# Privacy of distributed optimality schemes in power networks

Kanwal Khan, Andreas Kasis, Marios M. Polycarpou and Stelios Timotheou Kanwal
Khan and Andreas Kasis are first authors who contributed equally.Kanwal Khan,
Andreas Kasis, Marios M. Polycarpou and Stelios Timotheou are with the KIOS
Research and Innovation Center of Excellence and the Department of Electrical
and Computer Engineering, University of Cyprus, Cyprus; e-mails:
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>work was funded by the European Union’s
Horizon 2020 research and innovation program under grant agreements No. 891101
(SmarTher Grid) and No. 739551 (KIOS CoE), and from the Republic of Cyprus
through the Directorate General for European Programs, Coordination, and
Development.

###### Abstract

The increasing participation of local generation and controllable demand units
within the power network motivates the use of distributed schemes for their
control. Simultaneously, it raises two issues; achieving an optimal power
allocation among these units, and securing the privacy of the
generation/demand profiles. This study considers the problem of designing
distributed optimality schemes that preserve the privacy of the generation and
controllable demand units within the secondary frequency control timeframe. We
propose a consensus scheme that includes the generation/demand profiles within
its dynamics, keeping this information private when knowledge of its internal
dynamics is not available. However, the prosumption profiles may be inferred
using knowledge of its internal model. We resolve this by proposing a privacy-
preserving scheme which ensures that the generation/demand cannot be inferred
from the communicated signals. For both proposed schemes, we provide analytic
stability, optimality and privacy guarantees and show that the secondary
frequency control objectives are satisfied. The presented schemes are
distributed, locally verifiable and applicable to arbitrary network
topologies. Our analytic results are verified with simulations on a 140-bus
system, where we demonstrate that the proposed schemes offer enhanced privacy
properties, enable an optimal power allocation and preserve the stability of
the power network.

##  I Introduction

Motivation and literature survey: The increasing penetration of renewable
sources of generation is expected to cause more frequent generation-demand
imbalances within the power network, which may harm power quality and even
cause blackouts [1]. Controllable demand is considered to be a means to
address this issue, since loads may provide a fast response  to counterbalance
intermittent generation [2]. However, the increasing number of such active
units makes traditionally implemented centralized  control schemes expensive
and inefficient, motivating the adoption of distributed schemes. Such schemes
offer many advantages, such as scalability, reduced expenses associated with
the necessary communication infrastructure  and enhanced reliability due to
the absence of a single point of failure.

The introduction of controllable loads and local renewable generation raises
an issue  of economic optimality in the power allocation. In addition, the
introduction of smart meters for the monitoring of  generation and demand
units poses a privacy threat for the citizens, since readings may be used to
expose customers daily life and habits, by inferring the users energy
consumption patterns and types of appliances [3].  For example, this issue led
the Dutch Parliament to prohibit the deployment of smart meters until the
privacy concerns are resolved [4],  as well as several counties and cities in
California to vote for making smart meters illegal in their jurisdictions [5].
These  concerns motivate the design of distributed schemes that will
simultaneously achieve an optimal power allocation and preserve the privacy of
local prosumption profiles.

In recent years, various studies considered the use of
decentralized/distributed control schemes for generation and controllable
demand with applications to both primary [6], [7], [8], [9] and secondary
[10], [11], [12], [13] frequency regulation, where the objectives are to
ensure generation-demand balance and that the frequency attains its nominal
value at steady state respectively. In addition, the problem of obtaining an
optimal power allocation within the secondary frequency control timeframe has
received broad attention in the literature [14], [15], [16]. These studies
considered suitably constructed optimization problems and designed the system
equilibria to coincide with the solutions to these problems. In many studies,
the control dynamics were inspired from the dual of the considered
optimization problems [12], [17], [18]. Such schemes, usually referred to in
the literature as Primal-Dual schemes, yield an optimal power allocation and
at the same time allow operational constraints to be satisfied. Alternative
distributed schemes, which ensure that frequency attains its nominal value at
steady state by using the generation outputs, have also been proposed [19],
[20]. However, the use of real-time knowledge of the generation and
controllable demand in the proposed schemes may compromise the privacy of
prosumers.

The topic of preserving the privacy of generation and demand units  has
recently attracted wide attention in the literature. Different types of
privacy concerns, resulting from the integration of information and
communication technologies in the smart grid, are mentioned in [21]. In
addition, [22] analyzes various smart grid privacy issues and discusses
recently proposed solutions for enhanced privacy, while [23] proposes a
privacy-preserving power request scheme. In addition, [24] uses the
differential privacy framework to provide privacy guarantees and [25] studies
the effect of differential privacy on smart metering data. Moreover,
homomorphic encryption has been used in [26] to enable the direct connection
and exchange of data between electricity suppliers and final users, while
preserving the privacy in the smart grid. A privacy-preserving aggregation
scheme is proposed in [27] which considers various security threats. The use
of energy storage units to preserve the privacy of user consumption has been
considered in [28] and [29]. Furthermore, [30] and [31] aim to simultaneously
preserve the privacy of individual agents and enable an optimal power
allocation using homomorphic encryption and differential privacy respectively.
Both approaches result in suboptimal allocations, which suggests a trade-off
between optimality and privacy. Several existing techniques  that aim at
preventing disclosure of private data are also discussed in [32].

Although the problems of preserving the privacy of power prosumption and
obtaining an optimal power allocation in power networks have been
independently studied,  the problem of simultaneously achieving these goals
has not been adequately investigated. In addition, to the authors best
knowledge, no study has considered the impact of such schemes on the stability
and dynamic performance of the power grid. This study aims to jointly consider
these objectives within the secondary frequency control timeframe.

Contribution: This paper studies the problem of providing optimal frequency
regulation within the secondary frequency control timeframe while preserving
the privacy of generation and controllable demand profiles. We first propose
an optimization problem that ensures that secondary frequency regulation
objectives, i.e. achieving generation-demand balance and frequency attaining
its nominal value at steady state, are satisfied. In addition, to facilitate
the interpretation of our privacy results, we define two types of
eavesdroppers; (i) naive eavesdroppers, that do not  possess/make use of
knowledge of the system dynamics to analyze the intercepted information and
(ii) informed or intelligent eavesdroppers that  use knowledge of the
underlying system dynamics to infer the prosumption profiles.

We consider a distributed scheme that has been extensively studied in the
literature, usually referred to as the Primal-Dual scheme, that enables an
optimal power allocation and the satisfaction of system constraints, and
explain why it  causes privacy issues. Inspired by the Primal-Dual scheme, we
propose the Extended Primal-Dual scheme that incorporates a distributed
controller at each privacy-seeking unit of the power grid. The latter replaces
the communication of prosumption profiles with a consensus signal providing
privacy against naive eavesdroppers. However, we explain how intelligent
eavesdroppers may infer the prosumption profiles using the communicated signal
trajectories and knowledge of the underlying system dynamics. To resolve this,
we propose the Privacy-Preserving scheme, which incorporates two important
features into the Extended Primal-Dual scheme, such that privacy against
intelligent eavesdroppers is achieved. In particular, the proposed scheme
continuously alters the speed of response of each controller, making model
based inference inaccurate. Moreover, it adds bounded noise to the prosumption
information within each controller, with a maximum magnitude proportional to
the local frequency deviation. The latter yields changes in all controllers
when a disturbance occurs, making it hard to detect the origin of the
disturbance. These properties ensure that the Privacy-Preserving scheme
guarantees the privacy of the prosumption units against intelligent
eavesdroppers.  On the other hand, due to its additional features, the
Privacy-Preserving scheme could potentially result in slower convergence,
since the controllers response speed is reduced. For both proposed schemes, we
provide analytic stability guarantees and show that an optimal power
allocation is achieved at steady state. In addition, the proposed schemes are
distributed and applicable to arbitrary network topologies,  while the
proposed conditions are locally verifiable.

Our analytic results are  illustrated with numerical simulations on the NPCC
140-bus system which validate that the proposed schemes enable an optimal
power allocation and satisfy the secondary frequency regulation objectives. In
addition, we demonstrate how the Extended Primal-Dual and the Privacy-
Preserving schemes offer privacy of the prosumption profiles against naive and
intelligent eavesdroppers respectively.

To the authors best knowledge, this is the first study that:

  1. (i)

Jointly studies the  privacy, optimality and stability properties of
distributed schemes within the secondary frequency control timeframe.

  2. (ii)

Proposes distributed schemes that yield an optimal power allocation and
simultaneously preserve the privacy of the  prosumption profiles. In
particular, the proposed schemes offer privacy guarantees against naive
(Extended Primal-Dual scheme) and informed (Privacy-Preserving scheme)
eavesdroppers respectively. For the proposed schemes, we show that stability
is guaranteed and that the secondary frequency control objectives are
satisfied.

Paper structure: In Section II we present the dynamics of the power network,
the considered optimization problem and the problem statement. In Sections III
and IV we present the proposed Extended Primal-Dual and Privacy-Preserving
schemes respectively and provide our main analytic results. In Section V we
validate our main results through numerical simulations on the NPCC 140-bus
system. Finally, conclusions are drawn in Section VI. The proofs of all
analytic results are provided in the Appendix.

Notation: Real numbers and the set of n-dimensional vectors with real entries
are denoted by $\mathbb{R}$ and $\mathbb{R}^{n}$ respectively. The $p$-norm of
a vector $x\in\mathbb{R}^{n}$ is given by $\left\lVert
x\right\rVert_{p}=(|x_{1}|^{p}+\dots+|x_{n}|^{p})^{1/p},1\leq p<\infty$. A
function $f:\mathbb{R}^{n}\rightarrow\mathbb{R}^{m}$ is said to be locally
Lipschitz continuous at $x$ if there exists some neighbourhood $X$ of $x$ and
some constant $L$ such that $\left\lVert f(x)-f(y)\right\rVert\leq
L\left\lVert x-y\right\rVert$ for all $y\in X$, where
$\left\lVert.\right\rVert$ denotes any $p$-norm. A matrix
$A\in\mathbb{R}^{n\times n}$ is called diagonal if $A_{ij}=0$ for all $i\neq
j$. In addition, $A\preceq 0$ indicates that the matrix $A$ is negative semi-
definite. The image of a vector $x$ is denoted by $\operatorname{Im}(x)$. The
cardinality of a discrete set $\mathcal{S}$ is denoted by $|\mathcal{S}|$.  A
set $\mathcal{B}$ is a proper subset of a set $\mathcal{A}$ if
$\mathcal{B}\subset\mathcal{A}$ and $\mathcal{B}\neq\mathcal{A}$. For a graph
with sets of nodes and edges denoted by $\mathcal{A}$ and $\mathcal{B}$
respectively, we define the incidence matrix
$H\in\mathbb{R}^{|{\mathcal{A}}|\times|{\mathcal{B}}|}$ as follows

$\displaystyle H_{ij}=\begin{cases}+1,\text{ if }i\text{ is the positive end
of edge }j\in\mathcal{B},\\\ -1,\text{ if }i\text{ is the negative end of edge
}j\in\mathcal{B},\\\ 0,\text{ otherwise.}\end{cases}$

We use $\boldsymbol{0}_{n}$, $\boldsymbol{1}_{n}$ and $\mathds{1}_{n,m}$ to
denote the $n$-dimensional vectors with all elements equal to $0$, all
elements equal to $1$ and element $m$ equal to $1$ and all remaining elements
equal to $0$ respectively. Finally, for a state $x\in\mathbb{R}^{n}$, we let
$x^{*}$ denote its equilibrium value.

