The electrical distribution system (EDS) provides an economical, safe, and reliable means of energy supply. However, the traditional EDS is to vulnerable high-impact and low-probability (HILP) events, such as extreme weather events, cyberattacks, and natural disasters [1]. These HILP events can cause blackouts, and significantly impact power consumption. For example, in 2016, a tornado hitting Jiangsu province, China, caused a power outage for 135,000 households [2]; hurricane Alma hit Florida in 2017, affecting ~6.7 million households [3]; and the Great East Japan earthquake of 2011, resulted in a power outage for >4 million households for 7–9 days [4]. These heavy losses revealed the vulnerability of EDS. Extensive forecasting efforts have projected a total annual loss of >$480 billion due to electric power outages in the US between the years 2080–2099 [5]. Therefore, the development of a resilient EDS, capable of quickly recovering to an acceptable operational state after HILP events has become a research hotspot.

Previous studies on DG suggested optimal siting and sizing decisions to minimize the long-term, cumulative EDS operating costs [6,7]. These approaches are focused on normal operating conditions and use load profiles or renewable energy output as the stochastic variables. In contrast, resilience-oriented DG planning aims to minimize the load-shedding amount under stochastic N-K fault scenarios. Shi et al. [8,9] formulated resilience-oriented DG planning as a two-stage stochastic optimization problem. Firstly, the system planner deploys an optimal DG siting and sizing plan. Subsequently, the system operator minimizes load shedding through an outage management strategy. Khaledi et al. proposed [10] a three-stage resilience-oriented battery energy storage system allocation method, which combines distributed energy resource integration, intentional islanding, and identifying consumer preferences into the resilient operation. An emergency generator planning coordinated with a distribution line hardening method was proposed by Yu et al. [11], modeling the HILP events (especially typhoons) in both temporal and spatial dimensions. However, these studies primarily focus on applying investment strategies (e.g., DG planning and line-hardening) to enhance the EDS resilience, while not fully considering operational measures, such as DNR and DRP.

Generally, EDS resilience enhancing approaches include line-hardening [12], installing DGs [13], and DNR [14]. Although they can improve EDS reliability and resilience, an excessive number of DGs will increase both the economic burden and EDS control complexity [15]. The development of MG and active distribution systems provide alternate approaches to constructing a EDS. Chen et al. [16] proposed a post-disaster EDS reconstruction model based on DGs and remote switches. After a failure, non-fault areas are reconstructed into multiple MGs, and the DGs within these MGs secure the continuous power supply to consumers. Lei et al. [17] proposed a double-layer optimization of the deployment and dispatch of mobile emergency vehicles, which are connected to form an MG with the local generators. Farzin et al. [18] adopted a hierarchical management of energy resources in the MG to minimize post-disaster power failure losses. Ding et al. [19] proposed an MG formation method considering DG master-slave operations as a mixed-integer second-order conic programming (MISOCP) model, where the islanding operation considers the dispatchable DG as the master unit with voltage control, and renewable sources as the slave units.

The demand response (DR) technology has rapidly developed with the improvements in the power market. During a HILP event, a serious supply-demand imbalance is created within the MG. DRP can reduce or shift energy consumption by affecting the user behavior, to relieve the pressure of power supply and accelerate the load recovery process [20]. Effective load recovery is well-known to improve EDR resilience. Therefore, DRPs are non-negligible operational resources to increase EDS resilience [21]. Based on the step-type elastic load curve modeling method, Gan et al. [22] applied ten price levels to express the relationship between the incentive price and the user load response. However, in practical situations, price-based DRPs exhibit poor controllability, making it difficult to quickly respond to sudden HILP events [23]. In comparison, incentive-based DRPs require the consumers to sign a treaty with the distribution system operator (DSO) in advance. As a result, to get compensation rather than punishment, users are more willing to participate in the DRP [24]. Specifically, in emergencies (e.g., unplanned outages and sudden changes in renewable energy sources), the utilities perform incentive-based DRP actions, frequently referred to as emergency demand response (EDR) [25,26]. Sasaki et al. [25] proposed a power imbalance preventive control method for unpredictable events, with EDR to mitigate the sudden power changes in the renewable energy output. Osman et al. [26] utilized a cost-effective emergency DRP that can be applied after severe extreme disasters to help decrease the total load-shedding amount and minimize the total outage penalty cost.

