{'fraction_non_alphanumeric': 0.0536480686695279, 'fraction_numerical': 0.012127714917414488, 'mean_word_length': 4.161436482631314, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Architecture and Algorithms for Privacy Preserving Thermal Inertial Load Management by A Load Serving Entity

Motivated by the growing importance of demand response in modern power system's operations, we propose an architecture and supporting algorithms for privacy preserving thermal inertial load management as a service provided by the load serving entity (LSE). We focus on an LSE managing a population of its customers' air conditioners, and propose a contractual model where the LSE guarantees quality of service to each customer in terms of keeping their indoor temperature trajectories within respective bands around the desired individual comfort temperatures. We show how the LSE can price the contracts differentiated by the flexibility embodied by the width of the specified bands. We address architectural questions of (i) how the LSE can strategize its energy procurement based on price and ambient temperature forecasts, (ii) how an LSE can close the real time control loop at the aggregate level while providing individual comfort guarantees to loads, without ever measuring the states of an air conditioner for privacy reasons. Control algorithms to enable our proposed architecture are given, and their efficacy is demonstrated on real data.


I. INTRODUCTION
I N traditional power systems, the role of feedback control has primarily been concentrated on the generation side where the demand side variability is dynamically matched via operating reserve. As more renewables are being integrated into the power grid to reduce carbon footprint, a new operational paradigm is emerging. Unlike fossil fuels, generation from renewables such as solar and wind, cannot be directly controlled. Thus, large scale renewable integration requires moving from control of the supply to control of the demand. This necessitates a collection of mechanisms, termed as demand response, for manipulating aggregate demand to offset the supply side variability. Thermal inertial loads such as air conditioners (ACs) are one of the primary candidates [1] for control on the demand side. They contribute to 48% of U.S. annual residential consumption [2], and are potential enablers for demand response due to their ability to store energy and defer consumption without perceptible change in end-user functionality.
In this paper, we consider an aggregator or load serving entity (LSE) managing a finite population of residential ACs through direct load control [1], [3]. We address three distinct problems that are important for designing a direct load control architecture, viz. (1) how to control a population of thermal inertial loads to guarantee quality of service such as comfort bounds for homes, (2) how to achieve such control while preserving the privacy of the loads' states from the LSE, and (3) what to control the aggregate consumption to, so that the cost of serving the collection of loads is minimized. Our strategy effectively produces demand response from the collection of homes according to how their temperatures are distributed within their comfort zones at any given time, without attempting to squeeze it from each and every home.
Holistically maintaining individual home privacy while still generating demand response that respects home comfort constraints does not seem to have been addressed in the literature. Previous works on thermal inertial load management [4]- [11] have focused on obtaining an aggregate model for a population of loads, and then used the resulting model, or an approximation of it, to track a given reference power trajectory. The purpose of this paper is to present a comprehensive architecture and algorithms (Section III) so that the LSE can manage a population of thermal inertial loads while addressing the three questions mentioned in the preceding paragraph. We address the first two problems by proposing a modelfree setpoint velocity control algorithm (Section III-1). We formulate and solve (Section III-5) the third as an open-loop optimal control problem. We also quantify (Section III-3) the statistical performance of the LSE's strategy under random perturbations that entail different real-time energy usage than planned in the day-ahead market. We show (Section IV) how the LSE can price the contracts differentiated by the flexibility provided by the customers with respect to their comfort requirements, and illustrate (Section V) all our algorithms on day-ahead price forecast data from the Electric Reliability Council of Texas (ERCOT), and ambient temperature data from a weather station in Houston, Texas.
