Research Article

Small vulnerable sets determine large network cascades in power grids

See allHide authors and affiliations

Science  17 Nov 2017:
Vol. 358, Issue 6365, eaan3184
DOI: 10.1126/science.aan3184

The domino effect in power failure

Sometimes a power failure can be fairly local, but other times, a seemingly identical initial failure can cascade to cause a massive and costly breakdown in the system. Yang et al. built a model for the North American power grid network based on samples of data covering the years 2008 to 2013 (see the Perspective by D'Souza). Although the observed cascades were widespread, a small fraction of all network components, particularly the ones that were most cohesive within the network, were vulnerable to cascading failures. Larger cascades were associated with concurrent triggering events that were geographically closer to each other and closer to the set of vulnerable components.

Science, this issue p. eaan3184; see also p. 860

Structured Abstract

INTRODUCTION

Cascading failures in power grids are inherently network processes, in which an initially small perturbation leads to a sequence of failures that spread through the connections between system components. An unresolved problem in preventing major blackouts has been to distinguish disturbances that cause large cascades from seemingly identical ones that have only mild effects. Modeling and analyzing such processes are challenging when the system is large and its operating condition varies widely across different years, seasons, and power demand levels.

RATIONALE

Multicondition analysis of cascade vulnerability is needed to answer several key questions: Under what conditions would an initial disturbance remain localized rather than cascade through the network? Which network components are most vulnerable to failures across various conditions? What is the role of the network structure in determining component vulnerability and cascade sizes? To address these questions and differentiate cascading-causing disturbances, we formulated an electrical-circuit network representation of the U.S.–South Canada power grid—a large-scale network with more than 100,000 transmission lines—for a wide range of operating conditions. We simulated cascades in this system by means of a dynamical model that accounts for transmission line failures due to overloads and the resulting power flow reconfigurations.

RESULTS

To quantify cascade vulnerability, we estimated the probability that each transmission line fails in a cascade. Aggregating the results from multiple conditions into a single network representation, we created a systemwide vulnerability map, which exhibits relatively homogeneous geographical distribution of power outages but highly heterogeneous distribution of the underlying overload failures. Topological analysis of the network representation revealed that the transmission lines vulnerable to overload failures tend to occupy the network’s core, characterized by links between highly connected nodes. We found that only a small fraction of the transmission lines in the network (well below 1% on average) are vulnerable under a given condition. When measured in terms of node-to-node distance and geographical distance, individual cascades often propagate far from the triggering failures, but the set of lines vulnerable to these cascades tend to be limited to the region in which the cascades are triggered. Moreover, large cascades are disproportionately more likely to be triggered by initial failures close to the vulnerable set.

CONCLUSION

Our results imply that the same disturbance in a given power grid can lead to disparate outcomes under different conditions—ranging from no damage to a large-scale cascade. The association between large cascades and the triggering failures’ proximity to the vulnerable set indicates that the topological and geographical properties of the vulnerable set is a major factor determining whether the failures spread widely. Because the vulnerable set is small, failures would often repeat on the same lines in the absence of interventions. Although the power grid represents a complex system in which changes can have unanticipated effects, our analysis suggests failure-based allocation of resources as a strategy in upgrading the system for improved resilience against large cascades.

Cascade-resistant portion of the U.S.–South Canada power grid.

The network is visualized on a cartogram that equalizes the density of nodes. (Top) Power lines that never underwent outage in our simulations under any grid condition are shown in green, whereas all the other lines—whose vulnerability varies widely—are in gray. (Bottom) Spreading of a cascade triggered by three failures at time t = 0 (arrows), which resulted in 254 failures at t = 100 (the end of the cascade in linearly rescaled time).

Abstract

The understanding of cascading failures in complex systems has been hindered by the lack of realistic large-scale modeling and analysis that can account for variable system conditions. Using the North American power grid, we identified, quantified, and analyzed the set of network components that are vulnerable to cascading failures under any out of multiple conditions. We show that the vulnerable set consists of a small but topologically central portion of the network and that large cascades are disproportionately more likely to be triggered by initial failures close to this set. These results elucidate aspects of the origins and causes of cascading failures relevant for grid design and operation and demonstrate vulnerability analysis methods that are applicable to a wider class of cascade-prone networks.

