Reliability analysis of power system based on generalized stochastic petri nets

Reliability Analysis of Power System based on
Generalized Stochastic Petri Nets
Juliano S. A. Carneiro, Luca Ferrarini
Dipartimento di Elettronica e Informazione
Politecnico di Milano
Piazza Leonardo da Vinci 32, 20133, Milan, Italy
Abstract— Hidden failures in protection schemes, the tradi-
tional N − 1 security criterion and the introduction of the
electricity market are usually major causes in the recent wide
area blackouts. In the present work, we address the reliability
analysis of power systems using the Generalized Stochastic
Petri Nets (GSPN). The proposed modeling approach considers
not only the most common failures of power system elements,
i.e. short-circuit, breakdown, lightning, but also the improper
operations of protection schemes. In addition, the dependency on
the system operating conditions has been introduced according
to the GSPN formalism (marking-dependency), which allows for
the propagation of harmful events. At last, well-known techniques
such as reachability graph might be used to retrieve the reliability
information of the system under investigation.
I. I
NTRODUCTION
The reliability of electric power systems is currently under-
going numerous investigations, mainly after the latest wide
area blackouts. Essentially, the introduction of electricity
market and also the old-fashioned protection schemes have
been recognized as the major causes of catastrophic events.
In fact, the electrical market trends toward a more efficient
production, transmission and distribution of energy, and thus
exploiting fully the electric resources. On the other side, such
a concept shortens drastically the safety guards of power

systems and requires novel operating criteria to keep them
safe. Nevertheless, the protection schemes are still based on
the classical “N-1 criterion”, once extremely efficient, but
currently inadequate to face with critical operating conditions
created by this modern market-driven organization.
Studies conduced by NERC, UTCE and others revealed that
protection system failures are often involved in the most seri-
ous blackouts. Generally, the impact of a particular hazardous
event is minimized if the occurrence is promptly identified and
eliminated as soon as possible [2]. This procedure helps to
prevent “N-k contingencies” caused by cascading effects [1],
[4], [10], and then it reduces the probability of catastrophic
failures in power systems. Clearly, the protection system
plays an important role in this scenario, since it avoids the
disturbance propagation by removing the damaged component
and/or section from the rest of the grid.
There are two sorts of safety requirements concerning the
protection systems: the dependability, which is the ability to
operate correctly when required, and the security, which means
the ability to refrain from unnecessary tripping (undesired
tripping). The dependability is achieved by redundant protec-
tion schemes and has often taken priority with respect to the
security. However, security aspects have become particularly
important after the introduction of the electricity market.
For example, the line power flows during either heavy load
conditions or maintenance operations can induce undesired
tripping of distance protections. In this case, a line tripping will
lead to an additional stress in the system that might contribute
to widespread blackouts. This simple example illustrates a
case of hidden failures, defined in [11] as: a defect such as a

component failure, inappropriate setting or incorrect external
connection that remains undetected until some other system
event causes the hidden failure to initiate a cascading outage.
It is worth noting that hidden failures cannot be easily de-
tected and frequently lead to large outages [5], [9]. Moreover,
the example shows that a given disturbance might produce
different consequences depending on the power system state.
In conclusion, the reliability of protection schemes, understood
as the union of dependability and security, and its dependency
on the system operating conditions, deserve all attention when
analyzing and designing modern power systems [12].
The Petri Net (PN) paradigm is suitable to represent event-
driven systems, which are characterized by a set of states
(configurations) and a set of evolution rules (events). Many
authors used different types of PNs to model reliability aspects
in wide application fields [4], [6], [7]. In this paper, we
present a formal model based on Generalized Stochastic Petri
Nets (GPSN) for the reliability analysis of transmission power
systems.
II. G
ENERALIZED
S
TOCHASTIC
P
ETRI
N
ETS
Petri Nets are extremely useful for performance evaluation
and description of distributed systems characterized by sequen-
tiality, concurrency, synchronization, among others. Specifi-

cally, the GSPN [8] is one of the several extension of standard
PNs and is obtained by allowing transitions to belong to two
different classes: immediate transitions and timed transitions.
Immediate transitions fire in zero time once they are enabled.
Timed transitions fire after a random, exponentially distributed
enabling time. Formally, a GPSN can be defined as follows:
Definition 1: A GSPN is an 8-tuple:
N = {P, T, Π,I,O,H,W,M
0
}
where:
•
P is the set of places;
•
T is the set of transitions,
T = T
im
∪ T
tim
; T
im
∩ T
tim
= ∅
where T
im
means immediate transitions and T
tim
means
timed transitions;

