Int J Softw Tools Technol TransferDOI 10.1007/s10009-014-0345-y

SMC

Modelling and statistical model checking of a microgrid

Souymodip Chakraborty · Joost-Pieter Katoen ·Falak Sher · Martin Strelec

© Springer-Verlag Berlin Heidelberg 2014

Abstract This paper reports on the modelling and analy-sis of a microgrid with wind, microturbines, and the maingrid as generation resources. The microgrid is modelled as aparallel composition of various stochastic hybrid automata.Extensive simulation runs of the behaviour of the main indi-vidual microgrid components give insight into the complexdynamics of the system and provide useful information todetermine adequate parameter settings. The analysis of themicrogrid focuses on determining the probability of lineartemporal logic properties expressed in the logic LTL, usingthe statistical model checker Uppaal- SMC.

Keywords Microgrid · Statistical model Checking ·Uppaal

1 Introduction

Energy is of paramount importance for society. The impor-tance of alternative renewable energy sources like solar andwind is rapidly increasing. The exploitation of these differ-ent energy sources leads to a decentralisation of the energyproduction. This development, combined with an increas-ing resilience on faults and difficulties to upgrade the trans-mission infrastructure, have resulted in the development oflocal autonomous energy grids—(smart) microgrids [15]. A

This work has been financially supported by the MoVeS (Modelling,verification and control of complex systems: from foundations topower network applications) EU FP7 project SENSATION and theEU FP7 IRSES project MEALS.

S. Chakraborty (B) · J-.P. Katoen · F. SherRWTH Aachen University, Aachen, Germanye-mail: souymodip@gmail.com

M. StrelecUniversity of West Bohemia, NTIS, Pilsen, Czech Republic

microgrid can be seen as a localised group of generation,storage and load units that operates with more or less sup-port from the main grid by buying/selling electricity from/toit when needed.

A microgrid is an independent unit autonomously regu-lating the energy demands. It may have renewable energysources, e.g. wind turbines, microturbines, as well as con-ventional energy sources such as diesel generators. The maindistribution grid remains its major source of electricity. Themain power consumers in a microgrid are either householddevices or independent units that serve a specific purpose likeheating, ventilation or air conditioning (HVAC) units servingone or more buildings collectively. Apart from regulating theproduction and consumption of energy, a microgrid may alsostore electricity using batteries, water tanks, etc.

An important objective of a microgrid—in particular whenacting in islander mode—is to maintain a balance betweenproducing and consuming energy. Therefore, its supply ofenergy should not only be stable, safe, and reliable, but alsoin proportion to its demand. There are many ways to ensurethis balance with varying levels of associated cost. The opti-mal working of a microgrid establishes the supply–demandbalance at a minimal possible cost. This raises the question ofdetermining parameters/conditions that ensure power stabil-ity in a microgrid at minimal cost. This issue can be settled bya rigorous analysis of a mathematical model of a microgrid.

What kind of model for a microgrid is the most adequate?A microgrid is a real-world system exhibiting continuousbehaviour (e.g. electricity is continuously maintained in agrid even at varying levels of consumption) as well as discretecontrols (e.g. a local diesel generator can be on or off depend-ing on the electricity demand). Moreover, microgrid behav-iour is subject to uncertainties; e.g. a broadcast of an unex-pected incident of national importance may result in more TVsets switched on, leading to an increasing demand of electric-

123

S. Chakraborty et al.

ity. Therefore, we need a modelling formalism that capturesprobabilistic state changes based on continuously varyingquantities—stochastic hybrid automata (SHA) [6]. In theliterature, distributed probabilistic-control hybrid automatahave also been studied for the modelling and analysis of smartgrids [22].Stochastic hybrid automata are modelling formalisms inwhich state spaces are divided into discrete, also called modesof a system, and continuous parts. The behaviour of eachmode is given by ordinary differential equations; and a sys-tem can stay in a mode until certain conditions are satisfied.The mode switches are controlled by guards and the nextmode (state) of a system is determined by a continuous dis-tribution function over the state space. For details about SHA,we refer to [10].

This paper considers the microgrid configuration depictedin Fig. 1; it extends the configuration in [22] with thermalenergy such as the chillers. This microgrid is connected tothe electricity and natural gas distribution grids and incorpo-rates two local energy sources—a wind turbine and a micro-turbine. The microturbine represents a deterministic energysource which produces electricity and heat. The heat can beutilised for satisfying the heating demand such as domestichot water. The wind turbine is of stochastic nature and itspower output depends on actual wind properties. The localpower network (LPN) stands for the junction point wherethe electricity supply meets the electricity demand of, e.g.chillers, electrical load, etc. Chillers remove the heat fromthe chilled water circuit (CHWC) which supplies the coolingload with the chill. The demand of cooling load as well as theperformances of chillers can be affected by the outside tem-perature. Electrical energy storage is connected to the LPNand enables the possibility to store/load electricity energy.This can be very useful for the optimization of operationalcosts of the microgrid.

We model this system as a composition of stochastichybrid automata, and describe their continuous dynamics.

For several components of the microgrid, we have adoptedthe dynamics from the literature [9,19,23]. Given the diver-sity of the continuous phenomena and the strong intertwin-ing with discrete mode switching, we believe that the systemmodel in this paper can act as a benchmark case study foranalysis techniques of stochastic hybrid systems. Extensivesimulation runs of the behaviour of the microgrid compo-nents give insight into the complex dynamics of the systemand provide useful information to determine adequate para-meter settings. The parameter settings used in our verificationmodels have been obtained in this way and have been vali-dated by Honeywell. For some of the major parameters weshow their influence on the analysis results. For the analy-sis of the microgrid, we resort to model checking. Recentdevelopments in model checking of stochastic hybrid sys-tems show the possibility to check a rich variety of proper-ties such as probabilistic reachability and invariance [1], orLTL [2]. As the stochastic dynamics and complexity of themicrogrid configuration go beyond the scope and feasibil-ity of the above techniques that typically rely on discretiza-tion and dynamic programming, we resort here to statisticalmodel checking [4,25]. This technique is basically employ-ing Monte Carlo simulation to check the validity of temporallogic properties within a given a priori-defined confidenceinterval. To analyse probabilistic reachability and invarianceproperties of the microgrid case study, we use Uppaal- SMC,a recent extension to the model checker Uppaal (http://www.uppaal.org). Uppaal- SMC originally focused on (priced andprobabilistic) timed automata; however, recently it also cov-ers networks of stochastic hybrid automata [7]. We reporton the statistical model checking of several (bounded) LTLformulas and investigate the run-times for various confidenceintervals and time horizons.

