Page 1

Hawaii International Conference on System Sciences, January 2003, Hawaii. c ? 2003 IEEE.

A probabilistic loading-dependent model of cascading failure

and possible implications for blackouts

Ian Dobson

ECE Department

University of Wisconsin

Madison WI 53706 USA

dobson@engr.wisc.edu

Benjamin A. Carreras

Oak Ridge National

Laboratory

Oak Ridge TN 37831 USA

carrerasba@ornl.gov

David E. Newman

Physics Department

University of Alaska

Fairbanks AK 99775 USA

ffden@uaf.edu

Abstract

Catastrophic disruptions of large, interconnected infras-

tructure systems are often due to cascading failure. For ex-

ample, large blackouts of electric power systems are typi-

cally caused by cascading failure of heavily loaded system

components. We introduce the CASCADE model of cascad-

ing failure of a system with many identical components ran-

domly loaded. An initial disturbance causes some compo-

nents to fail by exceeding their loading limit. Failure of a

component causes a fixed load increase for other compo-

nents. As components fail, the system becomes more loaded

and cascading failure of furthercomponentsbecomeslikely.

The probability distribution of the number of failed compo-

nents is an extended quasibinomial distribution. Explicit

formulas for the extended quasibinomial distribution are

derived using a recursion. The CASCADE model in a re-

stricted parameter range gives a new model yielding the

quasibinomial distribution. Some qualitative behaviors of

the extended quasibinomial distribution are illustrated, in-

cluding regimes with power tails, exponential tails, and sig-

nificant probabilities of total system failure.

1. CASCADE model

Cascading failure is a standard cause of catastrophic fail-

ure in large, interconnected infrastructure systems. For ex-

ample, loading-dependent cascading failure occurs in large

blackouts of electric power transmission systems. The im-

portance of these infrastructures to society motivates the

construction and study of models that capture salient fea-

tures of cascading failure.

We define the CASCADE model of probabilistic cascad-

ing failure with the following general features:

1. Multiple identical components, each of which has a

random initial load and an initial disturbance.

2. When a component overloads, it fails and transfers

some load to the other components.

Property 2 can cause cascading failure: a failure addition-

ally loads other components and some of these other com-

ponents may also fail, leading to a cascade of failure. The

components become progressively more loaded as the cas-

cade proceeds. An initial version of CASCADE was used

to examine power transmission system critical loading and

power tails in probability distributions of blackout size [8].

1.1. Description of model

The CASCADE model has n identical components with

random initial loads. For each component the minimum ini-

tial load is Lminand the maximum initial load is Lmax.

For j=1,2,...,n, component j has initial load Lj that is

a random variable uniformly distributed in [Lmin,Lmax].

L1,L2,···,Lnare independent.

Components fail when their load exceeds Lfail. When a

component fails, a fixed amount of load P is transferred to

each of the components.

To start the cascade, we assume an initial disturbance

that loads each component by an additional amount D.

Other components may then fail depending on their initial

loads Lj and the failure of any of these components will

distribute an additional load P ≥ 0 that can cause further

failures in a cascade. The CASCADE model can be defined

more precisely in algorithmic form:

Algorithm for CASCADE model

0. All n components are initially unfailed and have initial

loads L1,L2,···,Lndetermined as independent ran-

dom variables uniformly distributed in [Lmin,Lmax].

1. Add the initial disturbance D to the load of component

j for each j = 1,...,n. Initialize iteration counter i to

one.

Page 2

2. Test each unfailed component for failure: For j =

1,...,n, if component j is unfailed and its load > Lfail

then component j fails. Suppose that micomponents

fail in this step.

3. If mi= 0, stop; the cascading process ends.

4. If mi > 0, then increment the component loads ac-

cording to the number of failures mi: Add miP to the

load of component j for j = 1,...,n.

5. Increment iteration counter i and go to step 2

A simple example of the CASCADE model with 5 com-

ponents producing a cascade is shown in Table 1. In this

cascade, two components fail in iteration 1, one compo-

nent fails in iteration 2, and one component fails in iteration

3, and then the cascade ends with a total of 4 components

failed. That is, m1= 2, m2= 1, m3= 1, and then the cas-

cade ends with a total of m1+ m2+ m3= 4 components

failed. Fig. 1 shows the succession of load increases in this

cascade labelled by their iteration number.

Table1.Componentloadsincreasinginacas-

cade example with 5 components

initial load range [Lmin,Lmax] = [0.5,8.5]

failure load Lfail= 9.5

initial disturbance D = 3

load increment P = 1

iteration counter i

1234

8674

119 107

1311129

1412 1310

1513 1411

cascade ends with 1,3,2,4 failed

5

1

4

6

7

8

component number

initial random load Lj

initial disturbance D added

1 and 3 fail; 2P added

2 fails; P added

4 fails; P added

i

0

1

2

3

4

– integer loads used for convenience only.

