Controlled Islanding under Complete and Partial False Data Injection Attack Uncertainties against Phasor Measurement Units

Abstract

The widespread application of phasor measurement units has improved grid operational reliability. However, this has increased the risk of cyber threats such as false data injection attack that mislead time-critical measurements, which may lead to incorrect operator actions. While a single incorrect operator action might not result in a cascading failure, a series of actions impacting critical lines and transformers, combined with pre-existing faults or scheduled maintenance, might lead to widespread outages. To prevent cascading failures, controlled islanding strategies are traditionally implemented. However, islanding is effective only when the received data are trustworthy. This paper investigates two multi-objective controlled islanding strategies to accommodate data uncertainties under scenarios of lack of or partial knowledge of false data injection attacks. When attack information is not available, the optimization problem maximizes island observability using a minimum number of phasor measurement units for a more accurate state estimation. When partial attack information is available, vulnerable phasor measurement units are isolated to a smaller island to minimize the impacts of attacks. Additional objectives ensure steady-state and transient-state stability of the islands. Simulations are performed on 200-bus, 500-bus, and 2000-bus systems.

1. Introduction

Controlled islanding, as a last resort solution, prevents cascading failures by isolating the faulty regions from the rest of the grid and creating smaller partitions that rapidly restore [1,2]. Islanding aims to: (1) minimize the total line power flow disconnection to enhance the system transient stability [3,4,5,6], and (2) minimize the imbalance of load generation in each island to enhance the steady-state stability [7,8,9].

Controlled islanding is particularly effective assuming that the received information about the system is trustworthy, an assumption that does not hold under unobservable cyber attacks. Undetected cyber attacks, such as data injection, falsify the measurements of the phasor measurement units (PMUs) in load injection buses [10,11,12,13]. Such attacks may result in incorrect estimation of bus voltages and angles, affecting island re-synchronization and system recovery. The problem is compounded in large power grids when monitoring the enormous volume of activity inside the network becomes extremely difficult, let alone the discovery of threats.

This paper considers how measurement uncertainties, under the lack of or partial information on compromised measurements, affect the outcome of controlled islanding. Specifically, false data attacks changing steady-state conditions are considered. The main scope of the study is to strengthen the existing islanding process by considering uncertainties in the PMU measurement in the islanding formulation and enabling a prompt response and recovery. To our knowledge, this is the first paper to accommodate PMU measurement uncertainties in traditional controlled islanding.

Figure 1 illustrates the overall process developed in the paper. With no prior knowledge of false measurements, designing a recovery approach is inherently complex. Suppose that the vulnerable PMUs that provide synchronized measurements are unknown. In that case, the attack impacts are minimized by creating islands that require minimal PMU measurements for maximum observability in state estimation. To the best of our knowledge, the problem of creating maximally observable islands with minimum PMUs has not been addressed before. In contrast, if the operators can further identify the potential attack location by analyzing PMU measurements [14], the mentioned mitigation approach isolates vulnerable PMUs to only a small part of the system while creating stable and observable islands. The dynamics of the system during islanding is incorporated by considering the coherency of generators [2].

The main contributions of this paper over the existing methods are summarized as follows.

• Incorporating measurement uncertainties: Two new strategies are developed for controlled islanding without or with partial knowledge of false measurements. Controlled islanding is formulated as a multi-objective optimization problem that yields stable and observable islands while ensuring that wrong PMU measurements impact a minimal number of partitions.
• Minimizing the loss of observability: A new method is developed to minimize the loss of observability during the partition process. This approach is efficient when reliable state estimation solutions are sought for the newly-formed islands with minimum PMUs in each island.
• Comprehensive islanding solutions: Trade-offs between different objectives such as island size, observability, load-generation imbalance, and power flow disconnection are investigated using various optimization methods while taking into account the number of islands, generator coherency, and dynamic stability of the system.

The rest of this paper is organized as follows: Section 2 briefly outlines the background and motivation of the problem addressed in this paper. Section 3 and Section 4 develop controlled islanding strategies considering uncertainties without the knowledge or partial attack information, respectively. Section 5 presents additional objectives for steady-state and transient stability and outlines constraints related to the partition and structural connectivity of the islands. Section 6 formulates the islanding problem as a multi-objective optimization. The simulation results and the discussion are given in Section 7, followed by the concluding statements in Section 8.

2. Background and Motivation

PMUs significantly enhance situational awareness of the grids by providing accurate real-time measurements. These measurements improve network observability and result in precise state estimation solutions. However, PMUs are considered vulnerable to sophisticated cyberattacks [10,11,12,15]. Attacks can inject false data in voltage and current measurements to alter the estimated states [10,11] or modify time stamps to change phase angle measurements [12]. The worst case attacks could be unobservable [11] and result in incorrect power flow estimation, generator dispatch, and line overload [16,17]. False measurements may result in a series of incorrect operator actions impacting critical lines and transformers, resulting in load shedding and unintentional islanding [18,19]. In combination with prior system faults, wrong actions have been responsible for major cascading blackouts in the past [20].

Cascading blackouts can be prevented at the regional level by installing event-based and parameter-based remedial action schemes (RAS). However, improper coordination, erroneous RAS interactions [21], or targeted attacks against RAS [22] can cause additional outages. Controlled islanding is the last resort RAS that prevents widespread outages by partitioning the system into several independent and stable islands. However, any islanding decision to stabilize the power system is only effective when the received measurements are trustworthy.

Sophisticated false data injections may prevent system operators from identifying what part of the network is compromised. Although most research explores preventive schemes using model-based and data-driven techniques described in the comprehensive survey in [14], there is considerably less focus on recovery strategies. In [23], reclosing strategic lines that limits inrush currents and power swings is suggested as recovery when attacks result in multiple line trips. Another solution proposed in [24] is to resupply the lost loads with autonomous battery backup systems independent of a central controller. This paper focuses on developing controlled islanding strategies that are robust against false data injections on measurements under two distinct scenarios:

• Scenario 1 under complete uncertainty: maximize the island observability with a minimum number of PMUs; and
• Scenario 2 under partial uncertainty: isolate vulnerable PMUs to a small island.

In Scenario 1, it is assumed that attacks, such as coordinated data and RAS attacks [22], have already resulted in the evolution of subsequent physical failures. With no knowledge of the cause of failures, the operators doubt the fidelity of the received data. In Scenario 2, it is assumed that partial information on potentially vulnerable PMUs is available using methods such as those presented in [14].

3. Islanding under Complete Uncertainty

In this section, a controlled islanding strategy with two competing objectives will be developed to (1) maximize the observability of islands and (2) minimize the number of PMU measurements utilized. The most notable advantage is that more resources can be deployed to secure a small subset of PMUs for maximal observability, leading to more reliable state estimation and improving the island re-synchronization process. The minimum number of retained PMUs for observability also depends on the additional steady-state and transient stability objectives described in Section 5.3. Note that this paper only considers steady state observability for the purpose of state estimation of bus voltage and angles, and not dynamic observability of generator state variables such as rotor speeds and rotor angles.

To formulate the problem of islanding under complete uncertainty, the power network is represented as a graph $\mathcal{G}(\mathcal{N},\mathcal{Z})$, where $\mathcal{N}$ is the set of buses and $\mathcal{Z}$ is the set of lines [3]. A small number of PMUs are placed on critical elements (defined as large generators and lines with large power flows). The limited PMUs on critical elements are assumed secure by prior cyber security design [25]. All other PMUs are assumed to be vulnerable to attacks. The set of lines with secure and non-secure PMU measurements are denoted by ${\mathcal{Z}}_S$ and ${\mathcal{Z}}_{\setminus S}$, respectively.