Microgrids have so far received scant attention in theformal modelling and verification community. To analysemicrogrid stability, dependability and fairness, in [11], sto-chastic timed automata (STA) are used as formal models

WindTurbine

ElectricalStorage

Chiller 1

CHWCLPN

Microturbine

Grid Power

Gas

Chiller 2

Heating Load

Cooling Load

ElectricalLoad

Fig. 1 Configuration of the microgrid case study. Electrical storage,microturbine, chiller 1 and 2 are deterministic; wind turbine and elec-trical/cooling/heating load are stochastic; grid power and gas are input;whereas LPN and CHWC are connecting elements. Arrow(s) to and

from LPN block depict flow of electrical energy; to and from CHWC,thermal (cooling) energy; to heating load, thermal (heating) energy;whereas to microturbine, fossil fuels input

123

Modelling and SMC of a microgrid

to investigate runtime control algorithms for photovoltaicmicrogenerators; and in [12] different strategies have beenanalysed to reduce frequency oscillations in a grid. Similarly,in [8] the requirement of the information system of the smartgrid is discussed. This system deals with the huge amount ofdata collected from different parts of the grid to maintain itsstability.

2 Modelling the microgrid configuration

In this section, we explain the model of the microgrid inmore detail. We start by discussing the individual compo-nents, putting an emphasis on their continuous behaviour.Subsequently, we discuss how the individual models are puttogether in a compositional manner so as to obtain a model forthe entire microgrid configuration. The continuous dynam-ics of several components is illustrated by some simulationresults that were obtained using Uppaal- SMC.

The Local Power Network (LPN) constitutes the junctionpoint that interconnects the main distribution grid, local gen-erators, electrical storage and power loads (see Fig. 1). Thepower balance equation for the LPN is given by:

PG(t)+PW(t)+PM(t)+PE(t)=2∑

i=1

PCh,i (t)+PD(t) (1)

where PG is the power load from the grid, PW is the powergenerated by the wind turbine, PM stands for the power gen-erated by the microturbine, PE denotes the power load/supplyto/from electrical storage, PD is the electrical load and PCh,i

is the power demand of the i-th chiller.The stability of the LPN depends on the balance between

power supply [left-hand side of Eq. (1)] and power demand[right-hand side of Eq. (1)]. The power imbalance ΔP(t)denotes their difference. The frequency of the AC currentis typically used as the stability criterion and can be con-sidered as a function of power imbalance f (ΔP(t)). For astable operation of the microgrid, the frequency may varyonly within a certain a priori-defined interval [−dfem, dfem]otherwise it goes to emergency mode for a specified amountof time [0, tcr]. Large power imbalances may result in black-outs (if the frequency deviation exceeds dfcr then tcr time isspent in emergency mode). In the case of a failure, the systemis usually restored to be operational within trt . In this config-uration, we assume the microgrid is connected to the distri-bution electricity grid which has the capability to eliminateall imbalances in the microgrid, i.e. ΔP(t) = 0. However, ifthe microgrid is disconnected from the distribution grid (theso-called islander mode), the stability of the LPN becomesimportant. The LPN can operate in three discrete modes:

Operational

FailureEmergency

dfcr

>|df

| >df

em

|df | >dfcr

|df| ≤

df em

c := 0, c > tcr

c>trt

Fig. 2 SHA model of the LPN

Operational, Emergency and Failure. Its discrete dynamicsis driven by the frequency deviation df1 and is naturally cap-tured by hybrid automata (see Fig. 2).

For simplification, we assume that whenever the local pro-duction exceeds the consumption, the storage devices arecharged. If the grid is operating in islander mode, the dis-crepancy between production and consumption is balancedby storage PE as long as it is not drained out. As justifiedin [3], we do not consider inertia as grid dynamics occurat a much smaller time scale than the phenomena studiedhere, such as temperature development in rooms and micro-turbines.The wind turbine is often modelled by a non-linear equationknown from the literature, e.g. see [16]:

PW(t) = π

2· ρ · R2 · u(t)3 · Cp(η, θ) (2)

where ρ is the air density, R is the blade radius, u(t) is thewind speed, and Cp is an efficiency function depending onθ (the pitch angle) and the tip speed ratio η = ωR

u , whereω is the rotor speed. (Both θ and η depend on t). In ourstudies, however, we utilise the wind turbine model basedon a polynomial approximation of the power curve [5] forcapturing wind turbine power production.

PW(t) = aWu3(t) + a′Wu2(t) + a′′

Wu(t) (3)

where aW, a′W, a′′

W are coefficients. The use of this polyno-mial approximation has two practical reasons: (i) the powercurve can be obtained from manufacturers datasheets, (ii) thepower curve can be directly identified from common mea-sured data.

A hybrid automaton for the wind turbine has been intro-duced in [24] and incorporates three discrete modes:

1 Frequency deviation stands for a deviation of the actual frequencyfrom the nominal frequency and can be modelled by df = Kf · ΔPwhere Kf is a multiplicative constant.

123

S. Chakraborty et al.

• Off —No power is generated by the turbine, e.g. when thewind speed is insufficient to drive the blades.

• Power optimization—Power is generated by wind speedaccording to the polynomial approximation of the Eq. (3).

• Power limitation—The turbine reached its maximum pro-duction capability PW,max.

