Impact of Data Quality on Real-Time Locational Marginal Price

Transcription

1 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 1 Impact of Data Qualty on Real-Tme Locatonal Margnal Prce Lyan Ja, Jnsub Km, Robert J. Thomas, Lfe Fellow, IEEE, and Lang Tong, Fellow, IEEE arxv:11.666v [math.na] 30 Aug 013 Abstract The problem of characterzng mpacts of data qualty on real-tme locatonal margnal prce (LMP) s consdered. Because the real-tme LMP s computed from the estmated network topology and system state, bad data that cause errors n topology processng and state estmaton affect real-tme LMP. It s shown that the power system state space s parttoned nto prce regons of convex polytopes. Under dfferent bad data models, the worst case mpacts of bad data on real-tme LMP are analyzed. Numercal smulatons are used to llustrate worst case performance for IEEE-1 and IEEE-118 networks. Keywords-locatonal margnal prce (LMP), real-tme market, power system state estmaton, bad data detecton, cyber securty of smart grd. I. INTRODUCTION THE deregulated electrcty market has two nterconnected components. The day-ahead market determnes the locatonal margnal prce (LMP) based on the dual varables of the optmal power flow (OPF) soluton [1], [], gven generator offers, demand forecast, system topology, and securty constrants. The calculaton of LMP n the day-ahead market does not depend on the actual system operaton. In the realtme market, on the other hand, an ex-post formulaton s often used (e.g., by PJM and ISO-New England [3]) to calculate the real-tme LMP by solvng an ncremental OPF problem. The LMPs n the day-ahead and the real-tme markets are combned n the fnal clearng and settlement processes. The real-tme LMP s a functon of data collected by the supervsory control and data acquston (SCADA) system. Therefore, anomales n data, f undetected, wll affect prces n the real-tme market. Whle the control center employs a bad data detector to clean the real-tme measurements, mss detectons and false alarms wll occur nevtably. The ncreasng relance on the cyber system also comes wth the rsk that malcous data may be njected by an adversary to affect system and real-tme market operatons. An ntellgent adversary can carefully desgn a data attack to avod detecton by the bad data detector. Regardless of the source of data errors, t s of sgnfcant value to assess potental mpacts of data qualty on the realtme market, especally when a smart grd may n the future deploy demand response based on real-tme LMP. To ths end, we are nterested n characterzng the mpact of worst case L. Ja, J. Km, R. J. Thomas, and L. Tong are wth the School of Electrcal and Computer Engneerng, Cornell Unversty, Ithaca, NY 1853, USA. Emal: (lj9, jk75, rjt1, ltong)@cornell.edu. Part of ths work was presented at HICSS 01 and PES General Meetng 01. Ths work s supported n part by a grant under the DoE CERTS program, the NSF under Grant CNS-11358, and a PSERC grant. data errors on the real-tme LMP. The focus on the worst case also reflects the lack of an accurate model of bad data and our desre to nclude the possblty of data attacks. A. Summary of Results and Organzaton We am to characterze the worst effects of data corrupton on real-tme LMP. By worst, we mean the maxmum perturbaton of real-tme LMP caused by bad or malcous data, when a fxed set of data s subject to corrupton. The complete characterzaton of worst data mpact, however, s not computatonally tractable. Our goal here s to develop an optmzaton based approach to search for locally worst data by restrctng the network congeston to a set of lnes prone to congeston. We then apply computatonally tractable (greedy search) algorthms to fnd the worst data and evaluate the effects of worst data by smulatons. In characterzng the relaton between data and real-tme LMP, we frst present a geometrc characterzaton of the realtme LMP. In partcular, we show that the state space of the power system s parttoned nto polytope prce regons, as llustrated n Fg. 1(a), where each polytope s assocated wth a unque real-tme LMP vector, and the prce regon X s defned by a partcular set of congested lnes that determne the boundares of the prce regon. X X 3 x X 1 X 0 ˆx X (a) Bad meter data State space X 1 Removed due to topology error X 0 ˆx X (b) Topology error Fg. 1: Change of real-tme LMPs due to bad data. Two types of bad data are consdered n ths paper. One s the bad data assocated wth meter measurements such as the branch power flows n the network. Such bad data wll cause errors n state estmaton, possbly perturbng, as an example, the correct state estmate ˆx n X 0 to x n X 3 (as shown n Fg. 1(a)). The analyss of the worst case data then corresponds to fndng the worst measurement error such that t perturbs the correct state estmaton to the worst prce regon.