3.1. Objective 1: Maximize Island Observability

A non-PMU bus is observable when it is incident to a line with a current phasor measurement from a neighboring PMU [26]. The loss of observability occurs when lines with measurements are disconnected during islanding [26]. This paper explores a new scenario that leads to a further loss of observability.

Consider the situation when the system is impacted by sophisticated false data attacks that may remain undetected for a long time [13]. While a single operator action might not result in a cascading outage, a series of incorrect actions impacting critical lines and transformers, combined with pre-existing faults or scheduled maintenance, may result in a widespread blackout. Prompt controlled islanding decisions are imperative for stability. In the absence of any information on the trustworthiness of the measurements, the approach introduced here aims to use only a fraction of non-secure PMUs rather than all for maximal island observability. This problem has two competing objectives. Hence, depending upon the number of non-secure PMU measurements retained, some buses may not remain observable.

Overall, the loss of observability is considered under two situations—(1) when lines with measurements are disconnected during islanding, and (2) when possibly compromised non-secure PMU measurements are discarded. Two binary variables are defined to take into account both the situations. The variable $z_{i,j},\forall (i,j)\in \mathcal{Z}$ denotes a line status as,

$$z_{i,j}=\left\{\begin{array}{cc}\hfill 0\hfill & \hfill \mathrm{if}\mathrm{line}(i,j)\mathrm{is}\mathrm{disconnected}\hfill \\ \hfill 1\hfill & \hfill \mathrm{if}\mathrm{line}(i,j)\mathrm{is}\mathrm{in}\mathrm{service}\hfill \end{array}\right.$$

(1)

and $d_{i,j},\forall (i,j)\in {\mathcal{Z}}_{\setminus S}$ denotes the measurement status as,

$$d_{i,j}=\left\{\begin{array}{cc}\hfill 1\hfill & \hfill \mathrm{if}\mathrm{line}\mathrm{measurement}(i,j)\mathrm{is}\mathrm{retained}\hfill \\ \hfill 0\hfill & \hfill \mathrm{if}\mathrm{line}\mathrm{measurement}(i,j)\mathrm{is}\mathrm{discarded}\hfill \end{array}\right.$$

(2)

Note that lines with secure measurements can be disconnected during islanding. However, their measurements are never intentionally discarded. Non-secure lines can be disconnected, and their measurements discarded, which is accounted for by the product of the two binary variables, $d_{i,j}{z}_{i,j}$.

Remark 1.

The product of the two binary variables $d_{i,j}{z}_{i,j}$ is denoted by another binary variable $v_{i,j}$ and the following set of linear constraints,

$$v_{i,j}\le d_{i,j}$$

(3)

$$v_{i,j}\le z_{i,j}$$

(4)

$$v_{i,j}\ge d_{i,j}+z_{i,j}-1$$

(5)

The constraints (3) and (4) imply $v_{i,j}=0$ when $d_{i,j}=0$ or $z_{i,j}=0$, and (5) implies $v_{i,j}=1$ only when both variables are one.

An observability decision matrix $\mathit{Z}\in {\mathbb{R}}^{m\times m}$ is defined as,

$$\mathit{Z}=\left[\begin{array}{cc}\begin{array}{c}{\mathit{Z}}_{\mathit{S}}\end{array}& 0\\ 0& \begin{array}{c}{\mathit{Z}}_{\backslash \mathit{S}}\end{array}\end{array}\right]=\left[\begin{array}{cccccc}.& & & & & \\ & z_{j,k}& & & 0& \\ & & .& & & \\ & & & .& & \\ & 0& & & v_{i,j}& \\ & & & & & .\end{array}\right]$$

(6)

where sub-matrices ${\mathit{Z}}_{\mathit{S}}$ and ${\mathit{Z}}_{\setminus \mathit{S}}$ correspond to secure lines $(j,k)\in {\mathcal{Z}}_S$ and non-secure lines $(i,j)\in Z_{\setminus S}$, respectively.

Next, a matrix $\mathit{H}$ is constructed that represents the topological observability at the bus/branch level using the line current measurements. The elements of $\mathit{H}$ corresponding to states $V_i$ and $V_j$ are set to one when there exists a line current measurement between nodes i and j, and zero otherwise [27],

(7)

The sub-matrices ${\mathit{H}}_{\mathit{S}},{\mathit{H}}_{\setminus \mathit{S}}$ correspond to the secure and non-secure lines, respectively. The system is fully observable when the gain matrix $\mathit{G}={\mathit{H}}^{\mathit{T}}\mathit{H}$ has a full rank [27]. To incorporate the measurement uncertainties during controlled islanding, a new gain matrix is constructed as,

$$\mathit{G}={\left(\mathit{ZH}\right)}^{\mathit{T}}\left(\mathit{ZH}\right)={\mathit{H}}^{\mathit{T}}{\mathit{Z}}^{\mathit{T}}\mathit{ZH}={\mathit{H}}^{\mathit{T}}\mathit{ZH}$$

(8)

Here, $\mathit{Z}$ is a binary diagonal matrix and, hence, ${\mathit{Z}}^{\mathit{T}}\mathit{Z}=\mathit{Z}$. When diagonal elements of $\mathit{Z}$ become zero during controlled islanding, it drives an entire column of $\mathit{G}$ to zero. In this scenario, a node becomes unobservable if it is not observed directly or indirectly by another PMU.

The overall objective is to maximize the observability of the system for a more reliable state estimation of the islands. The objective function for observability is defined as,

$$\begin{array}{cc}\hfill & \hfill {\tilde{F}}_1=\mathrm{rank}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right)\hfill \end{array}$$

(9)

The $\mathrm{rank}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right)=\mathrm{rank}\left(\mathit{G}\right)$ is the number of the corresponding non-zero eigenvalues. As $\mathit{G}$ is positive semi-definite, $\mathrm{rank}\left(\mathit{G}\right)$ is quasiconcave and NP-hard to maximize. Instead, $\mathrm{rank}\left(\mathit{G}\right)$ is replaced by $\mathrm{trace}\left(\mathit{G}\right)$, which serves as a convex proxy [28]. Hence, (9) becomes convex as,

$$\begin{array}{cc}\hfill & \hfill F_1=\mathrm{trace}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right)\hfill \end{array}$$

(10)

Remark 2.

The convex proxy or convex hull of a function is the largest convex under-estimator of the function. If $\varphi \left(\mathit{G}\right)=\mathrm{rank}(\mathit{G})$, then ${\varphi }_{hull}\left(\mathit{G}\right)={\left|\right|G\left|\right|}_{*}={\sum }_{i=1}^m{\sigma }_i\left(G\right)$, where ${\left|\right|G\left|\right|}_{*}$ is the nuclear norm and ${\sigma }_i$ is the $i^{th}$ singular value. As $\mathit{G}$ is symmetric and positive semi-definite, the singular values are equal to the eigenvalues. Thus, ${\left|\right|\mathit{G}\left|\right|}_{*}=\mathrm{trace}\left(\mathit{G}\right)$, which is a convex function.

Remark 3.

