Smart Grid Handbook Defining, Measuring, and Improving Resilience of Electric Power Systems

Defining, Measuring, and Improving
Resilience of Electric Power Systems

Ross Guttromson and Jean-Paul Watson
Sandia National Laboratories, Albuquerque, NM, USA
1 Introduction
The world’s prosperity is dependent on broad access to abundant, reliable, and cheap energy. Today, it is
our electric power system that almost singularly drives the world’s digital economy and elevates our health,
safety, and overall standard of living. Without a functioning electric grid, nearly every critical infrastructure
in the world – from banking to water to telecommunications – would grind to a halt.
However, as our dependence on the grid grows, so too do the threats, both natural and manufactured,
against it. Weather-related and other natural disasters, which cause the bulk of power outages, are projected
to increase in intensity and frequency, with a hotter, moister atmosphere primed to trigger disasters (Field
et al., 2011). In addition, frightening studies by the National Security Agency and others show that malware
directed at the grid continues to evolve and grow (Wilshusen, 2012). As a consequence, the world faces
significant risk from prolonged electrical outages, which, largely because of storms, have been steadily
increasing in frequency since 1995 (Massoud, 2011).
Given the change around us, we must find new ways to plan, manage, and safeguard our electric grid.
Much as a massive blackout in the United States in 1965 prompted the US Congress to enact the Electric
Power Reliability Act of 1967, leading to the formation of the National Energy Reliability Council (NERC)
and a standard definition of reliability, the natural disasters of the past few years (including Hurricanes
Katrina and Sandy) should prompt a new paradigm for securing the grid against its increased exposure to
high-consequence events.
Simply put, an electric grid defined only by reliability is no longer adequate in our twenty-first century
world. What is needed instead is a grid that can adapt to both large-scale environmental and manufactured
events and remain operational in the face of adversity, thus minimizing the catastrophic consequences that
affect quality of life, economic activity, security, and critical infrastructure operations. Specifically, the con-
cept of reliability needs to be augmented with a resiliency approach, one that looks at the grid not strictly
as a flow of electrons but as a grid that services, interfaces with, and impacts people and societies.
Smart Grid Handbook, Online © 2016 John Wiley & Sons, Ltd.
This article is © 2016 US Government in the US and © 2016 John Wiley & Sons, Ltd in the rest of the world.
This article was published in the Smart Grid Handbook in 2016 by John Wiley & Sons, Ltd.
DOI: 10.1002/9781118755471.sgd044
2 Smart Grid Handbook
The methodologies presented here are applicable at both the transmission level as well as the distribution
level. Among distribution, they can be applied to radial, networked, and SWER (single earth wire return)
systems.
2 Grid Reliability
Grid reliability, which is defined by NERC as a combination of grid adequacy (i.e., having sufficient gener-
ation to meet load) and grid security (having the ability to withstand disturbances), is a conceptually sound
but an insufficient framework for the emerging smart grid. Although the bulk-power system recognizes reli-
ability constraints,1 few provide a quantitative estimate of how violation of these constraints in real time
may affect the risk of delivery of electricity. For example, if a person were to inquire with control room
operator what the level of grid reliability was, they would likely reply “we are reliable because we meet our
reliability criteria.” In the off chance that reliability criteria were not met, the answer would become void.
During operation, there is no measure of what is in between. We recognize that from a planning perspective,
there are probabilistic measures of generation adequacy such as loss of load expectation, but these do not
address grid security, nor are they risk-based metrics, containing elements of threat, or consequence.
Other shortcomings exist at the distribution level, where reliability is measured statistically using historic
outage data that are captured using metric such as the system average interruption duration index (SAIDI) or
the system average interruption frequency index (SAIFI) Although both indices provide accurate historical
data, the raw data are nearly always scrubbed to remove large weather events and sometimes other incidents
that are beyond the utility’s control. Thus, while SAIDI and SAIFI are highly useful for comparative studies
of reliability, they cast little light on the reliability of the system for high-impact threats such as extreme
weather events. These metrics are also incapable of representing low-frequency events such as hurricanes.
Possibly a decade or more must pass before a statistically significant amount of data could be collected
to accurately represent the resilience of systems to these low-frequency events; by that time, the system
evolution and load growth would have changed substantially to void the data collected. Most importantly,
these types of metrics fail to reflect the consequences of any given outage. Societal and individual impact
simply do not factor into reliability.
3 Distinctions between Reliability and Resilience

When considering resilience for electric power systems, a topic of concern might be to differentiate the
concept of resilience from well-established definitions and metrics for power systems reliability. This could
be important for two reasons: (i) redefining well-established reliability concepts may cause confusion and
opposition within the power systems community and (ii) the redefinition of well-established reliability
concepts would disrupt social, political, and financial foundations to the electric power grid, such as rate
recovery. Given these arguments, the concepts of reliability and resilience will be considered separately
here, although there are no technical restrictions that prevent considering them together. In addition, the
authors recognize that it would be a challenge to create a definition of resilience that, when acted upon, did
not somehow influence reliability; however, the definitions themselves will be treated separately here.
We often speak of being resilient to a threat, whereas reliability has no such precondition. Reliability
metrics such as N-1, SAIDI, and SAIFI do not specify the cause of the disturbance, yet resilience requires
1 Examples of reliability constraints include N-1, contingency reserves, “loss of load probability/expectation,” transmission loading
reliefs, and security-constrained economic dispatch/unit commitments, which include stability and line overload constraints.
DOI: 10.1002/9781118755471.sgd044
Defining, Measuring, and Improving Resilience of Electric Power Systems 3
Reliability Resilience
Frequency of event
Level of consequences
Figure 1 A concept for differentiating resilience and reliability in electric power systems. The division between reli-
ability and resilience is intended to be notional
Table 1 Distinctions between electric power system reliability and resilience
Reliability Resilience
High probability, low consequence Low probability, high consequence