•
Π:T → N is the priority function that maps transitions
onto natural numbers representing their priority levels,
∀t
k
∈ T
tim
, Π(t
k
)=0; ∀t
k
∈ T
im
, Π(t
k
) > 0;
•
I,O,H : T → Bag(P ), are the input, output and
inhibition functions, respectively. Bag(P) is the multiset
on P;
•
W :(T × M) →
+
is the stochastic function that maps
transitions onto real numbers representing their firing
rates depending on the marking M,
W (t
k
,M)=


λ
k
,ift
k
∈ T
tim
ω
k
,ift
k
∈ T
im
•
M
0
: P → N is the initial marking, a function that
associates each place with a natural number.
The dynamic evolution of the PN marking that is governed
by transition firings that, once enabled, remove tokens from
upstream places and add them to downstream places. In short,
a transition t
k
has concession if and only if (i) each input
place contains a number of tokens greater or equal than a given
threshold, and (ii) each inhibitor place contains a number of
tokens strictly smaller than a given threshold.
Definition 2 (Concession): Transition t
k
has concession in
marking M if and only if:

∀p ∈
•
t
k
,M(p) ≥ I(t
k
,p) ∧∀p ∈
◦
t
k
,M(p) ≤ H(t
k
,p)
Instead, a transition t
k
is said to be enabled if it has concession
in marking M , and if no other transition t
j
∈ T of priority
Π
j
> Π
k
exists that has concession in the same marking M.
Definition 3 (Enabling): Transition t
k
is enabled in mark-
ing M if and only if:
•
t

k
has concession in marking M and,
•
Π(t
k
) > Π(t
j
), ∀t
j
∈ T that have concession.
When transition t
k
fires, it deletes from each place in its input
set
•
t
k
as many tokens as the multiplicity of the arc connecting
that place to t
k
, and adds to each place in its output set t
k
•
as many tokens as the multiplicity of the arc connecting t
k
to
that place.
Definition 4 (Firing): The firing of transition t
k
, enabled in

marking M, produces marking M

such that:
M

= M + O(t
k
) − I(t
k
)
The GSPN just introduced consists in a powerful tool to
model power systems. Phenomena like component failure,
short-circuit, lightning, etc, are always present in real systems
and occur randomly. Such events, together with control and
protection actions, can be suitable represented through the
GSPN, as described in the following sections.
III. G
ENERAL
M
ODEL
S
TRUCTURE
The general model representing the power system under
investigation is composed of three major blocks: Electrical
Topology Network (ETN), Stochastic Model Network (SMN)
and Current Evaluation Network (CEN). These sub-networks
communicate and exchange the required information to repre-
sent and describe the power system evolution. Basically, the
SMN acts as the “core” of the general model, while ETN and
CEN support the logical and stochastic evolution of the SMN.

A. Electrical Topology Network
The Electrical Topology Network computes the electrical
connectivity of each component of the system. Essentially, the
ETN operates based on the information regarding the states of
the components, e.g. open/closed for circuit breakers, out-of-
order/working for lines and transformers. Such information
come from the SMN though appropriate signal connectors, as
will be discussed later. In addition, the ETN has the physical
location of generation groups in order to identify the supplied
components.
Informally, the strategy used to compute the electrical
connectivity can be so outlined: starting from the generation
groups (GEN), the search algorithm identifies step by step
the graphs representing lines (L), station bars (SB) and trans-
formers (T) connected to at least one generation point. For
such scope, we created a modular basic element that contains
two places: the electrical state (E
ST) and the physical state
(P
ST), as shown in the box of Fig. 1. The former place
is marked when the component is connected to a generation
point, whereas the latter place is marked if the the component
state permits the electrical connectivity (data available in the
SMN). Beside the places, the basic element is endowed with
immediate transitions that propagate the token representing the
electrical connection as far as possible. In short, the evolution
of ETN
1
, illustrated in Fig. 1, can be described as follows:
1) A message is sent to the ETN after changing the state