2 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS The second type of bad data, one that has not been carefully studed n the context of LMP n the lterature, s error n dgtal measurements such as swtch or breaker states. Such errors lead drectly to topology errors therefore causng a change n the polytope structure as llustrated n Fg. 1(b). In ths case, even f the estmated system state changes lttle, the prces assocated wth each regon change, sometmes qute sgnfcantly. Before characterzng mpacts of bad meter data on LMP, we need to construct approprate models for bad data. To ths end, we propose three ncreasngly more powerful bad data models based on the dependences on real-tme system measurements: state ndependent bad data, partally adaptve bad data, and fully adaptve bad data. In studyng the worst case performance, we adopt a wdely used approach that casts the problem as one nvolvng an adversary whose goal s to make the system performance as poor as possble. The approach of fndng the worst data s equvalent to fndng the optmal strategy of an attacker who tres to perturb the real-tme LMP and avod beng detected at the same tme. By gvng the adversary more nformaton about the network state and endowng hm wth the ablty to change data, we are able to capture the worst case performance, sometmes exactly and sometmes as bounds on performance. Fnally, we perform smulaton studes usng the IEEE-1 and IEEE-118 networks. We observe that bad data ndependent of the system state seems to have lmted mpact on real-tme LMPs, and greater prce perturbatons can be acheved by state dependent bad data. The results also demonstrate that the real-tme LMPs are subject to much larger perturbaton f bad topology data are present n addton to bad meter data. Whle substantal prce changes can be realzed for small networks by the worst meter data, as the sze of network grows whle the measurement redundancy rate remans the same, the nfluence of worst meter data on LMP s reduced. However, larger system actually gves more possbltes for the bad topology data to perturb the real-tme LMP more sgnfcantly. Our smulaton results also show a degree of robustness provded by the nonlnear state estmator. Whle there have been many studes on data njecton attacks based on DC models, very few consder the fact that the control center typcally employs the nonlnear WLS state estmator under the AC model. Our smulaton shows that effects of bad analog data desgned based on DC model may be mtgated by the nonlnear estmator whereas bad topology data coupled wth bad analog data can have greater mpacts on LMP. The rest of the paper s organzed as follows. Secton II brefly descrbes a model of real-tme LMP and ntroduces ts geometrc characterzaton n the state space of the power system. Secton III establshes the bad data models and summarzes state estmaton and bad data detecton procedures at the control center. In Secton IV, a metrc of mpact on realtme LMP caused by bad meter data s ntroduced. We then dscuss the algorthms of fndng worst case bad meter data vector n terms of real-tme prce perturbaton under the three dfferent bad data models. Secton V consders the effect of bad topology data on real-tme LMP. Fnally, n Secton VI, smulaton results are presented based on IEEE-1 and IEEE- 118 networks. B. Related Work Effects of bad data on power system have been studed extensvely n the past, see [], [5], [6]. Fndng the worst case bad data s naturally connected wth the problem of malcous data. In ths context, the results presented n ths paper can be vewed as one of analyzng the mpact of the worst (malcous) data attack. In a semnal paper by Lu, Nng, and Reter [7], the authors frst llustrated the possblty that, by compromsng enough number of meters, an adversary can perturb the state estmate arbtrarly n some subspace of the state space wthout beng detected by any bad data detector. Such attacks are referred to as strong attacks. It was shown by Kosut et al. [8] that the condton for the exstence of such undetectable attacks s equvalent to the classcal noton of network observablty. When the adversary can only nject malcous data from a small number of meters, strong attacks do not exst, and any njected malcous data can be detected wth some probablty. Such attacks are referred to as weak attacks [8]. In order to affect the system operaton n some meanngful way, the adversary has to rsk beng detected by the control center. The mpacts of weak attack on power system are not well understood because the detecton of such bad data s probablstc. Our results are perhaps the frst to quantfy such mpacts. Most related research works focused on DC model and lnear estmator whle only few have addressed the nonlnearty effect [9], [10]. It s well recognzed that bad data can also cause topology errors [11], [1], and technques have been developed to detect topology errors. For nstance, the resdue vector from state estmaton was analyzed for topology error detecton [1], [11], [13]. Montcell [1] ntroduced the dea of generalzed state estmaton where, roughly speakng, the topology that fts the meter measurements best s chosen as the topology estmate. The mpacts of topology errors on electrcty market have not been reported n the lterature, and ths paper ams to brdge ths gap. The effect of data qualty on real-tme market was frst consdered n [15], [16]. In [16], the authors presented the fnancal rsks nduced by the data perturbaton and proposed a heurstc technque for fndng a case where prce change happens. Whle there are smlartes between ths paper and [16], several sgnfcant dfferences exst: () Ths paper focuses on fndng the worst case, not only a feasble case. () Ths paper consders a more general class of bad data where bad data may depend dynamcally on the actual system measurements rather than statc. () Ths paper consders a broader range of bad data that also nclude bad topology data, and our evaluatons are based on the AC network model and the presence of nonlnear state estmator. II. STRUCTURES OF REAL-TIME LMP In ths secton, we present frst a model for the computaton of real-tme locatonal margnal prce (LMP). Whle ISOs have somewhat dfferent methods of computng real-tme LMP, they

