Resolving the impasse in emergency systemoperation

W.R. Lachs

Indexing terms: Power system protection, Control systems

Abstract: Elaborate control and monitoringstructures have been developed for power-systemoperation. The basic operating structure is hier-archically organised from the main control centre,with the added provision of numerous automaticand protective devices to assist operators in effec-tively controlling the power grid. Centralisedcontrol has proved effective under normal condi-tions and for a range of disturbances for which thepower system has been planned. However for dis-turbances of greater severity than allowed byplanning criteria, this edifice does not avert thethreat to the power system. By default, it isassumed that operators can control the conse-quences of these calamitous disturbances. Experi-ences throughout the world have shown thefallacy of this assumption. The threat of calami-tous system disturbances has been mostly tackledfrom the aspect of a centralised control. As shownin this paper, a number of insuperable difficultiesare created in adopting this approach. Instead, itis possible to utilise a method of distributed intel-ligence within the existing hierarchical controlstructure. This paper demonstrates not only thefeasibility of this approach, but how it canmonitor the system's dynamic reactions to controlthe after effects of the disturbances. This wouldallow developments enabling power systems tosuccessfully withstand calamitous disturbances.

1 Introduction

The operational structure of a power system is arrangedso that the oversight of the more serious disturbances isdirected to the operators at the main control centre.These operators have facilities to monitor conditionsthroughout the grid, but rarely have they access to directoperational control measures.

Support measures are provided to successfully safe-guard the system against major disturbances fallingwithin predetermined planning (or operating) criteria.However, for more onerous calamitous system dis-turbances, this operational structure has proven inade-quate.

Emergency operation following calamitous system dis-turbances presently creates an intractible problem. Withits system-wide effects, the development of automatic

Paper 5522C (P9, Pl l) , first received 1st December 1986 and in revisedform 21st April 1987The author resides at 7 Garnet Avenue, Lilyfield, New South Wales,Australia 2040

countermeasures must also involve operators if thesystem is to be quickly restored to normal. This, in turnrequires that the operators should have effective guidancefrom a small number of selected indicators — not at alllike the existing state of affairs when these disturbancescreate an overflow of information. Supplementing thisguidance, there must also be a number of special-purposecontrol measures made accessible to the operators.

The paper builds a foundation from which an effectiveattack can be mounted on this problem, and so providesthe perspective to overcome the present impasse in emer-gency system operation.

2 Enumeration of objectives

The first step in this task is the enumeration of the objec-tives that should be met in countering calamitous systemdisturbances.

2.1 Monitoring and control structureThe existing hierarchical structure has, at its apex, themain control centre which connects to the area controlcentres. Communication and control links extend furtherfrom the area control centres to substations and powerstations. Although system oversight is delegated to oper-ators at the main control centre, direct operationalcontrol tends to be limited to area control centres andlower levels of the hierarchy. As well as communicationlinks, computers and microprocessors are provided at allnodes of this hierarchy. The power system is contin-uously monitored and from this information, operatorshave oversight of the grid. A primary objective would bethe utilisation of the existing monitoring and controlstructure in new developments for controlling calamitoussystem disturbances — a new system protection.

2.2 System protectionOnto this system control and data acquisition structurethe new system protection must be appended, but unlikeother protections, this one needs to function in symbiosiswith the operators. Its task can further be subdividedinto:

(i) Automatic measures to meet the main impact of aseries of disturbances.

(ii) The provision of powerful follow-up measures,possibly operator actuated.

(iii) The provision of clearly comprehensible indica-tions to guide operators in restoring the network tonormal.

2.3 Viable system operationThe primary objective of this system protection is toensure continuing viable system operation following a

1EE PROCEEDINGS, Vol. 134, Pt. C, No. 5, SEPTEMBER 1987 331

calamitous disturbance, until such time as operators canagain have effective oversight and control of the powersystem.

2.4 Speedy restorationAs well as preventing a major collapse of the system, theprotection should aim to make the operators' task aseasy as possible when their control is resumed. Thisobjective can best be met by having all possible transmis-sion elements and rotating units maintained in operation,even at the expense of shedding selected loads. From thisnucleus, operators could more speedily restore normaloperation.

2.5 Practical criteriaThere are rigorous criteria to be met if an automaticsystem protection is to be practically acceptable, namely:

(a) it must function sufficiently swiftly to be effective(b) it must be reliable — function when needed(c) it must grade correctly with existing automatic

devices(d) it should be flexible(e) it should be relatively simpleif) it should not be too expensive.