– loads above Lfail= 9.5 indicate failure.

Since the cascade of failures is only determined by the

component loads relative to Lfail, an equivalent way to vi-

sualize the cascade shows the component loads as if fixed at

their initial values and shifts the Lfailhorizontal line down-

wards as shown in Fig. 2. In this point of view, the line at

first shifts downwards by the initial disturbance D and then

shifts down by miP in subsequent iterations. In Fig. 2, mi,

the previous number of component failures, conveniently

appears as the previous number of zeros that the line passes.

Consider the event that exactly r components fail in

a cascade governed by the algorithm for the CASCADE

12

component number

345

2

4

6

8

10

12

14

load

0

0

0

0

0

1

1

1

1

1

2

2

2

2

2

3

3

3

3

3

4

4

4

4

4

Lfail

Lmax

Lmin

Figure 1. Component loads increasing in cas-

cade example with 5 components. 0 indicates

initial load and 1,2,3,4 indicate load at itera-

tions 1,2,3,4 respectively. A component fails

when its load exceeds the Lfailhorizontal line.

12345

component number

load

0

0

0

0

0

D

2P

P

P

0

1

2

3

4

Figure 2. Alternative visualization of cascade

example with loads (zeros) shown as if fixed

at their initial values and the Lfailhorizontal

line shifting downwards. The line first shifts

down by D = 3 and subsequently shifts down

proportionally to the previous number of fail-

ures (number of zeros the line just passed).

model. For convenience of description, we renumber the

components in the order they failed. Then an equivalent

description of the event that exactly r components fail is

that there are positive integers k and m1,m2,···,mksuch

that equations (1–6) on page 4 apply. We give some ex-

amples to explain (2–6). Since component 1 failed on the

first iteration after its load L1was increased by the initial

disturbance D, L1+ D > Lfail. This is an example of

(2). After the first iteration, all the loads are increased by

m1P. Since the m1+ 1 component failed on the second

iteration, Lm1+1+ m1P + D > Lfail. Moreover, since

the m1+ 1 component did not fail on the first iteration,

Lm1+1+D ≤ Lfail. This is an example of (3). The compo-

Page 3

nent r + 1 never fails and the load of component r + 1 was

increased by D + rP by the end of the cascade. Therefore

Lr+1+ D + rP ≤ Lfail. This is an example of (6).

The CASCADE model is summarized in table 2.

Table 2. CASCADE model with load range

[Lmin,Lmax] and failure load Lfail

Lj

initial load of component j;

uniformly distributed in [Lmin,Lmax]

load increase at each

component when failure

initial disturbance

number of components

max component load

min component load

component failure load

P

D

n

Lmax

Lmin

Lfail

Table 3. Normalized CASCADE model with

load range [0,1] and failure load 1

formula

Lj−Lmin

Lmax−Lmin

?j

initial load of component j;

uniformly distributed in [0,1]

load increase at each

component when failure

initial disturbance

number of components

max component load

min component load

component failure load

p

P

Lmax−Lmin

D+Lmax−Lfail

Lmax−Lmin

d

n

1

0

1

1.2. Normalized model

Suppose that the initial disturbance D is changed to

D+K and that the failure load Lfailis changed to Lfail+K.

Adding K to the initial disturbance has the effect of increas-

ing all the loads by K at the beginning of the cascade, but

since the failure load is also increased by K, the failure of

components is unchanged, and this holds throughout the en-

tire cascading process. That is, the cascade of component

failures is unchanged, except that all loads and failure loads

are increased in value by K. This conclusion holds for both

positive and negative K. Thus we have

Principle 1 The cascade process is unchanged if the initial

disturbance D and the component failure load Lfailare in-

cremented by the same amount K.

Principle 1 also follows from the expressions in (2–6) only

depending on the difference Lfail− D.

It is convenient to normalize the model in two steps:

The first step is to change the initial disturbance D to

D + Lmax− Lfailand change the failure load Lfailto

Lfail+ Lmax− Lfail= Lmax. According to Principle 1

with K = Lmax−Lfail, these changes have no effect on the

componentfailuresinthecascadingprocess. Thesechanges

are chosen to make Lfailcoincide with Lmax.

The second step defines the normalized initial load

?j=

Lj− Lmin

Lmax− Lmin

(12)

Then ?jis a random variable uniformly distributed on [0,1].