The expression $\mathrm{trace}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right)$ in (10) creates matrices that hold binary variables (instead of floating-point numbers), which becomes computationally expensive for large power systems. Instead, using the properties of the $\mathrm{trace}$ of matrix products, the term in (10) is conveniently written as,

$$\begin{array}{cc}\hfill & \hfill \mathrm{trace}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right)=\mathrm{trace}\left({\mathit{ZHH}}^{\mathit{T}}\right)=Z_{i,i}\sum _{j=1}^n{H}_{ij}^2\hfill \end{array}$$

(11)

3.2. Objective 2: Minimize the Number of Retained PMUs

In the previous section, objective 1 was formulated for maximum observability for a reliable state estimation. The challenging problem now is to utilize only a minimum number of non-secure PMU measurements for the same. This approach minimizes the resources needed during the post-attack recovery by securing only a small subset of PMUs. With $d_{i,j}$ in (2) indicating whether a measurement is retained or not, the objective function for retaining a minimum number of additional non-secure PMUs is written as,

$$\begin{array}{cc}\hfill & \hfill F_2=\sum _{(i,j)\in {\mathcal{Z}}_{\setminus S}}{\beta }_i{d}_{i,j}\hfill \end{array}$$

(12)

where ${\beta }_i$ is a weight which defines the measure of vulnerability for PMU i. One way to calculate ${\beta }_i$ is to measure how frequently PMU i appears in all possible attack scenarios. Such attack scenarios, based on the locations of load injection buses, can be simulated using the algorithm in [13].

While retaining (discarding) a noncritical PMU, all line current measurements associated with that PMU are retained (discarded). This is achieved by an additional constraint,

$$d_{i,j}=d_{i,k}\forall k,\forall (i,j),(i,k)\in {\mathcal{Z}}_{\setminus S}$$

(13)

Combining objectives $F_1$ and $F_2$ allows maximizing island observability using a minimum number of non-secure PMUs under situations when attacks remain completely unknown.

4. Islanding under Partial Uncertainty

In this section, a new controlled islanding strategy under partial information on cyberattacks is developed to (1) isolate vulnerable PMUs and (2) maximize the observability of the islands. The size of the island also depends on the additional stability objectives described in Section 5.3.

4.1. Objective 1: Isolate PMUs under Attack

Consider false data injections that alter specific PMU measurements to bypass the state estimator. Partial information on potentially vulnerable PMUs can be identified by scanning ports, user logs, and registry entries [29]. False measurements are also discerned by analyzing PMU measurements using model-based and data-driven detection techniques [14,30]. With model-based approaches, false data may be partially detected by (1) estimation-based methods that compare estimated states with state measurements and (2) direct calculation-based methods that combine measurements and system parameters to detect anomalies. On the other hand, data-driven methods employ supervised and unsupervised machine learning algorithms to detect anomalies in data. It should be noted that the detection of false data is outside the scope of this paper.

Assume node i is vulnerable based on the partial information received from any of the described methods. The objective is to isolate all possible vulnerable PMUs into a single island. The idea is illustrated in Figure 2. Centered at node i, all nodes ${\mathcal{N}}_i$ at a radius R are labeled as vulnerable. We employ a breadth-first search for this purpose, where the search starts at the root node i and explores all neighboring nodes at the same level before moving to the next depth [31]. The value of R may be determined on the basis of the architecture of the PMU communication network. The process is repeated for each suspected node.

Now, define a binary variable $x_i,\forall i\in \mathcal{N}$ for the placement of node i in an island as,

$$x_{i,h}=\left\{\begin{array}{cc}\hfill 1\hfill & \hfill \mathrm{if}\mathrm{node}i\mathrm{is}\mathrm{in}\mathrm{island}h\hfill \\ \hfill 0\hfill & \hfill \mathrm{otherwise}\hfill \end{array}\right.$$

(14)

The overall objective is to minimize the size of the island with vulnerable PMUs. The objective function is defined as,

$$\begin{array}{cc}\hfill & \hfill F_3=x_{1,h}+x_{2,h}+\dots +x_{n,h}=\sum _{i=1}^n{x}_{i,h}\hfill \end{array}$$

(15)

In (15), $h=1$ is explicitly set to indicate that all potentially compromised PMUs are contained in partition ‘1’. This smaller partition is denoted by sub-graph ${\mathcal{G}}^{\prime }\subseteq \mathcal{G}$. When combined with the additional objectives described in Section V, the optimization problem in (15) isolates all possible vulnerable PMUs in a single island while creating stable partitions.

4.2. Objective 2: Maximize Island Observability

We introduce an additional objective to maximize the observability of the newly formed islands. Buses may lose observability when multiple lines are disconnected during islanding [26]. An observability decision matrix is defined as,

$$\mathit{Z}=\mathrm{diag}\left(z_{i,j}\right)\forall (i,j)\in {\mathcal{Z}}_{\setminus S}$$

(16)

where $z_{i,j}$ is described in (1). The decision matrix $\mathit{Z}$ takes into account the impact of physical line disconnection on system observability. The optimization problem is defined as maximizing the $\mathrm{trace}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right)$, where H is the topological observability matrix described in (7). This problem is similar to (10) defined in Section 3.1.

5. Stability Objectives and Islanding Constraints

5.1. Stability Objectives

For Scenario 1 and Scenario 2, additional objectives are considered to maintain the load-generation balance and the transient stability of the system.

Consider $P_i$ as the net power injected at node i. Minimizing the load-generation imbalance in each island is defined as [32],

$$\begin{array}{cc}\hfill & \hfill {\tilde{F}}_4=\sum _{h=1}^K\left|\sum _{i=1}^n{P}_i{x}_{i,h}\right|\hfill \end{array}$$

(17)

To tackle the absolute values, the equation in (17) is written as a linear program by introducing slack variables. Let the slack variable $S_h={\sum }_{i=1}^n{P}_i{x}_{i,h}$ denote the mismatch in island h. Hence, (17) can be written with additional constraints as,

$$\begin{array}{cc}\hfill F_4=& \hfill \sum _{h=1}^k{S}_h\hfill \end{array}$$

(18a)

$$\begin{array}{cc}\hfill & \hfill \sum _{i=1}^n{P}_i{x}_{i,h}\ge -S_h\hfill \end{array}$$

(18b)

$$\begin{array}{cc}\hfill & \hfill \sum _{i=1}^n{P}_i{x}_{i,h}\le S_h\hfill \end{array}$$

(18c)

Balanced islands prevent frequency excursions, minimize load interruption, and reduce dependence on black-start units.

On the other hand, minimizing the line power flow disconnection prevents the creation of islands with a negative transient stability margin and avoids system collapse [3]. The objective function for the total line power flow disconnection is defined as [6],

$$\begin{array}{cc}\hfill F_5=& \hfill \sum _{(i,j)\in \mathcal{Z}}\frac{1}{2}(1-z_{i,j})P_{i,j}\hfill \end{array}$$

(19)

5.2. Identifying Coherent Generators

While securing the power grid from compromised PMU measurements is critical, an islanding solution should consider the dynamic stability of the system. The dynamics of the system are considered by grouping coherent generator clusters together [33]. The steps to identify the coherent generators, while not the focus of this paper, are briefly outlined below. Due to space limitations, the readers are referred to our previous work in [32] for more details.

