A Risk-Based Methodology and Tool Combining Threat Analysis and Power System Security Assessment

Abstract

A thorough investigation of power system security requires the analysis of the vulnerabilities to natural and man-related threats which potentially trigger multiple contingencies. In particular, extreme weather events are becoming more and more frequent due to climate changes and often cause large load disruptions on the system, thus the support for security enhancement gets tricky. Exploiting data coming from forecasting systems in a security assessment environment can help assess the risk of operating power systems subject to the disturbances provoked by the weather event itself. In this context, the paper proposes a security assessment methodology, based on an updated definition of risk suitable for power system risk evaluations. Big data analytics can be useful to get an accurate model for weather-related threats. The relevant software (SW) platform integrates the security assessment methodology with prediction systems which provide short term forecasts of the threats affecting the system. The application results on a real wet snow threat scenario in the Italian High Voltage grid demonstrate the effectiveness of the proposed approach with respect to conventional security approaches, by complementing the conventional “N − 1” security criterion and exploiting big data to link the security assessment phase to the analysis of incumbent threats.

1. Introduction

The increasing frequency of extreme weather events highlights the vulnerability of power systems to multiple outages [1]. The consequent interest in assessing the power system response to these high impact low probability events and the growing amount of data coming e.g., from prediction systems favor the maturation of probabilistic risk based approaches. Thus, Transmission System Operators (TSOs) are shifting their focus from security analyses based on N − 1 credibility criterion to the evaluation of power system vulnerability to extreme N − k events. In this context, TSOs have recently discussed the opportunity to use risk concepts (a suitable combination of event probability and impact) to assess and assure power system security against multiple contingencies [2,3,4,5]. Probabilistic models of weather related threats can greatly benefit from spatial-temporal data concerning the evolution of the weather over the power system. In this context, big data analytics applications can be of great help in providing reasonable probabilistic models of a weather threat both in long term (through historical data series) and in medium-short term (through forecasts and quasi-real time data acquisition) [2]. Big data analytics applications are raising more and more interest in the smart grid community, especially in the context of weather event alarming and management [3,4]. Reference [5] proposes a big data driven tool for disaster management to support operators’ decisions in emergency conditions, while in [6] a risk warning system is implemented based on big data. In order to plan strategies to relieve weather effects on distribution networks, in [7] a fuzzy logic technique is proposed to support utility operators’ decisions in optimizing real time operation and maintenance scheduling. An innovative method for weather-driven risk framework is deployed to analyse data and generate risk maps to support decision makers. Among the potential threats, wet snow events are common in different countries e.g., Italy [8], and they have been studied for many years. References [8,9] describe the activities carried out by the authors to propose and validate deterministic models aimed to forecast the amount of linear weight or thickness of snow sleeve accreted along the conductors of overhead lines (OHLs).

The goal of the paper is two-fold: (1) to propose a comprehensive methodology and platform which integrate a risk based security assessment tool for operational planning and quasi-real time operation [10] with advanced forecasting systems providing large amount of geo-spatial data on the expected intensity and extension of the major weather threats (focusing on wet snow events), and (2) to thoroughly present the results of the application of the platform to a real-life case study.

The added value of the proposed integrated platform is to exploit the available forecasts on the weather threats in order to provide the list of most risky contingencies on an hourly basis over the whole forecasting period, thus supporting operators in preparing the power system operation for the near future hours (i.e., at an operational planning level). Linking the set of single and multiple contingencies to be studied to the forecast of the threat affecting the system is an important step forward with respect the approaches proposed in literature to screen the most dangerous multiple N − k contingencies, from optimization frameworks, aimed to identify dangerous multiple branch outages [11,12,13] to rough set theory [14], random chemistry [15], graph theory [16], and eigen-sensitivity and cutsets [17], expert systems [18] or fuzzy logic [19] associated with neural networks. In fact, all these approaches have some limits, which are overcome by the contingency selection algorithm of the proposed methodology: (1) they usually screen the contingencies based on their impact, ignoring their probability; (2) common causes or dependent failures (e.g., busbar faults with protection misoperation) are neglected, while these events may initiate cascading outages and subsequent load disruptions; (3) most of the methods do not account for the current weather/environmental conditions.

The paper is organized as follows: Section 2 describes the risk-based methodology which integrates the threat/vulnerability analysis with power system security analyses. Section 3 discusses the data sources concerning the forecasts of extreme weather events with a focus on wet snow events, and the architecture of the risk based security assessment platform. Section 4 presents the detailed wet snow threat model and the relevant vulnerability models for overhead lines. Section 5 describes and discusses the results of the platform application to a realistic wet snow event scenario. Conclusions are drawn in Section 6.

2. Probabilistic Risk Assessment Methodology and Tool

This section presents the rationale at the basis of the proposed risk based approach and an overview of the threat and vulnerability modeling framework.

2.1. The Rationale of the Approach

The proposed probabilistic risk assessment method is derived from the bow tie conceptual scheme visualizing the connections between the causes and consequences of undesired events: Figure 1 illustrates an example where the disturbances consist in contingencies potentially provoking cascading outages and blackouts, i.e., with dangerous effects.

