Trusting the Solver

When you have worked through the formulation traps of the previous pages and the benchmark-readiness flags, the remaining trap is numerical, not physical. This page is about the last question a validator asks: how much should I trust what Ipopt just told me?

How to read this page

Same split as the main note: two audiences share this page.

Building or curating a dataset? Read the Takeaway boxes and the trust checklist at the end. The short version: once your bounds are sane, your objective is off the loss-maximization list, and the benchmark flags are clear, solver statuses become useful hypotheses to verify: multi-start and a feasibility relaxation strengthen an infeasibility diagnosis, while primal residual checks establish whether a locally solved point is a valid operating point.
Validating a formulation? Read everything. The two headline rules are: a local infeasibility status is not an infeasibility certificate, and a local optimum is not a global optimum. Sections 2–6 explain what additional evidence can justify greater confidence without changing those facts.

The two claims, up front

After the physics traps are excluded:

INFEASIBLE means this solver trajectory did not reach feasibility. Ipopt entered restoration, minimised constraint violation locally, and could not drive it to zero. Repeated starts and a consistent slack-current pattern strengthen the diagnosis but do not prove the feasible set is empty.
LOCALLY_SOLVED means Ipopt satisfied its approximate first-order termination tests. Interpreting that point as a regular KKT point requires constraint-qualification evidence; interpreting it as a local minimizer requires additional second-order evidence. A high-voltage start and a non-decreasing generation-cost objective often favour an operational branch, but this does not establish either claim, much less global optimality. Only a valid global bound — for example from an exact relaxation or global solver — can establish the last one.

Four questions that must remain separate

Primal feasibility: does the reported state satisfy the original AC equations and bounds to an engineering-relevant tolerance?
Local optimality and regularity: are the first-order residuals small, does a constraint qualification such as LICQ hold, and is the Lagrangian Hessian positive on the feasible critical directions?
Voltage-sheet classification: under a declared load/control continuation, is the power-flow state on the intended upper sheet, away from the relevant saddle-node?
Global optimality: does a valid lower bound match the objective of an independently AC-feasible point?

None of these answers implies the next. In particular, high voltage or an upper-sheet certificate does not prove local/global OPF optimality; LICQ does not prove that a KKT point is a minimizer or that the minimizer is unique; and a strict local minimum need not be global.

1. What Ipopt's verdicts actually certify

Takeaway

Ipopt is a local interior-point solver. LOCALLY_SOLVED reports that its termination tests for approximate first-order conditions passed. Under an appropriate constraint qualification those residuals support a KKT interpretation; without one they are solver termination evidence, not a theorem that the point is a local minimizer. In either case they do not establish a global optimum. LOCALLY_INFEASIBLE ("Converged to a locally infeasible point") reports that Ipopt's restoration phase reached a local minimiser of constraint violation with violation still above tolerance. Independently inspect primal residuals before treating either status as evidence about the represented system.

Ipopt solves a sequence of barrier subproblems with a filter line search (Wächter & Biegler, 2006). When a step cannot make progress toward both feasibility and optimality, it switches to a feasibility restoration phase that ignores the objective and minimises the constraint violation. The two terminal messages map onto this machinery directly:

LOCALLY_SOLVED — Ipopt's reported first-order residual and constraint violation are both below tolerance at its terminal point.
LOCALLY_INFEASIBLE — restoration converged to a local minimiser of infeasibility whose residual is still positive: Ipopt got as close to feasible as it locally could, and that was not close enough.

Derivation: why 'locally infeasible' is a one-sided signal on a nonconvex set

On a convex program, a point of minimal-but-positive constraint violation proves the feasible set is empty: the violation is a convex function and a local minimiser is global. On a nonconvex program that implication breaks. A locally infeasible point only certifies that from this trajectory Ipopt could not reach feasibility; a different start might. The honest reading is the one in the interior-point literature: converging to an infeasible stationary point leaves it "unclear whether the problem is truly infeasible or whether the algorithm was unable to find a feasible solution" (Hinder & Ye, 2018). Methods that do return a first-order certificate of local infeasibility exist, but they are specially constructed; stock Ipopt does not hand you one.

The practical upshot is the whole reason this page exists: you cannot lift INFEASIBLE to a proof for free, but you can accumulate reproducible evidence by excluding alternative explanations — which is Sections 2 through 6.