Moreover, the failure load is ?j= 1. Let

p =

P

Lmax− Lmin,d =D + Lmax− Lfail

Lmax− Lmin

(13)

Then p is the amount of load increase on any component

when one other component fails expressed as a fraction of

the load range Lmax− Lmin. Similarly d is the initial dis-

turbance expressed as a fraction of the load range. The

CASCADE model and its normalized parameters are sum-

marized in table 3. Also, the normalized conditions for r

components to fail are shown in (1) and (7–11).

2. Distribution of number of failed components

This section derives recursive and explicit formulas for

the probability distribution of the number of failed compo-

nents.

Definition: f(r,d,p,n) is the probability that r compo-

nents fail in the CASCADE model with normalized initial

disturbance d, normalized load transfer amount p, and n

components.

2.1. Cases d ≤ 0 and d ≥ 1

When the initial disturbance d ≤ 0, no components fail

and

?1

When the initial disturbance d ≥ 1, all n components

fail immediately and

?0

2.2. Deriving the recursion for 0 < d < 1

f(r,d,p,n) =

;r = 0

;0 < r ≤ n

0

?

,d ≤ 0

(14)

f(r,d,p,n) =

;0 ≤ r < n

;r = n

1

?

,d ≥ 1

(15)

This subsection assumes throughout that0 < d < 1. The

initial disturbance d causes immediate failure of the com-

ponents that have initial load ? in (1 − d,1]. Therefore the

Page 4

Condition for r components to fail

r = m1+ m2+ ··· +mk with mi> 0, i = 1,2,···,k

Lfail− D < L1,···,Lm1

Lfail− D − m1P < Lm1+1,···,Lm1+m2≤ Lfail− D

Lfail− D − (m1+ m2)P < Lm1+m2+1,···,Lm1+m2+m3≤ Lfail− D − m1P

...

Lfail− D − (m1+ m2+ ··· + mk−1)P < Lm1+···+mk−1+1,···,Lr≤ Lfail− D − (m1+ m2+ ··· + mk−2)P (5)

Lr+1,···,Ln≤ Lfail− D − rP

(1)

(2)

(3)

(4)

(6)

Normalized version of (2–6):

1 − d < ?1,···,?m1

1 − d − m1p < ?m1+1,···,?m1+m2≤ 1 − d

1 − d − (m1+ m2)p < ?m1+m2+1,···,?m1+m2+m3≤ 1 − d − m1p

...

1 − d − (m1+ m2+ ··· + mk−1)p < ?m1+···+mk−1+1,···,?r≤ 1 − d − (m1+ m2+ ··· + mk−2)p (10)

?r+1,···,?n≤ 1 − d − rp

(7)

(8)

(9)

(11)

probability of any component immediately failing is d and

the probability of any component not immediately failing is

1−d. Since the initial loads are independent, the probability

that r = 0 components fail is

f(0,d,p,n) = (1 − d)n

(16)

Also, in the case of one component (n = 1),

f(1,d,p,1) = d

(17)

For the rest of the subsection we assume that 1 ≤ r ≤ n.

If r ≥ 1 components fail, then a certain number of com-

ponents k with 1 ≤ k ≤ r must have failed immediately

due to the initial disturbance d only. Let Ekbe the event

that k components fail immediately. Then, since the initial

component loads are independent,

?n

Since E1,E2,···,Er are mutually exclusive and collec-

tively exhaustive events, the law of total probability gives

P[Ek] =

k

?

dk(1 − d)n−k

(18)

f(r,d,p,n) = P[r components fail]

r

?

We claim that

=

k=1

P[r components fail|Ek]P[Ek]

(19)

P[r components fail|Ek] = f(r − k,

kp

1 − d,

p

1 − d,n − k)

(20)

To establish claim (20), consider the n−k components that

did not immediately fail under the condition that Ek oc-

curred. Since none of the n − k components failed imme-

diately, their loads ? must lie in [0,1−d] and are uniformly

distributed in [0,1−d] (that is, the distribution conditioned

on Ekis uniform in [0,1 − d].) For the n − k components,

Lmin= 0 and Lmax= 1 − d.

AfterEk, eachofthen−k componentshashadaloadin-

crease d from the initial disturbance and an additional load

increase kp from the immediate failure of k components.

Therefore, after Ek, the total initial disturbance for each of

the n − k components is D = kp + d.

To summarize, after Ek, the failure of the n − k initially

unfailed components is governed by the CASCADE model

with initial disturbance D = kp + d, load transfer P = p,

Lmin= 0, Lmax= 1−d, Lfail= 1, and n−k components.