(e.g., outages from faults and component failures) (e.g., outages from major weather events and major
cyber attacks)
Not risk based Risk based
× Threats are not specified for reliability ✓ Threat (e.g., hurricane and GMD event)
× Consequences (to society) are excluded ✓ Consequence (beyond the system)
During operation, a system is reliable or it is not. Resilience metrics are a continuum where confidence is
Confidence is unspecified specified by a probability distribution
Focus is on measuring the impact to the system Focus is on measuring impact to humans
a specified threat (or threats) in order to have meaning. We often say “we are resilient to hurricanes,” but
regarding reliability, we simply say “we are reliable.” Formalizing this, we might draw a few conclusions:
• Reliability focuses on high-probability, low-consequence events

• Resilience focuses on low-probability, high-consequence events
• Low-consequence events deserve attention collectively
• High-consequence events deserve attention singularly or in smaller groups (Figure 1, Table 1)
In nearly all the technical literature, resilience can be defined within a process that starts from the inception
or identification of a threat, through to the recovery of the system. For example, in the Argonne report,2 there
is focus on preparedness, mitigation, response, and recovery, which is indeed a worthy focus. According to
our innate knowledge (and reinforced by Presidential Policy Directive 21), the purpose of resilience is to
preserve social well-being. So extending the focus beyond preparedness, mitigation, response, and recovery,
the measure of a resilient system should assess whether social well-being has indeed been preserved after a
critical event has occurred. Note that this statement does not dismiss the need for former, but simply restates
them as a means to the end rather than the ultimate goal. The corollary is that resilience that does not preserve
2 Resilience: Theory and Applications, January 2012, www.dis.anl.gov/pubs/72218.pdf.
DOI: 10.1002/9781118755471.sgd044
social well-being is useless. The important point here is that one cannot independently focus on the elements
of a system to achieve resilience. Instead, one must ascertain how a threat will affect the system, and in turn,
how the system performance will affect social well-being. Then one can augment the system in a way that
mitigates the detrimental effects and reinforced the useful effects. This gives rise to the need for useful
resilience metrics.
There are many different types of resilience metrics that have been developed over the years but nearly all
of them identify attributes of a system that will increase resilience, stopping short of quantifying how the
attributes change resilience. For example, Rand Corporation documented over 105 resilience metrics related
to electricity in peer-reviewed literature.3 Examples of attribute-based metrics might include
• the number of spare transformers available,

• the amount of repair equipment that can be used to aid in line repair,
• the miles of underground distribution cables,
• the use of advanced GIS restoration computer systems,
• the number of line crew staff accessible during restoration.
One would likely (and correctly) argue that each of these attributes, if implemented, would increase the
resilience of the power grid. However, these metrics do not quantify resilience of the system, nor is there a
means to quantitatively evaluate how a financial investment in any of these metrics will affect the resilience
of the system. What lacks is an understanding of how to invest among these options to achieve the best
outcome. In fact, a definition of the best outcome is also missing. As we make these investment choices,
how do we evaluate success?
Sandia Laboratories has formulated a framework for resilience metrics in the electric power industry.4
The framework focuses on consequences that extend beyond the electric power system itself. This reflects
the idea that preserving the system is not the goal, but rather a means to the goal, which is the sustainment
of societal well-being, or the minimization of social consequences.
Figure 2 is defined as a framework for a resilience metric. The framework takes the form of a probability
density function (PDF). The shape of the function identifies the probability of consequences being incurred
Probability of consequences X
given threat Y
Expected CVaR Consequence X

consequences
Figure 2 Resilience metric framework for the electric power system

3Quadrennial Energy Review Report: Energy Transmission, Storage, and Distribution Infrastructure, April 2015.
4Conceptual Framework for Developing Resilience Metrics for the Electricity, Oil, and Gas Sectors in the United States, Sandia Report
SAND2014-18019, September, 2015.
DOI: 10.1002/9781118755471.sgd044
if a threat occurs. The term framework is used because for this diagram, neither the system, nor the threat,
nor the consequences have been specified. Once they are specified, by replacing the “X” and “Y” with a
specific threat and consequence, and the actual PDF is determined for a particular system, it is referred to
as a resilience metric.
Two important features of this framework are (i) the expected consequences (or the mean value) and
(ii) the conditional value at risk, CVaR, which represents a severe outcome measured by ≤5% probability.5
The CVaR represents a possible severe outcome. Thus, it can be used to measure ones tolerance to risk.
A note on semantics: the expected consequence is an average of what would be experienced after many
trials, but not any one trial. The shape and breadth of the PDF itself indicate what could be expected for any
one trial.
4 Framing the Concept of Grid Resilience in Terms of Risk