2. Building evidence for physical infeasibility

Takeaway

Full operational bounds and a positive voltage floor can make the search region bounded and remove common collapse/zero-voltage pathologies (§3 and §4). They do not make the problem convex or make restoration exhaustive. Treat agreement across starts, formulations, and residual diagnostics as evidence, not as a binary proof.

The main note's §4 makes the physical case sharp: with constant-power loads, the edge of the AC feasible region is the loadability boundary, and beyond the nose the equations have no real solution — genuine infeasibility, not a modelling slip. So an INFEASIBLE on a heavily loaded sub-network is frequently the model telling you the truth.

The hedge is nonconvexity: restoration is start-dependent. Two cheap cross-checks promote the signal toward certainty:

Multi-start. Re-solve from several materially different starts (flat, high-voltage, a linear-model warm start). If every start lands in restoration with a comparable residual, confidence in the diagnosis increases; one independently verified feasible point disproves infeasibility — see Symptom 5.
The slack-current measure. solve_feasibility_opf adds an elastic slack current at every non-source terminal and minimises its norm. For a converged relaxed solve, a non-zero total_slack_magnitude_A localises where that local solution uses residual current. Unlike an IIS for a convex/linear problem, it does not certify that no zero-slack solution exists elsewhere.

3. Why a local solve often reaches the high-voltage branch

Takeaway

Some radial single-phase results establish useful uniqueness or attraction properties for the high-voltage power-flow solution under stated conditions. Those results motivate a high-voltage start and a loss/cost-minimising objective here. They do not establish uniqueness or global optimality for the meshed, multiphase, unbalanced OPFs this engine also targets.

This is the optimistic mirror of §2 and §5. On a radial network the high-voltage solution is the last one to vanish as the system loads toward its limit, and the standard computational routes return exactly it when one exists (Dvijotham, Mallada & Simpson-Porco, 2017, a radial, single-phase result). A loss-minimising objective can favour that branch (§5). For a four-wire unbalanced feeder this is a useful initialisation heuristic and modelling analogy, not a probability statement or a theorem that carries over (Bernstein et al., 2018). Globality remains an open claim until a valid lower bound closes the optimality gap.

Upper-sheet local minima can still coexist

A plausible voltage profile, a normal branch-angle screen, and an upper-sheet classification remove important pathological explanations; they do not make the OPF landscape convex. Distinct dispatches and active sets can remain as separate locally optimal basins while every retained voltage is operationally ordinary. Bukhsh et al. give documented multiple-local-solution AC-OPF examples (2013). Therefore use a high-voltage warm start to seek an operational candidate, not to infer that the candidate is unique.

Derivation: what an actual globality certificate would require

Attraction to a familiar branch is not a theorem about your specific instance. A genuine certificate comes from one of two places:

An exact convex relaxation. Solve the SOC/SDP relaxation, then confirm exactness (Diagnostics Symptom 3). Exactness means that a relaxation optimum can be recovered as an AC-feasible global optimum; it does not imply that the global minimizer is unique. If a valid relaxation lower bound matches the objective of your independently AC-feasible point, that point is globally optimal.
A global optimization method that brackets the global optimum between a feasible upper bound (any AC-feasible point) and a relaxation lower bound, and drives the gap to zero — surveyed in the note below.

Absent either, treat LOCALLY_SOLVED as a candidate operating point. Verify primal feasibility, local optimality/regularity, and voltage-sheet classification separately. A low-voltage branch is an important failure mode, but it is not the only way a clean local-solver termination can fall short of the claim you want.

Cross-formulation agreement: useful, but not a gate

ACP, ACR, and IVR are coordinate formulations of the same AC physics only when they encode the same variables after elimination, objective, bounds, angle conventions, and branch-rating semantics. Agreement among equivalent implementations is valuable robustness evidence; disagreement is a prompt to audit model equivalence and conditioning. It is not necessary for all three formulations to discover every basin: a local minimum reproduced in one formulation by an independent implementation remains scientifically interesting.

Compare the same optimization problem. In particular, replacing |S| <= S_max by |I| <= S_max / V_ref is exact only at V_ref. Across variable voltages the feasible sets and active faces differ, so different local minima may be a genuine consequence of different rating models. See Current vs. apparent-power limits.