First, different fault scenarios are simulated, and the generator rotor angle data are obtained. Typically, generators close to the fault location have fast non-coherent motion while those further away exhibit slow coherent motions [33]. Next, a hierarchical clustering method is employed on rotor angle time-series data to group the slow coherent motions. The similarity in characteristics of the time-series data is computed using the correlation metric—machines that exhibit coherency have higher rotor angle correlations. The closeness between generator clusters is evaluated based on the shortest distance between two points in each cluster. When groups of generators have a large inter-cluster distance, they are identified as separate set of coherent generators. In this paper, two and four coherent sets of generators are considered for controlled islanding.

5.3. Partitioning and Connectivity Constraints

The binary variables $z_{i,j}$ and $x_{i,h}$ are coupled through another binary variable $w_{i,j,h}$ as [6],

$$\begin{array}{cc}\hfill & \hfill z_{i,j}=\sum _h{w}_{i,j,h}\hfill \end{array}$$

(20)

$$\begin{array}{cc}\hfill & \hfill w_{i,j,h}\le x_{i,h}\hfill \end{array}$$

(21)

$$\begin{array}{cc}\hfill & \hfill w_{i,j,h}\le x_{j,h}\hfill \end{array}$$

(22)

$$\begin{array}{cc}\hfill & \hfill z_{i,j}=z_{j,i}\hfill \end{array}$$

(23)

The constraint restricting a node to a single island is given by,

$$\begin{array}{cc}\hfill & \hfill \sum _h{x}_{i,h}=1\hfill \end{array}$$

(24)

Additionally, ensuring at least M nodes are present in an island is enforced by the constraint,

$$\begin{array}{cc}\hfill & \hfill \sum _{i\in \mathcal{N}}{x}_{i,h}\ge M\hfill \end{array}$$

(25)

For each island h, one bus j is designated as a source node to: (a) act as a reference bus for state estimation, and (b) ensure islands are connected. The source node is set as,

$$\begin{array}{cc}\hfill & \hfill u_{j,h}=1j\in {\mathcal{N}}_s\hfill \end{array}$$

(26)

To ensure the islands are connected, an arbitrary network flow variable $f_{i,j,h}\in \mathbb{R}$ is defined as,

$$\begin{array}{cc}\hfill & \hfill 0\le f_{i,j,h}\le n{z}_{i,j}\hfill \end{array}$$

(27)

The source variable and the connectivity flow variable together ensure that the optimization problem yields connected islands by exploiting basic network flow concepts. If a unit flow $f_{i,j,h}$ is sent from $u_{j,h}$ to each node in area h and if each node consumes one unit flow (with $f_{i,j,h}$ and $f_{j,i,h}$ being the node inflow and outflow, respectively), islands are connected when,

$$\begin{array}{c}\hfill u_{j,h}\sum _{i\in \mathcal{N}}{x}_{i,h}-x_{j,h}+\sum _{\begin{array}{c}i,j\in \mathcal{N},\\ (i,j)\in \mathcal{Z}\end{array}}{f}_{i,j,h}=\sum _{\begin{array}{c}i,j\in \mathcal{N},\\ (j,i)\in \mathcal{Z}\end{array}}{f}_{j,i,h}\end{array}$$

(28)

6. Multi-Objective Optimization

The two islanding strategies under cyberattack uncertainties are formulated as multi-objective optimization problems, which find pertinent trade-offs between all the aforementioned objective functions. The multi-objective optimization problem for Scenario 1 is written as,

$$\begin{array}{cccc}\hfill & \hfill \mathrm{minimize}\hfill & \hfill & F=[F_1,F_2,F_4,F_5]=\hfill \\ \hfill & \hfill \hfill & & [-\underset{\mathrm{observability}}{\underbrace{\mathrm{trace}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right),}}\underset{\mathrm{retained}\mathrm{PMUs}}{\underbrace{\sum _{(i,j)\in {\mathcal{Z}}_{\setminus S}}{\beta }_i{d}_{i,j},}}\hfill \\ \hfill & \hfill \hfill & & \underset{\mathrm{imbalance}}{\underbrace{\sum _{h=1}^k{S}_h}},\underset{\mathrm{power}\mathrm{flow}\mathrm{disconnection}}{\underbrace{\sum _{(i,j)\in z}\frac{1}{2}(1-z_{i,j})P_{i,j}}}]\hfill \\ \hfill & \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill & \hfill \left(3\right)\text{–}\left(5\right),\left(13\right),\left(18\mathrm{b}\right)\text{–}\left(18\mathrm{c}\right),\left(20\right)\text{–}\left(28\right)\hfill \end{array}$$

(29)

Here, $d_{i,j},v_{i,j},z_{i,j},x_{i,h},w_{i,j,h}\in \{0,1\}$ and $S_h,f_{i,j,h}\in \mathbb{R}$ are the optimization decision variables. Similarly, the multi-objective optimization problem for Scenario 2 is written as,

$$\begin{array}{cccc}\hfill & \hfill \mathrm{minimize}\hfill & \hfill & F=[F_1,F_3,F_4,F_5]=\hfill \\ \hfill & \hfill \hfill & & [-\underset{\mathrm{observability}}{\underbrace{\mathrm{trace}\left({\mathit{H}}^{\mathit{T}}\mathit{ZH}\right),}}\underset{\mathrm{island}\mathrm{size}}{\underbrace{\sum _i{x}_{i,h=1},}}\hfill \\ \hfill & \hfill \hfill & & \underset{\mathrm{imbalance}}{\underbrace{\sum _{h=1}^k{S}_h}},\underset{\mathrm{power}\mathrm{flow}\mathrm{disconnection}}{\underbrace{\sum _{(i,j)\in z}\frac{1}{2}(1-z_{i,j})P_{i,j}}}]\hfill \\ \hfill & \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill & \left(18\mathrm{b}\right)\text{–}\left(18\mathrm{c}\right),\left(20\right)\text{–}\left(28\right)\hfill \end{array}$$

(30)

Here, $z_{i,j},x_{i,h},w_{i,j,h}\in \{0,1\}$ and $S_h,f_{i,j,h}\in \mathbb{R}$ are the optimization decision variables. Any optimal solution for (29) and (30) is a Pareto optimal (non-dominated) solution. Due to the competing nature of the objectives, no ideal solution exists that simultaneously minimizes every objective. The choice of an acceptable solution depends on the preference of the reliability coordinator overseeing the islanding.

6.1. Solution Approaches

The multi-objective optimization problems are solved using different methods [34], as shown in

Table 1. Multi-objective Optimization Solution Methods.

Solution	Formulation
Hierarchical	$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill F_{i}i=1,\dots ,4\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill F_j\le F_j^{*}+{\eta }_{j}j=1,\dots ,i-1\hfill \end{array}$
Weighted-sum	$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill {\sum }_{i=1}^4{\gamma }_i{F}_i\hfill \end{array}$
$ϵ$-constraint	$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill {\sum }_i{\gamma }_i{F}_i+{\sum }_j{\rho }_j{F}_{j}i\ne j\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill F_j\le {ϵ}_{j}j=1,\dots ,i-1,i+1,\dots 4\hfill \end{array}$
Weighted Chebyshev	$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill b+{\sum }_{j=1}^4{\rho }_j{F}_j\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill {\gamma }_i[F_i^{*}-F_i]\le bi=1,\dots ,4\hfill \end{array}$
Benson	$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill {\sum }_{i=1}^4{b}_i\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill F_i^0-F_i=b_{i}i=1,\dots ,4\hfill \end{array}$

, categorized into two types—(1) hierarchical and (2) scalarization.