3 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 3 share the same two-settlement archtecture and smlar ways of usng real-tme measurements. In the followng, we wll use a smplfed ex-post real-tme market model, adopted by PJM, ISO New England, and other ISOs [17], [3]. We vew ths model as a convenent mathematcal abstracton that captures the essental components of the real-tme LMP calculaton. For ths reason, our results should be nterpreted wthn the specfed setup. Our purpose s not to nclude all detals; we am to capture the essental features. In real-tme, n order to montor and operate the system, the control center wll calculate the estmated system condtons (ncludng bus voltages, branch flows, generaton, and demand) based on real-tme measurements. We call a branch congested f the estmated flow s larger than or equal to the securty lmt. The congeston pattern s defned as the set of all congested lnes, denoted as Ĉ. Note that we use hat (e.g., Ĉ) to denote quanttes or sets that are estmated based on realtme measurements. Detals of state estmaton and bad data detecton are dscussed n Secton III-B. One mportant usage of state estmaton s calculatng the real-tme LMP. Gven the estmated congeston pattern Ĉ, the followng lnear program s solved to fnd the ncremental OPF dspatch and assocated real-tme LMP, ˆλ = (ˆλ ) [17]: mnmze c G p c L j d j subjcet to p = d j p mn d mn j p p max d j d max j A k p j A kj d j 0, for all k Ĉ, (1) where d = ( d j ) s the vector of ncremental dspatchable load, p = ( p ) the vector of ncremental generaton dspatch, c G = (c G ) and = (c cl L j ) the correspondng real-tme margnal cost of generatons and dspatchable loads, p mn and p max the lower and upper bounds for ncremental generaton dspatch, d mn and d max the lower and upper bounds for ncremental dspatchable load, and A k the senstvty of branch flow on branch k wth respect to the power njecton at bus. The real-tme LMP at bus s defned as the overall cost ncrease when one unt of extra load s added at bus, whch s calculated as ˆλ = η k ĈA k µ k. () where η s the dual varable for the load-generaton equalty constrant, and µ k s the dual varable correspondng to the lne flow constrant n (1). Note that n practce, the control center may use the exante congeston pattern, whch s obtaned by runnng a 5 mnute ahead securty-constraned economc dspatch wth the state estmaton results and the forecasted loads (for the next fve-mnute nterval) and choosng the lnes congested at the dspatch soluton [17], [18]. However, to avod the complcaton due to ex-ante dspatch calculaton, we assume that real-tme prcng employs the estmated congeston pattern Ĉ obtaned from state estmaton results. By dong so, we attempt to fnd drect relatons among bad data, the state estmate, and real-tme LMPs. Notce that once the congeston pattern Ĉ s determned, the whole ncremental OPF problem (1) no longer depends on the measurement data. Under the DC model, the power system state, x, s defned as the vector of voltage phases, except the phase on the reference bus. The power flow vector f s a functon of the system state x, f = Fx, (3) where F s the senstvty matrx of branch flows wth respect to the system state. Assume the system has n + 1 buses. Then, x X = [ π,π] n, where X represents the state space. Any system state corresponds to a unque pont n X. From (3), the branch flow f s determned by the system state x. Comparng the flows wth the flow lmts, we obtan the congeston pattern assocated wth ths state. Hence, each pont n the state space corresponds to a partcular congeston pattern. We note that the above expresson n () appears earler n [1] where the role of congeston state n LMP computaton was dscussed. In ths paper, our objectve s to make explct the connecton between data and LMP. We therefore need a lnkage between data and congeston. To ths end, we note that the power system state, the congeston state, and LMP form a Markov chan, whch led to a geometrc characterzaton of LMP on the power system state space, as shown n the followng theorem. Theorem 1 (Prce Partton of the State Space): Assume that the LMP exsts for every possble congeston pattern. Then, the state space X s parttoned nto a set of polytopes {X } where the nteror of each X s assocated wth a unque congeston pattern C and a real-tme LMP vector. Each boundary hyperplane of X s defned by a sngle transmsson lne. Proof: For a partcular congeston pattern C defned by a set of congested lnes, the set of states that gves C s gven by X ={x : F x T max C,F j x < T max j j / C}, where F s the th row of F (see (3)), and T max j the flow lmt on branch j. Snce X s defned by the ntersecton of a set of half spaces, t s a polytope. Gven an estmated congeston pattern Ĉ, the envelop theorem [19] mples that for any optmal prmal soluton and dual soluton of (1) that satsfy the KKT condtons, () always gves the dervatve of the optmal objectve value wth respect to the demand at each bus, whch we assume exsts,.e., each congeston pattern s assocated wth a unque real-tme LMP vector λ. Hence, all states wth the same congeston pattern share the same real-tme LMP, whch means each polytope X n X corresponds to a unque real-tme LMP vector. Theorem 1 characterzes succnctly the relatonshp between the system state and LMP. As llustrated n Fg. 1(a), f bad data are to alter the LMP n real-tme, the sze of the bad data has to be suffcently large so that the state estmate at the Ths s equvalent to assumng that the dervatve of the optmal value of (1) wth respect to demand at each bus exsts

4 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS control center s moved to a dfferent prce regon from the true system state. On the other hand, f some lnes are erroneously removed from or added to the correct topology, as llustrated n Fg. 1(b), t affects the LMP calculaton n three ways. Frst, the state estmate s perturbed snce the control center employs an ncorrect topology n state estmaton. Secondly, the prce partton of the state space changes due to the errors n topology nformaton. Thrd, the shft matrxan (1), whch s a functon of topology, changes thereby alterng prces attached to each prce regon. III. DATA MODEL AND STATE ESTIMATION A. Bad Data Model 1) Meter data: In order to montor the system, varous meter measurements are collected n real tme, such as power njectons, branch flows, voltage magntudes, and phasors, denoted by a vectorz R m. If there exsts bad dataaamong the measurements, the measurement wth bad data, denoted by z a, can be expressed as a functon of the system states x, z a = z +a = h(x)+w +a, a A, () where w represents the random measurement nose. We make a dstncton here between the measurement nose and bad data; the former accounts for random nose ndependently dstrbuted across all meters whereas the latter represents the perturbaton caused by bad or malcous data. We assume no specfc pattern for bad data except that they do not happen everywhere. We assume that bad data can only happen n a subset of the measurements, S. We