Threats are classified into natural threats and man-related threats (see the left side of bow tie), and further divided into internal or external to the power system. The man-related ones are also subdivided into intentional (e.g., sabotage) or unintentional (e.g., human errors). Threats may bring to a contingency via a set of causes which affect vulnerabilities; the contingency might provoke different impacts under several circumstances. These impacts may in turn act on other vulnerabilities, triggering cascading outages that finally lead to a blackout. To describe the deep connection between threats and contingencies, the conventional risk concept as a triple {contingency, probability, impact} [20] is reconsidered and extended.

In the proposed modeling framework [10] a threat can act on several vulnerabilities of power system components by triggering stress variables, consisting in the physical quantities exploited by the threat to influence the component vulnerabilities (e.g., a tornado may result in heavy mechanical forces on transmission line towers). This stress may provoke the component failure. The generic “contingency” at system level means the failure of one or more components. The methodology interprets the “vulnerability” as the conditional probability of a component failure given the occurrence of a specific threat. Also, any threat is modelled in probabilistic terms: e.g., the probability of a natural threat, like a wet snow event, depends on the weather situation at the time of the event itself. The sequel of the section will provide a description of the approach and of the relevant tool.

2.2. Modeling Component Failures

Given a single component with a vulnerability defined via a conditional probability function $P_V\left(t|\tau ,s,x\right)$ [21], the failure probability P_F of this component in the time interval $\left[t_0,t\right]$ subjected to an individual threat described by a {stress, time} multivariate probability density function (pdf) $p_{Thr}\left(\tau ,s,x\right)$ can be computed as in (1):

$$P_F\left(x,t,t_0\right)={\displaystyle \underset{t_0}{\overset{t}{\int }}{\displaystyle \underset{S}{\int }{P}_V\left(t|\tau ,s,x\right)\times p_{Thr}\left(\tau ,s,x\right)dsd\tau }}$$

(1)

where $P_F\left(x,t,t_0\right)$ is the probability that the component in location x fails between time instants t₀ and t; $P_V\left(t|\tau ,s,x\right)$ is the conditional probability distribution of the component failure at t due to value s of stress variable S related to threat Thr and applied at τ. Also vulnerabilities are functions of time, e.g., because of ageing or maintenance; $p_{Thr}\left(\tau ,s,x\right)$ is the pdf of threat Thr applying value s of stress variable S in location x, at time τ. Term $p_{Thr}\left(\tau ,s,x\right)dsd\tau$ is the probability to have stress s at time τ.

Random variables are represented via upper case letters (e.g., S), while their realizations or non- random variables via lower-case letters (e.g., s). Multivariate distributions in (1) must be adequately adjusted to model the specific component and threat under investigation. The tuning process may encounter some issues due to the reduced availability of statistical data from the historical series analyses or from prediction tools. If one considers an average model of stress variable S in interval $\Delta t=t-t_0$, the previous formulation can be written as in (2):

$$P_F\left(x,\Delta t,t_0\right)={\displaystyle \underset{S}{\int }{P_V}^{\left(\Delta t\right)}\left(t_0,s,x\right)\times p_{Thr}^{\left(\Delta t\right)}\left(t_0,s,x\right)ds}$$

(2)

where apex ^(Δt) is related to the average (threat/vulnerability) model in time interval Δt. It’s worth noticing that Equation (2) can be used for different time frames, provided that an adequate average model is available on a Δt horizon. Next subsections and Section 3 present respectively the models chosen for $p_{Thr}^{\left(\Delta t\right)}$ and ${P_V}^{\left(\Delta t\right)}$, and the data sources to characterize the models.

Under the assumption of constant failure rates in Δt relevant for operation (e.g., from 15 min to 1 h), the probability of failure of more than one components, due to the same threat, is derived by combining the “time to failure” exponential distributions of all the affected components following the probability laws. The approach can model also the more general case of more than one components subjected to multiple threats, accounting for potential dependencies among threats.

Applying this formulation assures a general framework for the probabilistic modeling of power system contingencies. Short term models will be the focus of the present investigation, because the tool is mainly oriented to system operation. In the sequel, only single threat scenarios are investigated, without diminishing the generality of the proposed methodology.

2.3. Threat and Vulnerability Modeling

The threats modeled in the platform may range from natural disasters (ice and snow storms, pollution, lightning, earthquakes, sabotage, earthquake-induced landslides, floods, fires, tree contact, component aging) to deliberate acts of sabotage. Long term and short term probabilistic models for threats can be derived respectively from the elaboration of historical data series and from weather forecasting systems. The last term of (2) can be computed if the dependence of the stress variable pdf on location x (spatial dependence) is known. To this regard, the proposed methodology is general and it may incorporate an accurate representation of the geospatial distribution of the stress variable if data from prediction systems are available. Other references about long term threat models can be found in [10]. Any component is described in terms of a vulnerability function with respect to each threat. The vulnerability models in (2) are derived from:

(a)

Laboratory tests, like mechanical fragility curves, blast withstanding capacity curves, voltage withstanding capacity curves [22] for insulating materials;

(b)

Mathematical models which connect component properties to the exposure to specific threats, e.g., rolling sphere method for exposure to lightning [23];

(c)

Qualitative information from experts or specific drills, e.g., to define the vulnerability of a SCADA system, or of a substation to physical attacks.