##  II Problem Formulation

###  II-A Power network model

We describe the power network by a connected graph ${\mathcal{(N,E)}}$ where
${\mathcal{N}}=\\{1,2,..,|{\mathcal{N}}|\\}$ is the set of buses and
${\mathcal{E}}\subseteq{\mathcal{N}}\times{\mathcal{N}}$ the set of
transmission lines connecting the buses. The term $(i,j)$ denotes the link
connecting buses $i$ and $j$. The graph ${\mathcal{(N,E)}}$ is assumed to be
directed with an arbitrary direction, so that if $(i,j)\in{{\mathcal{E}}}$
then $(j,i)\notin{{\mathcal{E}}}$. For each $j\in\mathcal{N}$, we define the
sets of predecessor and successor buses by
$\mathcal{N}^{p}_{j}=\\{k:(k,j)\in\mathcal{E}\\}$ and
$\mathcal{N}^{s}_{j}=\\{k:(j,k)\in\mathcal{E}\\}$ respectively. It should be
noted that the form of the considered dynamics is unaffected by changes in the
graph ordering and the results presented in this paper are independent of the
choice of direction. The following assumptions are made for the network:
1) Bus voltage magnitudes are $|V_{j}|=1$ per unit for all $j\in\mathcal{N}$.
2) Lines $(i,j)\in\mathcal{E}$ are lossless and characterized by the
magnitudes of their susceptances $B_{ij}=B_{ji}>0$.
3) Reactive power flows do not affect bus voltage phase angles and
frequencies.
4) The relative phase angles are sufficiently small such that the
approximation $\sin\eta_{ij}=\eta_{ij}$ is valid.
The first three assumptions have been frequently used in the literature in
frequency regulation studies [7, 8, 12, 33]. They are valid in medium to high
voltage transmission systems since transmission lines are dominantly inductive
and voltage variations are small. In addition, they are valid in distribution
networks with tight voltage control. The fourth assumption is valid when the
network operates in nominal conditions, where relative phase angles are
small111It should be noted that the results presented in this paper can be
extended by considering sinusoidal phase angles, see e.g. the approach in [7].
We have opted not to consider this case for simplicity and to keep the main
focus of the paper on the privacy aspects of the proposed schemes.. It should
be noted that the theoretical results presented in this paper are validated
with numerical simulations in Section V, on a comprehensive power network
model.

We use the swing equations to describe the rate of change of frequency at
buses [34]. In particular, at each bus we consider a set of generation and
controllable and uncontrollable demand units. This motivates the following
system dynamics:

$\displaystyle\dot{\eta}_{ij}$
$\displaystyle=\omega_{i}-\omega_{j},(i,j)\in{\mathcal{E}},$ (1a)
$\displaystyle\begin{split}M_{j}\dot{\omega}_{j}&=\sum_{k\in\mathcal{N}^{G}_{j}}p^{M}_{k,j}-\sum_{k\in\mathcal{N}^{L}_{j}}d^{c}_{k,j}-\sum_{k\in\mathcal{N}_{j}}p^{L}_{k,j}-D_{j}\omega_{j}\\\
&-\sum_{i\in\mathcal{N}^{s}_{j}}p_{ji}+\sum_{i\in\mathcal{N}^{p}_{j}}p_{ij},j\in{\mathcal{N}},\end{split}$
(1b) $\displaystyle p_{ij}$
$\displaystyle=B_{ij}\eta_{ij},(i,j)\in{\mathcal{E}}.$ (1c)

In system (1), variable $\omega_{j}$ represents the deviation of the frequency
at bus $j$ from its nominal value, namely 50 Hz (or 60 Hz). Variable
$p^{M}_{k,j}$ represents the mechanical power injection associated with the
$k$th generation unit at bus $j$. Moreover, $d^{c}_{k,j}$ denotes the demand
associated with the $k$th controllable load at bus $j$. $\mathcal{N}^{G}_{j}$
and $\mathcal{N}^{L}_{j}$ represent the sets of generation units and
controllable loads, which are jointly referred to as active elements or active
units, at bus $j$ respectively. Each of these units are associated with a
privacy-seeking user or entity. The set of active units at bus $j$ is given by
$\mathcal{N}_{j}=\mathcal{N}^{G}_{j}\cup\mathcal{N}^{L}_{j}$. The variable
$p^{L}_{k,j}$ represents the uncontrollable demand associated with the $k$th
active unit at bus $j$. Furthermore, the time-dependent variables $\eta_{ij}$
and $p_{ij}$ represent, respectively, the power angle difference and the power
transmitted from bus ${i}$ to bus ${j}$. The quantities $B_{ij}$ represent the
line susceptances between buses $i$ and $j$. Finally, the positive constants
$D_{j}$ and $M_{j}$ represent the generation damping and inertia at bus $j$
respectively. The generation and consumption will be jointly referred to as
prosumption.

###### Remark 1

An alternative, but equivalent, representation of (1) could include a single
variable at each bus representing the aggregation of uncontrollable demand. We
opted to associate uncontrollable loads with active units to facilitate the
study of their privacy properties. The benefits of this representation are
evident in Sections III and IV. Note that when no uncontrollable load is
associated with some generation or controllable demand unit, then
$p^{L}_{k,j}=0$.  In addition, note that the results presented in this paper
can be extended to the case where uncontrollable loads are not associated with
prosumption units.

###  II-B Generation and controllable demand dynamics

We will study the behavior of the power system under the following dynamics
for generation and controllable loads,

$\displaystyle\tau_{k,j}\dot{x}_{k,j}$
$\displaystyle=-x_{k,j}+m_{k,j}(u_{k,j}-\omega_{j}),k\in\mathcal{N}^{G}_{j},j\in{\mathcal{N}},$
(2a) $\displaystyle p^{M}_{k,j}$
$\displaystyle=x_{k,j}+h_{k,j}(u_{k,j}-\omega_{j}),k\in\mathcal{N}^{G}_{j},j\in{\mathcal{N}},$
(2b) $\displaystyle d^{c}_{k,j}$
$\displaystyle=-h_{k,j}(u_{k,j}-\omega_{j}),k\in\mathcal{N}^{L}_{j},j\in{\mathcal{N}},$
(2c)

where $x_{k,j}\in\mathbb{R}$ represents the internal state, and $\tau_{k,j}>0$
and $m_{k,j}>0$ the time and droop constants associated with generation unit
$k$ at bus $j$ respectively. The positive constant $h_{k,j}$ represents the
damping associated with active unit $k$ (generation or controllable load) at
bus $j$. In addition, $u_{k,j}$ represents the control input to the $k$th
active unit at bus $j$, the dynamics of which are discussed in the following
sections.

We consider first-order generation dynamics and static controllable demand for
simplicity and to keep the focus of the paper on developing a privacy-
preserving scheme. More involved generation and demand dynamics could be
considered by applying existing results (e.g. [7], [10], [18]).

For convenience, we define the vectors
$p^{M}_{j}=[p^{M}_{k,j}]_{k\in\mathcal{N}^{G}_{j}}$,
$d^{c}_{j}=[d^{c}_{k,j}]_{k\in\mathcal{N}^{L}_{j}}$,
$p^{L}_{j}=[p^{L}_{k,j}]_{k\in\mathcal{N}_{j}}$,
$p^{M}=[p^{M}_{j}]_{j\in\mathcal{N}}$, $d^{c}=[d^{c}_{j}]_{j\in\mathcal{N}}$
and $p^{L}=[p^{L}_{j}]_{j\in\mathcal{N}}$.

###  II-C Prosumption cost minimization problem

In this section we form an optimization problem that aims to minimize the
costs associated with generation and controllable demand and simultaneously
achieve generation-demand balance. The considered optimization problem is
described below.

A cost $\frac{1}{2}q_{k,j}(p^{M}_{k,j})^{2}$ is incurred when the generation
unit $k$ at bus $j$ produces a power output of $p^{M}_{k,j}$. In addition, a
cost $\frac{1}{2}q_{k,j}(d^{c}_{k,j})^{2}$ is incurred when controllable load
$k$ at bus $j$ adjusts its demand to $d^{c}_{k,j}$. The optimization problem
is to obtain the vectors $p^{M}$ and $d^{c}$ that minimize the cost associated
with the aggregate generation and controllable demand and simultaneously
achieve power balance. The considered optimization problem is presented below.

$\displaystyle\min_{p^{M},d^{c}}$
$\displaystyle\sum_{j\in\mathcal{N}}(\sum_{k\in\mathcal{N}^{G}_{j}}\frac{1}{2}q_{k,j}(p^{M}_{k,j})^{2}+\sum_{k\in\mathcal{N}^{L}_{j}}\frac{1}{2}q_{k,j}(d^{c}_{k,j})^{2})$
(3) subject to
$\displaystyle\sum_{j\in\mathcal{N}}(\sum_{k\in\mathcal{N}^{G}_{j}}p^{M}_{k,j}-\sum_{k\in\mathcal{N}^{L}_{j}}d^{c}_{k,j}-\sum_{k\in\mathcal{N}_{j}}p^{L}_{k,j})=0.$

The equality constraint in (3) requires all the uncontrollable loads to be
matched by the generation and controllable demand, such that generation-demand
balance is achieved. The equality constraint also guarantees that the
frequency attains its nominal value at equilibrium, which is a main objective
of secondary frequency control. The latter follows by summing (1b) at steady
state over all buses, which yields $\sum_{j\in\mathcal{N}}D_{j}\omega_{j}=0$,
and noting that frequency synchronizes at equilibrium from (1a).

###  II-D Eavesdropper and privacy definitions

In this section, we define the two considered eavesdropper types, inspired
from [35], and present two notions of privacy to facilitate the interpretation
and intuition of our results.

###### Definition 1

An eavesdropper is a person or entity that aims to extract private information
by intercepting the signals communicated to and from generation and
controllable demand units. Eavesdroppers are classified as follows:

  1. (i)

Naive eavesdroppers, who  posses knowledge of:
(K1) All signals communicated to and from a given unit, for which it aims to
obtain private information.

  2. (ii)

Informed or intelligent eavesdroppers, who posses knowledge of K1 and:
(K2) The underlying control dynamics of the system.