of a component of the SMN;
2) The ETN clears all electrical places once the message
from the ETN is received;
3) A token diffusion starts from the generation points and
establishes a new electrical topology.
B. Stochastic Model Network
The Stochastic Model Network is composed of several sub-
blocks interconnected among them. Such sub-blocks represent
the different components of the transmission grid, whereas
their interconnections symbolize the logical interactions.
The construction rule for each sub-block follows two steps:
1) Identification and description of states (configurations);
2) Specification of transitions (events).
The result of such a procedure can be then synthesized in a
Markov Chain enriched by extra elements. The function of
such elements regards the conditioning of internal transitions
1
Note the station bar contains only the electrical state. That because we
decided to not consider the bus breaking.
Fig. 1. An example of the Electrical Topology Network
according to external events. To clarify these concepts, we
proceed with some modeling examples of the most important
components of transmission systems: power lines, protection
schemes, circuit breakers, bus bars and transformers.
1) Transmission Line Model: The model takes into account
the fact that the line can be short-circuited temporally (L
SC
)
or permanently (L
SC P

). Furthermore, the line can be either
hit by lightnings (L
F LASH
), or it can be broken (L
FAIL
),or
clearly it can be in normal state (L
OK
). Note that the states
just introduced are mutually exclusive, which means that short-
circuit, lightning and breaking cannot happen contemporane-
ously.
The evolution of line model (Fig. 2 (a)) is governed by the
following discrete events (temporized/immediate transitions):
TL
F LASH
Line is struck by a lightning;
TL
F OK
Lightning extinguishes autonomously and
the line returns to normal state;
TL
SC
Line goes from the normal state to short-
circuit with ground;
TL
SC OK
Short-circuit extinguishes autonomously;
tL


SC
E
Short-circuit extinguishes after the interven-
tion of protections (immediate transition);
TL
SC P
Line goes from normal state to permanent
short-circuit with ground;
TL
SC REP
Line is repaired to eliminate the permanent
short-circuit;
TL
FAIL
Line failure (normally caused by an object);
TL
REP
Line is restored to normal state;
TL
F SC
Line goes to short-circuit because of a light-
ning. The energy of the lightning is consid-
ered to be discharged to the ground;
TL
F FAIL
Line failure caused by a lightning. The
effect of the lightning is extinguished;
TL
SC FAIL
Line failure due to short-circuit (normally

caused by the breaking of an insulator).
2) Protection Model: The protection model is unique for
all components. It recognizes a failure in the element under
control and commands the associated breaker to open. As
mentioned before, the protection model must describe both
dependability and security aspects. Therefore, the protection
not only can be damaged (failure to operate), but also can be
subjected to undesired tripping (operate when not required).
In addition, the protection model includes the Breaker Failure
Device (BFD). This element, located in every bus of the
system, recognizes failures in a breaker opening and orders the
remaining interrupters connected to that particular bus station
to open. The overall behavior of the protection model, as well
as its resultant Petri Net (Fig. 2 (b)), can be summarized as
follows:
TP
FAIL
Protection failure;
TP
REP
Protection is repaired;
TP
TRIP
Protection identifies properly a failure in
the component under control;
TP
UT
Protection commands the breaker opening
in absence of failure (undesired tripping);
TP

READY
Protection returns to normal state when the
fault is eliminated;
TBFD
FAIL
BFD failure;
TBFD
REP
Protection is repaired;
TBFD
TRIP
BDF identifies a failure in the breaker
opening and commands the remaining in-
terruptors to open;
TBFD
READY
BFD returns to normal state when the fault
is eliminated;
The Fig. 2 exemplifies some of the interconnections among
the internal blocks of the SMN. In particular, the place
(P
OK
) is used to condition the protection tripping (TP
TRIP
).
Moreover, it imposes constraints to the resetting of both pro-
tection (TP
READY
) and BFD (TBFD
READY