HILP events may cause random damages to the EDS components, making it difficult to pin-point the part of the EDS that will face power outages. Therefore, to deal with such uncertainty, stochastic programming [14,27] and robust optimization (RO) [28–31] have been widely applied. However, stochastic programming generally requires random variables to obey a given probability distribution. In comparison, RO does not require a random variable probability distribution function, thus avoiding the establishment of component vulnerability models in HILP events. As an extension of the classical RO, the DAD structure clearly represents the defender-attacker interaction. Firstly, the DSO (defender) deploys an optimal planning strategy (typically, an investment strategy, such as line-hardening or DG allocation). Secondly, a HILP event (attacker) maximizes the load shedding amount under the given number of opponent faults (i.e., the worst-case N-K scenario is selected). Finally, the DSO minimizes the load shedding through operational resources. Yuan et al. [29,31] proposed a two-stage RO solved by the column and constraint generation (C&CG) method, where the first stage determines the line hardening and DG allocation and the second stage minimizes the load shedding. However, they neglected the function of the operational resources in resilience improvement. Lin et al. [32] considered the DNR and proposed a DAD structure, but it failed to take advantage of the DRP. This suggests that we need DGs with larger capacities to support critical loads (CLs) during HILP events, which will certainly increase the economic burden.

Previous works typically focused on investment strategies to improve EDS resilience. However, the operational flexibility of the EDS to provide resilience against HILP events has not been thoroughly explored in these studies. In practicality, there can often be strict limitations to the investment budget. Therefore, operational resources have great potential for improving EDS resilience without additional equipment and investment. In this study, we propose a resilience-oriented tri-level robust planning model that considers the EDS operational resources. The main contributions of this paper are summarized as follows:

1) We propose a novel tri-level robust planning model that innovatively coordinates DG allocation and operational resources and vastly expands the traditional DAD model. Unlike the previous studies, this model considers both DG siting and sizing as assuming the same size of all DGs might result in surplus or insufficient power supply.

2) From the system operation perspective, topology reconfiguration (MG formation) and DRP are both performed to achieve a novel EDS restoration algorithm as the defense mechanism. In this manner, the system defenders can be prepared for the worst-case attacks while considering the operational resources to achieve cost-effective and efficient resilience planning.

3) To deal with the 0/1 variables caused by fault uncertainty and network reconfiguration, we employed the nested column and constraint generation (NC&CG) algorithm to separate the original problem into upper and lower-level problems, with the latter further divided into a main and a sub-problem. The upper-level problem determines the allocation of DGs while the lower-level problem finds the worst case caused by the HILP events.

This paper is organized as follows: Section 2 describes the mathematical formulation of the problem; Section 3 introduces the solution; Section 4 discusses the case studies; and Section 5 presents conclusions.

Since the RO model adapts to the uncertainty of line failures caused by HILP events, the key lies in constructing uncertainty sets. We assumed that as long as the line is being attacked, it will remain unavailable until the fault is cleared. In addition, if the line is not attacked, its final switching state will be determined by the DSO.

(3){Zij≤aijaij=1−atkij∀(i,j)∈L,

where the aij value indicates whether the branch (i, j) is available (1) or not (0); the Zij value represents the final switching status decided by the DSO (open: 0 or closed: 1); and k refers to the attack budget.

If a line is not attacked (atkij = 0), it will be available (aij = 1) for the DSO to decide whether it is open (Zij = 0) or closed (Zij = 1). Whereas, if a line is attacked (atkij = 1), it will remain unavailable (aij = 0) and always open (Zij = 0). The uncertainty set, U, considering the N − k contingencies can be expressed a:

(4)U={∑(i,j)∈L(1−atkij)≥N−k}.

Here, Eq. (4) indicates no more than k branches are on outage simultaneously and the k-value can be selected according to the branch outage samples.