Also ageing processes, e.g., Arrhenius’ law or combined electric-thermal stress [24], can be included in vulnerability models.

Table 1. Stress variables adopted for the threats under study.

Threat	Stress Variable (Measurement Unit)
Ice and snow	Wind + Ice load (N/mm2) Conductivity on insulators (μS/cm2)
Pollution	Pollution concentration on insulators (mg/cm2)
Lightnings	Flash to ground density (# flashes/(km2·h))
Earthquake	Peak ground acceleration (m/s2)
Physical malicious attacks	Attack scenario probability (# attacks/week)
Landslides	Newmark displacement (m)
Floods	Water level (m)
Fires	Insulation temperature (°C)
Vegetation	Tree height (m)
Thermal Ageing	Air temperature (°C)

indicates the link between threats and stress variable(s).

2.4. Contingency Set Definition

The set of the contingencies to be analyzed in depth is detected via a two stage process:

• Identification of critical components (i.e., the ones explaining a fraction δ of total failure probability) using a cumulative sum screening technique [25,26];
• Screening of the most risky contingencies exploiting fast impact assessment techniques based on topological metrics.

An exhaustive set of single and multiple contingencies is generated by an enumeration technique, starting from critical components. Under the assumption of constant failure rates within Δt (valid hypothesis for time intervals up to 1 h), using probability theory and copula concept are used to combine the “time to failure” exponential distributions for all components involved in the contingency definition, in order to get the final distribution of the probability of contingency occurrence P_CTG(t): in the contingency screening process, the adopted value for probability is the maximum value of P_CTG(t) in the time interval Δt of study, henceforth named prob_ctg. Computing the probability for high order (N − k, k > 1) contingencies takes into account common mode and dependent events. Common mode events (e.g., outage of k branches subject to the same storm) are studied considering the available geo-spatial model (see Section 3) of the threat affecting the grid area under investigation. Dependent events are: (a) busbar contingencies (also accounting for protection malfunctioning), (b) power plant contingencies and (c) double circuit line outages.

Contingencies are screened on the basis of ex-ante risk indicators, obtained by combining event probability with impact metrics i.e., the number of outaged components or topological metrics such as average inverse geodesic length [27] and net-ability [28]: their computation is very fast. The proposed screening algorithm offers several options to adjust the contingency set selection, e.g., maximum ex-ante risk threshold and the fraction of explained total failure probability.

For time domain simulations, each contingency is characterized not only by outaged components but also by the time sequence of the trippings themselves, which depend on the response of primary and backup protections.

2.5. Modeling Power System Response to Contingencies and Computing Impact and Risk Indicators

The impact of each retained contingency is computed using a quasi-static cascading outage simulator [29] and/or a time domain simulator integrated in the platform.

The proposed approach introduces an extended risk concept: risk is defined as a quadruple {threat, vulnerability, contingency, impact} where the “probability” term of conventional triple {probability, contingency, impact} [20] is replaced by the probability distributions associated to threats and vulnerabilities. This risk definition links Probabilistic Hazard Assessment (PHA) studies to Security Assessment (SA) analyses, focusing on the disturbance root causes. In particular, component vulnerability connects the probabilistic model of generic threat Thr_p with the probability of contingency ctg, while the vulnerability in power system response connects contingency ctg with the final consequences (impact) on the power system itself. The way how threats act on power system clearly depends also on the (current or forecast) power system operating conditions OC_j. The risk indicator adopted in the present paper is the expected value of the impact for the analysed contingencies, accounting for threats and component vulnerabilities. Term “operating condition” incorporates both strictly operational conditions, i.e., load pattern, generation dispatch and grid topology, and more general environmental conditions, e.g., ambient temperature, wind speed.

Anyway, risk can be associated to:

(1)

A specific contingency, evaluated as dangerous in the specific OC subject to the given threat: contingency risk indicators help operators identify events with the highest risk (to plan suitable countermeasures);

(2)

The operating condition and the set of dangerous contingencies: global indicators assess how system risk varies under changing threats.

The risk indicator related to a specific contingency ctg—henceforth named Contingency Risk CR_ctg—is given in (3):

$$C{R}_{ctg}=im{p}_{Th{r}_p}^{O{C}_j}\left(ctg\right)\times pro{b}_{Th{r}_p}^{O{C}_j}\left(ctg\right)$$

(3)

where $im{p}_{Th{r}_p}^{O{C}_j}\left(ctg\right)$ and $pro{b}_{Th{r}_p}^{O{C}_j}\left(ctg\right)$ are respectively the contingency impact and probability depending on operating conditions OC_j and threat Thr_p. The probabilistic threat and vulnerability analysis provides term $pro{b}_{Th{r}_p}^{O{C}_j}\left(ctg\right)$, while the simulation of power system response to contingency ctg by means of the cascading outage simulator and time domain simulation allows to compute term $im{p}_{Th{r}_p}^{O{C}_j}\left(ctg\right)$. In the sequel notation will be simplified substituting $im{p}_{Th{r}_p}^{O{C}_j}\left(ctg\right)$ with $im{p}_{ctg}$ and $pro{b}_{Th{r}_p}^{O{C}_j}\left(ctg\right)$ with $pro{b}_{ctg}$.