Why there is no cheap certificate: AC OPF is NP-hard

The absence of a free globality certificate is fundamental, not a tooling gap. AC OPF is a nonconvex, NP-hard optimization problem, and the hardness does not come from the objective or from network size alone: even deciding AC feasibility*** — is there *any operating point at all — is **NP-hard even on radial / tree networks (Lehmann, Grastien & Van Hentenryck, 2016) and strongly NP-hard in general (Bienstock & Verma, 2019). The tree result is the pointed one here: the distribution feeders this package targets are precisely where one might hope topology buys tractability, and it does not. So a polynomial-time local solver such as Ipopt cannot, in general, hand you a certificate of globality or of infeasibility — which is exactly why this page is framed as calibrated trust, and why a certificate, when you need one, costs a relaxation-exactness check or a global solve.

If you do need a certificate: global OPF in practice

When the deliverable is a proof of the global optimum — certifying a benchmark reference value rather than trusting it — the tools live outside BMOPFTools (which ships only the local nonconvex engine) and form a small, well-characterised toolbox. All of them bracket the optimum between a feasible upper bound (any AC-feasible point, e.g. your Ipopt solution) and a relaxation lower bound, then close the gap:

Moment / Lasserre SDP hierarchies. Cast ACOPF as polynomial optimization and climb a hierarchy of SDP relaxations that converges to the global optimum; the second-order moment relaxation already closes many cases the first-order SDP leaves open (Molzahn & Hiskens, 2014). Critical limit: the semidefinite blocks grow steeply, so only sparsity / clique decomposition keeps it tractable, and even then it caps out at moderate network sizes.
Optimization-based bound tightening (OBBT) and valid cuts. Iteratively shrink variable bounds by solving auxiliary relaxations and add valid inequalities. Cheap and parallelizable — the workhorse that makes everything else practical — but it tightens the gap rather than closing it on its own.
Spatial branch-and-bound. Partition the nonconvex space and bound each piece with a convex relaxation, yielding a certified global optimum at exponential worst-case cost. Alpine.jl (Nagarajan et al., 2019) is the open Julia implementation; general global solvers (BARON, SCIP, Gurobi) do the same.
The QC relaxation (Coffrin, Hijazi & Van Hentenryck, 2016) — a tractable strengthening sitting between SOC and SDP, the relaxation of choice inside bound-tightening and branch-and-bound.

The state of the art combines all four: Gopinath et al. (2020) close the optimality gap on the standard ACOPF benchmark libraries (PGLib) by pairing SDP-based bound tightening with valid cuts. These methods can certify globality, but they are NP-hard in the worst case (above), do not yet scale to large feeders, and are not what this package ships. Reach for them — your own, or the ecosystem's via to_pmd — only when a proof is the actual deliverable; for everything else, the trust checklist is the right tool.

4. Residual trap A — degeneracy of the added models

Takeaway

Degeneracy is a constraint-qualification failure: the gradients of the active constraints stop being linearly independent. Its symptoms are slow convergence and non-unique or blown-up duals (shadow prices, sensitivities). Primal feasibility is a separate question: a small independently recomputed residual can still validate the represented operating point, but degeneracy prevents a routine KKT/local-optimality interpretation. Treat the dispatch as a feasible candidate and the prices or sensitivities as unsupported until the degeneracy is resolved.

Augmenting a case — adding generators, fixing a dispatch, pinning a regulator — is exactly where degeneracy creeps in. The classic example is an over-determined bus: a generator pinned to a single operating point (p_min = p_max) sitting at a bus whose voltage is also fixed by a hard equality. At the solution, several active constraints have linearly dependent gradients, and the Lagrange multipliers are no longer unique.

A second, entirely avoidable cause is a redundant constraint — an equation that carries no information because the others already imply it. Unlike the over-determined bus, which fails LICQ only on a measure-zero parameter set, a structural redundancy breaks it at every feasible point, so it never solves cleanly.

Don't bolt a system-wide power balance onto nodal KCL

The nodal power-balance (KCL) equations are linearly dependent by construction: summing them over all terminals telescopes the internal flows and leaves the global conservation identity

\[\sum_i S_i \;=\; \sum_g S^g \;-\; \sum_d S^d \;-\; \text{losses}.\]

So a "sanity" constraint $\sum_g S^g = \sum_d S^d + \text{losses}$ added on top of full per-terminal KCL is already implied — its gradient row is a linear combination of the KCL rows. LICQ then fails everywhere: duals become non-unique, and the interior-point iteration stalls or terminates with diverging iterates (NORM_LIMIT) on a problem that is otherwise perfectly well posed. This is the same redundancy that makes classical transmission OPF drop the slack-bus balance and let the reference absorb the mismatch (cycle-flow formulations); in this package the slack source plays that role, so the global balance is never needed. The same trap recurs in miniature whenever an equality duplicates information already present — pinning a reference bus's voltage magnitude on top of its rectangular fixes, or grounding a neutral the source already fixes to zero. Fix: delete the redundant equation; do not regularise around it.

