Architecture and Algorithms for Privacy Preserving Thermal ...

12
1 Architecture and Algorithms for Privacy Preserving Thermal Inertial Load Management by A Load Serving Entity Abhishek Halder, Member, IEEE, Xinbo Geng, Student Member, IEEE, P.R. Kumar, Fellow, IEEE, and Le Xie, Senior Member, IEEE Abstract—Motivated by the growing importance of demand response in modern power system’s operations, we propose an architecture and supporting algorithms for privacy preserving thermal inertial load management as a service provided by the load serving entity (LSE). We focus on an LSE managing a population of its customers’ air conditioners, and propose a contractual model where the LSE guarantees quality of service to each customer in terms of keeping their indoor temperature trajectories within respective bands around the desired individual comfort temperatures. We show how the LSE can price the contracts differentiated by the flexibility embodied by the width of the specified bands. We address architectural questions of (i) how the LSE can strategize its energy procurement based on price and ambient temperature forecasts, (ii) how an LSE can close the real time control loop at the aggregate level while providing individual comfort guarantees to loads, without ever measuring the states of an air conditioner for privacy reasons. Control algorithms to enable our proposed architecture are given, and their efficacy is demonstrated on real data. Index Terms—Load serving entity, demand response, thermal inertial load, privacy, contracts. I. I NTRODUCTION I N traditional power systems, the role of feedback control has primarily been concentrated on the generation side where the demand side variability is dynamically matched via operating reserve. As more renewables are being inte- grated into the power grid to reduce carbon footprint, a new operational paradigm is emerging. Unlike fossil fuels, generation from renewables such as solar and wind, cannot be directly controlled. Thus, large scale renewable integration requires moving from control of the supply to control of the demand. This necessitates a collection of mechanisms, termed as demand response, for manipulating aggregate demand to offset the supply side variability. Thermal inertial loads such as air conditioners (ACs) are one of the primary candidates [1] for control on the demand side. They contribute to 48% of U.S. annual residential consumption [2], and are potential enablers for demand response due to their ability to store energy and defer consumption without perceptible change in end-user functionality. The authors are with the Department of Electrical and Computer Engi- neering, Texas A&M University, College station, TX, 77843 USA, e-mail: {ahalder,gengxbtamu,prk,le.xie}@tamu.edu. This material is based upon work partially supported by NSF under Contract Nos. ECCS- 1546682, CPS-1239116, Science & Technology Center Grant CCF-0939370, DGE-1303378, and ECCS-1150944. In this paper, we consider an aggregator or load serving entity (LSE) managing a finite population of residential ACs through direct load control [1], [3]. We address three distinct problems that are important for designing a direct load control architecture, viz. (1) how to control a population of thermal inertial loads to guarantee quality of service such as comfort bounds for homes, (2) how to achieve such control while preserving the privacy of the loads’ states from the LSE, and (3) what to control the aggregate consumption to, so that the cost of serving the collection of loads is minimized. Our strategy effectively produces demand response from the collection of homes according to how their temperatures are distributed within their comfort zones at any given time, without attempting to squeeze it from each and every home. Holistically maintaining individual home privacy while still generating demand response that respects home comfort con- straints does not seem to have been addressed in the literature. Previous works on thermal inertial load management [4]– [11] have focused on obtaining an aggregate model for a population of loads, and then used the resulting model, or an approximation of it, to track a given reference power trajectory. The purpose of this paper is to present a comprehensive architecture and algorithms (Section III) so that the LSE can manage a population of thermal inertial loads while addressing the three questions mentioned in the preceding paragraph. We address the first two problems by proposing a model- free setpoint velocity control algorithm (Section III-1). We formulate and solve (Section III-5) the third as an open-loop optimal control problem. We also quantify (Section III-3) the statistical performance of the LSE’s strategy under random perturbations that entail different real-time energy usage than planned in the day-ahead market. We show (Section IV) how the LSE can price the contracts differentiated by the flexibility provided by the customers with respect to their comfort requirements, and illustrate (Section V) all our algorithms on day-ahead price forecast data from the Electric Reliability Council of Texas (ERCOT), and ambient temperature data from a weather station in Houston, Texas. Some preliminary results using these ideas applied to ERCOT real-time energy market price forecast data, appeared in [12]. Notations: The notation x ρ means that the random vector x follows joint density function ρ(x). We use the shorthand Lap(κ) to denote the zero mean Laplace density function with scale parameter κ> 0, Gamma(a, b) to denote the Gamma density with parameters a, b > 0, Exp(λ) to denote arXiv:1606.09564v3 [cs.SY] 29 Nov 2016

Transcript of Architecture and Algorithms for Privacy Preserving Thermal ...

Page 1: Architecture and Algorithms for Privacy Preserving Thermal ...

1

Architecture and Algorithms for Privacy PreservingThermal Inertial Load Management by

A Load Serving EntityAbhishek Halder, Member, IEEE, Xinbo Geng, Student Member, IEEE, P.R. Kumar, Fellow, IEEE,

and Le Xie, Senior Member, IEEE

Abstract—Motivated by the growing importance of demandresponse in modern power system’s operations, we propose anarchitecture and supporting algorithms for privacy preservingthermal inertial load management as a service provided by theload serving entity (LSE). We focus on an LSE managing apopulation of its customers’ air conditioners, and propose acontractual model where the LSE guarantees quality of serviceto each customer in terms of keeping their indoor temperaturetrajectories within respective bands around the desired individualcomfort temperatures. We show how the LSE can price thecontracts differentiated by the flexibility embodied by the widthof the specified bands. We address architectural questions of(i) how the LSE can strategize its energy procurement basedon price and ambient temperature forecasts, (ii) how an LSEcan close the real time control loop at the aggregate level whileproviding individual comfort guarantees to loads, without evermeasuring the states of an air conditioner for privacy reasons.Control algorithms to enable our proposed architecture are given,and their efficacy is demonstrated on real data.

Index Terms—Load serving entity, demand response, thermalinertial load, privacy, contracts.

I. INTRODUCTION

IN traditional power systems, the role of feedback controlhas primarily been concentrated on the generation side

where the demand side variability is dynamically matchedvia operating reserve. As more renewables are being inte-grated into the power grid to reduce carbon footprint, anew operational paradigm is emerging. Unlike fossil fuels,generation from renewables such as solar and wind, cannotbe directly controlled. Thus, large scale renewable integrationrequires moving from control of the supply to control of thedemand. This necessitates a collection of mechanisms, termedas demand response, for manipulating aggregate demand tooffset the supply side variability. Thermal inertial loads suchas air conditioners (ACs) are one of the primary candidates[1] for control on the demand side. They contribute to 48%of U.S. annual residential consumption [2], and are potentialenablers for demand response due to their ability to storeenergy and defer consumption without perceptible change inend-user functionality.

The authors are with the Department of Electrical and Computer Engi-neering, Texas A&M University, College station, TX, 77843 USA, e-mail:ahalder,gengxbtamu,prk,[email protected]. This material isbased upon work partially supported by NSF under Contract Nos. ECCS-1546682, CPS-1239116, Science & Technology Center Grant CCF-0939370,DGE-1303378, and ECCS-1150944.

In this paper, we consider an aggregator or load servingentity (LSE) managing a finite population of residential ACsthrough direct load control [1], [3]. We address three distinctproblems that are important for designing a direct load controlarchitecture, viz. (1) how to control a population of thermalinertial loads to guarantee quality of service such as comfortbounds for homes, (2) how to achieve such control whilepreserving the privacy of the loads’ states from the LSE,and (3) what to control the aggregate consumption to, sothat the cost of serving the collection of loads is minimized.Our strategy effectively produces demand response from thecollection of homes according to how their temperatures aredistributed within their comfort zones at any given time,without attempting to squeeze it from each and every home.

