1. Introduction
Over the past century, excessive amounts of greenhouse gases emitted from fossil-fuel combustion have increased both the frequency and severity of adverse atmospheric conditions and impacted the global climate [1]. The consequent hazardous weather events, including extreme weather events (e.g., hurricanes/typhoons and snowstorms) and long-term adverse weather events (e.g., long-term wind and sunlight scarcity) may result in disruption or severe degradation of infrastructure services in some regions. For example, the United States suffered 18 hazardous weather-related disasters in 2022, including nine severe storm events and three tropical cyclone events, each of which incurred economic losses exceeding 1 billion USD [2]. Also, between June and mid-July of every year (i.e., the East Asian rainy season), several provinces in the lower reaches of the Yangtze River in China, such as Zhejiang and Jiangsu, suffer from the long-term near-zero generation of renewable energy resources [3]. As a fundamental instrument for empowering the daily functions of end consumers, the electric power infrastructure—especially power distribution systems—is thus continually threatened by hazardous weather events, which can trigger widespread damage and power outages [4],
[5]. Accordingly, throughout any hazardous weather event, power distribution systems should be strategically operated to not only elude external disruptions to the maximum extent but also promptly restore interrupted electricity services. Such a self-adaptive capability that exceeds the context of conventional reliability is generally referred to as resilience [6]. More specifically, resilience focuses on low-probability but high-impact disruptions such as N-
k contingencies (a contingency resulting in loss of components where it is implicit that
k > 1), whereas reliability concerns normal small-scale local failures such as N-1 or N-2 contingencies. The reliability of active distribution networks (ADNs) is commonly measured in terms of expected or average values based on historical data. However, such statistics-based indices cast little light on the resilience of ADNs due to insufficient data records of hazardous weather events. To reduce carbon emissions and optimize electricity services, power distribution systems across the globe have been undergoing a revolutionary upgrade toward ADNs [7] by integrating microgrids and distributed energy resources, enabling flexible demand responses, and so forth. With the increasing grid connections of diverse active physical components (e.g., renewable-based distributed generators, energy-storage systems, and electric vehicles), ADNs harmonize a wide range of advanced information and communication technologies in the physical process of power generation, delivery, and consumption. The power infrastructure (i.e., the physical subsystem) and the set of communication, computing, and control facilities (i.e., the cyber subsystem), which were historically operated in isolation, have become two highly interdependent subsystems in ADNs [8],
[9].
Although the close synergy of these two subsystems enables fine-grained monitoring and energy-management applications, it simultaneously introduces a new range of systematic vulnerabilities
[10] to hazardous weather events. For example, a severe snowstorm struck Texas, USA, in February 2021, causing cascading cyber–physical faults and massive power outages [11]. While this incident was primarily caused by a combination of extreme cold and supply shortages, the situation was exacerbated by communication breakdowns and cyber–physical interdependencies within ADNs. In fact, even a seemingly minute disruption in the cyber subsystem has adverse impacts on the operation of the physical subsystem. Moreover, both the cyber and physical subsystems are vulnerable to hazardous weather events, which further complicates responsive strategies to address the associated disruptions. For example, Typhoon Faxai struck Okinawa Island, Japan, in August 2023 and caused widespread outages affecting 160 000 end customers; communication networks were also severely damaged, such that no remote control could be executed to remedy operations [12]. In September 2022, Hurricane Fiona swept across eastern Canada and devastated both power and telecommunication infrastructures, with the lack of communication functionality postponing the restoration of distribution services
[13]. Hence, it is crucial to consider cyber–physical interdependencies when performing systemic and accurate resilience analyses of ADNs.
In regard to cyber–physical interdependencies, current resilience analyses for ADNs mainly target human-made disasters (e.g., cyberattacks) or natural disasters (e.g., hazardous weather). Studies on the former tend to focus on cybersecurity (e.g., false data injection
[14],
[15], distributed denial of service [16], and data modification
[17]) and secondary physical impacts, which have been thoroughly reviewed (e.g., Ref.
[18]). As for the hybrid physical damage and cyber interruptions caused by the latter, especially those caused by the most typical hazardous weather events, current studies only analyze certain specific aspects of the issue of resilience (e.g., situational awareness, preventive dispatches, corrective actions, and coordinated restorations). As listed in Table 1 [19],
[20],
[21],
[22],
[23],
[24],
[25],
[26],
[27],
[28],
[29],
[30],
[31],
[32],
[33],
[34],
[35],
[36],
[37],
[38],
[39],
[40],
[41],
[42],
[43],
[44],
[45], in the last three years, studies on resilience-oriented situation awareness have mainly focused on situation awareness (i.e., learning-based hazardous assessment and fault detection
[19],
[20],
[21], model-based state estimation
[22],
[23], and synchronous measurements
[24] throughout events); preventive dispatches (i.e., key ideas for preventive dispatches to take proactive countermeasures in physical and cyber subsystems before events occur
[25],
[26],
[27]); corrective action (i.e., centralized
[28],
[29],
[30],
[31] or decentralized
[29],
[32] real-time corrective actions when withstanding highly uncertain hazardous weather, according to ADN operation and communication modes) and coordinated restoration (i.e., graph-based
[31],
[33],
[34],
[35],
[36] and mathematical-programming-based
[35],
[36],
[37],
[38],
[39],
[40],
[41],
[42],
[43],
[44],
[45] strategies supporting the coordinated cyber–physical restoration of ADNs). However, as ambient hazardous weather conditions evolve, failure to consider the progression of interdependent cyber–physical operations will make it impractical to put forward resilience-enhancement strategies in a holistic way. There is thus a need for a generic resilience analysis framework that can capture an overall view of the interactive dynamics between the cyber–physical operation strategies and system disruptions of ADNs withstanding diverse hazardous weather events.
Most current reviews (e.g., Refs.
[46],
[47],
[48],
[49],
[50]) focus on the resilience of ADNs withstanding extreme weather events, while neglecting the potential outage risks caused by long-term adverse weather events. With efforts to reduce carbon emissions, weather-sensitive renewable-based distributed generators (e.g., distributed solar panels and wind turbines) are increasingly being regarded as a major power support for ADNs during normal operations
[51]. Under long-term wind and sunlight scarcities, relying only on several small conventional distributed generators (e.g., gas turbines and diesel generators) may not fully cover long-term power shortages in ADNs, due to possible transmission congestion in the upper-stream utility grid. This adverse situation obviously falls under the topic of resilience, because—although all internal physical and cyber components are reliable—there is still a risk of massive outages in ADNs due to long-term adverse weather events. Furthermore, under simultaneous long-term high temperature and humidity, power disruptions in high photovoltaic-/wind-penetrated ADNs are exacerbated by the increasing load demands of weather-sensitive appliances (e.g., air conditioners).To this end, considering the widespread cyber–physical interdependencies in ADNs, this paper presents a comprehensive review to systematically analyze the operational resilience of ADNs under hazardous weather events. The main contributions of this paper are as follows:
(1) The adverse impacts of hazardous weather on ADNs are analyzed from a holistic source–network–load perspective. In addition to extreme weather events, long-term adverse weather events are expected to trigger outages, given the increasing proportions of renewable-based distributed generators and weather-sensitive loads in ADNs.
(2) Resilient ADN operations that emphasize cyber–physical collaborations are systematically analyzed, including situation awareness, preventive dispatches, corrective actions, and coordinated restoration. The parallel yet complementary responsibilities of dispatch and maintenance departments are also analyzed.
(3) Several additional considerations about cyber subsystems and cyber–physical connections are commented on when quantifying the resilience of ADNs. Emergent ADN resilience issues are discussed while considering potential repeats and overlaps of hazardous weather, as well as natural and human-made compound disasters.
The remainder of this paper is organized as follows: Section 2 introduces structural and functional cyber–physical interdependencies in the operations of ADNs; Section 3 characterizes hazardous weather events and their adverse impacts on ADNs; Section 4 presents a detailed resilience analysis framework for ADNs from a cyber–physical perspective; Section 5 discusses emergent resilience-related challenges; and Section 6 concludes this paper.
2. Cyber–physical interdependencies in the operation of ADNs
2.1. Structural interdependencies
An ADN is composed of a set of heterogeneous physical and cyber components that operate in harmony to enhance the sustainability, affordability, and security of electricity services. In parallel with a set of physical components that are directly related to electricity-service provisions, cyber components are connected via a supervisory control and data acquisition (SCADA) system [52]. The communication network underlying a SCADA system can be configured by using wired communication (e.g., optical cable communication and power line communication [53]) and wireless communication (e.g., wireless fidelity (Wi-Fi) and 5G [54]) technologies. Bidirectional data transfers are enabled among field devices, remote terminal units (RTUs) [55], and the distribution system control center (DSCC) throughout ADN operations.