Definition 1 presents two types of eavesdroppers, based on  whether they make
use of knowledge of the underlying system dynamics to infer private
information. In particular, naive eavesdroppers  have no knowledge of the
system model that may allow them to analyze the intercepted signals. They only
try to overhear sensitive information. Informed eavesdroppers  analyze the
intercepted signals using knowledge of the underlying dynamics. It is
intuitive to note that privacy against intelligent eavesdroppers implies
privacy against naive eavesdroppers but not vice versa.

Below we provide a definition of a private prosumption trajectory and profile,
used throughout the rest of the manuscript. We remind that $s^{*}$ denotes the
equilibrium value of $s$, i.e. $s^{*}=\lim_{t\rightarrow\infty}s(t)$.

###### Definition 2

The following two notions of prosumption privacy are considered:
(i) A prosumption trajectory is called private against an eavesdropper type if
the knowledge available to the eavesdropper does not allow the estimation of
$s(t),t\geq 0,s\neq s^{*}$.
(ii) A prosumption profile is called private against an eavesdropper type if
the knowledge available to the eavesdropper does not allow the estimation of
its trajectory and steady state values, i.e. of $s(t),t\geq 0$.

The considered privacy definition implies that a prosumption trajectory is
private when an eavesdropper cannot accurately estimate its initial condition
and values when not at steady state. The privacy of a prosumption profile
requires in addition the privacy of its steady state value. The distinction
between the two notions allows privacy guarantees based on different
conditions (see Section IV-B).

###  II-E Problem Statement

This paper aims to design control schemes that enable stability and optimality
guarantees and at the same time preserve the privacy of all active units. The
problem is stated below.

###### Problem 1

Design a control scheme that:

  1. (i)

Preserves the privacy  of the prosumption profiles against intelligent
eavesdroppers.

  2. (ii)

Enables asymptotic stability guarantees.

  3. (iii)

Uses local information and locally verifiable conditions.

  4. (iv)

Yields an optimal steady-state power allocation.

  5. (v)

Applies to arbitrary connected network configurations.

Problem 1 aims to design a control scheme that enables stability guarantees,
ensures an optimal power allocation at steady state, and guarantees the
privacy of the generation/demand profiles against informed eavesdroppers,
following Definitions 1 and 2. In addition, we aim to design a scheme that
relies on locally available information and locally verifiable conditions, to
enable scalable designs. Finally, it is desired that the proposed scheme is
applicable to general network topologies.

##  III Extended Primal-dual scheme

In this section we consider the problem of determining the generation/demand
inputs with aim to steer the system trajectories to a global minimum of the
prosumption cost minimization problem (3). We first examine a distributed
scheme that has been widely studied in the literature [7], [12], [15], [17],
usually referred to as the Primal-Dual scheme, that enables an optimal power
allocation, and discuss its resulting privacy issues. To resolve these issues,
we propose the Extended Primal-Dual scheme, which enables privacy of the
prosumption profiles against naive eavesdroppers.

###  III-A Primal-Dual scheme

To describe the Primal-Dual scheme, we consider a connected communication
graph ($\mathcal{N},\hat{\mathcal{E}}$), where $\hat{\mathcal{E}}$ represents
the set of communication lines among the buses, i.e.
$(i,j)\in\widetilde{\mathcal{E}}$ if buses $i$ and $j$ communicate. In
addition, we let $\hat{H}$ be the incidence matrix of
($\mathcal{N},\hat{\mathcal{E}}$) and define the variable
$\zeta_{j}=\boldsymbol{1}^{T}_{|\mathcal{N}_{j}|}p^{L}_{j}+\boldsymbol{1}^{T}_{|\mathcal{N}^{L}_{j}|}d^{c}_{j}-\boldsymbol{1}^{T}_{|\mathcal{N}^{G}_{j}|}p^{M}_{j}$
for all $j\in\mathcal{N}$. The prosumption input dynamics are given by

$\displaystyle\hat{\Gamma}\dot{\psi}$ $\displaystyle=\hat{H}^{T}p^{c},$ (4a)
$\displaystyle\bar{\Gamma}\dot{p}^{c}$ $\displaystyle=\zeta-\hat{H}\psi,$ (4b)
$\displaystyle u_{k,j}$
$\displaystyle=p^{c}_{j},k\in\mathcal{N}_{j},j\in{\mathcal{N}},$ (4c)

where the diagonal matrices
$\hat{\Gamma}\in\mathbb{R}^{|\hat{\mathcal{E}}|\times|{\hat{\mathcal{E}}|}}$
and $\bar{\Gamma}\in\mathbb{R}^{|{\mathcal{N}}|\times|{\mathcal{N}}|}$ contain
the positive time constants associated with (4a) and (4b) respectively and
$p^{c}_{j}$ is a power command variable associated with bus $j$ and shared
with communicating buses. In addition, variable $\psi$ is a state of the
Primal-Dual scheme that integrates the difference in power command variables
between communicating buses. The input for all active elements at bus $j$ is
given by the local power command value $p^{c}_{j}$, via (4c).

The dynamics in (4a) enable the synchronization of the power command variables
at steady state. This property is useful to provide an optimality
interpretation of the system’s equilibria. In addition, (4b) ensures that the
secondary frequency control objectives, i.e. ensuring generation/demand
balance and the frequency attaining its nominal value, are satisfied at steady
state. The latter follows by summing (1b) and (4b) at steady state over all
$j\in\mathcal{N}$, which yields $\sum_{j\in\mathcal{N}}D_{j}\omega^{*}_{j}=0$,
which in turn implies that $\omega^{*}=\boldsymbol{0}_{|\mathcal{N}|}$ from
the synchronization of frequency at equilibrium, as follows from (1a). It
should be noted that the stability and optimality of the Primal-Dual scheme
(4) for a wide class of generation/demand dynamics, including those in (2),
have been analytically shown in the literature (e.g. [7]).

###### Remark 2

A shortcoming of the Primal-Dual scheme (4) is the requirement for real-time
knowledge of the generation and demand from all active units in the network.
In practice, this would require the transmission of this information to a
central controller at each bus, in order to calculate $\zeta_{j}$, exposing
the local generation/demand profiles to a naive eavesdropper who intercepts
these signals. The latter compromises the privacy of the prosumption profiles.

###  III-B Extended Primal-Dual scheme

Figure 1: Schematic representation of system (1), (2), (5), (6) on a simple
3-bus network. Privacy-seeking users are associated with prosumption units.
Blue lines represent power transfers whereas red lines represent information
flows.  Users monitor the local frequency and communicate their respective
power command values to neighbouring users. Both naive and intelligent
eavesdroppers intercept the communicated signals between users, but only
intelligent eavesdroppers  possess knowledge of the underlying dynamics, that
may be used to analyze the intercepted information.

In this section we present a scheme that aims to improve the privacy
properties of the generation/demand profiles. In contrast to (4), which
includes a controller at each bus, the  proposed scheme employs a controller
at each privacy-seeking unit (generator or controllable load). We demonstrate
that the presented scheme offers privacy against naive eavesdroppers and
simultaneously enables an optimal power allocation.

To describe the new scheme, we consider a communication network characterized
by a connected graph ($\widetilde{\mathcal{N}},\widetilde{\mathcal{E}}$),
where $\widetilde{\mathcal{N}}=\cup_{j\in\mathcal{N}}\mathcal{N}_{j}$
represents the set of active units within the power network and
$\widetilde{\mathcal{E}}\subseteq\widetilde{\mathcal{N}}\times\widetilde{\mathcal{N}}$
the set of connections. Moreover, we let
$H\in\mathbb{R}^{|\widetilde{\mathcal{N}}|\times|\widetilde{\mathcal{E}}|}$ be
the incidence matrix of ($\widetilde{\mathcal{N}},\widetilde{\mathcal{E}}$).
In addition, the following variables are defined for compactness in
presentation,

$\displaystyle s_{j}^{T}$
$\displaystyle=[(-p^{M}_{j})^{T}\;,\;(d^{c}_{j})^{T}],j\in\mathcal{N},$ (5a)
$\displaystyle\widetilde{s}_{j}$
$\displaystyle=s_{j}+p^{L}_{j},j\in\mathcal{N},$ (5b)

where $\widetilde{s}\in\mathbb{R}^{|\widetilde{\mathcal{N}}|}$ is a vector
with all generation and controllable and uncontrollable demand units.

The proposed Extended Primal-Dual scheme, is presented below

$\displaystyle\widetilde{\Gamma}\dot{\psi}$ $\displaystyle=H^{T}p^{c},$ (6a)
$\displaystyle\Gamma\dot{p}^{c}$ $\displaystyle=\widetilde{s}-H\psi,$ (6b)
$\displaystyle u$ $\displaystyle=p^{c},$ (6c)

where
$\widetilde{\Gamma}\in\mathbb{R}^{|\widetilde{\mathcal{E}}|\times|{\widetilde{\mathcal{E}}|}}$
and
$\Gamma\in\mathbb{R}^{|\widetilde{\mathcal{N}}|\times|\widetilde{\mathcal{N}}|}$
are diagonal matrices containing the positive time constants associated with
(6a) and (6b) respectively, and $p^{c}_{k,j}$ corresponds to the power command
variable associated with active unit $k$ at bus $j$, that is also used as the
input to (2) following (6c). A schematic representation of the system (1),
(2), (5), (6) is provided in Fig. 1.

###### Remark 3

The proposed Extended Primal-dual scheme assumes communication among
prosumption units by considering the connected graph
($\widetilde{\mathcal{N}},\widetilde{\mathcal{E}}$). Note that when the
communication of prosumption is considered for the Primal-Dual scheme, then
its communication topology (i.e. a meshed network at bus level with a star
structure within each bus to allow communication from prosumption units
towards the bus controller) is a special case to that of the Extended Primal-
dual scheme. It should also be noted that, apart from connectivity, no
assumption is made on the topology of the communication network. The latter
allows practical considerations to be considered in the design of the
communication network (e.g. communication among buses could be at bus level
only).

Following the Extended Primal-Dual scheme, privacy-seeking users share power
command signals instead of their generation and demand values. Hence, the
prosumption profiles are not communicated towards local controllers. The
latter suffices to ensure privacy against naive eavesdroppers,  since
inferring the prosumption profiles from the power command variables would
require knowledge of the underlying dynamics. The privacy of prosumption
profiles against naive eavesdroppers under the Extended Primal-Dual scheme is
demonstrated in the following proposition, proven in the Appendix.

###### Proposition 1

Consider any supply unit $k,j$ implementing the Extended Primal-Dual scheme
(6). Then, its prosumption profile $\widetilde{s}_{k,j}$ is private against
eavesdroppers with knowledge of K1.

###  III-C Equilibrium Analysis

We now provide a definition of an equilibrium point to the interconnected
dynamical system (1), (2), (5), (6).

###### Definition 3

The point $\alpha^{*}$ = $(\eta^{*},\psi^{*},\omega^{*},x^{*},p^{c,*})$
defines an equilibrium of the system (1), (2), (5), (6) if all time
derivatives of (1), (2), (5), (6) are equal to zero at this point.

We will make use of the following equilibrium equations for (1), (2), (5),
(6).