Normalizing using (13) yields that the failure of the

n−k initially unfailed components is governed by the CAS-

CADE model with normalized initial disturbance

malized load transfer

the probability that r components fail given Ekis the prob-

ability that r − k of the n − k components fail and this

probability is given by (20).

Combining (18), (19), (20) yields the recursion

kp

1−d, nor-

p

1−dand n−k components. Therefore

f(r,d,p,n) =

r

?

; 0 < r ≤ n,

k=1

?n

k

?

dk(1 − d)n−kf(r − k,

0 < d < 1

kp

1 − d,

p

1 − d,n − k)

(21)

Page 5

2.3. Extended quasibinomial formula for f

This subsection establishes the extended quasibinomial

formulas for the distribution f of the number of failed com-

ponents. The special case of the quasibinomial distribution

is also discussed.

We summarize formulas (15–17) and recursion (21):

f(r,d,p,n) =

Equations

f(r,d,p,n) for all n ≥ 1 and d > 0. It is straightforward

to prove by induction that f(r,d,p,n) is a probability

distribution for all n ≥ 1 as detailed in Appendix A.

Consider the expressions

?n

;0 ≤ r ≤ (1 − d)/p, r < n

f(r,d,p,n) = 0 ;(1 − d)/p < r < n, r ≥ 0

n−1

?

Appendix B proves that (27-29) satisfy (22−26) and hence

are explicit formulas for the extended quasibinomial proba-

bility distribution.1

For np+d ≤ 1 the probability distribution given by (27-

29) reduces to (27) alone:

?n

and this is the quasibinomial distribution introduced by

Consul[5]tomodelanurnprobleminwhichaplayermakes

strategic decisions. Thus (27-29) is an extended quasibino-

mial distribution in that its range of parameters is extended

to allow np + d > 1. We will see below that this extended

parameter range often describes regimes with a high proba-

bility of all components failing.

0

1

; 0 ≤ r < n,

; r = n,

d ≥ 1

d ≥ 1

0 < d < 1

0 < d < 1

(22)

(23)

(24)

(25)

(1 − d)n; r = 0,

d

r

?

; r = 1, n = 1,

?

; r > 0, n > 1,

k=1

?n

k

dk(1 − d)n−kf(r − k,

kp

1 − d,

p

1 − d,n − k)

0 < d < 1

(26)

(22−25)and recursion(26) define

f(r,d,p,n) =

r

?

d(rp + d)r−1(1 − rp − d)n−r

(27)

(28)

f(n,d,p,n) = 1 −

s=0

f(s,d,p,n)

(29)

f(r,d,p,n) =

r

?

d(rp + d)r−1(1 − rp − d)n−r(30)

1We comment on how (27-29) apply for np+d > 1 or n > (1−d)/p.

If (1−d)/p < n < 1+(1−d)/p, (27) applies for r < n, (28) does not

apply, and (29) gives the probability of r = n. If n > 1+(1−d)/p, (27)

appliesonlyforr < (1−d)/p, (28)giveszeroprobabilityfor(1−d)/p <

r < n, and (29) gives the probability of r = n.

0 0.00050.001

p

0.0015 0.002

-0.2

0

0.2

0.4

0.6

0.8

1

d

0

1000

Figure 3. Average number < r > of compo-

nents failed as a function of p and d for

n = 1000. Linesarecontoursofconstant<r>.

White indicates < 100 failures and black indi-

cates > 900 failures.

Consul [5] has derived the mean of the quasibinomial

distribution (30) as

nd

n−1

?

r=0

(n − 1)!

(n − r − 1)!pr

(31)

3. Examples of CASCADE distribution

This section shows examples of the qualitative behavior

of the CASCADE distribution for n = 1000 components

and how modeling choices lead to parameterizations of the

normalized CASCADE model.

3.1. Average number of failures

One way to summarize the behavior of the CASCADE

distribution as the parameters vary is to examine the average

number <r> of components failed. A contour plot of <r>

as a function of parameters d and p is shown in Fig. 3. For

the case n = 1000 considered in Fig. 3, the line np+d = 1

joins (p,d) = (1/n,0) = (0.001,0) to (p,d) = (0,1).

The region of Fig. 3 to the right of the line np + d = 1

and above the line d = 0 is mostly black due to the high

probability of all components failing making the average

number of failures near 1000 (but note that the corner of the

Page 6

black region near (p,d) = (0.001,0) is rounded so that a

neighborhood of (p,d) = (0.001,0) is white).

In the region to the left of the line np+d = 1 and above

the line d = 0, the quasibinomial distribution (30) applies

and the average number < r > of failures is governed by

(31). In particular, <r> is proportional to d.

