CIGRE Technical Brochure on

REVIEW OF ON-LINE DYNAMIC SECURITY ASSESSMENT TOOLS AND TECHNIQUES

Working Group 01 of Advisory Group 6 of Study Committee C4

Final Report
Final Draft for review by WG Members - Not for General Distribution

December 2006
International Conference on Large High Voltage Electric Systems Confrence Internationale des Grands Rseaux lectriques a Haute Tension
Copyright 2006 Ownership of a CIGRE publication, whether in paper form or on electronic support only infers right of use for personal purposes. Are prohibited, except if explicitly agreed by CIGRE, total or partial reproduction of the publication for use other than personal and transfer to a third party; hence circulation on any intranet or other company network is forbidden. Disclaimer notice CIGRE gives no warranty or assurance about the contents of this publication, nor does it accept any responsibility, as to the accuracy or exhaustiveness of the information. All implied warranties and conditions are excluded to the maximum extent permitted by law. i

EXECUTIVE SUMMARY

This document is the product of work of the CIGRE Working Group C4.6.01 on Power systems Security Assessment. Within the working group a few ad hoc task forces were established to tackle various tasks related to power system security assessment and dynamic performance. This document is the result of the work of one of theses groups, which focused on dynamic security assessment tools and techniques. This document is the result of collaborative work among international members and contributors from utility companies, consultants and vendors, research organizations, and universities. It is a comprehensive report on several aspects on dynamic security assessment (DSA) tools and techniques including,

An overview of salient security issues which are fundamental in ensuring the robust and reliable operation of power system. The motivations for improved methods of system analysis are presented and the concept of on-line dynamic security assessment is introduced. A description of the generic requirements for on-line DSA systems and covers structural components as well as functional aspects. The requirements include issues associated with modeling, computation, performance, and reliability of DSA systems. A survey of the state-of-the-art in on-line DSA systems around the world. The survey includes descriptions of a number of on-line DSA systems and, in most cases, discusses the design objectives, the system architecture, performance, experience, and unique features. A presentation of some of the on-going research and development activities in the field of DSA. A summary including an identification of the aspects of on-line DSA that are currently not being actively addressed or which hold potential for future development.

ii

CIGRE WORKING GROUP C4.601 ON POWER SYSTEM SECURITY ASSESSMENT

WORKING GROUP CONVENER POUYAN POURBEIK (USA) TASK FORCE CONVENER: KIP MORISON (CANADA) MEMBERS AND CONTRIBUTORS Hamid Hamadani Denmark Ahmad A. Hamid Japan Nikos Hatziargyriou Canada John Hauer Japan Maurice Holly Germany Levente Hornyak Canada Jinan Huang Denmark He Huang Canada Shinichi Imai USA Mike Ingram Australia David Jacobson USA Jorge L. de Araujo Jardim Ireland Noel Janssens Romania Geza Joos Italy John Kabouris New Zealand Inocennt Kamwa USA Karim Karoui Italy Yuriy Kazachkov USA John Kehler Italy Yoshihiro Kitauchi Italy Sharma Kolluri Belgium Petr Korba New Zealand Harri Kuisti USA Kannan Lakmeeharan USA Mats Larsson Denmark Edwin Lerch Romania Eric LHelguen China Xi Lin USA Eugene Litvinov Belgium Jose L. Mata Brazil Bogdan Marinescu Canada Stefano Massucco Canada

Valdislav Akhmatov Yasuto Akiyama Udaya Annakkage Shinji Arinaga Andreas Basteck Danielle Beaulieu John Bech Jean Bland Gabriel Benmouyal Stephen Boroczky Roy Boyer Leslie Bryans Horia Stefan Campeanu Cristiano Candia Bhujanga Chakrabarti Hsiao-Dong Chiang Diego Cirio Jose Conto Sandro Corsi Bruno Cova Thierry Van Cutsem Richard Donaldson Ken Donahoo Reza Ebrahimian Peter Eriksen Mircea Eremia Wenjian Gao Floyd Galvan Mevludin Glavic Paulo Gomes Robert Grondin Sbastien Guillon

Canada Malaysia Greece USA Ireland USA Canada China Japan USA Canada Brazil Belgium Canada Greece Canada Belgium USA Canada Japan USA Switzerland Finland South Africa Switzerland Germany France China USA Spain France Italy

iii

Takatoshi Matsushita Jeff Mechenbier Francoise Mei Anatoliy Meklin Nick Miller Yasunori Mitani Kip Morison Arne Hejde Nielsen Jouko Niiranen Teruo Ohno Tsutoma Oyama Bikash Pal Mania Pavella Jose Vergara Santos Perez Markus Pller Marius Pomarleanu Michael Power Massimo Pozzi William Price Paul Ravalli Christian Rehtanz Jean-Claude Richard Ali Sadjadpour Olof Samuelsson Juan Sanchez-Gasca Walter Sattinger Savu Savulescu Steve Saylors Guy Scott

Japan USA UK USA USA Japan Canada Denmark Finland Japan Japan UK Belgium Panama Germany Romania Ireland Italy USA Australia China Canada USA Switzerland USA Switzerland USA USA Canada

Walt Stadlin Yasuyuki Tada Yong Tang Carson Taylor Jianzhong Tong Gilles Trudel Georgios Tsourakis Kjetil Uhlen Alain Vallete Gregor Verbic Dusko Vickovic Jim Viikansalo Rama Vinnakota Costas Vournas Lei Wang Leif Warland Louis Wehenkel Douglas Wilson Wihelm Winter Xiaochen Wu Xiaorong Xie Yueye Xue Tang Yong Mohd Yusof Sallehhudin Yusof Jozsef Zerenyi Guorui Zhang Marek Zima

USA Japan China USA USA Canada Greece Norway Canada Slovenia Bosnia and Herzegovina USA Canada Greece Canada Norway Belgium UK Germany China China China China Malaysia Malaysia Hungary USA Switzerland

iii

ACKNOWLEDGMENTS

The Task Force convener, contributors and working group members wish to thank Dr. P Kundur for facilitating the formation of the working group and for his continued support throughout the course of the work and Dr. Pouyan Pourbeik for his diligent coordination of the activities of the Working Group and associated Task Forces. The Task Force convener would also like to extend special thanks to all those who contributed to this document.

CONTENTS
CHAPTER 1. INTRODUCTION ....................................................................................................1-1 CHAPTER 2 OVERVIEW OF POWER SYSTEN SECURITY ISSUES ....................................2-1 2.1 2.2 2.3 2.4 2.5 2.6 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13 4.14 4.15 4.16 4.17 4.18 4.19 4.20 5.1 5.2 5.3 5.4 INTRODUCTION.....................................................................................................................2-1 POWER SYSTEM OPERATING STATES ....................................................................................2-2 SECURITY ASSESSMENT .......................................................................................................2-3 DYNAMIC SECURITY CRITERIA ............................................................................................2-4 OFF-LINE VS ON-LINE DSA .................................................................................................2-4 REFERENCES.........................................................................................................................2-6 OVERVIEW............................................................................................................................3-1 MEASUREMENTS ..................................................................................................................3-2 MODELING ...........................................................................................................................3-3 COMPUTATION .....................................................................................................................3-8 PERFORMANCE ...................................................................................................................3-12 AUTOMATION AND RELIABILITY .......................................................................................3-12 REPORTING AND VISUALIZATION ......................................................................................3-12 REMEDIAL CONTROL ACTIONS ..........................................................................................3-16 OTHER FUNCTIONS.............................................................................................................3-17 REFERENCES.......................................................................................................................3-17 OVERVIEW............................................................................................................................4-1 STATE-OF-THE ART OF DSA IN AUSTRALIA NEMMCO ..................................................4-3 STATE-OF-THE-ART OF DSA IN BOSNIA AND HERZEGOVINA - NOS ................................4-21 STATE OF THE ART IN BRAZIL - ONS.................................................................................4-26 STATE-OF-THE-ART OF DSA IN CANADA - HYDRO-QUBEC ............................................4-36 STATE-OF-THE-ART OF DSA IN CHINA CEPRI ..............................................................4-51 STATE-OF-THE-ART OF DSA IN CHINA GUANGXI ELECTRIC POWER GRID ...................4-53 STATE-OF-THE ART OF DSA IN EUROPE: THE EUROPEAN OMASES PROJECT ................4-55 STATE-OF-THE-ART OF DSA IN FINLAND - FINGRID .........................................................4-78 STATE-OF-THE-ART IN DSA IN GREECE: OMASES OPERATING EXPERIENCE ................4-84 STATE-OF-THE-ART OF DSA IN IRELAND ESB NATIONAL GRID ...................................4-93 STATE-OF-THE-ART OF DSA IN JAPAN TEPCO..............................................................4-96 STATE-OF-THE ART OF DSA IN MALAYSIA TENAGA NASIONAL BERHAD ...................4-111 STATE-OF-THE-ART OF DSA IN NEW ZEALAND TRANSPOWER ...................................4-123 STATE-OF-THE-ART OF DSA IN PANAMA - ETESA ........................................................4-125 STATE-OF-THE-ART OF DSA IN ROMANIA - TRANSELECTRICA ......................................4-133 STATE-OF-THE-ART OF DSA IN RUSSIA ..........................................................................4-144 STATE-OF-THE-ART OF DSA IN THE USA TSA AT PJM ..............................................4-146 STATE-OF-THE-ART OF DSA IN THE USA VSA AT PJM..............................................4-155 STATE-OF-THE-ART OF DSA IN THE USA SOUTHERN COMPANY ................................4-165 INTRODUCTION.....................................................................................................................5-1 ON-GOING R&D IN CANADA - HYDRO QUEBEC ..................................................................5-1 ON-GOING R&D IN CHINA - CEPRI ....................................................................................5-3 ON-GOING R&D IN EUROPE.................................................................................................5-3

CHAPTER 3. REQUIREMENTS FOR ON-LINE DSA................................................................3-1

CHAPTER 4. STATE-OF-THE-ART IN ON-LINE DSA .............................................................4-1

CHAPTER 5. ON-GOING RESEARCH AND DEVELOPMENT ...............................................5-1

ii

5.5 5.6 5.7 5.8 5.9

ON-GOING R&D IN FINLAND .............................................................................................5-16 ON-GOING R&D IN GREECE...............................................................................................5-16 ON-GOING R&D IN ITALY ..................................................................................................5-25 ON-GOING R&D IN ROMANIA ............................................................................................5-35 INTELLIGENT SYSTEMS FOR ON-LINE DSA .......................................................................5-42

CHAPTER 6. SUMMARY AND FUTURE DIRECTIONS ..........................................................6-1

iii

INDEX OF AUTHORS

CHAPTER 1 CHAPTER 2 CHAPTER 3 CHAPTER 4

INTRODUCTION- MOTIVATION FOR THIS REVIEW K. Morison, N. Hatziargyriou OVERVIEW OF POWER SYSTEM SECURITY ISSUES N. Hatziargyriou, K. Morison, W. Stadlin, REQUIREMENTS J. Jardim, S. Boroczky, H. Kuisti, N. Hatziargyriou, W. Stadlin, K. Morison STATE-OF-THE ART S. Boroczky, H. Stefan Campeanu, B. Chakrabarti, H.D. Chiang, T. Van Cutsem, K. Donahoo, R. Donaldson, W. Gao, M. Glavic, S. Guillon, H. Hamadani, A.J. Hamid, E. LHelguen, M. Holly, H. Huang, J. Huang, J. Jardim, H. Kuisti, X. Lin, E. Litvinov, P. Massimo, S. Massucco, A. Meklin, K. Morison, T. Ohno, M. Pavella, J. Vergara Santos Perez, M. Power, M.Y. Rakob, A. Sadjapour, S. C. Savulescu, Y. Tada, Y. Tang, D. Vickovic, C. Vournas, L. Wang, L. Wehenkel, X. Wu, T. Yong ON-GOING RESEARCH AND DEVELOPMENT U. Annakkage, H. Stefan Campean, T. Van Cutsem, M. Glavic, N. Hatziargyriou, J. Huang, H. Kuisti, P. Massimo, S. Massucco, K. Morison, M. Pavella, J. Vergara Santos Perez, S. C. Savulescu, Y. Tang, D. Vickovic, C. Vournas, L. Wehenkel, T. Yong SUMMARY AND FUTURE DIRECTIONS S. Boroczky, N. Hatziargyriou, H. Kuisti, K. Morison

CHAPTER 5

CHAPTER 6

Main Editor: K. Morison

iv

List of Acronyms and Terminology

AGC AVR BCTC BiH CCT CEPRI DB DCP DM DSA DSAS DSM DT DTS EAC ECC EMS EPRI ESB ETESA ETMSP FACTS FCAS FERC FMTCA FR FTP HIS HQ HTSO HVDC KB LAN LTC MMI NCC NEMMCO NERC NFR NN NPCC OASIS OEL OLTC OMASES OMIB ONS OPDMS OPF

Automatic Generation Control Automatic Voltage Regulator British Columbia Transmission Corporation Bosnia and Herzegovina Critical Clearing Time China Electric Power Research Institute Data Base Dynamic Case Preparation Disturbance Monitor Dynamic Security Assessment Dynamic Security Assessment System Dynamic Swing Monitor Decision Tree Dispatcher Training Simulator Equal Area Criterion Emergency Control Center Energy Management System Electric Power Research Institute Electricity Supply Board (Ireland) Empresa Electrica de Transmission (Panama) Extended Transient/Midterm Stability program Flexible AC Transmission Systems Frequency Control Ancillary Service Federal Electricity Regulatory Council Fast Maximum Transfer capability Analyzer Fault Recorder File Transfer Protocol Historical Information System Hydro Quebec Hellenic Transmission System Operator High Voltage Direct Current Knowledge Base Local Area Network Load Tap Changer Man Machine Interface National Control Center National Electricity Market Management Company (Australia) North American Electric Reliability Council Net Free Reserves Neural Network Northeast Power Coordinating Council Open Access Same Time Information System Over-Excitation Limiter On-Load Tap-Changer Open Market Access and Security Assessment System One-Machine Infinite Bus Operador Nacional do Sistema Electrico (Brazil) Operations Planning Data Management System Optimal Power Flow

OTS PCLL PCM PJM PMU PSS QSS RMT RTU SCADA SE SER SOL SPS SSA SSSA SSSL SVC TCSC TDS TEPCO TNB TP TS TSA TSAC TSO TTC UCTE UEL UFLS ULTC VSA VVD WAN WECC

Operator Training Simulator Post-Contingency Loadability Limits Preventative Control Measure Pennsylvania, New Jersey, Maryland (USA) Phasor Measurement Unit Power System Stabilizer Quasi Steady State Reserve Management Tool Remote Terminal Unit Supervisory Control and Data Acquisition State Estimator Sequence of Events Recorder Secure Operating Limit Special Protection Systems Static Security Assessment Small-Signal Stability Assessment Steady State Stability Limit Static VAr Compensator Thyristor Controlled Series Compensator Time Domain Simulation Tokyo electric Power Company (Japan) Tenaga Nasional Berhad (Malaysia) Transpower (New Zealand) Training Simulator Transient Security Assessment Transient Security Assessment and Control Transmission System Operator Total Transmission Capability Union for the Coordination of the Transmission of Electricity Under-Excitation Limiter Under Frequency Load Shedding Under-Load Tap-Changer (transformer) Voltage Security Assessment Voltage VAr Dispatch Wide Area Network Western Electricity Coordinating Council

vi

1 1
Chapter 1

INTRODUCTION
Chapter 1. Introduction Power system security refers to the degree of risk in a power systems ability to survive imminent disturbances (contingencies) without interruption to customer service. It relates to robustness of the system to imminent disturbances and, hence, depends on the system operating condition as well as the contingent probability of disturbances [1]. The system condition is determined not only by the system operating point (generation and load) but also by the devices dynamics as well as controls and protections which will operate should an event occur. Ensuring secure operation has always been of paramount importance in the safe and economic operation of power systems. When a system is insecure it becomes exposed to severe, and in some cases, catastrophic, system failures of the types observed in recent years in various power grids around the world; events that have enormous economic costs and may even lead to loss of life. The importance of system security is highlighted by the significant number of blackouts that have occurred around the world, such as the major North American blackout of August 2003. To ensure that a power system is sufficiently reliable, that is, that there is an acceptable probability of it operating satisfactorily over the long run, the system must be (a) properly designed with security as a primary consideration and (b) monitored and controlled during operation to ensure sufficient security margin exists at all times. Secure system operation has become a particularly challenging task with the evolution of the electric power industry toward open markets over the last decade which has introduced a number of factors that have increased the possible sources for system disturbances, reduced the robustness of systems, and reduced the predictability of operation. Traditionally, system operators depended heavily on the results of operational planning studies conducted off-line to guide them through day-to-day operations. In todays complex systems, total reliance on this off-line approach has become impractical and the use of on-line dynamic security assessment (DSA) has emerged and is growing in usage worldwide. In this approach, a snapshot of the actual system condition is taken and comprehensive security analysis performed in near-real-time with sufficient speed to either invoke automatic controls or to permit the operator to take necessary protective actions to ensure adequate security is maintained. Many sophisticated systems are in use today capable of assessing transient security, voltage security, and small-signal security. To deal with the complexity of such assessments, todays on-line tools use a wide range of system measurements, analytical techniques, computer system architectures, and visualization methods. Although the need for on-line systems is clearly growing in most power systems, detailed and exhaustive off-line studies can often still be used when they can be transformed to general guidelines, trends, and directions to follow. Such may be the case in power systems in which the uncertainties and variations of operation either so not exist or can be shown to have minimal impact on system dynamic performance. With security being of paramount importance to the electric power industry as a whole, it is important that all those involved in system operations be aware of the on-line DSA technologies available and in use today as well as the developments underway for the future; this is the goal of this document. This document is structured as follows,

Chapter 2: Provides and overview of power system security issues and introduces the concept of on-line dynamic security assessment. Chapter 3: Describes the generic requirements for on-line DSA systems and covers structural

1-1

components as well as functional aspects.

Chapter 4: Presents the state-of-the-art in on-line DSA by describing leading-edge systems throughout the world. Chapter 5: Presents a description of on-going research and development activities in the field of on-line DSA. Chapter 6: Presents a summary of the findings and provides some observations and directions for possible future work.

References
[1] IEEE/CIGRE Joint Task Force on Stability Terms and Definitions, Definition and Classification of Power System Stability, CIGRE Technical Brochure No. 231, 2003.

1-2

2 2
Chapter 2

OVERVIEW OF POWER SYSTEM SECURITY ISSUES

CHAPTER 2 Overview of Power System Security Issues

2.1

Introduction

Security and stability are related terms. Security is considered to be an instantaneous, time-varying condition that is a function of the robustness of the system relative to imminent disturbances. Stability is a narrower condition concerning the continuance of parallel, synchronous operation of all operating units (synchronous generators) of a system, and is a very important factor of security. A typical modern power system is a high-order multivariable process whose dynamic response is influenced by a wide array of devices with different characteristics and response rates. Depending on the network topology, system operating condition and the form of disturbance, different sets of opposing forces may experience sustained imbalance leading to different forms of instability. The instability of a power system can be classified taking into account the considerations [1]: The physical nature of the resulting mode of instability as indicated by the main system variable in which instability can be observed. The size of the disturbance considered, which influences the method of calculation and prediction of stability. The devices, processes, and the time span that must be taken into consideration in order to assess stability. According to the above consideration the power system's stability can be classified as voltage, rotor angle and frequency stability as shown in Figure 2-1.

Figure 2-1 Classification of Stability

1. Rotor Angle Stability. Rotor angle stability refers to the ability of synchronous machines of an interconnected power system to remain in synchronism under normal operating conditions and after being subjected to a disturbance. It depends on the ability to maintain/restore equilibrium between electromagnetic torque and mechanical torque of each synchronous machine in the system. Instability that may result occurs in the form of increasing angular swings of some generators leading to their loss of synchronism with other generators. The rotor angle stability is further divided to small-disturbance (or small-signal) stability and

2-1

transient stability. Small signal stability refers to the ability of the power system to maintain synchronism under small disturbance. Transient stability is concerned with the ability of the power system to maintain synchronism when subjected to a severe transient disturbance. 2. Voltage Stability. Voltage stability is concerned with the ability of a power system to maintain steady acceptable voltages at all buses in the system under normal operating conditions and after being subjected to a disturbance. Instability may occur in the form of a progressive fall or rise of voltage of some buses. The main factor causing voltage instability is the inability of the power system to maintain a proper balance of reactive power throughout the system. Large disturbance voltage stability is concerned with a systems ability to maintain steady voltages following large disturbances. Small disturbance voltage stability is concerned with a systems ability to control voltages following small perturbations, such as incremental changes in system load. 3. Frequency Stability. Frequency stability is the ability of a power system to maintain the frequency within a nominal range, following a severe system upset that may or may not result in the system being divided into subsystems. It depends on the ability to restore balance between system generation and load with minimum loss of load.

2.2

Power system operating states

The operating states of a power system are classified according to its security level, to help operators design appropriate control actions. Most authors credit Dy-Liacco for defining these different states in shown in Figure 2-2[Dy-Liacco, 1967]. Power system's operation is governed by three sets of generic equations: one differential and two algebraic. The differential set represents the dynamic behavior of the system. The first algebraic sets comprise equality constraints, which refer to the generation-load system balance. The second algebraic set comprises inequality constraints, which state that all network elements operate within their bus voltage and power limits. Normal State. In normal state all constraints are satisfied, which means that the balance between generation and load (plus losses) is met and that no equipment is overloaded. In addition the system's reserve margins are sufficient and it is able to withstand any of the set of plausible contingencies. Alert State. When the system's security level is weakened or the probability of disturbance increases, then the occurrence of a plausible contingency would cause the system to reach a state where some network equipment would be overloaded. In this state all the constraints are satisfied but the reserve margins are not enough to guarantee that the constraints will be satisfied when a severe contingency occurs. In this state preventive actions can be taken to restore the system to the normal state. Emergency state. The system can transpose from alert state to emergency state, if a sufficiently severe contingency takes place, before any preventive action is taken. Some of the inequality constraints are violated, which means that some network equipment is overloaded. The system, however, remains intact and can be restored to the normal state (or at least to the alert state), if the suitable corrective actions are taken. In extremis state. The system can transpose from the alert state to in extremis states when a severe disturbance takes place, or from the emergency state when no corrective action is taken. In this state both equality and inequality constraints are violated. The system loses synchronism, there are cascading outages and possibly shutdown of a major portion of the system. Control actions, like load shedding or controlled system separation are used for saving as much of the system as possible from a widespread blackout. Restorative state. In the restorative state, the operator performs control actions in order to

2-2

reconnect all the facilities and to restore all system load. The system can reach either the normal or the alert state, depending on the conditions.

Figure 2-2 Dy-Liacco's power system operating state transition maps adapted by Fink and Carlsen

2.3

Security Assessment

There are three levels of security assessment [2]: Security monitoring. Security Monitoring consists in checking if the operating conditions are satisfied. Security analysis. Security analysis consists in checking the system ability to undergo disturbances. A system is said to be secure if it can withstand each specified disturbance without getting into an emergency state. Otherwise it is insecure or in an alert state. It is obvious that if all possible disturbances were taken into consideration, it would be very difficult to find a secure Operating state. In practice, only disturbances with a reasonable probability to occur (contingencies) are considered. Security margin determination. The task of assessing the level of security for a given operating condition or topology configuration (under a pre-assigned set of contingencies) requires the definition of a security margin using some selected variables or parameters. Within this context, the objective is not only to bring the system from an insecure to a secure state but also to maintain adequate security margins. These margins are particularly needed in the transmission open access environment, which is prevailing in an increasing number of countries. In this case, the operator wants to know how much load or transfer increase can be accepted without the system becoming 2-3

insecure. Security assessment can be classified into Static Security Assessment (SSA) and Dynamic Security Assessment (DSA) according to the differences in the required analysis methods. Static security Assessment (SSA): are methodologies that verify bus voltage and line power flow limits for the post contingency operating state, considering that the transition between the precontingency and the post-contingency operating states has taken place without suffering any instability phenomena in any part of the system. Dynamic Security Assessment (DSA): are methodologies for evaluating the stability and quality of the transient processes between the pre-contingency and post-contingency states. In this case, DSA aims at ensuring that the system will be stable after the contingency occurrence and that the transients caused by such a contingency will be well damped, of small amplitude and with little impact on the quality of service.

2.4

Dynamic Security Criteria

In practice, the typical criteria for DSA include ([3]): Stability. This concerns loss stability through the evolution of relative machine angles (loss of synchronism, either in an aperiodic manner or oscillatory manner), loss of voltage or frequency control. Voltage excursions (dip or rise) beyond specified threshold level and duration. This includes separate voltage excursion threshold/duration pairs for voltage dip and voltage rise, and maximum/minimum instantaneous excursion thresholds. Frequency excursions (dip or rise) beyond specified threshold level and duration. Relay margin criteria. These are defined for pre-disturbance and post-disturbance conditions. If relay margin is violated for more than a maximum specified time after the disturbance, it is identified as insecure. Minimum damping criteria. For a designated list of contingencies, if the post-disturbance system exhibits oscillations, they must be positively damped (decreasing in amplitude). With these criteria in mind, DSA may be divided into three main components, o Transient Security Assessment (TSA), which includes the assessment of transient stability as well as voltage and frequency excursions, as well as relay margin violations, which may occur in the transient period. Voltage Security Assessment (VSA), which includes the assessment of voltage stability and generally also includes the assessment of under/over-voltage violations that may occur in the time period of interest. Small-Signal Stability Assessment (SSSA), which includes the assessment of smallsignal stability in which assessment of system oscillations (damping) are of interest.

2.5

Off-line Vs On-line DSA

In the operating environment, a secure system is one in which the operating criteria are respected at pre- and post-contingency conditions. This implies that analyses must be performed to assess all aspects of security, including the thermal loading of system elements, voltage and frequency

2-4

variations (both steady-state and transient) and all forms of stability. The computations needed to accurately assess the security of a single defined system condition are technically rigorous and require considerable effort. As a result, security assessment has been historically conducted in an off-line operational planning environment in which the steady-state and dynamic performance of the nearterm forecasted system conditions are exhaustively determined using tools such as powerflow and time-domain simulations. Because of the engineering and computational efforts needed for the more complex assessments, such as required for stability assessment, it was necessary to compute system operating limits well in advance of the time in which they were expected to occur. In this approach all planned conditions and contingencies had to be examined even though most would never actually occur. But the operating limits computed off-line for a postulated scenario do not necessarily apply to other power system operating conditions. This is because the stability limit is a local property of the system state vector. For each new solution of the system of equations that describe the system state there is a new stability limit. Simply stated, the stability limits are not fixed and change with the systems loading, voltages and topology. It is precisely this changing nature of the stability limits that makes it necessary to recompute them as often as possible, for each new system state, after each state estimate, and after each load-flow [4]. Another aspect of real-time operation that the off-line studies do not adequately capture deals with trend analysis. In addition to the information regarding current system status the system operator is keenly interested in knowing the status of the system as it transitions in future time. Off-line analysis by its very nature fails to capture the changes in system status. Hence, there exists a drive to obtain more accurate and relevant information using the on-line data [6]. To help compensate somewhat for this shortcoming, some system operating limits are often quoted as a function of measurable independent power system variables (e.g. generation, inertia, demand etc). Using linear regression these limit equations are defined with sufficient margin to ensure that they encompass, to within reasonable confidence, the various limiting states of the many operating conditions studied off-line. Because of the way these limit equations are derived, it is likely that the predicted limit at a particular operating condition be under-estimated. This leads to inefficient operation of the interconnectors, with a correspondingly lower return on the investment. Conversely on rare occasions, the limit equation can over-estimate the true operating limit, leaving the insecure post contingent system state undetected. In the new competitive environment, the uncertainty of predicting future operating conditions has created a need for a new approach to security assessment: On-line Dynamic Security Assessment (DSA). In this approach, a snapshot of the actual system condition is taken and the system security for this operating condition is computed in near-real-time with sufficient speed to either trigger an automatic control action or to allow time for the operator to react if a contingency analyzed is shown to be potentially insecure. Since this approach performs analyses on a snapshot of the current system condition, the uncertainty embedded in off-line analysis using forecasted condition is largely eliminated. This approach provides a radar-like mechanism that continually sweeps the system for potential problems that may result should a contingency occur. While it is uncertain if on-line DSA could have prevented, or reduced the extent of, any of the system blackouts observed around the world, it is very likely that such assessments would provide operators with early indications of pending trouble and provide the opportunity to take remedial actions. For example, the data published in [5] depict a succession of worsened system states during the hours prior to the August 14, 2003 blackout -- voltages getting lower, lines tripping, and generating units reaching the excitation current limit. These were signals that the system was approaching its stability limit, and could have been detected by real-time stability tracking tools. It is precisely the ability to predict approaching blackout conditions that renders on-line DSA, perhaps equipped with fast front-end calculators of the distance to instability, an indispensable tool in modern control centers.

2-5

2.6

References

[1] P. Kundur, "Power System Stability and Control", Mc-Graw Hill, 1994 [2] IEEE Committee Report. "Dynamic security assessment practices in North America". IEEE [3] Van Cutsem T. and Vournas C. "Voltage Stability of Electric Power Systems", Kluwer Academics, Boston, USA, 1998. [4] Savulescu, S.C., Real Time Stability in Power Systems, Springer, Norwell, MA, USA, 2005 [5] EPRI White Paper "Factors Related to the Series of Outages on August 14, 2003", Product Id 1009317, November 20, 2003. [6] N. Balu, et al, "On-line power system security analysis," Proceeding of the IEEE, Vol. 80, Issue 2, pp. 262-282, Feb. 1992

2-6

3 2
Chapter 3

REQUIREMENTS FOR ON-LINE DSA

CHAPTER 3. Requirements for On-Line DSA

3.1

Overview

There are a number of requirements that must be met for a successful on-line DSA implementation. These consist of structural requirements, (including such items as essential system components and data connections) and functional requirements (describing such items as what the system must do and how fast it must perform). This Chapter provides a general description of these requirements. Chapter 4 contains some additional information on specific requirements provided for some state-ofthe-art DSA implementation. The basic functions of an On-line DSA system includes the following basic steps, 1. Take a snapshot of the power system condition 2. Develop a suitable network model 3. Combine any additional dynamic data and contingency data required to perform the assessment 4. Perform the analysis 5. Report on results of analysis 6. Raise alarms when security issues are detected. 7. Identify security issues and make recommendations on how to alleviate them. (This function is not always achievable). Although there are a variety of on-line DSA architectures (as described in Chapter 4) that can achieve these functions, most on-line DSA systems can be divided into the components as shown in Figure 3-1 [1,4].

Figure 3-1 - The components of an on-line dynamic security assessment system

3-1

3.2

Measurements

On-line DSA systems rely heavily on the breadth and quality of measured data taken from the power system. The measurements obtained are used for four primary purposes, a) Input to state estimation (SE) tools from which system network and contingency models will be developed. This is the most common approach in which SCADA measurements are used as input to SE which in turn produce network (powerflow) model suitable for use with security assessment tools. Other inputs, such as those from phasor measurement units (PMUs) may be used to augment the SCADA data set in an effort to produce a more accurate system model. b) Direct input to security computation tools. Examples include use of measured quantities to assess system damping, or use of PMU data (such as angle spread across a system) to infer stability. c) Benchmarking of system models or security assessment results. Examples include (i) use of PMU measurements to verify quantities in models produced by state estimators or (ii) use of disturbance monitors to benchmark system responses predicted from the on-line DSA system. d) Arming or triggering of Special Protection Systems. An example is the arming of generation rejection schemes directly from PMU measurements. This assumes that either off-line or on-line studies have provided a relationship between the measured value and the required arming. System measurements can be obtained from a number of sources including traditional Supervisory Control and Data Acquisition (SCADA) systems, phasor measurement (PM) units and disturbance monitors.