Risk is often defined as the product of a system’s vulnerability, threats posed to it, and the potential conse-
quences. This simplistic model is beneficial in understanding what we mean when referring to a “risk-based
approach.”
Explaining Figure 3, let us assume that we are talking about risk to the resident’s of a nursing home that
rely on electric medical equipment due to a hurricane that will move across the electric power grid. In order
for any risk to exist, there must be a threat to the electric power system. That power grid must have some
level of vulnerability, and there must be consequences if the electric power system fails. Thus, we could
assign a value between zero and one to each of the legs, then their product would then represent the risk to
residents from the hurricane due to a power outage. Simplistically, that is: Risk = vulnerability × threat ×
consequences.
Let us first question whether there are any possible consequences in our scenario. If the electric power
went out, would it matter to nursing home residents in this case? If we argued that there are no possible
consequences to residents, then we argue by extension there is no risk, regardless of the hurricane threat or
the system vulnerability.
Likewise, if the hurricane changed direction or vanished, the threat would not exist, and it would have
no ability to affect the electric power system and thus residents would have medical equipment operating
without risk.
Risk
ce
ility
n
que
erab
Threat
se
Vuln
Con
Figure 3 Simplified representation of risk. All “legs of the stool” must be present in order for risk to exist
5 Any value can be used here, but the most typical values used are 5%, followed by the second most common, 1%.
DOI: 10.1002/9781118755471.sgd044
Finally, if the grid is perfectly invulnerable to hurricanes, then the worst of all hurricanes could not have an
effect on its delivery of electricity. Thus, the residents would have medical equipment operating without risk.
Notice that our scenario considers vulnerability, threat, and consequences simultaneously: the hurricane
is a threat to the grid, the power grid is vulnerable to the threat, and the consequences are the effects on
residents through the loss of electricity to medical equipment. The risk calculated under this scenario does
not translate to any other scenario. For example, we know that hurricanes can also cause a building to collapse
and hurt residents. This scenario is silent on that particular risk, however, we could include it by expanding
our equation to include the vulnerability of a structures’ integrity to a hurricane, and a consequence that
relates a collapsing structure to residents harm.
For resilience to be “risk based,” we mean that its mathematical representation must have elements of
vulnerability, threat, and consequence. Vulnerability represents the ability of the system to withstand or
continue to operate during a particular threat such as a hurricane or a cyber attack. The threat represents the
entity or attack that is poised to cause damage to the system. Finally, consequence represents the “so-what.”
Consequences can be represented at different depths; a shallower representation would be to characterize
consequences as the inability of the system to deliver electricity to its intended loads. A deeper characteriza-
tion might be its inability to provide essential social services. This latter definition is both more meaningful
and more challenging to model. It requires one to connect specific electrical loads to specific social con-
sequences. Although difficult, it is what our communities must think through in order to design electric
systems that are truly resilient. Many communities consider these essential loads to include elements such
as emergency services, key transportation services, water and waste water infrastructure, critical communi-
cations infrastructure, hospitals, community staging centers, grocery and gas stations, and critical residential
facilities such as nursing homes and retirement communities.
A frequently used characterization of resilience is that it represents the ability of a system to rebound
from a contingency. This is sometimes represented by the time it takes to restore, say 80% of, system func-
tion. “The ability to withstand and rapidly recover” is also a stated goal of resilience as stated in PPD-21.
Although there is no cause for disagreement with this perspective, it does not sufficiently explain the pur-
pose of resilience and does leave room for misinterpretation. It is possible for a system to be designed in
two completely different ways, both which rapidly recover from the same major hazard. The first system
may prioritize electric service to loads that enable and promote societal recovery. The second may not make
a distinction regarding the prioritization of electric service restoration. Although these two systems may
be “recovering” at the same rate, they are not equally resilient in that one system has provided more soci-
etal benefit than the other. This perspective presents recovery time and the ability to withstand as important
elements of resilience, but not the objective. Rather, the objective of an electric system’s resilience is to min-
imize a measurable or calculable metric representing social consequences. This better reflects the purpose
of the electric power system as an entity that serves society, rather than an entity that simply preserves or
restores itself without regard to societal need.
5 A Resiliency Analysis Framework

Sandia National Laboratories has developed a resilience analysis process (RAP) that can be used to assess
baseline system resilience and evaluate proposed resilience improvements. The process is designed to lead
decision makers from high-level goals to quantitatively defensible risk-based decisions that can guide infras-
tructure investments (and can be extended for real-time operating decisions). The RAP is for general-purpose
analysis of energy infrastructures and requires the application of system specific data. Here, we present the
RAP in its general form, but later, we will discuss a specific application of the RAP to an IEEE 118 bus grid
resiliency assessment and enhancement.
DOI: 10.1002/9781118755471.sgd044
The first six steps of the RAP provide decision makers and stakeholders a method for assessing the baseline
resilience of a system, that is, the existing system resilience, without any changes to the system infrastructure.
The seventh and final step identifies infrastructure investments that will improve in system resilience.
The RAP is inherently iterative in nature, in that the process does not terminate with execution of the
seventh and final step. Rather, the sequence is typically repeated. Francis and Bekera (2014) maintain that
“vulnerability analysis at regular intervals is a key to recognizing disruptive events in advance and continu-
ously self-evaluating and learning from incidents.” Periodic re-evaluation of system resilience is important
in practice, for the following purposes:
• Validating a resilience analysis methodology, including the RAP.

• Validating models against actual incident data.
• Updating resilience assessments with the current technology methods and improved threat characteriza-
tions.
All relevant stakeholders should engage in the RAP, from utility owners and operators to governmental
and policy entities. While there may be a single decision maker or small set of decision makers with a
question of concern, engaging a broad community in each RAP step helps ensure a more complete analysis
and acceptance of any proposed investments.
5.1 Step 1: Define Resiliency Goals

Before analyzing and selecting appropriate metrics and systems, it is essential to define high-level resilience
goals. The goal set during this first RAP step lays the foundation for all subsequent steps. For example,
discussions during this phase should determine whether assessing resilience is the main goal or if evaluating
possible system improvements is a central objective. If evaluating and/or identifying potential improvements
is within the scope of the analysis, a decision should be made about the kinds of changes to be considered
and the types of questions the analysis should address.
During this stage, key stakeholders and any possible conflicting goals among the stakeholders are identi-
fied. Some examples of high-level goal language appropriate at this step of the process are
• improving a regional electricity grid’s resilience to natural disasters,

• deciding how to allocate a utility’s capital investment budget,
• prioritizing the societal elements to be preserved, such as ensuring availability of power to emergency
services, key community facilities, and other critical infrastructure systems during disasters.
5.2 Step 2: Define the System and its Resilience Metrics

System boundaries and resilience metrics definitions determine the scope of any resiliency analysis. Execu-
tion of this step will include identification of a system’s geographic, schematic, and functional boundaries,
relevant time periods, and/or relevant components. Because some consequence measures (e.g., macroeco-
nomic impacts) require a relatively broad system definition, execution of this step is the appropriate time
for stakeholders to discuss the types of consequences about which they are most concerned.
Determining the appropriate level of fidelity for the analysis should be driven at least in part by the
high-level goals set during step 1, although data availability can often drive these decisions. Any resiliency
metrics selected during this step should be specific enough to enable decision making, whether for opera-
tional or planning purposes.
DOI: 10.1002/9781118755471.sgd044
Resilience metrics will take the form of a probability function; probability of consequence X given threat Y.
In this context, defining resilience metrics includes determining the type of threat or threats [such as a
hurricane or geomagnetic disturbance (GMD)] and the type of consequences (such as financial, safety, envi-
ronmental, and criticality-weighted load lost). It is assumed that more than one defined consequence metric
may be needed to fully understand the system resilience to the threat. For example, both financial conse-
quences and lives at risk may be appropriate for a full understanding of the consequences to a hurricane.
These consequences can be identified separately, or if desired, can be combined into a common basis such
as money.
5.3 Step 3: Characterize Threats