The methodology can provide both static and dynamic impact and risk indicators [10].

System risk indicators R are computed as in (4):

$$R={\displaystyle \sum _{ctg=1}^{N_{Th{r}_p}^{O{C}_j}}pro{b}_{ctg}\times im{p}_{ctg}}$$

(4)

where $N_{Th{r}_p}^{O{C}_j}$ is the number of dangerous contingencies selected by the screening algorithm and it depends on specific threat Thr_p and operating conditions OC_j.

Impact indicator imp_ctg used in the present paper is the Loss of Load (LOL) at the end of the cascading path potentially activated by the contingency.

3. Data Sources and Platform Architecture

This section discusses the important topic of data sources for the tuning of short term probabilistic models of weather related threats and it describes the overall architecture of the integrated platform.

3.1. Data Issues for Model Tuning

Characterizing the probabilistic models is one of the main barriers for the application of probabilistic techniques in real world power system operation [30]. Reliable data sources are required for a proper model tuning. In case of short term analyses (operational planning), the geospatial distribution of the stress variables (e.g., the mechanical tension on a conductor due to combined ice+wind load) which characterize each weather threat can be obtained starting from the geospatial distribution of the weather variables (temperature, wind speed, precipitation rate, etc.) by means of causal physical models (e.g., the Makkonen model for snow sleeve accretion, briefly described in Section 4). The abovementioned weather variables are subject to forecast uncertainties, thus they must be treated as stochastic variables.

On the basis of the way these weather variable geospatial distributions are generated, the platform allows to characterize the threat probabilistic models via two modes:

• An engineering mode, where a standard geo-spatial model of the weather variables is expressed via an analytical function characterized with few parameters which define the intensity and the extension of the stress itself (e.g., wind peaks, maximum precipitation rates, etc.) and which are subject to uncertainties. The final geospatial distribution of the stochastic stress variables is determined by applying the uncertain parameters to the abovementioned standard model. More details on the standard threat geospatial models adopted in engineering mode can be found in [10];
• An operational planning mode, where the weather variable geospatial distributions aimed to characterize the threat come from a weather forecasting system available at TSO’s control center.

In the operational planning mode, the platform integrates the k hour-ahead forecasts provided by numerical weather prediction systems to get an affordable probabilistic model for weather based threats (in particular, wet snow events which represent a major source of outages in specific zones of the Italian grid). In this mode the input data for the combined threat and contingency analysis platform define the so called threat/power system scenario and consist in:

• The data characterizing the threat:

  ○

  Forecasts of weather, influencing factors on a geo-localized basis; in particular for the analysis of wet snow events, the following quantities are forecasted: Ambient temperature in °C, Precipitation rate in mm/h, wind speed and direction respectively in m/s and meteorological degrees.

• The data characterizing the power system:

  ○

  The forecasts of renewable generation production and of load consumptions;

  ○

  Grid configuration concerning the transmission assets and grid topology. Components are characterized by electrical and, where relevant, mechanical properties;

  ○

  Operating condition of the system (including conventional generators dispatch, etc.).

For the sake of conciseness and clarity, the present paper will focus on the wet snow threat. The weather variables coming from two different high resolution NWP models, the WRF-ARW and RAMS dynamic cores [8], constitute the input for wet snow hazard model. The simulations are done on two nested grids (d01, d02, see Figure 2a) at a horizontal resolution of 0.125° (about 15 km) for the coarse domain (d01) and of 0.04° (about 5 km) for the finest grid (d02). The global model ECMWF provides the initial and boundary conditions for the simulation. Presently, the output of both weather models are used separately, but in the future the output will build up an outperforming Multi-Model Ensemble.

Wet snow condition has been identified when air temperature is in the range between −2 °C and +2 °C and, at the same time, the Snow Ratio of frozen precipitation is between 0.7 and 0.8, i.e., the Liquid Water Content of snowflakes is 20–30%.

The predictive system is based on several years of research activity and it is the core part of an alert system for wet snow formation on Overhead Lines (OHLs) in Italy. The system, named Wet snow Overload aLert and Forecasting (WOLF) [8], is aimed to provide the wet snow loads forecast and the estimated anti-icing current for OHLs in the forecast horizon of +72 h. Figure 2b shows an example of WRF-ARW simulation related to the accumulated daily precipitation (mm/24 h) for the wet snow event occurred in February 2015 in the North of Italy.

3.2. An Overview of the Platform

Figure 3 depicts the workflow of the tool for risk assessment: each module is identified via a specific letter put into brackets.

In the modules of scenario generator (top part of the diagram) the threat and power system component vulnerability are probabilistically modelled, evaluating the component failure probability [10]. The data for short term probabilistic models for weather related threats may come from the user (engineering mode) or from a numerical prediction system (operational planning mode), as explained in Section 3.1.

The cumulative sum screening method is run in module C: this allows to select the critical components (i.e., the ones which represent the largest fraction of explained total failure probability).

Then the enumeration technique is run still in module C in order to generate an exhaustive set of single and multiple also dependent contingencies, screened using fast algorithms. The response of power system to the retained contingencies is simulated by means of the time domain simulator and/or the cascading outage simulator in module R. Also influencing factors like forecast uncertainties on loads and renewables and uncertain response of defence/control systems are accounted for.