The linearized DistFlow model used to represent the power flow constraints in this study is described as follows: (5){∑j∈π(i)Pij,t−∑j∈θ(i)Pji,t=Pi,tDG−(Pi,tL−Pi,tDR−Pi,tcur)∑j∈π(i)Qij,t−∑j∈θ(i)Qji,t=Qi,tDG−(Qi,tL−Qi,tDR−Qi,tcur)∀i∈N, (6){Vi,t−Vj,t−Pij,tRijV0−Qij,tXijVo≤M(1−Zij)Vi,t−Vj,t−Pij,tRijV0−Qij,tXijVo≥−M(1−Zij)∀(i,j)∈B, (7){−SijmaxZij≤Pji,t≤SijmaxZij−SijmaxZij≤Qji,t≤SijmaxZij∀(i,j)∈B, (8){0≤Pi,tcur≤Pi,tL0≤Qi,tcur≤Qi,tL∀i∈N, (9){0≤Pi,tDG≤PiDG,r0≤Qi,tDG≤QiDG,r∀i∈N, (10)Vmin≤Vi,t≤Vmax ∀i∈N, (11)∑i∈Nδi≤N¯DG, (12)P_DG,rδi≤PiDG,r≤δiP¯DG,r.

Here, the power flow balance is represented in Eq. (5). The power balance constraint considers the power injection at node i by substation and DGs to attend the in-service load after load curtailment and DRP. Note that we assumed that the reactive power demand following the active power demand variations considering a constant power factor τil, thus Qi,tDR in Eq. (6) can be calculated as Qi,tDR=τilPi,tDR. Eq. (6) is the constraint of line voltage drop. Vo means the rated voltage. If Zij = 1, the inequality constraint is reduced to an equality constraint while if Zij = 0, Vi,t – Vj,t is unbounded. Eq. (7) is the active and reactive line flow constraint. Eq. (8) constrains that the amount of load curtailment cannot exceed the original load. Eq. (9) is the active and reactive DG output constraints. Eq. (10) is the voltage constraint. Eq. (11) restricts the number of DGs to be installed. Eq. (12) restricts the maximal and minimal DG size.

A radial graph is a connected graph without cycles (example in Fig. 1) [34]. Based on graph theory, it can be defined as a connected graph with n buses and n – 1 lines. Spanning tree [35,36] and single commodity flow (SCF) [19] are two effective methods to model the radial-topology constraints as a set of linear equations; we adopted the latter in this study.

According to the SCF method, the graph is radial when it strictly satisfies the following two conditions: (a) the number of closed lines equals the number of buses minus the number of sub-graphs; and (b) connectivity of each sub-graph is guaranteed. We introduced a fictitious network that has the same topology and group of switching status variables, Zij, as the original EDS. In the virtual network, each non-source bus is assumed to have a unity load demand (1.0). The radial-topology constraints are expressed as Eqs. (13)–(15). (13)∑(i,j)∈BZij=Nbus−∑i∈NRooti,where Nbus is the total number of buses; and the Rooti value indicates if a bus is chosen as the source (1) or not (0). ∑Rooti represents the number of sub-graphs. Every island formed by the DNR should contain at least one source bus. (14){∑j∈π(i)Fij−∑j∈θ(i)Fji≥−1−M⋅Rooti  ∀i∈N∑j∈π(i)Fij−∑j∈θ(i)Fji≤−1+M⋅Rooti  ∀i∈N,

Here, Fij is the fictitious power flow on the branch (i, j) and Eq. (14) confirms that the fictitious power flow is slacked at each source bus, while each non-source bus has a unity load demand (1.0). Thus, all the non-source buses should be connected to the source bus to meet Eq. (14). (15)−M⋅Zij≤Fij≤M⋅Zij ∀(i,j)∈B,

Here, Eq. (15) ensures that on the faulted lines, the fictitious power flow is maintained at 0. During the network reconfiguration process, the EDS contains three types of sub-graphs: (a) MGs installed with controllable DGs; (b) isolated islands experiencing power outages; and (c) buses supplied by the substation (Fig. 2).