Concept: LICQ, MFCQ, and what they do not prove

The linear independence constraint qualification (LICQ) asks that the gradients of the active constraints be linearly independent at the solution. At a differentiable local minimizer, LICQ supplies KKT multipliers and makes that multiplier vector unique. The weaker Mangasarian–Fromovitz CQ (MFCQ) supplies a nonempty bounded multiplier set, but not necessarily a unique vector. Interior-point convergence analysis leans on regularity of this kind: when even MFCQ fails, the dual iterates can diverge and the solve crawls (on multiplier behaviour in infeasible IPMs).

These are statements about constraint geometry and multipliers. LICQ does not imply that a stationary point is a local minimizer, that a local minimizer is unique, or that it is global. It also does not detect whether one nominal network contains weakly coupled or independent subnetworks; that is a separate graph/control-structure audit.

For AC OPF, LICQ holds generically — it fails only on a measure-zero set of parameter values, a fact made precise with tools from differential topology by Hauswirth, Bolognani, Hug & Dörfler (2018), who show the LICQ is satisfied almost everywhere and unique multipliers therefore exist generically. The trouble is that augmentation deliberately steers you onto that set: identical generator costs, zero-cost generators, and pinned injections are exactly the structured coincidences that make active-constraint gradients dependent. This is why these are caught structurally before you solve, by the benchmark- readiness flags W.BENCH.GEN_NO_DOF, W.BENCH.GEN_ZERO_COST, and W.BENCH.GEN_DEGENERATE_COST (Methodology § Benchmark readiness); a zero-cost generator's non-coercive objective surfaces at runtime as diverging iterates (NORM_LIMIT) or an unbounded-objective termination — the runtime echo of W.BENCH.GEN_ZERO_COST.

From a KKT point to a local minimum

First-order KKT conditions are necessary under a suitable constraint qualification, but they are also satisfied by some saddles. A conventional numerical audit therefore checks curvature of the Lagrangian on the critical cone (the feasible first-order directions), not the unconstrained Hessian. A positive second-order sufficient-condition margin supports a strict isolated local minimum; it still says nothing about globality. OPF-specific work explicitly distinguishing computed KKT points from local optima includes Wang & Chiang (2023).

The trust message: clear the W.BENCH.GEN_* flags, keep redundant equations out of your formulation, and you remove common avoidable sources of degeneracy. Where it remains, read it as a warning about local-optimality claims, prices, and sensitivities; independently verify primal feasibility and compare materially different starts (Symptom 5).

5. Residual trap B — smoothness loss and the zero-voltage bifurcation

Takeaway

The bilinear power map $p = v_r c_r + v_i c_i$ is smooth — products of variables are $C^\infty$. The danger near zero voltage is twofold: (a) the map's Jacobian rank drops when the voltage factor vanishes, so the current it multiplies becomes indeterminate — a bifurcation of the solution set, and a constraint-qualification failure; and (b) voltage-dependent load models are genuinely non-smooth as voltage → 0. Keep voltages away from zero and both disappear.

Bilinear is not the same as non-smooth

It is tempting to call the bilinear power equations "non-smooth," but they are not — a product $xy$ is infinitely differentiable everywhere. Two distinct effects masquerade as non-smoothness:

(a) Rank-loss / bifurcation. In the constant-power constraint $p = v_r c_r + v_i c_i$, the partial derivatives with respect to the current are $(v_r, v_i)$. When the voltage factor $\to 0$, that gradient vanishes: the current is no longer pinned by the power equation, so any current satisfies it. The solution set bifurcates and LICQ (§4) fails. The function is smooth; its Jacobian is rank-deficient.
(b) Genuine non-smoothness. ZIP and exponential load models are non-smooth at zero. The exponential form realises $P \propto (W / V_{\text{nom}}^2)^{\gamma/2}$ with $W = v_r^2 + v_i^2$, and the constant-current term needs $s = \sqrt{W}$. For $\gamma < 2$ the derivative of $x^{\gamma/2}$ blows up as $x \to 0$; $\sqrt{x}$ has an infinite slope at the origin. These are real singularities, not rank artefacts.