The wind turbine is considered as a deterministic systemgiven by Eq. (2), which is affected by stochastic inputs.These inputs depend on the pitch angle θ and the wind speedu. There are several modelling approaches in the literatureencompassing these two inputs. For example, the modellingof wind variability via discrete Markov chains is described in[18]. Alternative approaches are based on time-series mod-els [20]. We assume an optimal placement of the wind tur-bine against the wind direction θ . Therefore, the power of thewind turbine only depends on the wind speed u. We adopta one-dimensional stochastic differential equation to modelthis:

du(t) = −u(t) − u(t)

T· dt + κ · u(t) · √

2/T · dW (t) (4)

where u denotes hourly averages of wind speed, κ is a con-stant depending on the geographical location of the windturbine, dW is a Wiener process that models the uncertaintyin the actual and the forecasted wind speed, and T = L/u,where L is the turbulence length scale. Figures 3 and 4 depicttwo simulations for the wind speed and the correspond-ing power PW generated by the wind turbine [according to

Eq. (3)]. The similarity between the plots is apparent as highwind speed results in high power generation.The microturbine influences the electrical and thermal powerdynamics of the microgrid. The operation of a microturbinecan be divided into eight separate discrete modes [23]. Modetransitions are guarded by the turbine angular velocity ω

whose evolution is defined as:

J · ω = TM(t) + TE(t) − FV(t),

where J is the moment of inertia of the turbine, TE refers tothe electrical torque, TM is the mechanical torque, and FV isthe viscous friction defined by FV(t) = kV · ω(t).

The discrete modes are:

• Off —The microturbine is turned off.• Start up—The microturbine accelerates to 25,000 rpm

(ωstart). In this mode, the turbine generator acts as motorand consumes electrical power. The electrical power PM

is the driving force of the turbine (TE is positive and PM

is negative) and yields:

TE(t) = a0,M + a1,M · PM(t) + a2,M · PM(t)2.

The power requirement is modelled by a feedback loop inorder to reach the desired angular velocity of ωstart in thefollowing way:

Fig. 3 Simulation of windspeed u(t). In both simulationsk = 0.00004, u(t) =2 km/h, T = 1,600 s

123

Modelling and SMC of a microgrid

Fig. 4 Generated wind turbinepower PW with the sameparameters as in Fig. 3

PM(t) = kPM,P · (ωstart − ω(t))

+kPM,I ·∫ t

0(ωstart − ω(τ))dτ.

In the literature (e.g. [23]), different feedback controllersare applied for microturbine speed control (e.g. PID), how-ever, we consider PI controller with non-oscillating behav-iour for the sake of simplicity. Derivative part can be easilyincorporated into the model and consequently controllers’constants can be properly designed, but this is out of thescope of this article.

• Stabilisation—Short period before gas ignition where theangular speed of the turbine is constant ω = 25,000rpm.

• Acceleration—Electrical torque from the generator drivesthe turbine speed to 45,000 rpm. At the end of the interval,it comes to the ignition. The minimal fuel flow maintainsthe combustion process, but does not produce mechanicaltorque. Torque TM is zero.

• Warm up—The microturbine consumes only fuel, whencePM = 0. The energy from the combustion keeps the tur-bine at the desired speed of 45,000 rpm. TM provides thenecessary mechanical torque, see Fig. 5. The fuel flowand angular velocity oscillate before attaining equilibrium(modelled by PI control Eq. 7).

• Operational—The microturbine produces power and theturbine is driven of the fuel combustion. TM is the drivingforce for the rotation of turbine. Electrical power is gen-erated (PM is positive) and the emerged electromagnetic

field tends to slow down the turbine rotation hence (TE isnegative):

TM(t)=a3,M +a4,M · m f (t)+a5,M · m f (t)2−a6,M · ω(t),

TE(t) = a7,M + a8,M · ω(t) + a9,M · ω(t)2,

PM(t) = a10,M + a11,M · ω(t) + a12,M · ω(t)2.

The power at which the microturbine should eventuallyoperate determines the desired speed (ωS P ) of the turbine.The fuel flow m f is controlled by a PI controller to keepthe turbine at ωS P according to:

f low(t) = kmf ,P · (ωSP − ω(t))

+ kmf ,I ·∫ t

0(ωSP − ω(τ))dτ,

mf(t) = min{mminf , flow(t)}. (5)

• Slow down—The generator is disconnected from the LPNand the turbine is slowed down to ω = 25,000.

• Cool down—Fuel supply is closed (mf = 0). Microturbineslows to stop (ω = 0).

The heat produced from the combustion of fuel serves theheating load (e.g. domestic hot water) by:

QM(t) = a13,M + a14,M · mf(t) + a15,M · mf(t)2.

Figure 6 shows the angular velocity of the turbine fromstart to operational mode. Figure 7 shows the power charac-teristics of the microturbine where the value PM is negative

123

S. Chakraborty et al.

Fig. 5 Fuel mass flow duringwarm up mf

Fig. 6 Turbine angular velocityω

from start to acceleration mode. Only during the operationalmode (when the microturbine produces energy), PM is posi-tive. Fuel injection starts in the acceleration mode. This com-ponent is not stochastic.Electrical storage is the device that enables storing electri-

cal energy over time. We use the storage model of [19] where

the electrical storage evolves according to the following dif-ferential equation:

d PS

dt= −γ · PE(t) − PL(t), (6)

123

Modelling and SMC of a microgrid

Fig. 7 Microturbine power PM

where PS expresses the stored energy level in the storage,γ denotes the power exchange efficiency, PE is the powerexchanged between the storage and the LPN, and PL standsfor power losses associated to the storage. Electrical storagecan operate in five discrete modes:

– Supply - The device drains energy PE > 0 with efficiencyγ = γs .

– Store - No exchange of electricity PE = 0; electricalenergy leaks at rate PL .

– Load - The device acts as a load PE < 0 and rechargesits energy level with efficiency γ = γl .

– Full - Storage reaches its maximum capacity PE S =PE S,max .

– Drained - Stored energy level is at the minimal capacityPE S = PE S,min .