3 Drawbacks of a centralised control

Within the existing hierarchy the most powerful com-puters are located at the main control centre particularlyto meet the needs of energy-management systems. A cen-tralised control against calamitous system disturbanceswould require the resolution of at least some of the fol-lowing tasks:

(i) prediction of the disturbance(ii) dynamic, real-time modelling of the system(iii) pattern recognition.

Their resolution must also meet the above practical cri-teria for a system protection. It is worth examining thetasks for a centralised control from this perspective.

3.1 Predictive approachA complete, predictive approach would consider all com-binations of disturbances. A power system with n ele-ments can have 2" different combinations of disturbances.Merely a 30-element network would have over a billiondifferent combinations. The mammoth extent of this taskcan be gauged when we consider that calamitous dis-turbances follow an unexpected combination of events.Only considering single contingencies for security assess-ment takes a significant time [1].

3.2 Dynamic simulation —pattern recognitionInvolved mathematical modelling by computer would berequired for dynamic system-simulation and patternrecognition approaches [2]. For practical purposes,complex computer modelling cannot be considered reli-able nor foolproof.

However, even if it could be achieved in real time, afteridentification of the threat, and determination of the bestlocations for counter measures, this intelligence must stillbe passed through the control hierarchy.

3.3 SummaryThese factors mitigate against a practical centralisedcontrol capable of satisfactorily handling calamitoussystem disturbances.

4 Fundamental considerations for systemprotection

In developing an alternative approach, it is first necessaryto develop and examine fundamental factors, particularlyrelating to the need to prevent breakdown:

What is power-system breakdown?What are the causes of breakdown?

4.1 Concept of breakdownThere are numerous automatic controls within a powergrid. Some regulate voltage levels throughout thenetwork by controlling transformer tap positions, or byadjusting reactive-power outputs of rotating units orstatic voltage compensators. Other automatic controlsmaintain the balance between generator real-poweroutputs and the system load. Whilst a co-ordinated func-tioning of these automatic controls prevails, a powersystem can be operated effectively.

However if a series of disturbances produce stresses ofgreater severity and/or duration than those for which thegrid has been designed, this co-ordination will be dis-rupted.

It is the loss of co-ordination between the automaticcontrols which culminates in system breakdown.

With the considerable resilience designed into thepower system, preliminary symptoms of breakdown willoccur prior to the catastrophic loss of co-ordination ofthe automatic controls. The identification of these pre-liminary symptoms of breakdown could be made toactuate an automatic control (or protection).

The corollary provides the underlying guide for thedevelopment of a system protection — the system emer-gency control precept [3]:

Whenever the balance between the supply and thedemand of both real and reactive power can be sus-tained, viable system operation is possible.

4.2 Causes of breakdo wnAlthough a power system can be struck by an almostunlimited number of different disturbances, it can onlybreakdown in a limited number of ways. There are fourbasic causes of breakdown:

(a) a system reactive-power mismatch(b) a system real-power mismatch(c) steady-state instability(d) transient instability.

As illustrated in Fig. 1, one cause of breakdown may leadto another en route to system collapse. For example, the

system reactive-powermismatch

system MWmismatch

Xsteady-state

instabilitytransient

instability

Fig. 1 Causes of system breakdown

1978 French incident initially created a system reactive-power mismatch, but the collapse followed the loss ofsteady-state stability.

However each of these causes, except transient insta-bility, can occur in two different modes [3]. To illustrate,a system real-power mismatch can follow either a loss of

332 IEE PROCEEDINGS, Vol. 134, Pt. C, No. 5, SEPTEMBER 1987

generation or a loss of load. Completely different mea-sures would be required to control each situation.

A comprehensive system protection must have mea-sures for controlling each of the following seven causes ofbreakdown:

(a) system reactive-power mismatch — deficit orsurplus

(b) system real-power mismatch — deficit or surplus(c) steady-state instability — angular advance or

retard(d) transient instability.

4.3 Protection principlesAll practical protection schemes encompass three funda-mental aspects:

(i) a continual monitoring of selected parameters(ii) the identification of a disturbance(iii) the actuation of timely countermeasures.

These same principles would be utilised by the systemprotection. This approach would circumvent the need fora complex predictive technique so lending credence to itspracticality.

4.4 System operating statesFive different system operating states have beendescribed — normal, alert, emergency, in extremis andrestorative states [4]. This covers the existing situationwhen no automatic measures are available to adequatelyhandle calamitous system disturbances. If howeversystem protection could successfully be implemented, twoadditional system states can be defined — protective andpre-restorative [5], as illustrated in Fig. 2.