). The place
(I
OP EN
), instead, indicates an open breaker and it is used to
coordinate the protection and the BFD operation.
3) Circuit Breaker Model: The breaker has been modeled
with a similar approach. It consists of four main logical states:
open, closed, stuck closed and stuck open. Automatic circuit
reclosers (I
RECLOSE
) are also considered and have been
included inside the breaker model. The reclosers interrupt
and reclose an ac circuit with a preset sequence of trip-
ping/reclosing to eliminate temporally faults. After the first
opening, the breaker is automatic closed by the fast recloser
(TI
CLOSE
). If the breaker opens again (permanent fault),
then it can be closed only through the transition (TI
CLOSE2
).
Such a transition will be conditioned to the fact that the lines
attached to it are in normal state. The PN model of the circuit
breaker is sketched in Fig. 2 (c) and the transitions from one
state to another one are reported below:
TI
OP EN
Breaker opening triggered by the associated
protection;
TI

CLOSE
Fast reclosure of the breaker;
TI
CLOSE2
Reclosure of the breaker conditioned by the
normal state of connected elements;
TI
STUCK O
Breaker stuck in open condition;
TI
REP O
Breaker reparation (set to open state);
Fig. 2. Stochastic Model Network. (a) Line model. (b) Protection model. (c) Circuit breaker model.
TI
STUCK C
Breaker stuck in closed condition;
TI
REP C
Breaker reparation (set to closed state);
TI
REC END
Fast recloser resetting.
4) Station bus and transformers: Similarly, also bars and
transformers have been modeled. In short, the station bus
can be either hit by lightning or short-circuited, whereas the
transformers can be short-circuited or broken down. Details
are here omitted for the sake of simplicity.
To the present time, the stochastic transitions were supposed
to have constant probability of firing. However, there is a
strong correlation between the operating conditions of power

systems and the probability of harmful events. To consider this
dependency, we developed the CEN described next.
C. Current Evaluation Network
The scope of the Current Evaluation Network is to condition
the firing probability of stochastic transition defined in the
SMN according to the current flowing in the transmission
system. That could be done by associating a piecewise con-
stant function to the firing rate of stochastic transitions with
dependency on the electrical topology.
In the GSPN formalism, it is possible to work with parame-
ters of transitions that are marking-dependent. In other words,
the firing rate λ
k
of timed transitions, as well the weight ω
k
of immediate transitions, can be evaluated as the product of a
nominal rate (or weight in the case of immediate transitions)
and a dependency function defined in terms of the marking of
the places that are connected to a transition through its input
and inhibition functions.
The idea here consists in introducing a new place p
s
in
the SMN for each component that contains a transition with
marking-dependency. Such a place summarizes, by means of
its marking M(p
s
), the marking of a finite generic set of places
C = {p
n

,p
n−1
, ···,p
1
,p
0
}. Afterwards, it can be used to
condition the parameters of a transition according to the GSPN
formalism.
TABLE I
E
NCODING EXAMPLE
M(C)=(M
p2
, M
p1
, M
p0
) M(p
s
)
(0,0,0) 1
(0,0,1) 2
(0,1,0) 3
··· ···
(1,1,1) 8
For simplicity, let us suppose to work with safe Petri Nets
(1-bounded places) and that M
0
is the initial marking, then

the number of tokens in the place p
s
is computed by (1):
∀M ∈ M
0
| M(p
s
)=1+
n

i=0
M(p
i
) · 2
i
(1)
which is nothing more than the binary encoding of the string
M(C)=(M(p
n
),M(p
n−1
), ···,M(p
1
),M(p
0
)) plus 1. As
an example, let M(C) be a set of three places. Then, we have
the mapping reported in Table I.
Once defined the encoding strategy, the GPSN should be
extended to introduced the marking-dependency. Essentially,

we must include the place p
s
and an appropriate set of arcs
such that the following relations hold true:
M
0
(p
s
)=1+
n