Notations: The notation x ∼ ρ means that the random vector x follows joint density function ρ(x). We use the shorthand Lap(κ) to denote the zero mean Laplace density function with scale parameter κ > 0, Gamma(a, b) to denote the Gamma density with parameters a, b > 0, Exp(λ) to denote exponential density with rate λ > 0, and N (µ, Σ) to denote the Gaussian density with mean µ and covariance Σ. We use N (µ, σ, a, b) to denote a truncated univariate Gaussian density with mean µ and standard deviation σ, supported on [a, b]. The symbols ∨ and ∧ denote the maximum and minimum, respectively, and [r] + := 0∨r, for any r ∈ R. The notation 1 S denotes the indicator function of a set S, while the abbreviation i.i.d. stands for "independent and identically distributed". II. MODEL Fig. 1. Thermal inertial dynamics of an AC, not under direct load control, is shown with fixed setpoint s 0 , and a comfort temperature interval [L 0 , U 0 ] with range 2∆, where U 0 = s 0 + ∆ and L 0 = s 0 − ∆. The ambient temperature trajectory is θa(t). The indoor temperature trajectory θ(t) ∈ [L 0 , U 0 ] consists of alternating OFF (blue, up-going) and ON (red, down-going) segments, as shown, where the boundaries L 0 and U 0 act as reflecting barriers for the ON and OFF segments, respectively.

A. Dynamics of Thermal Inertial Load
In this paper, we consider the ambient temperature is high enough that ACs are cooling homes, a situation of the sort where demand response is appropriate. We denote the indoor temperature at time t by θ(t), and the ambient temperature by θ a (t). At time t = 0, an occupant privately sets a temperature s 0 , called setpoint, with a willingness to tolerate at most ±∆ temperature deviation from s 0 , thus defining a temperature comfort range [L 0 , U 0 ] := [s 0 − ∆, s 0 + ∆]. The flexibility of an AC is measured by 2∆; larger the flexibility, greater the potential for demand response. The goal of the proposed architecture and algorithms is to enable the LSE exploit this flexibility without the LSE being aware of the load temperature θ(t) or the setpoint s 0 , or even ∆.
The dynamics of an AC not under direct load control, is shown in Fig. 1. When the AC is OFF, the indoor temperature θ(t) rises exponentially toward θ a (t) until it hits the upper comfort limit U 0 , at which point the AC turns ON. Once ON, θ(t) decreases exponentially until it hits the lower comfort limit L 0 , at which point the AC turns OFF. Let us denote the mode of an AC at time t by σ(t) = 1(0), signifying if it is ON (OFF). Its hysteretic switching trajectory is The indoor temperature dynamics of the home is governed bẏ where the parameters α, β > 0 denote the heating time constant and thermal conductivity, respectively. Here, P denotes the amount of thermal power drawn by the AC when it is ON (σ(t) = 1). The electrical power drawn, P e , is related to the thermal power P , via the formula P e = P η , where the parameter η > 0 denotes the efficiency of the AC.

B. Direct Load Control Strategy
In this paper, we propose an architecture where the setpoint of an individual AC will be changed over time by the LSE through a control strategy. The rate of change of setpoint s(t) will constitute a "control variable" that can be used by the LSE. This velocity command, suitably modulated so that the comfort zone is never violated, can be followed by an AC locally without the LSE being aware of the load's chosen values of L 0 , U 0 or its current temperature θ(t). Yet, by squeezing the band close to the upper or lower limits, it can cause a certain fraction of loads to turn ON/OFF in response, thereby collectively invoking demand response. ACs that are ON with temperature trajectory headed downward can be intercepted by a rising lower boundary (L t ) to turn OFF. Similarly, ACs that are OFF with temperature trajectory headed upward can be intercepted by a falling upper boundary (U t ) and to force them turn ON. Thus, the demand response can induce less electricity consumption by issuing positive velocity commands, and it can also induce more cooling which allows storage of energy in the homes. This will be detailed in Section III-1.

C. Contracts
If a home agrees to allow the LSE to manage the energy consumption of its AC, the LSE is obligated to respect privacy in the sense that it may influence the consumption but should do so without ever measuring the state {s(t), θ(t), σ(t)} of any individual AC. Furthermore, the LSE must guarantee that the indoor temperature θ(t) lies within the home's comfort range [L 0 , U 0 ], at all times. These privacy and comfort range guarantees will constitute a contract between the LSE and an individual home. Larger the value of ∆, greater is the flexibility of the load that an LSE can potentially exploit in shaping demand response. The value of the contract therefore depends on the magnitude of ∆. A home may choose its tolerance ∆, and is charged lesser for electricity the larger ∆ it can tolerate. In Section IV, we will show how the LSE can determine the cost of providing electricity to a customer as a function of its flexibility ∆, which it can then use to determine how to price contracts.