The protective state would correspond to the presentemergency state, except that automatic measures (by thesystem protection) would maintain viable system oper-ation. Although in this mode the grid would continue tofunction, it may not meet normal operating criteria.

The pre-restorative state would cover the succeedingperiod when acceptable operating criteria would be re-stored. This may require selective load shedding.

The successful development of the system protectionwould ensure that the protective, pre-restorative and thefollowing restorative state would each be of short dura-tion.

5 Why a distributed intelligence?

The existing hierarchical control and monitoring struc-ture of a power system readily lends itself to an arrange-ment with distributed intelligence. In fact, if a distributedintelligence can be made to identify a critical situation,simultaneously the locations of the disturbances could bepin-pointed. This intelligence could then guide the appli-cation of counter measures.

This, however, requires two important assessments: toidentify a critical disturbance, and to determine theappropriate countermeasures.

5.1 Identifying the causeThis identification must be made at the nodes of thecontrol structure, preferrably those at the lowest level ofthe hierarchy — the substations and power stations. Foran efficient system of distributed intelligence, only a smallnumber of system parameters should be monitored foridentifying the possible causes of breakdown. As shownin Table 1, this can be achieved by the following systemvulnerability parameters:system: frequencymajor substations: transmission voltageslarge power stations: real-power and reactive-power

outputs

This limited number of system parameters provides anavenue for developing countermeasures and also thefurther task of monitoring the power grid. After the dis-turbance, the system's dynamic reactions can be assessedby the variations of these vulnerability parameters. Thiswould circumvent the need for complex computer prog-ramming as would be necessary with a centralisedcontrol.

5.2 Calibration of vulnerability parametersThe practical implementation of the system protectionwill require its correct grading with all existing protec-tions. This calibration will need to be based on an exten-sive history of monitored records of power-systemdisturbances.

A number of utilities already monitor power-systemdisturbances [7], but this may need to be extended toadequately incorporate variations of the system vulner-ability parameters.

futureautomatic system protection

Ith

nOr

EV)in

ing

inc

UJI

1

<bocoA

istu

ra m

itcca

l

pre-restorative

1protective

existingnonautomatic control

normal

u

O

istu

r

co

alert

c

restorative

.a3

dis

istu

r

(/)3

imito

au

emergency

in extremis

Fig. 2 System operating states

IEE PROCEEDINGS, Vol. 134, Pt. C, No. 5, SEPTEMBER 1987 333

Table 1 : Identification of causes of breakdown

Cause of breakdown Variations of vulnerability parameters

System real-power mismatch(i) Surplus

(ii) DeficitSystem reactive-power

mismatch(iii) Surplus

(iv) Deficit

(v) Transientinstability

Steady-stateinstability

(vi) Advance

(vii) Retard

rise of frequencyvoltage increases near lost loadsfall of frequencyvoltage reductions near lost generators

voltage rises in problem areaincrease of summated generator reactive-power absorptionvoltage reductions in disturbed areaincrease of summated generator reactive-power outputsevere voltage reductions near faulton fault clearance:at substations — fluctuations of voltages and frequencyat power stations — fluctuations of real- and

reactive-power outputsnear disturbance — generators would suffer an

abrupt change of reactive-power outputs followed by:at substations — fluctuations of voltages and

frequencyat power stations — fluctuations of real- and

reactive-power outputscommences with a sharp increase of generator

reactive-power absorptioncommences with a sharp increase of generator

reactive-power outputs

5.3 Suitable countermeasuresOnce an impending cause of breakdown has been identi-fied, countermeasures must function before the loss of co-ordination between the system's automatic controls.

Different measures would be required for each of thevarious causes of breakdown. The fact that the disturbedlocation had been identified would guide the applicationof countermeasures. This would allow more elegant mea-sures than the otherwise general purpose measures whichwould not function at the ideal locations. The continualmonitoring of the system's dynamic reactions wouldprovide a feedback for the further application of counter-measures.

5.4 Comprehensive protectionIf uncontrolled, one cause of breakdown may lead to

another. A comprehensive system protection must notonly control each of the seven causes of breakdown, butalso any combination of them. At first sight this seems tocomplicate our task but if parallel measures are availableto handle each of the individual causes, it would preventloss of co-ordination from the initial cause of breakdown.This sustained co-ordination of automatic controls wouldavoid the present danger of one cause of breakdownflowing to another.