Cascading failures are inherently large-scale network processes that cannot be satisfactorily understood from a local or small-scale perspective. In blackouts caused by cascading failures in the power grid, a relatively small local disturbance triggers a sequence of grid component failures, causing potentially large portions of the network to become inactive, with costly outcomes. In the North American power grid (1), for instance, a single widespread power outage can inflict tens of billions of dollars in losses (2), and smaller but more frequent outages can amount to a yearly combined impact comparable with that of the largest blackouts (3). Yet, not much is known about what distinguishes disturbances that cause cascades from seemingly identical ones that do not. Despite the substantial advances made through conceptual modeling of general cascades (410) and physics-based modeling of power-grid–specific cascades (1114), a major obstacle still remains: the lack of realistic large-scale models and a framework for analyzing cascade vulnerability under variable system conditions. Developing such a framework is challenging for three reasons: (i) Detailed data combining both structural and dynamical parameters are scarce, (ii) the system condition varies on a wide range of time scales, and (iii) computational resources required for modeling grow combinatorially with system size (15). These challenges have limited the applicability of most previous studies to vulnerability under a single condition and either to smaller scales than those required to describe large cascades or to models that are not constrained by real data. Similar hurdles exist in studying large-scale failures in the broader context of complex networks (1618), including extinction cascades in ecological systems (1921) and contagion dynamics in financial systems (22, 23).

Here, we focus on the U.S.–South Canada power grid, which is the largest contiguous power grid amenable to modeling. This system is composed of three interconnections (Texas, Western, and Eastern) (Fig. 1A), which are separate networks of alternating current generators and power consumers connected by transmission lines (network components are illustrated in Fig. 1B). To study this system, we used the data reported in the Federal Energy Regulatory Commission (FERC) Form 715. For each interconnection, the data represent various snapshots of the system, spanning the years 2008 to 2013 and covering multiple seasons as well as both on- and off-peak demand levels, which correspond to different operating conditions. Basic properties of the 46 snapshots we used are listed in table S1. A representation of each snapshot was constructed by processing the parameters of individual power-grid components, including power generation and demand as well as the capacity of transmission lines. Central to the analysis of cascade vulnerability in this system is that our approach distinguishes (i) transmission lines (or simply lines) that have become out of service and do not carry flow because of protective relay actions, equipment malfunctions, operational errors, or physical damages (“primary failures”); and (ii) lines that do not carry flow at the end of the cascades because they are de-electrified owing to the outage of other lines (“secondary failures”).

Fig. 1 The U.S.–South Canada power transmission network.

(A) System map showing the Texas, Western, and Eastern interconnections, as well as the eight NERC regions (acronyms are defined in table S2). (B) Schematic diagram of a portion of a transmission network. The vertical lines and pink circles represent buses and nodes, respectively. As indicated by the blue arrows, power injected by the generators flows through this network of transmission lines and is eventually consumed at other points (where the thickness of the arrow represents the amount of power flow).

Geographic layout of vulnerabilities

The vulnerability of a given transmission line ℓ can be quantified by the probability p that the line fails in a cascade event triggered by a random perturbation to a given snapshot of a given interconnection. To estimate p, we used a cascade dynamics model that combines key elements from previous models (12, 24, 25) to suitably account for the physics of cascading failures. In this model, the initial state of the system for the given snapshot is determined by computing the power flow over all transmission lines and transformers from the power flow equation (supplementary materials, materials and methods). The triggering perturbation was implemented through the removal of a set of nt lines, representing line outages due to unforeseen events, such as damage to power lines caused by extreme weather and unplanned line shutdowns caused by operational errors. After this initial removal, a cascade event was modeled as an iterative process, with each step consisting of a single power line outage due to overheating (primary failure), followed by the redistribution of power flow in the network to compensate for the lost flow over the failed line. Line overheating was modeled with a temperature evolution equation (12), and flow redistribution was determined by solving the power flow equation again; if a primary line failure disconnects the network into multiple parts with unbalanced supply and demand, the power generation and consumption in each part are adjusted (similarly to how generation reserves and power shedding are used in grid operation) to allow for the subsequent power flow calculation. The failure probability p was estimated from K such simulated cascade events, including those with no subsequent failures. Further details on the triggering perturbations and cascade dynamics model can be found in the supplementary materials, materials and methods.