$\displaystyle 0=\omega^{*}_{i}-\omega^{*}_{j},(i,j)\in{\mathcal{E}},$ (7a)
$\displaystyle\begin{split}&0=\boldsymbol{1}^{T}_{|N^{G}_{j}|}p^{M,*}_{j}-\boldsymbol{1}^{T}_{|N^{L}_{j}|}d^{c,*}_{j}-\boldsymbol{1}^{T}_{|N_{j}|}p^{L}_{j}\\\
&\hskip
5.69054pt-\sum_{i\in\mathcal{N}^{s}_{j}}p^{*}_{ji}+\sum_{i\in\mathcal{N}^{p}_{j}}p^{*}_{ij},j\in\mathcal{N}\end{split}$
(7b) $\displaystyle
0=-x^{*}_{k,j}+m_{k,j}(u^{*}_{k,j}-\omega^{*}_{j}),k\in\mathcal{N}^{G}_{j},j\in{\mathcal{N}},$
(7c) $\displaystyle 0=H^{T}p^{c,*},$ (7d) $\displaystyle
0=\widetilde{s}^{*}-H\psi^{*},$ (7e) where the variables
$p^{*},p^{M,*},d^{c,*},u^{*},\widetilde{s}^{*}$ satisfy $\displaystyle
p^{*}_{ij}$ $\displaystyle=B_{ij}\eta^{*}_{ij},(i,j)\in{\mathcal{E}},$ (7f)
$\displaystyle p^{M,*}_{k,j}$
$\displaystyle=x^{*}_{k,j}+h_{k,j}(u^{*}_{k,j}-\omega^{*}_{j}),k\in\mathcal{N}^{G}_{j},j\in{\mathcal{N}},$
(7g) $\displaystyle d^{c,*}_{k,j}$
$\displaystyle=-h_{k,j}(u^{*}_{k,j}-\omega^{*}_{j}),k\in\mathcal{N}^{L}_{j},j\in{\mathcal{N}},$
(7h) $\displaystyle u^{*}_{k,j}$
$\displaystyle=p^{c,*}_{k,j},k\in\mathcal{N}_{j},j\in{\mathcal{N}},$ (7i)
$\displaystyle(s_{j}^{*})^{T}$
$\displaystyle=[(-p^{M,*}_{j})^{T}\;,\;(d^{c,*}_{j})^{T}],j\in\mathcal{N},$
(7j) $\displaystyle\widetilde{s}^{*}$ $\displaystyle=s^{*}+p^{L}.$ (7k)

The following lemma, proven in the Appendix, characterizes the equilibria of
(1), (2), (5), (6).

###### Lemma 1

The equilibria of (1), (2), (5), (6) satisfy
$\omega^{*}=\boldsymbol{0}_{|{\mathcal{N}}|}$ and
$p^{c,*}\in\operatorname{Im}(\boldsymbol{1}_{|\widetilde{\mathcal{N}}|})$.

Lemma 1 demonstrates that the presented scheme ensures that the frequency
attains its nominal value at equilibrium, which is a main objective of
secondary frequency control. In addition, it shows that power command
variables share the same value at steady state. The latter can be used to
enable an optimal power allocation, as demonstrated in the following section.

###  III-D Optimality and Stability Analysis

The following proposition, proven in the Appendix, provides necessary and
sufficient conditions that ensure that the equilibrium values of $p^{M}$ and
$d^{c}$ are global solutions to the optimization problem (3).

###### Proposition 2

Let $q_{k,j}(m_{k,j}+h_{k,j})=1,k\in\mathcal{N}^{G}_{j},j\in\mathcal{N}$ and
$q_{k,j}h_{k,j}=1,k\in\mathcal{N}^{L}_{j},j\in\mathcal{N}$. Then, the
equilibrium values $p^{M,*}$ and $d^{c,*}$ of system (1), (2), (5), (6)
globally minimize  the optimization problem (3).

Proposition 2 follows directly from the KKT conditions [36]. It demonstrates
how the controller gains in generation and controllable load units should be
designed such that an optimal power allocation is ensured. Hence, we deduce
that the Extended Primal-Dual scheme (6) enables an optimal power allocation.

The following theorem, proven in the Appendix, provides global asymptotic
stability guarantees for (1), (2), (5), (6).

###### Theorem 1

Solutions to (1), (2), (5), (6) globally asymptotically converge to the set of
its equilibria, where $\omega^{*}=\boldsymbol{0}_{\mathcal{|N|}}$.

Theorem 1 guarantees the convergence of solutions to (1), (2), (5), (6) to the
set of its equilibria. In addition, the Extended Primal-Dual scheme is
locally verifiable and applicable to arbitrary network configurations.
Furthermore, the presented scheme guarantees the privacy of the prosumption
profiles against naive eavesdroppers. Noting also that Proposition 2
demonstrates how optimality may be achieved at steady state, it follows that
the Extended Primal-Dual scheme satisfies all objectives of Problem 1, except
from ensuring privacy against intelligent eavesdroppers.

###  III-E Discussion

The scheme presented in this section extends the Primal-Dual scheme (4) by
including a controller at each unit contributing to secondary frequency
control. The Extended Primal-Dual scheme results in the transmission of power
command signals instead of prosumption signals, which enables privacy against
naive eavesdroppers,  as demonstrated by Proposition 1.  On the other hand,
the interaction between an increased number of controllers may result in
slower convergence. The proposed scheme yields an optimal power allocation,
ensures that frequency attains its nominal value at steady state and
guarantees the global stability of the power network as follow from
Proposition 2, Lemma 1 and Theorem 1 respectively. However, the Extended
Primal-Dual scheme (6) does not ensure the privacy of generation and demand
profiles against intelligent eavesdroppers. In particular, an intelligent
eavesdropper may use the communicated power command trajectories and knowledge
of the underlying power command dynamics to infer the prosumption profiles
using (6b), e.g. by $\widetilde{s}=\Gamma\dot{p}^{c}+H\psi$. In the next
section, we present  a scheme that aims to resolve this issue.

##  IV Privacy-Preserving scheme

In this section we present  a scheme that aims to preserve the beneficial
properties of the Extended Primal-Dual scheme described in the previous
section and simultaneously  guarantee the privacy of the generation/demand
profiles against intelligent eavesdroppers.

###  IV-A Privacy-Preserving scheme

The proposed scheme, which shall be referred  to as the Privacy-Preserving
scheme, incorporates a privacy-enhancing signal $n$ in the power command
dynamics, as follows

$\displaystyle\widetilde{\Gamma}\dot{\psi}$ $\displaystyle=H^{T}p^{c},$ (8a)
$\displaystyle\Gamma\dot{p}^{c}$ $\displaystyle=\widetilde{s}-H\psi+n,$ (8b)
$\displaystyle u$ $\displaystyle=p^{c}.$ (8c)

In (8) above, the locally Lipschitz, privacy-enhancing signal
$n=[n_{i}]_{i\in{\mathcal{N}}}$, where
$n_{i}=[n_{k,i}]_{{k\in{\mathcal{N}_{i}}}}$, adapts the derivative of the
power command variables to enable enhanced privacy properties.

The design of the signal $n$ is crucial in providing enhanced privacy
properties and simultaneously enabling stability and optimality guarantees for
the Privacy-Preserving scheme (8). Some desired properties of the privacy-
enhancing signal $n$ are: (i) to permit the existence of equilibria, by taking
a constant value when the states of the system are at equilibrium, and (ii) to
allow an optimality interpretation of the resulting equilibria. Both
objectives can be achieved if $n$ is zero at steady state since in this case
the equilibria of (1), (2), (5), (8), and (1), (2), (5), (6) are identical.

The following design condition is imposed on the privacy-enhancing signal $n$.
As demonstrated below, this condition ensures the privacy of the prosumption
profiles against intelligent eavesdroppers and allows stability and optimality
to be deduced.  It should be noted that the trajectories of $n$ are in general
non-unique.

###### Design Condition 1

The privacy-enhancing signals satisfy
$n_{k,j}=n^{d}_{k,j}+n^{f}_{k,j},k\in\mathcal{N}_{j},j\in\mathcal{N}$, where:

  1. (i)

$n^{d}_{k,j}(t)=-\xi_{k,j}(t)\dot{p}^{c}_{k,j}(t)$, where the non-negative
signal $\xi_{k,j}(t)$ satisfies $\dot{\xi}_{k,j}(t)<\hat{\beta}_{k,j}$ for all
$t\geq 0$,

  2. (ii)

$|n^{f}_{k,j}(t)|<\beta_{k,j}|\omega_{j}(t)|$, for all $t\geq 0$.

Moreover, the positive design constants $\beta_{k,j},\hat{\beta}_{k,j}$
satisfy
$\begin{bmatrix}-h_{k,j}-D_{j}/|\mathcal{N}_{j}|&h_{k,j}+\beta_{k,j}/2\\\
h_{k,j}+\beta_{k,j}/2&-h_{k,j}+\hat{\beta}_{k,j}/2\end{bmatrix}\preceq
0,k\in\mathcal{N}_{j},j\in\mathcal{N}$.

Design Condition 1 splits the privacy-enhancing signal $n$ to two other
signals, $n^{d}$ and $n^{f}$, that serve different purposes. The signal
$n^{d}_{k,j}$ is proportional to the power command derivative
$\dot{p}^{c}_{k,j}$ with  a non-negative, time-varying gain $\xi_{k,j}$
designed such that $\dot{\xi}_{k,j}(t)<\hat{\beta}_{k,j}$ is satisfied at all
times. The latter adjusts the rate at which the power command variables
respond to external signals and makes any prior estimates of the power command
model inaccurate. Hence, a potential eavesdropper utilizing model-based
observations will produce inaccurate results. The component $n^{f}$ introduces
a noise signal222It should be noted that $n^{f}$ (and similarly $\xi$) are
treated as time-dependent variables rather than random variables, following
the assumption that $n$ is locally Lipschitz. The latter is made for
simplicity and to avoid a diversion of the paper focus from the privacy
properties of the proposed schemes. that is mixed with the generation/demand
values. The latter offers improved privacy properties since: (i) the
generation/demand profile information in the controller is distorted, and (ii)
it perturbs the communicated signals of all controllers when a disturbance
occurs, making it harder to detect the origin of the disturbance from a change
in the transmitted signal. Design Condition 1(ii) restricts the magnitude of
$n^{f}$ in relation with the magnitude of the local frequency. The  values of
$\beta_{k,j},\hat{\beta}_{k,j}$ are selected to satisfy the linear matrix
inequality (LMI) in Design Condition 1 such that convergence is guaranteed, as
demonstrated in Theorem 2 later on. These properties enable the privacy of
prosumpion against intelligent eavesdroppers since the same power command
trajectories result from a (wide) class of prosumption profiles due to
different potential trajectories of the privacy-enhancing signal $n$.  The
latter is analytically demonstrated in Section IV-B below. In addition, note
that since all communicated power command signals synchronize at steady state,
their equilibrium values do not convey any information about local
generation/demand.