The impact of each contingency is assessed in module I, and risk indicators are computed by combining probability and impact in module RI. The final outcome consists in risk indicators to rank contingencies and track overall system security.

4. Wet Snow Threat Modeling

This section presents the probabilistic model of the wet snow threat, considering the physics of wet snow accretion. The wet snow affects OHLs via two stress variables:

• The mechanical tension on the conductor section, due to the overall load including the wind load and the ice load produced by wet snow processes;
• The surface conductivity of the insulator chains, which depends on the accumulation of wet snow and on the conductivity of the water content of the snow.

Thus, two separate threat probabilistic models are elaborated to account for the two phenomena. The relationship between the wet snow events and the surface conductivity on the insulators is being investigated in literature [31]. However, in the study case of the present paper, the conductivity of the wet snow accretion on insulators in the area under investigation is negligible, thus the flashover model due to wet snow accretion is not considered henceforth.

4.1. The Physics of Wet Snow Accretion

The most well-known temperature interval for wet snow conditions is −2 °C/+2 °C, also from the verification of many observations in different countries. In this range of temperature layer, the snowflakes can partially melt and their typical Liquid Water Content (LWC) varies from 20% to 30% of the total mass. In this situation the snowflakes deposit on the conductor and join together not only due to collision mechanism, but also due to the strong coalescence caused by the presence of LWC in the snowflakes which favors the growth of typically cylindrical sleeves around the wire (see in Figure 4).

Wet snow events typically last for 18–24 h, generating snow sleeves up to 15 cm in diameter and causing an extra load on conductors up to 8–10 kg/m. The overload can produce severe damages to OHLs. Sometimes the conductor undergoes an extra load due to the intense wind blowing after the accretion process.

4.2. Threat Forecast Modeling

The model implemented in the platform [10] to forecast the stress variables (i.e., the mechanical loads due to ice and wind) accounts for four main measurements concerning the wind speed intensity and direction, the ambient temperature and the precipitation rate.

All the models for wet snow accretion rest on Equation (5), which models the accretion of snow mass M described in the ISO standard [32] for icing of structures:

$$\frac{dM}{dt}={\alpha }_1{\alpha }_2{\alpha }_3\times w\times A\times V$$

(5)

where α₁ is the collision efficiency; α₂ is the sticking efficiency, and α₃ is the accretion efficiency; w is water content (kg/m³); A is the cross-sectional area (m²) perpendicular to object; V is the particle impact speed perpendicular to object (m/s).

For the wet snow precipitation, term w × A may be approximated by the precipitation flux. The terminal vertical velocity of snowflakes V_s is assumed to be 1.5 m/s, obtained by three-year measurements of a disdrometer during wet snowfall events at the icing station on the Italian Alps (WILD) 8. Sticking efficiency α₂ may be inferred from some field observations. In particular, α₂ depends on the liquid water content of snowflakes and the impact speed. The density of the snow sleeve ρ_s depends on wind intensity W because higher snowflake impact speeds tend to produce a more compact snow deposit.

Moreover the model assumes a cylindrical wet snow accretion on conductor without sleeve shedding phenomena (conservative accretion).

The empirical parameters have been deduced from measurements of icing station collected over the past three winters. The assumptions and the value ranges for the most important parameters used in the model are reported below:

• Wet snow condition if air temperature is in the range of −2.0 to +2 °C;
• SR (Snow Ratio) of frozen precipitation in the range 0.7–0.8;
• Sticking coefficient α₂ = 1/W^1/3 if 1 m/s < W < 10 m/s; 0.1 if W > = 10 m/s; 1 if W ≤ 1 m/s;
• Admirat approach [31] suggests the following model for density of snow sleeve: ρ_s = 300 + 20 W; ρ_s = 500 kg/m³ if W > 10 m/s;
• Vertical velocity of snowflakes V_s = 1.5 m/s.

For dry-snow condition, when the temperature is lower than −2.0 °C or the SR > 0.8, the snow accretion is limited by empirical coefficient α₂ = 0.1 and ρ_s = 100 kg/m³. The angle θ is equal to 90° to consider the worst conditions of accretion. More details can be found in [9].

4.3. Modeling the Line Vulnerability

The vulnerability probabilistic model implemented for the OHLs in case of wet snow includes the vulnerability of:

(1)

the phase conductors and the shielding wires which are affected by the mechanical tension due to the combined ice-wind load;

(2)

the tower equipment (insulator chains, and bracings) subject to the combined force due to wind and ice loads.

As for item (1), a mechanical fragility curve is evaluated for each phase conductor P_{mech_conductor} and shielding wire P_{mech_shieldwire} consisting in a lognormal distribution of mechanical tension with a mean value equal to the expected tensile strength in kN for the conductor (e.g., 170 kN for phases in case of a 31.5 mm Aluminium Conductor Steel Reinforced (ACSR) conductors and a standard deviation equal to 2% of the expected value.