PE denotes an input variable quantifying the power supplied(loaded) from (over) the storage device in connection withthe LPN. We consider PE as the difference between the localpower production and load.Chiller is an electrical device that converts electrical energyinto thermal energy (cooling energy). We use the Gordon-Nq model of the chiller [9], where the power demand PChi

of chiller i (i = 1, 2) is given by:

PChi = a3,i Q2cool,i + (Qcool,i + a2,i )(TO A − TCW ) + a1,i TO A

TCW − a3,i Qcool,i

Here, Qcool,i (t) is the thermal energy removed by the i-th chiller at time t . The power demand of a chiller evolvescontinuously because of its dependency on other continuousquantities such as outside temperature. Qcool,i thus repre-sents the (portion of the total cooling Qcool ) energy requiredby the system from chiller i . Its value is decided based ona selected control policy. The total energy demand Qcool ismodelled by a PI (proportional, integral) controller. Its valuedepends on two quantities: the chilled water temperature TCW

and its desired value (set point) TCW S P . Our microgrid modelhas two chillers. The energy requirement is hence distrib-uted among them. This distribution is controlled by an inputparameter αCh(t), i.e. Qcool,1(t) = αCh(t) · Qcool(t) andQcool,2(t) = (1 − αCh(t)) · Qcool(t).The outside temperature is given by a modified Uhlenbeck–Ornstein stochastic differential equation:

dTO A = a1,O A · (T fO A−TO A(t))dt+a2,O A · dT f

O A(t)

+a3,O A · dW (7)

where T fO A is the forecasted outside temperature, and dW is

the Wiener process that models the uncertainty in the actualand the forecasted temperature.The cooling load is modelled by modified lumped thermalmodel (e.g. [17]) which represents a building consisting ofn rooms (zones), denoted Zi for i = 1...n. The zone tem-perature TZ A (at time t) evolves according to the stochasticdifferential equation:

123

S. Chakraborty et al.

CZ AdTZ A

dt= XC (t) · kcw · (TCW (t) − TZ A(t))

+ kout · (TO A(t) − TZ A(t)) + N P(t) · gain

where TCW (t) is the temperature of the coolant, XC (t) thethermostat valve position, CZ A is the thermal capacity ofthe zone, kcw is a heat transfer coefficient for zone-chilledwater, kout is a heat transfer coefficient for zone-outside airand gain stands for the heat produced by one person. Thestochastic aspects here are the number of people N P(t) in azone and the outside air temperature TO A(t) which is givenby Eq. (7). It is assumed that each person increases the zonetemperature by a constant gain per time interval.

The function of the thermostat is to regulate the tem-perature of the room TZ A by changing the value of XC .The thermostat is modelled by a PI controller and the valueof XC depends on two other quantities, the desired tem-perature of the zone TZ AS P and the current zone tempera-ture TZ A, along with proportional kXC ,P and integral kXC ,I

constants:

e(t) = TZ A(t) − TZ AS P (t), and

temp(t) = kXC ,P · e(t) + kXC ,I ·∫ t

0e(t) dt

XC (t) = max{0, min{temp(t), 100}}. (8)

Figures 8 and 9 show the evolution of the room temperatureand thermostat value, respectively, when the set point tem-perature TZASP is at 25 ◦C (blue), 22 ◦C (green), and 20 ◦C(red).The Chilled Water Circuit (CHWC) captures the behaviourof the coolant temperature TCW(t) which interacts with zonetemperature TZA(t) and with chillers. The chilled water cir-cuit temperature TCW is modelled by a modified lumped ther-mal model and evolves according to the following differentialequation:

CCW · dTCW

dt= XC(t) · kCW · (TZA(t)−TCW(t))−Qcool(t)

Fig. 8 Room temperature TZA

123

Modelling and SMC of a microgrid

Fig. 9 Thermostat value XC

where CCW is the thermal capacity of the water circuit andQcool is the thermal energy removed by chillers.2

The chilled water temperature controller keeps the chilledwater temperature at the set point value TCWSP (another con-trol parameter). The energy requirement is controlled by afeedback loop and hence designed as a PI control scheme:

eC(t) = TCW(t) − TCWSP(t),

temp(t) = kCW,P · eC(t) + kCW,I ·∫ t

0eC(τ )dτ,

Qcool(t) = min{0, min{Qmax, temp(t)}},where Qmax is the maximum energy requirement that can bemet by the chillers. Figures 10 and 11 show the behaviour atset points 20, 15, and 10 ◦C, respectively.The electrical load is modelled according to the Uhlenbeck–Ornstein differential equation which captures its continuousdynamics. It has two modes: Connected or Disconnected.When connected, the stochastic differential equation reads:

dPD = a1,D · (m(t) − PD(t)) · dt + σD · dW,

where m(t) is a given load profile,3 a1,D represents a trackingcoefficient, σD is a variation coefficient, and dW denotes theWiener process. In the case of the disconnected mode, the

2 Qcool(t) = Qcool,1(t) + Qcool,2(t).3 A load profile captures the typical pattern of the load which can beexpressed in a form of mean values for given time instances (e.g. dailyload pattern).

dynamics of electrical load is trivial as PD = 0, dPD/dt = 0.A simulation is shown in Fig. 12.The heating load represents a small demand for heating (i.e.domestic hot water) which is supplied by wasted heat fromthe microturbine. This load depends on occupants activityduring the day and can be considered as stochastic processwhich can be modelled in a similar fashion as the electricalload above.4

Overall microgrid model. We have modelled all individualcomponents as stochastic hybrid automata.

Let LPN, CHi , CHWC, Z j , MT, WT, ST, EL be the SHAmodels of the local power network, the i th chiller, the chilledwater circuit, the j th room (or zone), microturbine, wind tur-bine, storage, and electrical load, respectively. The compositeSHA model of the microgrid is now given as:

MG = (LPN ‖CHi ‖CHWC‖Z j ‖ MT ‖ WT ‖ ST ‖ EL)

where i = 1 to 2, j = 1 to n and ‖ denotes a parallel composi-tion operator (for details about ‖, we refer to [10]). Note that,our composite model is simple in the sense that there is nosynchronisation among different components of the grid. All“communication” among the components is achieved usingshared variables. Few of the components are shown in Fig. 13.Resolution of non-determinism in composite model. In thenetwork of SHA, each SHA continuously races against eachother component, i.e. they independently and stochastically