Threat characterization is critical to understanding how the system under consideration is able to absorb
and adapt to different types of intentional disruptions or natural disasters. Specific characterization of a
threat is needed to conduct the RAP analysis. For example, in the case of a hurricane, one must specify the
intensity, geographic (and schematic) path taken, or probabilistic scenarios for those items. Although the
RAP can be applied against a single threat, it can also be applied using multiple threats. When performing
an analysis to evaluate resilience against multiple hazards, information about (i) the relative likelihood of
each possible threat scenario and (ii) the capabilities or strength of the threat are extremely important. In this
analysis, a stochastic optimization is used to determine how to improve the system resilience under various
constraints such as capital cost and physical system capabilities.
5.4 Step 4: Determine Level of Disruption

Once an understanding of the relevant threats has been solidified, the nature and attributes of each threat
are used to determine the amount of damage to the system, such as the specific impact to infrastructure
components and support equipment that is likely to result from each of the identified threats. Note that
this characterization is generally expected to be probabilistic, particularly in the case of natural disasters.
For example, the specific set of transmission lines impacted by an ice storm depends on the precise real-
ization of a storm. Models such as FEMA’s HAZUS (http://www.fema.gov/hazus) can be useful at this
stage – HAZUS contains models for estimating potential losses from earthquakes, floods, and hurricanes.
In this step of the RAP, expectations concerning structural damage or other system impacts that could affect
performance are defined and mathematically quantified.
5.5 Step 5: Define and Apply System Models

The relationship between the threat to the system and the damage to the system is used to determine the
system’s electrical output under the threat scenario. For example, physical damage (or a range of dam-
age outcomes when incorporating uncertainty) to an electric grid from an earthquake can be used as input
to a system model to determine the amount and location of loads not served by the system over time.
Multiple system models may be required to capture all relevant aspects of the complete system. Further-
more, dependencies may exist between models that must be modeled. For example, a repair and cost model
may be used to determine a repair schedule for components of an infrastructure. The schedule determined
by these models may inform system models to assess how the system performs during the restoration
period.
DOI: 10.1002/9781118755471.sgd044
5.6 Step 6: Calculate Consequence

When evaluating system resilience, the system’s electrical output during and after a threat is only part of the
story. Energy systems provide electricity for a larger social purpose such as the preservation of key infras-
tructures, health and safety, and preserving economic welfare. During this step of the RAP, electrical outputs
from system models are correlated to social impact. Using stakeholder information and computational anal-
ysis, resilience metrics are populated as defined in the second step of the RAP. When probabilistic threats
and/or consequences are included in the RAP, probability distributions or corresponding summary statistics
will be used to define the shape of the resilience metric.
Obtaining a common set of priorities among stakeholders that can be used as a basis to determine the most
relevant threats and social consequences for a system resiliency analysis can be challenging, as there can be
differences of opinion regarding prioritization. Methods such as the analytic hierarchy process (REF) can
be used to support expert determinations of the relative importance of these measures.
5.7 Step 7: Evaluate Resiliency Improvements

Unless the RAP is being undertaken purely for assessment purposes, it is likely that decisions must be made
about how to modify operations or plan investments to improve resilience. After completing a baseline
resiliency assessment via the first six steps of the RAP, it is typically desirable to alter the system configura-
tion, for example, via capital hardening investments, in order to yield improved system resilience. Examples
include
• a physical infrastructure change to the system (e.g., adding a redundant power line),
• a policy change (e.g., allowing the use of stored gas reserves during a disruption),
• a procedural change (e.g., turning off equipment in advance of a storm),
• an operational change (e.g., modifying system dispatch, operating modes, or switch positions).
This step in the RAP can be executed in a variety of manners, dependent primarily on how the specific
resiliency-enhancing investments are determined. In the simplest case, alternative investments are proposed
by engineers and independently assessed using the first six steps of the RAP process. In more complex
cases, multiple investment choices can be selected as decision variables and an optimal set can be automati-
cally chosen by optimization algorithms or related analytic processes, subject to various constraints such as
budgetary limits and physical constraints. The latter leverages the first six steps of the RAP, but in a more
integrated and holistic manner than simple assessment.
6 An Application of the Resiliency Framework

We now detail an analytic example of resilience analysis for the electricity grid, using the RAP and asso-
ciated metrics. The presentation is organized around a series of analysis use cases, ranging from a baseline
resilience computation for an existing system to comparison of alternative investment portfolios to enhance
resilience, to optimization of investments for enhanced resilience given a fixed budget.
6.1 Illustrative Test System

To illustrate the use of our resilience framework and metrics in the context of the electricity section, we
consider a simple, well-understood, and widely used model of an electricity grid: the IEEE 118 bus test
DOI: 10.1002/9781118755471.sgd044
Figure 4 IEEE 118 bus electrical test system
case. This model – available from http://motor.ece.iit.edu/data/itscuc – consists of 91 loads, 54 generators,

and 186 lines. A high-level schematic of this test system is as follows (Figure 4).
The resilience framework assumes the availability of a systems operations model. For the 118 bus test case,
we consider a standard security-constrained unit commitment model with optimization objective of eco-
nomic dispatch, representing system reliability operations for a period of 24 h. Network physics are approx-
imated using linearized AC optimal power flow models, used in most ISO dispatch algorithms. Nonlinear
AC optimal power flow can be used at additional complexity and computational expense. These advanced
models are required to consider the effects of reactive power and voltage stability within the optimization.
In terms of mathematical constructs, the unit commitment operations model is expressed as a mixed-
integer linear optimization model, with algebraic constraints and objectives. This decision formalism con-
trasts with simulation formalisms, in that it allows for efficient global optimization of operational models.
Specifically, the use of such algebraic optimization models facilitates automatic determination of optimal
infrastructure investment selections, subject to fixed, prespecified budget.
6.2 Defining Threat Scenarios