One needs to identify the kind of bus that is qualified to be the source. Since the on-outage island is also counted as a type of sub-graph, we cannot simply consider the bus installed with DGs as the source bus. Thus, the bus at the end of any faulted line (ei=1) should be counted as a source bus either. The buses that meet any of the following conditions are qualified to be the source bus: (a) the ith bus installed with a controllable DG; or (b) the ith bus at the end of any faulted line (Fig. 3). The source bus qualification relation can be expressed as:

(16)Rooti≤δi+ei  ∀i∈N,

where δi value indicates whether the ith bus is installed with a DG (1) or not (0); and the ei value indicates whether the ith bus is at the end of any faulted line (1) or not (0). For the ith bus at the end of any faulted lines, we have Eq. (17).

(17)∑(i,j)∈L(1−aij)/M≤ei≤∑(i,j)∈L(1−aij) ∀i∈N,

i.e., if (∑(1−aij)≥1), ei will be set to be 1.

When the ith bus qualifies (δi+ei≥1), the DSO decides whether it will finally be selected as a source bus in the DNR process (Fig. 3). The DNR (MG formation) process is shown in Fig. 4. The original topology of the system exhibited fault on lines (2, 11), (3, 4), and (3, 8) (Fig. 4a). As per the principle proposed above, buses installed with controllable DGs are potential source buses (e.g., bus 7 and bus 9 in Fig. 4). However, the attack may lead to an on-outage island (e.g., MG1 caused by the attack on line (2, 11)). Thus, bus 11 was selected to be a source bus to preserve the radial topology. Similarly, buses 2, 3, 4, and 8 can also be potential source buses. Figs. 4b–4d show three different MG formation strategies. Strategy (b) takes advantage of the tie lines (2, 4) and (7, 10) to provide an alternate power supply path for the on-outage area, whereas strategies (c) and (d) form self-sufficient MGs to restore the power supply.

In the EDS, the priority of each load is different, which implies that curtailing the CL with higher priority can incur tremendous economic loss and even human casualties. Therefore, every possible effort should be made to secure a continuous power supply to the CL. In this study, we have identified two kinds of CLs, namely hospitals and important industries, which may incur human casualties if curtailed (Table 1). Other types of loads have also been identified, namely interruptible load (IL) and mixed load (containing a certain proportion of CL and IL).

Conventionally, there exist price-based and incentive-based DRPs [37]. In this study, we employed the latter as the goal was to improve EDS resilience [24], i.e., the EDR program [38]. We assumed that all the ILs have already signed a contract with the DSO, which allows it to curtail their loads during HILP events. Considering the different types and composition of each load, we adopted a stepped compensation mechanism (Fig. 5) [38]. The total load of a consumer is divided into several steps, and each step includes a specific percentage of the total load. Moreover, the compensation cost of the DPR ascends in each step, i.e., the first 10% of the load is much cheaper than the last 10% of the load curtailed by the DPR. For example, in the supermarket, the air conditioning load (D1 in Fig. 5) has a higher priority to participate in the DRP than the refrigerated load (D4 in Fig. 5). The curtailment of refrigeration load will spoil the stored items, which would lead to more economic loss than up on curtailing the air conditioning load.

The DRP stepped compensation mechanism can be expressed as Eqs. (18)–(20).

(18)Pi,tDR=∑d∈DiPd,i,tDR ∀i∈Λ, (19)Pi,tDR≤Pi,tL ∀i∈Λ, (20)Pd,i,tDR≤τd,iPi,tL ∀i∈Λ,

where τd,i denotes the proportion of the dth DR block in the ith load; Λ is the set of ILs; Pi,tDR is the total power reduced by the DRP of the ith bus at time t; and Pd,i,tDR is the used portion of the dth DR block of the jth load. Eq. (19) makes sure that the bus with its load curtailed by the DRP cannot access its original load and Eq. (20) makes sure that the used portion of every DR block is unable to access its capacity. The cost of CL curtailment and DRP compensation can be expressed as Eqs. (21)–(22). (21)Ccur=ccur∑t∈T∑j∈N(Pj,tcur)Δt, (22)CDR=∑t∈T∑j∈Λ∑d∈D(cj,dDRPd,j,tDR)Δt.

