Impact of geomagnetic disturbances on power transformers: risk assessment of extreme events and data availability

Certain rare events can have a drastic impact on power systems. Such events are generally known as high-impact low-probability (HILP) events. It is challenging to predict the occurrence of a HILP event mainly due to lack of data or sparsity and scarcity of data points. Yet, it is essential to implement an evidence-driven asset management strategy. In this paper, event tree analysis is used to assess the risk of power transformer failure due to a geomagnetically induced currents (GIC). Those currents are caused by geomagnetic disturbances in Earth’s magnetic field due to solar activity. To assess the impact on power transformers, an understanding of the mechanism and sequence of sub-events that lead to failure is required to be able to construct an event tree. Based on the constructed event tree, mitigation actions can be derived. GIC blockers or reducers can be used. However, that would require extensive installation and maintenance efforts, and the impact on system reliability has to be studied. Also, such technology is still in its infancy and needs extensive validation. A suggested alternative is to combine early warning data from solar observatories with a load management plan to keep transformers below their rated operation point such that a DC offset due to GIC would not cause magnetic core saturation and overheating. Load management and the risk of early warning false positives can incur a negative effect on reliability. Nevertheless, the risk assessment performed in this paper show that incorporating load management in asset planning is a viable measure that would offset the probability of catastrophic failure.


Introduction
Extreme events are quite often overlooked as highly improbable while underestimating their consequences without sufficient data-driven evidence. The problem of lack of data can be due to unavailability of a data source, scarcity of data points, or lack of access. From a risk perspective, probability estimation is challenging since a good understanding of the mechanism of extreme phenomena is required.
Looking into any low-probability high-consequence (LPHC) event, both of data acquisition and physical explanation are essential to assess the probability and the consequence of the event in question. Risk and vulnerability analysis allow for developing an informed decision making process and a mitigation strategy.
In this paper, a brief account of low-probability high-consequence events and event tree methodology is presented. Additionally, a case study involving the impact of geomagnetic disturbances on power transformers is analyzed using event tree analysis. The main contributions of this paper are the introduction of simplified event tree constructions for the studied case, and the discussion of two potential mitigation strategies.

Risk assessment
In this section, the concept of low-probability high-consequence events is reviewed and discussed in addition to using event tree analysis as a method of risk assessment for that type of events.

High-impact low-probability events
Certain unlikely events can have a detrimental impact on a system. Those events can range from natural disasters to human-made catastrophes. Some examples of natural disasters are due to weather such as floods or hurricanes. Other natural disasters can be due to external factors, such as asteroid impacts or solar storms (space weather). Additionally, some hazards are due to human error or intentional sabotage. Such events are referred to as low-probability high-consequence events (Rasmussen and Brysont 2013).
While determining whether an event has a low probability is a fairly straight-forward process, determining its consequences and exact probability is much more of a challenge. There are many aspects and perspectives to consider. In power systems, a comprehensive consequence evaluation would include assessments of the technical impact from the perspective of different parties (e.g., system owner, operator, or end user). Additionally, it would include an assessment of environmental, ethical, and social impacts.

Event tree analysis
The choice of a risk assessment method depends on the level of access to relevant data. When data are unavailable, one might rely on expert opinion to evaluate the probability and consequence of an event (Wilson 2008;Wallnerström and Hilber 2014).
More data-driven methods can be used with more data availability. Event tree analysis is an intermediate method between high data availability and expert assessment due to a lack of data. To have reliable results, a good understanding of the system, and the event in question is necessary. Based on the book titled "Hazard Analysis Techniques for System Safety," a general 10-step methodology for constructing an event tree and performing analysis is presented (Ericson 2015) as (also refer to Fig. 1): 1. System definition 2. Identification of different hazard scenarios 3. Identification of initial causes 4. Identification of pivotal events 5. Building the event tree 6. Determining failure probabilities 7. Identification of consequences 8. Evaluating consequences 9. Recommend mitigation or corrective plan 10. Documentation Event trees were historically used to perform risk-consequence analysis for nuclear power plants. A nuclear power plant failure is potentially catastrophic, and there are not many data points to determine a probability of failure conclusively. So, using event trees to study and document the sequence of how a catastrophic failure can happen is an advantageous alternative. A well-known example of such an analysis is detailed in the WASH-1400 report (Robert and Burns 1980).
The WASH-1400 report presented a quantitative risk assessment method of a nuclear reactor meltdown. The method was probabilistic and allowed for a higher error tolerance as opposed to reliability analysis. The report illustrates a study of component behavior (failure and repair) data and sequence of events, following an initiating event, which would lead to failure (complete core meltdown). Since the available data was limited and sparse at the time, point value estimates were used. Estimating the consequences of a meltdown and exposure to radiation at the individual level is independent of the failure estimates. In other words, consequence estimation requires assuming that the failure event has already occurred. The report suggests that such estimates were sufficient for risk assessment purposes but not for analyzing the reliability and that the risk of core meltdown was still acceptable (Robert and Burns 1980).
A nuclear meltdown is a typical example of a HILP event. By historical precedence, event tree analysis is an effective method to assess the risk of HILP events as long as subevents or "pivotal events" are well understood. The methodological steps shown earlier (Ericson 2015) are key to a successful event tree analysis.