3.2.1 SCADA Systems

Because all power systems have existing SCADA systems, this remains the primary source of data to be used as input to DSA systems. SCADA systems also offer a rich range of measured parameters and are updated at relatively fast rate. For on-line DSA purposes, useful measurements include,

Active power of most power lines, power transformers and generators Reactive power of most power transformers, shunt reactors, shunt capacitors and generators Voltage of most substations Frequency measured at a few locations of the grid Status of most network switched related to power lines, power transformers and generators Transformer tap positions

The above-mentioned quantities should be updated in the database at the interval of a few seconds. The secondary signals of instrument transformers used for protective relays and energy measurements can be utilized to provide power, voltage and frequency measurements at a short interval. It is recommended to utilize the secondary circuits used for energy measurements instead of those used for protection relays to get more accurate measurements. When assessing the damping of power oscillations (related to transient security and small signal security) an interval of approximately 100 ms is sufficient. It should be noted that, for large interconnected power systems, SCADA systems might have limited observability; that is, measurements are available only for a portion of the full system. As discussed below in the section on modeling, this may have significant implications when using the measured data for developing a real-time system model for use in simulations.

3-2

3.2.2 Phasor Measurements

There is a growing interest in the use of phasor measurements for power system security assessment, and phasor measurement units (PMUs) have been widely installed in many power systems throughout the world. PMUs have the advantage of providing accurate time-synchronized measurements from locations that can be geographically remote (over so-called wide-areas).

3.2.3 Disturbance Monitors

This is a class of device that monitors system performance and record specified quantities when disturbances occur. Devices of this sort may be called Fault Recorders (FR), Sequence of Events Recorders (SER), Dynamic Swing Monitors (DSM), or Disturbance Monitors (DM). Although these types of measuring devices do not generally play a role as inputs to security assessment, they can play a valuable role, if logged into a DSA database, in benchmarking security assessment results.

3.3

Modeling

When detailed analyses are to be performed for on-line DSA, high quality models of the interconnected system are needed. In fact, since all analyses are dependent on the quality of the system model, it may be the most important component in the DSA system. The modeling requirements (size, detail, extent of component models) depend largely on which security or stability issues are relevant for the power system in question. For example, if security problems are quite localized and steady-state analyses (i.e. powerflow-based methods) are sufficient, then a simple powerflow model produced by the state-estimator may be sufficient. However, if security issues are more widespread (say in the case of inter-area oscillation problems), then a largescale model would be required and dynamics of key devices would have to be provided.

3.3.1 Network
The foundation for most on-line DSA models is the network model produced as a solved powerflow case by the state estimator. The state estimator is, therefore, a critical link in the data assembly process and it is important that it can reliably produce an accurate powerflow model each DSA cycle. Accurate not only implies solved, but also implies that the powerflow solution is representative of the actual system conditions. Some quantities, such as generator outputs and limits are critical if device dynamic models are to be matched and initialized with the powerflow to create a dynamics simulation case (see the section 3.3.2 below). Some key issues are associated with network modeling, including, Network Model Size: Some interconnected power systems have grown very large in size, and as a result, their full simulation models have correspondingly expanded in dimension. The NERC planning model for the North American eastern interconnection for example is now approximately 45,000 buses and some state estimator models (which are intended to approximate the full system representation) for this region are approaching 20,000 buses. In general, it is necessary to model large portions of the power system in on-line DSA systems since some limiting phenomena, particularly small signal stability, can involve wide areas of the system. SCADA data (or other source of system measurements) and the resulting state estimator output, on the other hand, may be limited to a specific region of observability (such as a specific portion of the interconnected system, usually corresponding to a control area). It is therefore necessary to include representation of the external system (possibly in the form of equivalents) prior to conducting analyses. This can be achieved by either appending the state estimator model with an external representation developed off-line or by merging several state estimator models from different parts of the interconnected system.

3-3

Network Model Detail: The level of details contained in the model is also critical. For instance, representing key characteristics of the distribution system is vital for voltage stability analysis. Most powerflow models derived from state estimator models include load models in which all distribution components have been lumped into a single P & Q load. For voltage stability analysis it is often necessary to break out the portion of the load that represents key components such as distribution transformers, distribution capacitors and reactors, and induction motors. Similarly, details on generator reactive power capabilities and the maximum dispatchable power are critical in computing voltage stability margins for the specified system conditions and transactions.

3.3.2 Devices and Dynamics Representation

If dynamic simulation studies, (such as time-domain simulation) or eigenvalue analyses are to be conducted as part of the DSA, then the powerflow model alone is insufficient; the powerflow model from the state estimator must be matched with dynamic models for all dynamic devices in the system. In this regard it is critical that all key dynamics are represented correctly and appropriately. Depending on the specific studies to be conducted, dynamic models may be required for all or some of the following,

Generators, exciters, power system stabilizers, governor, prime movers Generator over-excitation protection Under-load tap changing transformers Switchable capacitors and reactors Loads HVdc Links FACTS Devices (particularly SVCs) Network protection systems Special protection systems including under-voltage and under-frequency load-shedding Wind farms

Issues associated with dynamic modeling It is often a challenge to match the dynamic data to the powerflow data because many state-estimators do not retain constant bus numbering. Therefore, the bus numbering used for the dynamics models must be mapped to match the appropriate bus numbers in the powerflow. Often, there are a number of organizations that develop and maintain the dynamic models. These are usually maintained by planning departments who have a long-term focus on the operation of the power system. These models are usually applied tailored and to well behaved powerflows. The EMS model, on the other hand, is primarily maintained by EMS departments, who are more focused on the day-to-day operation of the power system. Sometimes it can be difficult to marry up the immediate term network model with the long-term model provided by planning. Furthermore, a dynamic model may not necessarily be designed to cater for the ill-conditioned or extreme operating conditions that can be found in state estimated real time powerflows. A complete dynamic model of the power system may require certain information not always readily available from the SCADA or state estimator. This may include information such as transformer tap positions, statuses of key equipment (power system stabilizers for example) or the mode under which an exciter or governor is operating.

3.3.3 Load Modeling

As described below, actual loads are usually made of a large number numerous individual devices that may have diverse dynamic characteristics. In addition, the number and type of actual loads connected to a system may vary with time. These characteristics of the physical nature of actual power system loads makes load modeling for simulation studies a very challenging task. 3-4

Actual loads consist of a myriad of devices Most powerflow models are limited in their representation of the details of the distribution system, typically representing the system model down to subtransmission level such as 44 kV or 13.8 kV. Unfortunately, virtually all loads are located below this voltage level. As shown in Figure 3-2, the actual load below the subtransmission level may consist of a large number of components with widely varied characteristics such as resistive and inductive loads, induction motors, thermostatic loads, and extinction lighting loads. These may be connected though a distribution network consisting of feeders, transformers, voltage regulators, and static capacitors. Since it is impractical to represent all these loads in detail, an equivalent representation is required in which all these components are represented by a simplified equivalent model that must be capable of representing the dynamic performance of the aggregate of all downstream components and controls. Load composition may vary greatly with time
44 kV

M D

44 kV
D M

Figure 3-2: Typical Load Aggregation

The number and type of loads connected to the system normally varies continuously through time, as different load components are switched in or out in response to residential, commercial, or industrial activity. As a result, the magnitude as well as the dynamic nature of the load may change significantly with the time of day, day of the week, and season of the year. Other factors such as sporadic changes in weather may cause highly unpredictable and irregular variations in the nature and amount of load. This statistical nature of load makes it very difficult to establish a load model that is generically applicable in power system studies. Load Modeling Practice Loads can be modeled as constant power, voltage and/or frequency dependent, or as composite load consisting of a variety of components including dynamic devices such as induction motors. The type of load models required depends largely on the type of analysis to be conducted. To date, acquisition of suitable load parameters (types or loads, characteristics, and temporal information) have limited the types of load models generally used, usually to simple voltage dependent models (for example, for static analysis, constant power loads are often used as they are assumed to be the worst case loads since they neglect the natural load shedding which occurs from the voltage dependency of most load types). Such simple models, however, are generally unable to capture load dynamics (such as motor stalling or the effect of rotating load inertia) which may be important in some simulations. For on-line DSA, the current industry practice is, for lack of a better alternative, to assume the same load models as used for system planning or operational studies. A superior approach would be to derive load models for on-line DSA from real-time measurements. This type of approach is used at Hydro Quebec where load modeling is done in real time based on load forecast. A global exponential factor Np value is calculated that represents the impact of voltage variation on the power consumption as given by,

3-5

V P=P V0
0

NP

The calculation is based on the combination of load (heat load, air conditioning load, lighting load and base load). Formerly transmission system capacity limits were calculated using a relation between four values of the global Np factor and four temperatures ranges. This method had the drawback of providing an Np factor too sensitive to rapid temperature variation. Since there is an Np factor associated with each type of load and forecasting models work by predicting load based on different uses, it was suggested in 2004 to compute a global Np factor based on these models. Thus Np factors were suggested for base, heating, lighting and air conditioning load. The global Np factor is calculated from the proportion of each of the uses in total demand. This method results in more stable hour-to-hour changes in this factor and better grounds the global Np factor on the type of consumption. Special Consideration for Dynamic Load Components Some organizations have gone to great lengths to estimate dynamic load characteristics for the purposes of dynamic simulation. An indication of these load characteristics can often be obtained from fault recordings at major load centers. Load models can be developed to match the characteristics depicted in these recordings. These models transform what would normally be represented as a single load in the state estimated powerflow to a composite load model that attempts to account for the following components: Equivalent distribution transformer models with saturation characteristics Portion of dynamic induction motor model with shake-off characteristic (Shake-off represents the portion of load dropped as a result of the transient voltage dip during the application of a fault on the system.) Portion of distribution capacitor load Portion of equivalent static voltage and frequency dependent load with shake-off characteristic It has been found that these composite load models can accurately emulate the recorded fault waveforms. They can make a substantial difference in dynamic simulation when compared to simpler static voltage dependent load models. Even the simple addition of distribution capacitor modeling can make a difference of up to 5% in interchange capability. The proportions assigned to each load component are defined from load type represented at the bus. E.g., smelter loads, residential, commercial or industrial. The question still remains, however, whether given the limited number of opportunities to fit models to fault recordings, if one can accurately predict the composition of these models at any particular time. Whilst the total load is known from the state estimator, surely the composition of this load would vary with time of day, day of week and with season. Nevertheless this technique has shown that it would provide a more conservative estimate of a dynamic limit when compare to static voltage dependent load models. A substantial effort is required to gain a better understanding of the load characteristic and to more accurately estimate and predict load compositions at any point in time. Such composite load models can adversely affect DSA performance. Considering that the exact composition of loads may not be known in real time, one needs to weight up whether the burden on performance is worth the additional accuracy that might be achieved.

3-6

Despite current efforts, and considering the importance of loads in power system security assessment, it can be concluded that load modeling, and in particular real-time load modeling, is a domain in which further research and development is warranted.

3.3.4 Contingency Modeling

Contingency models will vary according to the type of security being examined but are likely to be more onerous in nature for the transient security domain. Contingencies in general need to be able to cater for a variety of events including,

Loss of single item of plant, including generators, loads, lines, transformers, reactive plant and HVDC plant. Dynamic loss of generation or load contingencies such as: o Loss of largest generation in a region o Loss of largest generation at a station o Loss of largest load at a station For these contingencies, the plant to be tripped would need to be determined at the time of analysis. Application of unbalanced faults at any location along a line. All types of unbalanced faults and three phase faults need to be allowed for. Opening a line or transformer at either end at different times. Note that lines other that the faulted line may be opened to clear a fault. Adjustment to generation or loads Adjustment of HVDC set points Multiple line faults when considered to be credible. Multiple contingent events which are considered to be credible, e.g. the loss of multiple generation plant at a station as a result of common mode failures

The contingencies need to identify the appropriate items of plant being faulted or opened. This is important when the contingencies are defined in EMS terms; the definition needs to go through the same conversion process as the network model.

3.3.5 Special Protection Systems (SPS)

Special Protection Scheme modeling is becoming more and more critical. Lack of SPS modeling may result in false indication of insecure operation. Some SPS can be quite novel and complex and may require just as complex modeling capability, which may be difficult to address generically. One such example is a scheme that dynamically arms units and loads for tripping based on the current system conditions at the time. There are basically two techniques to model an SPS: The SPS actions could be modeled as part of the contingency definition. If the contingency is modeled in the EMS, the SPS actions can also be determined in the EMS and translated as part of the contingency definition. The SPS could be modeled as a separate function in the analysis engine, and applied together with the contingencies. This technique could be used for static security, and for transient security analysis, where SPS can be modeled as dynamic models. For other forms of stability the post SPS state of operation need to be analyzed. This technique would require the full modeling of the SPS triggers and actions, but would also provide the greatest functionality. 3-7

SPS triggers would need to include under and over voltage, line and transformer loading, interface loading and various logical combinations of these. Trigger thresholds could be a constant or some function of seasonal or device ratings. SPS actions need to cover all the actions that can be modeled in a contingency.

3.3.6 Model Accuracy and Validation

For a system model to be used in DSA simulations, it is critical to ensure that the model is capable of adequately replicating the actual response of the power system to which it is to be applied. If devices are modeled on a component basis, then it is necessary to ensure that both the device models and data are correct for the full myriad of devices that could be present. Depending on the type of simulations to be performed, both steady-state and dynamic models (and associated data) must be validated. Devices for which dynamic models may be needed include generators and controls, system protections (relays and special protection schemes), FACTS devices, HVDC links, under-load tapchanging transformers, switchable shunts and reactors, and loads. To have confidence in the results of analysis, the models used must be validated for accuracy. While this is a considerable challenge, it can be separated into three components.

The first type of validation is measurement validation and can be achieved through use of advanced measurement technology (such as phasor measurement), better metering, and advanced state estimation algorithm. The second type of validation is device model validation. As a preliminary step, surveys can be conducted to determine if the simulation models match the actual devices in the field. If needed, further validation can be achieved through field-testing of devices. For example, in the wake of the blackouts of 1996 in the western interconnected system of North America, the Western Electricity Coordinating Council (WECC) mandated a generator testing and model validation activity. This process has uncovered a wide number of errors and inadequacies in the original WECC model library and has resulted in fully validated dynamic models for generators and controls. Load modeling is more of a challenge, and due to the inherent variation of load over time, field-testing has been met with limited success. Alternative approaches, such as synthesis of models from survey data and on-line load model identification devices, are likely to be more fruitful. The third type of validation is system model validation. This involves verifying that the overall responses of the simulating model are consistent with the actual system performance. Because only limited system testing is possible in this regard, the main source of validation is thorough replication of actual system disturbances. Data obtained from disturbance monitors or phasor measurement units can be invaluable in these efforts.

3.4

Computation

3.4.1 Required Computations

What operators need to know at any instant of time is (a) how secure is the current system state, (b) how secure will the system be if it is maneuvered, in the next few minutes, from the current state to a different state, and (c) if the degree of system security is unacceptable, what measures can be taken to make it acceptable?

3-8

In essence, the primary challenge is to verify the security of the current state and find the secure region within which the system can be maneuvered. This secure region can be conceptually visualized by the nomogram as illustrated in Figure 3-3 (full nomogram) [1] and is defined by boundaries set with respect to limits representing various security criteria including,

Thermal overloading of transmission elements Steady-state voltage and frequency excursions Transient voltage dip/rise Transient stability Small signal stability Voltage stability Frequency stability Protection margins Other
Figure 3-3: Security nomogram showing a secure region in which the operator can maneuver the system without encountering operating criteria violations. This is a twodimensional nomogram representative of the case of two generation groups. The boundaries are determined from assessment of thermal loadings, transient security, voltage security, and small signal stability.

3.4.2 Analytical Methods

The types of methods used for dynamic security assessment are widely varied and can be considered as spanning into two extremes,

Deterministic evaluation using analytical solutions: This is the most complex of approaches in which the response of the power system is assessed using detailed models of the steady-state and dynamic characteristics of the system. Contingencies are applied and the responses computed using techniques such as time-domain simulations. Direct inference from measurements: This is the simplest of approaches in which the security of the power system is inferred from direct quantities measured from the grid; using the difference in two phasor measurements to establish transient security for example.

In between these two extremes are a plethora of methods differing in computational complexity and which may include hybrid approaches combining simulation with some direct or measurement-based methods. The assessment of limits associated with comprehensive security assessment can be done using either full simulations or using approximate methods. Examples of full simulation methods include full powerflow solution of PV curves, time-domain simulation for transient security and eigenvalue analysis for small signal stability assessment. Approximate methods include techniques such as sensitivity methods for voltage security assessment and direct energy methods for transient stability assessment. Although the approximate methods may offer some speed advantages, the full simulation methods provide the most accurate assessment of security and eliminate the question of the suitability of the assumptions made in approximate methods under changing system conditions.

3-9

On-line monitoring of power oscillations There are analytical techniques based on measurements that can be used to assess the security of the power system without a simulation model. One of these is the on-line estimation of damping [2]. The method is based on the continuous and random changes of loads that create continuous smallamplitude power oscillations. By making suitable assumptions about the nature of the random perturbations of the system it is in theory possible to identify the dynamics of the system. Instead of making assumptions concerning the nature of the random perturbations, it is also possible to simply analyze the spectrum of the measured power for instance by Fourier analysis or to use bandpass filtering to see the amplitude of the oscillation on the most relevant frequencies which are often at least believed to be known beforehand based on off-line simulations. Instead of utilizing direct measurement of active power in the monitoring of oscillations it is even possible to use phasor measuring units (PMU) to provide inputs for the system. The power oscillations are seen as changing angle differences between the voltage phasors measured at the two ends of the corridor through which the power oscillation is taking place. By having several PMUs placed suitably in different parts the grid it is possible to see which areas (or even which components) of the system are participating most in the different modes of oscillation. It is important to pay careful attention to electromagnetic compatibility issues when monitoring power oscillations. If there are disturbances present in the measurement signals, there is a risk that the measured signals do not reflect real oscillations of the power system. On-line monitoring of power oscillations can as such only give information of the small-signal stability in the present state of the system. When a contingency occurs, the damping can change drastically. The on-line monitoring system could in principle give warnings or alarms, when the estimated damping gets too poor or if the amplitude of oscillation on one or several of the frequency bands exceeds a certain threshold. It is however questionable whether the operator can react sufficiently fast, if the poor damping is a result of a contingency and not of slowly developing smallsignal instability. To maintain security also in terms of contingencies it is therefore necessary to perform contingency analysis based on a simulation model. The on-line monitoring cannot replace the contingency analysis, if the n-1 criterion is applied in the operation of the power system. Only if stability is not required after contingencies (n-0 criterion), the required degree of security can be based on monitoring only.

3.4.3 Simulation of Contingencies

The types of contingencies that an on-line DSA system should be able to model were described in Section 3.4.1. However, for any DSA implementation a key decision is the scope of contingences to be studied. For practical reasons, not the least of which is computation speed, it is impractical (and unnecessary) to fully study all possible contingencies. Normally, the contingency specification is based on the applicable operating criteria such as N-1 or N-2 that must in turn be specified in terms of voltage level and electrical/geographic region (for example, all N-1 for 230kV and above within the study region). The total number of contingencies which can be assessed during each DSA cycle is determined by the cycle time available, the time to simulate each contingency, and the computational resources (computer hardware) available. For some security analyses, such as those using powerflow based methods, a very large number of contingencies may be examined with manageable computational difficulty, but for more intensive simulations, such as full time-domain simulations, a large number of contingencies may require significant computational resources. In this case screening, as described in Section 3.5 below) may be needed to reduce the number of contingencies to be studied.

3-10

3.4.4 Database
In addition to housing the on-line data, the database should also contain history data. The powerflow cases used in the contingency analysis should be archived and available for a defined time period (days, weeks, or months) and the measurement data should be stored permanently to facilitate postfault analysis off-line and the studying of trends. It should be possible to regenerate the powerflow cases used in the contingency analysis and to re-estimate the indices related to the power oscillations (including mode frequencies and damping). The accumulation of knowledge concerning the dynamics of the system and the estimation of damping can be a slow process, which can make it necessary to perform analyses afterwards also for the purpose of testing new estimation algorithms.

3.4.5 Intelligent Systems

There are significant opportunities for the introduction of intelligent system into the type of on-line DSA system described above which we may refer to as deterministic systems since they rely largely on enumerated analytical solutions. Intelligent systems are seen to have three features that can bring benefits to the real-time environment,

Intelligent systems can be very fast. Although distributed computation is now commonplace, full simulation methods require minutes of time to reach a conclusion. For large power systems in which many contingencies must be assessed, even with multiple-CPU computing, this time may be of concern and for on-line analysis, time is critical. This is particularly true if a system is entering an insecure state and decisions must be made quickly. Once developed, IS technologies such as neural networks (NN) or decision trees (DT) can provide solutions very quickly. Intelligent systems are learning systems. Deterministic systems will conduct the same computations every cycle even if some of the calculations could be deemed inconsequential or if conditions arise rendering the computations less accurate. IS systems have the ability to establish if a system condition has been seen previously and predict the solution accordingly. Similarly, if properly designed, an IS can adapt to new conditions by learning from situations previously seen. Intelligent system can provide a high degree of discovery. Discovery refers to the ability to uncover salient, but previously unknown, characteristics of, or relationships in, a system. For example, through the development of NN or DT, the system parameters that are crucial to security can be established, much in the same way as an operator would discover such traits over extended periods of time by observing the system behavior.

The role of intelligent systems is seen as one that is complementary to the so-called deterministic DSA approach. The concept is that an IS will supervise the DSA and perform the following functions,

Establish if the system security can be established without full simulations Determine what full simulations may be required Assist in the interpretation of the simulation results and provide insight into system critical parameters Learn from the results of simulations Assist in the specification of remedial actions 3-11

Based on the above functions, the IS can provide direct assessment capabilities and can provide supervision to the existing on-line DSA capabilities, much in the same way that a human operator could if sufficiently experienced and fast.

3.5

Performance

Although detailed simulations are recognized as providing the most accurate security assessments, speed of computation remains a challenge particularly with the complex models required in analyzing large interconnected systems. Simplified or direct methods can play a complementary role with full simulation, particularly in contingency screening. The typical computation cycle for an on-line system is 5 to 60 minutes, that is to say that a complete security assessment must be completed within 5 to 60 minutes from the time the snapshot is taken from the system to the time the results are made available. Since security assessment must determine the security for critical contingencies, and since it is generally impractical to study all contingencies in detail, one main element in on-line DSA is contingency screening. Contingency screening is the ability to select, from an extensive list, the important contingencies which must be analyzed in detail. While numerous methods have been proposed and applied for this task, it remains a balance between speed and accuracy. Screening methods for thermal overloading or voltage declines may be much easier to apply than those for stability, in which complex dynamics and nonlinearities of the system may render simplified screening methods unreliable. However, research in this field is on-going. Another approach in dealing with computation speed issue is to increase the computing power of an on-line DSA system by distributing computations among multiple servers. This can be easily achieved since the DSA problems are parallel in nature, at least at the contingency and analysis scenario levels. Distributing DSA analyses makes the computational performance of a DSA system scalable with the number of servers used, thereby increasing the DSA processing power for large system models.

3.6

Automation and Reliability

On-line DSA systems should run continuously on a scheduled cycle, be triggered by specified system changes, or invoked manually. The system must be highly automated and be capable of completing all tasks, repetitively, under varying conditions with little or no human intervention. This demands not only high standards for the DSA software but also functionalities with certain intelligence in order to provide the required results. For example, determination of appropriate remedial actions may need the assessment of additional contingencies and/or system scenarios depending on the security assessment results. Reliability is another important issue for an on-line DSA system. As illustrated in recent blackouts, the potential consequences of the unavailability of mission-critical software applications can be devastating. In addition to ensuring the deployment of high quality software and hardware for an on-line DSA system, techniques such as redundancy and self-healing should be considered to meet the reliability requirements.

3.7

Reporting and Visualization

The ability to display the results of the security assessment in a simple and meaningful manner is critical to the success of on-line applications. Generally, an operator is interested in the minimum amount of information needed to manage the power system. Under normal situations, a security assessment tool should monitor the system in the background and 3-12

summarize the security state of the system. It should report how close the system is to an insecure state to give an operator an idea of what may be just around the corner. An interface to the EMS alarm system is essential, such that an alarm can be generated when the proximity to an insecure state reaches a certain threshold, or indeed if the system does become insecure. When insecure conditions are detected, an operator is interested to know, what the problem is, and how to fix it. He is not generally interested in all the detail in between. This should be what the security assessment interface focuses on. For example, this may be accomplished by utilizing traffic light type of visualization. Green would mean a secure state, yellow would indicate an alarm requiring more attention due to a potentially insecure state of the system and the read color would indicate an urgent need to bring the system back to a secure state. It is important that operators are not overwhelmed by an unmanageable number of alarms or by repetitive alarms that lose their impact over time. There should also be tools to visualize the detail should such a potentially insecure situation arise. It is important that the security assessment tool provide sufficient information for an operator to assess the insecurity and apply the appropriate remedial action. Ideally it would be good if the tool would provide advice on how to remove the insecure state. Once an insecure state is detected an operator needs to know how to return the system to a secure state again. In addition, an operator needs to be able to view and adjust inputs. Examples of DSA Displays Form a practical perspective the main display seen by the operator should provide only the high level critical information including such items as security status, security trend, transfer limits, critical contingencies and DSA system status. An example of such a display is shown in Figure 3-4 . From such a display, the operator should be able to drill-down to obtain a variety of more detailed information. These can be provided in many formats, such as those described below and for which a number of other examples are provided in Chapter 4, Tabular Format: Figure 3-5 shows a summary table from a transient security assessment. The table shows the results of 10 contingencies and provides the operator with a quick indication of which contingencies cause criteria violations and provides information on the type and degree of violation. Similar tables can be used to show results of other types of security assessment and to show power transfer limits.

3-13

Figure 3-4 Top-level on-line DSA Operator Display

Figure 3-5:Table showing results of transient security assessment using time-domain simulations. Each row reports on the results of simulation of one contingency and each column provides a summary of criteria violations (shown in red). If any criteria violations exist, an alarm is provided to the operator as the scenario is deemed insecure.

Graphical Format: Figure 3-6 is a bar chart display showing the history of transfer limit computations over a number of previous DSA cycles. This allows the operator to see at a glance, how the limits are evolving over time.

3-14

Figure 3-6 Bar chart showing transfer limit history

Figure 3-7 shows the results of small signal analysis displayed on a geographic map. Such visualization clearly indicates the regions (and specific generators) involved in an inter-area oscillation following a contingency.

Figure 3-7: Graphical display of the results of small signal analysis showing the mode-shape for a lowfrequency inter-area oscillation. Each generator is represented as a circle (blue) or cross (red) on the map with the brightness of the symbol representing the generators relative activity in the mode. The generators represented by circles are swinging against those represented by crosses.

3-15

Figure 3-8: Graphical display of voltage security assessment. The left pane shows a secure region nomogram in which the crosshair represents the current operating point and the green region represents the area in which the operator can move the generation without criteria violations. The right pane provides a summary of the limiting contingency and the associated violated criteria for each point on the boundary of the secure region.

Figure 3-8 shows a secure region nomogram for voltage security analysis. The region is bounded by criteria violations of thermal overloading, voltage stability, voltage declines, and reactive power reserves. With this display, the operator is free to maneuver the system within the green region without encountering security violations. Combining nomograms of this type for voltage security, transient security, and small signal analysis results in the graphical display shown earlier in Figure 3-3. The above security assessment result displays can be associated with other types of visualizations to have comprehensive understanding of the system performance under the studied conditions. For example, a critical system condition laid out on a geographical transmission system map can help identify the worst regions of the system. A historical security margin chart can be used to predict and interpret the security of the system. Another trend in result visualization is to provide full security assessment results to local EMS console, as well as to make them available over the internet so that can be viewed at any remote location by authorized personnel. This can facilitate the exchange of security information among control centers so that preventative measures can be taken as soon as the security assessment is done.

3.8

Remedial Control Actions

If an on-line DSA system determines that a specific contingency or system condition may lead to an insecure situation, remedial measures must be determined. Remedial measures can be either

3-16

preventative or corrective actions and could include such actions as,

Load shedding Capacitor switching Generator rescheduling, Transformer tapping, Arming of special protection systems such as generation rejection or load shedding Switching operations Voltage scheduling Interchange scheduling Frequency scheduling Generator commitment/de-commitment

These controls can either be invoked by the operator as recommended by the DSA system, or automatically invoked by the DSA system. In this manner, the DSA system can become an integral part of special protection systems.

3.9

Other Functions

A number of other important requirements for an on-line dynamic security assessment system include, Study mode: The system should allow the operators or engineers to study any scenario of interest in an off-line study mode environment using base data taken from the live system (or archive). Archive: The DSA system should be able to periodically and selectively store cases studied and corresponding output results for use in the study mode or for post-mortem analyses. System monitoring, diagnostics, and maintenance functions: As a component of the real time applications, it is important that the performance of the DSA system is monitored continuously and any indication of operational irregularity should be detected and reported for diagnostics and maintenance.

3.10 References
[1] K. Morison, L. Wang. P. Kundur, Power System Security Assessment, IEEE Power & Energy Magazine, Volume 2, Issue 5, (September/October) 2004 [2] Douglas H. Wilson: Managing Oscillatory Stability using On-line Dynamics Measurement, Power Systems Conference and Exposition, New York, October 2004 [3] An Intelligent System for Advanced Dynamic Security Assessment, J.A. Huang, A. Valette, M. Beaudoin IREQ, Hydro-Quebec, K. Morison, A. Moshref, Powertech Labs Inc., M. Provencher, J. Sun Alberta Research Council, PowerCon 2002, Kunming, China, October 2002. [4] L. Wang, K. Morison, Implementation of On-Line Security Assessment, IEEE Power & Energy Magazine, Volume 4, Issue 5, (September/October) 2006.

3-17

4 2
Chapter 4

STATE-OF-THE-ART IN ON-LINE DSA

CHAPTER 4. State-of-the-Art in On-line DSA

4.1

Overview

As noted in earlier chapters, the number of on-line DSA installations around the world is continuously growing as system operators recognize that this approach may be the only practical solution to ensure power system security. Figure 4-1 shows some of the known installations and Table 4-1 indicates which installations are described in this report.

FinGrid United Power System - Russia NOS- Bosnia Heregovena Italian System TranselectricaRomania Hellenic Power System - HTSO Beijing Electric Power Corp

ESB National Grid BCTC BPA PG&E SCE ERCOT TVA Southern Company Entergy Hydro Quebec FirstEnergy PJM

TEPCO

Saudi Electric Company

Guangxi Electric

ETESAPanama

TNB

ONS

ESKOM NEMMCO Transpower

In-service and described in this report In-servce but not described in this report Under development Tested but not in-service

Figure 4-1 Reported On-Line DSA installations

4-1

Table 4-1 List of some on-line DSA Installations

Country/Region Australia Bosnia-Herzegovia Brazil Canada Canada China China China Europe Finland Greece Ireland Japan Malaysia New Zealand Panama Romania Russia Saudi Arabia South Africa USA USA USA USA USA USA USA USA USA USA Legend TSA VSA SSSA FSA (MB) I/S O/S U/D

Location/Company/Project NEMMCO NOS ONS BCTC Hydro-Quebec Beijing Electric Power Corp CEPRI Guangxi Electric Power Co. Omases Project Fingrid Hellenic Power System ESB TEPCO Tenaga Nasional Berhad Transpower ETESA Transelectrica Unified Electric Power System SEC ESKOM PJM Southern Company Northern States Power MidWest ISO Entergy ERCOT FirstEnergy BPA PG&E Southern Cal Edison TSA 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3

SCOPE VSA 3 3 3 3 SSSA 3(MB) 3 3 FSA 3 3

Status I/S I/S I/S U/D I/S I/S I/S I/S O/S I/S I/S I/S I/S I/S I/S I/S I/S I/S U/D U/D I/S I/S I/S I/S I/S I/S U/D I/S U/D U/D

Section 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13 4.14 4.15 4.16 4.17 4.18 / 4.19 4.20 -

3 3 3 3 3 3 3 3 3 3 3 3 3

3 3 3(MB)

3 3 3 3 3 3 3

Transient Security Assessment Voltage Security Assessment Small Signal Security Assessment Frequency Security Assessment Measurement-Based In Service Tested but out-of-service Under Development

4-2

4.2

State-of-the Art of DSA in Australia NEMMCO

Australias largest interconnected power system encompasses the states of Queensland, New South Wales, Victoria, South Australia and Tasmania, with voltage levels ranging from 500kV down to 110kV. This interconnected system represents a power system that stretches for 5000 km with a maximum demand of about 32 GW. NEMMCO is both the Independent System Operator and the Market System Operator and is responsible for the secure operation of this power system according to the National Electricity Rules. The National Electricity Market (NEM) is a regional based market managed by NEMMCO. An optimized dispatch of generation is issued on a five minute cycle which is binding. Constraints are applied in the dispatch solution to ensure that the power system will remain in a secure condition. These constraints, which represent both the static and dynamic security requirements on the system, can be applied as and when required and are usually formulated using off-line system analysis. NEMMCO has the responsibility to enable and adjust appropriate constraints in order to ensure secure operation. Control of the power system is thus achieved by the application of constraints in the dispatch process. NEMMCO uses real-time security assessment tools to monitor the security of the power system, whereby closed loop control is achieved, albeit via operator intervention.