4 Stochastic process based on Uhlenbeck–Ornstein model.

123

S. Chakraborty et al.

Fig. 10 Coolant temperature TCW

decide about the duration of their stay in a specific mode; andthe “winner” is the one that decides for a minimum duration.In the Uppaal- SMC tool, the components which can stayin a mode indefinitely decide about the duration of their stayusing an exponential distribution; and those which cannotstay more than a specific time period decide their durationusing a uniform distribution.Controllers and scenarios. There are various input parame-ters for the different components of the microgrid. Con-trollers are designed to modify these inputs to satisfy someoptimality criteria, usually to minimise power consumption.Various controllers can be modelled by automata. The effectof these controllers can be studied by running the respec-tive automaton in parallel with the microgrid. For exam-ple, we can consider an automaton that depending on therequired cooling power and ambient temperature distributesthe energy among the two chillers accordingly. It is possi-ble that some chillers work better at lower energy require-ments than others. In one experiment, we modified the con-trol parameter αch(t) which distributes the cooling energy

production between chillers from constant value (static) toa more dynamic one which changes according to the energyrequirement. Figure 14 depicts the total power consumed bythe chillers under the two different type of control parameterα. We know before hand that chiller 1 performs better at lowload than chiller 2. In this experiment, we start with an initialroom temperature of 36◦ and coolant temperature 25◦, weselected a threshold 2,000 KJ above which the distributionof the cooling energy production changes from (0.8:0.2) to(0.5:0.5).

We are also interested in testing the behaviour of themicrogrid under special conditions, e.g. observing the fre-quency deviation over time when the microgrid is discon-nected from the main grid (islander mode). Figure 15 showsthe frequency deviation when the microgrid is running inislander mode with two wind turbines and one microtur-bine providing for two chillers and one electric load alongwith a storage device. As the microgrid is cut off from themain grid, the power generated by wind turbines is insuf-ficient (in this experiment) and hence the batteries were

123

Modelling and SMC of a microgrid

Fig. 11 Energy requirement Qcool

catering for the power deficit. At the same time, the micro-turbine is powered up. We have seen from the simulationruns of the microturbine that in the initial phase it drawspower. The load of the grid is kept independent of theenergy production. The temperature set points for the cool-ing (TCWSP = 17 ◦, TZASP = 20◦) and the power distributionfor the chillers (α = (0.6:0.4)) are kept constant. Thus, thebatteries soon run out and we observe a negative frequencydeviation. When the microturbine is accelerated to opera-tional speed it provides (more than) enough energy for thedemand, hence we see a positive deviation. Finally, the bat-teries start to recharge themselves to use the excess powerand the frequency stabilises.

3 Model checking the microgrid

The properties of the microgrid that we are interested inare expressed as bounded linear-time formulas. For instance,

how likely is it that the temperature of various cooling devicesreaches a required set of values, or the energy requirementexceeds some threshold with a given outside temperature, ordoes a microgrid become unstable in islander mode, etc.

Numerical methods to solve model-checking problems ofstochastic hybrid systems against some temporal formulas(even reachability) are algorithmically involved and sufferfrom the curse of dimensionality [1,2,21]. Statistical modelchecking avoids these problems by resorting to discrete-eventsimulation (using Monte Carlo techniques). In a nutshell, itgenerates and examines finitely many simulation runs of amodel at hand, and uses hypothesis testing to infer whetherthe obtained simulation samples provide statistical evidencefor the satisfaction or violation of some (temporal logic) spec-ification [4,25].Statistical model checking in a nutshell. We briefly describethe main principles of statistical model checking and refer to[26] for a more detailed explanation. Let X be a stochasticprocess, which could be as simple as a Markov chain or as

123

S. Chakraborty et al.

Fig. 12 Electrical load PD inthe microgrid

Fig. 13 a The Uppaal model of the first four stages of microturbine, b the local power network, c the chilled water controller (qcsp is the chillerenergy demand Qcool)

complex as a closed (i.e. needs no external decision) stochas-tic hybrid automaton. Let ϕ be a property defined by sometemporal bounded logic, say bounded LTL. A finite trajec-tory ρ of X , also called an execution, satisfies (denoted |�)

the property ϕ if and only if the trace of ρ belongs to thelanguage of ϕ. The problem is to decide whether:

P : Pr[X |� ϕ] ≥ θ,

123

Modelling and SMC of a microgrid

Fig. 14 Cumulative electricalpower consumed by the chillers

Fig. 15 Frequency deviation

holds for θ ∈ [0, 1]. This is accomplished by inspecting alimited number of finite executions of X , called test samples.Obviously, we want the size of the test sample, denoted n, tobe as small as possible such that the probability of making an

error is small. One can observe that for bounded reachabilityproperties, it is possible to consider traces in a test samplethat are words of ϕ, which is not the case with unboundedreachability properties.

123

S. Chakraborty et al.

The aim now is to test the hypothesis H : Pr[X |� ϕ] ≥θ against K : Pr[X |� ϕ] < θ . Let ζ be the probabilityof accepting K when H holds (false negative) and β theprobability of accepting H when K holds (false positive). Itis not possible to have n for which both ζ and β are small.Hence, in practice one checks the hypothesis H0 : Pr[X |�ϕ] ≥ θ+δ against H1 : Pr[X |� ϕ] ≤ θ−δ, where δ(δ ≥ 0)

is the indifference region. This procedure is indifferent to thedecision whether | Pr[X |� ϕ] − θ | < δ.

Different ways of finding a test procedure with the above-mentioned characteristics exist, e.g. the fixed size samplemethod. Other methods are, for example, the sequential ratiotest method. For an overview and empirical comparison werefer to [14]. The fixed size sample method briefly worksas follows. A sample of size n contains the observationsρ1, . . . , ρn , with the associated random variable x1, . . . , xn

(i.e. x j = 1 iff ρ j |� ϕ). To test hypothesis H0 againstH1, we specify a quantity c (c ≤ n). H0 is accepted if∑n

j=1 x j > c. Observe that the random variables {xi }i≤n

are i.i.d. with Pr[xi = 1] = Pr[X |� ϕ]. Let Pr[xi = 1] = p.The probability of

∑nj=1 x j being at most c is:

F(c, n, p) =c∑

i=0

(n

i

)pi · (1 − p)n−i

Thus, the problem is to find a pair (n, c) which satisfiesF(c, n, p) ≤ ζ when p ≥ θ + δ, and 1 − F(c, n, p) ≤ β

when p ≤ θ − δ. Since F(c, n, p) is a non-increasing func-tion in p ∈ [0, 1], this yields the following (non-linear) opti-mization problem to minimise n:

F(c, n, θ + δ) ≤ ζ,

1 − F(c, n, θ − δ) ≤ β.