i=0
M
0
(p
i
) · 2
i
(2)
∀p
i
∈ C
⎧
⎨
⎩
(∀t ∈
•
p
i
) t

2
i
−→ p
s
(3)
(∀t ∈ p
i
•
) p
s
2
i
−→ t (4)
The initial marking of the place p
s
is given by (2), while the
number of tokens is updated as: (3) for input arcs, and (4) for
output arcs. A graphic interpretation is shown in the Fig. 3.
Fig. 3. An example of conditioned transition. Dashed elements represent the
extra place p
s
and the auxiliary arcs inserted for conditioning procedure.
Fig. 4. Firing rate of timed transitions as a function of current.
The Table I defines an auxiliary function f
i
that associates
the current level flowing in a component with the marking of
place p
s
. Such a function will to be used later as the input

of another function, called f
t
, which specifies the firing rating
according to the current in the component:
Electrical Topology ≡ M(p
s
)
f
i
−→ i
f
t
−→ λ
t
One possible alternative to describe the function f
t
is depicted
in Fig. 4. The firing rate λ
k
grows monotonically from zero
to the maximum value according to the measured current.
By changing dynamically the firing rate of stochastic tran-
sitions, we are able to describe not only the dependency
of operating conditions, but also the cascading effects. The
transitions to be conditioned are listed in Table II. Uparrow
and downarrow indicate that the firing probability increases
and decreases proportionally to the current, respectively.
In the next section we present an illustrative example
summarizing the introduced concepts. The purpose here is
to provide some implementation/simulation hints rather than

present a real case study. The subsequent reliability assessment
can be done using reachabiliy graphs obtained from a GSPN
simulation tool, such as GreatSPN [3].
IV. A
N ILLUSTRATIVE EXAMPLE
In this section we provide a guide to exemplify the most
important features of the proposed modeling approach. In
TABLE II
C
ONDITIONED TRANSITIONS
Component Transition Firing Rate
Line
TL
SC
↑
TL
SC FAIL
↑
TL
FAIL
↑
TL
SC OK
↓
Transformer
TT
SC
↑
TT
SC FAIL

↑
TT
FAIL
↑
TT
SC OK
↓
Bar
TB
SC
↑
TB
SC OK
↓
Protection
TP
UP
↑
TP
FAIL
↑
Breaker
TI
ST UCK C
↑
TI
OP EN
↓
particular, we illustrate the dependency of undesired tripping
on the current flowing in the component under control.

Let us consider the network shown in the left bottom of
Fig. 5. It is composed of: 6 transmission lines, 5 bars, 13
circuit breaker, 11 protection modules, 5 BFDs and pair of
generator/load. Note that BFDs, protections and reclosures
have been omitted for clearness, as well as the interconnections
with the SMN counterpart. The Fig. 5 illustrates also the
equivalent ETN of the example.
Due to the large dimension of SMN, just a small section of
the overall network is depicted in Fig. 2. Specifically, Fig. 2
reports the stochastic model of the line L
1
and its associated
protection, besides the breaker I
2
. The interconnections among
the three components is also evidenced, but those with the
ETN have been removed for clarity.
In order to simplify our analysis, we suppose that only the
lines L
1
, L
5
and L
6
can break down, and the protection of
L1 can be exposed of undesired tripping. For such a modeling
choice, the possible system configurations and the respective
line currents, besides the marking of auxiliary place M(p
s
),

are reported in Table III. Since we decided to condition only
the transition TP
UT
of the protection of line L
1
, then we
only need the information contained in the column I
1
of
Table III. This column resumes the current of L
1
on each
one of the possible configurations and denotes the constant
piecewise function f
i
defined before. Concerning the function
f
t
representing the probability of undesired tripping of line
L
1
, we decided to use the example depicted in Fig. 4. Note
that currents in series branches of the electrical circuit are
the same and so the number of columns in Table III can
be significantly reduced in real systems. Furthermore, many
configurations lead to identical currents and thus clustering
procedures can be used to reduced the table dimension.
Finally, after implementing the power system model in a
GSPN simulator environment, the reliability analysis can be
performed straightforwardly using the reachability graph.