Figure 4-2 Overview of the National Electricity Market managed by NEMMCO. The market regions roughly correspond to state political boundaries.

4-3

4.2.1 Specific Requirements 4.2.1.1 Scope

Static Security NEMMCO needs to ensure that no item of plant within its oversight is to be operated beyond its rated capability as determined by the asset owner. In addition, subject to any credible contingent event, no item of plant is to exceed its short term capability Credible events that need to be considered are usually the outage of a single item of plant, but from time to time n-2 multiple contingencies may also be declared to be credible events. Ratings that must be respected and need to be monitored can be categorized as: Thermal ratings of lines and transformers and terminal equipment Over-voltage ratings Under-voltage limits Node pair voltage angle difference limits Interface flow limits (these limits tend to represent other dynamic forms of stability limits)

As fault levels have increased over time, there a number or areas where the fault levels can exceed capabilities of aging circuit breakers. It is NEMMCOs responsibility to ensure that fault levels do not violate these breaker capabilities. From the market perspective, constraints to limit post contingent branch flows are formulated off-line for a large variety of system conditions. In real time, the appropriate constraints are enabled to enforce limits on these branch flows. NEMMCO is currently investigating options for constraint automation tools that will bring the constraint formulation process to the near real-time frame. Voltage Security Generally, voltage security assessment is done by asset owners at the planning stage, and predominantly consists of Q-V, P-V and modal analysis. NEMMCO does not currently assess voltage security in real-time but options are being investigated for real-time voltage security assessment. Transient security limit equations have some consideration to voltage stability, but generally voltage collapse is not considered to be too much of a problem in the Australian system. Transient Security A power system that is long and thin, stretching for 5000 km hugging the Australian coast is likely to be subject to transient stability problems. The critical points are along interregional boundaries where the transmission corridors are narrow, and in some cases only a double circuit line spans these regions. Transient Security is probably one of the most studied forms of dynamic stability in the Australian context.

4-4

The Australian power system is particularly sensitive to the control system modeling details and a lot of effort has also gone into developing large signal models for transient stability analysis. So much so, that there is now an unusually large number of user-defined models required for the Australian power system. Off-line studies are performed to assess the transient stability characteristics of the power system and to derive interconnector operating limits to encompass the many scenarios examined in the off-line studies. These operating limits, which are specified in terms of system variables, such as demand, generation pattern and inertia are then applied as constraints in the electricity market dispatch process. . Small Signal Security Similarly, small signal security is a concern in the Australian context where there are a number of inter-regional modes that can be poorly damped. Again a large number of off-line studies are performed to determine the post-contingent damping behavior of the power system from which limit equations are derived that define the operating limits. These limits are then applied in the dispatch process. NEMMCO shares the operation of a small signal damping monitors scattered around the system on the mainland. These monitors detect the damping in the constant perturbations that occur in interregional line flows. They are used to indicate instances of poor damping so that NEMMCO can take corrective action by applying additional constraints in the market. An additional system that uses wide area measurement techniques, monitors the damping more accurately, and is used to calibrate small signal off-line models. Both these systems, however, only monitor the real-time damping and make no attempt to assess the post contingent damping of the system. Options are being investigated to provide this functionality. Frequency Security NEMMCO is required to maintain the power system frequency to satisfy the frequency operating standards within each operating region of the National Electricity Market. A Frequency Control Ancillary Service (FCAS) market dispatches raise and lower frequency control in terms of fast, slow and delayed services to different generators and load centers in an economically optimized manner according to bids. Sufficient FCAS needs to be dispatched to satisfy the frequency operating standards for credible contingent events.

4.2.1.2

Performance Requirements

NEMMCO has the responsibility to operate the National Electricity Market under the National Electricity Rules, which requires the power system to be returned to a secure operating state within 30 minutes of having entered an insecure post-contingent operating condition. Credible contingencies to be examined are defined as the loss of a single item of plant (e.g. generator or line). Credible faults, for the purposes of transient security, are generally considered to be two phase-earth faults of single lines. Some double line faults can also be considered where there are a number of lines that share a right of way and have been declared as credible.

4-5

Double line faults are not normally considered as credible contingencies, unless there are unusual conditions, such as adverse weather conditions, that can increase the chance of such a contingency occurring. Thus during the normal course of operating the system, NEMMCO can declare certain contingencies to be credible or non-credible. In these situations it is important to the able to add or remove contingency definitions for analysis. Similarly, in the dispatch process, different constraints can be invoked depending on what contingencies are considered to be credible at the time. It is essential that the DSA cycle be completed in the minimum amount of time. Adjustments to the power system are usually achieved by the invocation of constraints, which can only be applied at each five-minute dispatch cycle. Thus if the security assessment tool returns a results within 10-15 minutes, then there are only two or three dispatch cycles left for an operator to interpret the results and take the appropriate action to restore the power system to a secure operating state. Hence the desired performance criteria would be for a security assessment tool to be able to return a result with the 10-15 minute time frame.

4.2.2 General Description of DSA Implementation

NEMMCO uses a variety of tools to assess the real time security of this power system. The network model for this system comprises approximately 2100 buses, 1200 lines and almost 300 generating units, which represent a system that stretches for 5000 km with a maximum demand of about 30000 MW.

4.2.2.1

Static Security

NEMMCO uses the EMS Contingency Analysis program to analyze static security. N-1 contingency analysis is performed for the loss of every single item of plant within NEMMCOs direct oversight. There are also a number of n-2 contingencies defined which are enabled when they are declared to be credible contingencies. The effect of special protection systems are also evaluated during the analysis. The assessment involves the monitoring of line and transformer thermal limits node over and under voltage limits voltage angle limits between pairs of loads (as provided by state estimation not measured quantities) interface flow limits (which represent limits heuristically derived from off-line studies of other stability criteria) In addition to contingency analysis, NEMMCO also runs real time short circuit analysis to ensure that there are no violations on terminal equipment short circuit ratings. There are a number of areas where the short circuit levels have grown to critical levels over the years of operation.

4.2.2.2

Voltage Security

Real time voltage security assessment is rather limited at present to the assumption that an unsolved contingency analysis solution is a result of a voltage collapse situation. A number of voltage stability limits are determined in the off-line environment in order to maintain

4-6

the required reactive margin as specified under the provisions on the National Electricity Rules. This is predominantly based on Q-V analysis, though some P-V and modal analysis is also performed. A limited number of transient security limits have also been formulated with voltage security considerations as part of the off-line time domain simulations. As such voltage stability is not as much of a concern, as thermal constraints and other forms of stability appear to be a more limiting factor in the Australian context. However, work needs to be done to improve real-time assessment of voltage security.

4.2.2.3

Transient Security

Transient security is of a major concern for Australian power system. As such this area has seen major investment of resources. The network service providers determine transient stability limits that NEMMCO applies in the form of constraints in the market dispatch engine. These limits are determined by thousands of off-line dynamic simulations that try to cover a whole range of system conditions. Many network service providers use rather sophisticated automated processes to create scenarios and cases for simulation and determine stability limits, usually with PSS/E as the simulation tool. To determine the transient stability of the power system, transmission network service providers and NEMMCO are largely dependant on time domain simulations, primarily with the PSS/E program. Direct methods are usually treated with suspicion largely because of the importance of control system limit action and other non-linearities in the simulation of the Australian power system. Whilst these limits are applied to the dispatch process to ensure that the power system remains stable, NEMMCO has also developed a real time security assessment tool that monitors the real time transient security of the power system, based on state estimator snapshots of the system. The state estimator solution is sent to a PSS/E simulation engine, which, by way of simulation, monitors the transient stability of the power system for a number of different contingencies. Usually there are 55 contingencies selected out of 93 that are defined. The additional contingencies are made available for unusual system conditions and can be enabled at any time, e.g. for double circuit lines when the original line is out of service; or when double circuit contingencies are declared as credible.

4.2.2.4

Small Signal Security

Small signal stability is also of major concern to NEMMCO and network service providers in Australia. At present there is no real time post-contingent assessment of the small signal security and NEMMCO is reliant on off-line studies to produce limit equations that are applied as constraints in the market dispatch engine. In addition NEMMCO has two tools that physically measure the system damping modes present in the power system. These tools are integral to the operation of the power system. When sufficiently low damping is detected, additional constraints are enabled in the dispatch engine to limit power transfers across various interfaces. Psymetrix is a tool that extracts modal damping information from tie-line flows. The Psymetrix monitor analyses a three-minute window of sampled data of tie line flows at various points in the system. The data is sampled at a rate of 50 samples/second. There are a number of measurement nodes spread across the mainland. Each of these nodes detects the different modes to varying degrees. Because of its short sample window, it can detect instances of poor damping rather quickly.

4-7

The Oscillatory Stability Monitor (OSM) is a wide area damping measurement tool that has been installed in Tasmania and on the mainland. It measures the damping modes within the two islands. Every five minutes it uses a three hour rolling window of phasor and voltage samples from a number of collection points in the system to estimate the system damping modes. It has been used for the calibration of the off-line small signal models and for stabilizer performance measurement.

4.2.2.5

Frequency Security

Frequency Control Ancillary Services (FCAS) are dispatched to ensure that the power system frequency is maintained within the frequency standards for credible contingent events. These events include loss of generation, loss of load and network separation events. FCAS is dispatched in terms of fast (6 s), slow (60 s) and delayed (5 min) time frames, both raise and lower ancillary services, based on bids. A raise service is one that raises system frequency. The timeframes fit together so that a rapid and sustained response can provide each of the three services sequentially. Governor control usually provides most fast and slow FCAS, but delayed FCAS is usually provided by manual control of generating units. Load shedding or other load control can also provide the services. In addition to the energy market, NEMMCO manages six ancillary service markets to dispatch the required raise and lower FCAS for the three time frames. Two more markets are used to dispatch raise and lower regulating services. The amount of each service needs to be sufficient to maintain frequency within the required bands for the contingency with the largest FCAS requirement. The allocated FCAS is simply the amount of generation or load at risk, less the expected amount of load relief, as is a result of load frequency dependence, at the relevant frequency standard. This method, however, suffers from a number of assumptions; ignoring the power system inertia, assuming size of disturbance is sufficiently small, and that the rate of change of frequency is zero at 6, 60 and 300 seconds after the event. With the completion of the HVDC link between the mainland and Tasmania, where the size of the link represents a substantial fraction of the Tasmanian load, and the island can have a relatively low inertia, a better method of determining the requirement is necessary. In addition, a special protection scheme, would trip a number of generators or loads for the contingent loss of the HVDC link, resulting in significant inertia or load changes on the island. The new method is now being used to calculate the FCAS requirements in Tasmania. This method models inertia, load relief and the various ancillary services, and requires the following inputs:

Total regional demand and generation Total regional (generation) inertia Amount of generation or load armed for SPS operation Inertias of generating units that are armed for SPS operation. Load relief factor (% change in load/% change in frequency)

This information is readily available in the EMS and, as the calculation of the FCAS requirements is an iterative solution of a number of non-linear equations, it is most practical that this be performed on the EMS. The solution is passed to market systems to dispatch the various FCAS markets. Benchmarking against time domain simulation has shown the accuracy of this method to be superior. It is intended that it will later be used for dispatch of the FCAS markets of the mainland.

4-8

4.2.3 Architecture
The following sections will deal primarily with NEMMCOs on-line security assessment tool, which performs base case Transient Security Analysis. The DSA, as the application is known, is the main on-line facility NEMMCO has for the estimation of Dynamic Security. NEMMCO maintains two co-primary control centers, each fully equipped with redundant AREVA EMS systems. Subsequently, there is one DSA server at each site servicing the site EMS. It was considered that redundant DSA servers were not necessary at each site because the alternate site server could always perform the analysis for both sites. The primary purpose of the DSA is to assess the post contingent transient security of the power system under NEMMCOs oversight. This is achieved by taking state estimator snapshots of the power system and simulating a number of predefined contingencies in a power system simulator on the DSA server. The stability of the system is ascertained by observing the swing characteristics of the generators during the simulation. The greater the angle separation between any two machines, the more unstable the case is considered to be. The results are fed back to the EMS for display and alarming. There are currently 93 contingencies defined, of which 55 are normally selected. The remaining contingencies are defined for unusual system conditions, most of which are defined to cover for cases where there is a prior outage of a double circuit line that should be considered. The contingencies are grouped for rapid selection and, if necessary, contingencies can also be defined on-line. The DSA process is essentially initiated and controlled by an application on the EMS. The EMS not only the starting point for the steady state network model, but also maintains the contingency models. This is necessary because of the need to be able to select and change from the EMS the contingencies to be analyzed by the DSA. A real time DSA run is only initiated by the EMS application when a valid state estimation of the system is available. The estimator solution is dumped into a flat file in a form that reflects the data structures of the EMS. At this point it is necessary to convert the network model from the EMS representation, in the form of nodes and breakers, to a form that is suitable for the simulation engine. In this case the simulation engine is PSS/E, which requires a model in the form of buses and branches. Thus nodes are collapsed and breakers are removed.

Figure 4-3 Architecture of the NEMMCO on-line DSA system

4-9

The formation of buses from nodes actually takes place on the EMS and the information is appended in the flat file. This takes advantage of the fact that the state estimator already has information about the buses that are formed. Once it is passed on to the DSA server, the network model is combined with the dynamic models and input files are created that are suitable for the dynamic simulation engine, PSS/E. In addition the selected contingencies are also dumped to a flat file and the data is converted by the same process to a form suitable for the simulation engine to interpret. A control program on the server initiates a simulation of each contingency, starting with the contingency that produced that worst results from the previous run. In this way it is likely that an unstable condition can be detected very early in the DSA run. A special dynamic model in the simulation monitors the rotor angle swings of each machine in the simulation and assesses the stability of the simulation. If the angle separation between any two machines reaches a predefined threshold, then the simulation is declared as unstable. The results of each simulation are collated and returned to the EMS as soon as they are available. The results are displayed in the EMS in a form that ranks the results starting with the most unstable contingency. An alarm is also generated if any unstable cases are detected. The DSA servers are currently DELL 1850s with dual 3.2GHz hyper-threaded CPUs and 2 GB of memory (which is not as crucial as its floating point performance). Even with the recent inclusion of HVDC models and the reduction of integration time step down to 1 ms, this configuration is sufficient to perform five second PSS/E simulations of all contingencies in less than ten minutes. The handshaking and information exchange between the EMS and the DSA server is achieved by simple file sharing. The applications at both ends are triggered by the appearance of key files in a file share.

4.2.4 Functional Components

The functional components can be divided into the following,

EMS Interface DSA Server Master Control Program Node-to-Bus Network model Conversion module PSS/E Simulation Engine and associated scripts

Node-to-Bus Network Model Conversion - OPDMS The Network model conversion is the cornerstone of the DSA. Without accurate model conversion the DSA would be worthless. The conversion of the EMS, node-breaker base model to a bus-branch network model is achieved by another NEMMCO application, the OPDMS (Operations Planning Data Management System). The OPDMS is a system that was designed to provide planners, both internal and external, with state estimator snapshots in a PSS/E format, suitable for use in PSS/E. It provides both positive and zero sequence data files, together with dynamics models of generators, excitation systems, stabilizers, governors, SVCs and any other item of plant that requires dynamics models for the purposes of time

4-10

domain simulation. It is also capable of creating data files that can be used for small signal analysis. In addition, it has features for the maintenance and mapping of dynamic model data together with bus number definitions. The models can be edited and preferred bus numbers assigned by the Transmission Network Service Providers who develop these dynamic models in the first place. There is an integrated authorization process whereby models are validated and approved before they become available in downloaded snapshots. The bus numbers and dynamic models are mapped to the network model on an EMS node basis. As all the data files, including the dynamics data file are created by the OPDMS when a snapshot is requested, the bus numbers will be synchronized across all data files. This is particularly important when various items of plant can end up on different bus numbers depending on the breaker topology at the station at the time of the snapshot. Furthermore dynamic model parameters themselves can also be a function of bus numbers. This is useful when the model parameters specify sources of input signals from remote buses or even lines. By allowing the network service providers to map their bus numbers to nodes, they can ensure that snapshots will come out with their preferred bus numbering schemes in the data files. The DSA uses the model conversion module in the OPDMS, but is independent of the OPDMS. This is designed to improve the availability of the DSA. It has its own cache of dynamics models and bus number mappings, which are regularly updated from the live OPDMS. The first phase of the conversion process takes place on the EMS side, where it takes inputs in the form of the EMS network model to create a flat file with all the information to represent the steady state network model, including zero sequence data. As most of the bus information is already available from the state estimator the model conversion also takes place here, creating buses from nodes and assigning circuit identifiers, bus types and even collapsing zero impedance branches. Once the flat file is created, the OPDMS application on the DSA server combines the data in its cache with the network model in the flat file. The final bus numbers are assigned to buses and to the dynamics models. The snapshot consists of three PSS/E files, the static network model (or load flow) representation, the zero sequence model and the dynamic model parameters. A high proportion of the dynamic models are user-defined models, which are coded up as Fortran subroutines and linked in with PSS/E. The OPDMS conversion has a number of other features:

Ability to selectively exclude certain types of models on a region bases (e.g. governor models on a region bases) Converts to equivalent loads those generators that dont have dynamic models associated with them. A requirement of PSS/E is that all generators must have dynamic models Converts switch shunts to fixed bus shunts as a work around for PSS/E not being able to handle operational switch shunt combinations. Provides other work-arounds where the PSS/E format does not allow for various features.

The files created by the OPDMS should be able to run directly in PSS/E without further manipulation. In addition, the OPDMS also performs the conversion of the contingency definitions. The contingencies are defined on the EMS in terms of EMS identifiers. The OPDMS creates PSS/E scripts from these definitions that apply faults and open lines identified by bus numbers that match those defined in the PSS/E powerflow file already generated. The contingencies that have been chosen are well understood in planning circles, and the mechanisms to alleviate unstable outcomes are well known.

4-11

Figure 4-4 Screen shot of EMS Display

Other contingencies may well also yield unstable outcomes, but without the prior knowledge of dealing with the contingency it is difficult to justify inclusion. EMS Application Interface The EMS has primary control over the DSA where runs are initiated and the results displayed. It is the only interface available to the control room operator. Contingencies are defined on the EMS and using prior understanding of the contingencies, they are associated with individual cutsets. Some may actually belong to a number of cutsets. This will make it easier, when results are displayed, to identify which cutset needs attention should an unstable contingency be detected. Contingencies can be rapidly selected on a group basis or individually as well, as shown on the screen shot in Figure 4-4 . Results are displayed by the EMS application (see Figure 4-5 )and are ranked in terms of their

Figure 4-5 Screen shot of DSA results display

4-12

maximum swing angle. The greater the maximum swing, the more unstable the contingency is considered to be. Both the current run and previous run results are displayed, so that, whilst the current run is still incomplete, there will always be at least one complete set of results available. Detailed information about an individual contingency result can be called up which includes the two machines that contributed most to the maximum angle swing. This information, together with the cutset association, gives the operator a crude indication of where problem could be. The operator can then take remedial action by applying constraints along the cutset that is yielding the unstable contingency. The EMS also has an interface to the EMS alarms and will raise alarms for the following conditions:

Unstable condition is detected There was a simulation run failure and results could not be returned The initial mismatch in PSS/E was too large.

DSA Server Control Program The control program on the DSA server orchestrates the various tasks on the DSA server once the job has been handed over to the server. This includes

Initiating the OPDMS process to create PSS/E data files for the given snapshot Converting the contingency definitions to PSS/E scripts The setting up of the base case power flows Queuing the various PSS/E simulations and running them when resources are available. This has two advantages in that it is actually more efficient in terms of overall CPU performance and this allows the more critical contingencies to be processed first to provide results sooner. Collation of results from the PSS/E simulations and the packaging of these results on to the DSA client application on the EMS. These results are passed back to the EMS application by simple file transfer where they are displayed immediately. All the general house keeping on the DSA server Recovering from errors in the simulation when they occur

The control program also reads a number of control parameters, some of which are set by the EMS application. These control the higher-level functions on the server, like the simulation times, initialization tolerances, logging levels and how to communicate with the EMS. PSS/E Simulation Engine At the heart of the DSA is the simulation engine. The stability of the system is determined by time domain simulation of contingencies on the power system. PSS/E uses the trapezoidal rule for the integration of differential equations to perform time domain simulations. Individual simulations are queued for each contingency to be analyzed, with the worst contingency from the previous run at the head of the queue. The PSS/E simulations are controlled by IPLAN scripts, which perform initialization and then apply the contingency during the simulation. If unbalanced faults are to be applied the equivalent zero sequence impedance is also calculated using the supplied sequence data. The simulation time is currently set to five seconds. Whilst a ten second simulation time would have been preferable, it was considered that limiting the simulation to five seconds would not introduce too much error and was worth the improved performance benefit. A special dynamic model that is included in the simulation is a rotor angle swing monitor. This 4-13

model monitors the maximum angle deviation between any two machines in the simulation. A simulation is declared to be unstable if the maximum angle between any two machines being greater than the stability threshold. If this is the case the simulation is stopped and the results are reported back to the control program.

4.2.5 Distinguishing Features

The stability measure is a swing criteria, where an attempt is made to measure the amount of swing any two generators can undergo during a contingency. This is achieved by ignoring the initial steady state angle separation and by monitoring the amount the rotor angle moves during the contingency. This rotor angle swing monitor also has a number of distinguishing features:

It has the ability to look at swings within each individual island, even when islands are created as a result of the contingency during simulation. Ignores the initial angle spread. The swing monitor is trying to measure the amount of swing between any two machines, not the angle separation. This should avoid any bias towards generators that have a large starting angle. This simple measure has proved to be surprisingly reliable. It has the ability to exclude certain specified generators from being monitored. This is to avoid problems with equivalent generators that are use do to model voltage source converters. It can also be used to exclude certain small generators at the extremities of the power system, which can be considered as insignificant if they lose synchronism. The monitor has early termination criteria, so if early on in a simulation the rotor angle swings do not appear to be growing significantly then the simulation is terminated early to improve performance.

An attempt is made to detect unstable cases as soon as possible, by running the contingency simulations in the order they were ranked in the previous run. In this way a developing unstable situation should be detected when the first simulation is completed, which could be in less than one minute, even before the run is complete. Confidence in the state estimator solution is measured by the amount of mismatch the state estimator solution has at each bus. If the mismatch is too high then the solution is flagged as such and none of the network applications, including DSA, will proceed until a reasonable solution is obtained. Since the network model conversion is such a significant step in the DSA, it would be beneficial to monitor the accuracy of the conversion process itself. Ideally the DSA would end up with an accurate representation of the current state of the power system, but errors and approximations introduced by the conversion process serve to blur this. In an attempt to monitor confidence in the conversion process, the initial mismatch is measured as soon as the powerflow is read into PSS/E, prior to any attempt at a powerflow solution. An alarm is raised if the initial mismatch becomes too high to indicate that there will be some uncertainty in the DSA solution and that they should be treated with a bit more caution. There are a number of other tests that could be performed to try to measure confidence in the converted solution. Other features of the DSA include:

The DSA can accept study cases from the EMS in the same manner as it does in the real time cases Facility to accept study requests from planners who submit PSS/E files directly for analysis. Ability to choose contingencies on group basis Ability to exclude governor models on a region basis. This feature is required because it is sometimes difficult to initialize governor models and feature allows a solution to be obtained at

4-14

slightly less accuracy. As governors are relatively slow acting, the removal of governors has limited impact on the accuracy of the solution. Contingency definitions are defined on the EMS and are translated by the same process that generates the power flow files. This ensures that the contingency definitions always map to the correct buses in the power flow.

4.2.6 Performance and Reliability

There has also been a lot of work in improving the performance aspects of the process. There were a number of trends that were degrading the performance of the DSA. These included, increasing number of contingencies, growth in the power system dimensions and increased complexity of the dynamic models. At one stage the performance degraded to a point where it was taking 25 minutes to perform a complete run. Since 2002 there have been a number of steps taken to improve performance, including:

Installation of faster hardware Development of early termination that would detect stable contingencies early and terminate the simulation. Improvement in the OPDMS network model conversion, which was originally taking a significant portion of the available processing time.

The recent implementation of HVDC modeling for Basslink and the need to halve the integration time step, has seen another degradation to the performance where now the complete cycle takes almost ten minutes The current performance is just sufficient for base case analysis, which is still far away from the intended ultimate development. The importance of the DSA to NEMMCO has been crucial over the period of time that it has been in service. NEMMCO has become reliant on the DSA, to the point that immediate 24 hour support is necessary in the event of failure. For this reason, a lot of effort has gone into making the DSA more reliable. Reliability should be considered in two contexts:

Solution accuracy, or false indication of stability or instability. This will be discussed in the section on Operational Experience. Reliability in obtaining a valid result and not experiencing solution failure.

Much work has gone into the DSA to make it more reliable. The DSA is a critical tool for NEMMCO and is expected to run successfully at each run. Figure 4-6 shows the failure rate the DSA has experienced over a twelve month period. It shows that there is a general improvement over that time as enhancements were made, and it also shows that by far the worst problem is initialization failure. DSA failures can be basically attributed in the following categories:

4-15

Figure 4-6 DSA Failures

Dynamic Model robustness: This is the primary cause of initialization failure. This is a particular issue for NEMMCO as a significant number of models are user-defined models, provided by network service providers. Most of the dynamic models come from a planning realm that work on well-behaved planning studies but often cannot cope with the unusual operating conditions that can be experienced in real time. Usually teething problems are experienced for a period when a new model is implemented until it is tuned for the real time environment. Typical examples are governor models that rarely allow for overload capability of the generator, which is now a regular occurrence in the market driven dispatch. Others include models that rely on a particular topology. The summated flow on parallel lines, for example, could be used as input to a stabilizer. It would be foolhardy, however, to assume that all the parallel lines would always be connected to the same bus, in real world examples. Another important aspect to consider here is that it requires the failure of only one dynamic model to render a complete solution failure. Often it is the same model that causes initialization problems, and these are the models that need the attention.

Telemetry and State estimator solution: State estimator solution itself can drive models into unexpected operating conditions. This often is as a result of poor telemetry coverage. The state estimator sometimes has bad estimates of loads whereby loads end up with a very poor power factor. This often leads to power flow solution failure in PSS/E.

4-16

Telemetry: Often there is insufficient telemetry of important statuses, such as HVDC control modes, AVR statuses, etc, so an assumed state may work much of the time, but can cause initialization failures when the physical operating conditions change. Other models also require analogues that are not available in the EMS. Some governor models require lake levels to initialize correctly, so there is no single set of default model parameters to suit all conditions. The only viable solution for this is for telemetered lake levels to be fed to the DSA. Whilst the obvious solution would be to improve telemetry, this is not always possible and the best compromise is to set up manual inputs that can be hand dressed in the EMS to represent these inputs. This would only be feasible for points that do not change regularly.

Bus-Branch Model: The PSS/E format does not always lend itself to the detail that is contained in the EMS and often approximations or assumptions need to be made in the conversion process. When these assumptions break down, we are often left with errors in the PSS/E solution. This can either yield to PSS/E solution failure or, worse still, to an inaccurate solution. Though not ideal, the only way to address these situations is to implement work-arounds either in the EMS or in the PSS/E model itself. Topology dependant models are particularly sensitive to the Bus-Branch conversion. These are typically models that refer to buses or lines as part of their parameter data. These parameters need to be mapped correctly to EMS nodes in OPDMS so that correct bus numbers will be generated during the conversion.

EMS Model Issues: Usually the EMS model is more detailed than the PSS/E model, but in some instances this is not the case. One example is for voltage source converter HVDC links, which are modeled as equivalent generator pairs in the state estimator. There is no linkage between the two generators and sometimes, but surprisingly rarely, the state estimator can come up with solutions that are infeasible for the DC link and cause initialization problems in PSS/E.

4.2.7 Operating Experience

NEMMCOs DSA has been operational since 2001, and in that time many improvements have been implemented, as a result of operational experience. Originally it was planned that the simulation load would be shared across the two sites at NEMMCO, with half the contingencies being processed at one site and the other half at the other site. However, operators were more comfortable if the full set of contingencies were enabled at both sites. Usually instabilities are quite marginal and small differences in the state estimator solution can mean the difference between a stable and an unstable result. Since the estimator solutions being fed to the DSA are slightly different at the two sites, the DSA can yield different results at each site. Also note that the timing of the results from the two DSAs are not necessarily synchronized. An unstable situation first needs to be confirmed at the alternate site before NEMMCO takes any remedial action. Figure 4-7 is a calendar that shows the days in a period of 12 months where unstable operation had

4-17

been detected. It was a surprise to note the large number of unstable indications, particularly when one considers that the constraints in the dispatch process were expected to avoid insecure operation. Many of the unstable conditions detected are fleeting conditions, usually during switching operations. However a significant number are bona fide unstable situations have occurred. Because of the volume of cases involved it is far easier to check for false indication of instability, rather than false stable indications. Particularly when the DSA was first commissioned much effort was expended investigating detected unstable conditions. These investigations showed that there were a number of underlying issues that yielded false unstable indication.

Figure 4-7 Calendar of DSA performance

4-18

SCADA and Estimator Issues: One particular example is for generator terminal voltage. Because some sites do not have SCADA telemetry for terminal voltage or generator transformer tap position, the state estimator is free to solve at any valid voltage and tap position. Unfortunately, when the state estimator solved for low terminal voltages, the dynamic excitation models ran into under-excitation. This usually resulted in local unstable modes for those generators. This was easily addressed by adding pseudo measurements that would bias the terminal voltage near 1 per unit. Other unstable cases can be attributed to poor state estimator results, such as generators with high MVAr output, or SVC solving near the end of its their dynamic range. Improved telemetry can help rectify most of these issues.

Dynamic Models: Often there would be a problem with dynamic models that ended up in an unexpected operating mode and would cause unstable indication. This could be attributed to dynamic model robustness. Load modeling is particularly critical also. So much so that an attempt to model distribution capacitors below the levels of the EMS modeling can yield up to about 50 MW improvement in transient stability limits. This was evidenced for an extensive period of time in May and June 2005 where the DSA was falsely indicating unstable, whilst the limit equations provided by the network service provider did not. Once the distribution capacitor modeling had been implemented the unstable indications disappeared. Network Model Conversion: Some problems with the network model conversion process may lead to unstable indication, though total solution failure is more likely.