Accordingly, an ADN is a sophisticated cyber–physical system, which can be graphically represented as a hierarchy of interacting cyber and physical subsystems (
Fig. 1). In the physical subsystem, power lines (including poles) are abstracted as edges, and physical components (e.g., electricity cabinets, distributed generators, and energy storage systems) deployed within the same low-voltage substation (e.g., a 10.5 kV/380 V substation) are abstracted as a single aggregated node. Similarly, cyber components (e.g., Internet of Things (IoT) devices [56]) located alongside the same RTU (or the DSCC) are abstracted as a single aggregated node in the cyber subsystem, while communication links (including routers and switches) are abstracted as edges. There are also extensive structural interdependencies between the cyber and physical subsystems, as represented by vertical cross-subsystem links in
Fig. 1, where each low-voltage substation is associated with an RTU for the monitoring and control of local physical processes and the RTU relies on the local power supply to maintain its functionality.
2.2. Functional interdependencies
Based on structural interdependencies, physical and cyber subsystems can have functional mutual supports and collaborative operations. The cyber subsystem plays a key role in maintaining the observability and controllability of the physical subsystem, which in turn empowers the cyber subsystem to fulfill its tasks. In principle, the operation of an ADN can be abstracted as a closed loop, where the physical and cyber subsystems are tightly coupled with each other (Fig. 2). More specifically, RTUs control field devices to collect real-time measurements that reflect the actual operating conditions of the physical subsystem, including analog data such as the voltage magnitudes of low-voltage substations and digital data such as the breaker statuses of power lines. The DSCC continuously interacts with RTUs over the communication network to enable situation awareness and thus continually observes the physical subsystem’s operating conditions. Then, the DSCC facilitates decision-making in the energy-management systems (e.g., adjusting the voltage magnitudes and re-dispatching generation units) and instructs RTUs over the communication network to implement control actions in response to any change in the power distribution network. This closed-loop operation procedure is performed on an ongoing basis; however, the cyber subsystem functionality hinges on the existence and quality of the power supply provided by the physical subsystem. For example, each RTU depends on an uninterruptible power supply (UPS) apparatus to maintain its functionality. When the associated low-voltage substation is experiencing an outage, the RTU will fail to function, making the substation neither observable nor controllable due to the limited UPS capacity under continuous hazardous weather events. For a cyber subsystem to function in a trustworthy manner, the operators must always be aware of any deteriorating operating conditions in the physical subsystem; otherwise, the operators would fail to make effective and timely energy-management decisions, as the emergency situations would be hidden from them. In fact, insufficient situation awareness due to cyber failures has already been identified as one of the contributing factors to outages [57].
3. Analysis of the effects of hazardous weather events on ADNs
3.1. Characterizations of hazardous weather evolution
As presented in
Fig. 3, weather conditions are commonly divided into normal, adverse, and extreme based on their probability of occurrence and level of impact
[50]. Among these, long-term adverse weather and extreme weather are classified as low-probability high-impact hazardous weather for ADNs. Low-probability extreme weather with a short duration (i.e., for one day or a few days) can directly cause high impacts; in comparison, medium-low-probability adverse weather has a medium-low impact in the short term. However, when adverse weather repeatedly occurs in the long term (i.e., over many days or even a month), this is also a low-probability high-impact event with respect to the cumulative effects of both probability and impact. Different kinds of long-term adverse weather events (e.g., long-term wind and sunlight scarcity and long-term high/low temperatures) and extreme weather events (e.g., extreme high temperatures, extreme precipitation and flood, snow/ice storm, hurricane/typhoon, and lighting) can result in different catastrophic consequences to ADNs. Hence, it is urgent to first characterize weather evolution by investigating what the specific characteristics of different kinds of hazardous weather are and how they can be analyzed in the context of ADNs. Notably, since ADNs typically cover a far smaller geographical area than power-transmission systems, it is reasonable to assume that all ADN components experience the same natural conditions at any given time. In other words, the progression of the effects of hazardous weather events on an ADN is regarded as being at a standstill, where the damaging impacts depend only on the time that elapses, corresponding to a sequence of time-dependent and location-independent weather conditions.To address various difficulties in characterizing the evolution of hazardous weather (
Table 2 [3],
[58],
[59],
[60],
[61],
[62],
[63],
[64],
[65],
[66]), diverse model-based methods have been developed. General and regional circulation models are the most common methods used to characterize temperature conditions
[58]. Also, since long-term/extreme high temperatures are bred by middle-/low-latitude ocean thermal anomalies [59], heat-wave models are used to simulate and understand long-term/extreme high-temperature trends; in contrast, cold-wave models are exploited to characterize long-term/extreme low temperatures and potential snowstorms with respect to the Arctic amplification phenomenon
[60]. For urban ADNs, localized temperature increases due to human activities can be characterized by urban heat island models. Long-term wind and sunlight scarcities commonly occur in the East Asian rainy season under Western Pacific subtropical-high conditions, during which outgoing longwave radiation data is often used to analyze the behavior of the high-pressure atmosphere [3]. As the most frequent type of extreme weather, hurricanes/typhoons evolve based on ocean-atmospheric dynamic models, while commonly triggering extreme precipitation and ice storms due to strong convective changes
[61]. Using the numerical simulation results of atmospheric dynamic models (e.g., stochastic dynamic prediction and regression prediction [62]), the occurrence intensity, probability, and frequency of extreme precipitation and ice/snow storms can be roughly calculated in the long or middle term. The random evolution processes of wind speeds or precipitation are also consistent with a multi-state Markov chain [63]. As a memoryless discrete time sequence, temporal transitions between Markov states (representing normal, strong, and extreme weather conditions) are only related to the latest state and are not affected by any previous state. Flood disasters accompanied by extreme precipitation are mostly distributed in the middle and lower reaches of great rivers [64]; the Muskingum model is widely used to characterize the routes of floods based on channel storage and hydrologic equilibrium equations [65]. In summary, model-based methods are used to characterize hazardous weather according to specific evolution mechanisms.
Due to technical limitations, short-term or even ultra-short-term evolution mechanisms for several hazardous weather events (e.g., snow/ice storm and hurricane/typhoon) are too complicated to permit the construction of associated models in time for sudden deteriorations of the weather. Fortunately, benefiting from advanced data-driven technologies, strong random weather features (e.g., wind speed) can be extracted and analyzed by automatically constructing mapping rules ranging from wide-area weather measurements to evolution trends
[67]. To achieve accurate modeling of such events, the first urgent step is for researchers to collect measurements from various meteorological observation stations, weather radars, and satellites, including temperature, humidity, precipitation, wind speed, and more. Then, the potential information values hidden in measurements are extracted and sequentially revealed through data preprocessing (e.g., noise removal and missing data imputation) and data mining [68]. In addition to such methods, learning-based artificial neural networks can simulate and predict the complicated processes of weather evolutions. It is possible to characterize the intensity of typhoons and their accompanying extreme precipitation in the ultra-short-term using deep learning, in which the structures and features of the temporal recursive connections are dynamically portrayed [69]. Although deep learning is powerful for fitting weather evolutions, it is likely to overfit when working with insufficient historical and measurement data records. To solve this problem, few-shot learning is applied in Ref. [70] to characterize extreme wind conditions with very few data records, by implementing a Bayesian neural network to learn highly uncertain features. As one of the most unpredictable forms of hazardous weather, lightning is very difficult to characterize based on either model-based or data-driven methods. Although some researchers have combined standard meteorological data and deep learning technologies to model lightning attacks within a radius of tens of kilometers [66], the effectiveness and generalization of this approach require testing.
In specific geographic regions, diverse hazardous weather events commonly occur in an overlapping fashion, which may cause multiple sequential disruptions in ADNs. For example, in southwest China, sustained high temperatures can impact the energy consumption in regions reliant on hydropower and potentially trigger extreme disasters such as wildfires
[71]. Similarly, at high latitudes, snowstorms may occur in a row accompanied by prolonged periods of extreme cold, drastically slowing down the restoration progress by maintenance departments
[11]. Also, ADNs in coastal areas may be severely damaged by hurricanes/typhoons that land multiple times in a short period [12],
[13]. Simultaneous extreme precipitation events and potential floods exacerbate the interruptions to electricity services and communication functions in ADNs
[13].