Holistically maintaining individual home privacy while stillgenerating demand response that respects home comfort con-straints does not seem to have been addressed in the literature.Previous works on thermal inertial load management [4]–[11] have focused on obtaining an aggregate model for apopulation of loads, and then used the resulting model, or anapproximation of it, to track a given reference power trajectory.The purpose of this paper is to present a comprehensivearchitecture and algorithms (Section III) so that the LSE canmanage a population of thermal inertial loads while addressingthe three questions mentioned in the preceding paragraph.We address the first two problems by proposing a model-free setpoint velocity control algorithm (Section III-1). Weformulate and solve (Section III-5) the third as an open-loopoptimal control problem. We also quantify (Section III-3) thestatistical performance of the LSE’s strategy under randomperturbations that entail different real-time energy usage thanplanned in the day-ahead market. We show (Section IV) howthe LSE can price the contracts differentiated by the flexibilityprovided by the customers with respect to their comfortrequirements, and illustrate (Section V) all our algorithms onday-ahead price forecast data from the Electric ReliabilityCouncil of Texas (ERCOT), and ambient temperature datafrom a weather station in Houston, Texas. Some preliminaryresults using these ideas applied to ERCOT real-time energymarket price forecast data, appeared in [12].

Notations: The notation x ∼ ρ means that the randomvector x follows joint density function ρ(x). We use theshorthand Lap(κ) to denote the zero mean Laplace densityfunction with scale parameter κ > 0, Gamma(a, b) to denotethe Gamma density with parameters a, b > 0, Exp(λ) to denote

arX

iv:1

606.

0956

4v3

[cs

.SY

] 2

9 N

ov 2

016

Page 2: Architecture and Algorithms for Privacy Preserving Thermal ...

2

exponential density with rate λ > 0, and N (µ,Σ) to denotethe Gaussian density with mean µ and covariance Σ. We useN (µ, σ, a, b) to denote a truncated univariate Gaussian densitywith mean µ and standard deviation σ, supported on [a, b].The symbols ∨ and ∧ denote the maximum and minimum,respectively, and [r]+ := 0∨r, for any r ∈ R. The notation 1Sdenotes the indicator function of a set S, while the abbreviationi.i.d. stands for “independent and identically distributed”.

II. MODEL

Fig. 1. Thermal inertial dynamics of an AC, not under direct load control,is shown with fixed setpoint s0, and a comfort temperature interval [L0, U0]with range 2∆, where U0 = s0 + ∆ and L0 = s0 − ∆. The ambienttemperature trajectory (green) is θa(t). The indoor temperature trajectoryθ(t) ∈ [L0, U0] consists of alternating OFF (blue, up-going) and ON (red,down-going) segments, as shown, where the boundaries L0 and U0 act asreflecting barriers for the ON and OFF segments, respectively.

A. Dynamics of Thermal Inertial Load

In this paper, we consider the ambient temperature is highenough that ACs are cooling homes, a situation of the sortwhere demand response is appropriate. We denote the indoortemperature at time t by θ(t), and the ambient temperature byθa(t). At time t = 0, an occupant privately sets a temperatures0, called setpoint, with a willingness to tolerate at most ±∆temperature deviation from s0, thus defining a temperaturecomfort range [L0, U0] := [s0 − ∆, s0 + ∆]. The flexibilityof an AC is measured by 2∆; larger the flexibility, greaterthe potential for demand response. The goal of the proposedarchitecture and algorithms is to enable the LSE exploit thisflexibility without the LSE being aware of the load temperatureθ(t) or the setpoint s0, or even ∆.

The dynamics of an AC not under direct load control, isshown in Fig. 1. When the AC is OFF, the indoor temperatureθ(t) rises exponentially toward θa(t) until it hits the uppercomfort limit U0, at which point the AC turns ON. Once ON,θ(t) decreases exponentially until it hits the lower comfortlimit L0, at which point the AC turns OFF. While thisqualitative behavior shown in Fig. 1 is valid for any ambienttemperature trajectory satisfying θa(t) > U0, quantitativelyspeaking, temporal variations in θa(t) produce time-varyingrates of heating (when AC is OFF) and cooling (when ACis ON). Let us denote the mode of an AC at time t by

Fig. 2. A schematic of the proposed architecture for thermal inertial loadmanagement by the LSE.

σ(t) = 1(0), signifying if it is ON (OFF). Its hystereticswitching trajectory is

σ(t) :=

1 if θ(t) = U0,

0 if θ(t) = L0,

σ (t−) otherwise.(1)

The indoor temperature dynamics of the home is governed by

θ(t) = −α (θ(t)− θa(t))− βPσ(t), (2)

where the parameters α, β > 0 denote the heating time con-stant and thermal conductivity, respectively. Here, P denotesthe amount of thermal power drawn by the AC when it isON (σ(t) = 1). The electrical power drawn, Pe, is relatedto the thermal power P , via the formula Pe = P

η , where theparameter η > 0 denotes the efficiency of the AC.

B. Direct Load Control Strategy

In this paper, we propose an architecture where the setpointof an individual AC will be changed over time by the LSEthrough a velocity control strategy. The rate of change ofsetpoint s(t) will constitute a “control variable” that can beused by the LSE. This velocity command, suitably modulatedso that the comfort zone is never violated, can be followedby an AC locally without the LSE being aware of the load’schosen values of L0, U0 or its current temperature θ(t). Yet,by squeezing the band close to the upper or lower limits,it can cause a certain fraction of loads to turn ON/OFF inresponse, thereby collectively invoking demand response. ACsthat are ON with temperature trajectory headed downwardcan be intercepted by a rising lower boundary (Lt) to turnOFF. Similarly, ACs that are OFF with temperature trajectoryheaded upward can be intercepted by a falling upper boundary(Ut) and to force them turn ON. Thus, the demand responsecan induce less electricity consumption by issuing positivevelocity commands, and it can also induce more cooling whichallows storage of energy in the homes. This will be detailedin Section III-1.

Page 3: Architecture and Algorithms for Privacy Preserving Thermal ...

3

Fig. 3. The two layer hierarchical strategy of the LSE.

C. Contracts

If a home agrees to allow the LSE to manage the energyconsumption of its AC, the LSE is obligated to respect privacyin the sense that it may influence the consumption but shoulddo so without ever measuring the state s(t), θ(t), σ(t) ofany individual AC. Furthermore, the LSE must guarantee thatthe indoor temperature θ(t) lies within the home’s comfortrange [L0, U0], at all times. These privacy and comfort rangeguarantees will constitute a contract between the LSE andan individual home. Larger the value of ∆, greater is theflexibility of the load that an LSE can potentially exploit inshaping demand response. The value of the contract thereforedepends on the magnitude of ∆. A home may choose itstolerance ∆, and is charged lesser for electricity the larger∆ it can tolerate. In Section IV, we will show how the LSEcan determine the cost of providing electricity to a customeras a function of its flexibility ∆, which it can then use todetermine how to price contracts.

D. Planning in the Day-Ahead Market

Much of the electricity purchase takes pace in the day-ahead market. In Section III-5, we will show how the LSEcan operationally plan the amount of energy to purchase ineach of the 24 one-hour periods of the day-ahead market, sothat it can support the loads at least cost. The goal of suchplanning is to ensure that the LSE purchases more energy attimes when the day-ahead prices are low, and less energy inperiods when day-ahead prices are high. The LSE must do sotaking into consideration the flexibilities of the collection ofhomes and the need to keep their temperatures within theircomfort zones.