We validated the model against historical line outage data available from the Bonneville Power Administration (BPA) with respect to the distribution of cascade sizes measured by the number of (primary) line failures Nf (supplementary materials, materials and methods, and fig. S1A). We also validated the extremal cascade size measured by Nf and power shed Ps (defined as the reduction in the amount of power delivered to the consumers) against the BPA data and grid disturbance data from the North American Electric Reliability Corporation (NERC), respectively (supplementary materials, materials and methods, and fig. S1, B and C). All simulations were performed with nt = 3 because the cascade size distribution for a given snapshot did not differ appreciably for other choices of nt (fig. S2). However, the distribution exhibited considerable variation across different snapshots, both when cascade size was measured by the power shed Ps (fig. S3) and when measured by the number of line failures Nf (fig. S4).

To aggregate results over different snapshots, we used a node to represent the set of all buses associated with the same geographic location across all snapshots in our data set, where the term “bus” refers to a connection point between components of a power grid, such as transmission lines, transformers, and generators (Fig. 1B). This definition of a node typically corresponds to a substation and can include generators at a nearby power plant and/or an electrical load representing local power consumption. We used a link between a pair of nodes to represent the set of all (parallel) transmission lines directly connecting the same pair of nodes in at least one snapshot, where each of these transmission lines connects two different buses (one from each node in the pair). In this network, the aggregated vulnerability Embedded Image of a link l, which we refer to as the a-vulnerability, is a weighted average of the failure probabilities over the lines represented by the link l and over the various snapshots and can be expressed asEmbedded Image(1)where c indexes the different snapshot conditions simulated, and the sum over ℓ is limited to the set of transmission lines defining the link for the given c. Here, pℓ;c is the probability of line failure in the simulated perturbations of the system (the values of K we used are given in table S1 and justified in fig. S5), and wc represents the weight assigned to each snapshot (table S1). In our analyses, we present the a-vulnerability separately for primary failures (denoted by Embedded Image), secondary failures (denoted by Embedded Image), and the combination of both primary and secondary failures (denoted by Embedded Image itself).

We constructed the a-vulnerability map of the U.S.–South Canada power grid (shown in Fig. 2, A to C, for a portion of the grid). Over the entire network, we found that only 10.8% of all links ever underwent a primary failure in our simulations and that secondary failures were on average 3.77 times more prevalent than primary ones (table S3). We also found that a-vulnerability was very unevenly distributed among the links, with 20% of the failing links (which in the case of primary failures correspond to only 2.16% of all links) accounting for about 85, 66, and 69% of the primary failures, secondary failures, and combined set of all failures, respectively (Fig. 2, D to F). Also uneven was the geographical distribution of links with nonzero a-vulnerability (Fig. 2, A to C), whose density was correlated positively with population density. This correlation was mainly due to the bias toward higher density of links in more densely populated areas because it disappeared when a-vulnerability was averaged over the links in each geographical area to control for this bias. However, substantial geographical heterogeneity still remained for the averaged a-vulnerability, ranging over several orders of magnitude when calculated for individual U.S. counties. These observations were validated with the U.S. county population data from the 2010 census and the geographic coordinates of county boundaries (fig. S6). Among the 48 states and the District of Columbia represented in the U.S. portion of the network, the three least vulnerable ones were West Virginia (average Embedded Image), Tennessee (average Embedded Image), and Mississippi (average Embedded Image), all in the middle third of the population density ranking. However, some states among the least vulnerable did have relatively high or low population density, such as Illinois and Nebraska, which ranked 13th and 43rd in population density while having the 5th and 6th lowest a-vulnerability, respectively. The heterogeneity of a-vulnerability is visualized in Fig. 3A, with a map representation that equalizes the density of nodes. The breakdown of this representation into primary and secondary failures, presented in Fig. 3, B and C, shows that a-vulnerability to primary failures was more heterogeneously distributed than a-vulnerability to secondary failures. Over all pixels with nonzero a-vulnerability, the standard deviation of Embedded Image was 0.48 (89.2%), of Embedded Image was 0.58 (57.5%), and of Embedded Image was 0.41 (87.0%), where the number in parentheses represents the fraction of such pixels. The homogeneity in the distribution of secondary failures, which were several times more numerous than primary failures, underlies the relatively homogeneous aggregated distribution of the resulting power outages observed in Fig. 3A.