call S as set of suspectable meters, whch means the meter readngs wth n S may subject to corrupton. If the cardnalty of S s k, the feasble set of bad data a s a k-dmensonal subspace, denoted as A = {a : a = 0 for all / S}. We wll consder three bad data models wth ncreasng power of affectng state estmates. M1. State ndependent bad data: Ths type of bad data s ndependent of real-tme measurements. Such bad data may be the replacement of mssng measurements. M. Partally adaptve bad data: Ths type of bad data may arse from the so-called man n the mddle (MM) attack where an adversary ntercepts the meter data and alter the data based on what he has observed. Such bad data can adapt to the system operatng state. M3. Fully adaptve bad data: Ths s the most powerful type of bad data, constructed based on the actual measurement z = h(x)+w. In addton to these, the change n topology wll affect contngency analyss. Such effect wll appear as changes n contngency constrants n realtme LMP calculaton (1) [17]. However, dealng wth contngency constrants wll sgnfcantly complcate our analyss and possbly obscure the more drect lnk between bad data and real-tme LMP. Hence, we consder only lne congeston constrants n (1). Notce here both conventonal measurements and PMU measurements can be ncorporated. Although PMU data seem to have more drect mpact on state estmaton and real-tme LMP calculaton, we won t dfferentate the types of measurements n the followng dscusson. Note that M3 s n general not realstc. Our purpose of consderng ths model s to use t as a conservatve proxy to obtan performance bounds for the mpact of worst case data. We assume heren a DC model n whch the measurement functon h( ) n () s lnear. Specfcally, z a = Hx+w+a, a A, (5) where H s the measurement matrx. Such a DC model, whle wdely used n the lterature, may only be a crude approxmaton of the real power system. By makng such a smplfyng assumpton and acknowledgng ts weaknesses, we hope to obtan tractable solutons n searchng for worst case scenaros. It s mportant to note that, although the worst case scenaros are derved from the DC model, we carry out smulatons usng the actual nonlnear system model. ) Topology data: Topology data are represented by a bnary vector s {0,1} l, where each entry of s represents the state of a lne breaker (0 for open and 1 for closed). The bad topology data s modeled as s b = s+b (mod ), b B, (6) where B {0,1} l s the set of possble bad data. When bad data are present, the topology processor wll generate the topology estmate correspondng to s b, and ths ncorrect topology estmate wll be passed to the followng operatons unless detected by the bad data detector. B. State Estmaton We assume that the control center employs the standard weghted least squares (WLS) state estmator. Under DC model, ˆx = argmn x (z Hx) T R 1 (z Hx) = Kz, (7) where R s the covarance matrx of measurement nose w, and K (H T R 1 H) 1 H T R 1. If the nose w s Gaussan, the WLS estmator s also the maxmum lkelhood estmate (MLE) of state x. By the nvarant property of MLE, from (3), the maxmum lkelhood estmate of the branch flows s calculated as ˆf = Fˆx = FKz. (8) The congeston pattern used n real-tme LMP calculaton (1) s drectly from state estmaton and conssts of all the estmated branch flows whch are larger than or equal to the branch flow lmts,.e., Ĉ = {j : ˆf j T max j }, (9) where T max j s the flow lmt on branch j. In the presence of bad meter data a, the meter measurements collected by control center s actually z a = Hx+w +a. By usng z a, the WLS state estmate s ˆx a = Kz a = ˆx +Ka, (10) where ˆx = Kz s the correct state estmate wthout the presence of the bad data (.e., a = 0). Eq. (10) shows that the effect of bad data on state estmaton s lnear. However, because a s confned n a k-dmensonal

5 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 5 subspace A, the perturbaton on the actual system state s lmted to a certan drecton. When bad data exst both n meter and topology data, the control center uses a wrong measurement matrx H, correspondng to the altered topology data, and the altered meter data z a. Then, the WLS state estmate becomes ˆx a = Kz a = Kz + Ka, (11) where K ( H T R 1 H) 1 HT R 1. Note that unlke the lnear effect of bad meter data, bad topology data affects the state estmate by alterng the measurement matrx H to H. C. Bad Data Detecton The control center uses bad data detecton to mnmze the mpact of bad data. Here, we assume a standard bad data detecton used n practce, the J(ˆx)-detector n [5]. In partcular, the J(ˆx)-detector performs the test on the resdue error, r z Hˆx, based on the state estmate ˆx. From the WLS state estmate (7), we have r = ( I H(H T R 1 H) 1 H T R 1) z = Uz. (1) where U =(I H(H T R 1 H) 1 H T R 1 ) The J(ˆx)-detector s a threshold detector defned by r T R 1 r = z T Wz bad data good data τ, (13) where τ s the threshold calculated from a prescrbed false alarm probablty, and W =U T R 1 U. When the measurement data fal to pass the bad data test, the control center declares the exstence of bad data and takes correspondng actons to dentfy and remove the bad data. In ths paper, we are nterested n those cases when bad data are present whle the J(ˆx)-detector fals to detect them. IV. IMPACT OF BAD DATA ON LMP In ths secton, we examne the mpact of bad data on LMP, assumng that the topology estmate of the network s correct. One thng to notce s that n searchng for the worst case, we take the perspectve of the control center, not that of the attacker. In partcular, we look for the worst congeston pattern for the LMP computaton, even f ths partcular congeston pattern s dffcult for the attacker to dscover. So the focus here s not how easy t s for an attacker to fnd a locally worst congeston pattern; t s how much such a congeston pattern affects the LMP. A. Average Relatve Prce Perturbaton In order to quantfy the effect of bad data on real-tme prce, we need to frst defne the metrc to measure the effect. We defne the relatve prce perturbaton (RPP) as the expected percentage prce perturbaton caused by bad data. Gven that LMP vares at dfferent buses, RPP also vares at dfferent locatons. Let z a be the data receved at the control center and λ (z a ) the LMP at bus. The RPP at bus s a functon of bad data a, gven by ( ) λ (z a ) λ (z) RPP (a) = E λ (z), (1) where the expectaton s over random state and measurement nose. To measure the system-wde prce perturbaton, we defne the average relatve prce perturbaton (ARPP) by ARPP(a) = 1 n+1 RPP (a), (15) where n+1 s the number of buses n the system. The worst case analyss