III. MEASUREMENT AND CONTROL ARCHITECTURE ANDSTRATEGY FOR THE LSE

We propose a novel architecture (Fig. 2) and operationalplanning and control strategies for the LSE to manage apopulation of N ACs over a finite time interval [0, T ], subjectto the contractual obligations, privacy constraints, and loaddynamics constraints, and to do so at low cost to the LSE.Our strategy consists of a planning phase where the LSEcontracts to purchase the optimal amount of energy at low cost

in the day-ahead market so that it can support the aggregateload of the homes under contract. We term this operationalplanning. For t ∈ [0, T ], the LSE takes the measured real timetotal power consumption Ptotal(t) as feedback to compute acontrol signal v(t) that it broadcasts to all homes, requestingthe setpoint of the ith AC at time t, denoted as si(t), be movedaccording to the velocity control policy

si(t) = ∆i v(t), i = 1, . . . , N. (3)

Homes with different contractual ∆i correspond to differentcomfort tolerances, and experience different setpoint veloci-ties. The operational planning, followed by setpoint velocitycontrol, comprise a two layer hierarchical strategy (Fig. 3) forthe LSE, which we expound next.

0 2000 4000 6000 8000 10000 12000 14000

0

2

4

6

0 2000 4000 6000 8000 10000 12000 1400020

22

24

26

28

30

t (seconds)

Pow

er(kW

)

t (seconds)

Tem

perature

(C)

Lt

Ut

θ(t)

s(t)

U0

L0

P reftotal(t)

Ptotal(t)

Fig. 4. Top: Using setpoint velocity control, the LSE makes the real timeconsumption Ptotal(t) (solid line), shown here for a single AC with θa(t) =32C and t ∈ [0, 4 hours], track the planned optimal reference consumptionP ref

total(t) (dashed line). Bottom: corresponding nonlinear deformation of thehysteretic band [L0, U0](thick black lines) 7→ [Lt, Ut] ([blue line, red line]),shown as the gray area, in real time under the setpoint velocity control. Alsoshown are the θ(t) (solid green) and s(t) (dashed brown) trajectories.

1) Privacy Preserving Load Control: We suppose that theday-ahead operational planning, to be detailed in Section III-5,has led to an optimal reference aggregate power consumptiontrajectory P ref

total(t) for 0 ≤ t ≤ T . We now focus on the

Page 4: Architecture and Algorithms for Privacy Preserving Thermal ...

4

design of a real time privacy preserving setpoint velocitycontroller for the LSE so as to make the actual total powerconsumption Ptotal(t) track the planned optimal target con-sumption P ref

total(t). This corresponds to the “second layer” inFig. 3. Assuming that the LSE can measure or estimate theaggregate output Ptotal(t) in real time, define the error signale(t) := Ptotal(t) − P ref

total(t). Then, a simple PID controllercan generate a common velocity command for all homesv(t) := kpe(t)+ki

∫ t0e(ς)dς+kd

dedt , with kp, ki, and kd being

the proportional, integral, and derivative gains, respectively.We choose PID controller since it is easy to implement.Alternatively, one may use a model-based feedback controllerfor which the “number density” [10] of ON/OFF ACs isapproximated in real time. As a model-free implementation,the PID controller obviates this difficulty.

The LSE broadcasts the common velocity command v(t) toall homes. Upon receiving the LSE’s broadcast, an individualhome’s AC moves its setpoint according to (3). At any giventime, a home with larger comfort range moves its setpointfaster than the one with smaller range, and hence providesmore flexibility to the LSE for reference tracking. To respectthe contractual comfort guarantee Li0 ≤ θi(t) ≤ Ui0 for eachi = 1, . . . , N , the setpoint controller (3), at any time t, utilizesthe time-varying band [Lit, Uit], where

Lit := Ui0 ∧ [Li0 ∨ (si(t)−∆i)] , (4)Uit := Li0 ∨ [Ui0 ∧ (si(t) + ∆i)] . (5)

Thus, the width of the time-varying bands expand (contract)when the aggregate power consumption needs to be increased(reduced). In Fig. 4, we show the deformation of the time-varying band [Lit, Uit] ⊆ [Li0, Ui0] for N = 1. Furthermore,we notice that only the computation of v(t) is centralized, butthe computation (3), (4) and (5) are all decentralized.

From an architectural standpoint, there are two ways to in-terpret the computation in equations (3)–(5). One may interpretthem as part of control, and in that case the proposed real-timecontrol algorithm becomes partially centralized (computationof v(t)) and partially decentralized (computation of (3)–(5)).This is unlike existing direct load control programs [13]–[16],where the controls are fully centralized while the actuationare decentralized. Alternatively, one can consider only thecentralized computation of v(t) as control, and regard thedecentralized computation of (3)–(5) as part of smart actu-ation. In this interpretation, the proposed method differs fromthe existing direct load control programs in that traditionalthermostatic actuation simply realize the control commands,whereas in our case, additional computation are performed atthe actuators to modify the received control commands beforerealizing them.

2) Estimating the Total Power Consumption: We note firstthat the setpoint control loop is closed only over the aggregatetotal power Ptotal(t) and not the individual homes’ powerdraws, thus requiring no intrusive sensing of every home. TheLSE only needs to measure or estimate Ptotal(t) in real time,for the AC population it manages.

Using the technique of differential privacy [17], we nowshow how this can be estimated even if the population of

Fig. 5. A schematic for the privacy preserving sensing architecture for theLSE to measure the real-time aggregate power Ptotal(t) for controlling thesetpoints of N ACs it manages. Each AC, at any given time, consumes eitherzero or Pe power. For small ε > 0 and fixed p ∈ (0, 1), each home adds locali.i.d. noise from Gamma( 1

pN, εpPe

), to the individual consumption at time t,and then transmits the noisy data with probability p. The sum of the reportedconsumptions, is first scaled by 1

p, then perturbed further by subrtactive noise

ν ∼ Exp( εPe

), and the resulting value Ptotal(t) is sensed by the LSE. Thisguarantees (Appendix A) that at the LSE level, the individual consumptiondata remains ε-differentially private, while the data transmitted by each ACremains secure against eavesdropping.

customers for the LSE constitutes only a subset of the totalpopulation whose consumption is being measured at a distribu-tion substation. The ith customer’s home, with fixed probabilityp, reports a noise corrupted version Pi(t) := Pi(t) + ni ofits power consumption Pi(t) to the LSE at time t, whereni ∼ Gamma( 1

pN ,εpPe

)’s are chosen independently and iden-tically distributed by the homes. The probability p ∈ (0, 1)satisfies pN = N , where N is the number of customers’homes that report consumption to the LSE. From this, the LSEgenerates an estimate of total consumption for its populationof customers Ptotal(t) = Ptotal(t) − ν, where Ptotal(t) :=N

N

∑Ni=1 Pi(t), and ν ∼ Exp( ε

Pe). It can be shown (Appendix

A) that Ptotal(t) := N

N

∑Ni=1 Pi + n, where the additive zero

mean noise random variable n ∼ Lap(Pe

ε ), and the standarddifferential privacy formulation for the sum query ensures thatan adversary would not be able to infer the N×1 consumptionvector (P1(t), . . . , PN (t))

> ∈ 0, PeN , at any time t, if itwere to snoop Ptotal(t). Also, even if Pi(t) are eavesdropped,the same ε-level of global differential privacy can be attainedby this local implementation of differential privacy (differentfrom the local differential privacy [18], [19]), as shown in Fig.5. In Section V, we will computationally analyze the tradeoffbetween privacy and tracking performance.