The final tri-level model was a mixed integer linear programming (MIP) problem that could be solved by commercial solvers, such as Gurobi, Cplex, and so on. The model can be expressed as: (23){objective:(1)attack constraints:(3)−(4)topology constraints:(13)−(17)operational constraints:(5)−(12),(18)−(20)

To simplify the notation, all the power flow variables (Pij,t,Qij,t,Pi,tcur,Qi,tcur,Pi,tDR,Pi,d,tDR,Pi,tDG,Qi,tDG,Vi,t) were set contained in the vector z; DG planning decision variables (δi,PiDG,r) were contained in the vector h; the attack variable (atkij) was contained in the vector u; the DNR continuous variable (Fij) was contained in the vector r; and the DNR integer variables (Zij,Rooti,ei) was contained in the vector c.

Thus, the whole problem can be reformulated as: (24)obj:minhcTh+maxuminz,r,cdTzs.t.{A1h+B1z+C1c+D1u+E1r≥F1 (3),(5)−(10),(13)−(17),(18)−(20)A2h+B2z+C2c≥F2 (5)−(10),(18)−(20)

The objective of the upper-level problem was to find the optimal DG planning strategy, using the given attack strategy created by the lower-level problem as the input. By defining the auxiliary variable α, the upper-level problem can be expressed as: (25)minh(CannualDG+α), (26)α≥(Ccur,κ+CDR,κ) κ=1,2,⋯, (27){∑i∈Nδi≤N¯DGP_DG,rδi≤PiDG,r≤δiP¯DG,r, (28)A1h+B1zκ+C1cκ+D1u∗+E1rκ≥F1 κ=1,2,⋯,where κ is the number of interactions for the upper-level problem; the symbol  ∗ indicates that the corresponding variable has been given already.

The objective of the lower-level problem is to find the attack strategy with the maximum damage under the given DG planning strategy of the upper-level problem. To deal with the integer variables of the topology constraints, the main problem finds the optimal attack plan given a set of fixed topologies, and the sub-problem determines the optimal operation strategies given the attack strategy.

a) Main problem

The lower-level main problem can be expressed as: (29)maxuminz(Ccur+CDR).

According to dual theory, the inner min problem can be converted to its dual form (max problem). Thus, the lower-level main problem can be re-expressed as: (30)maxumaxπf(π),where π is the vector of dual variable to vector z; and f(π) is the dual objective function. By introducing the auxiliary variable β in Eq. (30), we obtain: (31)maxumaxπβ, (32)∑ijatkij≤k, (33)β≤∑j,t(π1,j,tξPi,tL+π2,j,tξQi,tL+π9,j,tξPi,tL+π10,j,tξQi,tL+π11,j,tξPiDG,r,∗+π12,j,tξQiDG,r,∗+π13,j,tξVmin+π14,j,tξVmax)+∑ij,t(π3,ij,tξM(1−Zijξ)−π4,ij,tξM(1−Zijξ)−(π5,ij,tξ+π7,ij,tξ)SijmaxZij+(π6,ij,tξ+π8,ij,tξ)SijmaxZij)+∑d,j,t(π17,d,j,tξτd,iPi,tL), (34)π3,ij,tξ,π6,ij,tξ,π8,ij,tξ,π9,j,tξ,π10,j,tξ,π11,j,tξ,π12,j,tξ,π14,j,tξ,π16,j,tξ,π17,d,j,tξ≤0π4,ij,tξ,π5,ij,tξ,π7,ij,tξ,π13,j,tξ≥0, (35)π1,j,tξ−π1,i,tξ−(π3,ij,tξ+π4,ij,tξ)RijV0−SijmaxZijξ(π5,ij,tξ−π6,ij,tξ)=0→Pij,t, (36)π2,j,tξ−π2,i,tξ−(π3,ij,tξ+π4,ij,tξ)XijVo−SijmaxZijξ(π7,ij,tξ−π8,ij,tξ)=0→Qij,t, (37)π1,j,tξ+π11,j,tξ≤0→Pi,tDG, (38)π2,j,tξ+π12,j,tξ≤0→Qi,tDG, (39)π1,j,tξ+π9,j,tξ≤ccur→Pi,tcur, (40)π2,j,tξ+π10,j,tξ≤0→Qi,tcur, (41)π1,j,tξ+π15,d,j,tξ+π16,j,tξ≤0→Pi,tDR, (42)π17,d,j,tξ−π15,d,j,tξ≤cj,dDR→Pd,i,tDR, (43)π3,ij,tξ−π3,ji,tξ+π4,ij,tξ−π4,ji,tξ+π13,j,tξ+π14,j,tξ≤0→Vi,t, (44)Zijξ=(1−atkij)⋅Zij∗,where ξ is the iteration number of the lower-level problem (ξ = 1, 2, 3,...). Eq. (44) indicates that the line-switching status will stay consistent with the given topology if it is not attacked. Note that there are several nonlinear components in Eq. (33). Taking π3,ij,tξM(1−Zij) as an example, we will see that these components can be linearized by using the following functions: (45)μ≥π3,ij,tξ−M(1−Zij), (46)μ≥−M⋅Zij.