A number of unstable conditions have occurred during unusual operating conditions where there are multiple prior outages in the system. In these conditions the limit equations provided by the transmission network service providers no longer hold true. It has also been found that the stability behavior of one part of the system can be influenced by conditions on the far side of the system and is not always possible to ignore these effects. In other situations, the DSA has detected unstable local oscillatory modes rather than a system wide transient problem, where a single machine, or station, would have an undamped oscillation against the rest of the power system. However, the major issue is to understand how to deal with an unstable situation when it arises. Usually a particular contingency may be affected by the flow in a particular cutset, but this is not always the case. Hints are provided by grouping contingencies into cutsets and by reporting on the two machines that contributed most to the instability, but this is often insufficient. The two machines are often on the extremities of the system and it is difficult to see where the separation occurs. There is no mechanism to viewing how groups of machines are separating. A good example occurred in March where a bona fide instability was detected, but it was unknown how the situation could be alleviated. There was no cutset that was near any limits and nothing 4-19

seemed to have any affect. Extensive investigation later revealed that there was an unknown cutset that wasnt being monitored. Transfers need to be reduced on this new cutset in order to alleviate the problem. New constraints were formulated in the dispatch engine to control the transfer across this cutset.

4.2.8 Proven Benefits

The most apparent benefit of the DSA at NEMMCO came when a new transfer corridor prone to stability problems was discovered. This issue had been previously unknown. With the addition of further contingencies it is hoped that new problem areas can also be identified. Another obvious benefit is the ability to monitor and maintain the power system stability whilst it is experiencing multiple prior outage conditions, where the heuristically derived constraints no longer hold true. This seems to become a more common occurrence under a market driven environment. The DSA provides confidence in the heuristically derived limits that drive the dispatch process and acts as a monitoring tool that ensures that the constraints are working as they should. It enables NEMMCO to run the power system close to the envelope with confidence. At present there is no financial benefit to the electricity market while the heuristically derived constraints are being used in the dispatch engine. The DSA only operates as a monitoring tool. However, with confidence, there may come a time when the traditional constraints to maintain security are replaced by real time constraints derived by the DSA. At this point the market would benefit immensely by virtue of the increased transfer capabilities that can be achieved as a result. Studies have shown that even small improvements in transfer capabilities can yield annual benefits of many million dollars.

4.2.9 Planned Enhancements

The current DSA at NEMMCO is far from the ultimate development and was really only set up as a proof of concept and was much more successful than originally anticipated. The next stage of the project is long overdue and is scheduled to start in 2007. It involves some major enhancements. These enhancements include: Continuous effort in improving the robustness of user-defined models Implement many more contingencies. Determine stability limits in real time along transmission corridors, by iterating to find the limit. This will actually give a better measure of the security of the power system and how close to the envelope it is being operated. Each cutset would need to be examined. Furthermore, if an insecure state is entered, it will indicate how much the transfer level needs to be reduced to bring the system back to a secure condition. This feature will go along way in providing recommendations about what an operator needs to do in such situations. Perform oscillatory and voltage security analysis in addition to the transient security analysis. This will add an extra dimension to dynamic security analysis. Provide useful recommendations in alleviating insecure conditions. Implement faster integration algorithms. With the order of magnitude improvement in computation required to support additional contingencies and iterate to a limit, it is becoming impractical to use the existing PSS/E architecture. Major efficiency improvements are required to support this and alternatives are being examined which could have much better performance characteristics.

4-20

4.3

State-of-the-Art of DSA in Bosnia and Herzegovina - NOS

4.15.1 General Description

The Independent System Operator (NOS) of Bosnia and Herzegovina (BiH) has full dispatch responsibility and authority for the operation of the BiH electricity market. The BiH power system, which comprises the electrical generation and transmission facilities in the entire country, operates as a UCTE Single Control Area within the UCTE Control Block which encompasses Bosnia and Herzegovina, Croatia and Slovenia. On a regional scale, the BiH power system is part of the South Eastern European interconnection, which includes all the transmission systems from Turkey in the East to Slovenia in the West, and from Greece in the South all the way to Hungary in the North. Due to its location at the center of significant, and unregulated, MW transfers across the transmission networks of the market participants in the region which may significantly affect the operating reliability of the grid, NOS BiH has deployed real-time network modeling and analysis capabilities that compute, at any moment, with reasonable accuracy, and quickly enough to support on-line decision making, the distance between the current operating point and the state of maximum loadability where voltages may collapse and units may get out of synchronism. The approach taken by NOS is particularly significant in the aftermath of the blackouts that affected utilities in US, UK and mainland Europe in 2003, and offers a fine example of fast paced and inexpensive enhancement of an existing SCADA system with functionality that helps monitor and maintain the power system operating reliability. The solution passed the system acceptance testing and became fully operational within only six months after the terms of reference for adding real-time network analysis and stability assessment to the bare-bones SCADA were published -- with the state estimator running at five minutes intervals, real-time stability calculations being automatically triggered after each successful state estimate and converging in less than 1 second, and one of the Operators consoles displaying, in a user-friendly graphic format, the continuously updated value of the distance to instability and the safe operating margin of the Bosnian power system. The main features of this implementation are summarized in the following.

4.3.1 Architecture 4.3.1.1 Hardware Configuration

Prior to mid 2004, when it officially began its operations, NOS was known as the Joint Power Coordination Center, or ZEKC, which is the acronym in the local language. In early 2000, ZEKC undertook a large SCADA/EMS Project consisting of a SCADA/EMS at the NOS BiH control center, four regional SCADA control centers, OPGW based telecommunications, and RTU/ISAS. The implementation schedule for this project, which is now being pursued at full speed by NOS, is relatively long and the system is expected to be commissioned in 2008. In the immediate future, NOS BiH will also be equipped with a balancing market system. In order to support its operational mission during the transition period, NOS had to upgrade the interim system installed by ZEKC in 2002 to provide limited functionality SCADA and AGC relief on a temporary basis. The enhancement was implemented in 2005 in record time and included a State Estimator and a Fast Maximum Transfer Capability Analyzer (FMTCA). The state estimation and FMTCA solutions were designed to work harmoniously with the off-line power-flow and transient stability programs currently used in operations planning at NOS BiH. The main idea consisted of extending the interim SCADA with a state estimator that would either be seamlessly integrated with the existing system or run on a separate processor with input obtained from 4-21

the SCADA real-time database. Either way, the state estimator would execute periodically, its output results would be displayed on the Operators console, and the state estimate would be made available in PSS/E format both to FMTCA and for subsequent study-mode processing with the load-flow and/or other off-line computer programs available at NOS BiH. Together, these applications would thus help build and update the accurate model of the power system, automatically perform real-time voltage and steady-state stability checks, and allow the operations personnel to monitor and enhance the power systems operating reliability. As it turned out, the solution developed by Siemens Power Transmission and Distribution Energy Automation (Siemens) from Vienna with assistance from NOS BiH consisted of actually expanding the interim SCADA system to a distributed SCADA/EMS architecture with full support for real-time network analysis functionality. The FMTCA capability was provided by QuickStab [9] and was integrated with the enhanced SCADA/EMS by Iskra Sistemi (Iskra), Ljubljana, Slovenia with assistance from NOS BiH experts and Energy Consulting International, Inc., New York, USA. The solution architecture is depicted in Figure 4-8.

Figure 4-8 Integration of the Fast Voltage and Steady-State Stability Application on the SCADA/EMS LAN

4.3.1.2

Functional Description and Computational Method

Background The maximum transfer capability of an electric power system, i.e. the maximum MW power that can be transferred from generators (including tie-line imports) to loads (including tie-line exports), is limited by the: Amount of available reactive compensation 4-22

Thermal constraints Stability constraints. The latter are the most severe because stability violations lead directly to blackouts and, also, because instability develops rapidly and there is no time to react. But whats the meaning of violating stability constraints, and how to measure the distance to instability? During the last two decades, the search for stability limits was addressed primarily on the transient stability and voltage stability venues. These techniques have been extensively reviewed in previously published work [8]. Their limitations have also been documented, and stem from computational burden, non-convergence of load-flow calculations near instability, and, most importantly, from the algorithmic difficulty to mathematically quantify a system-wide index that would qualify as a stability limit. A promising solution to this otherwise complex problem comes from the realm of steady-state stability. With the understanding that the maximum loadability is a local property of the state vector rather than a generic constant, and that for each new system state there is a potentially different stability limit, the distance from a given operating point to the associated state of maximum loadability is called steady-state stability reserve, changes when the load, topology and voltages change, and may be quite different from values computed off-line. The value of a steady-state stability reserve that is large enough for the system to withstand any set of credible contingencies without transient instability is called security margin. The recalculation of the steady-state stability limit and the security margin after each state estimate and load-flow solution is required because operating the system near its stability limit may lead to blackouts. These concepts were well known and widely accepted as early as 1950s and 1960s. In fact, the Special Report of CIGRE Group 32 prepared by M. Magnien way back in 1964 stated explicitly that any network that meets the steady-state stability conditions can withstand dynamic perturbations and end in a stable operating state [3]. Solution Technique FMTCA uses the fast and reliable method developed by Paul Dimo in Europe approximately fifty years ago to quickly assess the maximum transfer capability of an electric power system, and which, in spite of its age, is particularly useful in real-time applications [1], [2], [5], [6]. Given a load-flow solution or state estimate of a multi-area power system, FMTCA: Computes, for each area, the maximum loadability and the safe system loading for a user-defined security margin Identifies generators that may cause instability and ranks the machines and tie-line injections in order of their impact on systems stability Performs bus-level analysis, shows how the generators are seen from that bus, and ranks the buses in the order of their stability indices.

4.3.1.3

Interface and Integration with the SCADA/EMS LAN

As shown in Figure 1, the FMTCA application runs on a PC connected to the SCADA/EMS LAN and its execution is controlled by the MCE QuickStab module developed by Iskra. Every 5 minutes, this module scans a specific folder on the SCADA/EMS LAN and, if a new state estimator output in PSS/E format is found, it triggers the FMTCA computational engine which performs a full array of stability calculations that take less than 1 second. Then, the MCE module triggers the FMTCAs graphical engine and saves the results in a save case directory. The entire process runs automatically, without manual intervention from the Operator.

4-23

The ability also exists both to repeat the stability calculations by changing the computational parameters, e.g., the percent security margin, load modeling assumptions, and tie-line injections filtering, and/or to display other calculation results, e.g., the impact of generators on the systems stability conditions, and the system-wide P-V relationship. In addition, the real-time case is exported to the off-line LAN for subsequent contingency case calculations with PSS/E and their study-mode evaluation for voltage and steady-state stability violations with FMTCA.

4.3.1.4

Distinguishing Features

A distinguishing feature of the approach taken by NOS BIH is the ability to both continuously and automatically monitor, in real-time, the systems distance to the maximum transfer capability and the security margin(Figure 4-9 - left), and to manually display other results that can assist the Operator to maintain and enhance the systems operating reliability (Figure 4-9 right).

Figure 4-9 Real-time stability monitoring at NOS. Operators console (left) -- detailed display (right)

An interesting by-product of this implementation is the ability to check the accuracy of the most recent state estimate. This is achieved by manually repeating the stability calculation in console mode, in which case FMTCA would display the maximum MW mismatch of the base case.

4.3.2 Performance and Reliability

The solution time of each FMTCA calculation is less than 1 second. However, a copy of the real-time case computed by the state estimator may or may not be available exactly at the beginning of the 5minute execution cycle. The delays, if any, in getting the input from the SCADA/EMS LAN may be due to a variety of factors and typically may range between 10 to 20 and, sometimes, up to 50 seconds -- but once the stability calculations were triggered, they converge almost instantaneously. The exact time of the state estimate is retrieved as a file time-stamp and is shown on the two-speedometer chart and on any other output displayed by FMTCA. The system has been in commercial operation since September 2005 and no reliability problems have been detected. Due to RTUs and/or communication channels unavailability, however, a converged state estimate may not always be available, in which case the MCE module alerts the operator that the 5 minute interval scheduled for a new real-time stability run has elapsed without a calculation having been made. This, of course, is a system problem and is not specific to the FMTCA functionality.

4-24

4.3.3 Planned Enhancements

At the present time, Siemens and NOS BiH are working together to upgrade the current real-time stability solution and seamlessly integrate it with the new SCADA/EMS. One enhancement consists of controlling the execution of FMTCA from Spectrum, rather than from the PC. Another one, and extremely relevant, improvement consists of displaying the main computational results directly on the Siemens Spectrum user-interface. Finally, the ability will also be provided to trigger, automatically or at the Operators request, an FMTCA execution directly from the Dispatchers Power Flow program. In the new implementation, after completion of the stability calculations performed by FMTCA, the key output results will be uploaded into the SINAUT Spectrum real-time database and the current steadystate stability reserve and security values will be stored as calculated points and subsequently shown on a trending chart with the standard SINAUT Spectrum SCADA trending facility. Additional tables and graphics will also be implemented on the SINAUT Spectrums user interface, thus providing the Operator with a single, consistent and uniform display environment.

4.3.4 References
[1] Dimo, Paul, "Nodal Analysis of Power Systems", Abacus Press, Kent, England, 1975 [2] Dimo, P., Manolescu, G., Iordanesscu, I., Groza, L., Ionescu, S., Albert, H., Moraite, G., Ungureanu, B., Computation and design of electrical energy systems (Romanian edition), Editura Tehnica, Bucharest, Romania, 1971 [3] Magnien, M., Rapport spcial du Groupe 32 Conception et Fonctionnement des Rseaux, Confrence Internationale des Grands Rseaux Electriques Haute Tension, CIGRE Session 1964 [4] Sauer, W.P., Pai, M.A., Relationships between Power System Dynamic Equilibrium, Load-Flow, and Operating Point Stability, in Real Time Stability in Power Systems, pp. 1-30, Springer Verlag, Norwell, MA, 2006 [5] Savulescu, S.C., "Fast Assessment of the Distance to Instability. Theory and Implementation", in Real Time Stability in Power Systems, Edited by S. C. Savulescu, Springer, Norwell, MA, 2005 [6] Venikov, V.A. "Transient Processes in Electrical Power Systems", Edited by V. A. Stroyev, English Translation, MIR Publishers, Moscow, 1977 [7] Vickovic, D., Concept of the Fast Maximum Transfer Capability Analyzer FMTCA Application in the Bosnia and Herzegovina ISO (NOS BiH) System, paper R.C2./D2.06, CIGRE Meeting in Neum, Bosnia and Herzegovina, 25 - 29 September, 2005 [8] IEEE PES, Techniques for Power System Stability Search, A Special Publication of the Power System Dynamic Performance Committee of the IEEE PES, TP-138-0, 1999 [9] http://www.eciqs.com home page and related links

4-25

4.4

State of the Art in Brazil - ONS

4.4.1 Specific Requirements 4.4.1.1 Functional Needs

System Description The installed capacity of the Brazilian power system is approximately 88.000 MW being 84% of hydro and 16% of thermal (coal, oil, nuclear and gas) generation. There are 80,000 km of transmission lines (230 kV and above). The peak load is around 57 MW. The system is operated by the Operador Nacional do Sistema Eltrico ONS. ONS has four regional and a main control centers, as shown in Figure 4-10 .

NE

SE
Main EMS Regional EMS

Figure 4-10 ONS control centers.

A power system model for studies at operational planning environment contains approximately 4000 buses and 5600 branches, considering all voltage levels. Real Time Data Supervised data from the various utilities are concentrated in the regional centers and retransmitted to the main control center. Therefore, the network represented at the main control center is more complete and suitable for dynamic security assessment. However, all centers perform their own topology processing, state estimation and steady-state analysis. 4-26

The supervised network (mainly 230 kV and above) currently results in estimated power flow cases real time base case - containing approximately 1500 buses. Installation of new RTUs and communication channels will increase the size of these cases to around 2000 buses. Real time base cases include almost all generation power plant and transmission lines of 345 kV and above. Therefore, no dynamic equivalent is required, but similar generating units of a power plant are automatically aggregated for security assessment studies, which significantly reduces the size of the dynamic model. Currently, there is no external system model coupled to the estimated network. A study is being conducted to validate the real time model (network and dynamic representations). The reference for this study is the model used for planning studies. Also, need of improvements in the state estimation process has been detected. Contingencies Contingencies used in real time dynamic security assessment are typically the following: - Single-line-to-ground or three-phase-to-ground solid fault at a bus or in the middle of a branch followed by loss of one or two branches. - HVDC pole blocking. - Loss of generating units. Functionalities and Respective Results Six security assessment methods are required for the ONS DSA, as follows. - Operating Point Steady-State Contingency Analysis This is the classical steady-state contingency analysis. For this method four criteria must be checked and tabulated: thermal limit violation, voltage violation, voltage deviation and no power flow solution. Contingencies can be ranked according their respective severity. - Operating Point Dynamic Contingency Analysis This is a dynamic contingency analysis. For this method nine criteria must be checked and tabulated: transient temporized voltage sag, transient instantaneous voltage sag, transient temporized voltage swell, transient instantaneous voltage swell, MW margin for critical generators and critical cluster, synchronous generator angular damping, transient angle deviation, steady-state angle deviation and frequency deviation. - Import-Export steady-state transfer limit between two-generation areas. Boundaries must be given for the four steady-state criteria. - Import-Export dynamic transfer limit between two-generation areas. Boundaries must be given for the nine dynamic criteria. - Steady-state security region computation - This is the set of secure power dispatch for three interconnected generation areas. A security contour must be given for each steady-state criterion. - Dynamic security region computation - This is the set of secure power dispatch for three interconnected generation areas. A security contour must be given for each dynamic criterion. Preventive/Corrective Actions The DSA must offer the following resources for preventive corrective actions: - Ranking of voltage control resources (generator or shunt compensation) to correct voltage violation. - Suggested MW re-dispatch (amount and location) to alleviate thermal limit violation. - Suggested MW re-dispatch (amount and location) to avoid angular instability. - Suggested MW re-dispatch (location) to improve damping. - Suggested load shedding (amount and location) to move from alert/emergency states to secure 4-27

state. EMS Integration In the first phase a loose integration is accepted. Network state is exchanged by flat file, the DSA system runs asynchronously with EMS and the graphical user interface is the one implemented in the DSA system. In the last phase, the DSA system access the EMS database to retrieve network data, runs in synchronously with EMS, DSA results are updated in the EMS database and EMS displays the results.

4.4.1.2

Modeling

Only observed network is currently modeled, but studies are being conducted to see if some not modeled low voltage parallel paths can significantly affect the assessment. If this is the case, the state estimation process will be changed accordingly. As almost all power plant are modeled, there is no need of dynamic equivalent. However, similar generating units in a power plant must be automatically aggregated by the DSA software. The dynamic model includes representation for hydro and thermal generation with respective controls (Governor, AVR, PSS, OEL and UEL), conventional and CCC HVDC, SVC, TCSC and loads. Utilities are responsible for validating the models and. Relevant special protection schemes must be represented.

4.4.1.3

Analytical Techniques

There is no requirement for a specific technique, but results must be validated against regular power flow and time domain simulation methods.

4.4.1.4

Database

The DSA must access the host EMS database to retrieve network data and update assessment results. Dynamic models are not supported by the EMS database and, therefore, must reside in the DSA systems.

4.4.1.5

Results Visualization

Results must be displayed in tables, graphics, nomograms and power system single-line diagrams.

4.4.1.6

Performance Requirements

The following table summarizes the required performance per functionality for a 3000 bus / 700 generator case.

4-28

Table 4-2 Case Summary

Functionality Static Contingency Analysis Dynamic Security Analysis Static Transfer Limit Dynamic Transfer Limit Static Security Region Dynamic Security Region

Number of Contingencies 100 100 10 10 10 10

Performance <5s < 30 s <5s < 30 s < 1 min < 2 min

4.4.2 General Description of DSA Implementation

ORGANON is the Dynamic Security Assessment system implemented in ONS [1]. It is an integrated environment for computing all aspects (e.g., voltage and angular stability) of power system security. It is based on conventional tools (power flow calculation and time domain simulation), but adopts advanced numerical algorithms, embedded diagnosis methods and distributed processing.

4.4.3 Architecture
To meet the performance requirements, ORGANON uses a distributed processing approach in a Manager/Workers (Master/Slaves) configuration. The Manager process contains the high level instructions to do a security assessment functionality, Figure 4-11 . The low-level instructions (solve a power flow problem, perform a time domain simulation, etc.) is done at Worker processes. Then the Manager is responsible for generating base cases, distributing tasks among Workers, collecting the respective reports, communicating with external world, managing distributed resources, storing/displaying results and plots. Workers receive tasks from Manager, process them using the specified power system simulation tool and send respective diagnosis in a report to the Manager

EMS - Real Time

SCADA SE

DB

Organon MANAGER/SERVER GUI LS

Filters

Contingency Analysis Transfer Limits Security Region Preventive Actions Corrective Actions

Functionalities Report T a sk

Power Flow Continuation Power Flow Optimal Power Flow Sensitivity Analysis Time Domain Simulation Energy Function Prony Analysis

WORKER1

WORKERN

Tools

Tools
Figure 4-11 Main components of the security assessment system.

4-29

The implementation uses a Windows platforms. The system works with at least two processes (one Manager and one Worker) residing on a single or multi-processor hardware platform. Ideally there should be one worker process per processor, but any other process per hardware configuration is allowed. Message Passing Interface MPI standard is used for intercommunication among processes. The hardware platform for the DSA system can consist of either a cluster of dedicated computers, a multiprocessor server or a set of PCs in a general purpose LAN. The distributed processing environment system can work with any number of processors and can be scaled up or down to accommodate the workload of various functionalities and performance requirements. The system architecture is the same for both planning and real time environments. The EMS connection is also available for planning applications, allowing analysis and assessment of cases that were captured as real-time snapshots. The code is written in FORTRAN 90/95 and C programming languages

4.4.4 Functional Components

INPUT Required input data depend on used functionalities. The main required information are the following. - Power flow base case. - Power flow contingency list. - Monitoring filters. - Generation groups. - Single line diagram. - Dynamic models. - Special protection scheme models. - Time domain simulation contingency list. - Sensitivity analysis data. - Criteria specification. - Options and Preferences. MODELING ORGANON supports a vast library of dynamic models for synchronous machines and respective controls, HVDC, SVC, FACTS, ULTC, AGC, protection systems, etc. Special protection schemes are user defined. COMPUTATIONAL METHODS AND FEATURES Numerical Methods ORGANON security assessment adopts the detailed modeling approach. Therefore, it is based on power flow and time domain simulation methods. However, it also contains simplified and faster methods for filtering and sensitivity calculations.

4-30

The basic requirements for the power flow and time domain simulation methods are reliability and accuracy. For real-time implementations, performance is also critical. Power Flow Methods: The power flow methods can represent up to 100,000 buses and 100 bus sections per bus. Models for shunt compensation (continuous and discrete), phase shifters, on load tap changers, DC links (conventional and CCC), interarea interchange control and load are available. Extensive data checking facilities can be used. The power flow computation method are the following. - DC power flow: This method is used only for initialization an contingency screening purpose. - Full-Newton power flow: In this method all controls (OLTC, DC Link, etc.) are solved simultaneously by the Newton method. - Synthetic Dynamic Power Flow: This is a very robust power flow method [3] in which most of controls are represented by synthetic dynamic models. The formulation is such that if the solution exists and the problem is properly formulated, the solution is found. This method is many times slower than the Newton method. Therefore, it is only used when it is absolutely necessary to confirm the existence of a power flow solution. - Continuation Power Flow: The tangent vector approach [4] is adopted for this implementation. The continuation method is used for moving operating points in search of security borders or for computation of PV curves (maximum loadability). - Optimal Power Flow: The primal-dual interior point method [5] is adopted for this implementation. It is currently used to generate bases for near-real-time and days-ahead scenarios. There are also plans for using it for contingency constrained optimization. - Sensitivity Analysis: This is used to ranking controls for voltage and flow controls and estimate contingency severity. Time Domain Simulation Method: The simulation method adopts the mixed ABM-BDF numerical integration method associated with variable-step-variable-order approach and simultaneous solution of algebraic and differential equations. These characteristics allow improved performance (more than 10 times faster) compared to the fixed time step approach and enhanced numerical stability. Simulations can be early terminated either by instability detection or steady-state convergence. Energy Function and Single Machine Equivalent Methods: Individual numerical energy functions [6] and SIME [7] methods are used for energy margin computation. Prony Analysis: Prony analysis [8] is used for modal analysis (damping assessment) of synchronous machines. Functionalities A security assessment system may consist of a simple operating point contingency analysis or a more complex functionality such as a contingency constrained security region computation. The requirements depend mainly on the characteristics of the network, amount and type of remedial action schemes and operational practices. But basically, a security assessment system must answer the following questions: given an operating point, is the system in secure state (no criteria violation) considering credible contingencies (contingencies that have significant probability of occurring and may cause severe damages)? If it is secure, it may be desirable to know how much some parameters can be changed (e.g., MW generation at specific power plants) so that the power system remains secure. In other words, this is a measure of security robustness in a parametric space. If it does not survive, we may want to know what needs to be done to prevent the problem? ORGANON contains a set of main functionalities to answer those questions, as follows. A. Operating Point Contingency Analysis For steady-state assessment the conventional load-flow (Full-Newton) is used. The evaluated criteria can be voltage collapse, thermal limits, voltage drop and voltage deviation. 4-31

For dynamic assessment the time-domain simulation (Variable-Step-Variable-Order) is used. The evaluated criteria can be stability margin, damping ratio, voltage sag, voltage swell, voltage drop, voltage violation, thermal limit, transient angular deviation, steady-state angular deviation and frequency deviation. Special protection schemes can be considered in simulations. Sensitivity indices can be computed for estimation of security margins in a parametric space. B. Security Limits in a Transmission Corridor This functionality consists of the import/export security boundaries in a particular corridor. Two interconnected generation regions are defined. Power is exchanged back and forth to search the security boundaries (import/export). A boundary per criterion can be computed. The available criteria are the same as the contingency analysis.

C. Security Region This is similar to the security limit calculations, but now there are three-generation groups instead of two. It is also possible to consider two-generation groups and a load group as a set of variable parameters. The available criteria are the same as the contingency analysis. D. Preventive/Corrective Actions Based on the result of the contingency analysis (static or dynamic), this functionality determines what actions can be taken to avoid/remove criteria violations. As per ONS requirements, the following functionalities are provided. - Ranking of voltage control resources (generator or shunt compensation) to correct voltage violation. - Suggested MW re-dispatch (amount and location) to alleviate thermal limit violation. - Suggested MW re-dispatch (amount and location) to avoid angular instability. - Suggested MW re-dispatch (location) to improve damping. - Suggested load shedding (amount and location) to move from alert/emergency states to secure state. One important aspect to be emphasized here is the importance of results visualization, in particular for security region computations, as it automatically provides simple means of removing violations by moving the operating point in the generation/load plane (MW changes). F. Base Case Builder ORGANON contains a module to build a base case for a future scenario based on load forecast, outage schedule and generation schedule. Assuming the necessary information are available, the objective is to generate a load flow solution with no steady state criteria violation. An optimal power flow is used to solve this problem. USER INTERFACE A full graphical interface is available for data editing and output visualization. This interface can be used for the standalone mode and loose connection to the EMS. OUTPUT AND VISUALIZATION For the standalone mode, all results are displayed in tables, graphics, nomograms and in single-line network diagrams. For tight EMS connection the required output can be directed to the host database. 4-32

Figure 4-12 shows an example of table report and Figure 4-13 shows an example of security region nomogram.

Figure 4-12 ORGANON report table (stability margin)

Figure 4-13 ORGANON security region nomorgram

ORGANON is designed to work either in planning and real-time environments. In real time it can work in a cycling mode or upon user request. There is an option to automatically translate real-time bus/bus section number and names into planning numbers and names. Automatic calculation of equivalent reactor for single-line fault simulation is available. Facilities for bus split/merge during simulation are available.

4.4.5 Distinguishing Features

ORGANON distinguishing features are the following. Single-system-multi-purpose security assessment tool. High performance full time-domain simulation. High performance distributed processing. Reliable processes and algorithms. Static and dynamic security region computation. Fast and reliable power flow solution methods.

4-33

4.4.6 Performance and Reliability

The system is currently meeting the performance established in Section 4.3.1.6. However, it is important to note that performance depends on factors such as assessment requirements and power system modeling and level of power system stress. For example, if the power system dynamic model contains ill-defined controls (e.g., for AVR, governors, etc.) numerical integration performance degrades. Similarly, power flow models with OLTC control conflicts generally require more iterations to converge. Therefore, it is essential to make sure that models used in real-time applications are properly defined. As a rough measure of ORGANON time domain simulation performance it can be said that for a 9000 bus / 1500 generator case, a 15 s simulation can be processed in 15 s using a 3 GHz

4.4.7 Operating Experience

An earlier version of some of the methods used in ORGANON has been implemented at British Columbia Transmission Corporation BCTC, BC to calculate real-time static security regions. This implementation entered commercial operation in 2005. ORGANON as herein described is in use in ONS planning environment (outage schedule and monthly schedule). It is test phase in real-time at the main control center using a loose connection to the EMS. There is an on-going process for evaluation of ORGANON by major Brazilian utilities.

4.4.8 Proven Benefits

So far, there is no measurement of financial benefits. For the ONS planning environment, ORGANON is allowing more comprehensive scenario assessments and speeding up the whole process.

4.4.9 Planned Enhancements

Visualization is an area users demand continuous enhancements. Many output results currently displayed in tables will also be available in graphic formats. Connection of results to the single-line diagram are also being designed. Fault tolerance for worker processes are being improved and for the master process is planned to be developed.

4.4.10 References
[1] J.L. Jardim, C.A. da S. Neto, A.P. Alves da Silva, A.C. Zambroni de Souza, D.M. Falco, C.L.T. Borges, G.N. Taranto, A Unified On-Line Dynamic Security Assessment System, Cigr, Paris, France, 27 Ago 1 Sep 2000. [2] J.L.Jardim, C.S.Neto, W.T.Kwasnicki Design Features of a Dynamic Security Assessment System, IEEE Power System Conference and Exhibition, New York, Oct 13-16, 2004.

4-34

[3] J.L. Jardim, B. Stott, Synthetic Dynamics Power Flow, IEEE General Meeting, San Francisco, 1216 June 2005 [4] V.Ajjarapu, C.Christy, 'The Continuation Power Flow: A Tool for Steady State Voltage Stability Analysis', IEEE PICA, May 91, pp 304-311. [5] S.Granville Optimal reactive Dispatch Through Interior Point Methods, IEEE Trans. PS, Vol. 9, No. 1, Feb 1994. [6] J.L Jardim, "Advances in Power System Transient Stability Assessment Using Transient Energy Function Methods", Ph.D. Thesis, Imperial College of Science, Technology and Medicine, University of London, October 1994. [7] M.Pavella, D.Ernst, D.Ruiz-Veja Transient Stability of Power Systems: A Unified Approach to Assessment and Control, Norwel, MA: Kluwer, 2000. [8] J.F Hauer "Application of Prony Analysis to the Determination of Modal Content and Equivalent Models for Measured Power System Response, IEEE Winter Meeting, 215-4 PWRS, 1991.

4-35

4.5

State-of-the-Art of DSA in Canada - Hydro-Qubec

This section presents current practices at Hydro-Qubec dealing with Dynamic Security Assessment (DSA).

4.5.1

Brief Summary

For Hydro-Qubec DSA and SSA are implemented and used in all power network activities. DSA is more than a simplistic computer computation, it is part of an integrated organizational structure and process.