3) Performance of the LSE’s Strategy: Since computingP ref

total(t) depends on both price and ambient temperatureforecasts π(t) and θa(t), the LSE’s plan, and consequentlythe tracking performance during real time setpoint velocitycontrol, are affected by the uncertainties in these forecasts,as well as the uncertainties in real time ambient temperatureθa(t). Let Ω be the set of all tuples of forecasted price, fore-casted and real time ambient temperatures. Then each forecastscenario ω ∈ Ω refers to a triplet of correlated trajectories(π(ω, t), θa(ω, t), θa(ω, t)), and engenders an effective widthstochastic process for the ith AC’s band at time t, denoted

Page 5: Architecture and Algorithms for Privacy Preserving Thermal ...

5

hereafter as weff (i, ω, t), given by

weff (i, ω, t) := Uit − Lit = ∆i

[2−

∣∣∣∣ ∫ t

0

v(ω, ς)dς

∣∣∣∣]+

, (6)

where the last equality results from substituting (4) and(5) for Lit and Uit respectively, followed by some algebra(Appendix B). To statistically quantify the performance of theLSE’s control strategy, we observe that the limit of controlperformance for the ith AC, is

ξT (ω) :=1

Tlimε↓0

1

ε

∫ T

0

10≤weff(i,ω,t)<ε dt, (7)

which is the normalized local time [21] for the effectivewidth stochastic process. In words, the random variable ξT (ω)measures the fraction of time ith AC remains inflexible overthe fixed horizon [0, T ], for a scenario ω ∈ Ω. Notice that(7) does not depend on i, which is a consequence of (3), i.e.,zero effective width epochs are synchronized among all ACs.In Section V, we will compute ξT (ω) for different forecastscenarios of (π(ω, t), θa(ω, t), θa(ω, t)), available from thehistorical data.

4) Assumptions: We make the following assumptions.

• The ambient temperature trajectories θa(t), θa(t), andthe price forecast π(t) are positive smooth (continuouslydifferentiable) functions of time t.

• ACs are necessary, i.e., for all t ∈ [0, T ], we haveθa(t), θa(t) > maxi=1,...,N Ui0.

• Without loss of generality, the initial indoor temperaturesθi0 := θi(0) ∈ [Li0, Ui0], for all i = 1, . . . , N .

5) Operational Planning: We now address how the ref-erence trajectory P ref

total(t) can be chosen so as to minimizethe cost to the LSE. We suppose that the LSE is exposedto a price forecast π(t) over [0, T ] from a day-ahead market.Suppose that the LSE serves N homes with comfort tolerances∆iNi=1. Further, for simplicity of exposition, we assume thateach AC in the population, when ON, draws same thermalpower P . The homes may have different thermal coefficients(α, β), and the LSE only knows a joint distribution ρα,β acrossthe population of its customers. To provision an optimal aggre-gate consumption profile P ref

total(t) over the time window [0, T ],the LSE makes its decision based on a price forecast π(t)available from the energy market, energy budget E availablefrom the load forecast, and predicted ambient temperaturetrajectory θa(t) available from the weather forecast. This isdepicted as the “first layer” in Fig. 3.

For i = 1, . . . , N , let the indicator variable ui(t) ∈ 0, 1denote whether the ith AC is ON/OFF at time t. Let nON(t)denote the number of ACs that are ON at time t. Sincethe aggregate electrical power drawn by the AC populationat time t is Pe(t) = P

η nON(t) = Pη

∑Ni=1 ui(t), and the

procurement cost for total energy consumption over [0, T ] is∫ T0P ref

total(t)π(t)dt, the LSE’s objective is to

minimizeu1(t),...,uN (t)∈0,1N

P

η

∫ T

0

π(t)

N∑i=1

ui(t) dt, (8)

3.7 4.6

0.01

0.04

Norm

alize

dhis

togra

m

↵ (103 seconds1) (103 CkW seconds

)

7.4 9.2

Fig. 6. Normalized histograms for α ∼ N (µα, 0.1µα, 0.9µα, 1.1µα) (left),and for β ∼ N

(µβ , 0.1µβ , 0.9µβ , 1.1µβ

)(right), with µα = 1

RCh-1,

µβ = 1C

C/kWh, used to generate the heterogeneous population of thermalinertial loads.

Fig. 7. Initial conditions for N = 500 homes, for four different contractualcomfort tolerance (∆) distributions, shown left to right. The red circles denoteON (σ0 = 1), and the blue circles denote OFF (σ0 = 0) initial states.

subject to the constraints

θi(t) = −αi(θi(t)− θa(t)

)− βiPui(t), (9)

P

η

∫ T

0

N∑i=1

ui(t) dt = E, (10)

Li0 ≤ θi(t) ≤ Ui0, (11)

where [Li0, Ui0] := [si0−∆i, si0 +∆i], and i = 1, . . . , N . Wenotice that the dynamics constraints (9) and the comfort rangeconstraints (11) are decoupled, while the cost function (8) andthe energy budget constraint (10) are coupled. The constraint(10) provides a modeling flexibility for the LSE, in case a totalenergy budget E > 0 is available from load forecast.

Equations (8)–(11) represent a continuous time deter-ministic optimal control problem. Denoting its solution asu∗i (t)Ni=1, expressed as an open-loop optimal control, theoptimal reference consumption is given by P ref

total(t) =Pη

∑Ni=1 u

∗i (t). In Section V, we will follow a “discretize-then-

optimize” approach to numerically solve (8)–(11).6) Feasibility of the Planning Problem: Let τ := ηE

P ,and notice that constraint (10) imposes a necessary feasibility

Page 6: Architecture and Algorithms for Privacy Preserving Thermal ...

6

Fig. 8. Left top: Increasing day-ahead price forecast πDA(t) as a piecewise constant function for each hour, with τ := ηEP

shown; left bottom: the correspondingoptimal indoor temperature θ∗(t), and ON/OFF control u∗(t) obtained by first discretizing (8)–(11) for a single AC, and then solving the resulting MILP(using Gurobi) and its LP relaxation (using MATLAB). In this simulation, [L0, U0] = [20C, 30C], the ambient forecast is constant, i.e., θa(t) ≡ 32C,and the parameters α, β, P, η are from Table 1, p. 1392 in [6]. Right: The optimal consumption trajectory P ref

total(t) computed from the MILP and its LPrelaxation, for the planning problem shown in the left.

condition

0 ≤ τ :=τ

NT=

ηE

NPT≤ 1. (12)

Given an ambient forecast θa(t) and parameters of the TCLpopulation, to respect constraint (11), τ is restricted to

0 ≤ τ ` ≤ τ ≤ τu ≤ 1, (13)

where τ ` := τ`NT = ηE`

NPT , and τu = ηEu

NPT . Here, E`(resp. Eu) is the aggregate energy consumed if the in-door temperatures for each home in the population wereto be restricted at their private upper (resp. lower) setpointboundaries, thus resulting in the lowest (resp. highest) totalenergy consumption while respecting (11). In other words,E` = P

η

∑Ni=1

∫ T0ui(t) dt, where the corresponding con-

trols are ui(t) = αi

βiP(θa(t) − Ui0), and hence τ ` =

1NP (

∑Ni=1

αi

βi(〈θa〉 − Ui0)), where 〈θa〉 := 1

T

∫ T0θa(t) dt.