The hierarchical approach assigns objective priorities and solves each objective iteratively and is given as,

$$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill F_{i}i=1,\dots ,4\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill F_j\le F_j^{*}+{\eta }_{j}j=1,\dots ,i-1\hfill \end{array}$$

(31)

The tolerance ${\eta }_j$ allows for defining optimal solution degradation. For example, let minimizing load-generation imbalance be of high priority and maximizing the $\mathrm{rank}$ be of low priority. Let the optimal solution for minimizing load-generation imbalance be 20 MW. When the solution degradation ${\eta }_1=5$ MW, the optimization problem will tolerate a non-optimal solution of $20+5=25$ MW or better for the imbalance while maximizing $\mathrm{rank}$.

The scalarization processes are classified into methods that specify (1) a posteriori or (2) a priori articulation of preferences, respectively [35]. Posteriori techniques, such as weighted sum and ϵ-constraint approaches, find a wide range of solutions with different trade-offs. A priori approaches [35], such as Chebyshev’s and Benson’s, incorporate a reference point representing a solution that the operator aspires.

The weighted sum approach captures the relative importance among all objectives $F_i$ through operator-specified weights ${\gamma }_i>0$ as,

$$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill \sum _{i=1}^4{\gamma }_i{F}_i\hfill \end{array}$$

(32)

The ϵ-constraint approach transforms trivial objectives into bounded constraints with operator-specified tolerances and optimizes only the most critical objective(s) as,

$$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill \sum _i{\gamma }_i{F}_i+\sum _j{\rho }_j{F}_{j}i\ne j\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill F_j\le {ϵ}_{j}j=1,\dots ,i-1,i+1,\dots 4\hfill \end{array}$$

(33)

The tolerances reflect the extent the system operators can relax the objectives without incurring significant risks. Extremely tight tolerances may result in an empty feasible space.

The weighted Chebyshev’s approach minimizes the maximum weighted difference between the current solution and a reference point $F_i^{*}$ as,

$$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill b+\sum _{j=1}^4{\rho }_j{F}_j\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill {\gamma }_i[F_i^{*}-F_i]\le b,i=1,\dots ,4\hfill \end{array}$$

(34)

The reference solution is considered the best solution each objective can achieve in the feasible region, and Chebyshev’s approach aims to find the closest solution to this ideal solution [34]. The term ${\sum }_j{\rho }_j{F}_j$, with a small positive scalar ${\rho }_j$, ensures a strict non-dominated solution.

For Benson’s approach, the system operator selects a non-optimal reference point $F_i^0$ as,

$$\begin{array}{cc}\hfill \mathrm{minimize}\hfill & \hfill \sum _{i=1}^4{b}_i\hfill \\ \hfill \mathrm{subject}\mathrm{to}\hfill & \hfill F_i^0-F_i=b_i,i=1,\dots ,4\hfill \end{array}$$

(35)

Benson’s approach then generates a Pareto-optimal solution that is farthest away from the dominant reference solution [34].

A combination of cutting planes and branch-and-bound method [36] is used to solve the mixed integer optimization problem in (29) and (30). In this process, all integer variables are first relaxed, and valid inequalities are generated to constrain the feasible solution set such that the extreme points are binary. The feasible region is then divided into subsets, and the optimization problem is solved for each subset. The optimality gap is set to zero to ensure both the linear relaxations of the integer problem and the dual of the relaxation have feasible integral solutions. For more details on generating valid inequalities, the readers are referred to [37].

By varying (a) the scalarization parameters, (b) the objective priority, and (c) the objective degradation tolerances, the system operators may obtain a wide range of solutions for the islanding problem.

6.2. Improving Computation Time

Controlled islanding is a general graph partition problem that is NP-hard, i.e., there exists no known algorithm to solve the problem in polynomial time [7]. Three steps are taken to improve the computation time. First, assuming the available blackstart capability, the objective function to minimize the total load-generation imbalance in each island in (18) is converted into an inequality constraint as ${\sum }_{h=1}^k{S}_h\le {ϵ}_{\mathrm{load}}$. Similarly, the objective function in (15) is converted to a constraint ${\sum }_{i=1}^n{x}_{i,h=1}\le {ϵ}_{\mathrm{size}}$ to ensure that the maximum size of the island with vulnerable PMUs is limited to a pre-determined fraction of the entire system. Second, when information on power system components not affected by cyber-attacks (such as nodes with secure PMUs) is available, such components are pre-assigned as not vulnerable. Pre-assignment of buses has been shown to drastically reduce the computation time [6]. Third, the integrality constraints on some or all binary variables are relaxed until binary solutions are obtained.

7. Case Studies

Under complete and partial uncertainty, the developed controlled islanding strategies are tested on the synthetic Illinois 200-bus, South Carolina 500-bus, and Texas 2000-bus systems [38]. A branch-and-cut approach [36] is employed to solve the multi-objective mixed-integer program in Gurobi on an Intel(R) i5-4460, 3.20 GHz with 16 GB RAM.

7.1. Test Case and Parameter Setup

Most digital relays these days are equipped with PMUs (e.g., widely used Schweitzer Engineering Laboratories relays). Hence, it is reasonable to assume a certain availability of PMU measurements throughout the system in the near future [39,40,41]. With this assumption, the power system network is made observable through optimal PMU placement schemes [42]. We consider two schemes to demonstrate the applicability of the developed approach under a diversity of PMU placements: (1) each bus is observed at least once, and (2) each bus is observed at least twice to protect against the loss of a single PMU [43]. The detailed case descriptions, including the total number of secure and non-secure PMUs, are summarized in

Table 2. Details of the Studied Test Cases.

System	Load	Gen	# Secure	# Non-Secure	# Non-Secure
	(MW)	(MW)	PMUs	PMUs (Obs = 1)	PMUs (Obs = 2)
200	1750	1765	25	46	130
500	7750	7832	63	176	394
2000	67,109	68,728	132	589	1247

. The weights ${\gamma }_i$ associated with the four objectives, and tolerances ${ϵ}_{\mathrm{load}}$ and ${ϵ}_{\mathrm{size}}$ are given in

Table 3. Scalarization Parameters.

System	${\mathit{\gamma }}_1$	${\mathit{\gamma }}_2$	${\mathit{\gamma }}_3$	${\mathit{\gamma }}_4$	${\mathit{ϵ}}_{\mathbf{load}}$	${\mathit{ϵ}}_{\mathbf{size}}$
200	0.1	1	1	1	10	40
500	0.01	1	1	1	30	50
2000	0.01	0.1	1	1	50	350

. The reference solutions for Chebyshev’s and Benson’s approach are given in

Table 4. Reference Solutions for Chebyshev’s Approach.

System	Rank	Size (${\mathcal{G}}^{\prime }) *$	Imbalance (MW)	Flow Out (MW)
200	412	29	0	28.03
500	1000	80	10	400.0
2000	4232	303	0	5373.29

* Size (${\mathcal{G}}^{\prime })$ refers to the size of the island with vulnerable PMUs.

and

Table 5. Reference Solutions for Benson’s Approach.

System	Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)
200	400	50	20	50
500	1000	200	350	2000
2000	4000	400	20	7000

, respectively. All ${\beta }_i$ are set to 1 assuming no prior information on attack is available.