Measures are also required for a situation of when adisturbance so overloads a transmission line that it trips.This could so aggravate conditions that it could swiftlylead to system breakdown, so that special measures havebeen devised that could avert line tripping [8]. Table 2provides an overview of the measures and timing require-ments for a comprehensive system protection. Associated

Table 2: Timing of countermeasures against causes of systembreakdown

Cause of breakdown

System real-power mismatch(i) Surplus

(ii) Deficit

System reactive-powermismatch

(iii) Surplus

(iv) Deficit

(v) Severe line overloads(vi) Transient instability

Steady-state instability*(vii) Advance(viii) Retard

Timing,s

1-5

1-5

0.3-2

5-60

0.2-10.1-3

Proposed countermeasures

Switching in of controllableloads [10]

Underfrequency load sheddingguided by voltage reductions

Switching local, scatteredshunt reactors [5]

Reactive-power pulses, fasttransformer tap changing.strategic load shedding [5, 6]

Fast strategic load shed [8]Controlled reactive plant

switching [3, 9]As for reactive-power mismatchSurplusDeficit

* Generator field forcing is a key stabilising factor immediately followingdisturbances leading to a system reactive-power deficit. It is therestriction of generator overexcitation that leads to steady-state instability[11]. Correct control of a system reactive-power deficit averts this excita-tion restriction and so circumvents steady-state instability.

Similarly fast measures controlling a system reactive-power surplus pre-vent undue generator angular advances which could otherwise causeloss of stability.

334 IEE PROCEEDINGS, Vol. 134, Pt. C, No. 5, SEPTEMBER 1987

papers provide more details of these different counter-measures [5, 6, 8-10].

These timings suggest that it should not be difficult toarrange an acceptable grading between each of the differ-ent groups of countermeasures. The basic scheme for thesystem protection is shown in Fig. 3.

development of computer software to provide the oper-ator with indications related to that cause of breakdownand prompts suggesting the best follow-up measures.

The continuing co-ordination between automatic con-trols would avert a host of abnormal conditions and indi-cations.

monitoringsystem vulnerability

parameters

identificationMW mismatch

surplus deficit

reactive-powermismatch

surplus deficit

steady-stateinstability

advance retard

transientinstability

countermeasures A B C D E

Fig. 3 System protection

5.5 Hierarchical considerationsMicroprocessors at each node could oversight the moni-toring of the system vulnerability parameters. Followingthe identification of an impending cause of breakdown,the necessary countermeasures would be actuated. Eachgroup of countermeasures would need to be tailored tomatch that cause of breakdown.

For the fastest cause of breakdown, transient insta-bility, initial measures must be locally actuated at thelowest rungs of the hierarchy [9]. By stemming the mainimpact of the disturbance, time would be available formeasures controlled at the next hierarchical level.

With a system reactive-power deficit, more time isavailable, so some of the primary automatic measurescould be controlled by higher levels of the hierarchy. Thisallows a greater flexibility in the organisation of thecountermeasures [5, 6].

6 Symbiosis with operators

Following a calamitous disturbance, even after the func-tioning of the system protection, the power system maystill be in a vulnerable state. Thus, unlike conventionalprotection operation, there is need for operators, particu-larly at the main centre, to become involved in restoringa normal system state. Strategic load shedding, using sel-ected loads, would lend itself to central control for thispurpose [5, 6]. There may be advantage in also havingother measures accessible to operator control.

6.1 Emergency monitoringWith the functioning of the system protection, essentialinformation would become available, namely:

(a) the cause of breakdown(b) the location of the disturbances(c) automatic measures that had functioned.

Well defined operating criteria would also allow the

IEE PROCEEDINGS, Vol. 134, Pt. C, No. 5, SEPTEMBER 1987

6.2 Existing situationThe oversight and emergency operational control follow-ing a calamitous disturbance would presently devolveupon operators at the main control centre. With existingfacilities the operators would be faced with:

(i) a large number of alarms and indications(ii) great difficulty in interpreting the situation(iii) access to a limited number of direct controls(iv) need to communicate with other control centres so

as to unravel the situation(v) a limited amount of time to save the power grid.

Additionally, it is extremely unlikely that operatorswould have had experience of, or training in handlingsuch a situation. It is difficult to envisage a more stressfulsituation than such an emergency operation situation,and stress is a major cause of operator errors.