Fig. 2 Vulnerability map of the U.S.–South Canada power grid.

(A) Averaged failure probability of transmission lines, including primary and secondary failures, expressed as the total a-vulnerability of links Embedded Image. Because the structure of the power grid varies slightly from one snapshot to another, we visualize the a-vulnerability using a single network constructed to represent all snapshots of each interconnection by regarding the set of all buses at a given geographical location as a node and all transmission lines connecting two nodes as a single link. Each link is color-coded by the failure probability Embedded Image estimated as a weighted average over all lines in all snapshots, where gray indicates links whose estimated probability is zero. (B and C) Same as in (A), but color-coded separately for (B) the a-vulnerability to primary failures Embedded Image and (C) the a-vulnerability to secondary failures Embedded Image. (A), (B), and (C) correspond to the same unidentified portion of the U.S.–South Canada map. (D) Histogram of the a-vulnerability Embedded Image and the curve for f(p) := Σ′pll pl, where Σ′ denotes the sum over all links l satisfying plp. The function f(p) thus represents the fraction of all failures that are associated with links of a-vulnerability p or larger. (E and F) Same as in (D), but with Embedded Image replaced by Embedded Image and Embedded Image, respectively. In (D), (E), and (F), the vertical and horizontal dashed lines indicate, respectively, the minimum a-vulnerability p* among the most vulnerable 20% of all failing links and the fraction f(p*) of failures accounted for by these links.

Fig. 3 Vulnerability of the power grid on a density-equalizing map.

(A) Each pixel is color-coded by the average a-vulnerability Embedded Image, including both primary and secondary failures, over all links connected to nodes in the area of the pixel. The cartogram was generated by using the diffusion-based method in (41) to equalize the density of nodes (supplementary materials, materials and methods) and is limited to the U.S. portion of the network. Color gray marks the pixels with zero average a-vulnerability. (B and C) Same as in (A) but color-coded separately for (B) the average a-vulnerability to primary failures Embedded Image and (C) the average a-vulnerability to secondary failures Embedded Image.

Network characterization of vulnerabilites

Our characterization of a-vulnerability allows us to study how the observed cascade dynamics depend on the network structure and to identify the topological centrality of individual links as a determinant. Topological centrality can be quantified through the concept of k-core (2629), which is defined as the largest subnetwork in which every node has at least k links (that is, it has degree k). The k-core of a given network can be obtained by recursively removing all nodes with degree <k until all nodes in the remaining network have degree ≥k. Repeating this for k = 1, 2, ... determines the k-core decomposition of the network. The coreness of a node is then defined as the (unique) integer c for which this node belongs to the c-core but not to the (c + 1)–core (30). We further extend this concept to links by defining a link’s coreness to be the smaller coreness of the two nodes it connects. A network visualization based on this decomposition is illustrated in Fig. 4A.

Fig. 4 Characterization of vulnerability through k-core decomposition.

(A) Coreness-based network visualization, where nodes with higher coreness are placed closer to the center. (B) Visualization of the k-core decomposition of the Eastern interconnection, showing (left) all the links in the network, (middle) only the links with nonzero a-vulnerability to primary failures (Embedded Image), and (right) only the links with nonzero a-vulnerability to secondary failures (Embedded Image). The bars underneath show the distribution of link coreness, color-coded as in (A). (C) Fraction of links with Embedded Image among all links of a given coreness. (D) Average of Embedded Image over all links of a given coreness with Embedded Image. (E and F) Counterparts of (C) and (D), respectively, for secondary failures.

When this network decomposition was applied to the entire topology of the U.S.–South Canada power system, we found that links of coreness 2 were dominant in all three interconnections (with 81, 67, and 82% of all links in the Texas, Western, and Eastern networks, respectively). This dominance of coreness 2 links was also observed for the cascade-prone portion of the network and was further verified separately for the set of links vulnerable to primary failures Embedded Image as well as the set of links vulnerable to secondary failures Embedded Image. These results are visualized in Fig. 4B for the case of the Eastern interconnection.