Two major challenges in modeling overlapping hazardous events are the inconsistent granularity of multidisciplinary temporal–spatial measurements and the complicated interaction mechanisms among different types of events. First, apart from regular meteorological measurements such as rainfall and temperature, it is difficult to achieve fine granularity in the time and space dimensions for data from other disciplines (e.g., hydrology, oceanography, and geology) in order to analyze overlapping hazard events. For example, when studying overlapping extreme high-temperature and wildfire events, data on the state of vegetation and wildfires are much less complete than meteorological data, in terms of both spatial coverage and time span. To address this issue, the data can be enriched by means of advanced measurement technologies such as air–ground coordination [72]; moreover, numerical models can be utilized to re-analyze and reconstruct the measurement data with the purpose of temporal–spatial granularity alignment
[73],
[74]. Second, the evolution mechanisms of overlapping weather events have not been completely explored, making it difficult to analyze them. If we directly use a conventional physical model based on a single series of driving factors for a specific hazardous weather event, the situation may be misjudged
[75]. It is crucial to adopt advanced techniques such as machine learning to comprehensively analyze the temporal–spatial coupling evolution mechanisms of overlapping events. In particular, critical thresholds for typical circulation patterns and important variables that trigger multiple events simultaneously should be identified. For example, when preexisting meteorological and hydrological conditions cause the air dryness to reach a certain threshold, the wildfire risk will reach a critical value beyond which the damage level will increase dramatically. 3.2. Adverse impacts of hazardous weather on ADNs
As shown in
Table 3 [3],
[13],
[26],
[28],
[29],
[50],
[51],
[71],
[76],
[77],
[78],
[79],
[80],
[81],
[82],
[83],
[84], once an ADN is continuously exposed to hazardous weather events, both its physical and cyber subsystems will be adversely impacted in various ways, covering all aspects of its sources, physical/cyber networks, and loads. During overlapping hazardous weather events, the adverse impacts are a specific combination of those listed in
Table 3.
3.2.1. Output decreases of renewable-based distributed generators
As shown in
Fig. 4, when the wind speed or sunlight intensity is consistently lower than the initial point, all distributed wind turbines or solar panels in an ADN will be unable to start or generate power for a long time. During a long-term shutdown of all renewable-based distributed generators in an ADN, once the upper-stream utility grid cannot promptly provide sufficient power supply due to transmission congestion, it may not be possible to fully cover all the load demands by relying only on a few conventional distributed generators with small capacity. In addition, when the wind speed exceeds the allowable upper limit, distributed wind turbines must be shut down to protect their blades [76]. Also, the output power of solar panels is significantly affected by the temperature, especially during long-term low or high temperatures, which not only cause the output to decrease but also shift the initial operation point to the right
[77],
[78]. More seriously, the RTUs and associated UPSs empowered by the distributed solar panels or wind turbines will be interrupted, causing the renewable-based distributed generators to be unobservable and uncontrollable by the DSCC. Renewable-based distributed generators lower the system inertia of an ADN, which leads to a decrease in stability under external hazardous weather, especially extreme weather. Frequent severe frequency deviations and voltage violations cause renewable-based distributed generators to disconnect from their ADN more easily, thereby exacerbating the systemic disturbance and weakening the ADN’s resilience against hazardous weather.3.2.2. Functional and structural changes in network components
The functional and structural changes in a network’s components can be examined from two perspectives: the weather-sensitive dynamic thermal rating and the failure mechanisms.
(1) Weather-sensitive dynamic thermal rating. Owing to the widespread deployment of measurement devices, the dynamic thermal rating, which is conventionally exploited for transmission networks, has recently been a technological hotspot for the high-performance operation of ADNs [79]. Unlike static ratings, which rely on conservative assumptions, the dynamic thermal rating utilizes real-time data on ambient temperature, wind speed, humidity, and precipitation to adjust the current-carrying capacity of power lines
[85],
[86]. From the perspective of the dynamic thermal rating, the impacts of hazardous weather are a mixed blessing. Unfavorable extreme temperatures can dramatically increase the resistance of power lines, reduce the current-carrying capacity, and cause thermal expansion and sags in power lines, which may pose a risk of inadvertent contact with trees and buildings
[87]. Also, under simultaneous long-term high temperature and humidity conditions (e.g., the East Asian rainy season), the actual capacity limit of power lines will continue to be lower than the rated value under normal operating conditions. If ADNs are operated based on a fixed thermal rating, they may suffer from the congestion or even disconnection of the physical subsystem due to a persistent exceedance of the thermal stability limit. In contrast, low temperatures and a high wind speed (e.g., snow/ice storm) help to increase the actual capacity limit of power lines, which may allow ADNs to retain the potential to remain functional under N-k contingencies. Since the dynamic thermal rating of power lines changes with the weather conditions, the role of the cyber subsystem is once again emphasized, as it plays the roles of collecting real-time weather data and detecting the line status. For example, phasor measurement units that integrate wide-area monitoring functions can provide status data on power lines for calculating the dynamic thermal rating [88]. Thus, the dynamic thermal rating of ADNs during hazardous weather may be updated in synchronization with the operational status of distributed resources [89],
[90]. Synergy between the dynamic thermal rating and information and communication technologies for ADNs can enhance the power support capability of various distributed resources (e.g., renewable-based distributed generators, energy storage units, and electric vehicles [91],
[92]).
(2) Failure mechanisms of network components. Under hazardous weather events, instead of adopting a constant failure rate, the failure mechanisms of the network components of physical and cyber subsystems should be integrally analyzed based on both the external weather implications and the internal aging conditions [81]. To reflect the correlation between components’ operating status and hazardous weather changes, logistic regression, multiple linear regression, and proportional hazard models are widely applied [93]. The logistic regression model only considers whether components can survive under various weather and aging factors; it does not calculate the possible survival time. In contrast, the multiple linear regression model only calculates the survival time but lacks judgment on the final condition of the component. The proportional hazard model synthetically takes both the component condition and the survival time as outputs (Fig. 5). In a typical proportional hazard model
h(
t,
Xt), internal and external effects are coupled as two multiplicative factors (i.e., the baseline hazard function h0(
t) and the exponential covariate function exp(
Xt)), where
h0(
t) describes the internal component degradation process that only depends on the accumulated service time t after the last maintenance, and exp(
Xt) quantifies the effects of external weather implications. Commonly,
h0(
t) is formulated as Weibull hazard rate function
with the shape parameter
φ and scale parameter τ, and
T is the most recent maintenance time of a specific component; time-varying weather conditions are incorporated as a covariate vector
Xt = [
Xt,1,…,
Xt,p] containing
p weather-related factors, by which exp(
Xt) is formulated as
with the predefined coefficients
γ1,…,
γp.
Given the structural and functional cyber–physical interdependencies in ADNs, the components in physical and cyber subsystems commonly fail together (i.e., common-cause failures
[10]) and interact with each other (i.e., cascading failures [10]) under hazardous weather events. The former case occurs when two or more components are simultaneously affected because of common causes, while the latter case occurs when the failure of one component causes the failure(s) of one or more other components. Significant cyber–physical interdependencies may even amplify and exacerbate the damage and interruptions caused by common-cause failures and cascading failures [27],
[33].
Fig. 6 illustrates two typical cases of indirect failures caused by cyber–physical interdependencies.
Case 1: The direct failures of communication links 2–4 and 4–5 caused by hazardous weather render RTU 4 inoperable, since RTU 4 is isolated from the remaining cyber subsystem. Hence, the DSCC fails to communicate with RTU 4 to collect real-time measurements from low-voltage substation 4 and the out-of-service renewable-based distributed generator, let alone implementing corresponding supervisory control commands.
Case 2: The direct failures of power lines 1–10 and the shutdown of the renewable-based distributed generator in low-voltage substation 10 jointly force the isolated low-voltage substations 10 and 11 into an outage. The direct failures of communication links 7–9 render the isolated RTU 9 inoperable. The outages further cause RTUs 10 and 11 to be inoperable once the two associated UPSs run out of power. Hence, the DSCC loses its observability and controllability of low-voltage substations 9–11, which hinders the power transfer of the conventional distributed generator at substation 7 through the backup tie line.
3.2.3. Weather-sensitive load demand changes
Maintaining a balance between power supply and demand is a basic requirement to support the normal operation of a power system, especially for an ADN that directly connects to end consumers [51]. Thus, weather-sensitive load demand changes must be considered when comprehensively analyzing the systemic impacts of hazardous weather events on ADNs. In particular, long-term/extreme high-temperature conditions caused by heat waves will increase the use of refrigeration equipment (e.g., air conditioners, electric fans, and refrigerators). The heavy load demands of end consumers may incur bus-undervoltage and line-overloading issues. Also, high temperatures limit the transmission capacity of power lines and increase energy losses, which may further result in massive outages once the balance of power supply and demand in the ADNs cannot be maintained [49]. Under snowstorms, overhead power lines and poles in ADNs may suffer different damages, while end consumers need more power supplies to deal with the severe low-temperature conditions. Unfortunately, residual power distribution networks may be overloaded and unable to cover all the climbing load demands. As a response, the load shedding of high-power electrical appliances on the consumption side—guided or enforced through the cyber subsystem—is necessary to alleviate the scale of outage areas [28]. However, once essential heating equipment (e.g., electric heaters and electric water heaters) cannot maintain normal operations or even fails to start up due to load-shedding commands, the poor level of electricity services will be unbearable for end consumers.