6.3 SummaryWith the proposed system protection, operators wouldbe assured of viable system operation immediately afterthe disturbances. This would allow them time and ameasure of detachment to evaluate pertinent indicationsprovided for them. With the aids provided and the elimi-nation of the main cause of stress, operators would beable to more effectively control system emergency condi-tions.

7 Conclusion

Existing operational facilities are not capable of effec-tively guarding power systems against calamitous dis-turbances — disturbances more severe than thoseenvisaged in planning the power system. It is the dis-ruption of co-ordination between the power system'smany and scattered automatic controls which culminatesin breakdown. At the onset of a calamitous disturbance

335

there is sufficient power-system resilience for preliminarysymptoms of breakdown to appear. These can be identi-fied by the variations of a limited number of system vul-nerability parameters. In spite of the limitless possiblecombinations of disturbances, there are only a handful ofcauses of system breakdown.

The time interval before the loss of co-ordination pro-vides the opportunity for automatic countermeasures.However the resolution of this task must meet a complexset of requirements:

(a) it must encompass the whole grid(b) it must counter the initial impact of the dis-

turbances(c) it must then provide guidance to the operators(d) follow-up control measures must be provided(e) it must meet acceptable practical criteria.

A distributed intelligence and decentralised controlsprovide the keys to meeting these objectives. At a modestcost, the existing system control and data acquisitionstructure could be adapted to monitor the system vulner-ability parameters. This perception of the grid's dynamicreactions would allow identification of preliminary symp-toms of breakdown and actuation of timely counter-measures.

Thus the need for unwieldy, complex computer prog-ramming and of a purely centralised emergency control iseliminated. Concurrently, it resolves the post-disturbancemonitoring needs of the operators, as after the initialautomatic measures had functioned, there would be indi-cations available of the cause of breakdown, the locationof the disturbances, automatic measures that had func-tioned, and prompts for follow-up measures.

With the assurance of viable system operation, oper-ators would be under far less stress and would have suffi-cient time to assimilate the selected indications, sohastening system restoration. This system protectioncould also open the way to improved emergency trainingmethods which would enhance the operators' abilities inhandling power-system emergencies.

An understanding of system breakdown has allowed adefinition of the task for safeguarding a power system.The provision of distributed intelligence onto the systemcontrol and data acquisition structure would allow apractical and modest cost development of a system pro-tection which could resolve the present impasse in emer-gency operation.

What cost could be justified for the development ofsuch a system-protection arrangement? There is nosimple answer, but this judgement must take into accountthe cost of a major blackout (for example, the costof the 1977 New York blackout has been estimated at$300 million). In addition there is the bonus that itsimplementation would improve levels of operationalsecurity as well as significantly extending present power-system capabilities.

8 References

1 VEMURI, S., and USHER, R.F.: 'On line automatic contingencyselection algorithm', IEEE Trans., 1983, PAS-102, pp. 346-354

2 SHULZ, R.P., and PRICE, W.W.: 'Classification and identificationof power system emergencies', ibid., 1984, PAS-103, pp. 3471-3479

3 LACHS, W.R.: 'Countering calamitous system disturbances'. IEEConf. Publ. 225, 1983, pp. 79-83

4 FINK, L.H., and CARLSEN, K.: 'Operating under stress andstrain', IEEE Spectrum, 1978, 3, pp. 48-53

5 LACHS, W.R.: 'Insecure system reactive power balance: analysisand countermeasures', IEEE Trans., 1985, PAS-104, pp. 2413-2419

6 LACHS, W.R.: 'Dynamic study of an extreme system reactive powerdeficit', ibid., 1985, PAS-104, pp. 2420-2427

7 KUNDUR, P.: 'Power system disturbance monitoring: utility ex-periences'. IEEE Winter Power Meeting, New Orleans, 1987 paper87WM 053-2

8 LACHS, W.R.: 'Transmission-line overload: real-time control', IEEProc. C, Gen. Trans. & Distrib., 1987, 134, (5), pp. 342-347

9 LACHS, W.R.: 'A new transient stability control'. IEEE WinterPower Meeting, New Orleans, 1987, paper 87WM 061-5

10 LACHS, W.R.: 'Load management for power-system emergencies',IEE Proc. C, Gen. Trans. & Distrib., 1987, 134, (5), pp. 337-341

11 LACHS, W.R.: 'Reactive power control in system emergencies', IEEConf. Publ. 187, 1980, pp. 149-153

336 IEE PROCEEDINGS, Vol. 134, Pt. C, No. 5, SEPTEMBER 1987