D. Planning in the Day-Ahead Market
Much of the electricity purchase takes pace in the dayahead market. In Section III-5, we will show how the LSE can operationally plan the amount of energy to purchase in each of the 24 one-hour periods of the day-ahead market, so that it can support the loads at least cost. The goal of such planning is to ensure that the LSE purchases more energy at times when the day-ahead prices are low, and less energy in periods when day-ahead prices are high. The LSE must do so taking into consideration the flexibilities of the collection of homes and the need to keep their temperatures within their comfort zones.

III. MEASUREMENT AND CONTROL ARCHITECTURE AND
STRATEGY FOR THE LSE We propose a novel architecture (Fig. 2) and operational planning and control strategies for the LSE to manage a population of N ACs over a finite time interval [0, T ], subject to the contractual obligations, privacy constraints, and load dynamics constraints, and to do so at low cost to the LSE. Our strategy consists of a planning phase where the LSE contracts to purchase the optimal amount of energy at low cost in the day-ahead market so that it can support the aggregate load of the homes under contract. We term this operational planning. For t ∈ [0, T ], the LSE takes the measured real time total power consumption P total (t) as feedback to compute a control signal v(t) that it broadcasts to all homes, requesting the setpoint of the i th AC at time t, denoted as s i (t), be moved according to the velocity control policẏ Homes with different contractual ∆ i correspond to different comfort tolerances, and experience different setpoint velocities. The operational planning, followed by setpoint velocity control, comprise a two layer hierarchical strategy (Fig. 3) for the LSE, which we expound next.

1) Privacy Preserving Load Control:
We suppose that the day-ahead operational planning, to be detailed in Section III-5, has led to an optimal reference aggregate power consumption trajectory P ref total (t) for 0 ≤ t ≤ T . We now focus on the design of a real time privacy preserving setpoint velocity controller for the LSE so as to make the actual total power consumption P total (t) track the planned optimal target consumption P ref total (t). This corresponds to the "second layer" in Fig. 3. Assuming that the LSE can measure or estimate the aggregate output P total (t) in real time, define the error signal e(t) := P total (t) − P ref total (t). Then, a simple PID controller can generate a common velocity command for all homes v(t) := k p e(t)+k i t 0 e(ς)dς +k d de dt , with k p , k i , and k d being the proportional, integral, and derivative gains, respectively. We choose PID controller since it is easy to implement. Alternatively, one may use a model-based feedback controller for which the "number density" [10] of ON/OFF ACs is approximated in real time. As a model-free implementation, the PID controller obviates this difficulty.
The LSE broadcasts the common velocity command v(t) to Fig. 5. A schematic for the privacy preserving sensing architecture for the LSE to measure the real-time aggregate power P total (t) for controlling the setpoints of N ACs it manages. Each AC, at any given time, consumes either zero or Pe power. For small > 0 and fixed p ∈ (0, 1), each home adds local i.i.d. noise from Gamma( 1 pN , pPe ), to the individual consumption at time t, and then transmits the noisy data with probability p. The sum of the reported consumptions, is first scaled by 1 p , then perturbed further by subrtactive noise ν ∼ Exp( Pe ), and the resulting value P total (t) is sensed by the LSE. This guarantees (Appendix A) that at the LSE level, the individual consumption data remains -differentially private, while the data transmitted by each AC remains secure against eavesdropping. all homes. Upon receiving the LSE's broadcast, an individual home's AC moves its setpoint according to (3). At any given time, a home with larger comfort range moves its setpoint faster than the one with smaller range, and hence provides more flexibility to the LSE for reference tracking. To respect the contractual comfort guarantee Thus, the width of the time-varying bands expand (contract) when the aggregate power consumption needs to be increased (reduced). In Fig. 4, we show the deformation of the time- we notice that only the computation of v(t) is centralized, but the actuation (3), (4) and (5) are all decentralized.