This yields the required n and test criterion c. The detailsof dealing with nested formulas (see [26]) are not relevantfor our case study as all properties of interest are un-nestedformulas.The Uppaal- SMC tool. We analyse the microgrid modelusing the Uppaal- SMC tool. Uppaal- SMC focuses mainlyon networks of priced timed automata. These are timedsystems in which real variables may have different rates(even potentially negative) in different modes. These vari-ables are not referred to in guards. A recent extension ofthis tool allows to handle stochastic hybrid automata, firstreported in [7]. Here, the change of continuous variables isgoverned by linear differential equations. Euler’s method offirst-order approximation for ordinary differential equationsis employed to restrict the change in real variables to constantrates.

Uppaal- SMC relies on results from statistics such assequential hypothesis testing and Monte Carlo simulation.Crucial statistical input parameters are the confidence ξ

which quantifies the error, given by the parameter ζ and β

(as before), and the probability interval defined by the indif-

Table 1 Microgrid constantsSymbols Constant Values

kout Outside temperature coefficient 0.25 W/K

kCW Chilled thermal coefficient 2,250 W/K

CCW Chilled water heat capacity 162,280 KJ/W

CZA Zone air heat capacity 6,093 KJ/W

Gain Average rate of heat gain 75

kv Viscous friction coefficient 0.000011 Nm s

T Wind speed turbulence factor 1,600

κ Geographical location constant 0.00004

a1,i , a2,i , a3,i Constants of chiller i = 1, 2 0.005, 22.22, 9.53

0.021, 22.22, 3.17

a1,OA, a2,OA, a3,OA Outside temperature parameters 0.05, 0.001, 0.2

a0,M, a1,M, a2,M Electric torque constants (start) −0.002, 0.15, 0

a3,M, a4,M, a5,M, a6,M Mechanical torque constants 167.906, 132.348

−24.371,0

a10,M, a11,M, a12,M Microturbine power curve constants 7.1, −0.0005

0.0000007

mminf Minimum fuel flow 0.15

kmf ,P , kmf ,I PI controller const. of MT fuel flow 3.1

kPM,P , kPM,I PI controller const. of MT power 50.5

kCW,P, kCW,I PI controller const. of chilled water temperature 0.5

kXc,P , kXc,I PI controller conts. of thermostat 3.1

123

Modelling and SMC of a microgrid

ference region δ. Apart from being able to simulate vari-ous variables, we can carry out statistical model checkingof temporal logic formulas expressed in bounded LTL. Forexample, we can check whether the likelihood of reaching aspecific set T of target states within m time units is greaterthan p or not (Pr(♦≤m T ) > p), or the probability to stay ina given set T of states for the next m time units is less thanp (Pr(�≤m T ) < p) (Table 1).Scalability. Simulation runs of the microgrid provide insightinto the dependency between different parameters. For exam-ple, the cooling load (CL) of a microgrid—that is dependenton the outside ambient temperature, the number of rooms,thermostat values, chilled water circuit and chilled watertemperature controller—varies with time as given in Fig. 16(we assume the number of people entering or leaving theroom to be binomially distributed). We see that there isalmost a linear relationship between CL and time. Figure 16also presents the runtime of model checking the formula ϕ =♦≤t (Qcool > 4,000 kJ) with TZASP = 20 and TCWSP = 17.Note that increasing the value of t in ϕ has no significanteffect on the runtime of the model checking algorithm. Thisis because ϕ is satisfied within 300 s (Table 2) with highlikelihood.

We can also vary different statistical model-checking para-meters and observe the effect on the runtime. For example,the number of runs increases rapidly (at least exponential)when the indifference region δ is decreased. The runtime

of verifying ♦I (|TZA − TZASP| ≤ 1) with TZASP = 20 andTCWSP = 17 on cooling load for varying values of δ is shownin Fig. 17.Temporal properties. For the microgrid case study, we aremainly interested in reachability properties. We do hypoth-esis testing using Uppaal- SMC version 4.1.11. The firstproperty of interest is the high likelihood of the room tem-perature being close to the desired set point within some finitetime interval. The initial value of the room and water coolanttemperature is 35◦ and 25◦, respectively. We vary the value of

0 1,000 2,000 3,000 4,000 5,000

0

5

10

15

Time of simulation: t sec

Run

tim

e(s

ec)

Fig. 16 Simulation (blue circles) and model checking (red squares)

Table 2 SMC results fortemperature control LTL formula I (s) ≺ p TZASP TCWSP Confidence δ Time (s)