The following subsections examine the extended quasib-

inomial distribution in more detail along lines in Fig. 3 such

as p constant and d varying, or d constant and p varying.

3.2. Binomial distribution for p = 0

One limiting case of the CASCADE model occurs when

p = 0 and the distribution becomes binomial:

?n

It is well known that for large n and small d, (32) is well

approximated by the Gaussian distribution with mean nd

and variance nd(1 − d).

3.3. Behavior for constant small d

f(r,d,0,n) =

r

?

dr(1 − d)n−r

(32)

We assume that the normalized initial disturbance is

fixed at the small value d = 0.0001 and examine how the

distribution changes as p increases. For p = 0, the distri-

bution is binomial as explained above. The distribution as

p increases from zero is shown in Fig. 4. The distribution

for p = 0.0001 has a tail slightly heavier than binomial but

still approximately exponential. The tail becomes heavier

as p increases and the distribution for p = 0.001 has an ap-

proximate power tail over a range of r. Note that p = 0.001

approximately satisfies the condition np + d = 1. The dis-

tribution for p = 0.002 has an approximately exponential

tail for small r, zero probability of intermediate r, and a

probability of 0.08 of all 1000 components failing. (If an

intermediate number of components fail, then the cascade

always proceeds to all 1000 components failing.)

A previous, restricted version2of CASCADE obtained

qualitatively similar results by assuming p = d and increas-

ing p. These results were qualitatively similar to simulation

results obtained by increasing loading in models of black-

outs caused by cascading failure in electric power transmis-

sion systems [8].

Increasing the normalized power transfer p may be

thought of as strengthening the component interaction that

causes cascading failure. The progression in the pdf as p in-

creases from exponential tail to power tail and then to an ex-

ponential tail together with a significant probability of total

failure is of interest. When the power tail or the significant

2The CASCADE model of [8] in effect assumed P = D and Lmax=

Lfail= 1. Average loading L = (1+Lmin)/2 was increased by increas-

ing Lmin, leading to increasing p(L) = d(L) = D/(2 − 2L).

probability of total failure occur, they have an important im-

pact on the risk of cascading failure [3].

The exponent of the power tail can be approximated as

follows. Suppose that np + d ≤ 1. By writing λ = np and

θ = nd, and letting n → ∞ and p → 0 and d → 0 in such a

way that λ = np and θ = nd are fixed, it can be shown [6]

using Stirling’s formula that the quasibinomial distribution

f(r,d,p,n) may be approximated by

g(r,θ,λ) = θ(rλ + θ)r−1e−rλ−θ

r!

(33)

which is the generalized Poisson distribution [6].

Now for r >> 1, use Stirling’s formula to get

g(r,θ,λ) ≈

θ

(rλ + θ)√2πrλre(λ−1)(−r−θ

λ)

In the limit, the condition np + d = 1 becomes λ = 1 and

setting λ = 1 gives

g(r,θ,λ) ≈

θ

(r + θ)√2πr

(34)

which has gradient on a plot of logg against logr of −1.5+

θ

r+θ→ −1.5 as r → ∞.

15 1050 1005001000r

0.00001

0.0001

0.001

0.01

0.1

1f

d=0.0001, n=1000

p=0.002

p=0.0001

p=0.001

Figure 4. pdf for constant small d and varying

p. Probability of no failures is 0.90 for all p.

Lines are drawn through the plotted points.

p = 0.002 has isolated point at (1000,0.08).

3.4. Effect of reducing maximum load

One way to try to mitigate cascading failure in the CAS-

CADE model is to reduce the maximum component load

Lmaxbelow Lfail. Let K = Lfail− Lmaxbe the amount

of the maximum load reduction. Then the system has no

failures for any initial disturbance D smaller than K. The

normalized amount of maximum load reduction is

k =

K

Lmax− Lmin

(35)

Page 7

and we will observe the effect of increasing k from zero.

The normalized initial disturbance d(k) and the normal-

ized power transfer p(k) are now functions of k. In particu-

lar, according to (13),

d(k) =

D − K

Lmax− K − Lmin=

P

Lmax− K − Lmin=

D − (Lmax− Lmin)k

(Lmax− Lmin)(1 − k)

P

(Lmax− Lmin)(1 − k)

p(k) =

Hence

d(k) =d(0) − k

1 − k

,p(k) =

p(0)

1 − k

(36)

and the probability of r components failing is

f(r,d(k),p(k),n) = f(r,d(0) − k

1 − k

,p(0)

1 − k,n)

(37)

This shows the effect of reducing the maximum load. If

k > d(0) then d(k) < 0 and there are no failures (14). For

small k, d(k) ≈ d(0) − k(1 − d(0)) so that the normalized

initial disturbance is decreased. However, the normalized

load transfer amount p(k) =

is shown in Fig. 5. The probability of no failures (r = 0;

p(0)