In addition to temperature-related increases in load demand, the adverse weather conditions of high air humidity and sunlight scarcity raise the load demand for dehumidifying and lighting, especially in the long-term East Asian rainy season
[3]. End consumers in ADNs are more likely to feel uncomfortable in hot and humid indoor environments, so they tend to use energy-consuming air conditioners and dehumidifiers to decrease the humidity and temperature. Similarly, sunlight significantly affects indoor and outdoor lighting needs. On sunny days, end consumers prioritize the use of sunlight, thus reducing the electricity demand for lighting equipment. However, during sunlight-scarce periods during the rainy season, the utilization of lighting equipment is extended to daytime to maintain the normal operation of human society, especially in infrastructure-heavy places such as factories and schools that require high light intensity [3]. Also, as a result of other hazardous weather events such as hurricanes/typhoons, extreme precipitation, and ice/snow storms, lighting load demands may suddenly increase due to end consumers’ need to improve the indoor light intensity and sustain emergency lighting facilities outdoors
[46]. The superimposed adverse impacts of harsh humidity, temperature, and light conditions will result in significant distortions and deviations from normal load curves. In response, frequency and voltage controls are performed to alleviate the systemic performance decline of ADNs [37]. However, unlike normal adjustment processes, frequency and voltage deviations caused by changes in load demand are difficult to suppress, considering the simultaneous output decrease in renewable-based distributed generators and the component failures of physical/cyber networks. Furthermore, even if ADNs can barely maintain normal operations by relying on power supplies from the upper-stream utility grid and local gas/diesel generators, any sudden power flow congestion in ADNs or in the upper-stream utility grid may terminate this vulnerable supply–demand balance.Hence, public sectors (e.g., government agencies and regulatory bodies) will issue temporary and non-mandatory policies related to hazardous weather as a means of regulating energy consumption. For example, when hazardous weather poses a threat to ADNs, orderly power-consumption policies encourage consumers to voluntarily reduce their energy consumption during critical periods
[94]. Such reductions help to prevent ADN overload, thereby ensuring continuous power supply for critical infrastructure (e.g., hospitals). Strategic time-of-use pricing adjustments can be simultaneously implemented to incentivize off-peak power usage and promote consumers’ participation in orderly electricity consumption
[95],
[96]. In addition, during certain specific hazardous weather events (e.g., extreme high or low temperatures), the authorities might also open community centers as cooling or heating shelters, to provide safe and temperature-controlled environments for vulnerable populations in order to reduce the need for excessive energy consumption in individual homes
[97]. Although these policies are temporary, they can promote long-term energy-saving habits among consumers. Also, by being non-mandatory, these policies rely on consumer cooperation and voluntary actions, which can foster a sense of community and shared responsibility. However, the successful implementation of such policies depends on public participation and awareness, which may be challenging without widespread cooperation. Accordingly, effective communication via the cyber subsystem is crucial to ensure that the public understands the importance of those policies and knows how to respond to them effectively. Government agencies and regulatory bodies also need to ensure that these policies do not disproportionately affect low-income or vulnerable populations.4. Resilient operation under cyber–physical interdependencies
4.1. A systematic resilient operation framework
Unlike widely studied information attacks, which first interrupt only the cyber subsystem and then impact the entire ADN, hazardous weather events directly damage both physical and cyber subsystems simultaneously and then continuously expand the cyber–physical interruptions
[27]. Hence, we establish a comprehensive cyber–physical resilience analysis framework that focuses on collaborative cyber–physical operations throughout hazardous weather (
Fig. 7). More specifically, continuous situation awareness is crucial to the implementation of preventive dispatches, corrective actions, and restorative actions in response to various disruptions during any hazardous weather event
[19],
[23]. In this regard, ADNs can proactively address the issues caused by hazardous weather rather than dealing with them in a conventional passive way. Considering the widespread cyber–physical interdependencies in ADNs throughout the entire evolution of hazardous weather events, preventive dispatches provide proactive countermeasures before events occur, as well as predesigned sets of the operation plan to be used during events to facilitate corrective actions. The corrective and restorative actions support each other by containing spreading interruptions and maintaining damaged components
[46].
Fig. 7 shows a typical evolution curve of targeted (i.e.,
Q′(
t)) and actual (i.e.,
Q(
t)) operation performance for an ADN (quantified by electricity services) before, during, and after the occurrence of a hazardous weather event
[47],
[48],
[49]. Although the evolution curve describes changes in electricity services from a single physical perspective and thus can follow the conventional curve, cyber–physical interdependencies are considered when analyzing the resilience in each stage. The evolution of operation performance proceeds over time in the following manner: It retains the targeted level
Q0 between
t0 (when the event unfolds) and
t1 (when the event incurs severe disruptions), undergoes a sharp decline until
t2 (when the event passes through), starts to improve after
t3 (when restoration starts), rapidly improves between
t3 and
t4, and finally returns to the targeted level at
t4 (when all electricity services are recovered). It should be noted that the span of the evolution curve for long-term adverse weather is relatively longer than that for extreme weather, especially regarding the long-term accumulation of adverse effects from
t0 to
t1, although the shapes of their evolution curves are similar. Preventive dispatches and corrective actions are implemented in sequence (i.e., before and after
t1) by the dispatch departments of the ADN; on another path, restorative actions are carried out by maintenance departments
[30],
[44]. The joint efforts of dispatch and maintenance departments, which take on different yet complementary responsibilities, promote the strategic resilient operation of ADNs. In particular, corrective and restorative actions, corresponding to the improvement process between t3 and
t4, are generally implemented in parallel to coordinately address post-disaster ADNs.
4.2. Situation awareness throughout hazardous weather
Relying on advanced information and communication technologies, resilience-oriented situation awareness exploits widely distributed sensors to understand current situations and anticipate changes. Hence, DSCCs can proactively address systematic interruptions caused by hazardous weather events
[19] concerning the structural integrity and functional availability of ADNs. More specifically, as shown in Fig. 8, structural integrity is related to physical/cyber networks and interdependent connections, while functional availability concerns the safe operation status and economical electricity services of the physical subsystem, as well as the observability and controllability of the cyber subsystem. The implications, works, and bottlenecks of situation perception, comprehension, and projection are different from conventional ones with regard to cyber–physical interdependencies.
With the increasing utilization of IoT-enabled field devices (e.g., phasor measurement units), IoT-enhanced advanced metering infrastructures, and patrol drones and satellites for ADNs, massive operational data, texts, snapshots, and videos can be measured and transmitted in real time to perceive and report on current situations under hazardous weather. In response to sudden changes in ADNs, 5G message queuing telemetry transports can expedite information-transmission speeds among field devices, RTUs, and DSCCs in a bidirectional request–response fashion [52]. The applications of synchronous timing by satellites (e.g., the Global Positioning System and Beidou System [98]) ensure the timeliness of situation perception and thus tighten cyber–physical coupling in the temporal dimension. Also, local clock synchronizations by specific protocols (e.g., network and precision time protocols [53]) and timestamps enable the real-time observation of semi/steady operation states (e.g., unpredictable voltage violations and communication interruptions by hazardous weather). Furthermore, social media, which platforms act like generalized cyber sensors by continuously collecting vast amounts of data from diverse sources (end consumers) across the Internet, can reduce communication investment for conventional sensors. The attitudes of end consumers toward hazardous weather events are quickly perceivable on social media. Nevertheless, the perceived situation may be untrustworthy due to fragmented, noisy, or even false information on social media.
