From the above data analysis, we can summarize some char- 2003. acteristics of cascading failures caused by small disturbances: [2] C. Lopez, P. Krishnakumari, L. Leclercq, N. Chiabaut, and H. Van Lint, “Spatiotemporal partitioning of trans- 1) Cascading failures induced by small disturbances rarely portation network using travel time data,” Transportation happen but can have devastating consequences. Research Record, vol. 2623, no. 1, pp. 98–107, 2017. 2) Cascade propagation is so fast that it can easily escape [3] J. Xia, L.-Y. Chiu, R. B. Nehring, M. A. B. Nunez, the grid protection mechanism. Q. Mei, M. Perez, Y. Zhai, D. M. Fitzgerald, J. P. Pribis, 3) The propagation path of this kind of failure mode is Y. Wang et al., “Bacteria-to-human protein networks from edge nodes to central nodes. reveal origins of endogenous dna damage,” Cell, vol. 176, These characteristics are clearly reflected in the large-scale no. 1-2, pp. 127–143, 2019. blackouts in recent years. [4] U. UCTE, “Final report system disturbance on 4 novem- ber 2006,” 2007. V. DISCUSSION [5] Xinhua. (2008) Blackouts continue in weather crisis. In this paper, motivated by the advance of dynamically [Online]. Available: http://www.china.org.cn/china induced cascading failures in power grids, we proposed a more [6] W. contributors. (2009) 2009 brazil and general model to analyze cascading failures and its spread paraguay blackout. [Online]. Available: mechanism. Our model abandoned the assumption existing https://en.wikipedia.org/wiki/2009 Brazil and Paraguay blackout in the traditional failure models that the network is stable. [7] ——. (2019) 2012 india blackouts. [Online]. Available: Instead, the Lyapunov criterion was introduced to judge the https://en.wikipedia.org/wiki/2012 India blackouts stability of the network. Based on this theory, besides the [8] Z. Ma, C. Shen, F. Liu, and S. Mei, “Fast screening of overload failures of lines during the steady flow conversion vulnerable transmission lines in power grids: A pagerank- process, we found that small disturbances can also induce the based approach,” IEEE Transactions on Smart Grid, shutdown of exceptional nodes and further trigger cascade in vol. 10, no. 2, pp. 1982–1991, 2017. unstable networks. Through data analysis, this kind of failure [9] Y. Huang and W. Jiang, “Extension of topsis method mode has the following characteristics: low incidence, large and its application in investment,” Arabian Journal for destructiveness, and fast propagation speed. Edge (leaf) nodes Science and Engineering, vol. 43, no. 2, pp. 693–705, are first affected and then lead to the failure of a large fraction 2018. of the transmission grid. The failure will propagate to the [10] Z. Jiao, H. Gong, and Y. Wang, “A ds evidence theory- central nodes with an extremely fast rate and result in the based relay protection system hidden failures detection paralysis of the entire network. These characters are consistent method in smart grid,” IEEE Transactions on Smart Grid, with the blackouts observed in real power grids. vol. 9, no. 3, pp. 2118–2126, 2016. Although we tried to construct a comprehensive dynamic [11] L. Che, X. Liu, and Z. Li, “Mitigating false data attacks model to study cascading failures and achieved the desired induced overloads using a corrective dispatch scheme,” results, there are still many challenges before the large-scale IEEE Transactions on Smart Grid, vol. 10, no. 3, pp. power outage of the grid is fully uncovered. For instance, how 3081–3091, 2018. 8

(a) Di = 0.5 (b) Di = 1

Fig. 8. The phase trajectory of N14 under different damping coefﬁcients Di. After the original network is attacked, the residual network tends to a new equilibrium that is stable. From a and b, the convergence rate depends on the damping coefﬁcient. At t = 20s, the system is disturbed and the phase trajectory reconverges.

multistability in oscillatory networks,” Chaos, vol. 27, no. 8, p. 083123, 2017. [18] Y. Xiang, L. Wang, and N. Liu, “A robustness-oriented power grid operation strategy considering attacks,” IEEE Transactions on Smart Grid, vol. 9, no. 5, pp. 4248–4261,

2018. [19] J. Machowski, J. Bialek, and J. Bumby, Power system dynamics: stability and control. John Wiley & Sons, 2011.