The mechanical failure probability of a single span of the line consists in (6):

$$\begin{array}{l}{P}_{mech\_span}=1-{\left(1-P_{mech\_phase}\right)}^{N_{phases}}\times {\left(1-P_{mech\_shieldwire}\right)}^{N_{shield\_wires}}\\ P_{mech\_phase}=1-{\left(1-P_{mech\_conductor}\right)}^{N_{conductors\_per\_phase}}\end{array}$$

(6)

where N_phases and N_{shield_wires} are respectively the number of phases (3 or 6 for a double circuit with common towers) and of shielding wires per span, and N_{conductors_per_phase} is the number of conductors for each phase (typically from 1 to 3).

As for item (2), the vulnerability model of the equipment is composed by the mechanical fragility curve P_{mech_equip} consisting again in the lognormal distribution of the mechanical load, centered on the standard expected breaking strength of the weakest equipment, i.e., the bracings of the tower considering the typical design criteria followed by the TSO.

The mechanical failure probability of the tower due to equipment breakdown is given by (7):

$$P_{mech\_tow\_equip}=1-{\left(1-P_{mech\_equip}\right)}^{Nequip\_pertow}$$

(7)

where N_{equip_pertow} represents the number of equipment per tower.

In the end, the failure probability of a line span P_Fspan is given by (8):

$$P_{Fspan}=1-\left(1-P_{mech\_span}\right)\left(1-P_{mech\_tow\_equip}\right)$$

(8)

The mechanical failure of the towers is neglected because lattice towers are much less vulnerable to ice and wind loads with respect to tower equipment like the bracings.

4.4. Modeling the Countermeasures at Component Level

Different countermeasures are being studied to reduce the wet snow sleeve. In particular, mechanical stabilizers of the conductors aim to avoid or at least to limit the conductor rotation which provokes sleeve accretion; moreover, ice-phobic coatings can delay the formation of the sleeve by reducing the sticking capability of the wet snow on the conductor or favor the sleeve shedding process. Further studies are required to model these countermeasures under a probabilistic point of view.

Presently a rough model of the ice-phobic coatings is provided to demonstrate the potentialities of the combined threat and contingency analysis tool. In particular, one property of the ice-phobic coatings is that they reduce the capability of the wet snow to stick to the conductor. This is modeled by limiting the sticking coefficient to 0.5 also for low wind speeds in the Makkonen model, thus using (9) to compute the sticking coefficient:

$${\alpha }_2=\min (0.5,\raisebox{1ex}{$1$}\!\left/ \!\raisebox{-1ex}{$\sqrt[3]{W}$}\right.)$$

(9)

5. Study Case and Simulations

The study case refers to an emergency scenario due to a severe wet snow event really occurred in the North of Italy in 5–7 February 2015. In fact, the Italian High Voltage (HV) and Extra High Voltage (EHV) grid has been affected by a significant number of wet snow events in the last few years (2015–2017).

The wet snow storm affected both Medium/Low Voltage (MV/LV) distribution and HV/EHV transmission networks, but the focus of the present paper is on the transmission system. The adopted realistic model of the Italian HV (132/150 kV) and EHV (220/400 kV) grid includes 5500 electric nodes, 8000 lines, 800 generators.

The mechanical rated tensile strengths for the conductors are assumed equal to 170 and 100 kN respectively for ACSR conductors with cross-sectional areas of 585 and 308 mm² (typical values for phase conductors respectively for 220/400 kV and 132 kV overhead lines). The shielding wires are steel conductors with a diameter equal to 11.5 mm.

Parameter δ, fraction of total failure probability, adopted for the selection of critical components (see Section 2.4) is set to 0.9, which means that the critical components contribute to the 90% of the total sum of failure probabilities over the whole system. The exploited big data consist in the forecasts of weather variables (ambient temperature, wind speed intensity and direction, precipitation rate) elaborated on 4 February 2015 for the subsequent 72 h (3-day ahead forecast). A total amount of 11,381 geospatial mesh points are considered for each forecast hour (from 1 to 72). The performed simulations and their goals are reported in

Table 2. Summary of simulation scenarios and their goals.

Simulation Scenario	Description	Goal
SC 1	Applying the weather forecast data generated on 4 February 2015 to the 400/220/132 kv grid model	To compare the set of critical branches found by the tool with public information concerning the collapsed HV lines recorded during the events in February 2015
SC 2	Same as scenario 1, except for introducing ice-phobic coatings on critical lines	To quantify the effectiveness of the hydrophobic coatings on the overall operational risk

.

On the basis of public information [33] the wet snow events affected a total equivalent length of 500 km of HV lines in the provinces of Bologna, Parma and Modena, with ice thicknesses up to 150–200 mm [33].

5.1. Validation of the Platform: Scenario SC 1

In scenario SC 1 the geospatial data of weather forecasts are applied to the grid model thus obtaining the resulting geospatial distributions of the stress variables of interest, i.e., the mechanical tension on the phase conductors and the mechanical load on tower equipment, for each hour belonging to the 72 h forecasting period. By combining these stress variable distributions with the vulnerability curves of the components, the set of critical components can be identified for each forecast hour. Figure 5 shows the expected values of the mechanical tension, the sleeve thickness and the load on tower equipment for the first 10 h of forecast, with focus on the OHL spans with the highest values of stress variables over the first 10 h in the area subject to the wet snow event.