Similar calculation yields τu = 1NP (

∑Ni=1

αi

βi(〈θa〉 − Li0)).

Equation (13) gives the necessary and sufficient conditionsfor feasibility of the planning problem (8)–(11). Notice that ifthe constraint (10) is inactive, then P

η

∫ T0

∑Ni=1 u

∗i dt = E`.

Also, note that (13) is equivalent to the energy inequalityEmin ≤ E` ≤ E ≤ Eu ≤ Emax, where Emin := 0 andEmax := NPT

η . For privacy preserving planning purpose, asearlier, the LSE can use noisy estimates and random samplesfor the initial conditions of the AC states (si0, θi0, σi0)Ni=1.Similarly, the thermal coefficient parameters (αi, βi)

Ni=1 can

be sampled from ρα,β .

IV. PRICING THE CONTRACTS

To address the issue of how the LSE can estimate the costof a contract for an individual home with a given flexibility∆, we employ a sensitivity analysis approach. The LSE cansimply calculate the cost (8) with and without an additional

customer of the given type. Assuming the LSE has an existingcustomer population of N ACs, let the optimal value of (8) beJ∗ :=

∫ T0π(t)P ref

total(t) dt. Recall that π(t) has unit $/MWh,and for T = 24 hours, J∗ (in $) denotes the daily energyprocurement cost. For i = 1, . . . , N , let J∗−i denote the optimalvalue of (8) with the ith AC removed from the population.Clearly, J∗−i > J∗, and the increase in per day cost J∗−i − J∗represents the marginal value ($/day) of an AC with comforttolerance ∆i. Thus, the LSE can use the graph of J∗−i−J∗ asfunction of ∆i, as a price chart for the thermal inertial loadmanagement service. When an individual AC, as new customerto the LSE, specifies its choice of comfort tolerance, this graphwill determine the price of the new contract between the LSEand the AC. This will be illustrated further in Section V.

V. NUMERICAL RESULTS

A. Parameters and Simulation Setup

Fig. 9. The day-ahead forecasted ambient temperature θa(t) (dashed blue),real-time ambient temperature θa(t) (solid blue), the day-ahead forecastedprice of energy πDA(t) (dashed green), and real-time price of energy πRT(t)(solid green) data used in Section V-B.

Page 7: Architecture and Algorithms for Privacy Preserving Thermal ...

7

(kp, ki, kd) (kp, ki, kd)

(a.1) (a.2)

(a.3) (a.4)

(b.1) (b.2)

(b.3) (b.4)

Fig. 10. (a) The setpoint tracking performance for the PID velocity controller implemented without (4) and (5); and (b) the same with (4) and (5), for differentcombinations of PID gain tuple (kp, ki, kd), shown as different colors in the legend box at the top. The four subfigures, denoted as (a.1)–(a.4) and (b.1)–(b.4),refer to four different contractual ∆ distributions mentioned in Section V-A.

Following Table 1 (p. 1392) in [6], we fix the thermalresistance R = 2C/kW, the thermal capacitance C = 10kWh/C, the thermal power drawn by an ON AC as P =14 kW, and the load efficiency η = 2.5. We choose thedistribution of thermal coefficient parameters as truncatedGaussians (Fig. 6), given by α ∼ N (µα, 0.1µα, 0.9µα, 1.1µα)and β ∼ N (µβ , 0.1µβ , 0.9µβ , 1.1µβ), with µα = 1

RC h-1,µβ = 1

CC/kWh. We consider a population of N = 500

homes, a time horizon of T = 24 hours, and suppose thatthe consumers have comfort tolerances (∆) between ∆min =0.1C and ∆max = 1.1C. We investigate four cases: (i) theentire population of customers has identical ∆ ≡ 1C, (ii)the population has i.i.d. uniform ∆ over [∆min,∆max], (iii)the population has i.i.d. right triangular ∆ distribution over[∆min,∆max] with peak at ∆max, (iv) same as (iii) but withpeak at ∆min. Intuitively, in case (iii) (case (iv)), there aremore homes with large (small) ∆, and the population offershigher (lower) flexibility for the LSE’s control strategy.

We sample the initial conditions (si0, θi0) from a bivariateGaussian N (µ0,Σ0), with mean vector µ0 = (20, 20)> and

covariance matrix Σ0 =

[1 0.5

0.5 3

], subject to the constraint

si0 − ∆i ≤ θi0 ≤ si0 + ∆i, where the comfort tolerancesamples ∆i are drawn from distributions according to case (i)-(iv), and i = 1, . . . , N . For each tuple (si0, θi0) thus generated,we assign σi0 = 1 or 0 with probability 0.5. The resultinginitial conditions are shown in Fig. 7.

B. Case Studies

1) Direct Numerical Solution of the Planning Problem: Toelucidate the numerical solution of (8)–(11), let us considerN = 1 home with [L0, U0] = [20C, 30C], θ0 = 25C,constant ambient temperature forecast θa(t) = 32C, day-ahead price forecast πDA(t) and τ as shown in Fig. 8,left top. We discretize (8)–(11) with ∆t = 1 minute time

step size, and use Euler discretization for the ODE (9), totranscribe the optimal control problem (8)–(11) as a mixedinteger linear programming (MILP) problem in decision vectorθ(1), u(1), . . . , θ(T ), u(T ). In Fig. 8 left bottom and right,we compare the MILP solution, computed using Gurobi [20],with the solution of its linear programming (LP) relaxation,computed using MATLAB. Intuitively, since πDA(t) is in-creasing, it is optimal to stay ON during [0, τ ], and OFFthereafter. We observe that (θ∗MILP(t), u∗MILP(t)) matches with(θ∗LP(t), u∗LP(t)) except at times t ∈ [thit, τ ], where thit isthe first hitting time to L0. In particular, during [thit, τ ], thesolution θ∗MILP(t) (resp. θ∗LP(t)) chatters (resp. slides) along L0.In the chattering period, u∗MILP(t) switches between 0 and 1 atevery time step, and as shown in Fig. 8 right, u∗MILP(t) ∈ 0, 1averaged over the chattering period yields u∗LP(t) ∈ [0, 1], i.e.,the proper fractional values of u∗LP(t) can be interpreted as thefraction of time the AC remains ON during [thit, τ ].

For N homes with 1 minute time step size, the planningproblem requires solving an MILP in 24×60×N×2 variables,and in our numerical experiments with Gurobi, solving theMILP even for N = 2 was found to have more than 24hours of CPU runtime. Armed with the physical meaning ofthe LP relaxation discussed above, in this paper, we solve(8)–(11) under control convexification (u1(t), . . . , uN (t)) ∈0, 1N 7→ (u1(t), . . . , uN (t)) ∈ [0, 1]N . This LP relaxationallows us to compute for large N (e.g. N = 500 in 10 minutesCPU time of which only 36 seconds are needed to run the LPsolver), which is of interest from the LSE’s perspective.

2) Planning and Setpoint Control for Actual Data: Wenow apply the LSE’s strategy proposed in this paper, tothe day-ahead price forecast πDA(t) data for Houston onAugust 10, 2015, available [22] from ERCOT. Further, weuse Houston weather station data, for day-ahead forecastedambient temperature θa(t) on August 10, 2015, and for realtime ambient temperature θa(t) on August 11, 2015. With

Page 8: Architecture and Algorithms for Privacy Preserving Thermal ...