###### Remark 4

The bounds $\beta_{k,j}$ and $\hat{\beta}_{k,j}$ associated with $n^{f}_{k,j}$
and $n^{d}_{k,j}$ respectively are interdependent through the LMI in Design
Condition 1. Hence, there is a trade-off between the maximum allowed
derivative of the gain $\xi_{k,j}$ and the maximum magnitude ratio between the
signal $n^{f}_{k,j}$ and the local frequency $\omega_{j}$. The latter can be
used for design purposes by placing different weights on the the associated
bounds, and hence the effect, of signals $n^{f}_{k,j}$ and $n^{d}_{k,j}$.

###  IV-B Privacy analysis

In this section, we present our main privacy results regarding the proposed
Privacy-Preserving scheme. First, we clarify that for an intelligent
eavesdropper, K1 implies knowledge of all power command signals communicated
to and from a considered unit. In addition, K2 implies knowledge of the
_Privacy-Preserving scheme_ dynamics (8).

The following proposition, proven in the Appendix, demonstrates that the
proposed scheme preserves the privacy of the prosumption profiles against
intelligent eavesdroppers.

###### Proposition 3

Consider any supply unit $k,j$ implementing the Privacy-Preserving scheme (8).
Then, its prosumption profile $\widetilde{s}_{k,j}$ is private against
intelligent eavesdroppers with knowledge of K1 and K2.

Proposition 3 provides privacy guarantees for the prosumption profiles when
the Privacy-Preserving scheme is implemented. The latter demonstrates that the
proposed scheme satisfies objective (i) within Problem 1.

A reasonable case to be considered is when intelligent eavesdroppers gain
knowledge of the steady-state value of the privacy-preserving signal $n$, i.e.
have the following knowledge:
(K3) The steady state value of the privacy-preserving signal $n$, i.e. that
$\lim_{t\rightarrow\infty}n(t)=\boldsymbol{0}_{|\widetilde{\mathcal{N}}|}$.

The following proposition, proven in the Appendix, shows that the prosumption
trajectories are private against eavesdroppers with knowledge of K1, K2 and
K3. We remind that the definition of a private trajectory is provided in
Definition 2(i).

###### Proposition 4

Consider any supply unit $k,j$ implementing the Privacy-Preserving scheme (8).
Then, its prosumption trajectory is private against intelligent eavesdroppers
with knowledge of K1, K2 and K3.

Note that Proposition 4 does not guarantee the privacy of the prosumption at
steady state, since knowledge of the variable $\psi$ may yield the equilibrium
values of $\widetilde{s}$ from (7e). However, since $\psi$ results from
integrating the differences between communicated power command variables, any
inaccuracy on determining these variables will lead to growing deviations
between the estimated and true values of $\psi$, compromising the reliability
of such estimate.

Stronger privacy guarantees may be obtained, such that the prosumption
profiles are kept private when eavesdroppers have knowledge of K3, by relaxing
K1. In particular, we consider the case where an eavesdropper does not have
full knowledge of the information communicated to a considered unit, i.e. has
knowledge of:
(K4) A proper subset of the power command signals communicated to and from a
given unit, for which it aims to obtain private information.

The following proposition, proven in the Appendix, guarantees the privacy of
prosumption profiles when intelligent eavesdroppers have knowledge of K2, K3
and K4.

###### Proposition 5

Consider any supply unit $k,j$ implementing the Privacy-Preserving scheme (8).
Then, its prosumption profile $\widetilde{s}_{k,j}$ is private against
intelligent eavesdroppers with knowledge of K2, K3 and K4.

Proposition 5 enables privacy guarantees of the prosumption profile, when
knowledge of the steady state value of $n$ is available. However, it assumes
that the intelligent eavesdropper does not possess full knowledge of the
information communicated to and from the considered privacy-seeking unit. Note
that the latter case might describe eavesdroppers associated with some
prosumption unit that communicates with the considered privacy-seeking unit,
under specific conditions on the communication network topology such that K4
is satisfied.

###### Remark 5

The presented privacy results hold when either of $n^{f}$ or $n^{d}$ is
neglected in $n$. However, their combined impact keeps additional information
associated with the prosumption profiles private. In particular, the presence
of $n^{f}$ results in a change on all controllers after a power disturbance,
making it difficult to infer its origin from the power command signals. In
addition, $n^{d}$ makes model based inference inaccurate, and hence difficult
to have a reasonable range estimate of the prosumption magnitude, i.e. obtain
an estimate with a margin of error analogous to the magnitude of
$n^{f}_{k,j}$.

###  IV-C Optimality and Stability Analysis

In this section we provide analytic optimality and stability guarantees for
system (1), (2), (5), (8).

The following proposition, proven in the Appendix, extends Proposition 2 by
demonstrating that Design Condition 1 enables an optimal steady state power
allocation.

###### Proposition 6

Let Design Condition 1,
$q_{k,j}(m_{k,j}+h_{k,j})=1,k\in\mathcal{N}^{G}_{j},j\in\mathcal{N}$ and
$q_{k,j}h_{k,j}=1,k\in\mathcal{N}^{L}_{j},j\in\mathcal{N}$ hold. Then, the
equilibrium values $p^{M,*}$ and $d^{c,*}$ of system (1), (2), (5), (8),
globally minimize the optimization problem (3).

Proposition 6 demonstrates that when Design Condition 1, and the gain
conditions provided in Proposition 2 hold, then the Privacy-Preserving scheme
yields an optimal power allocation. The latter follows trivially from
Proposition 2, since the privacy-enhancing signal $n_{k,j}$ is zero at steady
state from Design Condition 1, which results in identical equilibrium points
for (1), (2), (5), (8) and (1), (2), (5), (6).

The following theorem, proven in the Appendix, demonstrates that when Design
Condition 1 holds, then the set of equilibria of (1), (2), (5), (8), is
attracting. The latter shows that the proposed Privacy-Preserving scheme does
not compromise the stability of the power network.

###### Theorem 2

Let Design Condition 1 hold. Then, the solutions of (1), (2), (5), (8),
globally asymptotically converge to the set of its equilibria, where
$\omega^{*}=\boldsymbol{0}_{\mathcal{|N|}}$.

Theorem 2 guarantees the convergence of solutions to (1), (2), (5), (8), to
the set of its equilibria. In addition, the dynamics of (1), (2), (5), (8),
are distributed, applicable to arbitrary network configurations and locally
verifiable. Moreover,  as demonstrated in Section IV-B, the Privacy-Preserving
scheme enables the privacy of prosumption profiles against informed
eavesdroppers. Finally, as demonstrated in Proposition 6, the presented scheme
allows an optimal power allocation among generation and controllable demand.
Hence, all objectives of Problem 1 are satisfied.

##  V Simulation on the NPCC 140-bus system

In this section, we  illustrate our analytic results with simulations using
the Power system toolbox [37] on Matlab. For our simulations, we use the
Northeast Power Coordinating Council (NPCC) 140-bus interconnection system.
This model is more detailed and realistic than the considered analytical
model, including voltage dynamics, line resistances, and a transient reactance
generator model333 The details of the simulation model can be found in the
Power System Toolbox data file datanp48..

The test system consists of 93 load buses and 47 generation buses and has a
total real power of 28.55 GW. Controllable demand was considered in $20$ load
buses, where at each bus the number of controllable loads was randomly
selected from an integer uniform distribution with range $[90,180]$. A single
generation unit was added at each of $20$ generation buses. In addition,
quadratic cost functions were considered for generation and controllable
demand following the description in (3). The values for
$q_{k,j},k\in\mathcal{N}_{j},j\in\mathcal{N}$ were selected from a uniform
distribution with range $[50,250]$. For the simulation, a step change in
demand of magnitude $0.2$ per unit (100 MW) at $10$ randomly selected loads at
each of buses $2$ and $3$ was considered at $t=1$ second. The time step for
the simulations,  denoted by $\Delta T$, was set at 10 ms.

Figure 2: Frequency at bus $18$ when the following schemes are implemented:
(i) Integral action scheme, (ii) Primal-Dual scheme, (iii) Extended Primal-
Dual scheme, and (iv) Privacy-Preserving scheme.

Figure 3: Marginal costs for all generation and controllable demand units
contributing to secondary frequency control when the following control schemes
are implemented: (i) Integral action scheme, (ii) Primal-Dual scheme, (iii)
Extended Primal-Dual scheme, and (iv) Privacy-Preserving scheme.

The system was tested  under the four control schemes described below:

  1. (i)

An Integral action scheme, where generation units and controllable loads
integrate the local frequency with the controller gains selected to be
inversely proportional to their respective cost coefficients.

  2. (ii)

The Primal-Dual scheme, described by (4).

  3. (iii)

The Extended Primal-Dual scheme that we proposed, described by (6).

  4. (iv)

The Privacy-Preserving scheme that we proposed, described by (8) and Design
Condition 1.  First suitable values for
$\beta_{k,j},\hat{\beta}_{k,j},k\in\mathcal{N}_{j},j\in\mathcal{N}$ were
selected in accordance with the LMI in Design Condition 1. The values of
$\xi_{k,j}(t)$ were then randomly selected at each time step such that
$(\xi_{k,j}(t)-\xi_{k,j}(t-\Delta T))/\Delta T$ lied in
$[-\hat{\beta}_{k,j},\hat{\beta}_{k,j}]$ following Design Condition 1(i). In
addition, the values of $n^{f}_{k,j}(t)$ were randomly selected at each time
step from the uniform distribution
$[-\beta_{k,j}|\omega_{j}|,\beta_{k,j}|\omega_{j}|]$ such that Design
Condition 1(ii) was satisfied.

In schemes (ii)-(iv), the dynamics of the implemented generation and
controllable demand units followed from (2) and the controller gains were
selected such that the optimality conditions presented in Propositions 2 and 6
were satisfied. The communication network associated with scheme (ii) had the
same structure as the power network. A random connected communication network
was generated when schemes (iii) and (iv) were implemented. For consistency,
the same sets of randomly selected parameters were considered in all
simulations.

Figure 4: Controllable demand (top) and communicated signals (bottom) for
loads $9,18$ and $27$ at bus $2$ for the following control schemes: (left)
Primal-Dual scheme, (middle) Extended Primal-Dual scheme, and (right) Privacy-
Preserving scheme.

The frequency response at a randomly selected bus (bus $18$) is depicted in
Fig. 2. From Fig. 2, it follows that the frequency converges to its nominal
value at all simulated cases. The latter suggests that the proposed Extended
Primal-Dual and Privacy-Preserving schemes yield a stable response. Note also
that the frequency returns to within $0.01$ Hz from its nominal value in less
than two minutes, which is well within the secondary frequency control
timeframe. Nevertheless, the Extended Primal-Dual and Privacy-Preserving
schemes result in slower convergence of frequency to its nominal value.  This
is due to a larger number of controllers  that need to synchronize for
convergence. In addition, the implementation of the Privacy-Preserving scheme,
and particularly Design Condition 1(i), results in slower convergence compared
with the Extended Primal-Dual scheme.