4.5.1.1

Hydro-Quebecs DSA context

The following provides some background relevant to the DSA requirements and implementation at Hydro-Qubec. Hydro-Quebecs network is a long radial network with some main 735 kV lines as a backbone transmission system. It is not synchronized to its neighborhood networks. This configuration, with moderate size, causes challenging dynamic stability and static situations to deal with. On the opposite side since there are few power lines, the transmission behavior is directly related to the number of equipments connected in real situation. From these two facts, we can understand the necessity for Hydro-Qubec to do complete and thorough stability studies with detailed and precise dynamic models. Since it is a moderate size network we can do exhaustive simulation studies taking into account a finite number of power network configurations. In order to maintain a security level, we must take into account static and dynamic constraints in every Hydro-Qubecs operation planning and operational activities (production and transmission planning, maintenance scheduling, power network operation in the control room). All of these activities need to be evaluated if there is no risk of constraint violation. Theses constraints have to be known exactly and rapidly in the preparation process and in real time situation. In less than a few seconds, from the precise power network state, all constraints, particularly for this power network state, are calculated and displayed. Also in study mode, any what if scenario can be simulated and evaluated. These strategic tasks are done by the Hydro-Qubecs DSA tool, called LIMSEL. This DSA system is the core for maintaining a secure state and knowing how any change can affect the level of security. LIMSEL ensures a strong continuity and coherency between the operation planning and the operational activities. Inside LIMSEL, decision tables, based on the power system state, give all power transfer limits allowed to the different power transfer corridors. The power transfer limits are determined off-line after complex and complete dynamic and static studies. DSAs philosophy: Mixed solution With the intrinsic dynamic complexity of the power network and long term requirement to find the optimal secure operational transfer limit, Hydro-Qubec has chosen a mixed solution [1].

4-36

First, in off-line studies, specific locations of key transfer observation points are determined. A thorough analysis gives the power transfer limits of the full network for each predefined configuration, along with additional restrictions associated with unavailable equipment in that configuration. All power transfer limits results (with the impact of specific equipment) and the allowed configurations are given and stored in the software called LIMSEL [2]. Second, in on-line studies or during the planning process, the appropriate limits are determined by LIMSEL software automatically based on the expected power network topology and available connected equipment in the short term. This ensures that operators impose the right limits for each topology used. This task is automated because the computation of a set of limits (angular stability limits, voltage stability limits, thermal limits and different impacts of different equipments) using offline tools is complicated and time-consuming, and is beyond human ability for a set of numerous power network changes spanning only a short time horizon. This mixed solution has the advantage of accounting for the full experience of engineers, and at the same time gives flexible and rapid responses. Security, reliability, and optimization criteria are quickly met thanks mainly to a long preparation process. Also, all the operation planning and operational processes are strongly coherent, relying on the same rules and constraints, and striving for the same optimal operational state.

4.5.1.2

Power Network Characteristic: Challenging

The HQ transmission system includes many long lines interconnecting separate areas with hydroelectric power generation and load (see Figure 4-14 ). A large amount of power is transferred over 735-kv series-capacitor-compensated transmission lines. Hydro-Qubecs 735 kV power transmission system was honored by receiving an IEEE milestone plaque 1 on December 13, 2005 [3]. The current configuration, centered around Montreal, has developed over the years, first along a northeast axis, toward the Manicouagan and Churchill Falls generating facilities (12,000MW), and then along a northwest axis, toward the James Bay power stations (15,000 MW). The peak load is approximately 36,000 MW. Since most of the load is 1,000 km away from production area, there are large power transfers over only a few main transmission lines. Planners of this long, radial, high voltage power network have overcome critical challenges involving the following phenomena and constraints: Voltage control Voltage stability Transient stability Thermal limits Post contingency voltage and power flow limits Due to theses constraints, Hydro-Qubecs Security Assessment must include Static and Dynamic security assessment (SSA and DSA as described in sections below).

The text inscribed on the plaque : First 735 kV AC Transmission System, 1965

Hydro-Qubec`s 735,000 volt electric power transmission system was the first in the world to be designed, built and operated at an alternating-current voltage above 700 kV. This development extended the limits of long-distance transmission of electrical energy. On 29 November, 1965 the first 735 kV line was inaugurated. Power was transmitted from the Manic-Outardes hydro-electric generating complex to Montral, a distance of 600 km.

4-37

Type of instability

JAMES BAY COMPLEX (15 000 MW)

RO BERT-BOURASSA RADISSO N LG -4 TILLY LG -3 CHISSIBI

CHURCHILL FALLS COMPLEX (5 600 MW)

CHURCHILL

Transient stability area

20 %
NEM ISC AU

40 %
MONTAG NAIS

20 %
ALBANEL

2 M ANIC-O UTARDES COMPLEX (8 100 MW)

MICO UA

600 km 34 %
ARNAUD

1000 km 34 %
ABITIBI

2 32 %

CHIBO UG AMAU

CHAMO UCHO UANE

44 %
MANICOUAG AN

40 % 2 1
LAURENTIDES J.-C ARTIER

26 % 16 %
SAG UENAY

40 %
LA VRENDRYE

17 % Q UBEC AREA

400 km

LVIS G RAND-BRL CHNIER CHTEAUGUAY 1 3 2 NICO LET

APPALACHES

LEGEND 735 Kv Sub sta tion DC Converter Series Co mp ensa tion DC Line Sync hrono us Cond ensers Sta tic Va r Co mp ensa to rs

DES CANTO NS HERTEL

MONTRAL AREA 1-DUVERNAY 3 2-BOUCHERVILLE 3-CARIG NAN

Voltage stability area

N.Y.PA Nep o o l

Figure 4-14 Schematic diagram of Hydro-Qubec's main transmission system stability areas

Depending on the topology of the network and the location of a disturbance, two main types of dynamic phenomena can lead to instability, either separately or together. These are transient stability phenomena in the generator area and voltage stability phenomena in the load area. The locations of the two stability areas on the network are shown in Figure 4-14 . From Security to Reliability issues Due to increasing demand, and in light of the radial structure of the Hydro-Qubec network, the system had been seen to be vulnerable to many disturbances. Over the last 15 years or so, new equipment, including new types of equipment, has been installed on the network to improve reliability, specifically by improving the stability performance of the system. Today, with series compensation, automatic controls and fast protection systems, the network system is more robust. The loss of synchronism can still occur, but only for very severe conditions. When

4-38

these conditions occur, they are accompanied with high probability with mixed types of instabilities. The main limiting factor is becoming more and more the voltage levels and/or power swings seen at substations when the contingency occurs. Key issues: Preparedness and integration In response to the challenges brought on by this network, the organization of operational and planning functions must be well integrated. The success of operating this power network day to day strongly depends on close and tight coordination between several issues involving the power network, maintenance needs, exchange scheduling, production planning and system controls. Daily operations schemes are prepared beforehand, based on off-line studies made at least one year, one month and one week previously. If new equipment is required in the network, studies begin with integration requirements. Once the best new additions are determined, operational studies evaluate the requirements for protection, control settings and measurements. With a clear model of the resulting network, secure transfer limits are found. Also for that network, maintenance schedules are prepared a year in advance, production and transmission equipment requirements are prepared a month in advance, and production and transmission schedules are prepared a week in advance taking network constraints into account. Behind all these activities is the use of a predetermined set of configurations and their transfer limit capabilities. Safe Network operation: respect of transfer limits of specific set of power transmission line configurations An essential condition to ensure reliable operation is to respect the stability characteristic of the network. The robustness of the Hydro-Qubec network is directly linked to the number of transmission lines connected. As a rule of thumb, the removal of lines decreases the robustness of the network, but more precisely the ability of the network to transfer large amount of power safely and reliability depends on its specific configuration and the presence of specific equipment. One crucial efficiency factor: knowing the stability margin of the operating configuration Although the stability issue is fundamental, another crucial factor is efficiency. An adequate return on the high investment costs of power networks can only be achieved if it is used efficiently. The optimal efficiency is only reachable if the stability margins of the power network are known precisely. Stability study: Precise and detailed time domain simulation The maximum power transfer capability on a network can only be found with detailed studies using tools for assessing power flow and stability performance. The latter is based on time domain simulation fed by a set of contingencies and criteria. Finding transfer limits based on experience and the engineers know-how One challenging task is to find the optimal power transfer capability for a specific power network configuration. Some of the difficulties to be overcome are: Stringent specific sets of criteria and contingencies are given as input, but are not sufficient to find an optimal solution. Other conditions like weather, seasons, etc. affect the optimal solution. The power network is in itself a complex system, with many interrelated components that influence stability-related behavior. The impact of these components has to be determined in order to set secure operation ranges. Here is where the engineers experience and know-how come into play. The engineer contributes the following :

4-39

o o o

From the multitude of simulation results, meaning is extracted and synthesized, taking into account prevailing conditions on each apparatus and automatic control. This meaning is transferred into the control room through the use of practical directives. The underlying logical ideas are formulated clearly in order to be applied. The past and the partially known future of the power network are accounted for in the evaluation of the stability analysis

4.5.2 A Strategic Activity: Defining transfer limits 4.5.2.1 Operational Planning: respect of stability and security constraints

Power networks constraints To supervise the daily management of the transmission system, operating and transfer limit strategies have been established. These are intended to maintain the systems security while seeking to offset the difficulties brought on by the operating constraints: Maintenance outages Stability limits (transient and voltage instabilities) Thermal limits Supply-load balance Voltage control Optimization of intertie transfer capacities Risky weather period Post contingency voltage and power flow limits

Planning and operation studies are performed with a one year look-ahead period, and seek to optimize the use of the system. They must anticipate a wide range of operating situations, configurations with unexpected unavailability and/or the withdrawal of equipment for maintenance, in order to enable power transactions and production management. The severity of an event is directly related to the level of power being transferred when the event occurs, so operating strategies are based on a whole set of power transfer limits to be respected on the main transmission routes and DC installations. In addition, the overload capacity of the series capacitor banks and steady-state thermal limits on power lines impose additional constraints after the loss of a link. The supervision of the verification of these limits is provided by real-time software. The power transfer limits due to transient stability, voltage stability and thermal capacity are calculated in off-line studies for different topologies of the power network and integrated in real-time operation and in maintenance planning over different time periods. Since the HQ system is not synchronized with neighboring utilities, it does not have a strong inertia like that of the NPCC system, and therefore it has higher frequency sensitivity. In order to avoid large frequency deviations, real time operation determines, on-line, the generator reserves needed to adequately sustain the loss of the largest foreseeable production and load following an event. The control center room can impose the reduction of power transfers on specific radial transmission routes if the amount of power exchange is larger than generator reserve capacity. Also, during risky weather periods (lightning, geomagnetic storm, or ice storm), the amount of power transfer is reduced.

4-40

In summary, various constraints reduce the operating possibilities of the power network and determine the power transfer allowed. Some, like thermal limits, are updated in real time; others, like, stability limits are pre-determined in off-line studies.

4.5.2.2

Power Transfer Limit Search

The security of the Hydro-Qubec system is assessed by anticipating likely conditions resulting from the unexpected unavailability of transmission facilities and by evaluating their stability responses. Overview The principal objective of the power transfer limit and their associated operating strategies is to ensure a stable operational state of the power network with limited frequency deviation and adequate voltage control during specific, stringent and mandatory contingencies in order to maximize power transfer between production and load centers. Since the severity of these contingencies is directly related to the power transfer, the implementation strategy is based on a set of power limits allowed in the different corridors of the power network. Theses strategies specify the range of operation and the control actions allowed for different equipment and automatic controls. The action of special protection systems is also taken into account. Theses strategies cover a large range of configurations and numerous unavailability scenarios. Depending on the topology of the network and the location of the event, two main dynamic stability problems can occur separately or together, transient stability in the generator area, and voltage stability in the load area. Limits for a specific configuration should take into account, with a security factor, theses two types of instability phenomena following the most severe contingency as specified by criteria. The most severe contingency depends on the location and on the type of stability phenomenon considered. Also the impacts of equipment unavailability or of automatic controls are different and specific for each stability issue. To take into account these different issues and to facilitate the optimization of the power transfer, two complete sets of limits, for each subnetwork of the power network, are given with their own structure, for maintenance planning, control center operation planning and operations. In real time, or studying mode, the most limiting values are used and displayed to users by LIMSELs software. Moreover, each set of limits includes, in reality, a combination of specific limits coming from different set of contingency and criteria. For instance, in normal state, the transient limit in the ManicQuebec inter tie is the lowest power transfer limit values of, at least, three types of contingency with their specific rules.

Configurations To organize transmission system maintenance, precise rules govern the authorized configurations during normal operating conditions. In addition, to ensure sufficient coverage of likely system conditions created by the loss of a transmission line (forced outage condition), transfer limits are provided for these various conditions.

4-41

The set of configurations is based on different subnetwork part of the transmission network. This decomposition reduces the space of configuration and avoid the exponential increase of combination. Maintenance Configuration P: configuration obtained as the result of the withdrawal of lines in accordance with the scheduling guide for the transmission system withdrawal plan. This is the normal system condition. There are 114 maintenance configuration P in Hydro-Qubec. Maintenance configuration plus the loss of a line P+1: configuration caused by the unexpected tripping of a line. Following this event, the system no longer respects one or more of the scheduling rules of the maintenance plan. This configuration represents 719 different cases in Hydro-Qubec. Voltage Control configuration CT: configuration required when line withdrawals not included in the maintenance plan are necessary to respect the voltage profile and operating ranges of the compensators on lightly loaded networks. This practice is required by the characteristics of the 735kV system and the major variations in peak load in relation to off-peak loads. The Hydro-Qubec power system has been designed to satisfy a winter load that is three times larger than off-peak load. The voltage control configuration cases number 338 in Hydro-Qubec. When a maintenance configuration is used, the system operator is assured that transfer limits and operating strategies exist for all configurations obtained as the result of a line tripping. It is important to note that when operations are being planned, the possibility of several configurations in which several lines can be out of service at the same time is anticipated. These lines will be removed in accordance with the withdrawal plan for system maintenance. In relation to the full system (all lines in service), maintenance configurations (~150) allow the withdrawal of, for example, up to 10 lines at once, assuming one link out of service on each of the main transmission routes. Under real operating conditions, there can also be a large number of lines withdrawn simultaneously from the transmission system. Various other equipment can also be in maintenance (synchronous or static condensator, serie compensation bank, capacitive and inductive shunt reactors). Defining Limits At this time, establishing transfer limits (Figure 4-15 ) requires the use of substantial means and is performed entirely off-line. The pre-defined transfer limits are programmed in a software package called LIMSEL [1] (LIMSEL is in fact a table containing all the transfer limits associated with the various topologies of the power system and the unavailability of other strategic facilities such as synchronous condensors or static compensators, etc.). In real time, the system is operated respecting the constraints displayed by LIMSEL, which vary according to the changes in the system configuration and the availability of strategic facilities. When limits are exceeded, the system operator receives an alarm signal and makes the appropriate corrections to restore the network to a condition that again respects the security criteria.
Determine limits off-line (P, P+1, CT)

Integrate and program limits in LIMSEL

Use limits in real -time (LIMSEL )

Figure 4-15 Process used to establish transfer limits

4.5.2.3

Standard Procedures

When determining a power transfer capacity limit, engineers follows standard, written, procedures. Mainly there are three steps (planning, executing and implementation/diffusion).

4-42

First step: Planning Before beginning the planning step, one must make a first request. This first request can be triggered, for instance, by one of the following condition: Changing of operational criteria, Modification of contingency list Presence of new equipment Change of the power network property When the power transfer limits are considered insufficiently optimized or not sufficiently secure The planning process defines the work load, specific time domain simulations requirements, and a description of the mandate, and relies on the full knowledge of previous stability study methodologies and results. Second step: Execution This step requires doing complete, thorough stability studies and based on all derived information, modifying or defining a new decision table structure with its corresponding limit values. In more detail we have the following steps Prepare the most suitable power network representation files (power flow and dynamic files) Preliminary study : Based on mandatory contingencies, criteria and a configuration list, simulate the dynamic response of the power network under consideration to learn its typical behavior, characteristics or particularities Thorough dynamic stability analysis: All pertinent electrical elements, such as voltagecontrolled automatic scheme to switch 735 kV shunt reactors and static excitation systems with high-ceiling excitation voltage and high-gain voltage regulator with power system stabilizer, are evaluated by running sufficient simulations. Find the optimized power transfer limit based on the simulation results, taking into account all other important factors. Determine what the best way to summarize the results. Validate the work with co-workers and the future users in order to maintain a coherence with other power limits Prepare the proposition, decision table structure Third step: Implementation Implement the new limits in LIMSEL with the control center engineer and diffuse the information to pertinent personnel. Finally, validate and verify that the implementation was done correctly. Along these tasks, engineers are supported by formal key steps check documentation. This documentation lists the main steps to be completed in order to succeed.

4.5.2.4

Engineers Expertise and Knowledge Required

Power limit calculations and optimization are a complex activity based on engineers expertise and knowledge Power network properties The power network has the following properties: Many phenomena on many different time scales Large diversity of dynamic responses 4-43

Many nonlinearities and hysterisis phenomena that are difficult to analyze Strong interaction and coupling between components Mix of discrete and continuous time actions

These complex properties can not be summarized in a familiar linear framework. The impacts of the various network components change depending on the power network state. It is therefore very difficult to determine an optimum. Large number of cases Even for a simple power network with 5 series compensated transmission lines, one power plant, 2 types of instability, one specific fault and two states (normal and emergency), for full transmission lines, 100 cases must be studied. Many points to determine For each study case, engineers have to: Find the initial condition state (voltage, load, generation) Define the best qualitative criteria to make a judgment. There are mandatory criteria but they are not sufficient to give the optimum. Engineers use qualitative judgment in order to find the best solution. Search the relevant stress and observation points to be applied on the power network Develop a personal search methodology. Some basic methodologies are well know and widely used, but still engineers need to define particular sensitivity studies, the parameters used in the studies, and other tests. Analyze time domain results. This means o Check and verify the time-domain solution o Interpret that result and its consequence in taking account Electrical conditions Heuristic rules and specific knowledge All previous results, sensibilities o Deduce the main implication of this result Based on this result, determine what has to be done, what points need to be clarified and resolve them Synthesize and interpret correctly all result in a coherent picture No universality In the HQ power network, electrical responses change depending of the location and type of contingencies, and the seasonal period (load properties). Each location has its own particularities and specificities. There are no general rules. Cognitive capacity and implicit knowledge used For each study, a body of implicit knowledge, know-how, solving process, specific rational analysis and creativity are used by any engineer. The engineer seldom begins with blank knowledge. There is a huge historical body of knowledge available to him, giving critical information. Also the human being has the creativity to find a new path and to reduce the difficult problems to simple ones.

4-44

4.5.3 HYDRO-QUBECS on-line SSA

On-line Steady State Security assessment In real-time using, the scheduled interchange and generating output values, equipment availability, the SCADA and the state estimator, real data information, steady state security assessment are evaluated. The most critical tasks are the following: Thermal limits are computed on selected transmission facilities (e.g lines, and power transformers) of the transmission network as a function of ambient conditions (temperature, wind velocity, solarity etc.). The current in all series compensation is also monitored. Station Topology Analysis evaluates the impact of potential station busbar or breaker faults on the power system topology and determines loss of important MW generation, load, or transmission capacity. Multiple losses are also taken into account. Contingency Analysis analyzes network security from different contingencies (outages) and determines any violations. Contingencies mean single or multiple contingencies as equipment outages and/or switching status changes. Violation refers, for example, to load-flow limits violations (e.g branch amp/MVA, bus voltage, reactive power generation), overload equipments, exceeding maximum generations loss or loads loss, bus splitting and islanding. Contingency analysis consists of three steps. First contingencies are adapted to the base case network of interest. It identifies and ranks the most critical contingencies from the list of contingencies. Finally, from a detailed power flow, analysis of the critical contingencies, gives the overloads and limit violations caused by each contingency

4.5.4 HYDRO-QUBECS on-line DSA 4.5.4.1 LIMSEL- On-line DSA tool in Hydro-Qubec

An efficient on-line software for the real time reliability monitoring and control of the power system Maintaining the reliability of the power system with respect to its steady state operation and particularly with respect to its ability to survive contingencies can be accomplished by applying preventive or corrective remedial actions. Preventive measures include enforcing equipment limits, restricting interface flows and restricting total generation output from particular sets of power plants. Corrective remedial actions executed by special protection systems include generator and load tripping, and automatic reactor or capacitor bank switching. The relevant parameters for remedial and corrective actions heavily depend on the actual configuration and the state of the power system and the set of credible contingencies to be considered. They are mainly determined by numerous off-line simulations, mainly transient and voltage stability analysis. The number and complexity of these studies has grown rapidly since more precise and less conservative MW transfer limits have become an economic necessity.

4-45

Requirement to use this vast off-line knowledge in real-time and studying mode The knowledge to be collected from all these simulations has exploded as well. Therefore efficient processes and appropriate tools had to be designed to create, update, transform and store this vast amount of off-line information so as to rapidly retrieve it and to intelligently use it in real-time or in operating reliability studies.

LIMSEL
The development of LIMSEL (acronym meaning LIMit SELection) started at the end of 1970s. A major revision and update was accomplished in the middle of 1990s. Figure 4-16 illustrates the principle under which LIMSEL works. LIMSEL is essentially a user friendly system, allowing operations personnel to complement and translate the results of the off-line studies and display them on-line. For this purpose, it contains especially compact forms of decision tables. LIMSEL manages numerous tables of limits, restrictions
Topologies

Loss of one line after a fault

Circuit breaker (CB) on maintenance

Single phase fault with stuck CB (delayed fault clearing) Loss of more than one line

Transient base limits

Long Term base limits

CB Transient base limits

CB Long Term base limits

Restrictions

Restrictions

Restrictions

Restrictions

<
Geomagnetic storm Condition of Ice storm Thunder storm

<
Post contingency Thermal Limit (Laser) LIMSEL TRANSFER LIMITS

LIMSEL Restrictions

Operators

Figure 4-16 - Working principle of LIMSEL

4-46

and system variables (for example, generators, lines and substations as well as weather conditions and diverse information needed to determine the status of system protection).A specific power system condition corresponds to a specific set of transmission limits, system protection settings and operational restrictions for some system equipments. LIMSEL provides a fast access to that information. It also provides a summary of the sensitive elements and their impact on the limits or operating strategies. Use of LIMSEL In real-time, LIMSEL is used to supervise the actual power transfer on appropriate flow gates taking into account the status of all critical installations, and to establish the value of operating reserves. Rapid access to all information is provided using the SCADA system In study mode, for the next hours, LIMSEL is used to evaluate the impact of upcoming maintenance outages on transmission limits and operating reserve, and every 15 minutes to automatically update the operating reserve protection taking account planned outages and the most recent load forecast update. For the daily, weekly and monthly planning of maintenance outages, all security criteria including reliability margins has to be respected.

4.5.4.2

Software Description: architecture and functional components

Real time environment In the real-time environment, LIMSEL receives all real-time power network data (including network telemetry measures and signals. From these data, LIMSEL can accomplish more than just finding the corresponding transfer limits in different transmission corridors as shown in Figure 4-17 . For instance, if any forbidden configuration is present, alarms ring and LIMSEL sends a message to operators with the appropriate remedial action information. Moreover LIMSEL transmits in real time all settings of generator tripping and load shedding. These settings define the amount of tripping in different power plants and the amount of load shedding for different load. Because of its critical responsibilities in system operation, LIMSEL has interfaces with other major control-room applications. For instance, it is connected to RPTC, the Generator rejection and remote load shedding system, a major special protection systems (SPS). Other applications are shown in the above picture. LIMSEL keeps a direct link with the state estimators contingency analysis in order to check any over current in series compensation banks or in transformers when there is a loss of a power transmission line. This relation permits the increase of the real time power limits. Mandatory operation rules require having power limits specific to different time periods. For instance, to evaluate the amount of production needed for a specific time, it is necessary to calculate power transfer limits for that specific time. It is why LIMSEL also serves as a maintenance planning tool. Finally, there is also a connection with OASIS (Open Access Same Time Information System), which gives all total transmission capabilities (TTC) depending on the equipment outages.

Human-computer interface A main screen shows the operator all applicable values of power transfer limits for every transmission. On the same screen, LIMSEL displays relevant messages to the operator or gives the data status coming from other applications related to LIMSEL.

4-47

For each power limit calculation, the operator can visually see all the restrictions which were applied on the basic value. The operator can therefore easily identify constraints and determine corrective actions.

Figure 4-17 DSA Architecture

Study mode LIMSEL can not only work in real-time but also is used in study mode by outage coordinators to prepare the planning outage schedule for the next days or months. The software can work with a fictitious (future) network and evaluate the impact of the outage of specific equipment on power transfer limits. LIMSEL is able to build a network for a specific date and hour and calculate power limits taking into account the planned maintenance service of equipment. This study mode provides the possibility to make better decisions and to optimize with respect to security criteria. A day-to-day study mode is available to the operator. For instance after any event on the power network, the operator can evaluate the impact of the next planned outage. The operator can recall the actual configuration and change the equipment outage status and see the new power limits. Through the years, LIMSEL has become indispensable for operating and planning the power network in real time. Thanks to its great flexibility, it is not only used to ensure security but also contributes many tasks related to operation.

4.5.5 Performance and Reliability

System performance and reliability The pilot program (shell) of the software runs each fives seconds on two servers and takes

4-48

automatically the latest update information coming from 8 000 measurement and signal points necessary to calculate the new limits and the new RPTC settings values. There are at least 500 decision tables available in real-time, taking into account the complexity of conditions and strategies. It would be a very difficult task to operate the system without the support of this high level software. Sixty four study modes are possible and can be used simultaneously in realtime by different persons responsible for managing the system. Since it is a critical element of this system, LIMSELs servers are redundant. Also, there is another identical copy of LIMSEL available in the back-up control room if, for an exceptional or emergency case, the normal control room would be unavailable.

4.5.6 Operating Experience

Successful experience with LIMSEL and the power limit calculation activities spans more than 20 years. It has increased number of different transfer limits and ability to handle complex situations. The LIMSELs user-friendly environment and fast respond has allowed us to define more tasks. During this long period of time no incidence has happened.

4.5.7 Proven Benefits

During the last two decade, LIMSEL has shown its strategic role in operating Hydro-Quebec power system. We summarize some points showing its proven benefits: Many years of day to day experience : o go through thousand of situations with no incidence o use by many people with different responsibility o ability to tackle from few strategies to numerous, complex, strategies o became a requirement for a secure operation of power system It has offered several qualities: o flexibility o relatively fast response o robustness o reliability o provides variety of responses o shows historical continuity o shows coherence between the power limit value provided for planning and operation activities o can be used in risk management

4.5.8

Planned Enhancements

LIMSELs core structure will not see any major change in the near future, but a few enhancements are planned. First, LIMSEL will calculate the thermal capabilities of transformers and lines for 10 and 30 minutes periods. Secondly, the capability will be provided to make comparison tests possible in order to verify the impact of modified strategies. Thirdly, an on-line documentation link between LIMSEL and off-lines study report may be implemented.

4-49

4.5.9 References
[1] L. Riverin, A. Valette, Automation of Security Assessment for Hydro-Quebecs Power System in Short-Term and Real-Time Modes, CIGRE-1998, 39-103. [2] Aboumrad, P. Doyle, J. Gauthier, H. Horisberger, R. Mailhot, G. Versailles, LIMSEL-Un systme temps rel efficace pour la surveillance et le contrle de la fiabilit du rseau (An efficient on-line system for power system monitoring, reliability, and control), CIGRE-2004, C2204. [3] V. K. Sood: IEEE Milestone: 40th Anniversary of 735 kV transmission System, IEEE Canadian Review, Spring 2006, No. 52.

4-50

4.6

State-of-the-Art of DSA in China CEPRI

In the past years, the scale and complexity of power system is increasing drastically in China, which has driven the need for more powerful tools to permit fast and on-line simulation of the systems dynamic behavior. Transient stability simulation is an effective tool to analyze power system dynamic phenomena, and when combined with the use of parallel processing, can be used in a realtime mode for on-line dynamic security assessment. The China Electric Power Research Institute (CEPRI) has developed a platform for the parallel simulation of electromechanical transients that is based on the use of a parallel computing, (PC cluster), whose computer nodes are PCs interconnected using a 100M Ethernet network as shown in Figure 4-18 . The system has been developed and applied to the real-time electromechanical simulation of the large-scaled power grid. Every PC of the cluster can be configured with double CPU, memory and hard disk, and can carry out computation and I/O dependently. The communication of every PC is through Myrinet or internet. The control and computation is commanded by the control computer.

Figure 4-18 The PC cluster of the DSA

The system consists of PC cluster, simulation software, and an MMI. To deal with the parallel linear algebraic equation solution, which is one of the most difficult parts in transient stability simulation. the project used Gauss-Jacobi and Gauss-Seidel iterative methods in parallel-in-time. According to the requirements of parallel power system electromechanical transient simulation, the criteria of power network portioning are set. On the basis of Contour Tableau method, by optimizing the constructing process of the contour tableau, a practical power network portioning method for parallel processing of power system simulation is developed and is shown in Figure 4-19 . Based on the method, the parallel electromechanical transient simulation is developed. The interconnected network of Northeast China, North China, Central China, Sichuan and Chongqing can be included in the dynamic security assessment.

4-51

The system has the following functions: Power flow serial and parallel computation. Fault analysis for the power system Dynamic simulation for the high voltage DC and AC system, which can includes 10,000 nodes. Interface of parallel computer with the EMS State-Estimation result.

Processor

P4 P3 P2 P1

y1 4
1 y3

2 y4 2 y3 2 y2

3 y4 3 y3 3 y2

4 y4 4 y3 4 y2

y1 2
1 y1

y12

y13

y14
4

1 2 3 Normalized Time (WU)

Figure 4-19 Sequence of parallel operations for the Gauss-Jacobi methods.

4-52

4.7

State-of-the-Art of DSA in China Guangxi Electric Power Grid

The Guangxi on-line dynamic security assessment system (Guangxi On-line DSA) was jointly developed by Guangxi Power Grid Company, Nanjing Automation Research Institute, and Powertech Labs Inc. This system was commissioned in 2004. It is designed to provide the advanced on-line DSA capability to monitor the Guangxi Power Grid and to assess its transient and voltage security. Guangxi Power Grid is a provincial power grid in southern China. It is located in the midway of southern China interconnected system. Presently, there are more than 30 500 kV AC lines and more than 120 220 kV AC lines in Guangxi area and the system peak load is about 7,000 MW. There are two important features in the Guangxi grid. Firstly, the 500 kV AC lines in Guangxi and two 500 kV bipolar DC links across Guangxi make the major part of the Power Transmission from West to East project of southern China, which routinely transfer more than 8,000 MW of power from the two western provinces with rich hydro and coal generation to supply the huge power demand in the southeastern Guangdong province (the economical center of southern China). This power transfer path is more than 1000 km, and the reactive power support of the AC system is mainly provided by the power plants in Guangxi. Secondly, more than half of the generation capacity is hydro located far from the load centers. Obviously stability is a major issue for systems with such features and the problem will be of more concern as the grid is undergoing rapid expansion to meet fast load increase.

4.7.1 Features of Guangxi Online DSA

1. An extensive set of security criteria including transient stability, damping, transient voltage and frequency excursions, and post-contingency steady-state voltage profiles. The credible contingencies can be sorted with any security criterion and shown to system operators. Critical contingencies can therefore be easily identified for specific operating condition. 2. If a contingency is identified as insecure, the on-line DSA will further evaluate the emergency control actions available and suggest to the operators the appropriate control action. 3. The list of contingencies to be analyzed can include the must-run contingencies prepared off-line and the conditional contingencies prepared on-line. The conditional contingencies are created automatically, based on specific powerflow conditions and other criteria. 4. Important system conditions and the associated DSA cases are archived automatically, so as to allow the off-line analysis of critical system conditions to help gain insightful understanding of the system behavior. 5. Key system condition and DSA results are posted on the companys intranet. Authorized users can examine such information in real time using web browser at any location inside the intranet. This system has been in operation for more than two years (including trial operation). Some experiences as well as concerns of implementation are provided here.

4.7.2 Computation speed

Presently, the on-line system model contains about 2400 buses and 250 generators (including some external equivalents). At the normal condition, 7 Dell 2650 servers are designated for DSA computations (6 for transient stability and 1 for voltage stability). The DSA system is able to complete the entire assessment cycle for 80-100 contingencies within 7 minutes (in TSAT, each contingency is simulated to 10 seconds). It can be seen that for such a medium size power grid system, the computation speed is not a bottleneck anymore. The computation requirements can be easily reached using low cost hardware. And since the technique of Cluster of Workstation is deployed, the hardware platform of the DSA system is flexible and reliable, it is easy to be expanded or upgraded and 4-53

maintenance is not difficult either.