♦I (|TZA − TZASP| ≤ 1) ≺ p [0, 200] ≥0.98 20 17 0.95 0.05 1.874

[0, 3,000] ≥0.98 20 17 0.95 0.05 1.968

[0, 3,000] ≥0.98 25 20 0.95 0.05 1.307

[0, 3,000] ≥0.98 25 20 0.995 0.005 1.647

[0, 3,000] ≥0.998 25 20 0.9995 0.0005 2.011

♦I (|TCW − TCWSP| ≤ 1) ≺ p [10, 200] ≥ 0.98 20 17 0.95 0.05 16,627

[10, 3,000] ≥0.98 20 17 0.95 0.05 16.638

[10, 3,000] ≥0.98 25 20 0.95 0.05 16.03

[10, 3,000] ≥0.98 25 20 0.995 0.005 28.185

[10, 3,000] ≥0.998 25 20 0.9995 0.0005 393.832

♦I (|TZA − TZASP| ≤1 ∧ Xc > 5) ≺ p

[0, 200] ≥ 0.98 20 17 0.95 0.05 13.085

[0, 3,000] ≥0.98 20 17 0.95 0.05 13.069

[0, 3,000] ≥0.98 25 20 0.95 0.05 1.787

[0, 3,000] ≥0.98 25 20 0.995 0.005 2.48

[0, 3,000] ≥0.998 25 20 0.9995 0.0005 25.104

♦I (Qcool ≥ 4,000) ≺ p [0, 200] ≥0.98 20 17 0.95 0.05 5.08

[0, 1,000] ≥0.98 20 17 0.95 0.05 5.162

[0, 1,000] ≤0.02 20 15 0.95 0.05 16.048

[0, 1,000] ≤0.02 20 15 0.995 0.005 28.151

[0, 1,000] ≥0.002 20 15 0.9995 0.0005 394.371

123

S. Chakraborty et al.

the time interval and the temperature set points to investigateits impact on the runtime. The hypothesis testing results arelisted in Table 2. The first, second and third columns definethe property. The fourth and fifth columns indicate the val-ues of the control inputs (temperature set points). The sixthand seventh columns indicate the confidence and δ of the

0 0.1 0.2 0.3 0.4 0.5

0

2

4

Indifference region :δ

log 1

0of

runt

ime

(sec

)

Fig. 17 Indifference region vs runtime

SMC algorithm (where confidence = 1 − ζ or 1 − β and δ

is the indifference interval) and the last column presents theruntime of Uppaal- SMC.

The first property refers to the high likelihood of zonetemperature TZA differing at most one degree Celsius fromthe desired room temperature TZASP in a given time interval.The second property checks the high likelihood of the chilledwater temperature TCW being close to its set point TCWSP.Both these properties are found to be true (conforming to thesimulations). The third property is a conditional property,where we check if the room temperature is close to the settemperature then the thermostat valve is not (fully) open. Thelast property focuses on the cooling energy Qcool, as realisedby a PI controller, reaching a threshold of 4,000 KJ. Observehow the probability changes from very unlikely to highlylikely when we change the internal parameters of the model.The effect is also reflected on the runtime.

As a next property (see Table 3), we are interested in thebehaviour of the chillers. We have the cooling load (CL) alongwith two chillers. The varied parameters are the distributionparameter α, TCWSP and TZASP. The LTL-property of interestis the likelihood that the chiller’s power demand (of the first

Table 3 SMC results forcooling load LTL formula I (s) ≺ p αch,1 TZASP TCWSP Confidence δ Time (s)

♦I (PCh,1 ≥ 1) ≺ p [0, 500] ≥0.98 0.65 20 17 0.95 0.05 43.712

[0, 500] ≤0.02 0.65 25 20 0.95 0.05 38.65

[0, 500] ≤0.02 1 25 20 0.95 0.05 41.784

[0, 500] ≤0.02 1 25 20 0.995 0.005 71.627

[0, 500] ≤0.02 1 25 20 0.95 0.005 1,025.492

Table 4 Maximum windproduction LTL formula I (s) Max (kWH) Confidence δ # Runs Time (s) Pr

♦I (PW >= Max) [0, 500] 1.5 0.95 0.05 738 53.185 [0, 0.05]

[0, 1,000] 1.5 0.95 0.05 738 108.872 [0, 0.0744]

[0, 3,000] 1.5 0.95 0.05 738 259.849 [0.338, 0.438]

[0, 3,000] 2 0.95 0.05 738 258.456 [0.329, 0.429]

[0, 3,000] 2.5 0.95 0.05 738 259.671 [0.314, 0.414]

[0, 3,000] 2 0.995 0.05 1,199 424.564 [0.316, 0.416]

[0, 3,000] 2 0.95 0.005 73,778 25,824.784 [0.369, 0.379]

Table 5 SMC results for microgrid operating in islander mode

LTL formula I (s) ST WT MT Confidence δ #Runs Time (s) Pr

♦I (fr ≤ −0.1) [10, 1,000] No 2 No 0.95 0.05 738 320.793 [0.95,1]

[10, 1,000] No 4 No 0.95 0.05 738 320.582 [0.95, 1]

[10, 1,000] No 2 Yes 0.95 0.05 738 306.094 [0, 0.05]

[10, 1,000] Yes 2 Yes 0.995 0.05 1,199 1,215.123 [0, 0.05]

♦I (fr ≥ 0.4) [10, 500] No 2 No 0.95 0.05 738 330.797 [0.425, 0525]

123

Modelling and SMC of a microgrid

chiller, say) exceeds a certain threshold (1 kWH, say) withininterval I .

Table 4 presents the results of checking whether the max-imum generated power by the wind turbine exceeds somethreshold (Max). Unlike Qcool, PW shows more randombehaviour, so the run is not as predictable as in the caseof the cooling load. We apply statistical model checking tocalculate the probabilities (range of the probability) in favourof the hypothesis testing. Note that, relaxing the probabilityinterval has a greater effect on the runtime than changing theconfidence. The reason being the number of runs for verifi-cation increases sharply by lowering δ (see Fig. 17).

Lastly, we check whether the microgrid is stable or notwhen it goes into the islander mode. We assume the grid sta-bility is characterised by the frequency deviation. We con-sider the following components: cooling load (CL), one elec-trical load (EL), wind (W), wind turbines (WT), storage (ST),microturbine (MT) and the local power network (LPN). Weconsider various situations where we vary the availability ofstorages devices, the number of wind turbines at our disposaland whether the microturbine is already in warm-up phaseor not. Some verification results are listed in Table 5.

4 Conclusions

In this paper, we have presented a model of a microgrid con-figuration as a composition of stochastic hybrid automata.The main contribution is the simulation and analysis of thecombined behaviour of all these components. We reported onvarious simulation experiments and statistical model check-ing a number of bounded LTL properties using Uppaal-SMC. In our case study, we were not confronted with rareevents [13]. Our model is more extensive than the piece-wise deterministic Markov process model recently reportedin [22]; it copes with more general and more detailed dynam-ics, and includes thermal energy. This case study has shownthat stochastic hybrid automata are an adequate modellingformalism for modelling microgrids in a faithful manner. Sta-tistical model checking seems to be an effective technique toevaluate bounded temporal properties of interest. Substan-tial effort in the model-checking process has been spent onadopting the formal models to the syntactic restrictions ofUppaal- SMC.