To demonstrate the optimality of the proposed analysis, we consider the
marginal costs of each active unit, defined as the absolute value of the cost
derivative of the local cost functions. The marginal costs for all
controllable loads and local generators are depicted in Fig. 3. From Fig. 3,
it follows that for schemes (ii), (iii) and (iv), the marginal costs for all
units converge to the same value. The latter suggests that an optimal power
allocation is attained at steady state and validates the presented optimality
analysis. By contrast, the marginal costs differ at equilibrium in scheme (i),
which suggests that a suboptimal response is obtained.

To validate the enhanced privacy properties associated with the Extended
Primal-Dual and the Privacy-Preserving schemes, compared with the Primal-Dual
scheme, we considered the communicated signals from three randomly selected
loads (loads $9,18$ and $27$ at bus $2$). The results are shown on Fig. 4,
which demonstrate that when the Primal-Dual scheme is implemented (scheme
(ii)), the privacy of the controllable demand units is compromised  since the
demand values are communicated. By contrast, when the Extended Primal-Dual and
Privacy-Preserving schemes were implemented (schemes (iii) and (iv)
respectively), the privacy of the controllable load profiles against naive
eavesdroppers is preserved.

Figure 5: Inferred demand information on loads $9,18$ and $27$ at bus $2$
using the power command trajectories for the following two control schemes:
(top) Extended Primal-Dual scheme, and (bottom) Privacy-Preserving scheme.

To demonstrate that the Privacy-Preserving scheme ensures the privacy of the
prosumption profiles against intelligent eavesdroppers, we considered an
observer scheme that aims to infer the controllable demand using a model of
the power command dynamics and knowledge of the power command signals. In
particular, by evaluating the power command derivative and the value of
$\psi$, an eavesdropper may attempt to observe the generation and controllable
demand profiles by reversing (6b), i.e. using
$\widetilde{s}=\Gamma\dot{p}^{c}+H\psi$. Figure 5 demonstrates the result from
such observer scheme for the same three loads considered in Fig. 4, when the
Extended Primal-Dual and Privacy-Preserving schemes are implemented. From Fig.
5, it follows that an intelligent eavesdropper may obtain the controllable
demand profiles when the Extended Primal-Dual scheme is applied. By contrast,
the application of the Privacy-Preserving scheme ensures that the demand is
private against intelligent eavesdroppers, since the retrieved information is
distorted by the signal $n_{k,j}$.

##  VI Conclusion

We have considered the problem of enabling an optimal power allocation and
simultaneously preserving the privacy of generation and controllable demand
profiles within the secondary frequency control timeframe. To enhance the
intuition on our results, two types of eavesdroppers were defined; naive
eavesdroppers that  do not possess/make use of knowledge of the internal
system dynamics to analyze the intercepted signals and intelligent
eavesdroppers that use knowledge of the underlying dynamics to infer the
privacy-sensitive prosumption profiles. We proposed the Extended Primal-Dual
scheme, which implements a controller at each privacy-seeking unit in the
power grid to provide improved privacy properties. The proposed scheme enables
privacy guarantees against naive eavesdroppers. However, the generation/demand
profiles may be inferred by intelligent eavesdroppers using the communicated
signal trajectories and information on the underlying dynamics. To resolve
this issue, we proposed the Privacy-Preserving scheme, which shares the
structure of the Extended Primal-Dual scheme but also incorporates a privacy-
enhancing signal at each controller. The latter  continuously adjusts the
response speed of the controllers, making model based observations inaccurate,
and disturbs the generation/demand profile information within the controllers,
enabling privacy against intelligent eavesdroppers. For both proposed schemes,
we provide analytic stability, optimality and privacy guarantees. Our
presented results are distributed, locally verifiable and applicable to
general network configurations. The applicability of the proposed schemes is
demonstrated with simulations on the NPCC 140-bus system where we show that
stability is preserved, and improved privacy properties and an optimal power
allocation are attained.

## Appendix

In this appendix, we prove our main results, Theorems 1 and 2, Lemma 1 and
Propositions 1-6.

_Proof of Proposition 1_: The proof follows from the fact that naive
eavesdroppers do not possess knowledge of (6). In particular, inferring the
trajectory of $\widetilde{s}_{k,j}$, i.e. either by reversing (6b) or by
implementing an observer, requires knowledge of (6). In addition, using the
equilibrium value of $\psi$ to infer the steady state of $\widetilde{s}_{k,j}$
requires knowledge of (6b). Hence, the prosumption profile and steady state of
$\widetilde{s}_{k,j}$ are private. $\blacksquare$

_Proof of Lemma 1_: To show that $\omega^{*}=\boldsymbol{0}_{|\mathcal{N}|}$,
we sum equations (6b) at equilibrium over all $j\in\mathcal{N}$, resulting in
$\sum_{j\in\mathcal{N}}(\sum_{k\in\mathcal{N}^{G}_{j}}p^{M}_{k,j}-\sum_{k\in\mathcal{N}^{L}_{j}}d^{c}_{k,j})=\sum_{j\in\mathcal{N}}\sum_{k\in\mathcal{N}_{j}}p^{L}_{k,j}$.
Then, summing (7b) over all $j\in\mathcal{N}$ results in
$\sum_{j\in\mathcal{N}}D_{j}\omega^{*}_{j}=0$, which suggests that
$\omega^{*}=\boldsymbol{0}_{|\mathcal{N}|}$ from the frequency synchronization
at equilibrium and $D_{j}>0,j\in\mathcal{N}$, as follows from (7a). Moreover,
$p^{c,*}\in\operatorname{Im}(\boldsymbol{1}_{\widetilde{\mathcal{N}}})$
follows directly from (7d). $\blacksquare$

_Proof of Proposition 2_: The optimization problem (3) includes a strictly
convex, continuously differentiable cost function and a linear equality
constraint. Thus, a point $(\overline{p}^{M},\overline{d}^{c})$ is a global
minimum of (3) if and only if it satisfies the KKT conditions [36],

$\displaystyle q_{k,j}\overline{p}^{M}_{k,j}$
$\displaystyle=-\lambda,k\in\mathcal{N}^{G}_{j},j\in\mathcal{N},$ (9a)
$\displaystyle q_{k,j}\overline{d}^{c}_{k,j}$
$\displaystyle=\lambda,k\in\mathcal{N}^{L}_{j},j\in\mathcal{N},$ (9b)
$\displaystyle 0$
$\displaystyle=\sum_{j\in\mathcal{N}}(\sum_{k\in\mathcal{N}^{G}_{j}}\overline{p}^{M}_{k,j}-\sum_{k\in\mathcal{N}^{L}_{j}}\overline{d}^{c}_{k,j}-\sum_{k\in\mathcal{N}_{j}}p^{L}_{k,j}),$
(9c)

for some constant $\lambda$. It will be shown below that, when the conditions
in the proposition statement hold, then (9) is satisfied when
$(\overline{p}^{M},\overline{d}^{c})=(p^{M,*},d^{c,*})$, where the equilibrium
values follow from (7c), (7g) and (7h).

First, note that from (7d) it follows that $p^{c,*}_{k,i}=p^{c,*}_{l,j}$ for
all $k\in\mathcal{N}_{i}$, $l\in\mathcal{N}_{j}$ and all
$i,j\in\widetilde{\mathcal{N}}$ and let their common value be
$\overline{p}^{c,*}$. Then, let $\lambda=-\overline{p}^{c,*}$. In addition,
note that at equilibrium $\omega^{*}=\boldsymbol{0}_{|\mathcal{N}|}$ from
Lemma 1. Then from (7h), (7i), (9b) and $q_{k,j}h_{k,j}=1$, it follows that
$d^{c,*}=-h_{k,j}(\overline{p}^{c,*}_{j})=\lambda/q_{k,j}=\overline{d}^{c}_{k,j}$.
Similarly, from (7c), (7g), (7i), (9a) and $q_{k,j}(m_{k,j}+h_{k,j})=1$, it
follows that
$p^{M,*}_{k,j}=\overline{p}^{c,*}(m_{k,j}+h_{k,j})=-\lambda/q_{k,j}=\overline{p}^{M}_{k,j}$.
Furthermore, (9c) follows by multiplying (7e) with
$\boldsymbol{1}_{|\widetilde{\mathcal{N}}|}$.

Hence, the values $(\overline{p}^{M},\overline{d}^{c})=(p^{M,*},d^{c,*})$
satisfy the KKT conditions (9). Therefore, the equilibrium values $p^{M,*}$
and $d^{c,*}$ define a global minimum for (3). $\blacksquare$

_Proof of Theorem 1_: We will use the dynamics in (1), (2), (5), (6), to
define a Lyapunov candidate function for (1), (2), (5), (6).

Firstly, we consider an equilibrium point $\alpha^{*}$ =
$(\eta^{*},\psi^{*},\omega^{*},x^{*},p^{c,*})$ that satisfies (7). Then, we
let
$V_{F}(\omega)=1/2\sum_{j\in{\mathcal{N}}}M_{j}(\omega_{j}-\omega^{*}_{j})^{2}$.
The time derivative of $V_{F}$ along the trajectories of (1b) is given by

$\dot{V}_{F}=\sum_{j\in{\mathcal{N}}}(\omega_{j}-\omega^{*}_{j})(-\sum_{k\in\mathcal{N}_{j}}p^{L}_{k,j}+\sum_{k\in\mathcal{N}^{G}_{j}}p^{M}_{k,j}-\sum_{k\in\mathcal{N}^{L}_{j}}d^{c}_{k,j}\\\
-D_{j}\omega_{j}-\sum_{i\in\mathcal{N}^{s}_{j}}p_{ji}+\sum_{i\in\mathcal{N}^{p}_{j}}p_{ij}).$
(10)

Subtracting the product of $(\omega_{j}-\omega^{*}_{j})$ with each term in
(7b) it follows that

$\dot{V}_{F}=\sum_{j\in{\mathcal{N}}}(\omega_{j}-\omega^{*}_{j})(\sum_{k\in\mathcal{N}^{G}_{j}}(p^{M}_{k,j}-p^{M,*}_{k,j})+\sum_{k\in\mathcal{N}^{L}_{j}}(-d^{c}_{k,j}+d^{c,*}_{k,j})\\\
-D_{j}(\omega_{j}-\omega^{*}_{j}))+\sum_{(i:j)\in\mathcal{E}}(p_{ij}-p^{*}_{ij})(\omega_{j}-\omega_{i}).$
(11)

Moreover, we let $V_{C}(p^{c})=1/2(p^{c}-p^{c,*})^{T}\Gamma(p^{c}-p^{c,*})$.
Using (6b) and (7e) the time-derivative of $V_{C}$ is given by

$\dot{V}_{C}=(p^{c}-p^{c,*})^{T}((\widetilde{s}-\widetilde{s}^{*})-(H\psi-H\psi^{*})).$
(12)