It can be noticed that after just 10 h the ice sleeve reaches around 100 mm thicknesses, causing a mechanical tension on some OHLs approaching 100 kN which is the rated tensile strength of 132 kV OHLs. The comparison of simulations against the available information on recorded line outages during the event confirms the good performance of the tool, as the first line outages affected the 132 kV network at hour 12, thus close to hour 10. By comparing the results over the whole 72 h with the available data it’s worth noticing that:

-

There is a good match between the maximum ice sleeve thickness recorded in the event (150–200 mm) and the ice thickness forecasted by the tool;

-

There is also a good match between the portion of the grid with the largest number of collapsed lines (areas of Parma, Modena, Bologna) and the localization of the lines in

Table 3. List of critical branches with their failure probabilities for hours 8, 10 15 and 28 in the forecast period.

Hour Ahead	Branch ID	Failure Probability
8	POTF411-VEGF411	1.221 × 10−15
10	POTF411-VEGF411	0.868
	POTF411-PTAF411	0.308
15	POTF411-VEGF411	>0.9
	BRBF41a-FZAF411	>0.9
	POTF411-PTAF411	>0.9
	SASF411-SVKF411	>0.9
	MZBF411-SASF411	0.865
	MZAF411-SASF411	0.815
28	BORF411-RTTF411	>0.9
	BORF411-SFAF411	>0.9
	CAEF411-SDMF412	>0.9
	CASF411-LPPF411	>0.9
	CIRF411-TREF411	>0.9
	FIOF411-LGNF411	>0.9
	MONF411-GRZF411	>0.9
	MOVF411-MRTF412	>0.9
	MOVF411-VIGF411	>0.9
	MRTF412-SDMF412	>0.9
	MZAF411-SASF411	>0.9
	MZBF411-SASF411	>0.9
	PCWF411-RTTF411	>0.9
	PVLF411-SSLF411	>0.9
	SASF411-SVKF411	>0.9
	SDMF412-SLAF411	>0.9
	SLAF411-SOGF411	>0.9
	FIOF411-MONF411	>0.9
	LPPF411-ROAF411	>0.9
	MOCF411-SDMF412	>0.9
	MOCF411-SDMF412	>0.9
	MONF411-PCEF411	>0.9
	MANF411-MUKF411	>0.9
	CASF411-CSGF411	>0.9
	FARF411-ROAF411	0.886
	FIDF411-FIOF411	0.815

which reports the list of the critical lines (i.e., the ones which most contribute to the total failure probability) with their failure probabilities at hours 8, 10, 15 and 28. The choice of a 28-h interval is justified by the fact that the majority of the line outages took place between hour 32 and hour 35 (on 6 February): using an interval of 28 h (just before hour 32) allows to test the prediction capability of the tool with respect to the actual outages recorded during the event.

In the first hours (8 and 10) the lines with the highest failure probabilities are in the rural area south of Bologna city. In hour 15 the affected lines still south of Bologna get closer to the city. The persistence of adverse weather conditions determine a large sleeve thickness on the conductor and values of tension close to the rated tensile strength around hours 30–40, which is confirmed by the records during Emilia Romagna events. In fact, during the event under study, after hour 35 (6 February) several 132 kV lines connected to substations in the provinces of Bologna, Parma and Modena suffered from mechanical damage with a repair time higher than 3 h. The list of critical lines for hour 28 confirms that the lines with very high failure probabilities are located in the area of Parma (substations FARF and FIOF) and between Modena and Bologna (substations MOVF, SDMF, MRTF and VIGF in Table 3). Figure 6 shows the geographical visualization of the set of critical lines respectively at hour 15 (in Figure 6a) and 28 (in Figure 6b).

Other causes of line damages, such as the fall of trees on conductors, reported in public sources [33], and possible contacts among phases or small clearance between the phases and the ground due to sleeve loads, are not currently modeled inside the tool and will be considered in future activities.

On the basis of the lists of critical components at hour 15 in Table 3 the power system tool described in [10] and [26] elaborates a set of 71 single and multiple contingencies which most contribute to the total risk of operating the system under such an extreme event. This set includes 6 “N−1” branch outages, 15 “N−2”, 20 “N−3”, 15 “N−4”, 6 “N−5” and 1 “N−6” common mode multiple branch contingencies, and 8 (multiple dependent) busbar contingencies.

Table 4. Top 10 positions in the risk ranked list of contingencies—hour 15.

CTG ID	LOL RISK	LOL, MW	Probability
N-6_Ln_FF48031_Ln_FF47575_Ln_FF4782_Ln_FF47833_Ln_FF4132_Ln_FF47653	6.4946	34.8	0.18663
N-5_Ln_FF48031_Ln_FF4782_Ln_FF47833_Ln_FF4132_Ln_FF47653	1.2652	12.7	0.099623
N-4_Ln_FF48031_Ln_FF47833_Ln_FF4132_Ln_FF47653	1.1637	12.7	0.091634
N-3_Ln_FF48031_Ln_FF47833_Ln_FF4132	1.1311	12.7	0.089062
N-5_Ln_FF48031_Ln_FF47575_Ln_FF47833_Ln_FF4132_Ln_FF47653	0.98048	12.7	0.077203
N-4_Ln_FF48031_Ln_FF4782_Ln_FF47833_Ln_FF4132	0.61209	12.7	0.048196
N-2_Ln_FF47833_Ln_FF4132	0.59212	12.7	0.046624
N-4_Ln_FF48031_Ln_FF47575_Ln_FF47833_Ln_FF4132	0.49269	12.7	0.038795
N-5_Ln_FF48031_Ln_FF47575_Ln_FF4782_Ln_FF47833_Ln_FF4132	0.45917	12.7	0.036155
N-5_Ln_FF48031_Ln_FF47575_Ln_FF4782_Ln_FF4132_Ln_FF47653	0.41043	22.1	0.018571

and

Table 5. Top 10 positions in the probability ranked list of contingencies —hour 15.