[20] P. Dey, R. Mehra, F. Kazi, S. Wagh, and N. M. Singh, “Impact of topology on the propagation of cascading failure in power grid,” IEEE Transactions on Smart Grid, vol. 7, no. 4, pp. 1970–1978, 2016. [21] R. Albert, I. Albert, and G. L. Nakarado, “Structural Fig. 9. The phase trajectory of exceptional N10. N10 is also unreliable vulnerability of the north american power grid,” Physical judged by Lemma 2. After being disturbed, the phase trajectory will diverge exponentially. Review E Statistical Nonlinear & Soft Matter Physics, vol. 69, no. 2, p. 025103, 2004. [22] A. R, J. H, and B. AL, “Error and attack tolerance of complex networks,” Nature, vol. 340, no. 1, pp. 378– [12] ——, “Fast screening of high-risk lines under false data 382, 2004. injection attacks,” IEEE Transactions on Smart Grid, [23] X.-B. Cao, C. Hong, W.-B. Du, and J. Zhang, “Improving 2018. the network robustness against cascading failures by [13] W. Ren, J. Wu, X. Zhang, R. Lai, and L. Chen, “A adding links,” Chaos, Solitons & Fractals, vol. 57, pp. stochastic model of cascading failure dynamics in com- 35–40, 2013. munication networks,” IEEE Transactions on Circuits [24] B. Sch¨afer and G. C. Yalcin, “Dynamical modelling and Systems II: Express Briefs, vol. 65, no. 5, pp. 632– of cascading failures in the turkish power grid,” arXiv 636, 2018. preprint arXiv:1907.05194, 2019. [14] R. Yao, S. Huang, K. Sun, F. Liu, X. Zhang, and S. Mei, [25] I. Simonsen, L. Buzna, K. Peters, S. Bornholdt, and “A multi-timescale quasi-dynamic model for simulation D. Helbing, “Transient dynamics increasing network vul- of cascading outages,” IEEE Transactions on Power nerability to cascading failures,” Physical review letters, Systems, vol. 31, no. 4, pp. 3189–3201, 2015. vol. 100, no. 21, p. 218701, 2008. [15] J. Song, E. Cotilla-Sanchez, G. Ghanavati, and P. D. [26] Y. Huang, H. Dong, W. Zhang, and J. Lu, “Stability Hines, “Dynamic modeling of cascading failure in power analysis of nonlinear oscillator networks based on the systems,” IEEE Transactions on Power Systems, vol. 31, mechanism of cascading failures,” Chaos, Solitons & no. 3, pp. 2085–2095, 2015. Fractals, vol. 128, pp. 5–15, 2019. [16] S. Lozano, L. Buzna, and A. D´ıaz-Guilera, “Role of net- [27] A. E. Motter, S. A. Myers, M. Anghel, and T. Nishikawa, work topology in the synchronization of power systems,” “Spontaneous synchrony in power-grid networks (vol 9, The European Physical Journal B, vol. 85, no. 7, p. 231, pg 191, 2013),” NATURE PHYSICS, vol. 15, no. 1, pp. 2012. 103–103, 2019. [17] D. Manik, M. Timme, and D. Witthaut, “Cycle ﬂows and 9

[28] P. Anderson and A. Fouad, “Power system control and stability, 2nd edn.” 2003. [29] A. R. Bergen and D. J. Hill, “A structure preserving model for power system stability analysis,” IEEE Trans- actions on Power Apparatus and Systems, no. 1, pp. 25– 35, 1981. [30] T. Nishikawa and A. E. Motter, “Comparative analysis of existing models for power-grid synchronization,” New Journal of Physics, vol. 17, no. 1, p. 015012, 2015. [31] G. Filatrella, A. H. Nielsen, and N. F. Pedersen, “Analysis of a power grid using a kuramoto-like model,” The European Physical Journal B, vol. 61, no. 4, pp. 485– 491, 2008. [32] M. Rohden, A. Sorge, M. Timme, and D. Witthaut, “Self- organized synchronization in decentralized power grids,” Physical review letters, vol. 109, no. 6, p. 064101, 2012. [33] B. Sch¨afer, D. Witthaut, M. Timme, and V. Latora, “Dynamically induced cascading failures in power grids,” Nature communications, vol. 9, no. 1, p. 1975, 2018.