Fig. 5. Electrical Topology Network
TABLE III
P
OSSIBLE CONFIGURATIONS
Configuration Current Encoding
L
1
L
5
L
6
I
1
I
2
I
3
I
4
I
5
I
6
M(p
s
)
000
a
a
0

b
0
a
0
c
0
d
0
e
0
1
001
b
a
1
3a
1
a
1
a
1
4a
1
0 2
010a
2
a
2
a
2

a
2
02a
2
3
01100000 0 4
10003a
3
0 a
3
2a
3
a
3
5
1010 a
5
00a
5
0 6
1100 a
6
0 a
6
0 a
6
7
11100000 0 8
a
Working

b
Failure
V. C
ONCLUSION
This paper describes a modeling approach based on the
GPSN to perform reliability analyses. The proposed model
is capable to represent complex phenomena of power systems
such as cascading events and protection hidden failures.
The most important components of transmission systems
have been modeled in a modular fashion. Such approach
enhances the usability of basic elements and allows to built
complex systems by drag-and-drop the desired components.
The major drawback of the proposed methodology regards
the scalability. When implementing large power systems, the
number of tangible markings (states), and consequently the
reachability graph, may grow quite fast.
R
EFERENCES
[1] Z. Bie and X. Wang, “Evaluation of power system cascading outages,”
in International Conference on Power System Technology, 2002. Pro-
ceedings. PowerCon 2002., vol. 1, October 2002, pp. 415–419.
[2] Q. Chen, “The probability, identification, and prevention of rare events
in power systems,” Ph.D. dissertation, Iowa State University, 2004.
[3] G. Chiola, , G.Franceschinis, R. Gaeta, and M. Ribaudo, “Greatspn
1.7: Graphical editor and analyzer for timed and stochastic petri nets.”
Performance Evaluation, special issue on Performance Modeling Tools,
vol. 24, no. 1-2, pp. 47–68, 1995.
[4] I. Dobson, B. Carreras, V. Lynch, and D. Newman, “Complex systems
analysis of series of blackouts: cascading failure, criticality, and self-
organization,” in Bulk Power System Dynamics and Control, August

2004, pp. 438–451.
[5] D. Elizondo, J. de La Ree, A. Phadke, and S. Horowitz, “Hidden failures
in protection systems and their impact on wide-area disturbances,” in
IEEE Power Engineering Society Winter Meeting, 2001, vol. 2, 2001,
pp. 710–714.
[6] L. Ferrarini, J. Carneiro, S. Radaelli, and E. Ciapessoni, “Dependability
analysis of power system protections using stochastic hybrid simulation
with modelica,” in IEEE International Conference on Robotics and
Automation, 2007, April 2007, pp. 1584–1589.
[7] N. G. Leveson and J. L. Stolzy, “Safety analysis using petri nets,” IEEE
Trans. Softw. Eng., vol. 13, no. 3, pp. 386–397, 1987.
[8] M. A. Marsan, G.Balbo, G.Conte, S.Donatelli, and G.Franceschinis,
Modelling with Generalized Stochastic Petri Nets. John Wiley & Sons,
1995.
[9] A. Phadke and J. Thorp, “Expose hidden failures to prevent cascading
outages,” IEEE Computer Applications in Power, vol. 9, no. 3, pp. 20–
23, 1996.
[10] J. D. L. Ree, L. Yilu, L. Mili, A. G. Phadke, and L. Dasilva, “Catas-
trophic failures in power systems: causes, analyses, and countermea-
sures,” Proceedings of the IEEE, vol. 93, no. 5, pp. 956–964, 2005.
[11] S. Tamronglak, S. Horowitz, A. Phadke, and J. Thorp, “Anatomy of
power system blackouts: preventive relaying strategies,” IEEE Transac-
tion on Power Delivery, vol. 11, no. 2, pp. 708–715, 1996.
[12] X. Yu and C. Singh, “A practical approach for integrated power system
vulnerability analysis with protection failures,” IEEE Transactions on
Power Systems, vol. 19, no. 4, pp. 1811–1820, 2004.