8

TABLE IENERGIES (IN MWH) MENTIONED IN SECTION III-6, ASSOCIATED WITH

THE OPTIMAL PLANNING PROBLEM IN SECTION V-B2. THE GRAYCOLUMNS SHOW THE REAL TIME CONTROLLED (Ec) AND

UNCONTROLLED (Eunc) ENERGY CONSUMPTIONS IN MWH.

∆ cases Emin E` E Ec Eunc Eu Emax

1.0

0

21.5088

22.4

22.4681 25.6821 26.3328

67.20.1 1.1

22.1496 22.4485 25.6905 26.6778

0.1 1.121.9287 22.4690 25.7193 25.9663

0.1 1.122.5625 22.4299 25.0748 25.2126

Fig. 11. Tracking performance of the PID setpoint velocity controller withlocal implementation of differential privacy, as described in Section III-2,with ε = 0.1, p = 0.9, and (kp, ki, kd) = (10−4, 10−6, 10−4). Theblack curve above is the same as that in Fig. 10(b.2), i.e., P ref

total(t) for ∆uniformly distributed in [0.1, 1.1]C. Different colored Ptotal(t) correspondto 10 different realizations of the noise random variable n.

these price and ambient temperature data (Fig. 9), and usingthe parameter values in Section V-A, we first solve the day-ahead planning problem described in Section III-5 to designthe optimal aggregate consumption, and then track that ref-erence consumption in real time via setpoint velocity controldescribed in Section III-1. As in Section V-B1, the planningproblem is solved with time step size equal to 1 minute,and with τ = 1

3 , which is feasible from (13). The setpointvelocity control is implemented with a smaller time step sizeof 1 second, to emulate the actual dynamics possibly beingdifferent from the model used in planning computation.

In Fig. 10, two sets of four subfigures, labeled as (a.1)–(a.4)and (b.1)–(b.4), are shown. The subfigures (a.1)–(a.4) (resp.(b.1)–(b.4)), show the tracking performance of the setpointvelocity controller (3) in the absence of noise n, without (resp.with) enforcing the comfort range constraints (11) in real timevia (4) and (5). The four subfigures in each set correspondto the four contractual cases mentioned in Section V-A. Theblack curve in each subfigure denotes P ref

total(t) obtained bysolving the discretized LP for the control convexified (seeSection V-B1) version of (8)–(11) with the correspondinginitial conditions and parameters. As shown in Table I, for

t (hours)

Pto

tal(t)

(kW

)

(a)

t (hours)

(b)

Fig. 12. Tracking performance of the PID setpoint velocity controller with(kp, ki, kd) = (10−4, 10−6, 10−4), and black curves P ref

total(t) same as inFig. 10(b.2) and 11, when individual consumption data at each time are(a) corrupted by ±10% i.i.d. uniform noise about the true values, and (b)both noise corrupted as in (a) as well as incomplete data reported due tocommunication by (each time randomly selected) 400 out of N = 500 homes.The blue curves are the controlled real-time aggregate consumption. There isno significant difference in the tracking performance between those shownabove and the same in Fig. 10(b.2) and 11.

each contractual case, E :=∫ T

0P ref

total(t) dt satisfies the energyinequality mentioned in Section III-6. The gray columns inTable I show the actual consumptions

∫ T0Ptotal(t) dt with and

without PID control.Different colored Ptotal(t) trajectories in Fig. 10 correspond

to different combinations of the PID gain tuple, shown in thetop legends. In both sets (a.1)–(a.4) and (b.1)–(b.4), the realtime aggregate consumption Ptotal(t) trajectories, in general,show more oscillation than the optimal P ref

total(t), due to dif-ferent time scales for operational planning (1 minute) andreal time tracking (1 second); the gain tuple (kp, ki, kd) =(10−4, 10−6, 10−4) (shown in maroon), in general, performsbetter than others. Fig. 10 (a.1)–(a.4) show almost perfect realtime tracking for all four ∆ distributions, since the movementof the comfort boundaries are unrestricted. In the presenceof (4) and (5), as shown in (b.1)–(b.4), the tracking accuracyis limited compared to (a.1)–(a.4), and differs for differentcontractual comfort (∆) distributions.

In subfigure (b.1), all ACs have identical ∆ ≡ 1C, andhence identical weff(t) for all t. Notice that about 16 hoursonward, P ref

total(t) is decreasing, and to follow it in real time, theLSE moves all ACs’ setpoints up at identical rates, resultingin all hitting their respective upper boundaries Ui0 simultane-ously at around 20 hours. Between 20–23 hours, weff(t) = 0at Ui0, and Ptotal(t) cannot track further decrease in P ref

total(t),as seen in subfigure (b.1). In subfigures (b.2)–(b.4), unlike(b.1), the setpoint boundaries for different ∆i are moved atdifferent rates. In (b.3) (resp. (b.4)), more ACs have large (resp.small) ∆i, thus allowing the LSE more (resp. less) flexibility inreal time tracking, and result in less (resp. more) overshootsin Ptotal(t). Comparing Fig. 10(b.2) with Fig. 11, it is seenthat the privacy for individual consumptions can be preservedvia local noise injection described in Section III-2, withoutaffecting the tracking performance. Since the setpoint velocitycontrol is reactive to error in the aggregate consumption, hencethe tracking performance is robust against outliers, noise,and/or incompleteness in individual consumption data. In otherwords, the robustness observed in Fig. 11 is typical in thesense that individual noise statistics or incomplete data doesnot significantly affect the aggregate tracking performance, asevidenced in Fig. 12.

To demonstrate the statistical performance of the LSE’s

Page 9: Architecture and Algorithms for Privacy Preserving Thermal ...

9

5 PM

Fig. 13. We use historical data for 30 days in August 2015, to generate 30 scenarios of θa(ω, t) (top left), θa(ω, t) (top right), πDA(ω, t) (bottom left), foranalyzing the performance of the LSE’s strategy. The corresponding P ref

total(ω, t) sample paths are shown in the bottom right.

strategy, as discussed in Section III-3, we take the historicaldata for forecasted day-ahead price and ambient temperaturefor 30 days in August 2015, and use these as the scenarioset Ω. One specific scenario ω ∈ Ω, refers to a trajec-tory tuple (πDA(ω, t), θa(ω, t), θa(ω, t)) that yields P ref

total(ω, t)and ξT (ω) (see (7)). For ω ∈ Ω, Fig. 13 shows all sce-narios (πDA(ω, t), θa(ω, t), θa(ω, t)), and the correspondingP ref

total(ω, t) for ∆ uniformly distributed between [0.1, 1.1]Cwith respective initial conditions and parameters mentionedin Section V-A, and τ = 0.45 feasible for all ω ∈ Ω. Fig.14 shows that for most scenarios, the normalized local timeξT (ω) is close to unity, meaning that under the proposedstrategy for the LSE, each AC would have zero effectivewidths for more than 90% of times in a day, as expected inhot days in Houston.

In Fig. 15, we plot results for the sensitivity analysisdescribed in Section IV, with the data shown in Fig. 9, for∆ uniformly distributed in [0.1, 1.1]C. The red line in Fig.15 is the least squares linear fit for the scattered data, and canbe used to price the contract with a new home for its chosencomfort tolerance ∆. As expected intuitively, a smaller ∆ leads

to higher per day service charge, and vice versa.

C. Computational Complexity

The computational complexity of the proposed method istwofold: that of the optimal planning, and that of the setpointcontrol. The first being an offline computation, scales as a func-tion of both the number of homes N , and the discretization-length µ :=

⌈T∆t

⌉of the time horizon [0, T ], where ∆t is the

discretization step-size for the ODE (9). The setpoint controlbeing an online computation, scales as a function of N .