4.7.3 External system observability

Because the accesses to the semi-real-time information of neighbor provinces are not available, Power Flow Matching method has been used. Several typical power flow cases of the whole southern China interconnected system are prepared off-line. The DSA system chooses the suitable case to match the semi-real-time power flow of Guangxi Power Grid based on the tie line power flow, load condition and season etc., and makes a new power flow as the base for simulation. But here the difficulty is that Guangxi Power Grid is strongly coupled with neighbor power grids. Especially, it is in parallel operation with two big HVDC links, whose sending ends and receiving ends are close to the boundary of Guangxi, but the DSA system doesnt have the accesses to their semi-real-time information. This has made many troubles to the DSA system. It seems to us that for such a grid which is strongly coupled with external system, without having the essential semi-real-time information of the external system, it is very difficult to make a reliable power system model on-line.

4.7.4 Making suggestions on preventive action

If the DSA system finds that the system condition is insecure, the operators want suggestions on two kinds of control actions: preventive actions and emergency control actions. The emergency control actions are only taken after the disturbance occurred and are mostly taken by automatic special system protections, so the options are limited and it is not difficult for the DSA system to evaluate them and make suggestions. On the other hand, preventive actions change the power flow and theoretically there are infinite possibilities, it is very difficult for the DSA system to choose the preventive action and evaluate it.

4.7.5 Visualization and interactive interface

In many cases, the operators want to do further analysis on an online case. Mostly, it is because the DSA system has shown that the system is insecure and the operator wants to take some preventive actions, and it is preferred to test such actions beforehand. Currently, this can be done by downloading the archived online case and using offline software to do analysis in a conventional power system analysis engineers way, but there are still challenges to be faced, (1) The current display modes of transient stability programs can not provide the user an overall view of the system condition, unless the user is an (very) experienced power system analysis engineer. It prevents the operators from easily and rapidly finding out preventive solutions of insecure system conditions. It may be necessary to think outside the conventional transient stability analysis box, find new ways to organize and present the information from the simulation. They may include: a new way to display the oscillations on system diagram with various zoom levels; a new way to display dynamic voltage variations on system diagram; a new way to display dynamic power flow variations on system diagram; a new way to display the critical generators on system diagram, it may need the help of eigenvalue analysis. (2) How to incorporate an interactive DSA interface into the EMS interface? The DSA data sets may need to be integrated into the graphical database of the EMS. The operator should be able to modify the DSA power flow on the same interface as in the Operator Power Flow, as well as to use the graphical interface to change the parameters of equipments, set the contingency, run the simulation and show the results.

4-54

4.8

State-of-the Art of DSA in Europe: The European OMASES Project

4.8.1 General description

OMASES stands for Open Market Access and SEcurity assessment System. This project involved a consortium of Industries, Research Centers, Universities and System Operators and was sponsored by the European Union [1]. The scope was to provide Energy Management System (EMS) operators with a tool for Dynamic Security Assessment (DSA) to be used on-line during the normal cycle of real-time operation, in operational planning and as a dispatcher training simulator including a simulation of the deregulated electric market environment. DSA is realized through different application functions: Transient Stability Assessment (TSA), Voltage Stability Assessment (VSA), Training Simulator (TS) and Market Simulator (MS), which can also perform independently from each other [2], [3]. The OMASES technical aims were: to provide a transparent methodology to assess the network dynamic stability, to increase the power flow on electrical lines by computing dynamically operating limits, to reduce the incidents resulting from stability problems by simulating dynamic contingencies, to improve the generation allocation by computing the unit commitment in accordance with the dynamic limits and the electrical market demand, to adjust emergency protection to more accurate values either off line or on line (according to field equipment capabilities), and to provide advanced real time dynamic simulation tool for operator training.

4.8.2 Architecture
Simply stated, OMASES is a tool including some DSA application functions, making use of a powerful training simulator, including market aspects and capable of proposing preventive remedial actions. OMASES can be inserted into an existing EMS or engineered into a new EMS structure. The following modes can be activated: 1. Real-time mode. The EMS feeds OMASES with network data and solutions. DSA is synchronized with data reception from the EMS and cyclically runs with a period of activation in the range 1030 minutes (typically 15 minutes). 2. Engineering mode. It is the off-line application of TSA and VSA studies involving or not the market environment. The user launches the execution of OMASES-VSA (TSA) manually. The data used may be either the real-time data or saved snapshots retrieved from the historical database by the user. A network solution stemming from the EMS state estimator or from a power flow program (saved cases) can thus be retrieved from the database dedicated to study mode, and used to initialize a VSA (TSA) study. This mode is also referred to as study mode, while an expert mode is also available, in which the experienced users can have access to more analysis tools. 3. Training mode. The operator gets used with the DSA tools and power system dynamics, performs analysis (future scenarios, post-event analysis, etc.) of the existing electrical system and/or experiments. In this mode, market rules can be used to realistically affect on the operational stage.

4-55

TSA and VSA are quite mature methodologies and techniques at least in the Engineering mode. Efforts have been done in this project to make them fully available in the real-time mode and to include them into realistic training sessions. TS and MS are very much related to existing power system simulator and to specific market. Therefore, within OMASES, the MS is intended to provide credible scenarios for subsequent TS and DSA activities. The OMASES applications run in a distributed WINDOWS environment, with a link to the host EMS from which real-time snapshots of the network are obtained. The architecture includes (see Figure 4-20 ): a server hosting any shared information, the relational database, the message system, etc. This server is totally separate from the computer system running the EMS platform; an appropriate server (even in parallel computing configuration) for each Application Function (TSA, VSA, MS, TS); computers to be used by operation personnel as user interfaces; a LAN structure under the TCP/IP protocol for communication between the above components.
EMS EMS Data Loader User Interface Process Control

DB

Message Bus

Adapter TSA

Adapter VSA

Adapter Training Simulator

Adapter Market Simulator

Figure 4-20 OMASES Architecture

The integration of the OMASES platform into an existing environment is easy. The communication between the EMS and OMASES computers is accomplished with text files loaded by the EMS computer onto the OMASES server. In fact, the DSA functions are triggered automatically by the transfer of data files from the EMS system into a predefined entry directory of the OMASES server. The transferred data consist of 14 text files containing the latest network solution computed by the state estimator. Each file is a description of a class of EMS components (e.g. substations, nodes, buses, lines, transformers, generators, loads, etc.) and corresponds to a table in the relational database. If the EMS cycle is shorter than the DSA cycle (a very uncommon situation), the DSA process is not interrupted; new EMS data set will be loaded as soon as the previous DSA cycle finishes. The DSA results are stored in the database when the analysis is completed and a WEB-based user interface is used to display results on PCs connected to the LAN.

4-56

4.8.3 Functional Components 4.8.3.1 Transient Stability Computational Methods and Features

SIME Fundamentals SIME (for SIngle-Machine Equivalent), is a hybrid direct-temporal transient stability method [4]. Basically, SIME replaces the dynamics of the multi-machine power system by that of a suitable OneMachine Infinite Bus (OMIB) system. By refreshing continuously the OMIB parameters and by assessing the OMIB stability via the equal-area criterion, SIME provides an as accurate transient stability assessment as the one provided by the multi-machine temporal information and, in addition, stability margins and critical machines. In other words, SIME preserves the advantages of the temporal description (flexibility with respect to power system modeling, accuracy of transient stability assessment, handling of any type of instability (first or multi-swing, plant or inter-area mode)), and, in addition, complements them with functionalities of paramount importance. One of them is generation control (generation rescheduling for preventive control, generation shedding for emergency control), which uses the knowledge of stability margins and critical machines. Indeed, the amount of generation to shift (or shed) depends on the size of the stability margin, and the generators from which to shift (or shed) are the so-called critical machines. The temporal information that feeds SIME may be provided either by a Time-Domain (T-D) simulation program or real-time measurements. This yields respectively the P-SIME (for preventive SIME and the E-SIME (for emergency SIME). Nevertheless, conceptually, the core of the method is the same. In what follows we first assume that SIME is fed sequentially by samples of the multimachine swing curves. The intrinsic characteristics of P-SIME will then be described. Finally, description of the E-SIME will be given in Section 5. SIME Method and Features To analyze an unstable case (defined by the pre-fault system operating conditions and the contingency scenario), SIME starts receiving samples of the swing curves as soon as the system enters its postfault configuration. At each new sample, SIME transforms the multi-machine swing sample into a suitable One-Machine Infinite Bus (OMIB) equivalent, defined by its angle , speed , mechanical power Pm, electrical power Pe and inertia coefficient M. (All OMIB parameters are derived from multi-machine system parameters [4].) Further, SIME explores the OMIB dynamics by using the equal-area criterion (EAC). The procedure stops as soon as the OMIB reaches the EAC instability conditions expressed by
Pa (t u ) = 0

& (t ) > 0 P a u

(1)

where, Pa is the OMIB accelerating power, difference between Pm and Pe, and tu is the time to instability: at this time the OMIB system loses synchronism, and the system machines split irrevocably into two groups: the group of advanced machines that we will henceforth refer to as the critical machines (CMs), and the remaining ones, called the non- critical machines, (NMs). The advanced machines are the CMs for up-swing instability phenomena, while for back-swing phenomena they become NMs. Thus, at tu SIME determines: the CMs, responsible of the system loss of synchronism; 4-57

the stability margin:

u = Adec Aacc = M u2
1 2

(2)

Figures Figure 4-21 to Figure 4-23 illustrate the above definitions on a stability case of the 88machine EPRI system [5], [6], [7]. More precisely, Figure 4-21 portrays the multi-machine swing curves provided by the ETMSP program, stopped respectively at the time to instability, tu, (unstable case) and at the maximum integration period (5 s; stable case). The symbol PC used in the captions denotes the total power of the group of critical machines. Time tr indicated in Figure 4-21 is defined by the stability conditions
(t r ) = 0

Pa (t r ) < 0 .

(3)

At tr the first-swing stability margin can be computed by

st = Pa d
r u

(4)

Figure 4-22 portrays the equivalent OMIB swing curves, while Figure 4-23 represent, in the -P plane, the evolution with of powers Pm and Pe. To simplify, Figure 4-23 (b) displays only part of the evolution of the electrical power Pe. SIMEs salient parameters and properties 1.- Calculation of stability margins, identification of the critical machines and assessment of their degree of criticality (or participation to the instability phenomena) are parameters of paramount importance. 2.- The time to instability, tu, is another important factor. It indicates the time an unstable simulation is stopped, and measures its severity. 3.- Similarly, the time to first-swing stability, tr, indicates the time where the system is identified as first-swing stable. If multi-swing instabilities are not of concern, it can be used as an early termination criterion for stable simulations.

(a) Unstable case: PC = 26,162 MW

(b) Stable case: PC = 25,377 MW

Figure 4-21 Multi-machine swing curves. Ctg # 11 applied to the EPRI system [5]. Critical clearing time: 69 ms; clearing time: 95 ms

4-58

(a) Unstable case: tu = 1.315 s

(b) Stable case: tr = 1.285 s

Figure 4-22 OMIB swing curves. Ctg # 11 applied to the EPRI system [5], [7]

(a) Unstable case: u = 92.9 degrees

(b) Stable case: r = 48.11 degrees

Figure 4-23 OMIB d-P curves. Ctg # 11 applied to the EPRI system [5], [7]

4.- Under very unstable conditions, it may happen that the standard margin does not exist, because the OMIB Pm and Pe curves do not intersect (there is no post-fault equilibrium solution). A convenient substitute is the minimum distance between post-fault Pm and Pe curves. Figure 4-24 illustrates this substitute margin under particularly stressed conditions. Note that here the time to instability is the time to reach this minimum distance and to stop the simulation. To simplify, we will still denote it tu.

(a) Multi-machine swing curves

(b) OMIB -P curves

Figure 4-24 Example of a severely stressed case: Ctg # 1b applied to the EPRI system [5], [7]. Clearing time = 95 ms; PC = 5600 MW

4-59

(a) Stability margin vs PC

(b) Minimum distance vs PC

Figure 4-25 Typical variation of the standard stability margin and of its substitute with PC. Drawn on the EPRI system. Ctg. # 1b. [5], [7]

5.- A very interesting general property of the stability margins (standard as well as substitute ones) is that they vary quasi- linearly with the stability conditions [4]. Figure 4-25 illustrates the margin variation with the total generation power of the group of critical machines, PC. The proposed control techniques benefit considerably from this property. Transient stability control: Principle To stabilize an unstable case (defined by the pre-fault operating conditions and the contingency type and clearing scenario), SIME furnishes the following two-part information. Size of instability (margin) and critical machines along with their degree of criticality or involvement; the degree of involvement of a critical machine is proportional to its angular deviation, d, assessed at tu. Suggestions for stabilization. These suggestions are obtained by the interplay between OMIBEAC (Equal-Area Criterion) and time-domain multi-machine representations, according to the following procedure:

Stabilizing an unstable case consists of modifying the pre-contingency conditions until the stability margin becomes zero. According to EAC, this implies increasing the decelerating area and/or decreasing the accelerating area of the OMIB -P representation. Plot (a) in Figure 4-23 (suggests that, in turn, this may be achieved by decreasing the OMIB equivalent generation power. Ref. [4] derives a relationship between the margin and the amount of the OMIB generation decrease, POMIB:

= f(POMIB.). (5) Further, Ref. [4] shows that to keep the total consumption constant, the following multi-machine condition must be satisfied, when neglecting loses:
POMIB = PC =

iCMs

Ci

= PN =

jNMs

Nj

(6)

where PC and PN are the changes in the total power of the group of critical and non-critical machines, respectively.
Application of eqs (5) and (6) provides a first approximate value of PC. Remark. Obviously, generation re-dispatch is corroborated by engineering reasoning: to stabilize a system, bring the machines angle trajectories closer to each other. However, SIME provides

4-60

important additional information: it quantifies the amount of generation to be shifted and determines the machines from which it should be shifted. Preventive Control Recall that the preventive SIME gets information from contingency simulations performed by a timedomain (T-D) program in order to set up a unified approach to transient stability Analysis Contingency screening and ranking Sensitivity analysis Transient oscillations damping analysis and control Preventive control. Analysis, and sensitivity analysis matters are described in detail in [4]. On the other hand, Ref. [6] gives an in-depth account of contingency screening and ranking approaches. Below we essentially focus on control, which is one of the most important assets of SIME. Iterative stabilization procedure Figure 4-26 describes the SIME-based iterative procedure that we summarize below.

1= 0.90 PcLim =25785 Pc1=25377 Pc0=-377 Pc 0=26162 P (MW) 0=0.83

Figure 4-26 SIME-based stabilization procedure. Ctg #11; conditions of Figure 4-21

For a given negative (unstable) margin 0:

decrease the total initial power of the critical machines PC0 by PC0 to get the new power PC1 = PC0 - PC0, using either eqs (5), (6) or a small percentage of the initial generation; increase by the same amount the total active power of the non-critical machines; perform successively a power flow to compute the new operating conditions, and a stability run to compute the corresponding stability margin, 1, and if 1 = 0, stop, otherwise perform a linear interpolation (or extrapolation as appropriate), to get a first-guess power limit PCLim , then go to step (i) and decrease or increase the active power of the critical machines, as appropriate.

Generation rescheduling patterns Expression (6) suggests that there exist numerous ways of distributing the total power change PN among non-critical machines. In addition, whenever there are many critical machines, there exist numerous patterns for distributing PC among them [4], [5]. Concerning distribution of generation among non-critical machines, the patterns may be dictated by various objectives, related to market or technical considerations; for example, one may seek for maximum transfer capability on a given corridor. In the absence of particular constraints or objectives, the total generation power could be distributed proportionally to the inertias of the non-critical machines. Another, interesting solution consists of

4-61

using an optimal power flow (OPF) program. Further, instead of stabilizing individually each unstable contingency one can design a pattern able to stabilize all harmful contingencies simultaneously. The principle is simple: to stabilize simultaneously many harmful contingencies having in common (some) CMs, apply the most constraining power shift, imposed by the severest contingency, to these common CMs only. The simultaneous stabilization may comply with various patterns, just like individual stabilization. Transient Stability-Constrained OPF Several attempts have been made to imbed transient stability constraints within OPF. According to the way of handling these constraints, two different approaches may be thought of: the global and the sequential one. Global approach. A time-domain (T-D) simulation is run. The power system transient stability model is converted into an algebraic set of equations for each time step of this simulation. The set of non-linear algebraic equations resulting from the whole T-D simulation is then included in the OPF as a stability constraint, forming a (generally huge) single nonlinear programming problem (e.g., see [8], [9]). Sequential approach. A T- D simulation is run. The transient stability constraints are directly converted into conventional constraints of a standard OPF program, e.g., active generation power. Hence, they do not affect the size of the power system model and the complexity of the OPF solution method. They can use any conventional OPF program (e.g., [10]). SIME-based sequential approach In principle, the SIME-based transient stability-constrained techniques may comply with either of the above approaches. Below we describe the sequential approach for the reasons advocated in [10] and for the following additional ones. (i) While in theory this approach cannot guarantee optimality, in practice it provides near optimal solutions, thanks to SIMEs multi-faceted information. (ii) The sequential approach may easily comply with market requirements thanks to the flexibility of choice among CMs and NMs on which generation can be re-dispatched. (iii) The approach can easily be adapted to auction market software different from the OPF program. Figure 4-27 illustrates the principle of the sequential approach. Its various steps are summarized as follows. The TSA block identifies the harmful contingencies and sends the appropriate information (operating conditions along with CMs and margins) to the transient stability control (TSC) block for stabilization. This block computes the amount of power to be shifted from CMs, and sends this information to the OPF block, which compensates for this change by re-dispatching an almost equal generation on NMs. The resulting new operating condition is sent to the TSA block, which tests its stability with respect to the contingencies of concern. If the case is found to be still unstable, the contingencies and their information (CMs and margins) are sent again to the TSC block; otherwise, the procedure stops.

Transient oscillations damping assessment and control Today, online transient oscillations damping is becoming an issue of great concern, with the trend to include damping techniques as part of a transient stability function. The Prony method (single or multi-channel), may analyze one or several (up to, say, 15) generator swing curves at a time. However, the quality of the analysis depends strongly on the number and proper identification of the relevant generator curves, whereas, generally, their number may exceed 4-62

Contingencies SIME-based software

Transient Stability Assessment (TSA)

Stability Margins

Unstable Contingencies (margin < 0) ?

No

Proposed Preventive Countermeasures

Yes Stability Margins , Critical Machines

Transient Stability Control (TSC)

Finding preventive countermeasures to stabilize the operating state New critical machine powers

Optimal Power Flow (OPF)

Improved Operating State after applying the Preventive Countermeasures
Figure 4-27 Transient stability-constrained OPF: sequential approach

the algorithmic possibilities, and their identification may be far from obvious. This may create serious difficulties when dealing with real-world power systems. SIME allows one to circumvent these difficulties by applying single channel Prony analysis to the OMIB curve. Besides, by identifying the system machines that have a major influence on the oscillatory phenomena, it easily determines the dominant modes of oscillation. Last but not least, it provides control techniques, able to improve transient oscillations damping. Reference [11] proposes such a SIME-based analysis and control of transient oscillations damping (both plant and inter-area modes). Functionalities of P-SIME The tight coupling of the T-D program with the OMIB allows SIME to preserve the assets of these programs, namely, Accuracy Flexibility with respect to power system modeling, contingency scenarios, modes of (in)stability Compliance with existing operational strategies. At the same time, the contingency screening techniques allow speeding up the assessment of T-D methods, while broadening substantially their possibilities. In particular, by designing preventive control actions, thus opening avenues to an issue that has long been considered to be problematic. Note on Seconds of T-D integration (sTDI). By observing that that the computing effort required by SIME per se is virtually negligible as compared with the computation of T-D simulations, one concludes that the computing effort reduces to the time required by the T-D program to run the simulation. A handy measure of the computing effort: is thus given by sTDI. This makes 4-63

comparisons of computing performance (almost) independent of the computer used and of the system size.

4.8.3.2

Voltage Stability Assessment Computational Methods and Features

Quasi Steady-State simulation The heart of all computations performed within the VSA part of OMASES is Quasi Steady-State (QSS) simulation, a fast time-domain method well suited to the analysis of long-term voltage stability phenomena [12]. The QSS approximation relies on time-scale decomposition. The essence of this method is that faster phenomena are represented by their equilibrium conditions instead of their full dynamics. This greatly reduces the complexity of the resulting model and hence provides the computational efficiency required to meet the constraints of an on-line application. In addition, the amount of additional data required by the QSS model is moderate, so that data collection, validation and maintenance are not a big issue. This method, which has been validated with respect to detailed time simulation, offers better accuracy and richer interpretations than simple methods based on load flow equations. For instance, in unstable cases, the area in trouble is automatically pointed out, while sensitivity-based diagnosis can be performed on the unstable system trajectory in order to identify appropriate remedial actions. Even when the QSS model involves components and phenomena that could be also accounted for in load flow computations, QSS simulations offer advantages over the latter, while preserving computational efficiency. Under the QSS approximation, the short-term dynamics of a synchronous generator, its governor and its Automatic Voltage Regulator (AVR), are replaced by three nonlinear algebraic equations [12]. The latter account for the generation saturation, the AVR steady-state gain and the speed droop. These nonlinear equations are solved at each time step, together with the network ones. For each load, voltage dependent active and reactive powers are assumed at the MV bus behind the HV-MV distribution transformer, in parallel with a shunt compensation capacitor. Studies are still under progress to improve the modeling of loads. The initial tests reported in this paper have been performed with an exponential model, as shown in Figure 4-28 . Different exponents are used according to the type of load. Load power restoration mainly comes from the Load Tap Changers (LTCs) operating in the HV-MV transformers.

Figure 4-28 Typical Load Model

QSS simulation reproduces the long-term dynamics of LTCs, OverExcitation Limiters (OELs), automatically switched shunt compensation, secondary voltage control (if any), protecting devices,

4-64

etc. This simulation takes into account the (initial and subsequent) delays in between transformer tap changes, the delays before a synchronous machine is switched under constant field current, etc. System Stress Voltage security is analyzed in terms of power transfers, referred to as system stress. The stress is a change in load and generation that makes the system weaker by increasing power transfer over relatively long distances and/or by drawing on reactive power reserves. A system stress is characterized by its direction, i.e. by the participation of each load active and reactive power to the overall load increase and that of each generator active power production to the overall generation adjustment. VSA is performed at the current system state, provided by the EMS state estimator, and referred to as base case in the remaining of the paper. Two approaches have been followed for assessing the impact of contingencies, as explained in the next two sections. Loadability limits A loadability limit indicates how much the system can be stressed before reaching instability. To this purpose, OMASES-VSA does not resort to (repeated or continuation) power flows, but rather simulates the time response of the system to a ramp increase in demand and/or generation. Thus, for a load increase, the demand coefficient Pi o of the load model shown in Figure 4-28 is increased linearly with time according to:

Pi o (t ) = Pi o (0) + ai g P t

with

a
i

=1

(7)

where ai is a dimensionless participation factor and g P is the power increase gradient (MW/s), at system level. This parameter is chosen small enough to consider that the system evolves through steady states, and large enough to save computing time. The same relationship applies to reactive power. All LTCs, OELs, etc. respond with their delays to this increase in demand. Note that in the absence of corrective control, the total load power increase over a period t is smaller than g P t under the effect of LTC deadbands and possibly limits. Similarly, the active power setpoints of generators can be increased with time. The imbalances between load and generation due to losses and the above-mentioned LTC effects are covered by primary frequency (governor) control. To this purpose the frequency deviation is computed at each time step of the QSS simulation. The presence of this extra variable is balanced by the slack-bus phase angle relationship slack = 0 as explained in [12]. Loadability limits are computed in the base case configuration, as well as for a limited set of dangerous contingencies, whose identification is explained in the next sections. The later limits are referred to as Post-Contingency Loadability limits (PCLL). To this purpose, in the same run, the contingency is simulated over a specified time interval, before the ramp increase in demand and generation is applied. Besides power limits, the main outcome of such a simulation comes in the form of system or regional PV curves. To this purpose, voltages at key buses are recorded as a function of the total load (power consumption, not demand) in various predefined regions, or in the whole system.

4-65

Secure Operation Limits For a given direction of stress, the Secure Operation Limit (SOL) corresponds to the most stressed operating point such that the system can withstand any contingency of a specified list [23]. Unlike a PCLL, this limit refers to the current, pre-contingency configuration of the system. In the SOL computation, the stressed system states are obtained from a (pre-contingency) load flow computation, while the effect of a contingency is assessed using QSS simulation, initialized at the load flow solution. The pre-contingency stress assumes full load recovery. Thus, at the i-th bus, the active and reactive powers increase according to:

Pl i = Pi bc + bi S Qli = Qibc + ci S

with with

b =1
i

c
i

=1

(8)

where superscript bc denotes base case values, S is the total load power increase and (bi, ci) are participation factors. The active power generation at the j-th bus is redispatched according to: Pjg = Pjbc + d j (1 + ) S with dj =1 (9)

where dj is a participation factor and accounts for changes in losses. The reactive power generations are rescheduled by letting the machines under AVR control, unless their reactive capabilities are reached. The SOLs are determined by binary search. This simple and robust method consists of building smaller and smaller intervals [ Sl Su ] of stress values such that Sl corresponds to an acceptable postcontingency evolution and Su to an unacceptable one. At each step, the interval is divided in two equal parts; if the midpoint is found acceptable (resp. unacceptable) it is taken as the new lower (resp. upper) bound. The procedure is repeated until Su Sl is smaller than a specified tolerance . To make the VSA function automatic, the binary search starts with Sl = 0 (corresponding to base case) and

Su = min ( Smax , f S N )

(10)

where S max is the maximum stress of interest, S N the maximum stress that can be reached in the absence of contingency and f is typically equal to 0.9. S N is itself determined by binary search, considering an ``empty'' contingency. To preserve computational efficiency in the presence of multiple contingencies, one should avoid repeating (pre-contingency) load flow computations relative to the same stress level. The number of load flows can be minimized by performing a Simultaneous Binary Search (SBS), which handles as many contingencies as possible at a given stress level. At a given step of this procedure, the unacceptable contingencies remaining from the previous step are simulated. If at least one of them is unacceptable, the acceptable ones are discarded (since their limits are higher than the current stress) and the search proceeds with the unacceptable ones only. For the most severe contingency(ies), the SOL is computed with the accuracy, while for the others, a lower bound on the SOL is obtained. A simple example with 4 contingencies is shown in Figure 4-29 . The sequence of tested stresses is So , S1 , S 2 , S3 , S4 . Five pre-contingency load flows are thus performed in the course of this SBS. The

4-66

SOL corresponds to S 4 and relates to contingency no. 1. Contingency no. 4 is discarded at stress So ,

Figure 4-29 Example of Simultaneous Binary Search

contingency no. 3 at S1 and contingency no. 2 at S3 .

From there on, it is generally of interest to compute the individual SOLs of dangerous contingencies other than the most severe. Individual binary searches are performed to this purpose. Note that the PCLLs and PV curves described in the previous section are computed for the subset of contingencies found with the lowest margins at the end of the SOL determination (which is thus performed first). It is clear that SOLs and PCLLs give different information and call for different interpretations. SOL is better suited to quantify the "distance to insecurity" in terms of total system load. Along the precontingency stress we have normal operating points similar to those that operators are used to observe. A distance of 100, or 1000 MW in this respect is very meaningful to the operator who knows what is the increase he expects in the next hour or so. The trajectory leading to a PCLL on the other hand, does not consist of normal operating points and the PCLL is not to be handled as a quantitative measure. Rather, it is valuable to demonstrate the system limits through local, regional, system-wide PV curves, which are convenient, widely accepted graphical representations. These post-contingency PV curves demonstrate graphically the amount of load restoration achieved in each area and in the whole system following the contingency (as well as the corresponding transmission voltage), and are thus providing useful information, complementary with respect to SOLs. Contingency filtering Contingency filtering is an important step of any on-line security assessment application. A form of filtering takes place at the first step of the SBS, i.e. at maximum stress, when discarding the contingencies that yield an acceptable system response. However, in spite of the QSS simulation speed, it may take too long to simulate the system response to each contingency of a long list. An additional pre-filtering may be needed before the SBS is launched. In a majority of systems, postcontingency load flows can be advantageously used to this purpose. Load flow equations with constant power loads and enforcement of generator reactive limits correspond to the long-term equilibrium that prevails after load voltage restoration by LTCs and machine excitation limitation by OELs. Insofar as voltage instability results from the loss of such equilibrium, the corresponding load flow equations no longer have a solution and the Newton-

4-67

Raphson algorithm diverges. On the other hand, divergence may result from purely numerical problems and some dynamic controls that help stability cannot be accounted for in the static load flow calculation. Conversely, some system dynamics may be responsible for an instability not detected by the load flow. Keeping in mind the above conflicting aspects, the filtering consists of: (i) performing QSS simulation on a subset of contingencies labeled potentially harmful; (ii) identifying the latter as the contingencies that cause the load flow to diverge or some voltages to drop by more than a threshold V . The value of V must be taken large enough to filter out as many harmless contingencies as possible, but not too large to avoid missing a contingency with low SOL. To make the filtering as reliable as possible, the post-contingency load flow data must closely match the QSS model. To this purpose, the reactive power limits of the generators are updated with their active power and terminal voltages, while active power imbalances are distributed over them according to frequency control. Furthermore, for filtering purposes, accurate post-contingency voltages need not be computed: estimates obtained from linearized load flow equations may be appropriate to filter out the harmless contingencies. If needed, the threshold V can be adjusted to account for the approximation. Reference [19] reports on the successful use of linear estimates of the post-contingency voltage drops obtained by:

first solving a sparse system to update the phase angles; then, assuming constant active power flows in branches, solving a second sparse system to update the voltage magnitudes.

This technique yields better accuracy than a single iteration of the full Newton-Raphson method, while retaining the sparse structure of a decoupled formulation.

4.8.4 Implementation in OMASES (Illustrated on VSA)

The scope of VSA is the analysis of the impact of significant contingencies and the determination of security margins in terms of power transfers or power consumption in load areas. More precisely, the application involves: 1. 2. 3. 4. contingency filtering according to the technique of Section 4.8.3; determining Secure Operation Limits (SOLs) using the technique of Section 4.8.3; computing the system pre-contingency loadability limit, using the method of Section 4.8.3; computing Post-Contingency Loadability Limits (PCLLs), by the same method, for the dangerous contingencies identified at item 2.

The architecture of the VSA application within OMASES is shown in Figure 4-30 . OMASES-VSA integrates two VSA software packages developed prior to the project. The SOL computation and the contingency filtering rely on the ASTRE software developed at the University of Lige and used by several power companies [14], [15], [16], [12]. ASTRE itself is made up of a load flow program (ARTERE, used for stressing the system and filtering contingencies) and a QSS simulator (QSSS, used for simulating contingencies) both conducted by the SOLD module implementing the binary searches. The former two executables communicate through a shared memory for the data and through files for the outputs.