A key concept in the proposed resilience framework is the following: an infrastructure is designed to be
resilient to a specific set of possible disruptions. In other words, the set of possible events is finite and
prespecified, at an appropriate level of abstraction. A number of methodologies can specify such events.
DOI: 10.1002/9781118755471.sgd044
Figure 5 Threat scenario tree representing three “children” nodes
However, for purposes of simplicity, we adopt the notion of a scenario tree. A scenario tree is a decision tree
that specifies, via branching, the nature of the range of disruptions to which we are designing an infrastructure
to be resilient to.
For a posited system, we consider three classes of high-level threats: a hurricane, an earthquake, and a
terrorist incident. These three event classes correspond to the first branches from the root on the tree, yield-
ing three “children” nodes. In general, probabilities can be assigned to each specific event class – assuming
sufficient information is available for their estimation. More commonly, the event classes reflect all-hazard
events, such that the probabilities are treated as uniformly distributed. In a real system, the high-level
threat scenario identification process is expected to be an output from an iterative and highly interactive
stakeholder-driven process. In this electricity use case, the first stage of the scenario tree can be depicted as
shown in Figure 5.
Given a high-level threat specification, the next stage in the scenario analysis process is to further refine
the description of each specific threat. For illustrative purposes, we focus on the hurricane scenario. In the
case of a hurricane and other natural disruption events, significant historical information and forecast models
can be used to guide specification of possible realizations of the general threat. For example, the scenario
tree node representing a hurricane is expanded as shown in Figure 6.
Note that at this point in scenario analysis, probabilities for specific event realizations are likely to be
available, or at minimum, relative weightings of likelihood.
Finally, each realization of an event must be translated into physical damage of the infrastructure system
under consideration, for example, the electricity grid. Pictorially, we illustrate this process for one of the
hurricane events as shown in Figure 7.
For a real-world system, system experts should be consulted to estimate the damage to equipment given
the occurrence of the threat. In the context of the IEEE 118 bus test case, we arbitrarily define system damage
under this specific hurricane event realization as follows. For generation, we sample the number of distinct
failures from a normal distribution, with mean 20 and standard deviation 5; the failures are then allocated
uniformly and randomly to the generation fleet. We follow an analogous process to simulate damage to lines,
DOI: 10.1002/9781118755471.sgd044
p1 p2 pn
Category 2, landfall at Category 4, north-of- Category 5, eye tracks

high tide peninsula strom track over metropolitan area
Figure 6 Detailed expansion of the hurricane threat
Category 2, landfall at
high tide
Damage Damage
realization K realization N
Figure 7 Damage realizations for a category 2 hurricane, landfall at high tide
using a normal distribution with mean 40 and standard deviation 7. These damage profiles are intended to
be strictly notional. As with high-level threat scenario identification, actual damage realization profiles will
need significant domain expertise and stakeholder involvement in order to be accurately specified.
6.3 Specifying Consequences of Loss of Delivery

In the context of the electricity grid, loss of power – typically quantified as megawatt hours of load shed – is
a very indirect method to quantify the true consequence associated with loss of delivery. For purposes of
resilience analysis, more salient metrics quantify aspects of safety, security, or economic impacts. In this
analysis of the 118 bus test case, we define consequences in terms of economic losses calculated using
hypothetical relationships, for example, due to industrial facilities being disrupted. In order to translate
from loss of load at each bus to consequence, we introduce piecewise linear transformations – an example
of which is given in Figure 8.
The particular transformation was chosen to reflect the typically nonlinear nature between loss of delivery
and consequence. In reality, specification of this transformation requires deep knowledge of both the system
under consideration and any associated dependent infrastructure.
DOI: 10.1002/9781118755471.sgd044
Economical loss ($)

Demand not served (MWh)
Figure 8 Example function relating megawatt not served at a bus to economic loss
6.4 Baseline Resilience Assessment

The initial resilience analysis of the system requires computation of a baseline resilience value. The intent
of this analysis is to demonstrate the initial use of a resilience metric for any infrastructure, which is to
establish a rigorous and quantifiable description of system resilience. Without such a baseline measure, it is
difficult to assess the benefit conferred by any proposed investments to improve system resilience.
We consider a hypothetical hurricane event, and sample of 100 realizations of potential damage using the
distributions of damage to generation and line resources introduced above. For each scenario, we compute
an economic (minimal operating cost) commitment and dispatch. Given this dispatch, we then compute
the cumulative economic losses incurred due to loss of service, using the piecewise linear transformations
described previously. We assume no recovery is possible in the short term (i.e., 24 h), such that generators
and lines that have failed remain disabled for the scheduling horizon.
A histogram of cumulative economic losses incurred across the sampled scenarios is shown in Figure 9.
Histogram of economic losses due to hurricane

35
Mean =
30 $990.3M
25
Frequency
20
15
10
0
0 1000 2000 3000 4000 5000
Economic losses incurred ($M USD)
Figure 9 Resilience metric for the baseline system
DOI: 10.1002/9781118755471.sgd044
Histogram of economic losses due to hurricane Histogram of economic losses due to hurricane
35 100
30
Optimized under economic 80 Minimize consequence:
25 dispatch (business as usual)
economic loss
Frequency
60
Frequency
20
vs
15
40
10
20
5
0 0
0 1000 2000 3000 4000 5000 0 200 400 600 800 1000 1200 1400 1600 1800
(a) Economic losses incurred ($M USD) (b) Economic losses incurred ($M USD)
Figure 10 Resilience metrics for the same system under economic dispatch (a) and resilience dispatch (b)
While many scenarios yield minimal economic losses, there are a nontrivial number of scenarios in which
the economic loss is significantly larger than the mean of $990.3M. Translation from the distribution to a
single summary statistic can proceed in a variety of ways, including a simple mean (as shown in Figure 9)
or tail-oriented statistics such as CVaR, which identifies the worst 5% consequences that can be expected.
Beyond establishing a baseline resilience quantity, it is possible to simply operate the system in a man-
ner that directly minimizes consequence. During an economic dispatch, the optimization seeks to minimize
generator operating costs, but changing the optimization objective to minimizing the mean value of system
consequences (i.e., the system resilience metric) provides a dramatic increase in system resilience. Under
this paradigm, we are able to drastically reduce the expected consequences and VaR associated with the hur-
ricane event. We graphically show the impact of shifting operations from an economic dispatch (minimizing
operating cost) to a resilience dispatch (minimizing expected resilience) as shown in Figure 10.
In other words, by mathematically representing the system consequence as a resilience metric and directly
optimizing against this metric, it is possible to significantly reduce the consequences associated with a
posited event. In practice, balancing area authorities typically dispatch excess reserve generation before
and during hurricanes but do not enumerate the added resilience of doing so. The analysis here results in a
clear indication of what generation should additionally be dispatched, and what resulting resilience is gained.
Clearly, the strategy has deviated from an economic dispatch, resulting in higher operating costs for a day
or two, while the hurricane threat looms. These added costs should be compared to the reduced economic
consequences of the hurricane – in this case, $990M − $50M = $940M. If the analysis was conducted with
a probability-weighted set of hurricane threat scenarios representing the best available information, then
this comparison is fair. Else, if the hurricane being evaluated was assumed to be a “worst case” scenario,
the resulting improvement in consequence must be reduced by a factor that accounts for the likelihood of
its occurrence.
6.5 Restoration and Recovery Analysis