Derivation: the Hessian blow-up of a fractional power

For $f(x) = x^{\gamma/2}$ with $0 < \gamma < 2$, $f''(x) = \tfrac{\gamma}{2} \!\left(\tfrac{\gamma}{2}-1\right) x^{\gamma/2 - 2}$, whose magnitude $\to \infty$ as $x \to 0^+$ because the exponent $\gamma/2 - 2 < -1$. An interior-point method building the Lagrangian Hessian then sees unbounded curvature, takes vanishing steps, and churns in restoration — the symptom in Trap 8. The fix is to bound the argument away from zero: BMOPFTools floors $W$ at $(\texttt{\_W\_FLOOR\_FRAC} \cdot V_{\text{nom}})^2$ and $s$ correspondingly (see load.jl), so the load model never reaches its singular point. The volt-var / volt-watt droop curves are smoothed the same way, with softplus corners rather than hard ReLU kinks (Smooth droop encoding).

6. Residual trap C — zero voltage in power–voltage formulations

Takeaway

Allowing $|V| = 0$ admits a spurious all-zero solution ($S = 0$ for any current) and excites the constant-power $1/V$ current singularity. Keep a strictly positive voltage floor — even in collapse studies, where you drop the operational lower bound but never lower it to literally zero.

In the bus-injection model $S_i = V_i \sum_j Y_{ij}^* V_j^*$, the all-zero voltage profile $V = 0$ gives $S = 0$ trivially — a feasible point of the power-flow equations that is physically meaningless. With the IVR formulation the same degeneracy appears through §5(a): at $v_r = v_i = 0$ the bilinear power equation collapses to $0 = 0$ for any current, so an ungrounded or islanded sub-network can drift its whole voltage to zero. Conversely, a constant-power load demands $i = (S/V)^*$, so as $|V| \to 0$ the required current $\to \infty$ — the feasible set is non-compact in the current variables and the constraints become ill-conditioned (Molzahn, Lesieutre & DeMarco, 2013).

Reconciling with the collapse-study advice

§4 of the main note tells you to drop the voltage lower bound to study loadability — and that is right, but it means dropping the operational bound (e.g. $0.9$ p.u.), not setting it to zero. The low-voltage branch you want to expose lives well above zero; the all-zero solution of this section is a different, spurious object. BMOPFTools' feasibility OPF keeps this distinction concretely: it retains the case's own (strictly positive) voltage bounds unchanged and relaxes only nodal current balance, so infeasibility surfaces as localised slack currents rather than as a collapsed voltage solution (see the infeasibility diagnosis tutorial).

7. A trust checklist

Work top to bottom; each step removes one alternative explanation for the solver's verdict.

Before you trust the verdict

Benchmark-readiness flags clear? No W.BENCH.GEN_*, no degeneracy flags (Methodology). Clears §4.
No redundant constraints? No equation implied by the others — in particular no system-wide power balance on top of nodal KCL (§4).
Bounds sane and collapse excluded? Full operational box, a strictly positive voltage floor (§6), and you are not deliberately on the loadability boundary (§4).
Objective off the loss-max list? Loss/cost-minimising, non-decreasing in generation (loss-maximization list).
Load models away from their singular point? Voltage floor in place so fractional ZIP exponents stay smooth (§5).
Compared models genuinely equivalent? Same objective, bounds, angle semantics, and current/apparent-power rating model before interpreting formulation agreement or disagreement.
Multi-start agrees? Same verdict, comparable objective, no distinct physical cluster across several starts (Symptom 4–5).

Then read the verdict this way

INFEASIBLE after steps 1–7 ⇒ report a strengthened but still local infeasibility diagnosis; show the multi-start outcomes and localise the residual with solve_feasibility_opf.
LOCALLY_SOLVED after steps 1–7 ⇒ treat it as a candidate operating point after independently checking primal feasibility. For a local minimum claim, add a CQ/critical-cone curvature audit. For an upper-sheet claim, add a declared continuation test. For a global claim, require a matching valid lower bound (Symptom 3).
Slow / churning / suspicious duals ⇒ you are in Section 4, 5, or a collapse regime; localise with Symptom 5 before trusting any number.