As described in Section V-B1, Euler discretization for ODE(9) leads to an LP in decision vector θ1(1), u1(1), θ2(1),u2(1), . . . , θN (1), uN (1), . . . , θN (µ), uN (µ) of length 2Nµwith Nµ + 1 equality constraints and 2Nµ inequality con-straints. Here, θi (k) and ui(k) respectively denote the indoortemperature and optimal control for the ith home at time t =k∆t, where i = 1, . . . , N , and k = 1, . . . , µ. We solved thisLP via MATLAB linprog using Mehrotra’s implementationof primal-dual interior point solver [23], that has worst-casecomplexity polynomial in Nµ. For our particular instance oflinear program and for ∆t = 1 minute (i.e., µ = 1440), the

Page 10: Architecture and Algorithms for Privacy Preserving Thermal ...

10

runtime complexity scaling with N is shown in Fig. 16. Itis easy to verify that executing equations (3), (4) and (5) forreal-time setpoint control, requires O(N) runtime complexity.

The LPs for computing optimal reference power consump-tion trajectories, were solved in MATLAB R2015a runningon Dell PC with 3.4 GHz Intel i7-2600 processor and 16GB memory. The same platform was used for solving theMILP mentioned in Section V-B1 using Gurobi. All othersimulations including setpoint velocity control were performedin MATLAB R2013a running on a Macbook Pro with 2.6 GHzIntel Core i5 processor and 8 GB memory.

VI. CONCLUSION

We have presented an architecture and control algorithmsfor an aggregator or load serving entity managing a pop-ulation of thermal inertial loads. The proposed hierarchicalarchitecture solves the twin problems of minimum cost energyprocurement from the day-ahead market, and real-time setpointcontrol to track the reference aggregate power trajectory thatcorresponds to the optimal energy procurement. The controlalgorithms respect privacy and contractual comfort at theindividual consumer level, but can be implemented at theaggregate level. We demonstrate these algorithms using theday-ahead price data from ERCOT, and using the forecastedand real time ambient temperature data from a weather stationin Houston, Texas. Future work will investigate the potential ofsuch contracts as innovative business models for load servingentities.

APPENDIX ADIFFERENTIALLY PRIVATE ESTIMATE OF TOTAL POWER

At time t, let us consider two consumption vectorsc(t), c′(t) ∈ 0, PeN . We call two consumption vectorsneighboring if they differ by at most one element. Then,for any neighboring consumption pair c(t), c′(t), and forsum query SUM : 0, PeN 7→ 0, Pe, 2Pe, . . . , NPe, wehave supc(t),c′(t) |SUM(c(t)) − SUM(c′(t))| ≤ Pe. Hence,ε-differential privacy [17] at the LSE level is guaranteed ifPtotal(t) =

∑Ni=1 Pi + n, where n ∼ Lap

(Pe

ε

).

To see that the strategy proposed in Section III-2 achievesε-differential privacy, notice that ni ∼ Gamma( 1

pN ,εpPe

) ⇒1pni ∼ Gamma( 1

pN ,εPe

), and since N = pN , we have n :=∑Ni=1

1pni ∼ Exp( ε

Pe). We thus arrive at

Ptotal(t) = Ptotal(t)− ν =1

p

N∑i=1

Pi(t) + (n− ν), (14)

where the first term 1p

∑Ni=1 Pi(t) provides an estimate for

the true aggregate consumption∑Ni=1 Pi(t); the second term

n := n− ν ∼ Lap(Pe

ε ) since n, ν are i.i.d. Exp( εPe

).

APPENDIX BDERIVING EQUATION (6)

For a, b, x ∈ R, recall that

(a+ x) ∧ (b+ x) = (a ∧ b) + x, (15)(a− x) ∨ (b− x) = (a ∨ b)− x, (16)

− (0 ∧ a) = [−a]+, (17)

0.000

Fig. 14. The normalized local time random variable ξT (ω) (see (7)) is shownas a function of the 30 scenarios described in Fig. 13.

Fig. 15. The scatterplot with blue circles denotes the increase in per dayenergy procurement cost, if an AC with comfort tolerance ∆i, is removedfrom the existing population of 500 ACs, as described in Section IV. The redline is the least squares linear fit that the LSE can use for pricing the contractof a new home.

and hence we can rewrite (4) and (5) as

Lit(16)= (si0 + ∆i) ∧ [(si0 ∨ si(ω, t))−∆i]

(15)= si0 ∧ [(si0 ∨ si(ω, t))− 2∆i]+ ∆i, (18)

Uit(15)= (si0 −∆i) ∨ [(si0 ∧ si(ω, t)) + ∆i]

(16)= si0 ∨ [(si0 ∧ si(ω, t)) + 2∆i] −∆i. (19)

This results weff(i, ω, t) := Uit − Lit = T1 − T2 − 2∆i,where T1 := si0 ∨ [(si0 ∧ si(ω, t)) + 2∆i], and T2 :=si0 ∧ [(si0 ∨ si(ω, t))− 2∆i].

If∫ t

0v(ω, ς)dς > 0, then si(ω, t) > si0,⇒ T1 = si0 ∨

[si0 + 2∆i] = si0 + 2∆i, and T2 = si0 ∧ [si(ω, t)− 2∆i] =

si0 ∧[si0 + ∆i

∫ t0v(ω, ς)dς − 2∆i

](15)= si0 + ∆i0 ∧

Page 11: Architecture and Algorithms for Privacy Preserving Thermal ...

11

35

30

25

20

15

10

5

1 2 3 4 5

N (×102 homes)

CPU

time(seconds)

Fig. 16. CPU time (in seconds) needed to execute MATLAB linprog forsolving the planning problems for N = 100, 200, 300, 400 and 500 homes,corresponding to case (iv) in Section V-B2. The CPU time data for other casesare almost identical to the one shown, and omitted for brevity. The horizontalaxis is in logarithmic scale while the vertical axis is in linear scale.

[∫ t

0v(ω, ς)dς − 2]. This yields

weff(i, ω, t) = −∆i

(0 ∧

[∫ t

0

v(ω, ς)dς − 2

])(17)= ∆i

[2−

∫ t

0

v(ω, ς)dς

]+

. (20)

On the other hand, if∫ t

0v(ω, ς)dς ≤ 0, then si(ω, t) ≤

si0,⇒ T1 = si0 ∨ (si(ω, t) + 2∆i) = si0 ∨ (si0 +∆i

∫ t0v(ω, ς)dς + 2∆i), and T2 = si0 ∧ (si0 − 2∆i) =

si0 − 2∆i, resulting

weff(i, ω, t) = [si0 ∨ (si0 + ∆i

∫ t

0

v(ω, ς)dς + 2∆i)]− si0

(16)= ∆i

[2 +

∫ t

0

v(ω, ς)dς

]+

. (21)

Combining (20) and (21), we arrive at (6).

REFERENCES

[1] D.S. Callaway, and I.A. Hiskens, “Achieving Controllability of ElectricLoads”. Proceedings of the IEEE, Vol. 99, No. 1, pp. 184–199, 2011.

[2] U.S. Energy Information Administration, “Residential Energy Con-sumption Survey 2009”. http://www.eia.gov/consumption/residential/index.cfm, accessed on May 3, 2016.

[3] M.C. Caramanis, R.E. Bohn, and F.C. Schweppe, “Optimal Spot Pricing:Practice and Theory”. IEEE Transactions on Power Apparatus andSystems, Vol. PAS-101, No. 9, pp. 3234–3245, 1982.