Another aspect of resilience quantification relates to the time and costs associated with system recovery and
restoration. To illustrate resilience analysis using these concepts, we augment the baseline 118 bus test case
DOI: 10.1002/9781118755471.sgd044
Histogram of recovery effort cost

20
15
Frequency
10
0
0 2000 4000 6000 8000 10,000 12,000 14,000 16,000
Recovery effort ($M USD)
Figure 11 Resilience metric focused on restoration and recovery
with a recovery and restoration model. This process is modeled as occurring over a 3-day period following
the initial event. We assume a fixed budget for recovery and restoration resources and impose the following:
• Five crews are available, three for line restoration and two for generator restoration.
• Each crew requires 3 h to repair a line.
• Each crew requires 18 h to repair a generator.
• Lines are repaired in a random order.
• Generators are repaired largest-to-smallest (in terms of capacity).
Mirroring the previous baseline resilience analysis methodology, we compute restoration and recovery
costs for the associated disruption scenarios. The resulting histogram of cost is shown in Figure 11.
As with the analysis of economic losses incurred, methods for reducing the recovery and restoration dis-
tribution to a single metric include both expected value computations and tail-oriented statistics.
6.6 Investment Analysis

Given a baseline resilience analysis for a particular infrastructure system, the next logical step is to assess
how different infrastructure investments will improve system resilience, and by how much. To illustrate
the execution of this type of analysis, we consider the assessment of two competing investment options
for the modified 118 bus test case. In option A, engineers propose to build flood walls around generators
with greater than 180 MW capacity; this represents approximately 20% of the thermal fleet. This posited
strategy – a proxy for protection against flooding – costs $100M total, $9.1M apiece for each of the 11
affected generators in the system. In option B, engineers propose to bury high-capacity lines, specifically
those with thermal limits exceeding 250 MW; this represents approximately 5% of the lines in the system.
DOI: 10.1002/9781118755471.sgd044
With generator flood walls With line burying

Histogram of economic losses due to hurricane Histogram of economic losses due to hurricane
50 40
Mean = $544.7M Mean = $673.4M
35
40
30
30 25
Frequency
Frequency
20
vs
20
15
10
10
5
0 0
0 500 1000 1500 2000 2500 3000 3500 0 1000 2000 3000 4000 5000 6000
(a) Economic losses incurred ($M USD) (b) Economic losses incurred ($M USD)
Figure 12 Resilience metrics showing improvements over baseline by adding flood walls (a) and burying electrical
cables (b)
This posited strategy – a proxy for protection against high winds and tree faults – also costs $100M, $4M
apiece for each of the 25 affected lines. Rerunning the analysis with the additional system protections in
place, we obtain Figure 12.
Note that both investment options reduce consequences, relative to the baseline mean of $990.3M. How-
ever, option A yields a more significant reduction, and further admits fewer high-consequence losses. Over-
all, the intent of this example is to illustrate the use of the proposed resilience framework and metrics to
rigorously assess the relative benefits of proposed investment options – a critical step in (for example) rate
case justification.
6.7 Advanced Planning

An alternative to evaluating competing investment portfolios is to simply determine the optimal investment
portfolio directly, that is, the portfolio that maximizes the increase in resilience (decrease in consequence)
subject to a fixed budget constraint. In the case of this electricity use case example, this capability is enabled
by the availability of the operations model as an algebraic mathematical optimization model. To illustrate
this type of analysis, we expand the investment analysis scenario as follows. First, we assume a total budget
of $100M and respective hardening costs as previously specified – $9.1M per generator and $4M per line.
However, we introduce decision variables into the operational model that allows the optimization to deter-
mine which assets are hardened, and in what mix, while requiring that expenditures do not exceed $100M.
The resulting histogram of economic impacts incurred is shown in Figure 13.
In this analysis, we minimized the mean (expected) economic loss incurred across 100 sampled scenarios
of realized damage for the posited hurricane event. The graphic indicates that the resulting investment port-
folio (which includes a mix of generator flood walls and line burying) outperforms both options A and B,
in terms of both reducing the mean impact and admitting fewer very high-consequence events, although the
investment was equivalent.
DOI: 10.1002/9781118755471.sgd044
Histogram economic losses due to hurricane

30
25 Mean =
$375M
20
Frequency
15
10
0
0 500 1000 1500 2000 2500 3000
Economic losses incurred ($M USD)
Figure 13 Resilience metrics showing improvements over baseline by combining the addition of flood walls with
buried electrical cables. The optimization algorithm selected the mix of each, constrained to $100M total
6.8 Summary of Resilience Framework Application