Additionally, we define
$V_{P}(\eta)=1/2\sum_{(i,j)\in{\mathcal{E}}}B_{ij}(\eta_{ij}-\eta^{*}_{ij})^{2}$.
Using (1a) and (1c), the time-derivative is given by

$\dot{V}_{P}=\sum_{(i,j)\in{\mathcal{E}}}B_{ij}(\eta_{ij}-\eta^{*}_{ij})(\omega_{i}-\omega_{j})=\sum_{(i:j)\in{\mathcal{E}}}(p_{ij}-p^{*}_{ij})(\omega_{i}-\omega_{j}).$
(13)

Furthermore, consider
$V_{\psi}(\psi)=1/2(\psi-\psi^{*})^{T}\widetilde{\Gamma}(\psi-\psi^{*})$ with
time-derivative given by (6a) and (7d) as

$\dot{V}_{\psi}=(\psi-\psi^{*})^{T}H^{T}(p^{c}-p^{c,*}).$ (14)

Finally, we let
$V_{M}(x)=\sum_{k\in{\mathcal{N}^{G}_{j}}}\sum_{j\in{\mathcal{N}}}\tau_{k,j}/2m_{k,j}(x_{k,j}-x^{*}_{k,j})^{2}$
with time-derivative given by (2a), (6c), (7c) and (7i) as follows

$\dot{V}^{M}=\sum_{k\in{\mathcal{N}^{G}_{j}}}\sum_{j\in{\mathcal{N}}}[(x_{k,j}-x^{*}_{k,j})(-x_{k,j}+x^{*}_{k,j})]/m_{k,j}+\\\
(x_{k,j}-x^{*}_{k,j})((p^{c}_{k,j}-p^{c,*}_{k,j})-(\omega_{j}-\omega^{*}_{j})).$
(15)

Based on the above, we define the function

$V(\omega,p^{c},\eta,\psi,x)=V_{F}+V_{P}+V_{C}+V_{\psi}+V_{M},$ (16)

which we aim to use as a Lyapunov candidate. Using (11) - (15) and
substituting the values of $p^{M},d^{c}$ and $\widetilde{s}$ from (2b), (2c)
and (5), it follows that the time derivative of V satisfies

$\dot{V}\leq\sum_{j\in\mathcal{N}}(-D_{j}(\omega_{j}-\omega^{*}_{j})^{2}-\sum_{k\in{\mathcal{N}^{G}_{j}}}(x_{k,j}-x^{*}_{k,j})^{2}/m_{k,j})\\\
-\sum_{j\in\mathcal{N}}\sum_{k\in\mathcal{N}_{j}}h_{k,j}((p^{c}_{k,j}-p^{c,*}_{k,j})-(\omega_{j}-\omega^{*}_{j}))^{2}\leq
0.$ (17)

It is straightforward that $V$ has a global minimum at $\alpha^{*}$ =
$(\eta^{*},\psi^{*},\omega^{*},x^{*},p^{c,*})$. Hence, we consider the set
$\Xi=\\{\alpha:V\leq\epsilon,V\text{ connected}\\}$ containing $\alpha^{*}$
for some $\epsilon>0$. From (17), it follows that $\Xi$ is an invariant set
for (1), (2), (5), (6). We are hence in a position to apply LaSalle’s
Invariance principle [38] on (1), (2), (5), (6), using $\Xi$ as an invariant
set. From LaSalle’s Invariance principle, we deduce that solutions to (1),
(2), (5), (6), converge to the largest invariant set within $\Xi$ where
$\dot{V}=0$. Within this set, it follows that
$(\omega=\omega^{*}=\boldsymbol{0}_{|\mathcal{N}|})$, as follows from Lemma 1,
and $(p^{c},x)=(p^{c,*},x^{*})$. In addition, convergence of $(\omega,p^{c})$
to $(\omega^{*},p^{c,*})$ implies the convergence of $(\eta,\psi)$ to some
constant values $(\bar{\eta},\bar{\psi})$. Hence, solutions initiated within
$\Xi$ converge to the set of equlibria within (1), (2), (5), (6). Noting that
$\epsilon$ in the definition of $\Xi$ can be selected to be arbitrarily large
demonstrates global convergence and completes the proof. $\blacksquare$

_Proof of Proposition 3_: Consider an intelligent eavesdropper, aiming to
estimate $\widetilde{s}_{k,j}$ based on K1 and K2. There are two ways to
proceed for this. The first is to try reversing the dynamics in (8), i.e. use
the relation $\widetilde{s}=\Gamma\dot{p}^{c}+H\psi-n$ associated with a
particular unit. This approach cannot be applied since the value of $n$ is
unknown to the eavesdropper. The second approach would be to use the
equilibrium values and trajectories of the power command and $\psi$ to
estimate $\widetilde{s}_{k,j}$, i.e. use
$\widetilde{s}_{k,j}(t)=\widetilde{s}^{*}_{k,j}-\int_{t}^{\infty}\gamma_{k,j}\dot{p}^{c}_{k,j}(\tau)-\mathds{1}^{T}_{|\tilde{\mathcal{N}}|,f}H^{T}\psi(\tau)-n_{k,j}(\tau)d\tau$
where $f$ corresponds to the row associated with unit $k,j$ in $H^{T}\psi$.
However, estimating the equilibrium value of $\widetilde{s}^{*}_{k,j}$ using
$\widetilde{s}^{*}+n^{*}=H\psi^{*}$ requires knowledge of the equilibrium
values of both $\psi$ and $n$, with the latter being unknown. Hence, the
Privacy-Preserving scheme (8) guarantees the privacy of the prosumption
profiles against eavesdroppers with knowledge of K1 and K2. $\blacksquare$

_Proof of Proposition 4_: Consider an intelligent eavesdropper, aiming to
estimate $\widetilde{s}_{k,j}$ based on K1, K2 and K3. Similarly to the proof
of Proposition 3, there are two ways to proceed for this. The first is to try
reversing the dynamics in (8), i.e. use
$\widetilde{s}=\Gamma\dot{p}^{c}+H\psi-n$ associated with a particular unit.
However, when the system is not at steady state, the value of $n$ is unknown
to the eavesdropper. The second approach would be to use that
$n=\boldsymbol{0}_{|\widetilde{\mathcal{N}}|}$ at steady state from K3 and
calculate the vector $\psi$ using
$\psi(t)=\psi(0)-\int_{0}^{t}\overline{\Gamma}^{-1}H^{T}p^{c}(\tau)d\tau$.
Although the value of $\psi(0)$ might be difficult to obtain, an eavesdropper
could be interested in the deviation of supply so
$\psi(0)=\boldsymbol{0}_{|\widetilde{\mathcal{E}}|}$ could be used. Then, the
equilibrium value $\widetilde{s}^{*}=H^{T}\psi^{*}$ could be used to estimate
$\widetilde{s}_{k,j}$, i.e. use
$\widetilde{s}_{k,j}(t)=\widetilde{s}^{*}_{k,j}-\int_{t}^{\infty}\gamma_{k,j}\dot{p}^{c}_{k,j}(\tau)-\mathds{1}^{T}_{|\tilde{\mathcal{N}}|,f}H^{T}\psi(\tau)-n_{k,j}(\tau)d\tau$
where $f$ corresponds to the row associated with unit $k,j$ in $H^{T}\psi$.
The implementation of the latter is impossible since the trajectory of
$n_{k,j}$ is unknown. Hence, the Privacy-Preserving scheme (8) guarantees the
privacy of the prosumption trajectories. $\blacksquare$

_Proof of Proposition 5_: The proof follows using similar arguments as in the
proof of Proposition 4. In particular, since K2, K3, K4 include less
information than K1, K2, K3, then the prosumption trajectory
$\widetilde{s}_{k,j}$ is private as a special case of Proposition 4. In
addition, $\widetilde{s}^{*}=H^{T}\psi^{*}$ cannot be used to estimate the
steady state value of $\widetilde{s}_{k,j}$, since $\psi$ cannot be estimated
from K2, K3, K4. Hence, the privacy of the prosumption profile
$\widetilde{s}_{k,j}$ is guaranteed. $\blacksquare$

_Proof of Proposition 6_: The proof follows by noting that the equilibria of
(1), (2), (5), (8), are identical to those of (1), (2), (5), (6). The latter
follows from Design Condition 1, which ensures that at steady state
$n^{*}=\boldsymbol{0}_{|\widetilde{\mathcal{N}}|}$ since at equilibrium the
frequency attains its nominal value and
$\dot{p}^{c}=\boldsymbol{0}_{|\widetilde{\mathcal{N}}|}$. Therefore, the proof
of Proposition 6 follows directly from the proof of Proposition 2.
$\blacksquare$

_Proof of Theorem 2:_ First, we consider the function
$V_{n}(p^{c})=(p^{c}-p^{c,*})^{T}(\Gamma+\Xi)(p^{c}-p^{c,*})/2$, where
$\Xi\in\mathbb{R}^{|\widetilde{\mathcal{N}}|\times|\widetilde{\mathcal{N}}|}$
is a diagonal,  positive-semidefinite matrix containing the elements
$\xi_{k,j}$ associated with Design Condition 1(i), and note that its time
derivative along the trajectories of (8b) is given by

$\displaystyle\dot{V}_{n}=$
$\displaystyle(p^{c}-p^{c,*})^{T}((\widetilde{s}-\widetilde{s}^{*})-(H\psi-H\psi^{*})$
$\displaystyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}+(n^{f}-n^{f,*})+\dot{\Xi}(p^{c}-p^{c,*})/2),}$

where $\dot{\Xi}=\frac{d\Xi}{dt}$, noting that
$n^{f,*}=\boldsymbol{0}_{|\widetilde{\mathcal{N}}|}$ from Design Condition
1(ii) and $\omega^{*}=\boldsymbol{0}_{|{\mathcal{N}}|}$, as follows from Lemma
1 and the fact that the equilibria of (1), (2), (5), (8) and (1), (2), (5),
(6) are identical.