Resilience-oriented situation comprehension for ADNs focuses on coupled physical and cyber subsystems as an integrated entity. Associated external factors from other critical infrastructure systems (e.g., the transportation system related to electric vehicles) and the social system that enhance the resilience of the ADNs are also projected to the ADNs. To comprehend the current situation of this complex coupled system, a feasible approach is to analyze widely distributed heterogeneous measurements from the temporal and spatial dimensions separately. In the temporal dimension, the internal physical and cyber subsystems in ADNs encompass the dynamic nature of certain coupled nodes and edges over time. For example, temporal data mining and fusion can reveal the resilience-enhancement potential of user-side flexible loads over diverse time intervals [99], such as hourly proactive load shedding and minute-level emergency load transfers. At each time slice, the cyber subsystem comprehends the overall operational conditions of the ADN; in the next moment, the DSCC can implement proactive actions against hazardous weather. For example, coupled power, traffic, and information flows in the spatial dimension indicate that, by urgently adjusting the traffic signals, electric vehicles can be guided to support critical load demands, thereby reducing the area of outages. To technically interpret such massive and heterogeneous time-varying operation measurements in a cyber–physical system, spatiotemporal-graph-based approaches provide holistic insights into both spatial and temporal attributes and their interactions under hazardous weather
[35]. By exploiting spatiotemporal graph neural networks [100],
[101], hidden patterns and trends of the cyber–physical system can be uncovered. Digital twins also provide real-time visualization of and insights into an ADN’s complicated status [102]. Comparing actual measurements with expected behaviors simulated by digital twins allows the anomalies and faults caused by hazardous weather to be quickly detected. Then, the dynamic structural integrity and functional availability, as well as potential disruptions within or across subsystems, can be tracked and understood.After situation comprehension, the current situations of the ADN will be projected as a series of instructive actions, including early warning, hazard assessments, state estimation, and fault detection by SCADA
[19],
[20],
[21],
[22],
[23]. Early warning and hazard assessments guide ADNs to proactively respond to physical or cyber interruptions according to the different kinds and risks of hazardous weather events
[19]. Careful consideration of long-term adverse weather events in advance enriches the implications of early warning and hazardous assessment, allowing the time and spatial scales of situation awareness to be expanded. In other words, conventional short-term early warnings only for extreme weather must be modified to long-term warnings; moreover, additional hazardous weather events (e.g., long-term wind and sunlight scarcity) and consequent adverse impacts (e.g., long-term shutdown of all renewable-based distributed generators) require increased efforts for hazard assessment.Unlike conventional power distribution systems, ADNs involve bidirectional power flows, multiple energy resources, and dynamic network topologies, making the state estimation more complicated in the context of resilience analysis. Especially considering the dynamic thermal rating, the nonlinear relationship between weather conditions (e.g., wind speed and temperature) and the rated capacities of power lines complicates the state estimation [85],
[86]. In addition to branch power flow and node voltage, state estimation is generalized to accurately determine the real-time operating conditions of distributed energy resources and flexible loads against hazardous weather [22]. In particular, additional considerations for resilience-oriented state estimation include the regulation capacities of distributed generators, primary energy inventories and market prices, states of charge for energy-storage systems, and user-side aggregated demand curves. Cyber–physical coupled failures increase the difficulty of fault detection during and after hazardous weather, especially the damaged topology identification of both the physical and cyber networks. Also, with the gradual restoration of the cyber subsystem and the corresponding improved observability, existing faults in an ADN can be quickly detected.
4.3. Preventive dispatches before hazardous weather
Before hazardous weather events occur, continuous situation awareness enables the implementation of early warning, hazardous assessment, and state estimation for ADNs. Hence, preventive dispatches can purposefully assist ADNs to reduce potential damage and interruptions of both the physical and cyber subsystems, while laying a decision-making foundation for subsequent corrective actions. Generally, preventive dispatch strategies not only include proactive countermeasures (Stage 1) before the occurrence of hazardous weather but also verify operation plans through simulated hazardous weather in advance (Stage 2;
Fig. 9)
[26],
[27],
[103]. A verified operation plan can be regarded as a benchmark for implementing subsequent possible corrective actions. Two-stage programming models are mathematically formulated to determine certain preventive objectives while considering both the physical- and cyber-side operation-related elements (
Table 4). Notably, preventive dispatches are carried out based on simulated scenarios, so it is necessary to establish a compromise between the resilience performance and additional economic costs at these two stages.
4.3.1. Stage 1: Proactive countermeasures before hazardous weather
In Stage 1, proactive countermeasures are taken for both the physical and cyber subsystems.
(1) The physical subsystem. Taking into account the ADN’s built-in flexibilities and flexible energy resources, both the utility and individual parts are preventively dispatched against possible massive outages. In particular, sufficient energy reserves at each low-voltage substation are essential for maintaining electricity services under hazardous weather events. Energy reserves are commonly realized by charging energy-storage systems, gathering mobile energy resources (e.g., electric vehicles and emergency generators), purchasing primary energy resources, and so forth. Notably, although the increasing penetration of renewable energy resources brings additional outage risks, preventive dispatches of renewable-based distributed generators can support resilient operations against extreme weather events. Micro-sensors and control units embedded in inverter-based wind turbines and solar panels enable bidirectional power and information interactions, through which the renewable-based distributed generators can shift their outputs and act as energy reserves by charging energy-storage systems [26]. Under long-term adverse weather events (e.g., long-term wind and sunlight scarcity), renewable-based distributed generators may shut down throughout the event; thus, preparing adequate primary energy reserves for the conventional distributed generators is the most important measure. In addition, in possible outage areas, proactive network adjustments and load curtailments are necessary to cooperate with the energy reserves. Potential damaged traffic roads during hazardous weather (e.g., extreme precipitation and flood) are also considered when making basic schedule plans for mobile generators and electric vehicles under extreme weather [104]. In addition, the latest studies (e.g., Refs.
[105],
[106],
[107]) propose cooperating with microgrids in ADNs to enhance the operational resilience with localized electricity services. When the power supply from the upper-stream utility grid is unexpectedly interrupted, microgrids could connect with ADNs as a backup power support for isolated power islands. (2) The cyber subsystem. To mitigate the degradation of observability and controllability caused by hazardous weather, redundant deployment of field devices and corresponding traffic-routing paths are essential
[26]. Similarly, redundant UPSs to maintain RTUs’ functional operations are significantly beneficial once the associated low-voltage substations undergo prolonged outages; backup communication channels and data-forwarding functions will reduce potential communication congestion as numerous emergency data packets are uploaded to the DSCC at the same time. Technically, software-defined networking technologies allow SCADA to manage cyber subsystems by separating the control plane (which makes decisions on how to reroute data traffic) from the data plane (which forwards the actual data traffic)
[108]. By relying on the programmable architecture of software-defined networks, the cyber subsystem can be automatically reconfigured to avoid the spread of faults. Furthermore, depending on their situation awareness, operators can perform vulnerability assessments of ADNs to analyze potential weaknesses and susceptibilities in the context of different hazardous weather events. This assessment process involves structural and functional examinations (e.g., of wired communication links and power lines under hurricanes and wireless communication functions under high temperatures), with the aim of uncovering vulnerabilities that might accidentally trigger massive outages. In this way, operators can purposefully alleviate identified vulnerabilities. In addition, it is necessary to delegate part of the DSCC’s centralized control functions to local RTUs, such as local (re)active power regulations, to maintain the automatic power flow balance in potential power islands. Partial decentralization at the cyber subsystem significantly improves an ADN’s self-organization and self-healing capabilities during the corrective and restorative stages following an adverse weather event, while lessening the communication burden of the DSCC that interacts with all RTUs.4.3.2. Stage 2: Operation plan verification during simulated hazardous weather
Relying on the proactive countermeasures made in Stage 1, basic operation plans against hazardous weather can easily be formed. According to the most likely physical and cyber damage identified during Stage 2, the basic operation plans are carefully verified to see whether the ADN can tolerate operational performance degradation of the physical subsystem and observability/controllability decreases in the cyber subsystem. It should be noted that, although Stage 2 is simulated, all possible actual impacts during hazardous weather (e.g., the dynamic thermal rating of power lines, high packet loss, time delay, and bit error of wireless communication) should be taken into account [80],
[87]. If it is found that one or more possible impacts are not covered by the operation plan, Stage 2 will feedback adjustment information to guide Stage 1 to make corrections. If the plan is shown to consider all possible impacts under the simulated scenarios of various hazardous weather events, the basic operation plans are modified at a fine granularity to form multiple back-up contingency plans, which include joint sets of physical and cyber operation plans for the subsequent corrective actions. In particular, both in-service-line switch-off and out-of-service-line switch-on actions must be able to reconfigure the damaged distribution network and thus ensure that each potential outage area has at least one power resupply path [46]. Similar to the damage done to the physical subsystem, the envisioned hazardous weather events will force the cyber subsystem to suffer a certain degree of disruption. With communication link disconnections and RTU failures, the DSCC must rapidly adjust damaged communication networks and corresponding communication modes. Traffic path rerouting and data packet reforwarding schemes among the DSCC, functional RTUs, and field devices must also be verified in advance.