In this section, we have illustrated the resilience framework and associated metrics in the context of the
electricity grid. Using a standard test system, we illustrated how threat scenarios and consequences can be
specified. Given this context, we demonstrated a range of resilience analysis for the test system, ranging from
a simple yet critical baseline resilience computation to automated deterministic of investment portfolios to
maximize improvement in system resilience.
7 Challenges Ahead
Moving toward greater grid resiliency will be difficult. To begin with, a focused initiative on grid resilience
will require a range of coordinated activities, including R&D activities that are not just technical in focus
but encompass markets, policy, human behavior, and so on. Technical challenges also lie ahead, including
the identification and development of appropriate resilience metrics, a process that must be undertaken
collaboratively, with the help of federal and state agencies, the electric utilities, regulators, and research
institutions.
In addition, the metrics must be carefully formulated in such a way to be useful as tools for infrastructure
investment, strategic planning, and operational decision making in real time. At the same time, the utilities
will have to be trained to understand these tools and helped through a difficult and interdependent process.
8 Next Steps
The application of this methodology on an US electric grid system is currently being conducted with
both PJM (Pennsylvania-New Jersey-Maryland Interconnection) and AEP (American Electric Power). The
DOI: 10.1002/9781118755471.sgd044
threats being considered are weather related, physical threats, and GMDs. Although the focus of these
analyses are on transmission systems, the application of this methodology on distribution systems is both
appropriate and useful.
8.1 Data
To adapt to large-scale events and minimize their consequences requires real-time capabilities and
response times. Resilience metrics will therefore reflect the communications capabilities of the smart grid
and depend heavily on the data being generated by both the bulk-power and distribution systems. However,
by encompassing “big data,” these metrics also have the potential to have significant impact on the broader
electric sector: they could inform R&D strategies, justify new business approaches, and improve the overall
adaptability of the grid in a world that is changing.
8.2 Policy and Financing

These topics are often lumped together although they can be very different. When discussing social issues,
however, financing often becomes a policy topic, which makes progress slower and more difficult as it
requires a political process in order to approve.
8.2.1 Policy
From a planning perspective, resilience metrics and analytics offer the ability for a utility or community
to understand what benefits they would receive for any given infrastructure improvement investment. In
addition, a focus on both reliability and resilience could impact policy, leading to changes in planning and
in operational practices and procedures that would help minimize the consequences of a grid outage.
Figure 14 shows how the RAP process can be applied to identify benefits to system resilience and then
compare them to the costs of the infrastructure improvements. In the diagram, we state that the threat is
“given,” meaning we have assigned the probability of the threat occurring at 100% in our model. Therefore,
the expected consequence presumes that the threat (e.g., Class 5 hurricane) takes place. If we were to place
a 1 in 10 chance of the threat occurring, then we should conduct our simulation with that condition. In
a similar manner, more than one threat can be considered on the metric. We could, for example, identify
the best system improvements and resulting reduction in consequences considering some chance of an ice
storm, hurricane, and cyber threat all bundled together. It is important to note that if one selected the best
$1M infrastructure investments to reduce consequences for several potential threats, the investment choices
would likely be different than if the investments were chosen for each threat separately. In fact, you would
likely see higher value as there may be some asset improvement choices that could significantly reduce
consequences from all three threats but may not have been the very best investment for any single threat.
This is the power of the optimization process. The ability to quantify a value proposition for resilience
improvements is a critical accomplishment, enabling policy makers to engage in social debate at a more
significant level.
8.2.2 Improvements to Reliability

As mentioned earlier in the document, reliability is defined separately from resilience. This means that the
outcome of a resilience analysis may or may not have marked improvement on system reliability. In many
DOI: 10.1002/9781118755471.sgd044
Reduced expected financial

consequence
Probability of consequences ($)

Reduced
risk
given threat X
E ′(C) E (C) Consequences ($)
Resilience of system
after improvements Improvements Baseline system
must cost resilience
significantly less
than E–E ′
Figure 14 Using resilience metrics to identify cost–benefits of potential system investment alternatives
cases, utilities have a good idea of where there system reliability issues are located and what investments
would be best suited for their improvement. So any analytic result that identifies the best improvement for
resilience should also be considered against its potential improvements to reliability. There are probabilistic
software tools that have been developed at Sandia National Laboratory for the evaluation of electric power
system reliability. These tools are currently being evaluated to determine the suitability of evaluating and
co-optimizing the resilience and reliability of an electric power systems.
8.2.3 Financing
Of critical importance for resilience enhancements is the ability to monetize benefits of the improvements.
Up to this point, we have not discussed benefits in terms of income, but rather in terms of avoided costs.
Let’s look at both cases.
Benefits as Income
In order to have an income stream, one must provide a product or service over time. In some cases, it may
be feasible to charge beneficiaries of resilience improvements for the benefits they receive, although most
often it may be difficult to charge public recipients for these services due to the political process involved.
For publically owned systems, municipalities, coops, and so on, rate hikes would be approved by a board
of directors that is elected by the constituency, thus a political, public process would be typically started.
For investor-owned utilities, the state Public Utility Commission would require engagement (and likely
advocacy) from the utility along with public hearings in again, a lengthy public process. In both cases, the
public process would weigh many things, but chief among them is immediate need for capital to make the
improvements against the belief of future incurred costs avoided.
This process can be shortened dramatically if the public is not called upon to pay for the improvements.
Sandia National Laboratories has conducted resilience improvement designs that rely on the sale of electric
DOI: 10.1002/9781118755471.sgd044
power to regional industrial customers and the independent system operator to fund the development of
the resilient system itself. Doing this is similar to an entity becoming an independent power producer. For
larger generation plants, say 50–100 MW or more, efficiencies and economies of scale start to enable a
positive income stream, even given O&M costs. This scale of generation also provides a critical backbone
for resilience if properly designed and integrated with the existing utility grid. This integration could take the
form of a very large microgrid or could take other forms. The design itself would be configured to provide
resilience against the most ominous threat(s) to the community it served. The future revenue stream and
physical infrastructure itself becomes the collateral needed to obtain the capital needed to build the plant.
After the system becomes operational, the revenues generated through the sales of electricity and other
ancillary services can be used to pay back capital investors with interest. All the while, the constituency
benefits from the added protection of an enhanced resilient system.
Benefits as Avoided Costs