to be followed can be used for other metrcs (e.g., prce ncrease ratos or prce decrease ratos, whch are closely related to the market partcpants gan or loss). Smlar results can be showed followng the same strateges. However, the comparson among dfferent metrcs s beyond the scope of ths paper. B. Worst ARPP under State Independent Bad Data Model Frst, we consder the state ndependent bad data model (M1) gven n Secton III-A. In ths model, the bad data are ndependent of real-tme measurements. In constructng the state ndependent worst data, t s useful to ncorporate pror nformaton about the state. To ths end, we assume that system state follows a Gaussan dstrbuton wth mean x 0, covarance matrx Σ x. Typcally, we choose x 0 as the day-ahead dspatch snce the nomnal system state n real-tme vares around ts day-ahead projecton. In the presence of bad data a, the expected state estmate and branch flow estmate on branch are gven by E[ˆx] = x 0 +Ka. (16) E[f ] = F E[ˆx] = F x 0 +F Ka, (17) where F s the correspondng row of branch n F. Our strategy s to make ths expected state estmate nto the regon wth the largest prce perturbaton among all the possble regons, Ĉ. From (9), ths means makng all the expected branch flows satsfy the boundary condton of Ĉ, E[f ] T max for Ĉ E[f ] Tj max for j / Ĉ. (18) However, due to the uncertanty (from both system state x and measurement nose w), the actual estmated state after attack, ˆx, may be dfferent from E[ˆx]. Therefore, we want to make E[ˆx] at the center of the desred prce regon,.e., maxmzng the shortest dstance from E[ˆx] to the boundares of the polytope prce regons whle stll holdng the boundary constrants. The shortest dstance can be calculated as β = mn{ β : E[f ] T max β for all }. (19) However, the exstence of bad data detector prevents the bad data vector a from beng arbtrarly large. Accordng to (1), the weghted squared resdue wth a s r T R 1 r = z T a Wz a = (w+a) T W(w +a). (0)

6 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 6 snce WHx = 0 Heurstcally, snce w has zero mean, the terma T Wa can be used to quantfy the effect of data perturbaton on estmaton resdue. Then we use a T Wa ǫ to control the detecton probablty n the followng optmzaton. Therefore, for a specfc congeston pattern Ĉ, the adversary wll solve the followng optmzaton problem to move the state estmate to the center of the prce regonĉ and keepng the detecton probablty low. max a A, β 0 subject to β E[f ] β T max, Ĉ E[f ]+ β < Tj max,j / Ĉ a T Wa ǫ, (1) whch s a convex program that can be solved easly n practce. We call a regon Ĉ feasble f t makes problem (1) feasble. Among all the feasble congeston patterns, the worst regon Ĉ s chosen as the one gvng the largest ARPP. Ĉ = arg max λ λ (Ĉ), () Ĉ Γ where λ s the LMP at busf thex 0 s the system state, andγ the set of all the feasble congeston patterns. Hence, the worst case constant bad data vector s the soluton to optmzaton problem (1) by settng the congeston pattern as Ĉ. C. Worst ARPP under Partally Adaptve Bad Data For bad data model M, only part of the measurement values n real-tme are known to the adversary, denoted as z o. The adversary has to frst make an estmaton of the system state from the observaton and pror dstrbuton, then make the attack decson based on the estmaton result. Wthout the presence of bad data vector,.e., a = 0, the system equaton (5) gves z o = H o x+w o, (3) whereh o s the rows ofh correspondng to the observed measurements and w o the correspondng part n the measurement nose w. The mnmum mean square error (MMSE) estmate of x gven z o s gven by the condtonal mean E(x z o ) = x 0 +Σ x H T o(h o Σ x H T o) 1 (z o H o x 0 ). () Then, the flow estmate on branch after attack s E[f z o ] = F E[ˆx z o ]. (5) Stll, we want to move the estmaton of state to the center. On the other hand, the expected measurement valuee[z a z o ] = HE[ẑ z o ]+a. Agan, we need a pre-desgned parameter ǫ to control the detecton probablty. Therefore, the soluton to the followng optmzaton problem s the best attack gven congeston pattern A max a A, β 0 subject to β E[f z o ] β T max, Ĉ E[f z o ]+ β < Tj max,j / Ĉ (HE[z a z o ] T )W(HE[z a z o ]) ǫ. (6) Ths problem s also a convex optmzaton problem, whch can be easly solved. Among all the Ĉ s whch make the above problem feasble, we choose the one wth the largest prce perturbaton, denoted as Ĉ. The soluton to problem (6) wth Ĉ as the congeston pattern s the worst bad data vector. D. Worst ARPP under Fully Adaptve Bad Data Fnally, we consder the bad data model M3, n whch the whole set of measurements z s known to the adversary. The worst bad data vector depends on the value ofz. Dfferent from the prevous two models, wth bad data vector a, the estmated state s determnstc wthout uncertanty. In partcular ˆx = Kz +Ka. (7) And the estmated flow on branch after attack s also determnstc ˆf = F ˆx = F Kz +F Ka. (8) Smlar to the prevous two models, congeston pattern s called feasble f there exsts some bad data vector a to make the followng condtons satsfed: ˆf T max, Ĉ ˆf < Tj max,j / Ĉ (z +a) T W(z +a) τ, a A. (9) Among all the feasble congeston patterns, we choose the one wth the largest prce perturbaton,ĉ. Any bad data vector a satsfyng condton (9) can serve as the worst fully adaptve bad data. E. A Greedy Heurstc The strateges presented above are based on the exhaustve search over all possble congeston patterns. Such approaches are not scalable for large networks wth a large number of possble congeston patterns. We now present a greedy heurstc approach amed at reducng computaton cost. In partcular, we develop a gradent lke algorthm that searches among a set of lkely congeston patterns. Frst, we restrct ourselves to the set of lnes that are close to ther respectve flow lmts and look for bad data that wll affect the congeston pattern. The ntuton s that t s unlkely that bad data can drve the system state suffcently far wthout beng detected by the bad data detector. In practce, the cardnalty of such a set s usually very small compared wth the systems sze. Second, we search for the worst data locally by changng one lne n the congeston pattern at a tme. Specfcally, suppose that a congeston pattern s the current canddate for the worst data. Gven a set of canddate lnes that are prone to congestons, we search locally by flppng one lne at a tme from the congested state to the un-congested state and vce versa. If no mprovement can be made, the algorthm stops. Otherwse, the algorthm updates the current worst congeston pattern and contnue. The effectveness of ths greedy heurstc s tested n Secton VI-C.