Geomagnetic disturbances and power transformers
In 1859, the largest solar storm on record was observed by the British astronomer Richard C. Carrington. That event resulted in auroras far away from the polar circles. It also had a dramatic impact on telegraph networks at the time as communication was lost in several locations globally. However, there is a lack of evidence on the economic impact (David et al. 2019). As shown in Fig. 2, a solar storm starts with an increase in radiation (or a flare) that reaches Earth at the speed of light (which takes 8 min) as X-ray and ultraviolet radiation. Fifteen to sixty minutes after the electromagnetic radiation, Earth is bombarded by energy-rich particles (proton bursts). Fifteen hours to three days after the particle radiation, it can be followed by a coronal mass ejection consisting of plasma with high magnetic fields that can collide with our planet and lead to fluctuations in its magnetic field (Svenska Kraftnät (Swedish TSO) 2012; Battersby 2019). On Earth, the resulting geomagnetic disturbances (GMD) in the magnetosphere can cause damage to electric systems including communication and power networks. In a power system, the impact manifests as a GIC (Girgis and Vedante 2012). Such a current can lead to failures in power components in general and transformers in particular. This section provides an account of the likelihood of geomagnetic storms and a risk assessment based on an event tree analysis. The status of data available for estimating the probability of geomagnetic storms is reviewed. Then, the consequence of geomagnetically induced currents on power transformers is discussed with a provision of recommended actions taken by network operators.

Likelihood of geomagnetic storms: data availability
The sun goes through a solar cycle that spans 11 years on average (Chapman Sandra et al. 2020) (see Fig. 3). Towards the end of the cycle, an increase in solar irradiance occurs. This is known as a solar maximum. However, there is a high uncertainty when it comes to predicting the development of a solar maximum into a geomagnetic storm on Earth.

3
The main reason is that we have only one data point for an extreme geomagnetic storm, which is the Carrington event, as well as a few other events that are lower in scale (Svenska Kraftnät (Swedish TSO) 2012). Figure 3 shows the fluctuation of sunspot areas based on data retrieved from the Royal Observatory, Greenwich-USAF/NOAA Sunspot database (Royal Observatory 2021). Sunspot is a term referring to dark areas on the solar hemisphere that are cooler than the rest of the solar atmosphere. A spike in the sunspot area (solar maximum) causes an increase in the likelihood of a solar flare due to the increase in built-up magnetic energy near the dark spots. A solar cycle is a peak-to-peak duration in sunspot variations.
Since reliable observational data are relatively modern and limited for the time scale of solar activity, research has focused on trying to acquire estimates over past centuries or even millennia. Some examples of these methods are looking for coronal mass ejection evidence in ice cores (McCracken et al. 2001), developing a probabilistic model (David et al. 2019), or observing distant stars that are similar in type to the sun (Battersby 2019). However, it is noteworthy that estimates of the probability of a Carrington-like event in different recent studies vary widely indicating a high level of uncertainty.
When comparing sunspot peaks shown in Fig. 3 to the power system disturbances reported by Svenska Kraftnät (Swedish Transmission System Operator) (refer to Table 1) and incidents recorded in different locations, GIC-related disturbances seem to occur within two to three years following a solar maximum (Svenska Kraftnät (Swedish TSO) 2012). Statistical significance is yet to be proven, however.
Two notable examples other than the Carrington event are: 1. The March 1989 geomagnetic storm caused major power disruptions in Quebec, Canada. Six million people were affected by the loss of power. However, this event was estimated to be less severe than the Carrington event (David et al. 2019).