2) Estimating the Total Power Consumption: We note first that the setpoint control loop is closed only over the aggregate total power P total (t) and not the individual homes' power draws, thus requiring no intrusive sensing of every home. The LSE only needs to measure or estimate P total (t) in real time, for the AC population it manages.
Using the technique of differential privacy [12], we now show how this can be estimated even if the population of customers for the LSE constitutes only a subset of the total population whose consumption is being measured at a distribution substation. The i th customer's home, with fixed probability p, reports a noise corrupted version P i (t) := P i (t) + n i of its power consumption P i (t) to the LSE at time t, where n i ∼ Gamma( 1 pN , pPe )'s are chosen independently and identically distributed by the homes. The probability p ∈ (0, 1) satisfies pN = N , where N is the number of customers' homes that report consumption to the LSE. From this, the LSE generates an estimate of total consumption for its population of customers P total (t) = P total (t) − ν, where P total (t) := where the additive zero mean noise random variable n ∼ Lap( Pe ), and the standard differential privacy formulation for the sum query ensures that an adversary would not be able to infer the N ×1 consumption vector (P 1 (t), . . . , P N (t)) ∈ {0, P e } N , at any time t, if it were to snoop P total (t). Also, even if P i (t) are eavesdropped, the same -level of global differential privacy can be attained by this local implementation of differential privacy (different from the local differential privacy [13], [14]), as shown in Fig.  5. In Section V, we will computationally analyze the tradeoff between privacy and tracking performance.
3) Performance of the LSE's Strategy: Since computing P ref total (t) depends on both price and ambient temperature forecasts π(t) and θ a (t), the LSE's plan, and consequently the tracking performance during real time setpoint velocity control, are affected by the uncertainties in these forecasts, as well as the uncertainties in real time ambient temperature θ a (t). Let Ω be the set of all tuples of forecasted price, forecasted and real time ambient temperatures. Then each forecast scenario ω ∈ Ω refers to a triplet of correlated trajectories ( π(ω, t), θ a (ω, t), θ a (ω, t)), and engenders an effective width stochastic process for the i th AC's band at time t, denoted hereafter as w eff (i, ω, t), given by where the last equality results from substituting (4) and (5) for L it and U it respectively, followed by some algebra (Appendix B). To statistically quantify the performance of the LSE's control strategy, we observe that the limit of control performance for the i th AC, is which is the normalized local time [16] for the effective width stochastic process. In words, the random variable ξ T (ω) measures the fraction of time i th AC remains inflexible over the fixed horizon [0, T ], for a scenario ω ∈ Ω. Notice that (7) does not depend on i, which is a consequence of (3), i.e., zero effective width epochs are synchronized among all ACs.

4) Assumptions:
We make the following assumptions.
• The ambient temperature trajectories θ a (t), θ a (t), and the price forecast π(t) are positive smooth (continuously differentiable) functions of time t. • ACs are necessary, i.e., for all t ∈ [0, T ], we have θ a (t), θ a (t) > max i=1,...,N U i0 . • Without loss of generality, the initial indoor temperatures θ i0 := θ i (0) ∈ [L i0 , U i0 ], for all i = 1, . . . , N . 5) Operational Planning: We now address how the reference trajectory P ref total (t) can be chosen so as to minimize the cost to the LSE. We suppose that the LSE is exposed to a price forecast π(t) over [0, T ] from a day-ahead market.
Suppose that the LSE serves N homes with comfort tolerances Further, for simplicity of exposition, we assume that each AC in the population, when ON, draws same thermal power P . The homes may have different thermal coefficients (α, β), and the LSE only knows a joint distribution ρ α,β across the population of its customers. To provision an optimal aggregate consumption profile P ref total (t) over the time window [0, T ], the LSE makes its decision based on a price forecast π(t) available from the energy market, energy budget E available from the load forecast, and predicted ambient temperature trajectory θ a (t) available from the weather forecast. This is depicted as the "first layer" in Fig. 3.