1−kincreases. An example

15 1050 1005001000r

0.00001

0.0001

0.001

0.01

0.1

1f

d(0)=0.001 p(0)=0.00075, n=1000

k=0

k=0.0009

Figure 5. Effect on pdf of increasing k from 0.

not shown in Fig. 5) is 0.37 for k = 0 and 0.90 for k =

0.0009. In this case the mitigation increases the probability

of no failures and decreases the probability of failures over

a range of r ≥ 1. However, the increase in p(k) makes the

tail of the distribution slightly heavier.

3.5. Effect of changing average load

We assume that the initial disturbance D = 0 and exam-

ine the effect of changing the initial load range by changing

the average initial load L defined by

L =1

2(Lmax+ Lmin)

(38)

The range of initial load W = Lmax− Lmin. Then the

initial load range can be parameterized by L and W:

[Lmin,Lmax] = [L − W/2,L + W/2]

We choose to let W be constant and examine the effect

of varying L. Then, according to (13), the normalized initial

disturbance d(L) becomes an affine function of L and the

power transfer p is a constant:

(39)

d(L) =L + W/2 − Lfail

W

,p =P

W

(40)

The probability of r components failing is

f(r,d(L),p,n) = f(r,L + W/2 − Lfail

W

,P

W,n)

(41)

If L < Lfail− W/2, then d(L) < 0 and there are no

failures (14). If L > Lfail+ W/2, then d > 1 and all

components fail (15).

Now consider Lfail− W/2 ≤ L ≤ Lfail+ W/2 so that

0 ≤ d(L) ≤ 1. In particular, we choose Lfail= 1 and

W = 0.2 so that 0.9 ≤ L ≤ 1.1 and choose p = 0.00075

and n = 1000. Fig. 6 shows the pdf for d = 0.0005, 0.05,

0.2, 0.25 and, respectively, L = 0.9001, 0.91, 0.94, 0.95.

For this case, np + d = 1 occurs at d = 0.25 and the pdf

quickly becomes all components fail with probability one

for d > 0.25. In the range 0 ≤ d ≤ 0.25 the quasibinomial

formulas (30) and (31) apply and hence the mean number

of failed components increases linearly with d and L.

151050 1005001000r

0.00001

0.0001

0.001

0.01

0.1

1f

p=0.00075, n=1000

d=0.0005 d=0.05d=0.2

d=0.25

Figure 6. pdf for increasing d.

4. Application to blackouts

CASCADE is much too simple to represent with realism

the detailed aspects of a large scale electric power system.

However, it is plausible that the general features of CAS-

CADE can be present in large blackouts involving cascad-

ing failure of transmission lines and generation.

Page 8

There are many ways in which power system component

failures interact, including via the protection system, redis-

tribution of power flow, dynamics, and operator or planning

errors. However, in accordance with the CASCADE model,

it is generally true that these interactions are loading de-

pendent and failure of one component tends to stress other

components and make their failure more likely. If we focus

on cascading failure with interactions due to line overloads

and outages via redistribution of power flow (DC power

flow with LP dispatch), then results from the OPA model

[1, 2, 7] suggest that a variety of operational regimes are

possible [1, 2, 4]. Some of these regimes yield distributions

of blackout sizes that are qualitatively similar to those ob-

served in CASCADE in the examples of Section 3.

The examples of Section 3 also illustrate how different

models and parameterizations can be defined in the CAS-

CADE model and then normalized so that the formulas for

the CASCADE distribution apply. For example, the maxi-

mum load reduction in Section 3.4 roughly models some of

the overall features of applying an n-k security criterion to

a system with cascading failure. (If we regard initial com-

ponent failures as providing an initial disturbance to n re-

maining components, then the reduction in maximum load

roughly approximates in CASCADE the effect of the n-k

criterion in that the system can survive a certain number k of

initial component failures proportional to K. The analysis

in Section 3.4 considers only the n remaining components

where n = n-k.)

The CASCADE model can be used to test ideas about

cascading failure in complicated contexts such as large

power system blackouts. Indeed, as sketched in section 3.3,

a restricted version of the CASCADE model has already

been used to show power tail behavior qualitatively similar

to that obtained in blackout models [8]. Further application

of CASCADE to better understand cascading failure in the

OPA blackout model [1, 2, 4] and the power system itself is

promising future work.