The July 2012 Carrington-class solar storm missed
Earth, yet the resulting coronal mass ejection was close to a direct collision. The proximity was in the order of a few days. Svenska Kraftnät received an early warning; however, no power disturbances were reported (Svenska Kraftnät (Swedish TSO) 2012).

Power transformer behavior during a geomagnetic storm
Based on the core's magnetic hysteresis loop, the transformer's rating is set just below the magnetic saturation level (see Fig. 4). During a geomagnetic storm, currents induced in the ground result in a DC offset in the magnetic flux, and thus, increase the current flowing through the transformer. If the transformer is operated close to its rated operation point, the DC offset will result in saturation of the magnetic core (Girgis and Vedante 2012). This in turn results in overheating and a risk of winding and/or insulation failure. Gassing can also occur in the transformer's oil. All this combined can lead to a reduction in the transformer's lifespan (i.e., accelerated aging), or a catastrophic failure in the worst case. In Figs. 5, 6, and 7, the transformer is modeled with a black box where it can be operating whether close to the rated operation point or not. Moreover, the impact of GIC is considered to be overheating and/or gassing in the insulating oil due to the saturation of the magnetic core. The likelihood of overheating and gassing mainly depends on the transformer's failure model (age, failure rate, and the probability of failure based on the model's cumulative distribution function) and is assumed to increase with respect to GIC intensity. The logic behind considering the proximity to the rated operating point is that the load profile is not constant and fluctuates hourly, daily, weekly, and monthly. However, only the hourly fluctuations are considered to assess the risk of a DC offset that would result in saturation. Another reason is that the duration of a GMD storm is on the scale of a few hours.
In Fig. 5, the event tree is constructed while considering the solar flare as the initiating event. When a coronal mass ejection hits the Earth, induced currents arise due to magnetic field fluctuations. Ideally, this sequence of events is accurate in a qualitative sense. However, when it comes to numerical estimations of the probability of occurrence of each event, one would need to rely heavily on assumptions since relevant data are limited.
In Figs. 6 and 7, the initiating event is considered as a geomagnetic disturbance that would cause GICs. An  Table 1) and a case of a near-miss in Svenska Kraftnät (Swedish TSO) (2012) evidence-driven estimation would rely on a sufficient historical record of magnetic field fluctuations Again, since the time scale would be in the order of at least centuries, sufficient historical data is not available at the moment. In recent research (David et al. 2019;Chapman Sandra et al. 2020), a physics-and mathematics-based method was used to derive a model that would yield probability estimations of GMD occurrences of several levels of severity within a chosen time interval. As transformers are usually in operation over a time scale of decades, a single decade estimation is not enough when considering the high consequence of an extreme GMD event. An interval of 60 years can be assumed as comparable to a transformer's lifetime.

Impact on distribution networks including distributed generation
Based on the data presented in Table 1, GIC-related disturbances are mainly reported at the transmission level followed by less frequent disturbances at the sub-transmission level. However, the distribution system can be indirectly vulnerable to GIC. A power transformer failure at transmission or sub-transmission levels can leave areas fed by that transformer constrained in terms of power supply. In many cases, redundancies may exist in the transmission grid. As described earlier, a GMD event can last up to a few hours making large geographical areas exposed. As such, redundancies might not always help in mitigating the risk. In distribution systems, there is an increasing trend of integrating distributed generation (DG). If a distribution network is forced into islanding due to failure(s) in the transmission grid, DG becomes critical to sustaining power supply and power quality. Maintaining acceptable reliability and power quality also depends on the availability of power system protection components and primary/secondary control. Coupled with failures in communication systems, GIC-related transmission grid failures pose challenges to power system protection and control infrastructure. In this case, two parallel sequences of events can leave the distribution system operator in a complex scenario. As described earlier, the first sequence is the one leading to failures in the  transmission grid that may lead to islanding some distribution networks. The second is related to events causing failures in sensitive infrastructure, such as communication networks, GPS, and control systems. Note that the latter sequence can even be triggered by less severe geomagnetic disturbances than those that would trigger a power transformer failure sequence. Thus, there is a significant likelihood of the concurrence of the communications failure sequence with the power transformer failure sequence. Without access to   Event tree of transformer damage due to a geomagnetic disturbance: mitigation using GIC reducers or blockers system control and protection tools, several consequences are incurred. For instance, a network operating in islanding mode is susceptible to unusual frequency fluctuations. A loss of access to control systems needed for frequency stabilization adds to the problem. Furthermore, without the ability to monitor the grid, protection components can be tripped due to accidental overloading. All in all, even though the onset of such a worst-case scenario has a low probability, the potential high consequences make it worth ensuring the reliability of distributed generation and protection components in distribution networks and microgrids.