4.4. Corrective actions during and after hazardous weather events
Even when following the predesigned basic plans, an ADN might still be endangered, primarily due to the high uncertainties and impacts of hazardous weather
[28],
[29]. Accordingly, based on suitable back-up contingency plans, real-time corrective actions are essential to curb the level of damage during a hazardous weather event. Depending on the completeness of the cyber subsystem, the ADN’s systemic corrective actions can be formulated as either Model 1 or Model 2 in
Table 5 [109]. Model 1 assumes that part of the RTUs have lost communication with the DSCC (due to associated communication link damages, insufficient UPS energy, or direct damage), while Model 2 assumes that all RTUs have complete communication with the DSCC. In addition, part of the ADN’s alternating current (AC) networks may be converted into direct current (DC) networks to facilitate the large-scale integration of DC-reliant flexible resources (e.g., energy storage, photovoltaics, and electric vehicles) [110],
[111]. Thus, without loss of generality, we assume that ADNs are AC–DC hybrids when dispatching various types of flexible resources for corrective actions. The existing cyber–physical interdependencies are further enhanced by the wide application of power electronics in ADNs, such as voltage source converters (VSCs) and soft open points (SOPs) [109]. Accordingly, in Model 1 or Model 2, the states of the observability and controllability of low-voltage substations, power lines, power electronics, and other flexible resources can be embedded into branch flow equations by using dummy binary variables
[57].
As shown in
Fig. 10, the actual corrective actions for an ADN heavily depend on the situation awareness of the outage areas. With an incomplete cyber subsystem, the basic situation awareness results (e.g., network topology, bus voltage, and power flow) may be inaccurate. This is because the operation information of the outage states of low-voltage substations and damaged power lines will remain the same as the last available measurement when the local RTUs were functional. Especially for sudden large-scale damage during extreme weather events (e.g., hurricane/typhoon and snowstorm), the estimated outage states are not exactly the same as the actual conditions, which results in the partially observable outage constraints in Model 1. Also, since the DSCC’s control commands cannot be sent to uncontrollable substations without functional RTU supports, it is difficult to realize ideal operation (i.e., Model 2) and the corresponding global optimal power flow distributions. In addition, non-ideal communication concerns (e.g., time delay, packet loss, and bit errors) are emphasized in the case of an incomplete cyber subsystem, due to the suboptimal traffic routes among the DSCC and functional RTUs. To be compatible with a non-ideal communication environment, especially to avoid mis-dispatches, the DSCC must perform data checksums and error corrections before optimizing Model 1, which will delay the commands propagated from the DSCC to the RTUs. This delay, the basic communication time, and the optimization time all need to be pre-embedded into Model 1 in the form of delay compensation concerning the time-sensitive nature of the corrective actions
[110]. After solving Model 1 via the DSCC, the controllable physical components associated with functional RTUs will execute relevant broadcasted instructions. For uncontrollable components, the last controllable supervision by the DSCC is maintained. Consequently, owing to the corrective actions, the cyber subsystem will endeavor to coordinate as many physical components as possible to restrain the spread of damage and ensure resilient operations, thereby laying the foundation to rapidly restore the ADN after the hazardous weather event is over. With the subsequent restorative actions in the cyber subsystem, Model 1 is gradually modified to become Model 2.
Advanced power electronics technologies and software-defined networking technologies jointly enable the faster failover and flexible reorganization of ADNs with both physical and cyber damage.
Fig. 11 illustrates a case in which more than one power line and communication link are disconnected due to a hazardous weather event. As responses to such events, systematic failover and reorganization generally do not involve power dispatches within power islands but integrate all power islands from an overall perspective. Since a power island with no energy source would undoubtedly undergo a severe outage, AC power island 1 submits a connection request to the DSCC (
Fig. 11(b)) and then smoothly reconnects with the main grid via the SOP (
Fig. 11(a)). DC power island 2 and AC power island 3, which have power supports from microgrids or distributed energy resources, can temporarily maintain their operations. Cooperative requests to microgrids are commonly initiated by the DSCC, after which the power islands and microgrids can be synergistically operated by the DSCC and microgrid master controllers.
In addition, AC power island 3, which has insufficient energy resources, can connect to DC power island 2 via the VSC as an aggregated AC/DC hybrid island to seek external power support. Although the operation mode of this aggregated AC/DC hybrid island is more complicated, the overall operational efficiency and stability are improved (e.g., richer energy resources and stronger system inertia). More importantly, the existing information silo 1 is eliminated when the RTUs equipped in the aggregated AC/DC hybrid island are connected, through which the control commands of DSCC can recover AC power island 3. By sensing the operational situation of all islands and the main grid, the cyber subsystem can monitor whether the VSC and power lines are out of their respective power limits and whether the power/energy is adequate for the aggregated AC/DC hybrid island. It should be noted that, to adapt to the distorted power flow distribution due to the changed physical network topology in
Fig. 11(a), it is crucial to permit the overloaded operation of power lines by considering the dynamic thermal rating under specific weather conditions (e.g., snow/ice storm)
[87],
[88]. When the power imports from microgrids and distributed energy resources are greater than the local load demands plus the line losses in the aggregated AC/DC hybrid island, automatic generation curtailment is applied until the internal power flow is rebalanced; in contrast, automatic generation increase is executed. Once the local regulations exceed the limits, the island operation modes can flexibly adjust. Nevertheless, corrective actions can only suppress functional degradations as much as possible and cannot restore the initial structural integrity of an ADN. For example, Information silo 2 still exists (
Fig. 11(b)); the aggregated AC/DC hybrid island cannot operate for a long time due to limited primary energy inventories and poor electricity service caused by the severe load curtailments. Accordingly, as shown in
Fig. 10, during a hazardous weather event, only corrective actions are performed in a rolling fashion; after the hazardous event is over, the mutual support of corrective actions and subsequent restorative actions are necessary.
4.5. Coordinated restorations after hazardous weather events
In parallel with corrective actions, after a hazardous weather event, restorative actions are implemented by the maintenance departments of the ADN; these restorative actions depend on situation awareness to update the damage status of both the physical and cyber subsystems. Compared with conventional restoration strategies that only focus on physical maintenance, coordinated cyber–physical restoration emphasizes the significance of the cyber subsystem recovering its observability and controllability in order to holistically accelerate other processes. Without loss of generality,
Fig. 12 summarizes a typical coordinated cyber–physical restoration process for an ADN. In this process, the structural integrity and functional availability of the physical and cyber subsystems are monitored by means of continuous situation awareness. When any interruption occurs or is found to exist, coordinated cyber–physical restorations are implemented. The physical and cyber subsystems’ repair crews, as well as mobile energy resources, prioritize the restoration of critical physical components (transformers, root power lines, non-interruptible loads, etc.) and cyber components (DSCC, RTUs, etc.) in parallel. The recovery of critical cyber components then improves the basic observability and controllability of the physical subsystem by rerouting the recovered DSCC and RTUs, whereas the recovery of critical physical components enables the functional operations of the cyber subsystem. When the inoperable RTUs and their communication links with the DSCC have been recovered as much as possible, almost all low-voltage substations and power lines can once more be observed. Based on the observed connectivity and integrity of the physical subsystem, the DSCC optimizes the global route of the repair crews and mobile energy resources for the ADN to restore the general physical components (e.g., power lines and distributed generators), according to the latest available status. By activating different kinds of distributed energy resources and importing power from the upper-stream utility grid in a strategic sequence, the ADN will come back online in an orderly manner. The stability of the frequency and voltages will gradually be restored as well, through load-frequency control and reactive power-voltage control by means of corrective actions.
From a global perspective, the integration and solving of a coordinated cyber–physical restoration model are quite challenging. In particular, there are routing problems related to the repair crews and mobile energy resources; that is, the physical and cyber subsystem repair crews and mobile energy resources operate in parallel in time and space but affect each other due to the cyber–physical interdependencies shown in
Fig. 12. Hence, it is necessary to first harmonize the physical and cyber subsystems along the same time axis, and then synchronously explore the restore sequence of both the disrupted physical and disrupted cyber components
[41]. The coordinated restoration can be mathematically formulated as a bi-level optimization problem, in which the physical and cyber subsystems optimize their respective models in different spatial dimensions and coordinate with each other via coupled variables [112]. Considering the importance levels of the disrupted physical and cyber components, especially for loads with different properties (e.g., industrial, commercial, and residential loads), critical components are assigned a higher restoration priority by setting larger cost coefficients in the optimization models. More rigorously, we can also enforce that the components must be recovered in order of priority in the constraints or formulate a multi-stage model in order of priority, where each stage solves the restoration problem with the remaining resources from the previous stage. Because of the numerous nonlinear constraints and integer variables, representing the states of the repair crews, mobile energy resources, communication nodes, and so forth, optimization models for both physical and cyber subsystems are nonconvex. Thus, converging exact mathematical programming methods to the global optimality is very time-consuming, although skillful convex reformulations can simplify partially specific nonconvex terms [41]. The excessive solution time directly decreases the implementation speed of restorative actions, which could cause the failure of the entire coordinated restoration process. Accordingly, a simple modeling process for post-disaster ADNs with appropriate pretreatment measures may better alleviate the computational burdens in designing systemic and rapid restoration strategies (e.g., status updates by developing the repair-event-triggered mechanism and cyber–physical connectivity simplifications through the single-commodity flow model in Ref. [41]).