7 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 7 V. BAD TOPOLOGY DATA ON LMP So far, we have consdered bad data n the analog measurements. In ths secton, we nclude the bad topology data, and descrbe another bad data model. We represent the network topology by a drected graph G = (V,E) where each V denotes a bus and each (,j) E denotes a connected transmsson lne. For each physcal transmsson lne (e.g., a physcal lne between and j), we assgn an arbtrary drecton (e.g., (, j)) for the lne, and (, j) s n E f and only f bus and bus j are connected. Bad data may appear n both analog measurements and dgtal (e.g., breaker status) data, as descrbed n Secton III-A: z a = z +a = (Hx+w)+a, a A, s b = s+b (mod ), b B. (30) As n Secton IV, we employ the adversary model to descrbe the worst case. The adversary alters s to s b by addng b from the set of feasble attack vectors B {0,1} l such that the topology processor produces the target topology Ḡ as the topology estmate. In addton, the adversary modfes z by addng a A such that z a looks consstent wth Ḡ. In ths secton, we focus on the worst case when the adversary s able to alter the network topology wthout changng the state estmate. We also requre that such bad data are generated by an adversary causng undetectable topology change,.e., the bad data escape the system bad data detecton. For the worst case analyss, we wll maxmze the LMP perturbaton among the attacks wthn ths specfc class. Even though ths approach s suboptmal, the smulaton results n Secton VI demonstrate that the resultng LMP perturbaton s much greater than the worst case of the bad meter data. Suppose the adversary wants to mslead the control center wth the target topology Ḡ = (V,Ē), a topology obtaned by removng a set of transmsson lnes E n G (.e., Ē = E\ E ). We assume that the system wth Ḡ s observable:.e., the correspondng measurement matrx H has full column rank. Suppose that the adversary changes the breaker status such that the target topology Ḡ = (V,Ē) s observed at the control center. Smultaneously, f the adversary ntroduces bad data a = Hx Hx, then z a = Hx+a+w = Hx+w, (31) whch means that the meter data receved at the control center are completely consstent wth the model generated from Ḡ. Thus, any bad data detector wll not be effectve. It s of course not obvous how to produce the bad data a, especally when the adversary can only modfy a lmted In general, the adversary can desgn the worst data to affect both the state estmate and network topology. It s, however, much more dffcult to make such attack undetectable. Lne addton by the adversary s also possble [0]. However, compared to lne removal attacks, lne addton attacks requre the adversary to observe a much larger set of meter measurements to desgn undetectable attacks. In addton, the number of necessary modfcatons n breaker data s also much larger: to make a lne appear to be connected, the adversary should make all the breakers on the lne appear to be closed. Please see [1] for the detal. Wthout observablty, the system may not proceed to state estmaton and real-tme prcng. Hence, for the adversary to affect prcng, the system wth the target topology has to be observable. (1,3) (,1) (,) (3,) (3,) (1,3) (,1) (,) (3,) (3,) Hx = Hx = B 1 (x )+B (x - x )-B 3 (x 3 -x ) -B (x - x )-B 3 (x 3 -x ) B 13 (-x 3 ) B 1 (x ) B (x - x ) B 3 (x 3 -x ) B 3 (x 3 -x ) B 1 (x ) + B (x - x ) -B (x - x )-B 3 (x 3 -x ) B 13 (-x 3 ) B 1 (x ) B (x - x ) 0 B 3 (x 3 -x ) Fg. : Hx and Hx: Each row s marked by the correspondng meter ( for njecton at and (,j) for flow from to j). number of measurements, and t may not have access to the entre state vector x. Fortunately, t turns out that a can be generated by observng only a few entres n z wthout requrng global nformaton (such as the state vector x) [0]. A key observaton s that Hx and Hx dffer only n a few entres correspondng to the modfed topology (lnes n E ) as llustrated n Fg.. Consder frst the noseless case. Let z j denote the entry of z correspondng to the flow measurement from to j. As hnted from Fg., t can be easly seen that Hx Hx has the followng sparse structure [0]: Hx Hx = (,j) E α j m (,j), (3) where α j R denotes the lne flow from to j when the lne s connected and the system state s x, and m (,j) s the column of the measurement-to-branch ncdence matrx, that corresponds to (,j):.e., m (,j) s an m-dmensonal vector wth 1 at the entres correspondng to the flow from to j and the njecton at, and 1 at the entres for the flow from j to and the njecton at j, and 0 at all other entres. Absence of nose mples that z j = α j, whch leads to Hx Hx = (,j) E z j m (,j). (33) Wth (33) n mnd, one can see that settng a = Hx Hx and addng a to z s equvalent to the followng smple procedure: as descrbed n Fg. 3, for each (,j) n E, 1) Subtract z j and z j from z and z j respectvely. ) Set z j and z j to be 0. where z s the entry of z correspondng to the njecton measurement at bus. When measurement nose s present (.e., z = Hx + w), the dea of the attack s stll the same: to make a approxmate Hx Hx so that z a s close to Hx+w. Snce z j = α j +w j, z j s an unbased estmate of α j for each (,j) E, and ths mples that (,j) E z j m (,j) s an unbased estmate of (,j) E α j m (,j) = Hx Hx. Hence, we set a to be G Ḡ

8 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 8 z z j Unaltered measurements z j j z j z z j 0 0 Attack-modfed measurements Fg. 3: The attack modfes local measurements around the lne (,j) n E. j z j z j (,j) E z j m (,j), the same as n the noseless settng, and the attack s executed by the same steps as above. For launchng ths attack to modfy the topology estmate from G to Ḡ, the adversary should be able to () set b such that the topology processor produces Ḡ nstead of G and () observe and modfy z j, z j, z, and z j for all (,j) E. The attack s feasble f and only f A and B contan the correspondng attack vectors. To fnd the worst case LMP perturbaton due to undetectable, state-preservng attacks, let F denote the set of feasble Ḡs, for whch the attack can be launched wth A and B. Among the feasble targets n F, we consder the best target topology that results n the maxmum perturbaton n real-tme LMPs. If ARPP s used as a metrc, the best target s chosen as Ḡ [z] = arg max Ḡ F λ (z;ḡ) λ (z;g) λ (z;g). (3) where λ (z;ḡ) denotes the real-tme LMP at bus when the attack wth the target Ḡ s launched on z, and λ (z;g) s the real-tme LMP under no attack. VI. NUMERICAL RESULTS In ths secton, we demonstrate the mpact of bad data on real-tme LMPs wth the numercal smulatons on IEEE- 1 and IEEE-118 systems. We conducted smulatons n two dfferent settngs: the lnear model wth the DC state estmator and the nonlnear model wth the AC state estmator. The former s usually employed n the lterature for the ease of analyss whereas the latter represents the practcal state estmator used n the real-world power system. In all smulatons, the meter measurements consst of real power njectons at all buses and real power flows (both drectons) at all branches. A. Lnear model wth DC state estmaton We frst present the smulaton results for the lnear model wth the DC state estmator. We modeled bus voltage magntudes and phases as Gaussan random varables wth the means equal to the day-ahead dspatched values and small standard devatons. In each Monte Carlo run, we generated a state realzaton from the statstcal model, and the meter measurements were created by the DC model wth Gaussan measurement nose. Once the measurements were created, bad data were added n the