4-68

stress specifications contingency description

VSA specific data EMS data VSA task status

HTTP SERVER
(Output Display Tool)
HTML, ASP pages for final display GIF files : margin bar charts, volt. evolutions, volt. profiles, Q reserves, PV curves

DATA BASE SERVER

Export files

Update status (SQL request) Load data Input directory Scan

EMS

OMASES CONTROL SYSTEM

Start/stop VSA (DCOM event)

OMASES USER INTERFACE

Start/stop VSA (WIN32 event)

Activate/load data (Message event)

OMASES - VSA
Start/stop/supervise (WIN32 APIs)

FRONT-END VSA

Send "assembled" results

Start/stop/supervise (WIN32 APIs)

ARTERE module

Data Loader
GIF files : margin bar charts, volt. evolutions, volt. profiles, Q reserves, PV curves

Data Loader

shared memory

WPSTAB module

QSSS module ASTRE

SOLD module

WPSTAB

Figure 4-30 Architecture of VSA application within the OMASES platform

ASTRE has been used for several years in Planning and Operational Planning by RTE (the French TSO), the TransEnergie division of Hydro-Qubec (Canada) and ELIA (the Belgian TSO). It is also used in ASD-T, one module of the real-time platform developed by RTE and used in the French national and regional control centers. Another real-time implementation is under way at HydroQubec. Furthermore, based on this software, a training simulator has been set up, that is presently used at the Hydro-Qubec control center to train operators at better controlling the grid voltages in normal and emergency conditions [17]. The computation of PCLLs and the preparation of PV-curves rely on the WPSTAB software developed at the National Technical University of Athens [18]. Within the context of OMASES, data loaders have been devised whose role is to connect (through SQL requests) to the relational data base server hosting the Energy Management System (EMS) data, the VSA-specific data, the stress specification, the contingency description, and the output curves description. The data loaders produce the ASCII files needed by ASTRE and WPSTAB. Outputs of ASTRE and WPSTAB consist of GIF figures showing plots and ASCII files with numerical results. Among the other modules sketched in Figure 4-30 , let us quote:

4-69

the OMASES Control System, aimed at: queuing and dispatching OMASES messages to the VSA task, detecting the presence of new EMS files, loading them into the database through a loader script, activating, synchronising and supervising the VSA task automatically, updating its status into the database; the Omases User Interface, aimed at: starting and stopping the VSA task, activating it manually, making the VSA task status visible to the OMASES user.

Finally, a front-end program has been developed in order to: prepare, manage and remove dynamically the working environment of a new VSA session, communicate (through messages) with the remaining of the OMASES environment, launch the data loaders, call sequentially and supervise the ASTRE and WPSTAB programs, collect the GIF figures produced by the latter and assemble them into HTML pages, together with ASP scripts, for user-friendly WEB-based display by the HTTP server (the latter being used for both controlling the platform and displaying results). The architecture of the TSA application within OMASES is the same as for VSA illustrated in Figure 4-30 (only difference is that VSA should be replaced by TSA and ASTRE with SIME). The presentation of the results, in case of TSA, is quite similar to that of TSA (assembling GIF figures into the HTTP pages and together with ASP scripts enable user-friendly WEB-based displays by the HTTP server).

4.8.5 Performance, Operating Experience and Proven Benefits

Within OMASES two Experimentation Sites have been implemented. One site was the Greek HTSO (Hellenic Transmission System Operator) and the other one was the Italian TSO through its cooperation with CESI, one of the two OMASES Italian Partners. The Italian Site Experimentation was intended to test the performances of the OMASES platform in a real world environment both in the Real-time mode (on-line) and in the Engineering mode (off-line). The OMASES platform installed at the National control centre of the Hellenic Transmission System Operator (HTSO) was in trial on-line operation until June 2003, when the project ended. In the fall of 2004, the on-line VSA function of OMASES has been reactivated with the implementation of user recommended modifications and it is used since then as an on-line and study tool at the HTSO control center. The on-going operating experience if on-line VSA in the HTSO control center will be described in the Section below.

4.8.5.1

TSA of the Italian interconnected system

The Italian test site was installed in December 2002. The experimentation concerned portability issues, in particular the operation of the data transfer module between Italian EMS and OMASES platform: both the automatic file creation and transfer in real time mode, and the system model conversion in the OMASES format were thus checked. The experimentation also regarded the correct operation of the platform from a software standpoint, and the output consistency of the DSA functions. OMASES TSA and VSA functions have been tested both in the Real-time mode (on-line) and in the Engineering mode (off-line) [2], [15]. The TS and MS testing were out of scope of this Experimentation Site. The Real-time mode is mainly concerned with the overall platform testing, and with the filtering/ranking capabilities, as it is rare that truly jeopardizing situations occur: in fact the Italian power system is usually operated in a conservative manner, with N-1 (and sometimes even N-2) criterion being satisfied. The Engineering mode is more suitable for a systematic validation of the tool capabilities and its 4-70

tuning. In particular, it makes it possible to check the output of the tool when heavily stressed scenarios are concerned. In the Engineering mode, if the initial conditions are excessively secure, the power system may be stressed in a variety of ways: for instance: by increasing the load or the power transfer between areas, by weakening the topology and/or the generation capacity, by creating low voltage conditions. The aim is to find the system limits and to compare suggested preventive actions with those used in the past or suggested by operators experience. In order to fit the Italian EMS snapshots into the OMASES database, a bridge between the Italian EMS and OMASES was implemented at the Italian site. The bridge performs data conversion to the OMASES format and can be used for on-line acquisition of the data which are then processed. The bridge from EMS data to OMASES data was developed by CESI. The overall importation scheme is reported in Figure 4-31 . For the experimentation, the file transfer was performed on a Wide Area Network (WAN). The final installation within a TSO can be on a Local Area Network (LAN), faster than the former solution. In the Real Time mode the estimated snapshot of the network was loaded every 15 minutes.

Italian EMS

DADIR/ DAVA (CESI)

OMASES exported files

OMASES Database

Bridge

topological FILTER

Application Functions (TSA and VSA)

Island identification
Data & results ARCHIVE

Figure 4-31 Data import from the Italian EMS

The Italian Power System The network under analysis was the complete Italian power system as in 2003, provided by the National TSO including the 400 kV and 220 kV transmission lines and the main 150 kV lines and stations, along with generators and equivalent loads. It was stored in the OMASES database used in the Real-Time mode. Significant figures for the examined grid are: Grid: 1118 Lines; 7234 Nodes about 1500 Buses The number of buses depends on the actual state of the network whereas the number of nodes is a network characteristic. The bus number is related to the actually energized nodes; 5778 Switches (1018 Bus bar couplers); Machines: 467 Synchronous generators, AVRs, system excitation limits; Hydraulic, Thermal (steam and gas) Governors and turbines; Transformers: 1082 two/three windings, 363 ULTC Loads: 1046 Static and dynamic loads. The grid topology in terms of network description and operating condition was imported automatically whereas the dynamic description, both for long term dynamics and short term dynamics, was provided either by hand or partially automatically downloaded by database, and makes

4-71

use of different models for TSA and VSA. TSA systematically performed the following tasks: (a) investigate large numbers (hundreds) of (credible) contingencies; (b) extract a subset of those that may threaten system security (contingency filtering and ranking); (c) provide possible preventive remedial actions. The most important aspect of the TSA validation phase at CESI site concerned its functionality, particularly for the FILTRA function [20] that allows selecting potentially harmful contingencies. A significant aspect of the testing consisted of comparing the simulation outputs of the TSA functions with a reference that represents the real system behavior. For the Italian power system this reference has been the electromechanical and long-term simulator SICRE [21], developed by CESI. As the OMASES Application Function TSA used the Eurostag package [22], it was important for the models adopted in the OMASES TSA Application Function to be comparable to those implemented in SICRE. Proper adaptations to reproduce the models originally used in the Italian simulator were required. For TSA few seconds of simulation are sufficient, since experience suggests that multi-swing transient instability phenomena are not likely to occur in the Italian system. This allowed neglecting the slow dynamics that a simulator takes into account. For example, the boiler representation (steam plants) was highly simplified and LTCs can be assumed fixed. The most important models related to TSA concern, in fact, the representation of synchronous machine, AVR, PSS, and turbine governor. Apart from the synchronous machine, the other models were built by means of Eurostag macro-blocks reproducing the standard Italian AVR and PSS models. Proper adaptations were made to implement turbine governors. Results from TSA testing The functionality of TSA has been tested as described in the following. A snapshot of the EMS output is correctly transferred to the OMASES database. In the Real-Time mode the following operations were automatically performed:
(1) (2) (3) (4)

Dynamic data preparation (TSA folder and configuration file creation) Retrieving of contingency and other TSA parameters from the database Loading of static system data and execution of load flow Execution of FILTRA and CONTROL modules, including the necessary dynamic simulations.

The settings related to TSA FILTRA operation are stored in the TSA database as well as the data for dynamic simulation. Different sets of contingencies have been used to verify the TSA function. A complete set of three-phase short circuit contingencies followed by line tripping for (N-1) criterion analysis in the entire network was initially tested. Critical lines have been identified and mainly corresponded to lines connecting, or close to, power plants and specifically for those plants weakly connected to the HV grid. Table 4-3 reports a list of contingencies selected for analysis. Further, some interconnection lines located in the production areas in the South of Italy have been tested. During real-time experimentation, the Italian network did not experience any particular transient stability problem. Figure 4-32 reports some results referring to a real case analyzed during the testing phase. The FILTRA parameters were selected as: CT1 = 300 ms, CT2 = 250 ms, CT3 = 200 ms, that represent the thresholds for considering a three-phase short circuit contingency respectively FSU, harmful and potentially harmful. It can be noted that the list of dangerous contingencies is really small compared to the full list of contingencies filtered, as nearly all of the analyzed cases were found firstswing stable (FSS in Figure 4-32 ).

4-72

Table 4-3. Partial list of the most representative contingencies for TSA
Line ID Cont_220 kV_line _16 Cont_220 kV_line _17 Cont_220 kV_line _18 Cont_220 kV_line _19 Cont_220 kV_line _20 Cont_220 kV_line _28 Cont_400 kV_line _14 Cont_400 kV_line _16 Cont_400 kV_line _17 Cont_400 kV_line _22 Cont_400 kV_line _29 Cont_400 kV_line _34 Cont_400 kV_line _42 Cont_400 kV_line _9 Description (faulted line) BIELLA EST-->TURBIGO ST SPEZIA STA-->AVENZA SPEZIA STA-->COLORNO MESE-->GORDUNO SONDRIO-->ROBBIA OSTIGLIA-->BUSS. S.S. TURBIGO ST-->RONDISSONE OSTIGLIA-->DUGALE OSTIGLIA-->FERRARA F. PORTOTOLLE-->FORLI' RAVENNA C.-->PORTOTOLLE MONTALTO-->SUVERETO PRESENZANO-->VALMONTONE SPEZIA STA-->MARGINONE

Output of FILTRA module

TSA parameters

Ranked List of Contingencies

Figure 4-32 Output of FILTRA module: TSA parameters and list of contingencies ranked in a severity order

One major aspect of FILTRA is the capacity to assess the dangerous contingency faster than the CCT calculation, even if the value of the CCT is only approximate. In fact, for example, the contingency MM1317 is declared unstable (HS in Figure 4-32 ) with a CCT larger than 290 ms, while the exact value calculated is 296 ms. On the other hand the identification of this contingency as a dangerous one is correct. In any case, by a particular functionality of the FILTRA module, it is possible to assess

4-73

very precisely the CCT of each contingency. This powerful facility is more dedicated to the engineering mode of the OMASES platform. One major value of the TSA function is to provide the operator with a list of possible actions to stabilize the system against a set of contingencies. The control function suggests how to stabilize the contingencies declared harmful by FILTRA and evaluates the power that should be re-scheduled from the critical to the non-critical machines. An example of the results of this action related to one harmful case is reported in Table 4-4. Figure 4-33 reports the details concerning the most severe identified harmful contingency for the examined case. It is taken from the OMASES User Interface for the Real Time mode. Several pieces of information are provided, among which the name of the contingency, the detail of each simulation (clearing time, margin, stability judgment, simulated time etc.), the computed CCT and the final rank.
Table 4-4. Rescheduling of critical machines for a harmful contingency
Rescheduling of Critical Machine for one contingency identified by FILTRA Initial power Final power Machine name in MW in MW ANPPG2 73.30 63.56 ANPPG3 78.20 68.46 BRNNG3 181.20 161.06 ROSNG1 296.70 274.85 ROSNG2 316.10 294.25 ROSNG3 320.00 298.15 ROSNG4 304.60 282.75 TIMPG4 280.70 258.85 TIMPG5 279.40 257.55 ISBAGA 159.50 139.25 ISBAGC 156.00 135.75 SFMPG3 160.00 148.79 ROSNGA 88.90 80.63 ROSNGC 98.50 90.23 ROSNGE 102.00 93.73 TIMPGA 110.60 102.33 TIMPGC 112.50 104.23 BSCNG1 637.00 448.94 BSCNG2 652.80 464.74 BSCNG3 617.20 429.14 BSCNG4 622.40 434.34 SFMPG6 244.40 222.55 ISBAG1 108.50 91.77 ISBAG2 107.30 90.57 specific harmful Difference in MW 9.738 9.738 20.143 21.849 21.849 21.849 21.849 21.849 21.849 20.249 20.249 11.215 8.271 8.271 8.271 8.271 8.271 188.060 188.060 188.060 188.060 21.849 16.731 16.731

The OMASES TSA function was also tested for heavily stressed system conditions, generated on purpose. In this case, the starting point consisted of a real time snapshot, and the stress was implemented by a topology change. The considered situation was that of 12/6/2003 at 11:30, characterized by a very high demand due to temperature rather higher than usual. A weakening of the system was then obtained by opening a line near Brindisi power station (South of Italy). For this stressed case, the validation phase included comparison of the simulation outputs of the TSA function with the electromechanical and long-term simulator SICRE, developed by CESI, taken as the reference. A complete comparative analysis is here reported for contingency affecting line NN1322. When performing a full simulation with SICRE a dichotomy process was used to assess the CCT related to the outage of this line. The approximate value of the CCT computed with SICRE is about 135-140 ms, against the value calculated by FILTRA, i.e. 142 ms.

4-74

Figure 4-33 FILTRA output for the modified case

The artificially stressed operating point mentioned above, caused a low critical clearing time (CCT = 117 ms) for a three-phase short-circuit fault on the BrindisiTaranto line (NN1320) close to Brindisi power station. Figure 4-34 shows the identified critical machines of Brindisi power plant. These machines matches with the analysis performed SICRE. The OMASES Control function determined the margin and the amount of power to be re-scheduled among the non-critical machines in order to make the system able to withstand this contingency (NN1320) with an imposed new clearing time of 180 ms, quite larger than the previously computed CCT of 117 ms.

Figure 4-34 FILTRA results and critical machines of Brindisi power station

Table 4-5 presents the final output of the OMASES Control function: it helps the operator to reschedule properly the power of the critical machines to non critical machines for a total amount of about 468 MW.

4-75

The amount of power to be re-scheduled is quite large. Therefore to reduce it, the control function was run again with a less demanding requirement: the desired clearing time of the system was set at the value of 150 ms. Table 4-6 shows that the amount of power to be re-scheduled is drastically decreased (257 MW) but, as it is clearly shown, the Critical machines are many more.
Table 4-5. Output of the control function for the stressed case, contingency NN1320
Rescheduling of Critical Machine Initial power in Final power Difference in Machine name MW in MW MW BRNNG3 181.20 160.94 20.265 BSCNG1 637.00 525.09 111.909 BSCNG2 652.80 540.89 111.909 BSCNG3 617.20 505.30 111.899 BSCNG4 622.40 510.50 111.899

Table 4-6. Control function output for the stressed case, contingency NN1320
Rescheduling of Critical Machine Initial power in Final power in Difference Machine name MW MW MW BRNNG3 181.20 175.16 6.043 TIMPG4 280.70 274.66 6.043 TIMPG5 279.40 273.36 6.043 ISBAGA 159.50 153.91 5.594 ISBAGC 156.00 150.41 5.594 SFMPG3 160.00 156.90 3.103 TIMPGA 110.60 108.31 2.289 TIMPGC 112.50 110.21 2.289 BSCNG1 637.00 585.88 51.117 BSCNG2 652.80 601.68 51.117 BSCNG3 617.20 566.08 51.117 BSCNG4 622.40 571.28 51.117 SFMPG6 244.40 238.36 6.043 ISBAG1 108.50 103.87 4.625 ISBAG2 107.30 102.67 4.625 in

The experimentation phase proved that OMASES can effectively be linked to an existing Energy Management System, e.g. a proprietary system with its own system model and data format, such as the Italian one. The only requirement consists of developing an appropriate bridge for on-line data acquisition and conversion into OMASES format. The real time tests showed the functionality of the on-line platform and, in particular, the filtering/ranking capabilities of the tool. Some off-line studies performed on artificially stressed scenarios allowed to confirm the ability of the package to correctly identify critical situations and provide preventive control countermeasures, such as generation re-scheduling. Results of the experimental process permitted the tuning and validation of the DSA platform in terms of experience and feed-backs for what concerns the effective possibilities of filtering, screening and stabilizing contingencies in large electrical power systems.

4.8.6 References
[1] OMASES - Open Market Access and Security Assessment System, EU Contract N. ENK6CT2000-00064, December 2000. {2] S. Massucco, D. Ruiz-Vega, A. Bihain, G. Burt, F. Casamatta, T. Koronides, R. Lopez, C. Vournas, Advance Perspectives and Implementation of Dynamic Security Assessment in the Open Market Environment, paper 39-101, CIGRE 2002. [3] S. Massucco, L. Wehenkel, A. Bihain, D. Cirio, M. Fiorina,R. Lopez, D. Lucarella, , D. Ruiz Vega, C. Vournas, T. Van Cutsem, , OMASES: A Dynamic Security Assessment Tool for the New Market Environment, Proc. IEEE Bologna Power Tech conf., June 2003

4-76

[4] M. Pavella, D. Ernst and D. Ruiz-Vega. Transient Stability of Power Systems: A Unified Approach to Assessment and Control. Kluwer Academic Publishers, 2000. [5] D. Ruiz-Vega and M. Pavella. A Comprehensive Approach to Transient Stability Control. Part I: Near Optimal Preventive Control, IEEE Trans. On PWRS, (18), 4, pp. 1446-1453, November 2003. [6] D. Ruiz-Vega. Dynamic Security Assessment and Control: Transient and Small Signal Stability. PhD Thesis. University of Liege, May 2002 [7] Standard Test Cases for Dynamic Security Assessment. Final EPRI report No. EPRI TR-105885, Project 3103-02 03, December, 1995. [8] D. Gan, R. J. Thomas and R. D. Zimmerman. Stability-Constrained Optimal Power Flow. IEEE Trans. on PWRS, (15), 2, pp. 535-540, May, 2000 [9] M. LaScala, M. Trovato and C. Antonelli. On-Line Dynamic Preventive Control: An Algorithm for Transient Security Dispatch. IEEE Trans. on PWRS, (13), 2, pp.601-610, May 1998. [10] A. Bettiol, L. Wehenkel and M. Pavella. Transient Stability-Constrained Maximum Allowable Transfer. IEEE Trans. on PWRS, (14), 2, pp. 654-659, May 1999 [11] Ruiz-Vega, D., Messina, A., Pavella, M., 2004, Online Assessment and Control of Transient Oscillation Damping, IEEE Trans. on Power Systems, Vol. 19, No. 2, pp. 1038-1047, May 2004. [12] T. Van Cutsem, C. Vournas, Voltage Stability of Electric Power Systems, Kluwer Academic Publishers, Boston, 1998 [13] B. Otomega, T. Van Cutsem, Fast contingency filtering based on linear voltage drop estimates, Proc. IEEE Power Tech conference, St Petersburg (Russia), June 2005 [14] T. Van Cutsem, Y. Jacquemart, J.-N. Marquet, P. Pruvot, A comprehensive analysis of midterm voltage stability, IEEE Transactions on Power Systems, Vol. 10, pp. 11731182, 1995. [15] T. Van Cutsem, J. Kabouris, G. Christoforidis, C.D. Vournas, Application of real-time voltage security assessment to the Hellenic Interconnected system, IEE Proceedings on Generation, Transmission and Distribution, Vol. 152, No.1, pp. 123-131, Jan. 2005 [16] T. Van Cutsem, R. Mailhot, Validation of a fast voltage stability analysis method on the HydroQubec system, IEEE Trans. on Power Systems, Vol. 12, pp. 282-292, 1997 [17] T. Van Cutsem, G. Hasse, C. Moors, S. Guillon, R. Mailhot, A new training simulator for improved voltage control of the Hydro-Qubec system, Proceedings IEEE Power System Conference and Exhibition (PSCE), New York, Oct. 2000. [18] C. Vournas, Scientific Co-ordinator, Software Development for Voltage Stability Analysis, Project 96 SYN 95, NTUA, Greece [19] G. Christoforidis, J. Kabouris, C. Vournas, T. Van Cutsem, Investigation of Parameters Affecting Voltage Security of the Hellenic Interconnected System, Proc. 15th PSCC, Liege (Belgium), Aug. 2005 [20] D. Ernst, D. Ruiz-Vega, M. Pavella, P. Hirsch and D. Sobajic. A Unified Approach to Transient Stability Contingency Filtering, Ranking and Assessment. IEEE Trans. on PWRS, (16), 3, August, 2001. [21] P. Baratella, P. Scarpellini, R. Marconato, B. Cova, E. Gaglioti, R. Zacheo, A Power System Simulator Covering Different Time Scale Phenomena: Models, Algorithms, MMI and Test Results, Proc. IEEE Stockholm Power Tech, Stockholm, June 1995, pp. 376-381. [22] S. Gissinger, M. Stubbe, P. Chaumes, J.P. Antoine, A. Bihain, Advanced Dispatcher Training Simulator, IEEE Computer Applications in Power, Vol. 13, No. 2, 2000, pp. 25-30 [23] T. Van Cutsem, C. Moisse, R. Mailhot, ``Determination of secure operating limits with respect to voltage collapse'', IEEE Trans. on Power Systems, vol. 14, 1999, pp. 327-335 [24] D. Cirio, D. Ernst, D. Lucarella, S. Massucco, A.Morini, F. Silvestro, M. Pavella, G. Vimercati, L. Wehenkel, Application of an Advanced Transient stability assessment and control method to a realistic power system, PSCC, Liege, August 2005.

4-77

4.9

State-of-the-Art of DSA in Finland - Fingrid

At Fingrid, the issues of voltage stability and angle stability are most important because they are the limiting factors for transmission between Finland and Sweden and between Northern and Southern Finland. When the power flows from Sweden to Finland via the AC-lines in the north and on to Southern Finland the transmission capacity is limited by the voltage stability. The security of the system can then be assessed with help of the contingency analysis of the SCADA/EMS system. The contingency analysis is based on a load flow model updated by state estimation with a time interval of 5 minutes. The state-estimation is based on a large number of power and voltage measurements made throughout the Finnish grid. Also the status of each EHV-line in the model is updated according to the actual situation. Only the Finnish power system is modeled in detail whereas the rest the synchronously operated Nordic power system (including Sweden, Norway and the Eastern Denmark) is modeled as an Thevenin equivalent. When the power flows from Southern Finland to north and on to Sweden, it is the damping of power oscillations that limits the transmission capacity. Because in the critical mode of oscillation (with a frequency approximately 0.3 Hz) the generators of Southern Finland are oscillating against the generators of Southern Sweden and Norway, a model for the whole Nordic power system is required. Such a model exists for the off-line studies but there is at present no way of updating its loading, generation and component status data to make it correspond to the continuously changing powerflow. The on-line contingency analysis is therefore not yet possible from the angle stability point of view. If an automatically updated dynamic model existed for the whole Nordic power system, it would still be impractical to perform any extensive contingency analysis, because the long simulation time required. The dimensioning faults are however most often known beforehand based on off-line simulations, which helps to keep the list of relevant contingencies short.

4.9.1 General Description of DSA Implementation 4.9.1.1 On-line monitoring of power oscillations

Fingrid has tested since February 2004 one system for on-line monitoring of oscillations [1]. The test arrangement is based on power measurements at the two 400 kV interconnecting lines between Finland and Sweden. These locations were chosen for the measurements because the dominant mode of power oscillation in the Nordic power system (0.3 Hz) is always seen on these two lines when they are in use. The power is measured at a sampling rate of 10 samples/s. The measurement data is sent in real-time to a server located in the central office of Fingrid. The same server also has the analysis software.

4.9.1.2

The state estimator

The state estimator used at Fingrid for on-line contingency analysis is illustrated in the Figure 4-35 .

4-78

Real time state estimation (PNA, Power Network Applications)

Status data

Power system
Voltage- ja power measurements Default data

Network Configurator (CE) The model of the power grid

State Estimator (SE) The load flow of the grid Complete Model Estimator (CME) Penalty Factor Calculator (PFC) Short Circuit Calculation (SCC)

Contingency Selection/ Analysis (CS/CA)

Power flow solution

OPF applications Remedial/Preventative Action (RA/PA) Security Constrained Dispatch (SD) Voltage/VAr Scheduler (VVS) Reactive Capability Monitor (RCM)

Figure 4-35 The state estimator

At Fingrid the network data used in the state estimator of the SCADA/EMS-system is largely the same as in the powerflow model used for off-line studies. Only the 110 kV network is partly reduced, which does not significantly affect performance of the contingency analysis from the system point of view. The Finnish power system is represented by a set of hierarchical pictures in the SCADA/EMS system. The example of the Figure 4-36 represents the 400/220 kV transmission grid. In the contingency analysis applied at Fingrid in the context of voltage stability it is assumed that all loads have constant power, which is the worst case in terms of voltage stability. Fingrid does not have Special Protection Schemes (SPS) relevant to the voltage stability assessed by the contingency analysis. They have therefore not been included in the contingency analysis. Loadshedding schemes will however be utilized in the future, which will make it necessary to include them also in the contingency analysis. At Fingrid the outputs of most generators including the largest ones are measured directly and fed to the SCADA/EMS system and are therefore available also for the contingency analysis. Loads are estimated by the state estimator. The rest of the synchronously operated Nordic power system is modeled as a Thevenin equivalent with a constant impedance. This causes some error for contingencies involving the interconnecting lines between Finland and Sweden. The error will be bigger in cases where there is a power line outage on the Swedish side and close to the interconnecting lines. To make the contingency analysis cover all cases a more detailed model of the Swedish power system would be required or the Thevenin impedance should at least be updated based on real-time estimation of that impedance. There are techniques available for that. Such techniques are used for instance in the Voltage Instability Predictor which estimates the equivalent impedance of the feeding side of a corridor and compares that to the impedance of the load side of the same corridor.

4.9.1.3

Real-time monitoring of reserves

4-79

The issue of frequency stability is common for Finland, Sweden, Norway and the Eastern Denmark even if Sweden and Norway have the main responsibility for the frequency control. The goal is to maintain the frequency stability by making sure there are sufficient reserves available that are activated by under-frequency. There are agreements concerning this between the TSOs of the Nordic countries. A simple way of monitoring frequency security is to monitor the amount of reserves in realtime. Fingrid has already implemented this.

Figure 4-36 An example figure of the Finnish transmission grid represented in the SCADA/EMS system.

4.9.2 Operating experiences 4.9.2.1 On-line monitoring of power oscillations

The on-line monitoring system [1] has five adjustable frequency bands. The upper frequency limit of a band is always the lower limit for the next band. There cannot be gaps between the bands and the bands cannot be overlapping. There are adjustable warning and alarm thresholds for the damping time constant, the amplitude and frequency of the oscillation. These can be set separately for each of the five bands. The warning and alarm thresholds were set in such a way that the number of warnings and alarms could be kept reasonable. The messages given by the monitoring system [1] have not yet been linked to the SCADA/EMS-system, because there do not exist any known rules concerning the required course of action by the operator if a warning or alarm is issued by the monitoring system. The only mode of oscillation that is known to limit the transmission capacity from Finland to Sweden

4-80

is that of appr. 0.3 Hz. That is also the only mode the damping of which can be affected by control actions in Finland. The monitoring of the other modes is however potentially useful as it can reveal previously unknown features of the Nordic power system and help to verify the simulation model. The details of the estimation algorithm [1] are not known to Fingrid, but it is based on the assumption that the random variations of loads taking place in the system act as white noise perturbing a linear system. The measured power oscillation is treated as the output of that linear system and is used to identify the dynamics of the system and to give estimates of mode amplitudes, frequencies and damping time constants. The estimation algorithm [1] sees many modes of frequency in each frequency band, not just one. The algorithm chooses the one having the highest amplitude and uses its frequency, amplitude and damping time constant as representative for the whole band. When the amplitude of oscillation is small and the damping is good there are several modes inside one single frequency band that have approximately the same amplitude. In that case the one happening to have the highest amplitude varies all the time resulting in a constant variation of the mode frequency, amplitude and damping time constant given by the algorithm. If there is a clearly dominating mode of oscillation but it happens to have a frequency close to the border line of two neighboring bands, the frequency associated with the highest amplitude may fall in turn on any of the two bands. The amplitude, frequency and damping estimates associated to the two bands then change abruptly each time the frequency of the dominating mode passes the border line between the bands. To avoid this the frequency limits of each band should be set carefully based on the expected mode frequencies so that the dominating modes always remain inside the same frequency bands. This requires some prior knowledge of the modes of oscillation present in the system. The on-line monitoring of power oscillation has performed reasonably well as a software, but the damping estimates have not proved to be useful. There is a large scatter in the estimated damping time constants even when the power flow of the system remains largely the same. The scatter can be reduced by averaging but even a long averaging window of 45 min gives a seemingly random and high variation of damping estimates. The correlation between the estimated damping and the proximity of the transmission capability limit is poor (see Figure 4-37 ). The averaging window used in the figure 3 was 45 min. The correlation is worse if non-averaged damping time constants are used. The poor correlation makes it impossible in practice to assess the proximity to the transmission capacity limit based on the on-line estimation of damping. There are also inherent limitations in the method of on-line monitoring of damping. The damping estimation is based on small perturbations in the system assumed to be a linear one and can consequently only give estimates of the small-signal damping. The transmission capacity is however limited by the damping of high-amplitude oscillations which can be much worse due to the nonlinearity of the power system. Another limitation of the method is that it naturally only can estimate the damping of the system in its current state, whereas the transmission capability is usually determined by the damping after a contingency (e.g. the n-1-criterion). A simulation model of some kind is needed to predict the damping after the contingency. It will be too late to estimate it by measurements, if the damping is too poor and the system becomes unstable after the contingency.

4.9.2.2

Operating experience of the contingency analysis

4-81

15 Damping time constant (s) 14 13 12 11 10 9 8 7 6 -1100 -600 -100 P1 (MW)

Figure 4-37 The estimated damping time constant vs. the transmission in corridor limiting the transmission capability. The P1corridor is located between the Southern and Northern Finland.

400

The contingency analysis has been in use since 1997. There have been periods of time when the stateestimator has failed thus making even the contingency analysis impossible. There have been several reasons for the failure of the state-estimator including the following: - Failure of communication has lead to missing measurements. - The topology of the grid has been such that the estimator has failed to solve the state of the system. - The server and its back-up server have both failed (approximately once per two years). The state-estimator has been out of operation in total approximately 5 % of time. The contingency analysis has mostly worked well, when the state-estimator has been able to provide the necessary power flow case. An exception is a busbar fault contingency involving the other 400 kV interconnecting lines between Finland and Sweden. The load flow solution fails to converge in that contingency due to an over-simplified equivalent of the Swedish power system. The voltage limit for voltage instability has been set to 370 kV for the 400 kV grid. There have this far been no need to reduce transmission based on the violation of that limit. The reason is, that the transmission is kept in the capacity limits based on off-line simulations using the same voltage limit of 370 kV.

4-82

4.9.3 Proven benefits

4.9.3.1

Benefits of the on-line monitoring of oscillations

Even if the on-line estimation of damping does not seem to be a promising technique for direct monitoring of the security of the power system it does have certain benefits. First of all it is a step forward to have a means to observe the oscillations continuously. In the past the measurements have been limited to those given by oscillation recorders triggered by a major event in the power system. Continuous measurements of power oscillations facilitate a learning process in which persons responsible for the operation and planning of the power system become familiar with the normal behavior of the power system. That normal behavior can then compared to the behavior during abnormal situations after major contingencies and to the behavior predicted by a simulation model in normal and abnormal conditions. The comparisons can help to make the simulation model more accurate, to identify components not performing optimally in terms of damping and to improve the control systems to give better damping. The estimated mode frequencies look more useful information than the damping time constants, because the frequency can be measured with better accuracy even in the presence of noise. Based on simulations and previous measurements it is known that the dominating mode of oscillation in the Nordic power system has a frequency of approximately 0.3 Hz. The monitoring done by the on-line monitoring system [1] has supported this and has increased the confidence on the simulation model in this respect. The on-line monitoring system [1] has however identified such a mode of poorly damped oscillation that cannot be produced by simulations. That mode has a low amplitude and a frequency of approximately. 0.5 Hz. It is not known yet what is the origin of this oscillation and whether it is a potential risk to the system security. The same mode of oscillation with equally low amplitude has been measured also in the Swedish and Norwegian power systems by Phasor Measuring Units (PMU) installed by other TSOs and research institutes. The fact that the 0.5 Hz mode has exhibited a poor damping for long periods of time without leading to significant amplitudes suggests that the mode can be harmless. The estimated amplitude is at least one decade smaller than that of the continuously present dominant mode of 0.3 Hz. Since the origin of the 0.5 Hz mode is not yet explained, there is a reason to continue investigations by monitoring and by examining the behavior of different control systems to find an explanation.