Upon closer inspection, however, the vulnerability revealed a strong correlation with link coreness beyond what can be inferred from the availability of links of a given coreness in the network. For primary failures, almost all links of coreness 1 showed zero a-vulnerability in our simulations, whereas 7 to 19% of higher coreness links were vulnerable (Fig. 4C). The links of coreness 1 are rarely vulnerable because each belongs to a tree subnetwork connected to the rest of the network through a single node, and this protects the link from flow rerouting, which is responsible for most primary failures (for example, flow rerouting accounts for more than 98% of primary failures in the 2010 spring peak snapshot of the Texas network, as shown in the supplementary materials, materials and methods). Among the links that were vulnerable, the level of a-vulnerability increased monotonically with their coreness (Fig. 4D). This is probably because there are more flow paths (from power generators to consumers) that are parallel to a link of higher coreness in general, making the link more likely to be affected by flow rerouted from a failure in these paths.

For secondary failures, the fraction of links that were vulnerable and the a-vulnerability levels of these links followed opposite trends. The decrease in the fraction of vulnerable links shown in Fig. 4E can be understood by noting that a link can experience a secondary failure only if all available flow paths passing through that link are disabled by primary failures. Because links of higher coreness generally have more such paths, they were less likely to fail through this mechanism. Among the vulnerable links, the increase of the average a-vulnerability with coreness shown in Fig. 4F likely arose from the organization of the nodes in each k-core into graph components (maximal subsets of nodes in which every node pair is connected by a network path). Whereas the 2-core formed a single graph component in all three interconnections, the nodes in the 3-core were organized into multiple graph components (3, 11, and 52 components for the Texas, the Western, and the Eastern network, respectively), which were connected sparsely with each other by coreness 2 links. Because of this structure, most secondary failures on links of coreness ≥3 were likely caused by primary failures on the surrounding links of coreness 2 that disconnected a 3-core graph component with no internal power generation from the other 3-core components. This would make the links in these components prone to repetitively undergo secondary failures together. This tendency of co-occurring failures (31) among vulnerable links would lead to higher a-vulnerability for those links than for links with lower coreness.

Relating triggers and network states to vulnerable lines

To characterize the lines at risk of primary failures, we now shift our attention back to individual transmission lines connecting buses in each snapshot, rather than their collective representation as links. For this purpose, we define a “vulnerable” transmission line for a given snapshot to be a line ℓ for which Embedded Image, with at least 95% Wilson’s confidence level (32) (which excludes any line with a single failure in 1000 simulated events). This approach for vulnerability analysis is in contrast to previous studies on identifying the line failure combinations that initiate large cascading failures (25, 33). We then define the vulnerable set Embedded Image to be the set of all vulnerable lines for the given snapshot. We found that these vulnerable sets not only represented small portions of the grid in each snapshot but also exhibited considerable overlap across different snapshots (although it was rare for the same line to be vulnerable in all snapshots). These findings are presented in Table 1 for each interconnection using, respectively, the weighted averageEmbedded Image of the number of vulnerable transmission lines over all snapshots and the number Embedded Image of lines that were vulnerable in two or more snapshots (relative to the number expected if the vulnerable sets were randomly distributed with no correlation). For example, in the Texas interconnection, Embedded Image represents only about 0.6% of all the transmission lines, and the relative number of overlapping lines Embedded Image is 2.9 (details on the distribution of Embedded Image for individual snapshots can be found in fig. S7).

Table 1 Subdivisions of the U.S.–South Canada power grid and its vulnerable sets.

The rows represent the regions defined by NERC (Fig. 1A and table S2), within which the simulated cascades are triggered. The columns represent the number of buses, number of transmission lines, and four measures of the vulnerable sets: the number of vulnerable lines Embedded Image, the relative number of lines that are vulnerable in multiple snapshots Embedded Image, and the mean pairwise normalized topological and geographical distances between vulnerable lines, Embedded Image and Embedded Image, respectively. These quantities are averaged over all snapshots (which is indicated by the notation Embedded Image). The normalized distances are defined in the supplementary materials, materials and methods.