Affected by the varying degrees of cyber disruptions, it may be difficult to obtain an accurate system status at the very beginning of an adverse situation caused by a hazardous weather event. The observability and controllability of the cyber subsystem are lowered under large-scale cyber failures caused by hazardous weather, making the aforementioned centralized restoration strategies impractical in real-life applications
[40]. Hence, another feasible attempt is to restore a post-disaster ADN from the local perspective to the overall perspective. In this sense, decentralized approaches such as multi-agent cooperative restoration enables power islands to achieve dynamic internal self-restoration and obtain mutual emergency power supplies by arranging mobile energy resources. Meanwhile, several field devices in the ADN (e.g.,
ad hoc devices) process horizontal data-exchange functions, while various auxiliary cyber–physical devices (e.g., patrol drones and electric vehicles) have potential networking and communication capabilities. Local emergency communication networks can be rapidly organized to bridge the damaged cyber subsystem. In particular, considering gradually popular user-side wireless private networks, ad hoc devices enable direct device-to-device communication for flexible remote network reconfiguration under large-scale cyber subsystem failures [38]. If the traffic conditions of the transportation systems are not damaged (e.g., after long-term adverse weather), electric vehicles with wireless mobile communication capability can be regarded as communication agents to organize survivability-aware routes for repair crews and mobile energy resources
[35]. Conversely, small drone cells, acting as aerial wireless base stations, provide a reliable alternative to cover outage areas once both the ADNs and traffic roads are damaged severely (e.g., after extreme precipitation and consequent flooding) [43]. With progress in repairing the cyber subsystem, the restoration mode should be adjusted back to the centralized mode by the DSCC, whereby suboptimal decentralized restoration processes are modified to optimal processes from a global perspective.
If hazardous weather events overlap, post-disaster ADNs may not be fully restored before subsequent disasters occur. Ongoing restorative efforts by repair crews and mobile energy resources may be forced to be suspended in the face of intermittent harsh catastrophes. Unfortunately, due to the inconsistent granularity of multidisciplinary measurements and the complicated interaction mechanisms of overlapping events, it is difficult to avoid all interruptions at once in most of the current restoration strategies for ADNs. Consequently, the evolution curve shown in Fig. 7 is modified as shown in
Fig. 13, where multiple disruptions caused by overlapping hazardous weather events may decrease the operation performance at different stages
[113]. In such circumstances, the actual systematic restoration of an ADN changes, becoming an oscillatory improvement process. From
t1 to
t2, the initial disruption 1 significantly decreases the operation performance of the ADN, which necessitates the joint effects of corrective and restorative actions between t3 and
t4. Unexpectedly, overlaps and repeats of hazardous weather events may incur disruptions 2 and 3, which decrease the operation performance again at
t′ and
t″. To alleviate these multiple degradations and the consequent slowdown in the overall restoration process, it is essential to further characterize oncoming hazardous weather events at multiple stages and conservatively perceive their future situations by means of the cyber subsystem. This corresponds to robust multi-stage optimization in mathematics, which exploits a recursion-like idea to solve a robust solution at each stage that accounts for the effects of all previous stages [114].
In practice, the coping strategies that have been attempted are similar to the idea of robust optimization but are simpler and more brute-force. For example, under an extreme high temperature weather event, some regions in southwest China implemented varying degrees of consecutive electricity restrictions—even though the current disruptions caused by the extreme high temperature had been restored—to avoid larger unanticipated disruptions caused by wildfires [115]. Under such circumstances, dispatch and maintenance departments can prepare to implement secondary or even multiple corrective and restorative actions on site. Disruptions 2 and 3 in
Fig. 13 will thus be less severe than disruption 1.
4.6. Quantitative evaluation of cyber–physical resilience performance
In this section, works on the quantitative resilience evaluation of ADNs are reviewed and analyzed. Unlike conventional evaluations, which only concern the physical side of power distribution networks, ADNs are regarded as resilient only if the adequacy and continuity of both the physical and cyber subsystems have been maintained. In
Table 6, representative conventional resilience metrics and additional metrics with respect to cyber–physical interdependencies are classified. Here, static metrics mainly include the network performance and degree of degradation of an ADN. The network performance evaluation of both the physical and cyber subsystems is generally based on graph theory, which is highly correlated with resilient implications. For example, topological performance is used to evaluate the local network resilience [104],
[116], while spectral performance is used to examine the global network resilience
[117],
[118]. The degree of degradation indicates the maximum decreases in the physical-side operation capability and electricity services, and the cyber-side systemic observability and controllability
[119],
[120], to judge whether an ADN can recover from the lowest point of operation performance. In addition, taking advantage of the advanced complex network theory, the interdependent cyber-physical resilience performance of an ADN can be well quantified by the interdependent weight [121], degree of coupling
[122], and coupling pattern
[89]. Compared with static metrics, which evaluate the resilience at a certain moment, dynamic metrics are formed based on the time-varying operation performance curve, as shown in
Fig. 7 [123],
[124]. In addition to conventional dynamic metrics, a shorter duration time in situation awareness and systemic observability/controllability lead to a higher resilience performance and lower economic costs when coping with hazardous weather events. A smaller observability/controllability loss and smaller size of cyber–physical avalanche collapse
[35] indicate that the cyber and cyber-physical coupled interruptions in the ADN are well contained by the resilient operation strategies.
To go one step further, in practical engineering, operators tend to comprehensively quantify the resilience performance of ADNs by synthesizing the specific resilience metrics described above. For example, high-dimensional resilience matrices provide a clear numerical representation of systemic resilience for different aspects and under different threat events
[125]. For ADNs, the simplest three-dimensional resilience matrix, with the three dimensions representing hazardous weather types, physical/cyber subsystems, and resilience metrics, respectively, allows for the straightforward visualization of weak metrics after normalizing all elements. In each specific two-dimensional submatrix, such as the cyber subsystem submatrix, detailed resilience performances under different hazardous weather events are intuitively compared to disclose relatively weak metrics in the cyber subsystem. In addition, entropy weight methods [126] enable operators to integrate all quantitative metrics in this resilience matrix as one abstract value to represent the overall cyber-physical resilience against all possible hazardous weather events.
However, entropy allocation processes, which are purely data driven without any expert guidance, usually lack interpretability and may be unreasonable. Besides, although different kinds of static and dynamic metrics quantify different resilience-related aspects, the coupling relationships among them are widespread, especially considering cyber–physical interdependences. Based on analytic hierarchy processes [127], the subjective opinions of operators regarding specific metrics about the physical subsystem, cyber subsystem, and cyber–physical interconnections can easily be transformed into different weights. The hierarchy commonly involves three vertical levels: the goal level, criteria level, and sub-criteria level. As the name suggests, the goal level quantifies comprehensive resilience. The criteria level contains the resilience performance of the physical and cyber subsystems, as well as the cyber-physical interconnections, where the differentiated weight coefficients are flexibly set by operators. In the sub-criteria level, specific static and dynamic metrics in
Table 6 are selected to evaluate certain aspects of resilience according to the classifications in the criteria level. Consequently, alternatives (i.e., different resilient operation strategies) can be sequentially calculated and weighted via the sub-criteria and criteria levels, respectively, to finally quantify their resilience values in the goal level.
Without loss of generality, here we summarize a quantitative cyber–physical evaluation process (
Fig. 14). The very first step is to identify types of hazardous weather because the evolution of resistance is aimed at specific hazardous weather events (e.g., resilient operation under a snowstorm will inevitably fail under a flood). Then, through comprehensive expert inference (e.g., subjective metrics and corresponding weights) and mathematical analyses (e.g., objective calculation formulas), operators can integrate and quantify the resilience of physical and cyber subsystems and the interdependent cyber–physical resilience. It should be noted that additional resilience-enhancement actions commonly lead to high costs. Therefore, it is necessary to compromise to achieve a balanced solution. Finally, the quantitative results of resilience are effective for evaluating certain resilience-enhancement strategies or comparing an ADN’s resilience performance under different operational conditions. By comparing the practical resilience value (in a real fault scenario) with the targeted resilience values (in several probabilistic simulation-based scenarios), weak metrics can be traced back to the source to guide subsequent actions.