For i = 1, . . . , N , let the indicator variable u i (t) ∈ {0, 1} denote whether the i th AC is ON/OFF at time t. Let n ON (t) denote the number of ACs that are ON at time t. Since the aggregate electrical power drawn by the AC population at time t is P e (t) = P η n ON (t) = P η N i=1 u i (t), and the procurement cost for total energy consumption over subject to the constraintṡ where [L i0 , U i0 ] := [s i0 −∆ i , s i0 +∆ i ], and i = 1, . . . , N . We notice that the dynamics constraints (9) and the comfort range constraints (11) are decoupled, while the cost function (8) and the energy budget constraint (10) are coupled. The constraint (10) provides a modeling flexibility for the LSE, in case a total energy budget E > 0 is available form load forecast. Equations (8)-(11) represent a continuous time deterministic optimal control problem. Denoting its solution as {u * i (t)} N i=1 , expressed as an open-loop optimal control, the optimal reference consumption is given by P ref In Section V, we will follow a "discretize-thenoptimize" approach to numerically solve (8)- (11).
6) Feasibility of the Planning Problem: Let τ := ηE P , and notice that constraint (10) imposes a necessary feasibility condition Given an ambient forecast θ a (t) and parameters of the TCL population, to respect constraint (11), τ is restricted to where τ := τ N T = ηE N P T , and τ u = ηEu N P T . Here, E (resp. E u ) is the aggregate energy consumed if the indoor temperatures for each home in the population were to be restricted at their private upper (resp. lower) setpoint boundaries, thus resulting in the lowest (resp. highest) total energy consumption while respecting (11). In other words, where the corresponding controls are u i (t) = αi βiP ( θ a (t) − U i0 ), and hence τ = αi βi ( θ a − L i0 )). Equation (13) gives the necessary and sufficient conditions for feasibility of the planning problem (8)- (11). Notice that if the constraint (10) is inactive, then P η T 0 N i=1 u * i dt = E . Also, note that (13) is equivalent to the energy inequality E min ≤ E ≤ E ≤ E u ≤ E max , where E min := 0 and E max := N P T η . For privacy preserving planning purpose, as earlier, the LSE can use noisy estimates and random samples for the initial conditions of the AC states (s i0 , θ i0 , σ i0 ) N i=1 . Similarly, the thermal coefficient parameters (α i , β i ) N i=1 can be sampled from ρ α,β .

IV. PRICING THE CONTRACTS
To address the issue of how the LSE can estimate the cost of a contract for an individual home with a given flexibility ∆, we employ a sensitivity analysis approach. The LSE can simply calculate the cost (8) with and without an additional customer of the given type. Assuming the LSE has an existing Fig. 8. Left top: Increasing day-ahead price forecast π DA (t) as a piecewise constant function for each hour, with τ := ηE P shown; left bottom: the corresponding optimal indoor temperature θ * (t), and ON/OFF control u * (t) obtained by first discretizing (8)-(11) for a single AC, and then solving the resulting MILP (using Gurobi) and its LP relaxation (using MATLAB). In this simulation, [L 0 , U 0 ] = [20 • C, 30 • C], the ambient forecast is constant, i.e., θa(t) ≡ 32 • C, and the parameters α, β, P, η are from Table 1, p. 1392 in [6]. Right: The optimal consumption trajectory P ref total (t) computed from the MILP and its LP relaxation, for the planning problem shown in the left.
customer population of N ACs, let the optimal value of (8) be Recall that π(t) has unit $/MWh, and for T = 24 hours, J * (in $) denotes the daily energy procurement cost. For i = 1, . . . , N , let J * −i denote the optimal value of (8) with the i th AC removed from the population. Clearly, J * −i > J * , and the increase in per day cost J * −i − J * represents the marginal value ($/day) of an AC with comfort tolerance ∆ i . Thus, the LSE can use the graph of J * −i − J * as function of ∆ i , as a price chart for the thermal inertial load management service. When an individual AC, as new customer to the LSE, specifies its choice of comfort tolerance, this graph will determine the price of the new contract between the LSE and the AC. This will be illustrated further in Section V.