7.2. Performance of Controlled Islanding under Complete Uncertainty

For Scenario 1 under complete uncertainty, the observability of islands is maximized using a minimum number of non-secure PMUs, while maintaining island stability. The power system network is divided into two or four islands based on two coherent sets of generators [32]. With no prior information on false data, each non-critical PMU is assumed equally vulnerable, and the corresponding weights ${\beta }_i$ are set to one.

7.2.1. Partitioning into Two Islands

The hierarchical approach in Table 1 is used to solve the problem. Figure 3 and Figure 4 demonstrate the performance of the islanding strategy developed for systems where each node is observed by a single PMU or by at least two PMUs, respectively. The following observations are noted. For all three systems in Figure 3, retaining $100\%$ of non-secure PMUs does not ensure full observability after islanding, i.e., a $100\%$ rank is not achieved, because lines disconnected result in loss of observability. On the other hand, the disconnected lines during islanding in Figure 4 do not result in a loss of observability due to the presence of redundant PMU measurements. For the same reason, as the number of retained non-secure measurements is decreased, the system observability decreases at a steeper rate in Figure 3 compared to Figure 4.

The hierarchical optimization allows assigning individual importance to objectives during the islanding process. Consider one case for the 200 bus system—when maintaining transient-stability has a higher priority, the line flow disconnection is $240.05$ MW at the expense of $348.62$ MW of load-generation imbalance. When maintaining load-generation balance has a higher priority, the islands have a $17.57$ MW imbalance, and $437.61$ MW line flow is disconnected. Similar results are noted for the 500-bus and 2000-bus systems. This demonstrates that a small number of non-secure PMUs can maximize the island observability while maintaining island stability. Once selected PMUs are retained, the actual PMU measurements can now be used to obtain the steady state bus voltage and angle estimation for the smaller partitions. The dynamic stability of the islands is later investigated in Section 7.4.

7.2.2. Partitioning into Multiple Islands

The hierarchical optimization approach is extended to cases where the system is partitioned into multiple smaller islands where each bus is observed only once. Consider the 200-bus system with the set of coherent generators given in [32]. The multi-objective optimization is solved and the system is partitioned into 4 islands. In this case, the objective degradation for $\mathrm{rank}$ is set to 10, which allows the later objectives to degrade the earlier objective of $\mathrm{rank}$ off its optimal value by 10.

Table 6. Hierarchical optimization for the 200-bus system: 4 islands.

Optimal Solution [Priority, Degradation]
Rank	% Meas Retained	Imbalance (MW)	Flow Out (MW)
	(Non-Secure)	$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|+|{\mathit{S}}_{\mathbf{3}}|+|{\mathit{S}}_{\mathbf{4}}|$
173 [3, 10]	100 [4, 0]	445.48 [2, 0]	294.15 [1, 0]
178 [1, 10]	100 [4, 0]	675.52 [2, 0]	428.09 [3, 0]
163 [3, 10]	93.33 [4, 0]	17.57 [1, 0]	527.98 [2, 0]

summarizes the results of islanding considering different objective priorities. Similar observations to Section 7.2.1 are noted. Consider the case when the highest priority is assigned to $\mathrm{rank}$ in row 2, a total of 178 buses remain observable, while $100\%$ non-secure measurements are retained. As observed previously, the reduction in the number of observable buses occurs due to increase in the number of multiple line disconnections when creating more islands.

7.3. Performance of Controlled Islanding under Partial Uncertainty

For Scenario 2 under partial knowledge of an attack, the size of the island with vulnerable PMUs is minimized while maximizing observability, steady-state, and transient stability. The redundant PMU placement is considered for the studies.

7.3.1. Identification of Attack Buses

First, potential attackable nodes are identified following the approach in [13]. For the 200-bus, 500-bus, and 2000-bus systems, the load injection nodes $\{17,18\},\{100,101\}$, and $\{657,663\}$ are identified to be under attack. Next, all neighboring PMUs at a distance of $R=3$ are labeled as vulnerable. The parameter R can be tuned when more information on the extent of attack becomes available. The dependency of the island size on the value of R is illustrated later in Section 7.3.4. Depending on the distribution of zero injection buses in the network, a total of $27,9$, and 19 buses are initially designated as untrustworthy for the $200,500$, and 2000-bus systems, respectively. The total number of buses flagged as potentially vulnerable will vary when different candidate nodes are chosen for attack. A wide range of solutions are obtained by varying the objective priority and the degradation tolerance of the solution using the hierarchical optimization approach.

7.3.2. Partitioning into Two Islands

The solutions obtained by varying the objective priority and the degradation tolerance are summarized in

Table 7. Scenario 2: Hierarchical optimization for a 200-bus system.

Optimal Solution [Priority, Degradation]
Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)	Time (s)
		$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
196 [3, 0]	42 [2, 0]	9.80 [4, 0]	28.03 [1, 0]	0.27
197 [3, 0]	29 [2, 0]	32.3 [4, 0]	54.16 [1, 50]	0.36
197 [3, 0]	38 [2, 0]	0.07 [4, 10]	35.76 [1, 50]	0.69

,

Table 8. Scenario 2: Hierarchical Optimization for a 500-bus system.

Optimal Solution [Priority, Degradation]
Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)	Time (s)
		$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
499 [3, 0]	107 [2, 0]	649.16 [4, 0]	649.16 [1, 0]	0.19
500 [1, 0]	196 [3, 0]	1610.0 [4, 0]	1465.1 [2, 0]	0.30
498 [2, 0]	11 [1, 0]	124.22 [4, 0]	867.36 [3, 0]	0.15

and

Table 9. Scenario 2: Hierarchical Optimization for a 2000-bus system.

Optimal Solution [Priority, Degradation]
Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)	Time (s)
		$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
1979 [4, 0]	312 [1, 0]	370.5 [2, 0]	8519.1 [3, 0]	511.5
1980 [4, 0]	352 [1, 40]	0.01 [2, 0]	5650.4 [3, 0]	131
1891 [4, 0]	351 [1, 40]	8.9 [2, 10]	5526.9 [3, 0]	3.4

. First, Table 7 illustrates the effect of optimal solution degradation. Compare rows $1\mathrm{and}3$ of Table 7. With an objective degradation tolerance of 50 MW for flow disconnection and 10 MW for load-generation imbalance in row 3, the size of the uncertain island ${\mathcal{G}}^{\prime }$ decreases from 42 to 38, and the imbalance improves from $9.8$ MW to $0.07$ MW. The improvements, come at the expense of a $7.7$ MW increase in flow outages. The system remains $98\%$ observable (as seen from $\mathrm{rank}$) in both cases. Similar observations are noted in Table 9 for the 2000-bus system.

The impact of objective prioritization is explored in Table 8 for the 500-bus system. Here, the priority $=1$ corresponds to the objective of the highest importance, and the priority $=4$, the lowest. Consider row 1 in Table 8—$649.16$ MW line power flow is disconnected because the top priority is to minimize the total flow disconnection. When maximizing observability is of interest in row 2, complete observability is maintained at the expense of large islands with uncertain PMUs, a significant imbalance of 1610 MW, and a large power flow disconnection of 1465 MW. When isolating attack is the top priority in row 3, the vulnerable PMUs are contained in an island of $2.2\%$ of the entire system. However, such a small island may not survive independently without generators. Hence, a suitable prioritization between the four objectives is necessary to maintain island stability. This example shows the flexibility of designing islands that cater to a particular need during islanding. The dynamic stability of the islands is investigated in Section 7.4.