b) Sub-problem

After obtaining the optimal attack strategy, the lower-level sub-problem minimizes the operating cost using DNR and DRP. This process can be expressed as: (47)minzminr,c(Ccur+CDR), (48)A1h∗+B1z+C1c+D1u∗+E1r≥F1.

After solving the lower-level sub-problem, the newly formed topological structure is returned to the lower-level master problem for another iteration. Once the lower-level problem converges, the optimal attack strategy is returned to the upper-level problem in the next iteration, as shown in Fig. 6.

The NC&CG initialization process is explained as follows (Fig. 6): we set the (i) lower bound of the upper-level problem as LB←−∞; (ii) upper bound of the lower-level problem as UB←+∞; (iii) upper bound of the lower-level master problem as LUB←+∞; (iv) the lower bound of the lower level sub-problem as LLB←−∞; (v) convergence threshold, gap; (vi) iteration number, κ=1; and (vii) ξ=1.

The IEEE 33-bus system was used to test the performance of the proposed method (Fig. 7). This is an EDS with a main transformer, 37 branches (32 normally-closed lines and 5 normally-open tie-lines), and 33 load buses. The power base value was 1.0 MVA and Δt was 1 h. For a mixed-load bus, CL and IL both account for 50% of the total load (main parameters listed in Table 2; other parameters can be found in [41]). All computational tests were conducted on a laptop with an AMD Core 3.6 GHz CPU and 16 GB RAM using the Cplex solver on the GAMS platform to solve the MIP model.

By using our proposed DAD model considering the coordination of DNR and DRP, we obtained the planning results for the IEEE 33-bus EDS (Table 3). To reflect the necessity of operational strategies to improve EDS resilience, we performed a comparative analysis of three cases based on four line faults.

Case 1: without using any operational strategies;

Case 2: only considering DNR;

Case 3: considering a coordination of both DNR and DRP.

Note that we used CL curtailment as the indicator for resilience assessment. After implementing the proposed model (Case 3), the CL curtailment was reduced by 62.26% and 45.37% compared to Case 1 and Case 2, respectively. This indicated that the proposed planning model significantly enhanced the EDS resilience. Moreover, with the introduction of operational resources, the operating and total investment costs of installing DGs can be significantly reduced. Compared with the existing models only considering DNR (Case 2), the advantage of our planning model considering the coordination of DNR and DRP allows for an initial investment decision that is less conservative, which has profound implications for scenarios with a limited investment budget.