manners dscussed n Secton IV and Secton V. Wth the corrupted measurements, the control center executed the DC state estmaton and the bad data test wth the false alarm probablty constrant 0.1. If the data passed the bad data test, real-tme LMPs were evaluated based on the state estmaton results. For IEEE-1 and IEEE-118 system, the network parameters are avalable n []. We used the number of meter data to be modfed by the adversary as the metrc for the attack effort. For the 1 bus system, n each Monte Carlo run, we randomly chose two lnes, and the adversary was able to modfy all the lne flow meters on the lnes and njecton meters located at the ends of the lnes. For the 118 bus system, we randomly chose three lnes, and the adversary had control over the assocated lne and njecton meters. Both state and topology attacks were set to control the same number of meter data so that we can farly compare ther mpacts on real-tme LMPs. As for the meter data attack, we only consdered the lnes that are close to ther flow lmts (estmated flows under M1 and M, or actual flows under M3) as canddates for congeston pattern search. The threshold s chosen as 10MW n our smulaton. Fg. s the plot of ARPPs versus detecton probabltes of bad data. They show that even when bad data were detected wth low probablty, ARPPs were large, especally for the fully adaptve bad meter data and the bad topology data. Comparng ARPPs of the three bad meter data models, we observe that the adversary may sgnfcantly mprove the perturbaton amount by explotng partal or all real-tme meter data (for the partally adaptve case, the adversary observed a half of all meters.) It s worthy to pont out that bad topology data result n much greater prce perturbaton than bad meter data. Recall the dscusson n Secton II and Secton V that bad topology data and bad meter data employ dfferent prceperturbng mechansms: bad topology data perturb real-tme LMP by restructurng the prce regons wthout perturbng the state estmate (the lne-removal attack ntroduced n Secton V does not perturb state estmate) whereas bad meter data perturb real-tme LMP by smply movng the state estmate to a dfferent prce regon. Therefore, the observaton mples that restructurng the prce regons has much greater mpact on real-tme LMP than merely perturbng the state estmate. B. Nonlnear model wth AC state estmaton The smulatons wth the nonlnear model ntend to nvestgate the vulnerablty of the real-world power system to the In addton to the network parameters gven n [], we used the followng lne lmt and real-tme offer parameters. In the IEEE-1 smulaton, the generators at the buses 1,, 3, 6, and 8 had capactes 330, 10, 100, 100, and 100 MW and the real-tme offers 15, 31, 30, 10, and 0 $/MW. Lnes (, 3), (, 5), and (6, 11) had lne capactes 50, 50, and 0 MW, and other lnes had no lne lmt. In the IEEE-118 smulaton, the generators had generaton costs arbtrarly selected from {0, 5, 30, 35, 0 $/MW} and generaton capactes arbtrarly selected from {00, 50, 300, 350, 00 MW}. Total 16 lnes had the lne capactes arbtrarly selected from {70, 90, 110 MW}, and other lnes had no lne lmt. To handle possble occurrence of prce spkes, we set the upper and lower prce caps as 500$/MW and -100$/MW respectvely. Total 1000 Monte Carlo runs were executed for each case. Topology attacks need to make few addtonal modfcatons on breaker state data such that the target lnes appear to be dsconnected to the topology processor. However, for smplcty, we do not take nto account ths addtonal effort. The detecton probabltes for the fully adaptve bad meter data and the bad topology data cases were less than 0.1 n all the smulatons. In the fgures, we draw ARPPs of those cases as horzontal lnes so that we can compare them wth other cases.

9 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 9 LMP perturbaton (%) partally adapt. fully adapt. state ndep. TABLE I: Performance of greedy search method method average search tme accuracy exhaustve search 1.3s - greedy search 0.51s 97.3% Detecton Probablty (a) IEEE-1: ARPP of the worst topology data s 66.1%. LMP perturbaton (%) partally adapt. fully adapt. state ndep. LMP perturbaton (%) state ndep. fully adapt Detecton Probablty (a) IEEE-1: ARPP of the worst topology data s 95.% Detecton Probablty (b) IEEE-118: ARPP of the worst topology data s.%. Fg. : Lnear model: ARPP vs detecton prob. LMP perturbaton (%) state ndep. fully adapt. worst adversaral act, desgned based on the lnear model. The smulatons were conducted on IEEE-1 and IEEE-118 systems n the same manner as the lnear case except that we employed the nonlnear model and the AC state estmaton. Fg. 5 s the plot of ARPPs versus detecton probabltes. The result shows that the proposed methodology can affect the system to some extent even when nonlnear estmator s used, especally when the bad data are present n the topology data, although the nonlnear estmator makes ths effect relatvely less sgnfcant compared wth the lnear case results. C. Performance of the greedy search heurstc We also conducted smulaton based on the proposed greedy search technque n Secton IV-E. The smulaton was based on 118 bus system, and all parameters were the same as those presented n Secton VI-A. We compared the performance and computaton tme of the greedy heurstcs wth exhaustve search benchmark, as shown n Table I. Notce here the exhaustve search and greedy search are both over the lnes that are close to ther flow lmts (estmated flows under M1 and M, or actual flows under M3), the same as n Secton VI-A. In Table I, the second column (average search tme) s the average searchng tme for worst congeston pattern over 1000 Monte Carlo runs, and the thrd column (accuracy) s the percentage that the greedy search fnd the same worst congeston pattern as the exhaustve search. From the result, we can see that usng greedy heurstc can gve us much faster processng algorthm wthout losng much of the accuracy. VII. CONCLUSION We report n ths paper a study on mpacts of worst data on the real-tme market operaton. A key result of ths paper s the Detecton Probablty (b) IEEE-118: ARPP of the worst topology data s 76.9%. Fg. 5: Nonlnear model: ARPP vs detecton prob. geometrc characterzaton of real-tme LMP gven n Theorem 1. Ths result provdes nsghts nto the relaton between data and the real-tme LMP; t serves as the bass of characterzng mpacts of bad data. Our nvestgaton ncludes bad data scenaros that arse from both analog meter measurements and dgtal breaker state data. To ths end, we have presented a systematc approach by castng the problem as one nvolvng an adversary njectng malcous data. Whle such an approach often gves overly conservatve analyss, t can be used as a measure of assurance when the mpacts based on worst case analyss are deemed acceptable. We note that, because we use adversary attacks as a way to study the worst data, our results have drect mplcatons when cyber-securty of smart grd s consdered. Gven the ncreasng relance on nformaton networks, developng effectve countermeasures aganst malcous data attack on the operatons of a future smart grd s crucal. See [8], [3], [10], [1] for dscusson about countermeasures. From a practcal vewpont, our result can serve as the gudelne to the real-tme operaton. Followng the methodology n our paper, worst effect of a specfc set of meters on real-tme LMP can be checked. Once a huge potental perturbaton s detected, alarm should be made and the operator needs to check the accuracy of these specfc data, add protecton devces, or even add more redundant meters.