We have started to explore the relation of CASCADE

to fiber bundle models of material failure [9]. Instead of

regarding initial loads Lj as random and the failure load

Lfailas fixed, one can regard Lfailas random and Lj as

fixed. This makes CASCADE more comparable to a model

of a single cascade of failure in an increasingly loaded

fiber bundle. Global load sharing fiber bundle models

redistribute the load of a failed fiber equally to all unfailed

components so that, in contrast to CASCADE, the amount

of load transferred to each unfailed component tends to

increase as the cascade proceeds. However, Kloster et al.

hold load transfer fixed when analyzing a single cascade of

failure and obtain the generalized Poisson distribution (33)

in equation (11) of [9].

5. Conclusions

We define and explain the CASCADE model of loading-

dependent cascading failure of a system of identical compo-

nents. Formulas for the pdf of the number of failed compo-

nents are derived using a recursion. These formulas quan-

tify the effect on the pdf of the initial disturbance and the

amount of load transfer when a component fails. Thus fea-

tures of loading-dependent cascading failure are captured in

a probabilistic model with an analytic solution.

The pdf of the number of failed components is an ex-

tended quasibinomial distribution; that is, a quasibinomial

distribution with an extended parameter range. CASCADE

appears to be a new model that yields as a special case the

quasibinomial distribution. The recursion offers a simple

way to derive the distribution that avoids complicated alge-

bra or combinatorics.

The tail of the pdf can range from exponential to an ap-

proximately power tail, or there can be a high probability

of total failure (all components fail). Compared to systems

with no cascading dependency, the power tail and total fail-

ure regimes show greatly increased probabilities of most of

the components failing. Indeed under these regimes, the

risk of catastrophic failure from cascading rare events can

be comparable to or in excess of the risk of the more fre-

quent smaller disruptions. (Although catastrophic failures

are rarer, they have huge costs and their risk is the product

of frequency and cost.) For a more detailed discussion of

this claim in the context of blackout risk due to power tail

regimes in distributions of blackout size see [3].

For future work, we look forward to systematic descrip-

tion of CASCADE model properties and its application to

understand cascading failure in large interconnected com-

plex systems. We hope that CASCADE can contribute to

the goal of approximate quantification of the risks of catas-

trophic infrastructure failure due to cascading rare events

and the mitigation of these risks.

6. Acknowledgements

I. Dobson and B.A. Carreras gratefully acknowledge

coordination of this work by the Consortium for Elec-

tric Reliability Technology Solutions and funding in part

by the Assistant Secretary for Energy Efficiency and Re-

newable Energy, Office of Power Technologies, Transmis-

sion Reliability Program of the U.S. Department of En-

ergy under contract 9908935 and Interagency Agreement

DE-A1099EE35075 with the National Science Foundation.

I. Dobson, D.E. Newman, and B.A. Carreras gratefully ac-

knowledge support in part from NSF grants ECS-0214369

and ECS-0216053. Part of this research has been carried

out at Oak Ridge National Laboratory, managed by UT-

Battelle, LLC, for the U.S. Department of Energy under

Page 9

contract number DE-AC05-00OR22725.

References

[1] B.A. Carreras, V.E. Lynch, M. L. Sachtjen, I. Dobson, D.E. New-

man, Modeling blackout dynamics in power transmission networks

withsimplestructure, 34thHawaiiIntl.Conf.SystemSciences, Maui,

Hawaii, Jan. 2001.

[2] B.A. Carreras, V.E. Lynch, I. Dobson, D.E. Newman, Dynamics, crit-

icality and self-organization in a model for blackouts in power trans-

mission systems, 35th Hawaii Intl. Conf. System Sciences, Hawaii,

Jan. 2002.

[3] B.A. Carreras, V.E. Lynch, D.E. Newman, I. Dobson, Blackout

mitigation assessment in power transmission systems, 36th Hawaii

Intl. Conf. System Sciences, Hawaii, Jan. 2003.

[4] B.A. Carreras, V.E. Lynch, I. Dobson, D.E. Newman, Critical points

and transitions in an electric power transmission model for cascading

failure blackouts, to appear in Chaos, scheduled for December 2002.

[5] P.C. Consul, A simple urn model dependent upon predetermined

strategy, Sankhy¯ a: The Indian Journal of Statistics, Series B, vol. 36,

Pt. 4, 1974, pp. 391-399.

[6] P.C. Consul, Generalized Poisson distributions, Dekker, NY 1989.

[7] I. Dobson, B.A. Carreras, V. Lynch, D.E. Newman, An initial model

for complex dynamics in electric power system blackouts, 34th

Hawaii Intl. Conf. System Sciences, Maui, Hawaii, Jan. 2001.