CTG ID	LOL RISK	LOL, MW	Probability
N-6_Ln_FF48031_Ln_FF47575_Ln_FF4782_Ln_FF47833_Ln_FF4132_Ln_FF47653	6.4946	34.8	0.18663
N-1_POTF411_VEGF411	0	0	0.15626
N-1_BRBF41a_FZAF411	0	0	0.11443
N-2_Ln_FF48031_Ln_FF4132	0	0	0.11352
N-5_Ln_FF48031_Ln_FF4782_Ln_FF47833_Ln_FF4132_Ln_FF47653	1.2652	12.7	0.099623
N-4_Ln_FF48031_Ln_FF47833_Ln_FF4132_Ln_FF47653	1.1637	12.7	0.091634
N-3_Ln_FF48031_Ln_FF47833_Ln_FF4132	1.1311	12.7	0.089062
N-5_Ln_FF48031_Ln_FF47575_Ln_FF47833_Ln_FF4132_Ln_FF47653	0.98048	12.7	0.077203
N-3_Ln_FF48031_Ln_FF4132_Ln_FF47653	0	0	0.055553
N-1_POTF411_PTAF411	0	0	0.053815

report respectively the list of the ten most probable and the most risky contingencies with their probability of occurrence. It’s worth noticing that all the most risky contingencies and seven out of the ten most probable outages are N-k common mode contingencies (indicated with label “N−k” with k > 1): in fact, under extreme weather conditions multiple outages are more probable than single outages and contribute to the majority of the loss of load risk, which clearly highlights the limits of a conventional contingency analysis based on N−1 criterion.

Figure 7 reports the loss of load risk indicators for the set of contingencies with an indication of the total risk of loss of load at hour 15 (equal to 14.6 expected lost MW).

5.2. A “What If” Scenario: Effect of Ice-Phobic Coatings

In scenario SC 2 the same forecast variables are applied to a grid model where the asset data related to OHLs have been modified by considering the ice-phobic coatings on all the critical lines.

The analysis detects only one critical line (POTF-VEGF 132 kV line) which is already in the set of critical lines in scenario SC 1. Its failure probability is drastically reduced from >0.9 to 4.66 × 10⁻². The relevant set of risky contingencies is limited to three contingencies, consisting in 1 “N−1” line contingency, two “N−k” busbar dependent contingencies affecting 132 kV substations POTF and VEGF. After running the quasi static cascading outage simulator on the contingency set, it can be noticed that the use of ice-phobic coatings determines a substantial reduction of the total loss of load risk which passes from 14.6 expected lost MW’s in SC 1 to 5.3 × 10⁻⁵ expected lost MW’s in SC 2.

6. Conclusions

The paper has introduced an extended risk concept, a general approach for probabilistic risk based security assessment and a tool adequate for operation and operational planning contexts. The proposed holistic approach can adjust the set of single and multiple (also common mode and dependent) contingencies to be studied in security assessment sessions, on the basis of short term evolution of the actual threats, and it can rank the contingencies by means of risk indexes. In particular, the paper has focused on the integration of the risk-based security assessment tool with a weather forecasting system which provides 3-day ahead forecasts of weather variables characterizing the threats. The wet snow threat model is used to demonstrate the capability of the proposed tool: the integrated risk-based tool is thus applied to a real wet snow threat scenario occurred in February 2015 in the North of Italy. The simulations performed on a realistic model of the HV Italian grid confirm the effectiveness of the tool in forecasting critical conditions which occurred according to the historical records of line collapses during specific wet snow events. The mismatches between the real event recordings and the critical lines identified of the platform can be due to the fact that some of the outages were not provoked by snow sleeves but by other causes (e.g., fall of trees, contacts among phases or to the ground) currently not modelled in the platform.

The tool can bring different potential benefits to the TSOs. In fact, the selection of contingencies as a function of the environmental/weather threats, forecasted via available numerical prediction systems, permits operators to select the most risky disruption scenarios in the forecast period (up to few hours), and to prepare suitable preventive/corrective actions to cope with them, in case these scenarios really occur. Furthermore, the methodology represents a step forward with respect to conventional N−1 security assessment: first, the proposed contingency selection criterion, based on a risk concept, complements the N−1 credibility criterion including also multiple common mode and dependent events, potentially leading to large load disruptions. Secondly, the two-stage contingency screening process is able to select the subset of most significant multiple contingencies, which permits to reduce the computational burden in an operation context.

Besides predicting risky situations, the platform can also evaluate the benefits brought by potential countermeasures. Next steps will consist in a finer tuning of the vulnerability models of the grid components and the simulation of further indirect effects of weather threats (e.g., fall of trees).