10 SUBMITTED TO THE IEEE TRANSACTIONS ON POWER SYSTEMS 10 Although our fndngs are obtaned from academc benchmarks nvolvng relatvely small sze networks, we beleve that the general trend that characterzes the effects of bad data s lkely to persst n practcal networks of much larger sze. In partcular, as the network sze ncreases and the number of smultaneous appearance of bad data s lmted, the effects of the worst meter data on LMP decrease whereas the effects of the worst topology data stay nonneglgble regardless of the network sze. Ths observaton suggests that the bad topology data are potentally more detrmental to the real-tme market operaton than the bad meter data. ACKNOWLEDGEMENT The authors wsh to acknowledge comments and suggestons from the anonymous revewers that help to clarfy a number of ssues and mprove the presentaton. [18] T. Zhang and E. Ltvnov, Ex-post prcng n the co-optmzed energy and reserv markets, IEEE Transactons on Power Systems, vol. 1, no., pp , Nov [19] A. Mas-Colell and M. D. Whnston, Mcroeconomcs Theory. Oxford Unversty Press, [0] J. Km and L. Tong, On topology attack of a smart grd, n 013 IEEE PES Innovatve Smart Grd Technologes (ISGT), Washngton, DC, Feburuary 013. [1], On topology attack of a smart grd: undetectable attacks and countermeasures, IEEE Journal on Selected Areas n Communcatons, vol. 31, no. 7, July 013. [] Power Systems Test Case Archve. [Onlne]. Avalable: [3] T. Km and H. Poor, Strategc protecton aganst data njecton attacks on power grds, IEEE Transactons on Smart Grd, vol., no., pp , june 011. REFERENCES [1] F. Wu, P. Varaya, P. Spller, and O. S., Folk theorems on transmsson access: proofs and conterexamples, Journal of Regulatory Economcs, vol. 10, [] E. Ltvnov, T. Zheng, G. Rosenwald, and P. Shamsollah, Margnal loss modelng n LMP calculaton, IEEE Transactons on Power Systems, vol. 19, no., May 00. [3] T. Zheng and E. Ltvnov, Ex-post prcng n the co-optmzed energy and reserve market, IEEE Transactons on Power Systems, vol. 1, no., November 006. [] A. Abur and A. G. Expósto, Power System State Estmaton: Theory and Implementaton. CRC, 000. [5] E. Handschn, F. C. Schweppe, J. Kohlas, and A. Fechter, Bad data analyss for power system state estmaton, IEEE Transactons on Power Apparatus and Systems, vol. PAS-9, no., pp , Mar/Apr [6] F. C. Schweppe, J. Wldes, and D. P. Rom, Power system statc state estmaton, Parts I, II, III, IEEE Transactons on Power Apparatus and Systems, vol. PAS-89, pp , [7] Y. Lu, P. Nng, and M. K. Reter, False data njecton attacks aganst state estmaton n electrc power grds, n ACM Conference on Computer and Communcatons Securty, 009, pp [8] O. Kosut, L. Ja, R. J. Thomas, and L. Tong, Malcous data attacks on the smart grd, IEEE Transactons on Smart Grd, vol., no., pp , dec [9] L. Ja, R. J. Thomas, and L. Tong, On the nonlnearty effects on malcous data attack on power system, n 01 Power and Energy Socety general meetng, July 01. [10] G. Hug and J. Gampapa, Vulnerablty assessment of AC state estmaton wth respect to false data njecton cyber-attacks, IEEE Transactons on Smart Grd, vol. 3, no. 3, pp , 01. [11] F. F. Wu and W. E. Lu, Detecton of topology errors by state estmaton, IEEE Transactons on Power Systems, vol., no. 1, pp , Feb [1] K. Clements and P. Davs, Detecton and dentfcaton of topology errors n electrc power systems, IEEE Transactons on Power Systems, vol. 3, no., pp , nov [13] I. Costa and J. Leao, Identfcaton of topology errors n power system state estmaton, IEEE Transactons on Power Systems, vol. 8, no., pp , nov [1] A. Montcell, Modelng crcut breakers n weghted least squares state estmaton, IEEE Transactons on Power Systems, vol. 8, no. 3, pp , aug [15] R. J. Thomas, L. Tong, L. Ja, and O. E. Kosut, Some economc mpacts of bad and malcous data, n PSerc 010 Workshop, vol. 1, Portland Mane, July 010. [16] L. Xe, Y. Mo, and B. Snopol, False data njecton attacks n electrcty markets, n Proc. IEEE 010 SmartGrdComm, Gathersburg, MD, USA., Oct 010. [17] A. L. Ott, Experence wth PJM market operaton, system desgn, and mplementaton, IEEE Transactons on Power Systems, vol. 18, no., pp , May 003.