Then, we consider the function $\hat{V}=V_{F}+V_{P}+V_{n}+V_{\psi}+V_{M}$,
where the terms $V_{F},V_{P},V_{\psi},V_{M}$ follow from the proof of Theorem
1. Compared with the time-derivative of $V$, given in (17), $\dot{\hat{V}}$
has only  two extra terms given by $(p^{c}-p^{c,*})^{T}n^{f}$ and
$(p^{c}-p^{c,*})^{T}\dot{\Xi}(p^{c}-p^{c,*})/2$. Hence, it follows that the
time derivative of $\hat{V}$ satisfies

$\dot{\hat{V}}\leq\sum_{j\in\mathcal{N}}\big{(}\sum_{k\in\mathcal{N}_{j}}[-h_{k,j}((p^{c}_{k,j}-p^{c,*}_{k,j})-(\omega_{j}-\omega^{*}_{j}))^{2}\\\
+(p^{c}_{k,j}-p^{c,*}_{k,j})n^{f}_{k,j}+{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\dot{\xi}_{k,j}(p^{c}_{k,j}-p^{c,*}_{k,j})^{2}/2}]-D_{j}(\omega_{j}-\omega^{*}_{j})^{2}\big{)}.$
(18)

From (18)  and Design Condition 1 it follows that

$\dot{\hat{V}}\leq\sum_{j\in\mathcal{N}}\sum_{k\in\mathcal{N}_{j}}[(2h_{k,j}+\beta_{k,j})|(p^{c}_{k,j}-p^{c,*}_{k,j})(\omega_{j}-\omega^{*}_{j})|\\\
-(h_{k,j}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}-\hat{\beta}_{k,j}/2})(p^{c}_{k,j}-p^{c,*}_{k,j})^{2}-(h_{k,j}+D_{j}/|\mathcal{N}_{j}|)(\omega_{j}-\omega^{*}_{j})^{2}]\\\
\leq 0,$ (19)

where the last inequality follows from the  LMI condition in Design Condition
1.

The rest of the proof follows by similar arguments as in the proof of Theorem
1. In particular, $\hat{V}$ has a global minimum at $\alpha^{*}$ =
$(\eta^{*},\psi^{*},\omega^{*},x^{*},p^{c,*})$. Hence, the set
$\Xi=\\{\alpha:\hat{V}\leq\epsilon,\hat{V}\text{ connected}\\}$ containing
$\alpha^{*}$ is positively invariant for (1), (2), (5), (8), and some
$\epsilon>0$ as follows from (19). By applying [39, Theorem 4.2] on (1), (2),
(5), (8), using $\Xi$ as an invariant set, we deduce that solutions to (1),
(2), (5), (8), converge to the largest invariant set within $\Xi$ where
$\dot{\hat{V}}=0$. The characterisation of this set follows in analogy to the
proof of Theorem 1. Hence, solutions initiated within $\Xi$ converge to the
set of equlibria within (1), (2), (5), (8). Noting that $\epsilon$ in the
definition of $\Xi$ can be selected to be arbitrarily large demonstrates
global convergence and completes the proof. $\blacksquare$

## References

  * [1] A. Ipakchi and F. Albuyeh, “Grid of the future,” IEEE Power and Energy Magazine, vol. 7, no. 2, pp. 52–62, 2009.
  * [2] F. Kamyab, M. Amini, S. Sheykhha, M. Hasanpour, and M. M. Jalali, “Demand response program in smart grid using supply function bidding mechanism,” IEEE Transactions on Smart Grid, vol. 7, no. 3, pp. 1277–1284, 2015.
  * [3] M. Zeifman and K. Roth, “Nonintrusive appliance load monitoring: Review and outlook,” IEEE Transactions on Consumer Electronics, vol. 57, no. 1, pp. 76–84, 2011.
  * [4] Z. Erkin, J. R. Troncoso-Pastoriza, R. L. Lagendijk, and F. Pérez-González, “Privacy-preserving data aggregation in smart metering systems: An overview,” IEEE Signal Processing Magazine, vol. 30, no. 2, pp. 75–86, 2013.
  * [5] D. J. Hess and J. S. Coley, “Wireless smart meters and public acceptance: The environment, limited choices, and precautionary politics,” Public Understanding of Science, vol. 23, no. 6, pp. 688–702, 2014.
  * [6] E. Devane, A. Kasis, M. Antoniou, and I. Lestas, “Primary frequency regulation with load-side participation—part ii: Beyond passivity approaches,” IEEE Transactions on Power Systems, vol. 32, no. 5, pp. 3519–3528, 2016.
  * [7] A. Kasis, N. Monshizadeh, E. Devane, and I. Lestas, “Stability and optimality of distributed secondary frequency control schemes in power networks,” IEEE Transactions on Smart Grid, vol. 10, no. 2, pp. 1747–1761, 2017.
  * [8] C. Zhao, U. Topcu, N. Li, and S. Low, “Design and stability of load-side primary frequency control in power systems,” IEEE Transactions on Automatic Control, vol. 59, no. 5, pp. 1177–1189, 2014.
  * [9] A. Kasis, N. Monshizadeh, and I. Lestas, “Primary frequency regulation in power grids with on–off loads: Chattering, limit cycles and convergence to optimality,” Automatica, vol. 131, p. 109736, 2021.
  * [10] A. Kasis, E. Devane, C. Spanias, and I. Lestas, “Primary frequency regulation with load-side participation—part i: Stability and optimality,” IEEE Transactions on Power Systems, vol. 32, no. 5, pp. 3505–3518, 2016.
  * [11] S. Trip, M. Bürger, and C. De Persis, “An internal model approach to (optimal) frequency regulation in power grids with time-varying voltages,” Automatica, vol. 64, pp. 240–253, 2016.
  * [12] N. Li, C. Zhao, and L. Chen, “Connecting automatic generation control and economic dispatch from an optimization view,” IEEE Transactions on Control of Network Systems, vol. 3, no. 3, pp. 254–264, 2015.
  * [13] X. Chen, C. Zhao, and N. Li, “Distributed automatic load frequency control with optimality in power systems,” IEEE Transactions on Control of Network Systems, vol. 8, no. 1, pp. 307–318, 2020.
  * [14] E. Mallada, C. Zhao, and S. Low, “Optimal load-side control for frequency regulation in smart grids,” IEEE Transactions on Automatic Control, vol. 62, no. 12, pp. 6294–6309, 2017.
  * [15] C. Zhao, E. Mallada, and S. H. Low, “Distributed generator and load-side secondary frequency control in power networks,” in 2015 49th Annual Conference on Information Sciences and Systems (CISS), pp. 1–6, IEEE, 2015.
  * [16] C. Zhao, E. Mallada, S. H. Low, and J. Bialek, “Distributed plug-and-play optimal generator and load control for power system frequency regulation,” International Journal of Electrical Power & Energy Systems, vol. 101, pp. 1–12, 2018.
  * [17] Low, M. Enrique, and S. H, “Distributed frequency-preserving optimal load control,” IFAC Proceedings Volumes, vol. 47, no. 3, pp. 5411–5418, 2014\.
  * [18] A. Kasis, S. Timotheou, and M. Polycarpou, “Optimal secondary frequency regulation with on-off loads in power networks,” IEEE Transactions on Control Systems Technology, 2022.
  * [19] A. Kasis, N. Monshizadeh, and I. Lestas, “A distributed scheme for secondary frequency control with stability guarantees and optimal power allocation,” Systems & Control Letters, vol. 144, p. 104755, 2020.
  * [20] S. Trip and C. De Persis, “Distributed optimal load frequency control with non-passive dynamics,” IEEE Transactions on Control of Network Systems, vol. 5, no. 3, pp. 1232–1244, 2017.
  * [21] S. Zeadally, A. K. Pathan, C. Alcaraz, and M. Badra, “Towards privacy protection in smart grid,” Wireless Personal Communications, vol. 73, no. 1, pp. 23–50, 2013.
  * [22] F. Siddiqui, S. Zeadally, C. Alcaraz, and S. Galvao, “Smart grid privacy: Issues and solutions,” in 21st International Conference on Computer Communications and Networks (ICCCN), pp. 1–5, IEEE, 2012.
  * [23] C.-M. Yu, C.-Y. Chen, S.-Y. Kuo, and H.-C. Chao, “Privacy-preserving power request in smart grid networks,” IEEE Systems Journal, vol. 8, no. 2, pp. 441–449, 2013.
  * [24] F. Fioretto, T. W. Mak, and P. Van Hentenryck, “Differential privacy for power grid obfuscation,” IEEE Transactions on Smart Grid, vol. 11, no. 2, pp. 1356–1366, 2019.
  * [25] G. Eibl and D. Engel, “Differential privacy for real smart metering data,” Computer Science-Research and Development, vol. 32, no. 1-2, pp. 173–182, 2017.
  * [26] F. G. Mármol, C. Sorge, O. Ugus, and G. M. Pérez, “Do not snoop my habits: preserving privacy in the smart grid,” IEEE Communications Magazine, vol. 50, no. 5, pp. 166–172, 2012.
  * [27] R. Lu, X. Liang, X. Li, X. Lin, and X. Shen, “Eppa: An efficient and privacy-preserving aggregation scheme for secure smart grid communications,” IEEE Transactions on Parallel and Distributed Systems, vol. 23, no. 9, pp. 1621–1631, 2012.
  * [28] L. Yang, X. Chen, J. Zhang, and H. V. Poor, “Cost-effective and privacy-preserving energy management for smart meters,” IEEE Transactions on Smart Grid, vol. 6, no. 1, pp. 486–495, 2014.
  * [29] Z. Zhang, Z. Qin, L. Zhu, J. Weng, and K. Ren, “Cost-friendly differential privacy for smart meters: Exploiting the dual roles of the noise,” IEEE Transactions on Smart Grid, vol. 8, no. 2, pp. 619–626, 2016.
  * [30] T. Wu, C. Zhao, and Y.-J. A. Zhang, “Privacy-preserving distributed optimal power flow with partially homomorphic encryption,” IEEE Transactions on Smart Grid, 2021.
  * [31] V. Dvorkin, F. Fioretto, P. Van Hentenryck, P. Pinson, and J. Kazempour, “Differentially private optimal power flow for distribution grids,” IEEE Transactions on Power Systems, vol. 36, no. 3, pp. 2186–2196, 2020.
  * [32] H. Souri, A. Dhraief, S. Tlili, K. Drira, and A. Belghith, “Smart metering privacy-preserving techniques in a nutshell,” Procedia Computer Science, vol. 32, pp. 1087–1094, 2014.
  * [33] A. Kasis, E. Devane, and I. Lestas, “On the stability and optimality of primary frequency regulation with load-side participation,” in 2015 54th IEEE Conference on Decision and Control (CDC), pp. 2621–2626, IEEE, 2015\.
  * [34] J. Machowski, Z. Lubosny, J. W. Bialek, and J. R. Bumby, Power system dynamics: stability and control.  John Wiley & Sons, 2020.
  * [35] S. Parsaeefard and T. Le-Ngoc, “Improving wireless secrecy rate via full-duplex relay-assisted protocols,” IEEE Transactions on Information Forensics and Security, vol. 10, no. 10, pp. 2095–2107, 2015.
  * [36] S. Boyd, S. P. Boyd, and L. Vandenberghe, Convex optimization.  Cambridge university press, 2004.
  * [37] J. H. Chow and K. W. Cheung, “A toolbox for power system dynamics and control engineering education and research,” IEEE Transactions on Power Systems, vol. 7, no. 4, pp. 1559–1564, 1992.
  * [38] H. K. Khalil and J. W. Grizzle, Nonlinear systems, vol. 3.  Prentice hall Upper Saddle River, NJ, 2002.
  * [39] W. M. Haddad and V. Chellaboina, Nonlinear dynamical systems and control: a Lyapunov-based approach.  Princeton university press, 2011.