View this table:

Having a small portion of the grid vulnerable to cascading failures does not imply that these failures stayed localized even for single snapshots. To quantify the degree to which cascades were localized, we used the concepts of topological distance (the number of links along the shortest paths in the network) and geographical distance (the arc length along the Earth’s surface), both normalized by the size of the triggering region measured by the respective distances and thus are unitless (supplementary materials, materials and methods). Specifically, the extent of the vulnerable set was measured by Embedded Image and Embedded Image, defined as the normalized topological and geographical distance, respectively, between two transmission lines, averaged over all pairs of lines in the vulnerable set. We further defined Embedded Image and Embedded Imageto be the weighted average of Embedded Image and Embedded Image, respectively, over all snapshots. As shown in Table 1, for the Texas and Western networks, both Embedded Image and Embedded Image are comparable with the size of the interconnection, revealing that the spreading of cascades is nonlocal [which is consistent with observations from historical data (34), power flow calculations (35), and abstract models (36, 37)]. In all cases, Embedded Image and Embedded Image hold true in the Eastern interconnection, where cascades were actually triggered in a local region and could have, in principle, spread widely to the other regions within the interconnection, leading to Embedded Image or Embedded Image. This suggests that there is also an aspect of the cascading failures that is local: The propagation of failures in general does not extend too far from the region being perturbed.

The analysis of vulnerable sets provides relevant insights not only into the origins of cascading failures but also into the size of the damage inflicted on the network by individual cascades. In particular, what is the difference between the perturbations that cause large cascades and those that do not? To answer this question quantitatively, we categorized cascades according to their sizes measured by the power shed Ps defined above: small cascades (0.01 MW ≤ Ps < 300 MW) and large cascades (Ps ≥ 300 MW). This choice of measure and threshold is based on the NERC requirement that all blackouts causing more than 300 MW of lost power be reported. We characterized perturbations by three different measures based on (normalized) distances: dt–t, defined as the average pairwise distance among the nt triggering line failures, as well as dt–v and gt–v, defined as the minimum topological and geographical distances, respectively, from one triggering line failure to the vulnerable set Embedded Image. The average of these distances over cascades in each size category (Embedded Image, Embedded Image, and Embedded Image) is shown in Fig. 5 for each region. Cascades resulting in power shed Ps ≥ 300 MW were associated with a set of triggering line failures that were topologically closer to each other (Fig. 5A), as well as with triggering failures that occurred topologically and geographically closer to a vulnerable line (Fig. 5, B and C).

Fig. 5 Cascade size and distances involving triggering line failures.

(A to C) Three types of (normalized) distances are shown for each NERC region (Fig. 1A and table S2): (A) the mean pairwise topological distance between the triggering failures, (B) the topological distance between the set of triggering failures and the vulnerable set, and (C) the geographical distance between the set of triggering failures and the vulnerable set. The distances are averaged separately over large cascades (blue, Ps ≥ 300 MW) and over small cascades (red, 0.01 MW ≤ Ps < 300 MW). In each case, the distances are further averaged over all snapshots. Error bars mark the estimated standard deviation.

Conclusions

Our vulnerability analysis of a continent-wide power system distinguishes itself from most previous studies by its scale but also by accounting for (i) the physics of cascading failures (dc-approximated power flow redistribution and heating of line conductors); (ii) grid operation practices (generation reserves and power shedding); and (iii) a wide range of conditions across years, seasons, and power demand levels (over which the average cascade size varies by one to two orders of magnitude). A strength of our approach is that it consists of tools—the definition of vulnerable sets, the method for aggreating multiple network conditions, and the analysis of coreness-vulnerability correlations—that are applicable to any cascade-prone network.

Our analysis separates the set of all failures occurring in cascade events into primary failures, which define the vulnerable set and account for only 1/5 of all failures, and secondary failures, which are more uniformly distributed and, albeit more numerous, are a mere consequence of the primary ones. The vulnerable set is not only surprisingly small but also highly skewed—with few lines far more likely to undergo a primary failure than the others—and patchy even when we control for the heterogeneity in the geographic organization of the grid. Although the vulnerable set is widespread through the network, the portion of it recruited in each cascade is not and is in fact strongly spatially correlated with the location of the triggering line failures; this is counter to the perception that cascades [for being nonlocal with respect to both topological and geographical distances (31, 38)] can spread essentially without spatial constraints.