When Hurricane Sandy hit the US east coast in October of 2012, it created devastating impact across many
communities, with estimated costs incurred over $65B.6 Cleanup and rebuilding costs came from many
different sources, including individuals, insurance companies, cities, states, and the federal government.
Some of this expense went to electricity rate payers, but not all. For example, New Jersey’s Board of Public
Utilities has authorized rate increases to support a $1.2B effort in strengthening and increasing resilience
for the electric and gas infrastructures in the state. Over $18B in insurance claims were made.7 By July
2013, Federal budget outlays exceeded $22B with authority of $50B plus an additional $9.8B in borrowing
authority.8 New Jersey, the second hardest hit states, has spent less than $1B on Sandy recovery efforts.9
This information provides a better understanding of who the financial stakeholders are. Those with the
greatest motivation to prevent damages are those poised to incur the costs of them. Given that a state gets
significant financial assistance through federal aid when disaster strikes, it would be difficult to motivate the
states to bear the full costs of prevention and mitigation through resilience improvements.10 As a means of
self-insurance, the greatest motivation to invest in resilience rests with the federal government. Insurance
policy holders, whether private, corporate, or public, should also weigh the cost/benefits of self-insurance
via resilience improvements against those provided by the insurance industry.
References
Field, C., Barros, V., Stocker, T., et al. (eds) (2011) Managing the Risks of Extreme Events and Disasters to Advance Climate Change
Adaptation (SREX) Special Report of the Intergovernmental Panel on Climate Change, 594 pp, Cambridge University Press,
New York, NY.
Francis, R. and Bekera, B. (2014) A metric and frameworks for resilience analysis of engineered and infrastructure systems. Reliability
Engineering & System Safety, 121, 90–103.
Massoud, A. (2011) U.S. electrical grid gets less reliable. IEEE Spectrum, January.
Wilshusen, G. (2012) Cybersecurity: Challenges in Securing the Electricity Grid. Testimony before the Committee on Energy and
Natural Resources, the U.S. Senate. July 17, 24 pp.
6 Hurricane Sandy Rebuilding Task Force Report, August 2013.

7 Ibid.
8 Ibid.
9 http://www.njspotlight.com/stories/14/10/29/two-years-after-hurricane-sandy-new-jersey-s-recovery-trudges-along/
10 The author does not intend to imply that all the financial losses associated with a major threat such as Hurricane Sandy will evaporate
if only investments in resilience were made in the electric sector. Rather, a careful inspection of cost–benefits are now possible.
DOI: 10.1002/9781118755471.sgd044
Further Reading
Nateghi, R., Guikema, S., and Quiring, S. (2011) Comparison and validation of statistical methods for predicting power outage durations
in the event of hurricanes. Risk Analysis, 21 (12), 1807–1906.
Pat-Cornell, E. and Guikema, S. (2004) Probabilistic modeling of terrorist threats: a systems analysis approach to setting priorities
among countermeasures. Military Operations Research, 7 (4).
Quiring, S.M., Schumacher, A., and Guikema, S. (2014) Incorporating hurricane forecast uncertainty information into decision support
applications. Bulletin of the American Meteorological Society, 95, 47–58.
Staid, A. and Guikema, S. (2012) A Risk Framework for Offshore Wind Farms in Hazard-Prone Areas. Proceedings of the 11th Interna-
tional Probabilistic Safety Assessment and Management Conference and the Annual European Safety and Reliability Conference.
Ton, D.T. and Wang, W.-T.P. (2015) A more resilient grid: the U.S. department of energy joints with stakeholders in an R&D plan.
IEEE Power and Energy Magazine, 13 (3), 26–34.
Watson, J.P., Guttromson, R., Silva-Monroy, C., et al. (2014) Conceptual Framework for Developing Resilience Metrics for the
Electricity, Oil, and Gas Sectors in the United States. Sandia National Laboratories Report No. SAND2014-18019.
Yamangil, E., Bent, R., and Backhaus, S. (2015) Designing Resilient Electrical Distribution Grids. Proceedings of the 29th Conference
on Artificial Intelligence (AAAI 2015), January, Austin, Texas.
Zhu, L., Quiring, S., and Emmanuel, K. (2013) Estimating the risk of tropical cyclone precipitation in Texas. Geophysical Research
Letters, 40, 6225–6230. doi: 10.1002/2013GL058284.
DOI: 10.1002/9781118755471.sgd044
DOI: 10.1002/9781118755471.sgd044

Smart Grid Handbook Defining, Measuring, and Improving Resilience of Electric Power Systems

Enviado por

Dados do documento

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Smart Grid Handbook Defining, Measuring, and Improving Resilience of Electric Power Systems

Enviado por

Direitos autorais:

Formatos disponíveis

Defining, Measuring, and Improving

Resilience of Electric Power Systems

3 Distinctions between Reliability and Resilience

Table 1 Distinctions between electric power system reliability and resilience

High probability, low consequence Low probability, high consequence

• Reliability focuses on high-probability, low-consequence events

• the number of spare transformers available,

Expected CVaR Consequence X

Figure 2 Resilience metric framework for the electric power system

4 Framing the Concept of Grid Resilience in Terms of Risk

5 A Resiliency Analysis Framework

• Validating a resilience analysis methodology, including the RAP.

5.1 Step 1: Define Resiliency Goals

• improving a regional electricity grid’s resilience to natural disasters,

5.2 Step 2: Define the System and its Resilience Metrics

5.3 Step 3: Characterize Threats

5.4 Step 4: Determine Level of Disruption

5.5 Step 5: Define and Apply System Models

5.6 Step 6: Calculate Consequence

5.7 Step 7: Evaluate Resiliency Improvements

6 An Application of the Resiliency Framework

6.1 Illustrative Test System

Figure 4 IEEE 118 bus electrical test system

case. This model – available from http://motor.ece.iit.edu/data/itscuc – consists of 91 loads, 54 generators,

6.2 Defining Threat Scenarios

Figure 5 Threat scenario tree representing three “children” nodes

Category 2, landfall at Category 4, north-of- Category 5, eye tracks

Figure 6 Detailed expansion of the hurricane threat

Figure 7 Damage realizations for a category 2 hurricane, landfall at high tide

6.3 Specifying Consequences of Loss of Delivery

Economical loss ($)

6.4 Baseline Resilience Assessment

Histogram of economic losses due to hurricane

Figure 9 Resilience metric for the baseline system

6.5 Restoration and Recovery Analysis

Histogram of recovery effort cost

Figure 11 Resilience metric focused on restoration and recovery

6.6 Investment Analysis

With generator flood walls With line burying

6.7 Advanced Planning

Histogram economic losses due to hurricane

6.8 Summary of Resilience Framework Application

8.2 Policy and Financing

8.2.2 Improvements to Reliability

Reduced expected financial

Probability of consequences ($)

E ′(C) E (C) Consequences ($)

Benefits as Avoided Costs

6 Hurricane Sandy Rebuilding Task Force Report, August 2013.

Você também pode gostar