The solutions obtained from the hierarchical optimization approach are compared to different scalarization methods. Here, Scenario 2 is considered for comparison purposes. The results of the scalarization methods, using the parameters in Table 3, Table 4 and Table 5, are summarized in

Table 10. Scenario 2: Scalarization Results for the 200-Bus System.

Scalarization	Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)
			$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
Weighted-Sum	197	38	0.07	35.76
$ϵ$-Constraint	196	39	2.93	34.98
Chebyshev	197	38	0.07	35.76
Benson	197	38	0.07	35.76

,

Table 11. Scenario 2: Scalarization Results for the 500-Bus System.

Scalarization	Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)
			$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
Weighted-Sum	499	111	3.7	850.82
$ϵ$-Constraint	498	116	12.69	847.07
Chebyshev	498	113	26.69	833.83
Benson	499	111	3.7	850.82

and

Table 12. Scenario 2: Scalarization Results for the 2000-Bus System.

Scalarization	Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)
			$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
Weighted-Sum	1982	375	2.0	5470.56
$ϵ$-Constraint	1982	350	24.72	5513.70
Chebyshev	1979	340	1.85	5727.20
Benson	1980	353	0.02	5501.86

. As an example, Figure 5 illustrates the two partitions corresponding to row 1 of Table 10.

7.3.3. Partitioning into Multiple Islands

The problem of partitioning the system into multiple smaller islands is considered next. Four coherent generator groups are assumed to exist for the 200-bus system [32]. The group of vulnerable buses was chosen to be $17,18,19,20,21,39,83,85,109,120,134,186$. This group was assigned to the closest coherent generator set based on electrical distance. Figure 6 illustrates the four partitions obtained using the weighted-sum scalarization process. It is observed that the size of the island with vulnerable buses is now $28.5\%$ of the entire system. The increase in size is attributed to assignment of coherent generators and, subsequently, additional nodes to yield lower load-generation imbalance. The remaining three islands have low MW imbalances. A total of 494 MW of line flow is disconnected while 191 buses remain observable.

7.3.4. Effect of Attack Radius R on Size of Vulnerable Island

The design of islands is further investigated considering different attack radius R. Quite often, the actual extent to which the attack has compromised the PMU network may not be accurately determined under rapidly evolving power system situations in real-time.

Table 13. Effect of attack radius R on the size of vulnerable islands: 200-bus system.

Optimal Solution [Priority, Degradation]
R	Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)	Time (s)
			$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
3	198	66	3.94	107.93	0.71
4	198	85	1.82	108.99	0.57
5	196	103	2.78	126.12	0.42
6	196	110	11.96	116.93	0.33
7	196	120	8.74	257.32	0.27

and

Table 14. Effect of R on size of vulnerable island: 500-bus system.

Optimal Solution [Priority, Degradation]
R	Rank	Size (${\mathcal{G}}^{\prime }$)	Imbalance (MW)	Flow Out (MW)	Time (s)
			$|{\mathit{S}}_{\mathbf{1}}|+|{\mathit{S}}_{\mathbf{2}}|$
2	500	7	153.28	385.91	3.31
3	497	206	5.64	378.62	1.19
4	498	254	4.02	449.39	5.16
5	500	258	19.96	1266.38	1.68

illustrate the size of the vulnerable island under different values of R. With larger R, more buses are deemed vulnerable. While a very large value of R is impractical, more reasonable values can be obtained by identifying the underlying architecture of the PMU-PDC communication network between different areas.

The results conducted on the test systems in this section demonstrate that the proposed recovery scheme effectively isolates attacks while creating stable and observable islands. The optimal islanding decisions ultimately depend on how operators choose to strike a balance between multiple competing objectives.

7.4. Dynamic Simulations

To avoid a total system blackout, it is necessary to ensure the smaller islands are transient stable during controlled islanding. While the objective function in Equation (19) prevents disconnections of lines with large power flow [3], it is important to assess the transient stability of the newly formed islands through time-domain simulations (TDS). The TDS are performed using DSATools^TM and the Transient Stability Index (TSI) of the smaller partitions are reported. The TSI of the system is calculated as [44],

$$\mathrm{TSI}=\frac{360-{\delta }_{\max }}{360+{\delta }_{\max }}\times 100$$

(36)

where ${\delta }_{\max }$ represents the maximum angle difference between any two generators in an island at any particular time. Here, TSI is generally considered as the smallest index among all islands in the system. In this paper, transient studies are performed on the 200-bus and the 500-bus systems.

For Scenario 1, Figure 7 and Figure 8 illustrate the transient stability through time-domain simulations. Figure 7a,b show that the generator rotor angles in both islands are transient stable. The frequency of the islands in Figure 7c are $60.03$ Hz and $59.96$ Hz, respectively. These deviations are caused by imbalances of $183.11$ MW and $165.51$ MW in islands 1 and 2, respectively. Furthermore, the bus voltages in Figure 7d are within the acceptable limits of $0.90$ p.u. and $1.1$ p.u. Similar observations are noted for the 500-bus system in Figure 8.

For Scenario 2, Figure 9 and Figure 10 illustrate the transient stability results. Figure 9a,b show that the generator rotor angles in both islands are stable. The frequency of the islands in Figure 9c are $60.01$ Hz and $59.99$ Hz, respectively. Furthermore, the bus voltages in Figure 9d are well within the acceptable limits of $0.90$ p.u. and $1.1$ p.u. The transient stability indices, obtained using DSATools${}^{\mathrm{TM}}$ time-domain simulations, are summarized in

Table 15. Transient Stability Index.

System	Scenario 1	Scenario 2
	Hierarchical	Weighted Sum	$\mathit{ϵ}$- Constraint	Chebyshev	Benson
200-bus	75.71	76.55	74.47	76.55	76.55
500-bus	72.38	62.16	58.59	61.20	62.14

.

The results for partitioning the system into four smaller islands, corresponding to Figure 6, are demonstrated in Figure 11 and Figure 12. The rotor angles in Figure 11 and the frequency in Figure 12a demonstrates the dynamic stability of the four smaller partitions. However, it is observed in Figure 12b that few buses have low voltages post partition. Corresponding to Figure 6, buses with low voltage are $59,74,138,139,171,190,195,196$, and 197 in island 1 and $7,8,43,86,110,112,116,117,132,141,144,148$, and 162 in island 4. The buses with low voltages are shown in Figure 12c. The cause of low voltages on these two neighboring clusters of buses is attributed to the following—(1) there is a lack of local reactive power production in these two clusters, and (2) a total of $29.32$ MVAR of reactive power flow is disconnected during islanding. There are two possible mitigation strategies to overcome this problem—(1) incorporate a reactive power term in the objective function of the optimization problem for controlled islanding [4], or (2) reduce the MVAR load post islanding. As demonstrated in [4], incorporating additional objectives solves the reactive power problem, however, for our study, this increases the number of objective functions to five, which may become difficult for the operator to optimize. Instead, post islanding MVAR load shedding is employed near the affected buses after which voltages return to near nominal values as shown in Figure 12d.

These results demonstrate that the optimization problem can successfully create stable partitions while minimizing the impact of attacks.