A. Parameters and Simulation Setup
Following Table 1 (p. 1392) in [6], we fix the thermal resistance R = 2 • C/kW, the thermal capacitance C = 10 kWh/ • C, the thermal power drawn by an ON AC as P = 14 kW, and the load efficiency η = 2.5. We choose the distribution of thermal coefficient parameters as truncated Gaussians (Fig. 6), given by α ∼ N (µ α , 0.1µ α , 0.9µ α , 1.1µ We consider a population of N = 500 homes, a time horizon of T = 24 hours, and suppose that the consumers have comfort tolerances (∆) between ∆ min = 0.1 • C and ∆ max = 1.1 • C. We investigate four cases: (i) the entire population of customers has identical ∆ ≡ 1 • C, (ii) the population has i.i.d. uniform ∆ over [∆ min , ∆ max ], (iii) the population has i.i.d. right triangular ∆ distribution over [∆ min , ∆ max ] with peak at ∆ max , (iv) same as (iii) but with peak at ∆ min . Intuitively, in case (iii) (case (iv)), there are more homes with large (small) ∆, and the population offers higher (lower) flexibility for the LSE's control strategy.
2) Planning and Setpoint Control for Actual Data: We now apply the LSE's strategy proposed in this paper, to the day-ahead price forecast π DA (t) data for Houston on August 10, 2015, available [17] from ERCOT. Further, we use Houston weather station data, for day-ahead forecasted ambient temperature θ a (t) on August 10, 2015, and for real time ambient temperature θ a (t) on August 11, 2015. With these price and ambient temperature data (Fig. 9), and using the parameter values in Section V-A, we first solve the dayahead planning problem described in Section III-5 to design the optimal aggregate consumption, and then track that reference consumption in real time via setpoint velocity control described in Section III-1. As in Section V-B1, the planning problem is solved with time step size equal to 1 minute, and with τ = 1 3 , which is feasible from (13). The setpoint velocity control is implemented with a smaller time step size of 1 second, to emulate the actual dynamics possibly being different from the model used in planning computation.
In Fig. 10 1)-(b.4)), show the tracking performance of the setpoint velocity controller (3) in the absence of noise n, without (resp. with) enforcing the comfort range constraints (11) in real time via (4) and (5). The four subfigures in each set correspond to the four contractual cases mentioned in Section V-A. The black curve in each subfigure denotes P ref total (t) obtained by solving the discretized LP for the control convexified (see Section V-B1) version of (8)- (11) with the corresponding initial conditions and parameters. As shown in Table I, for each contractual case, E := T 0 P ref total (t) dt satisfies the energy inequality mentioned in Section III-6. The gray columns in Table I show the actual consumptions T 0 P total (t) dt with and without PID control. Different colored P total (t) trajectories in Fig. 10 correspond to different combinations of the PID gain tuple, shown in the top legends. In both sets (a.1)-(a.4) and (b.1)-(b.4), the real time aggregate consumption P total (t) trajectories, in general, show more oscillation than the optimal P ref total (t), due to different time scales for operational planning (1 minute) and real time tracking (1 second); the gain tuple (k p , k i , k d ) = (10 −4 , 10 −6 , 10 −4 ) (shown in maroon), in general, performs better than others. Fig. 10 (a.1)-(a.4) show almost perfect real time tracking for all four ∆ distributions, since the movement of the comfort boundaries are unrestricted. In the presence of (4) and (5)  large (resp. small) ∆ i , thus allowing the LSE more (resp. less) flexibility in real time tracking, and result in less (resp. more) overshoots in P total (t). Comparing Fig.10(b.2) with Fig. 11, it is seen that the privacy for individual consumptions can be preserved via local noise injection described in Section III-2, without affecting the tracking performance. Fig. 11. Tracking performance of the PID setpoint velocity controller with local implementation of differential privacy, as described in Section III-2, with = 0.1, p = 0.9, and (kp, k i , k d ) = (10 −4 , 10 −6 , 10 −4 ). The black curve above is the same as that in Fig. 10(b.2), i.e., P ref total (t) for ∆ uniformly distributed in [0.1, 1.1] • C. Different colored P total (t) correspond to 10 different realizations of the noise random variable n.