[8] I. Dobson, J. Chen, J.S. Thorp, B.A. Carreras, D.E. Newman, Exam-

ining criticality of blackouts in power system models with cascading

events, 35th Hawaii Intl. Conf. System Sciences, Hawaii, Jan. 2002

[9] M. Kloster, A. Hansen, P.C. Hemmer, Burst avalanches in solv-

able models of fibrous materials, Physical Review E, vol. 56, no. 3,

September 1997.

A. f is a probability distribution

This appendix proves by induction that f defined by

(22−26) defines a probability distribution for n ≥ 1, d > 0.

If d ≥ 1, then (22), (23) define a probability distribution.

Now assume 0 < d < 1. f nonnegative in (22–25) and

recursion (26) imply that f is nonnegative for all n ≥ 1.

Inthecasen = 1, (24), (25)give?1

according to (24) and (26),

?

n

?

= (1 − d)n+

n

?

=

k

r=0f(r,d,p,1) = 1.

If n > 1 and?m

n

f(r,d,p,n) = (1 − d)n+

?n

r=0f(r,d,m,p) = 1 for m < n, then,

r=0

r=1

r

?

k=1

k

?

dk(1 − d)n−kf(r − k,

kp

1 − d,

p

1 − d,n − k)

k=1

n

?

n

?

r=k

?n

?n

k

?

?

dk(1 − d)n−kf(r − k,

kp

1 − d,

p

1 − d,n − k)

k=0

dk(1 − d)n−k= 1

In the special case np + d ≤ 1, f reduces to the qua-

sibinomial distribution (30) and we see that the recursive

definition of f allows a proof that (30) is a probability dis-

tribution that is more elementary than the proof in [5].

B. Extended quasibinomial formulas satisfy

the recursion

This appendix proves that extended quasibinomial for-

mulas (27–29) satisfy recursion (22−26) for d > 0.

If d > 1, (27) does not apply (because d > 1 and r <

(1 − d)/p ⇒ r < 0) and (28), (29) satisfy (22), (23).

If d = 1, (27) (for r = 0) and (28) (for 0 < r < n)

verify (22). Then (29) verifies (23).

Now assume 0 < d < 1. For r = 0, (27) satisfies (24).

For r = 1 and n = 1, (29) satisfies (25). Moreover, for

r > 0 and n > 1, we claim that (27–29) satisfies (26).

To prove this claim, we first assume that 0 < r ≤ (1 −

d)/p and n > 1. Since

r ≤1 − d

p

⇒ r − k ≤

1 −

kp

1−d

p

1−d

,

(42)

(27) applies to all the instances of f in the right hand side

of (26) so that these instances of f may be written as

f(r − k,

?n − k

kp

1 − d,

?

k = 1,2,···,r

p

1 − d,n − k) =

kp

1 − d

r − k

?rp

1 − d

?r−k−1?

1 −

rp

1 − d

?n−r

(43)

(Note that (r − k)

the right hand side of (26) to get

?n

?n − k

=

r

k=1

?n

?n

According to (27), the left hand side of (26) also evaluates

to (44).

Now we assume that (1 − d)/p < r < n. Since

1 − d

p

1−d

p

1−d+

kp

1−d=

rp

1−d.) Substitute (43) into

r

?

k=1

k

?

dk(1 − d)n−k

?

r

?

(1 − rp − d)n−r

r − k

?n

kp

1 − d

?r

?rp

?k

1 − d

rdk(rp)r−k(1 − rp − d)n−r

?r − 1

?r−k−1?

1 −

rp

1 − d

?n−r

?

?

?

k

=

r

r

?

k=1

k − 1

?

dk(rp)r−k

=

r

(1 − rp − d)n−rd(rp + d)r−1

(44)

< r < n ⇒

1 −

kp

1−d

p

< r − k < n − k,

Page 10

(28) implies that

f(r − k,

kp

1 − d,

p

1 − d,n − k) = 0,k = 1,2,···,r

and hence (26) is verified.

Now we assume that r = n. Since r = n ⇒ r − k =

n − k, (29) implies that

kp

1 − d,

1 −

s=0

f(n − k,

p

1 − d,n − k) =

f(s,

1 − d,

n−k−1

?

kp

p

1 − d,n − k),k = 1,2,···,r

Substitution into the right hand side of (26) gives

1 − (1 − d)n−

n−1

?

s=1

s

?

k=1

?n

k

?

dk(1 − d)n−k

f(s − k,

kp

1 − d,

p

1 − d,n − k) = 1 −

n−1

?

s=0

f(s,d,p,n)(45)

wherethelaststepusestheresultestablishedabovethat(27)

satisfies (26). According to (29), the left hand side of (26)

also evaluates to (45).