The following is a detailed analysis of the effects of the two operational resources (DNR and DRP) on the EDS resilience improvement:

1) DNR (MG formation) defense mechanism

We obtained the topology of the IEEE 33-node EDS for all three cases after the optimal DG and attack strategy planning scheme (Table 3). When the number of DG hits the limit (N¯DG=5), without considering any operational resource, the only way to cover the power demand of the CLs is to set the DGs directly on the CL buses (Fig. 8a). However, as there is no alternative power supply path, the four attacks caused three on-outage islands (Islands 1–3 in Fig. 8a). The mixed-load buses in these islands continued to face full load shedding. Next, we introduced DNR after the fault occurrence as the only defense mechanism, which resulted in the active formation of two temporary MGs (Fig. 8b). After taking into account the tie-lines, we found that the alternate power supply path allowed a single DG to cover a wide range of loads. For example, in Fig. 8a, if there is a tie-line between bus 9 and bus 15, the DG on bus 15 would be able to supply the power demand of Island 1 and the attacker can no longer cause a large-scale power outage in this area. In general, DNR can provide an alternate power supply path for some loads, enabling a single DG to support more loads. As a result, DNR can make it difficult for attackers to cause widespread power outages in the EDS, thereby enhancing its resilience. Additionally, it can alleviate investment pressure since a single DG can serve a larger area, reducing the overall DG capacity requirements. Compared to Case 1, the network reconfiguration in Case 2 improved the resilience (reducing CL curtailment from 1250.5 to 864 kW), while reducing the investment cost (from $394,898.782 to $368,031.908) due to the reduction of the total DG capacity (from 2052 to 2007 kW).

However, in all three cases, there always were two identical on-outage islands (Islands 1 and 2 in Figs. 8a–8c). As the IL proportion in these two areas was relatively large, the extra investment brought in by the additional DG was far greater than the loss caused by the load shedding. Therefore, it was not appropriate to deploy additional DGs in this case. Moreover, these two islands were present at the end of the system with no additional tie-lines to provide a backup power supply path. If the attacker cuts two lines, i.e., (15, 16) and (29, 30), the entire area would face a full load shedding. The above two reasons make these two areas fragile to attacks. This phenomenon demonstrated the requirement for the DNR. The ability of the EDS to resist and recover from HILP events can be further enhanced by reasonably adding tie-lines.

2) DNR-DRP defense mechanism

Once the DRP operational resource was added to Case 2, the obtained DG siting strategy of the new case was the same as that of Case 2 (Table 3 and Fig. 8). This phenomenon was expected, as the DRP does not change the initial load distribution and DGs are still prioritized on CLs. The function of the DRP is to adjust user power consumption behavior by offering financial compensation after a fault occurrence. Therefore, the DG siting and attack strategies in both cases were unchanged. The only difference was that in the temporary MGs (MG1 and MG2 in Figs. 8b and 8c) supported by the DGs, the IL users actively participated in the DRP, which greatly reduced the total load demand at peak power consumption time. As shown in Table 4, more ILs actively participated in the DRP in both MGs in Case 3 than those curtailed passively in Case 2. Thus, due to the decrease in power supply pressure, the DG capacity in the MG can be relatively reduced. Furthermore, the cost of cutting the IL power supply by signing a contract in advance would be much lower than that of cutting it without any warning, thereby further reducing the operating cost.

To sum up, the DRP mitigates the power supply-demand imbalance within isolated islands during extreme events. It is known that the EDS operator can curtail part of the loads by offering comparatively lower financial incentives (compared to the cost of abrupt load shedding without prior notification). For curtailing the same amount of load, the compensation cost of DRP is significantly lower compared to that of abrupt load shedding. Consequently, this alleviates the power supply stress in islands, enabling DGs within these isolated areas to concentrate more on the CLs, greatly enhancing EDS resilience. Simultaneously, the inclusion of DRP reduces the need for DGs within isolated islands to maintain large capacities in an attempt to support maximally both CLs and ILs, thereby mitigating the investment pressure. When further considering DRP as an operational strategy in Case 3, compared with Case 2, EDS resilience significantly improved, with CL curtailment decreasing from 872 to 472 kWh. Furthermore, with the decreased demand for the total DG capacity from 2007 to 1820 kW, the pressure on investment costs also reduced from $30,363.172 to $27,832.37 (Table 3).

Fig. 9 shows the convergence of the upper and lower bounds in Case 3. Due to the existence of binary variables in the optimization model and the characteristic of the NC&CG algorithm to increase constraints in the iterative process, it took 7 iterations and 18,311 s to find the optimal solution. However, considering that the model proposed in this paper is a long-term planning solution rather than a short-term scheduling one, the calculation time is within the acceptable range.