Recommended actions for network operators
Space weather events need to be considered when creating an asset management strategy in a power system. Thus, it is useful to utilize geomagnetic disturbance and solar activity data to update the probabilities in the event tree. However, when forecasting cannot be conclusive, mitigation actions can be derived by following the sequence of sub-events within the event tree. According to Fig. 6, the consequences of a GIC event can be controlled at two stages in the event tree that are explained in the following paragraphs.
First, GIC intensity can be reduced or blocked using a protective device connected to a power transformer. There are several types of construction of GIC reducers or blockers. In general, a core requirement for such a device is that it has to discriminate against any residual current phenomenon other than GIC. That requires continuous measurement of the variations in Earth's magnetic field. One approach is mitigating GIC through neutral switching (Kovan and De Leon 2015). That method uses a trade-off between GIC mitigation and fault current detection. In a white paper published by the North American Electric Reliability Corporation (NERC) (NERC 2021), multiple device designs and constructions are reviewed. Nonetheless, further validation is required to assess whether such devices are sufficiently reliable as components and as part of the power system. If GIC reducers or blockers become widely and commercially available soon, the risk of having a high consequence on power transformers during a GMD would be significantly reduced (see Fig. 7). Yet, even if they would be available, cost and performance evaluations would still be necessary for network operators to make any decisions regarding using them.
Second option to reduce the consequences of a GIC event would be to have a data-driven approach to manage loading in such a way that transformers in the network are not close to their rated operating point. This requires collaboration among network operators, space agencies, and Earth science institutions. Early warnings systems can be implemented in day-ahead planning. The trade-off here is that some controlled load shedding will be needed to reduce the operating current and temperature in transformers, and thus, reducing the likelihood that a DC offset caused by GIC would throw the magnetic core into the saturation zone of the hysteresis loop and eventually cause overheating. Consequently, a considerable impact on power system reliability can occur.
The field of solar observation is in continuous development with more space missions in the near future (Hapgood 2017). Day-ahead warning systems as a result will improve with time. Yet, even with the risk of false positives, such as in the year 2012, mitigating the high consequence of transformer failure is still worth increasing the risk of less desirable reliability indices.

Conclusion
Data availability is a crucial issue when evaluating HILP events. When data points of a certain event are limited or sparse, it is useful to analyze a system's response to a lowprobability high-consequence event through an event tree. In this article, event tree analysis is applied to a case study of the risk of failure of power transformers due to geomagnetic storms. Even with a low probability, such an event can cause significant damage to a power network. Since it can happen, it will likely happen at some point in time and some substation within a network, especially since a power transformer is expected to operate for decades. Currently, the prediction of geomagnetic storms is in its infancy. Even though one-day-ahead warnings are available, they can be false positive. Thus, focusing on consequence mitigation is more important than predicting a solar storm given the potential severity. Geomagnetically induced current (GIC) blockers or reducers can be used to decrease the probability of transformer failure, yet the technology still requires more validation. Alternatively, early warnings combined with load management during a geomagnetic disturbance are a potential solution to managing the risk of transformer failure. Load management would reduce the current flowing through a transformer and its temperature below the rated operation point. Consequently, a DC offset caused by a GIC is less likely to cause magnetic saturation and overheating. as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.