[4] C.-Y. Chong, and A.S. Debs, “Statistical Synthesis of Power SystemFunctional Load Models”. Proceedings of the 18th IEEE Conference onDecision and Control including the Symposium on Adaptive Processes,No. 18, pp. 264–269, 1979.

[5] R. Malhame, and C.-Y. Chong, “Electric Load Model Synthesis by Dif-fusion Approximation of a High-Order Hybrid-State Stochastic System”.IEEE Transactions on Automatic Control, Vol. 30, No. 9, pp. 854–860,1985.

[6] D.S. Callaway, “Tapping the Energy Storage Potential in Electric Loadsto Deliver Load Following and Regulation, with Application to WindEnergy”. Energy Conversion and Management, Vol. 50, No. 5, pp. 1389–1400, 2009.

[7] S. Bashash, and H.K. Fathy, “Modeling and Control Insights intoDemand-side Energy Management through Setpoint Control of Thermo-static Loads”. Proceedings of the 2011 American Control Conference, pp.4546–4553, 2011.

[8] J.L. Mathieu, S. Koch, and D.S. Callaway, “State Estimation and Con-trol of Electric Loads to Manage Real-time Energy Imbalance”. IEEETransactions on Power Systems, Vol. 28, No. 1, pp. 430–440, 2013.

[9] W. Zhang, J. Lian, C.-Y. Chang, and K. Kalsi, “Aggregate Modelingand Control of Air Conditioning Loads for Demand Response”. IEEETransactions on Power Systems, Vol. 28, No. 4, pp. 4655–4664, 2013.

[10] A. Ghaffari, S. Moura, and M. Krstic, “Analytical Modeling and IntegralControl of Heterogeneous Thermostatically Controlled Load Popula-tions”. ASME 2014 Dynamic Systems and Control Conference, Paper No.DSCC2014-6022, pp. V002T22A002; 8 pages, 2014.

[11] S. Meyn, P. Barooah, A. Busic, Y. Chen, and J. Ehren, “Ancillary Serviceto the Grid using Intelligent Deferrable Loads”. IEEE Transactions onAutomatic Control, Vol. 60, No. 11, pp. 2847–2862, 2015.

[12] A. Halder, X. Geng, G. Sharma, L. Xie, and P.R. Kumar, “A ControlSystem Framework for Privacy Preserving Demand Response of ThermalInertial Loads”. Proceedings of the 2015 IEEE International Conferenceon Smart Grid Communications (SmartGridComm), pp. 181–186, 2015.

[13] Summer Discount Plan of Southern California Edison in California,http://tinyurl.com/zly97mt, accessed on Sep. 21, 2016.

[14] Saver’s Switch Program of Xcel Energy in Colorado, Minnesota andWisconsin, http://tinyurl.com/z4zayh7, accessed on Sep. 21,2016.

[15] Energy Wise Rewards Program in Maryland and District of Columbia,http://tinyurl.com/z5pov8s, accessed on Sep. 21, 2016.

[16] Power Partner Thermostats of Austin Energy in Texas, http://tinyurl.com/zbvzhyb, accessed on Sep. 21, 2016.

[17] C. Dwork and A. Roth, The Algorithmic Foundations of DifferentialPrivacy, Foundations and Trends in Theoretical Computer Science, NowPublishers, Delft, The Netherlands, 2014.

[18] S.L. Warner, “Randomized Response: A Survey Technique for Elimi-nating Evasive Answer Bias”. Journal of the American Statistical Asso-ciation, Vol. 60, No. 309, pp. 63–69, 1965.

[19] J.C. Duchi, M.I. Jordan, and M.J. Wainwright, “Local Privacy andStatistical Minimax Rates”. 54th IEEE Annual Symposium on Foundationsof Computer Science, pp. 429–438, 2013.

[20] Gurobi Optimization, Inc., “Gurobi Optimizer Reference Manual”.http://www.gurobi.com, 2015.

[21] M. Marcus, and J. Rosen, Markov Processes, Gaussian Processes, andLocal Times. 1st ed., Cambridge University Press, 2006.

[22] Electric Reliability Council of Texas (ERCOT) day-ahead price data.http://tinyurl.com/z3gmvt6, accessed on Feb. 23, 2016.

[23] S. Mehrotra, “On the Implementation of a Primal-Dual Interior PointMethod”. SIAM Journal of Optimization, Vol. 2, No. 4, pp. 575–601,1992.

Abhishek Halder (S’10-M’14) received the B.Tech. and M. Tech. degrees in aerospace engineeringfrom IIT Kharagpur in 2008, and the Ph.D. degreein aerospace engineering from Texas A&M, CollegeStation, TX, USA, in 2014. He is a PostdoctoralResearch Associate at the Department of Electricaland Computer Engineering, Texas A&M University.His research interest is in systems, control andoptimization with focus on large-scale cyberphysicalsystems such as the smart grid and aerial swarmrobotics. He received the 2014 Outstanding Doctoral

Student Award from Texas A&M and the 2008 Best Thesis Award from IIT,both in Aerospace Engineering.

Xinbo Geng (S’14) received the B.E. degree in elec-trical engineering in 2013 from Tsinghua University,Beijing, China, and the Master of Science degreefrom the Department of Electrical and Computer En-gineering at Texas A&M University in 2015, wherehe is currently working toward the Ph.D. degree. Hisresearch interests include demand response, electric-ity markets and data analytics in power system.

Page 12: Architecture and Algorithms for Privacy Preserving Thermal ...

12

P. R. Kumar (F’88) received the B. Tech. degreefrom IIT Madras, Chennai, India, in 1973, and theD.Sc. degree from Washington University, St. Louis,MO, USA, in 1977. He was a faculty memberat UMBC (19771984) and University of Illinois,Urbana-Champaign (19852011). He is currently atTexas A&M University. His current research is fo-cused on stochastic systems, energy systems, wire-less networks, security, automated transportation,and cyberphysical systems.

He is a member of the US National Academyof Engineering and The World Academy of Sciences. He was awarded aDoctor Honoris Causa by ETH, Zurich. He has received the IEEE FieldAward for Control Systems, the Donald P. Eckman Award of the AACC,Fred W. Ellersick Prize of the IEEE Communications Society, the OutstandingContribution Award of ACM SIGMOBILE, the IEEE Infocom AchievementAward, and the SIGMOBILE Test-of-Time Paper Award. He is a Fellow ofIEEE and an ACM Fellow. He was Leader of the Guest Chair Professor Groupon Wireless Communication and Networking at Tsinghua University, is a D.J. Gandhi Distinguished Visiting Professor at IIT Bombay, and an HonoraryProfessor at IIT Hyderabad. He was awarded the Distinguished AlumnusAward from IIT Madras, the Alumni Achievement Award from WashingtonUniv., and the Daniel Drucker Eminent Faculty Award from the College ofEngineering at the Univ. of Illinois.

Le Xie (M’10-SM’16) received the B.E. degreein electrical engineering from Tsinghua University,Beijing, China, in 2004, the S.M. degree in engineer-ing sciences from Harvard University, Cambridge,MA, USA, in June 2005, and the Ph.D. degreefrom the Electric Energy Systems Group (EESG),Department of Electrical and Computer Engineering,Carnegie Mellon University, Pittsburgh, PA, USA,in 2009. He is an Associate Professor in the De-partment of Electrical and Computer Engineering atTexas A&M University, where he is affiliated with

the Electric Power and Power Electronics Group. His research interest includesmodeling and control of large scale complex systems, smart grid applicationsin support of renewable energy integration, and electricity markets.