Irrespective of which optimization algorithm the operator uses, the proper way for system operators to use the results of the optimization are as follows: (1) The set of transmission lines to be disconnected for controlled islanding is the output of the optimization problem. (2) All circuit breakers (CB), installed on two ends of the candidate lines, are then identified. These circuit breakers can be directly controlled by the operator through relays at the local user interface or at the remote control center. (3) Multiple CB can be tripped from SCADA, the communication protocol being the Distributed Network Protocol 3 (DNP3) protocol. In general, the DNP3 outstation runs on substation relay, in this case, PMU such as SEL 421 [45]. On the other hand, the DNP3 Master is on SCADA. The remote circuit breaker trip commands to go from the DNP3 master to the substation relay through the communication path comprising the SCADA gateway router and the substation gateway. (4) Once the breakers are opened and the system is partitioned into smaller islands, the operators can use real-time PMU measurements from selected devices to estimate the steady states of the islands using SE.

7.5. Computation Time

The computation times for the hierarchical optimization are summarized in Table 7, Table 8 and Table 9 while those for the scalarization approaches are given in

Table 16. Simulation Time (s) with and without Relaxation.

System	200-bus		500-bus		2000-bus
Relaxation	No	Yes	No	Yes	No	Yes
Weighted Sum	0.07	0.05	0.43	0.21	69.96	0.70
$ϵ$-Constraint	0.00	0.00	13.01	0.60	10.00	1.58
Chebyshev	0.15	0.00	1.68	0.44	148.82	2.85
Benson	0.15	0.033	1.61	0.28	14.64	6.72

. The comparison demonstrates that hierarchical approaches often lead to more solution time for large systems, because the hierarchical technique solves multiple single-objective problems iteratively. However, the provision for optimal solution degradation makes the hierarchical approach particularly attractive for larger power systems when prompt islanding decisions are needed at the expense of non-optimal but acceptable solutions.

Table 9 illustrates the effect of solution degradation in reducing the computation time from 511 s to $3.4$ s for the 2000-bus system—a reduction of almost 99% at the expense of $4.45\%$ decrease in observability and $8.9$ MW increase in imbalance. Solution degradation offers similar flexibility as the $ϵ$-constraint approach. This makes the hierarchical process more intuitive as preferences on objectives are assigned according to their importance. In contrast, the correct choice of weights in scalarization methods may not be readily determined unless multiple optimizations are solved. Furthermore, the reference solutions for Chebyshev and Benson’s approach have to be pre-determined, which may not be feasible during the fast islanding process. A drawback of the hierarchical technique is that the number of additional constraints imposed in each iteration increases as the number of objectives increases. However, this is of little concern as the number of objectives is limited to four in this paper. Overall, the hierarchical approach offers greater flexibility in designing islands in a very short period at the expense of non-optimal but acceptable solutions.

To further improve the solution time, the integrality constraints are relaxed. For example, when variables $z_{i,j}$ and $w_{i,j}$ are relaxed in the 200-bus system, binary solutions are promptly obtained. Similarly, $z_{i,j}$ is relaxed for the 500 and the 2000-bus systems. The computation times with these relaxations are given in Table 16.

Overall, the time from initiation to completion of the recovery process can be determined as follows. For Scenario 1, in the absence of any attack information, system operators may doubt the fidelity of the data depending on the evolution of steady-state failures, which may take dozens of minutes [46]. For Scenario 2, partial knowledge on compromised data may be obtained in sub-seconds, assuming a learned (data-driven) offline model is already available [14]. The time to solve the optimization problem developed in this paper is less than a second to a few seconds (from Section 7.5). Finally, assuming that the line open status signals are sent to the correct set of circuit breakers, it will take a few cycles (incorporating communication delays) for the circuit breakers to respond to the islanding commands.

7.6. Comparison of Multiple Solutions

Figure 13 demonstrates Pareto-optimal solutions for the 200-bus and the 500-bus systems. The approach introduced in this paper allows system operators to create islands considering a broad spectrum of choices, which affects the islands’ operation. For example, a loss of substantial MW flow disconnection negatively impacts the transient stability of the system, thereby increasing the chances of further outages. On the other hand, low observability increases dependency on pseudo-measurements and yields poor state estimation results. Furthermore, a higher load-generation imbalance results in load loss, large frequency excursions, and increased reliance on black-start units.

7.7. Limitations

The first limitation arises when attacks are distributed and span multiple regions. In such scenarios, isolating vulnerable PMUs in one single island is not desired. While such large-scale distributed attacks are rare due to the inherent security measures of the electric grid, they are not impossible given a large attacker budget. The developed method can be extended to create multiple smaller islands to isolate attacks. However, this approach comes at the expense of an increase in the number of binary variables, longer computation times, and difficulties in the coordination of multiple smaller islands. This work makes a practical assumption where different power system areas have different cyber security policies, and considers attacks against single cyber security architecture, thereby isolating all potential vulnerable nodes in a single island.

The second limitation arises when ample integration of renewables introduces new sets of dynamic stability constraints to the power system. We acknowledge that this limitation cannot be solely tackled by enclosing coherent synchronous generators in one island. Controlled islanding with renewables is a separate problem related to islanding itself and is currently outside the scope of this paper.

In the future, we will explore approximation algorithms [47] to further reduce the complexity of the optimization problem. These approximation techniques can help find near-optimal solutions and accelerate computation times when a prompt and reliable islanding solution is desired. Moreover, the set of candidate lines for controlled islanding depends on real-time system conditions and is not fixed. Additional studies leveraging the line topology status are needed to ensure that the line open signal is sent to the correct breakers during partitioning.

8. Conclusions

This paper presents controlled islanding methods that incorporate different degrees of uncertainty in PMU measurement. Uncertainties are considered under the lack of or partial information on the reliability of PMU measurements originating from sophisticated false data injection attacks. When attacks remain undetected, the impact of measurements in each island is minimized by creating islands that require a minimal number of PMU measurements for a state estimation solution. This allows system operators to allocate additional security to a minimum number of nodes on the network, thus improving recovery plans. When partial information on bad data is available, the impact is minimized by isolating vulnerable PMUs in a single island. This prevents malicious attacks from spreading to larger sections of the grid.

The major findings of this paper are summarized as follows.

• Under complete attack uncertainty with different numbers of PMUs in the original system, it was observed that redundant PMUs played a major role in retaining more observable sections of the newly formed islands.
• Under partial attack uncertainty, it was found that a smaller island was sufficient to isolate all vulnerable PMUs into a single region.
• Various multi-objective optimization methods are compared based on the number of iterations, number of parameters, optimal solution, and the total run time. It was found that the hierarchical approach is particularly attractive in providing acceptable controlled islanding solutions incorporating objective priority and optimal solution degradation when considering multiple competing objectives.
• It was observed that partitioning the power system into multiple smaller islands using the proposed approach created partitions with sufficient steady-state and transient stability margins and maximal observability.
• Lastly, it was found that accurate islanding solutions were obtained when integral constraints on some binary variables were relaxed in the optimization problem and certain objective functions were converted into bounded constraints, thereby reducing computation time.

Our findings demonstrate that it is feasible to successfully limit the impact of bad PMU data while creating islands. The developed approach offers considerable flexibility to operators in designing islands that cater to a particular objective. The improvements in traditional islanding address post-incident analysis, enable quick recovery, and ensure continuity of grid operations. Such a consistent and collaborative approach will help contain threats and help power utilities minimize operational losses and financial threats in the face of contingencies. In the future, additional studies will be conducted to incorporate communication delays in circuit breaker operations, incorporate dynamic stability constraints due to renewables, and further improve the computation time of controlled islanding.