Our analysis also shows that larger cascades are associated with co-occurring perturbations that are closer both to each other and to the vulnerable set. This validates the existing hypothesis that localized triggering failures amount to bigger cascades (39) and reveals a striking relation to the classic threshold model (4) used to describe behavioral cascades in social systems, in which large cascades tend to be triggered by perturbations adjacent to the set of “early adopters.” This set corresponds to the nodes most susceptible to change and thus plays a role similar to the one the vulnerable set plays in our analysis. The network topology emerged as a significant factor in determining the risk of cascading failures in our analysis based on the k-core decomposition, which has also been used to characterize nodes that serve as efficient spreaders in contact-based processes (40).

There are never two identical cascades in a network. It may thus come as a surprise that (primary) failures in large cascades are constrained to only a small subset of the network, which will likely experience new failures in the absence of remediating actions. This offers a scientific foundation for failure-based allocation of resources, which in the case of a power grid would be based on prioritizing upgrades of the system on the basis of previous observed failures (14)—but only if those are the primary (as opposed to all) failures (although upgrading transmission line capacities in the vulnerable set could create new vulnerable lines outside the set). Future work will be needed to determine the extent to which this applies to other flow networks that are subject to repeated failures, such as supply chains, food webs, and traffic networks.

Methods summary

For each interconnection, the system was modeled as a network of buses connected by transmission lines, given the parameters of individual network components in a given snapshot. The triggering perturbations were chosen uniformly from all lines for the Texas and Western networks, whereas for the Eastern network, they were chosen uniformly within one of the six regions defined by NERC (Fig. 1A and table S2). The initial state of the network and the redistribution of power flow after a line removal were both calculated by solving an equation that expresses a balance between incoming and outgoing power flows at each bus. Through a temperature-evolution equation, the heating of a transmission line was modeled as an exponential convergence to the equilibrium temperature determined by the power flow over that line. Mechanisms responsible for the primary failures occurring in a given simulated cascade were identified by using an algorithm we developed to determine the degree to which the change in each generator’s output contributes to changes in individual line power flows.

The density-equalizing transformation used to generate Fig. 3 was determined by estimating the density function for the geographical distribution of nodes and evolving it to a uniform-density equilibrium through a linear diffusion process (41). The topological and geographical distances between two transmission lines are defined based on the corresponding distances between the buses they connect. Both distances are thus zero between two lines that connect to a common bus. Further details on the formulation of the power flow equation, triggering perturbations, temperature evolution equation, validation of the cascade dynamics model against historical data, calculation of the density-equalizing transformation, algorithm for assigning power flow changes to generators, and the definitions of bus-to-bus distances are all given in the supplementary materials.

Supplementary Materials

www.sciencemag.org/content/358/6365/eaan3184/suppl/DC1

Materials and Methods

Figs. S1 to S7

Tables S1 to S3

References (4249)

References and Notes

Acknowledgments: The authors thank H. Valizadehhaghi for insightful discussions. This work was supported by the Institute for Sustainability and Energy at Northwestern (ISEN) under a Booster Award, the U.S. National Science Foundation under grant DMS-1057128, and the Advanced Research Projects Agency–Energy (U.S. Department of Energy), under award DE-AR0000702. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States government or any agency thereof. The power-grid data were obtained from FERC under a nondisclosure agreement by following the procedure described at www.ferc.gov/legal/ceii-foia/ceii.asp. The BPA line outage data and the NERC grid disturbance data are both publicly available at https://transmission.bpa.gov/Business/Operations/Outages (Miscellaneous Outage Data and Analysis) and www.oe.netl.doe.gov/OE417_annual_summary.aspx (Electric Disturbance Events, OE-417), respectively. The 2010 U.S. census data and the boundary data for the U.S. counties can be downloaded from https://factfinder.census.gov and www.census.gov/geo/maps-data/data/cbf/cbf_counties.html, respectively.
View Abstract

Subjects

Navigate This Article