To demonstrate the statistical performance of the LSE's strategy, as discussed in Section III-3, we take the historical data for forecasted day-ahead price and ambient temperature for 30 days in August 2015, and use these as the scenario set Ω. One specific scenario ω ∈ Ω, refers to a trajectory tuple ( π DA (ω, t), θ a (ω, t), θ a (ω, t)) that yields P ref total (ω, t) and ξ T (ω) (see (7)). For ω ∈ Ω, Fig. 12 shows all scenarios ( π DA (ω, t), θ a (ω, t), θ a (ω, t)), and the corresponding P ref total (ω, t) for ∆ uniformly distributed between [0.1, 1.1] • C with respective initial conditions and parameters mentioned in Section V-A, and τ = 0.45 feasible for all ω ∈ Ω. Fig.  13 shows that for most scenarios, the normalized local time ξ T (ω) is close to unity, meaning that under the proposed strategy for the LSE, each AC would have zero effective widths for more than 90% of times in a day, as expected in hot days in Houston.
In Fig. 14, we plot results for the sensitivity analysis described in Section IV, with the data shown in Fig. 9, for ∆ uniformly distributed in   (7)) is shown as a function of the 30 scenarios described in Fig. 12.
Fig. 14. The scatterplot with blue circles denotes the increase in per day energy procurement cost, if an AC with comfort tolerance ∆ i , is removed from the existing population of 500 ACs, as described in Section IV. The red line is the least squares linear fit that the LSE can use for pricing the contract of a new home.
14 is the least squares linear fit for the scattered data, and can be used to price the contract with a new home for its chosen comfort tolerance ∆. As expected intuitively, a smaller ∆ leads to higher per day service charge, and vice versa.
VI. CONCLUSION We have presented an architecture and control algorithms for an aggregator or load serving entity managing a population of thermal inertial loads. The proposed hierarchical architecture solves the twin problems of minimum cost energy procurement from the day-ahead market, and real-time setpoint control to track the reference aggregate power trajectory that corresponds to the optimal energy procurement. The control algorithms respect privacy and contractual comfort at the individual consumer level, but can be implemented at the aggregate level. We demonstrate these algorithms using the day-ahead price data from ERCOT, and using the forecasted and real time ambient temperature data from a weather station in Houston, Texas.
APPENDIX A DIFFERENTIALLY PRIVATE ESTIMATE OF TOTAL POWER At time t, let us consider two consumption vectors c(t), c (t) ∈ {0, P e } N . We call two consumption vectors neighboring if they differ by at most one element. Then, for any neighboring consumption pair c(t), c (t), and for sum query SUM : {0, P e } N → {0, P e , 2P e , . . . , N P e }, we have sup c(t),c (t) |SUM(c(t)) − SUM(c (t))| ≤ P e . Hence, -differential privacy [12] at the LSE level is guaranteed if P total (t) = N i=1 P i + n, where n ∼ Lap Pe . To see that the strategy proposed in Section III-2 achieves -differential privacy, notice that n i ∼ Gamma( 1 pN , pPe ) ⇒ 1 p n i ∼ Gamma( 1 pN , Pe ), and since N = pN , we have n := N i=1 1 p n i ∼ Exp( Pe ). We thus arrive at where the first term 1 p N i=1 P i (t) provides an estimate for the true aggregate consumption N i=1 P i (t); the second term n := n − ν ∼ Lap( Pe ) since n, ν are i.i.d. Exp( Pe ).