References

1. Abate, A., Katoen, J.-P., Lygeros, J., Prandini, M.: Approximatemodel checking of stochastic hybrid systems. Eur. J. Contr. 16(6),1–18 (2010)

2. Abate, A., Katoen, J.-P., Mereacre, A.: Quantitative automatamodel checking of autonomous stochastic hybrid systems. In:

Hybrid Systems: Computation and Control (HSCC). ACM, NewYork, pp. 83–92 (2011)

3. Anderson, G.: Dynamics and Control of Electric Power Systems.Lecture Notes, ETH Zurich (2012)

4. Barringer, H., Falcone, Y., Finkbeiner, B., Havelund, K., Lee, I.,Pace, G.J., Rosu, G., Sokolsky, O., Tillmann, N. (ed.) Runtimeverification—first international conference, RV 2010, St. Julians,Malta, November 1–4, 2010. In: Proceedings. Lecture Notes inComputer Science, vol. 6418. Springer, Berlin (2010)

5. Carrillo, C., Obando Montao, J.C., Daz-Dorado, E.: Review ofpower curve modelling for wind turbines. Renew. Sustain. EnergyRev. 21, 572–581 (2013)

6. Cassandras, C., Lygeros, J.: Stoch. Hybrid Syst. Taylor & Francis,UK (2007)

7. David, A., Du, D., Larsen, K.G., Legay, A., Mikucionis, M.,Poulsen, D., Sedwards, S.: Statistical model checking for stochas-tic hybrid systems. In: Workshop on Hybrid Systems and Biology(HSB), EPTCS 92, pp. 122–136 (2012)

8. Gensollen, N., Gauthier, V., Marot, M., Becker, M.: Modelingand Optimizing a Distributed Power Network: A Complex Sys-tem Approach of the Prosumer Management in the Smart GRID.CoRR abs/1305.4096 (2013)

9. Gordon, J.M., Ng, K.C.: Predictive and diagnostic aspects of a uni-versal thermodynamic model for chillers. Int. J. Heat Mass Transf.38(5), 807–818 (1995)

10. Hahn, E.M., Hartmanns, A., Hermanns, H., Katoen, J.P.: A com-positional modelling and analysis framework for stochastic hybridsystems. Formal Methods Syst. Des. 43(2), 191–232 (2013)

11. Hartmanns, A., Hermanns, H.: Modelling and Decentralised Run-time Control of Self-stabilising Power Micro Grids. In: ISoLA (1),LNCS, vol. 7609, pp. 420–439 (2012)

12. Hartmanns, A., Hermanns, H., Berrang, P.: A comparative analy-sis of decentralized power grid stabilization strategies. In: WinterSimulation Conference (WSC), WSC, pp. 1–13 (2012)

13. Jégourel, C., Legay, A., Sedwards, S.: Cross-entropy optimisationof importance sampling parameters for statistical model check-ing. In: International Conference on Computer Aided Verification(CAV), LNCS, vol. 7358, pp. 327–342 (2012)

14. Kim, Y.J., Kim, M., Kim, T.H.: Statistical model checking for safetycritical hybrid systems: an empirical evaluation. In: Haifa Verifi-cation Conference (HVC), pp. 162–177 (2012)

15. Lasseter, R.: Smart distribution: coupled microgrids. Proc. IEEE99(6), 1074–1082 (2011)

16. Machowski, J., Bialek, J.W., Bumby, J.R.: Power SystemDynamics—Stability and Control. Wiley, New York (2008)

17. Mathisen, K.W., Morari, M., Skogestad, S.: Dynamic models forheat exchangers and heat exchanger networks. In: European Sym-posium on Computer Aided Process Engineering3 25th EuropeanSymposium of the Working Party on Computer Aided ProcessEngineering and 494th Event of the European Federation of Chem-ical Engineering (EFChE). Computers & Chemical Engineering,vol. 18, Supplement 1(0), pp. S459–S463 (1994)

18. Mur-Amada, J., Bayod-Rujula, A.A.: Wind power variabilitymodel—part II—probabilistic power flow. In: 9th Int. Conf. onElectrical Power Quality and Utilisation (EPQU 2007), pp. 1–6(2007)

19. Parisio, A., Glielmo, L.: Energy efficient microgrid managementusing model predictive control. In: 50th IEEE Conf. on Decisionand Control and European Control Conference (CDC-ECC 2011),pp. 5449–5454 (2011)

20. Philippopoulos, K., Deligiorgi, D.: Statistical simulation of windspeed in Athens, Greece, based on Weibull and ARMA models. J.Energy 3, 151–158 (2009)

21. Ramponi, F., Chatterjee, D., Summers, S., Lygeros, J.: On the con-nections between PCTL and dynamic programming. In: Hybrid

123

S. Chakraborty et al.

Systems: Computation and Control (HSCC). ACM, New York, pp.253–262 (2010)

22. Strelec, M., Macek, K., Abate, A.: Modeling and simulation of amicrogrid as a stochastic hybrid system. In: IEEE Conf. on Innov-ative Smart Grid Technologies (ISGT). IEEE, New York, pp. 1–9(2012)

23. Tigges, M.: Modellbasierte Analyse zur Verbesserung der elek-trischen Energiebereitstellung zu künftiger Offshore–Windparksmittels Biogastechnologie. Ph.D. thesis, Universitaet Paderborn(2010)

24. Tzanos, J., Margellos, K., Lygeros, J.: Optimal wind turbine place-ment via randomized optimization techniques. In: Power Syst.Comput. Conf. (PSCC), pp. 1–8 (2011)

25. Younes, H., Simmons, R.G.: Statistical probabilistic model check-ing with a focus on time-bounded properties. Inf. Comput. 204(9),1368–1409 (2006)

26. Younes, S., Clarke, E.M., Gordon, G.J., Schneider, J.G.: Verifi-cation and Planning for Stochastic Processes with AsynchronousEvents. Technical Report (2005)

123