5. Discussion
5.1. Potential compounding of natural and human-made disasters
With the significant development of IoT technologies, increasingly advanced metering infrastructures (e.g., smart meters) are widely deployed in ADNs [128]. Under natural disasters, especially hazardous weather events, these wider-range metering infrastructures produce massive real-time situation-awareness data packets to support the resilient operations of ADNs. Meanwhile, the application of advanced wireless communication technologies (e.g., 5G) reduce the possibility of direct link damages and thus indirectly improve ADNs’ resilience in response to hazardous weather. However, wireless communications are relatively weaker in cyber security than wired communications under both active and passive attacks [14],
[15],
[16]. As a result of this lower level of cyber security, data flows in the communication network can easily be intercepted and manipulated by hackers (
Fig. 15)
[17]. Worst of all, potential cyberattacks by hackers are catastrophic for ADNs when both their physical and cyber subsystems are already suffering from hazardous weather events and corresponding N-
k disruptions
[129].
In addition, with the expansion of incremental distribution business (e.g., industrial parks and smart buildings [130]), local independent investments have made ADNs socialized and diversified. Challenges to resilient operation are further raised in the social system in terms of bounded rational or even malicious human behaviors. The thinking patterns, decisions, and associated electric demands of irrational consumers may be adversely affected by negative public opinions or even rumors (e.g., false prices and exaggerated power shortages
[131]) during various hazardous weather events (
Fig. 15). Many consumers in ADNs may shift their load demands from conventional peak-demand periods to valley-demand periods, which may cause a series of adverse influences (e.g., power line overload, voltage constraint violation, and subsequent potential large-scale outage). On social media, negative public opinions and rumors may be further widely disseminated due to the imitative behaviors of consumers in ADNs
[132], thereby compounding the natural and human-made disasters. Hence, the latest technical bottleneck is how to cross-validate the authenticity of measured information from social media concerning personal sentiments, topic relevance, and differences in attitudes.
5.2. Resilience of critical infrastructure systems
In addition to ADNs, consumers are dependent on a large number of fundamental services from other infrastructure systems (e.g., transportation, natural gas, water, and cooling/heating systems). On the one hand, with frequent energy exchanges and information interactions, mutual support among critical infrastructure systems can enhance their respective resilience against hazardous weather. On the other hand, these infrastructural interdependencies could increase the risk of systematic collapse, since cascading failures would result in cross-system damages [69],
[70].
Table 7 [133],
[134],
[135],
[136],
[137],
[138],
[139],
[140],
[141] shows corresponding challenges and countermeasures to leverage the benefits of resilience enhancement by considering multiple infrastructure systems and to avert potential disasters. These challenges are further described below.
Diversified time constants. ADNs with a small electrical time constant have a fast response performance, whereas natural gas, water, and cooling/heating systems have significant time-delay problems with regard to the energy-storage capacities of their networking pipelines. In the transportation system, the cycle time, split time, and phase sequences of traffic signals and the different charging modes, traffic flows, and speeds of vehicles jointly make the system’s time constant fluctuate over a large range with changing operation conditions. Thus, multiple timescale analyses and dynamic model embedding
[133],
[134] are common countermeasures for formulating resilient operation models of multiple critical infrastructure systems; however, these naturally complicate the resilience analysis.
Nonconvex mathematical models. Natural gas, water, and other fluid energy network equations have many nonlinear terms, while transportation system models have many discrete variables (e.g., traffic signals). Attempts have been made to deal with nonconvex terms by means of piecewise linearization [135] and convex relaxation [136]. However, these mathematical tricks only work for specific nonconvex forms; for other forms, they may result in suboptimality. It would be better to customize different nonconvex mathematical programming methods according to the types of infrastructure system compositions and hazardous weather events. In contrast, heuristic algorithms [137] have been criticized for possible local optimality and are thus only suitable to assist in analyzing resilience. Preserving privacy. Since critical infrastructure systems are managed by different stakeholders, these stakeholders’ respective privacy information (e.g., economic/technical parameters) should be preserved when conducting resilient operations in a coordinated manner. Most conventional privacy-preservation methods based on distributed decision-making require convex representation to ensure optimality [138],
[139]. However, given the widespread nonconvex terms, if the convex relaxation is excessive, the original model is already inaccurate, whereas if the convex relaxation is inadequate, the iterative process is difficult to converge. Also, frequent interactive communication raises additional cyberattack issues
[142],
[143]. Thus, if we instead exploit cryptography-based encryption and decryption by means of additional software and hardware, we can not only preserve privacy but also enhance the resilience of cyber subsystems
[140],
[141].
5.3. Resilience from the social perspective to the physical and cyber perspectives
In the extremely uncertain environment of a hazardous weather event, customers behave with bounded rationality to reduce their personal adverse impacts from potential outages
[144],
[145]. From a social to physical perspective, this directly complicates the operation status of ADNs. Meanwhile, from a social to cyber perspective, negative public opinions and rumors about the hazardous weather and power shortages may be disseminated through social media, especially in urban ADNs. However, due to the lack of universal modeling methods for human behaviors, as shown in
Table 8 [144],
[145],
[146],
[147],
[148],
[149],
[150], existing studies mainly focus on qualitative analysis or simple quantitative analysis.
From a social to physical perspective. Unlike basic utility functions in low-uncertainty environments, whose values are linearly correlated with economic costs, bounded rational utility functions undergo varying degrees of nonlinear distortion. Accordingly, concave quadratic utility functions that are finely weighted according to the different attributes of customers (e.g., age, income, and cognition) have recently been utilized to characterize customer behaviors in the context of demand response [144],
[145]. In addition, the predictive behavior patterns of consumers (e.g., travel patterns, cooling/heating periods) affected by non-mandatory policies can be simply characterized by ambiguous or probabilistic soft constraints in resilient operation models
[146],
[147]. Nevertheless, current studies are limited to how to embed the diverse bounded rational behaviors into resilient operation models and have not yet addressed how to reduce the adverse impacts of bounded rational behaviors.
From a social to cyber perspective. Leveraging the powerful computation and communication capabilities of cyber subsystems, the aforementioned bounded rational behaviors may be gradually mitigated through rolling optimization and observability improvement. However, there is still a lack of high-fidelity and generalizable analysis methods for concomitant social–cyber resilience caused by negative public opinions and rumors. Existing studies simply analyze social–cyber resilience based on complex networks
[148],
[149], infectious disease models
[150], and so forth, and their model parameters (e.g., information life cycles and degrees of impact) excessively rely on empirical assumptions. Accordingly, we suggest using digital twins through a multi-agent system and employing neural networks to learn the propagation features online, thereby updating the social–cyber parameters in semi/real time. Furthermore, concerning the problem of insufficient data due to privacy preservation and the fragmentation of propagated information on the Internet, another bottleneck is how to mine valuable information for social-cyber resilience analysis with limited measurements. 6. Conclusions
This paper presented a review on the resilience analysis of ADNs and provided a comprehensive cyber–physical framework to capture the interactive dynamics between system disruptions and operation strategies. Under hazardous weather events, massive cyber and physical damages to ADNs may lead to extensive outages, such that end consumers are faced with degraded electricity services. Fortunately, resilience-oriented modernization efforts pertain to configuring and managing both the cyber and physical subsystems, as the number of hazardous weather events that can hardly be predicted or prevented continues to increase. Both built-in flexibility (e.g., microgrids as building blocks) and flexible components (e.g., distributed energy resources and controllable loads) enhance the resilient operation of ADNs through diverse corresponding countermeasures. Consequently, advanced situation awareness technologies, preventive dispatches, and corrective and restorative actions for both physical and cyber subsystems open the door to embedding resilience into electricity infrastructures.
CRediT authorship contribution statement
Zhiyi Li: Writing – original draft, Validation, Project administration, Methodology, Investigation, Funding acquisition, Conceptualization. Xutao Han: Writing – original draft, Methodology, Investigation. Mohammad Shahidehpour: Writing – review & editing, Formal analysis, Conceptualization. Ping Ju: Writing – review & editing, Supervision, Formal analysis, Conceptualization. Qun Yu: Writing – original draft, Validation, Methodology.
Declaration of competing interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.
Acknowledgments
This work was supported by the National Natural Science Foundation of China (52477132 and U2066601).
PDF
(12980KB)