4.9.3.2

Benefits of the contingency analysis

The transmission capacity valid for the intact grid is calculated by off-line simulations. There is however from time to time planned and unplanned outages affecting the transmission capacity and even the number of generators running varies. The contingency analysis uses the current state of the system in assessing the security of the system from the voltage stability point of view. It is therefore possible to adapt the transmission to the continuously changing capacity.

4.9.4 References
[1] Douglas H. Wilson: Managing Oscillatory Stability using On-line Dynamics Measurement, Power Systems Conference and Exposition, New York, October 2004.

4-83

4.10 State-of-the-Art in DSA in Greece: OMASES Operating Experience

This section summarizes the follow-up of the OMASES project, the continuing in service operation of the on-line VSA application in the Control Center of HTSO in Greece since the end of 2004 and some typical results from this application period.

4.10.1 VSA of the Hellenic interconnected system

The Hellenic Interconnected System includes the generation and transmission systems of mainland Greece and some adjacent islands. The main production center is located in the northwest part of the country close to the lignite mines, which is the basic fuel source, while the main center of consumption lays in the southern part including the metropolitan area of Athens. The installed generation capacity of the interconnected system in 2004 was about 10700 MW with 48% lignite, 29% hydro, 14% natural gas, 7% oil and 2% renewable. The generation capacity at the southern part of the country is close to 2860 MW, installed mainly at the power plants of Lavrio, Ag. Georgios (both near Athens), Aliveri in Central Greece and Megalopolis (in Peloponnese). The transmission system operates mainly at the levels of 400 and 150 kV with a very limited number of 66 kV connections. There are 5 AC interconnection lines with the neighboring countries in the north (with a net transfer capability of 700 MW) and a DC interconnection with Italy via a submarine cable (with a maximum capacity of 500 MW). Depending on topology the system consists on the average of 800 buses, 1100 branches and 70 generators. As already mentioned, the geographical imbalance between generation and consumption leads to bulk transmission in the North-South direction. This transfer is continuously increased due to the high increase of the yearly peak loads mainly in the south; such peaks occur during the summer period and they are mainly due to air-conditioning and other cooling devices. The delays in the implementation of planned transmission projects (mainly due to public protest) makes the situation even worse. Thus occasionally the Hellenic system faces critical operational conditions regarding voltage stability. Such incidents have been experienced since 1996. The most severe and recent disruption occurred on July 12th, 2004, when the southern part of the country suffered a blackout lasting for two hours. This subsection presents a sample of typical VSA outputs available to the HTSO operators.

4.10.1.1 Secure Operation Limits

The contingencies resulting in the most constraining SOLs are listed in a table format as seen in Table 4-7 , together with the corresponding margins (computed with a tolerance = 10 MW). Note that the first five contingencies of Table 4-7 have a zero margin, meaning that the occurrence of any of these at the specific time that the snapshot was taken would result in unacceptable postcontingency conditions. However, all these contingencies have very local effects and refer to areas of the system where transmission upgrades were already under way. In particular the first three contingencies refer to breaking the loop of cables feeding the island of Kerkyra resulting in an abnormally long radial path to a relatively large load and, hence, in an excessive voltage drop. The nature of the other local problems is similar.

4-84

Table 4-7 Secure Operation Limits

no.
254 312 296 299 228 61 51

Contingency name
LINE_CON_2-1.1 LINE_CON_ -2.1 LINE_CON_ -.1 LINE_CON_ KARD-ELBA400.1 LINE_CON_ -.1 GEN_CON_ _.GFIC.UN GEN_CON_ .GFIC.GEN2.UN all other contingencies

Margin (MW)
0 0 0 0 0 40 79 > 316

The first contingency with really serious system wide effect is no. 61 referring to the loss of a combined cycle plant in Lavrio. A similar loss of generating units in Lavrio is contingency no. 51, with slightly larger margin. All other contingencies have margins above 316MW. The snapshot of the above Table corresponds to the system configuration during the winter of 2003 (trial operation of OMASES) where one natural-gas power station (Ag. Georgios) in the Athens area was not in operation. This left the Athens region with little reactive support. Although the total load was quite light at the time, contingency no. 61 had a very small margin of 40 MW. This is a typical case where the system operator should ask the missing unit to start (if available) for security reasons. As seen, the contingencies with small margin are not all equally dangerous. The extent of the problems caused to the system by an unacceptable contingency is easily assessed from the voltage profiles automatically produced by the SOL computation and described in the sequel.

4.10.1.2 Voltage profiles

A voltage profile shows the number of buses with voltages below a certain level. The voltages correspond to a snapshot of the collapsing system at the marginally refused level of stress during SOL computation. The affected area is identified from the names of typical buses. For instance, Figure 4-38 shows the voltage profile corresponding to a contingency with very localized effect (no. 299 in Table 4-7 ). As can be seen, very few buses with very low voltages exist in this case, while almost all buses remain above 0.9 pu voltage. By examining such voltage profiles, it is easily seen that all contingencies with zero margin in Table 4-7 result in local problems. In contrast, Figure 4-39 shows the voltage profile of a system-wide dangerous contingency. As can be seen, the disturbance is widely spread, even though the focal point (lowest voltages) can be located in a specific area, namely Central Greece, just to the north of Athens metropolitan region. This picture is typical of the South system instability mode, which was endemic in the Hellenic system before its upgrades after July 2004 [19].

4-85

Figure 4-38 Voltage profile for a contingency with local effect

Figure 4-39 Voltage profile for a contingency with system-wide impact

4.10.1.3 Voltage Evolutions

Another output readily available for interpreting results is the post-contingency time evolution of the transmission voltage with the largest drop after the contingency. This is displayed at the marginally accepted and marginally refused stress levels of SOL computation respectively. The final voltages are compared to a lower acceptable value, typical of a voltage collapse, to decide whether the system evolution is acceptable or not. Figure 4-40 shows the voltage evolution for a case of unacceptably low voltage. As can be seen, the marginally refused simulation does not correspond to a voltage instability, but merely to final voltages that are a little below the assumed 0.7 pu threshold. Hence, for this contingency, the SOL should not be interpreted strictly as a voltage stability limit. In later on-line operation during 2005 a threshold of

4-86

0.75 was adopted for refusing a contingency.

Figure 4-40 Post-contingency voltage evolutions: low but stable voltages

A quite different situation is shown in Figure 4-41 , which shows the voltage evolution corresponding to a contingency leading to a voltage instability and collapse. Here, the marginally unstable simulation ends up in a collapse and loss of synchronism at t=880s. This evolution is clearly very different from the one of Figure 4-40 .

1)

Figure 4-41 Post-contingency voltage evolutions near a stability limit

The final collapse shown in Figure 4-41 can be explained as a loss of synchronism occurring at the Aliveri power station. In order to demonstrate this, the post contingency loadability limit for this contingency is computed and, for this run, the simulated rotor angle curves of the two generators of Aliveri station are plotted in Figure 4-42 , together with that of a generator in Northern Greece, for comparison purposes.

4-87

Figure 4-42 Rotor angles of Aliveri and Ag. Demetrios generators

Figure 4-38 to Figure 4-41 illustrate the type of information that can be retrieved from unstable postcontingency system evolutions obtained by QSS simulation. In the case of Figure 4-41 , for instance, a standard load flow would have merely diverged, providing no further information.

4.10.1.4 Regional and National PV curves

The regional PV curves are plots of the simulated voltage of a critical bus in each area as a function of the total system load actually consumed in the area, whereas the national PV curve shows the total load consumed in the system versus the voltage of a representative 150-kV bus located in Athens. In the absence of any contingency, PV curves are obtained through QSS simulation of a ramp increase in demand, as already mentioned. An example of national PV curve without any contingency is shown in Figure 4-43 . This result tells the operator how far the system could go without incident. In this example, the load could increase by more than 500 MW with an acceptable voltage level.

Figure 4-43 National PV curve without contingency

PV curves relative to a post-contingency situation, on the other hand, include the effect of the

4-88

contingency followed by the demand increase. Figure 4-44 shows the national PV curve corresponding to a very severe contingency, namely the loss of a large combined cycle plant at Lavrio power station calculated from historical data of Summer 2002. As seen in this figure, the total load is barely able to restore to its pre-contingency consumption even after the demand ramp. This is due to the exhaustion of the regulating range of the LTCs in the affected area, where the power received by consumers is reduced due to low distribution voltages. Note that due to the non-restoration of load, the PCLL implied in Figure 4-44 should not be compared to the SOL margin, for which the stress is applied prior to the contingency assuming full restoration of load power.

Figure 4-44 National PV curve after severe contingency

The regional PV curve of the area of Central Greece for the same contingency is shown in Figure 4-45 . Clearly, in this case, the load power is severely reduced after the contingency and the demand increase cannot lead to increased consumption. Inspecting the various PV curves clearly demonstrates that the most affected region by the specific contingency is Central Greece. Customer service in this area will greatly suffer, if such a contingency had occurred.

Figure 4-45 Central Greece regional PV curve after severe contingency

4-89

4.10.2 Operating experience

In this section, results from two characteristic real-time operation cases are presented, together with their analysis and evaluation [3]. The first case refers to a winter 2005 day and the second to the summer 2005 day with the yearly maximum load conditions.

4.10.2.1 Winter 2005 case

Peloponnese is a peninsula in southern Greece that is connected electrically to Athens area with 5 high voltage (150 kV) transmission lines through Korinth substation and to Western Greece through a pair of high voltage submarine cables in the area of Patra. The cables normally import power to Peloponnese from the Kastraki hydro generating station that consists of four units with a maximum capacity of 320 (4x80) MW. During high load conditions in Peloponnese, the usual practice is to split this station with two of its units connected to a bus supplying the cables and the other two units on a different bus interconnected to Western Greece. The objective is to control the current flow through the cables with the generation level at Kastraki.
Table 4-8 Voltage Security Margins (Feb.15th 2005, 18:30)

Contingency Name Line Megalopolis-Kalamata Line Patra-Lapa Unit GEN2 Kastraki Unit GEN4 Kastraki

MW 0 10 42 42

(a) Voltage evolution after the loss of the line Patra-Lapa Figure 4-46

(b). System voltage profile after the loss of the line Patra-Lapa.

On February 15th of 2005, real-time VSA showed a large difference in voltage security margins between the results of the 17:30 and 18:30 timestamps of the periodic execution. Although the security margins table of 17:30 did not include any contingency with a margin less than 1000 MW (with the exception of a few known outages with very local effect), the table of 18:30 included some contingencies at Kastraki and Peloponnese with zero or low margin, as shown in . No other indication of a problem (such as low voltages) appeared in the EMS SCADA or real-time state estimator results. An investigation on the validity of the above results showed that the reason was the opening of a Kastraki circuit breaker (bus coupler) at 17:45 that had separated the two units feeding Peloponnese for the afternoon high load period, as described above. The Peloponnese load increased between those

4-90

timestamps from 620 to 706 MW. Also, in February 2005, a high voltage transmission line in Peloponnese from Patra to Korinth was open at the Xilokastro substation, somewhere in the middle of the distance, due to a transmission expansion project, resulting in a longer electrical way from Korinth to Xilokastro and western Peloponnese. Figure 4-46(a) illustrates the voltage evolution at the Xilokastro substation after the outage of the Patra-Lapa line for the marginally stable and unstable cases. The voltage collapse in the unstable case is evident. The corresponding system voltage profile (Figure 4-46(b)) indicates that the area affected is close to Patra and extends to northern Peloponnese and the area of western Greece radially connected to Peloponnese. The interpretation of these results led to a change in the way of operating the Kastraki station circuit breaker. Afterwards, when the station is electrically divided in two parts, three (instead of two) units feed Peloponnese through the submarine cables, providing a larger generation reserve to that area, and thus resulting in higher voltage security margins.

4.10.2.2 Summer 2005 case

Voltage security problems have appeared in the Greek interconnected system in its southern part mainly during the summer, when the load reaches its maximum and the power transfer from North to South is high. After the blackout of summer 2004, several transmission reinforcements were introduced in the system as described in the next section. Therefore, the summer of 2005 was a crucial period for testing the limits of the upgraded system and monitoring its voltage security margins in real-time. On August 3rd, 2005 at 13:55, maximum load occurred in the system with a value of 9642 MW. On that day (as well as the previous days) the real-time VSA results were closely monitored in order to spot contingencies resulting in voltage stability problems and indicate the nature of the problem and the available security margin. Based on that information, decisions could be made regarding system operation.
800

700

600

500 Megalopolis GEN3-4 Komotini GENCC Megalopolis GEN1-4

MW

400

300

200

100

16 .3 0

22 .3 0

12 .3 0

Figure 4-47. Evolution of voltage security margins on August 3rd, 2005.

9. 30 10 .3 0

11 .3 0

13 .3 0

13 .4 5

4-91

14 .3 0

15 .3 0

19 .3 0 20 .3 0

21 .3 0

23 .3 0

17 .3 0

18 .3 0

1. 30

0. 30

4. 30

5. 30

6. 30

7. 30

2. 30

3. 30

8. 30

(a) PV curve for the double unit outage at Megalopolis (units 3,4). Figure 4-48

(b) PV curve for the outage of combined cycle at Komotini.

All the contingencies that used to cause security problems in the Athens area (see next chapter), including those responsible for the July 2004 blackout, had in the Summer of 2005 an SOL larger than 500 MW. Figure 4-47 illustrates the evolution of the security margins, during that day, for the remaining three critical contingencies, namely generator outages in the power plants of Megalopolis (Peloponnese area) and Komotini (North-Eastern Greece). The value of 800 MW in the graph practically indicates margins larger or equal to 800, since this value is the maximum security margin considered in the analysis. The smallest margins appear during periods of high load conditions e.g. 12:00-15:00 and 20:00-22:00. The N-2 contingency that involves the loss of units 3 and 4 at Megalopolis had a zero security margin for several hours during that day. Peloponnese has become the most vulnerable part of the grid regarding voltage security and thus, several transmission projects are planned for this area in order to reinforce the system. The contingency at plant Komotini (loss of all three units of the combined-cycle) has also zero security margin for a timestamp very close to maximum load. Figure 4-48(a) and (b) show the regional PV curves for the contingencies at Megalopolis and Komotini (with zero margin close to maximum load). It can be seen that the Megalopolis contingency results in voltage instability in Peloponnese, since the load cannot be restored, while the Komotini contingency results in a marginal voltage instability in North-Eastern Greece. In general, operating conditions corresponding to such results, were considered satisfactory since no critical N-1 contingency appeared threatening the voltage stability of the system.

4.10.3 References
[1] T. Van Cutsem, J. Kabouris, G. Christoforidis, C.D. Vournas, Application of real-time voltage security assessment to the Hellenic Interconnected system, IEE Proceedings on Generation, Transmission and Distribution, Vol. 152, No.1, pp. 123-131, Jan. 2005 [2] G. Christoforidis, J. Kabouris, C. Vournas, T. Van Cutsem, Investigation of Parameters Affecting Voltage Security of the Hellenic Interconnected System, Proc. 15th PSCC, Liege (Belgium), Aug. 2005 [3] G. Christoforidis, J. Kabouris, C. Vournas, T. Van Cutsem, Experience Gained by the Application of a Real-Time Voltage Security Assessment Method at the Hellenic Transmission System Operator, CIGRE paper C2-206, Paris, Aug./Sept. 2006.

4-92

4.11 State-of-the-Art of DSA in Ireland ESB National Grid

4.11.1 Introduction
Electricity Supply Board (ESB) is Irelands state owned electricity utility. ESBs National Grid is responsible for the dispatch of generation and the operation of the transmission system and electricity market. It operates the National Control Centre (NCC) and a standby Emergency Control Centre (ECC), both located in Dublin. In early 2001, ESB commenced a project to replace the main Supervisory Control and Data Acquisition (SCADA) / Energy Management Systems (EMS) at these locations and also to replace the associated Operator Training Simulator (OTS) and obsolescent Remote Terminal Unit (RTU) equipment. This section describes the architecture and main functions of the new EMS and associated systems.

4.11.2 Architecture
The new EMS is based on a distributed architecture with identical hardware and software components at both the NCC and ECC. A simplified representation of the NCC system is provided in Figure 4-49 , a replica of which is installed at the ECC. The hosts are Intel based Windows 2000 servers and the clients are Windows XP workstations.

Figure 4-49 National Control Centre Overview

4.11.3 Power Applications

For the purposes of this paper the power applications are divided into two groups. The first group covers the traditional applications such as power flow, contingency analysis and reactive power management. The second group covers the stability applications specified to meet the operational requirements of the ESB power system.

4-93

4.11.3.1 Traditional Applications

State Estimator, Power Flow, Short Circuit Analysis (both single-phase and three-phase), Optimal Power Flow (OPF), Contingency Analysis, Security Enhancement and Voltage Var Dispatch (VVD) have been delivered as an integral part of the new EMS, each of which can be run in real-time and study modes. Security Enhancement uses linear programming based OPF techniques to provide control strategies to the operator for the purposes of alleviating security violations and reducing operating costs. Security constraints on both current state and simulated post-contingent states are addressed by providing several control strategies. VVD is also an OPF based tool and it provides control recommendations to maintain system voltages within prescribed limits. These recommendations are automatically computed as part of the real-time network analysis sequence and can be directly implemented in the power system via SCADA or can be made available to the operators as advisory recommendations.

4.11.3.2 Stability Applications

Two third party stability applications running on a dedicated server are integrated with the new EMS : Voltage stability Analysis (VSA) : A VSA tool has been delivered to assist with the management of voltage stability issues which have arisen in recent years due to the significant growth in system demand (28% in 5 years) and the limited investment in network infrastructure. The tool can operate in both real-time and study modes. In real-time mode the application analyses data provided by the EMS via a dedicated utility know as Dynamic Case Preparation (DCP) and returns alarms to the EMS if specified criteria are broken. The operator can retrieve additional information from the VSA tool directly, if necessary, such as the MW margins to a collapse situation. The VSA tool also supports a workstation based study mode. Transient Stability Analysis (TSA) : The requirement for dynamic analysis has been driven by the increasing flows on the 275kV inter-connector between the ESB system and Northern Ireland Electricity (NIE) system. Currently, faults on either system can cause low frequency (1 to 1.5 Hz) damped oscillations on the inter-connector. In order to manage the continued growth in system demand it is important to maximize imports across the inter-connector. The new TSA tool will assist in the management of dynamic stability issues that could arise from this growth. In a similar manner to VSA, TSA is provided with EMS data by the DCP utility enabling it to perform a base case analysis which assesses the secure operation of the current system condition under a set of credible contingencies. The tool can also perform a transaction analysis which assesses the secure operation of a future system condition, defined by a power transaction under a set of credible contingencies. The security of the system is indicated by the specified security indices for the base case analysis, and the power transfer limit for the transaction analysis. The latter can further be used, together with the thermal and voltage security limits, to determine the Total Transfer Capabilities (TTC) of various interfaces in a system.

4.11.4 Conclusion
ESBs new EMS is equipped with a range of network and generation applications, specified to cope with the challenges of operating Irelands power system. The system is based on industry standard hardware, a flexible web based GUI and communications technology that will facilitate improvements in the reliability and speed of telemetry acquisition. The delivery of the new EMS has presented an opportunity to rationalize data interfaces to corporate systems and to standardize on a centralized data hub architecture. .

4-94

4-95

4.12 State-of-the-Art of DSA in Japan TEPCO

4.12.1 Scope
The Tokyo Electric Power Company (TEPCO) is one of ten electric power companies, which are responsible for the system operation of their own jurisdictions in Japan. TEPCOs jurisdiction includes the metropolitan Tokyo area, and the peak demand as of this date is 64.3 GW recorded on July 24, 2001. The operation of this large and complex power system poses a considerable challenge for system operators. Transmission capacities in the EHV network are more frequently limited by transient stability constraints than by thermal limit constraints, and thus the implementation of TSA facilitates the stable and secure operation while minimizing the generation cost. As for voltage stability, TEPCO has built transmission lines to reinforce its EHV network and has installed static and dynamic reactive power sources since it experienced a massive blackout caused by voltage collapse in 1987. Therefore, credible contingencies dont pose a serious threat to the TEPCO network in a daily operation. The implementation of VSA, however, has helped system operators monitor the security of the power system, considering extreme contingencies that are more severe than credible ones. TEPCO also has been developing a powerful transient screening program for the on-line DSA system. Name of this screening program is TEPCO-BCU. While TEPCO-BCU is still under development to apply to on-line DSA systems, TEPCO-BCU already has enough capability to screen out critical contingencies from a large number of contingencies in a very large power system in an off-line situation. For example, the TEPCO network planning section has installed a useful transient stability verification system that is based on TEPCO-BCU. This system can greatly reduce the effort required for transient stability analysis.

4.12.2 Description of VSA Implementation 4.12.2.1 Architecture

The first version of the TEPCO VSA started its operation, just after the voltage collapse. It has been updated periodically, and now, the function runs on a set of EWS and client PCs. The architecture of current version of the TEPCO VSA is shown in Figure 4-50 . The terminal PCs in the figure are the MMI (Man Machine Interface) for VSA. By the terminal PCs, users can view the result of the on-line analysis, change settings for the calculation, and perform maintenance on equipment data. The terminal PCs are installed in the Central Load Dispatching Office, which is responsible for the generation-demand control, and in two System Load Dispatching Offices, which are responsible for the operation of the EHV network.

4.12.2.2 State Estimation

4-96

State estimation is carried out by the on-line voltage security monitoring EWS in the System Load Dispatching Office. The EWS obtains power flow data from the real-time database of EMS and produces input files for the voltage stability analysis through the state estimation function.

Central Load Dispatching Office

Database Generation Scheduling System Database Server Database Server Database Real-Time Database of EMS

Terminal PC

Firewall Office LAN

Online Voltage Security Monitoring EWS Terminal PC Terminal PC Printer

Generation Scheduling System

Tokyo System Load Dispatching Office

P C 8 P C 3 P C 2 P C 1

System Load Dispatching Office

Figure 4-50 -Architecture of the TEPCO VSA

The TEPCO system operating at 154 kV and above is modeled into the input files, which includes approximately 1,500 nodes, 1,500 branches, and 150 generators. (The system operating at 66kV and below is reduced as loads at the LV side buses in the 275/66 kV and 154/66 kV substations.) Almost all CB status, disconnector status, bus voltages, and power flows in the transmission lines are monitored on-line and transmitted to load dispatching offices, providing an ideal environment for the state estimation.

4.12.2.3 Procedures
In order to realize the functions of the TEPCO VSA, the on-line voltage security monitoring EWS in the System Load Dispatching Office works with other systems and PCs. It repeats the following procedure on a 10-minute interval: Obtains on-line data from real-time database of EMS Obtains the actual generation schedule from the generation scheduling server Carries out state estimation Simulates a set of contingencies to obtain the post-contingency states

4-97

Increases total demand by 10% from post-contingency states, using the actual generation schedule Draws P-V curves from 10% increased demand and present demand

The set of contingencies is selected before the procedure starts, and up to six contingencies can be included in the set. Since the TEPCO VSA assesses the voltage stability under 10% increased demand, it allows enough time for system operators to respond to the voltage stability results and take preventive measures.

4.12.2.4 Results Visualization

Figure 4-51 shows an output example of the TEPCO VSA. The result of the on-line analysis can be viewed at the terminal PCs installed in the three load dispatching offices, and is expressed by the P-V curves. The terminal PCs alert system operators when required margin for demand and voltage cannot be maintained at the nose of the P-V curves.
Present Demand 10% Increased Demand

Voltage [kV] 11

Pre-set Contingencies

VQC

PV Analysis

Demand [10MW]

Figure 4-51 - Output example of the TEPCO VSA

4.12.2.5 VQC Simulation Program

For the TEPCO VSA to simulate the demand increase of 10%, the automatic voltage controllers in the power system need to be modeled into the simulation program. EHV substations in the TEPCO network are equipped with Voltage and Reactive Power (Q) controllers (VQC) in order to regulate HV and LV side bus voltages, by controlling tap positions, shunt capacitors and shunt reactors [20]. In addition, most of generators in the TEPCO EHV system are equipped with Power System Voltage Regulators (PSVR) to regulate HV side voltage of step-up transformers [20]. These automatic voltage controllers, as well as AVR and SVC, are modeled in detail in the VQC Simulation program, developed by TEPCO, and the TEPCO VSA uses this program to simulate the demand increase. Data flow is shown in Figure 4-52

4-98

The on-line voltage security monitoring EWS generates required input files for the VQC Simulation program, and sends these files to the eight PCs (PC1, PC2, , PC8) shown in Figure 4-50 . The VQC Simulation program is executed in these PCs, each of which is responsible for each pre-set contingency. The results of the VQC Simulation program are sent back to the EWS for the assessment.
Online Data System Condition
Active powers Reactive powers Node voltages Tap positions On/Off information of circuit breakers etc

VQC Simulation Data Initial State State Estimation VQC Control Data P-V Data

kV

Data Conversion

Tr Impedance Data

VQC Simulation

MW

Pattern Data
AVR, PSVR VQC, SOAC etc

P-Q Relation Setting for Demand Increase

Generator Constraints Data

Target State

Target State Data

Analysis Results

System Constants Setting Data

Figure 4-52 -Data flow

4.12.2.6 Off-line Function

Last 400 days of captured and simulated data are stored in the TEPCO VSA and can be used for offline studies. Basic functions for off-line studies are same as those for on-line studies.

4.12.3 The TEPCO-BCU: One of the most promising transient stability screening technique for powerful DSA system

4.12.3.1 Introduction
Modern energy management systems periodically perform the tasks of on-line power system static security assessment and control for ensuring the ability of the power system to withstand a set of credible contingencies (disturbances). The assessment involves the selection of the set of credible contingencies and then the evaluation of the systems response to contingencies. Security control and optimization are concerned with the selection of control actions to ensure the system operating in the secure state. Various software packages for security assessment and control have been implemented in modern energy control centers. These packages provide comprehensive on-line security analysis and control based almost exclusively on steady-state analysis, making them applicable only to static security assessment and control [1]. These results currently are not executed in a closed-loop manner; instead they are presented to the operator, who accepts, modifies, or ignores them based on his/her

4-99

engineering judgment. For many utilities around the world, there has been considerable pressure to increase power flows over existing transmission corridors, partly due to economic incentives (a trend towards deregulation and competition) and partly due to practical difficulties of obtaining authorization to build power plants and transmission lines (environmental concerns). This consistent pressure has prompted the requirement for extending EMS to take account of dynamic security assessment (DSA) and control. Such extension, however, is a rather difficult task and requires several breakthroughs in measurement systems, analysis tools, computation methods and control schemes. Indeed, on-line DSA, concerned with power system stability/instability after contingencies, requires the handling of a large set of nonlinear differential equations in addition to the nonlinear algebraic equations involved in the static security assessment. The computational efforts required in on-line DSA is roughly three magnitudes higher than that for the SSA (static security assessment). This explains why dynamic security assessment and control has long remained in off-line activity. Hence, current power system operating environments have prompted the need to significantly enhance time-domain stability analysis programs to meet new requirements. For instance, it is often desirable in practice to perform many power system stability studies to examine the effects of different fault locations and types, various operating conditions, different network topologies, and control device characteristics. In addition, it is becoming advantageous to move transient stability analysis from the off-line planning area into the on-line operating environment. There are significant financial benefits expected from this movement. It appears that there is always significant incentive to find superior approaches for stability analysis and control. After decades of research and development in the direct methods, it has become clear that the timedomain method approach in stability analysis cannot be completely replaced. Instead, the capabilities of the direct methods and the time-domain method should be used to complement each other. The current direction of development is to combine a direct method and a fast time-domain method into an integrated power system stability program to take advantage of the merit of both methods. The TEPCO-BCU is developed under this direction by integrating BCU method, improved BCU classifiers, and BCU-guide time domain method. TEPCO-BCU has been evaluated on several practical power system models. The evaluation results indicate that TEPCO-BCU works well with reliable transient stability assessment results and accurate energy margin calculations on several study power systems including a 12,000-bus test system.

4.12.3.2 Dynamic Contingency Screening

The strategy of using an effective scheme to screen out a large number of stable contingencies and capture critical contingencies and to apply detailed simulation programs only to potentially unstable contingencies is well recognized. This strategy has been successfully implemented in on-line SSA. The ability to screen several hundred contingencies to capture tens of the critical contingencies has made the on-line SSA feasible. This strategy can be applied to on-line DSA. Given a set of credible contingencies, the strategy would break the task of on-line DSA into two stages of assessments [2,3]: Stage 1: perform the task of dynamic contingency screening to fast screen out contingencies which are definitely stable from a set of credible contingencies Stage 2: perform detailed assessment of dynamic performance for each contingency remaining in Stage 1. Dynamic contingency screening is a fundamental function of an on-line DSA system. The overall computational speed of an on-line DSA system depends greatly on the effectiveness of the dynamic contingency screening, the objective of which is to identify contingencies which are definitely stable and thereby avoid further stability analysis for these contingencies. It is due to the definite classification of stable contingencies that considerable speed-up can be achieved for dynamic security

4-100

assessment. Contingencies which are either undecided or identified as critical or unstable are then sent to the time-domain transient stability simulation program for further stability analysis. Several methods developed for on-line dynamic contingency screening have been reported in literature. These methods can be categorized as follows: the energy function approach, the timedomain approach and the artificial intelligence (AI) approach. The time-domain approach involves the step-by-step simulation of each contingency for a few seconds, say 2 or 3 seconds, to filter out the very stable or very unstable contingencies. This approach may suffer from accuracy problem in identifying multi-swing stable or unstable contingencies. The artificial intelligence (AI) approaches, such as the pattern recognition technique, the expert system technique, the decision tree technique and the artificial neural network approach, all first perform extensive off-line numerical simulations aiming to capture the essential stability features of the systems dynamic behavior. They then construct a classifier attempting to correctly classify new, unseen on-line contingencies. As such, the AI approach is likely to become ineffective for on-line application to current or near-future power systems if little correlation exists between on-line operational data and presumed off-line analysis data. The following requirements are essential for any candidate (classifier) intended to perform on-line dynamic contingency screening for current or near future power systems [3]: 1) (Reliability measure) absolute capture of unstable contingencies as fast as possible; i.e. no unstable (single-swing or multi-swing) contingencies are missed. In other words, the ratio of the number of captured unstable contingencies to the number of actual unstable contingencies is 1. 2) (Efficiency measure) high yield of screening out stable contingencies as fast as possible, i.e. the ratio of the number of stable contingencies detected to the number of actual stable contingencies is as close to 1 as possible. 3) (On-line computation) little need of off-line computations and/or adjustments in order to meet with the constantly changing and uncertain operating conditions. 4) (Speed measure) high speed, i.e. fast classification for each contingency case. 5) (Performance measure) robust performance with respect to changes in power system operating conditions. The requirement of absolute capture of unstable contingencies is a reliability measure for dynamic contingency screening. This requirement is extremely important for on-line DSA. However, it is due to the nonlinear nature of the dynamic contingency screening problem that this requirement can best be met by a method with a strong analytical basis. The third requirement asserts that a desired dynamic contingency classifier is one which relies little on off-line information, computations and/or adjustments. This requirement arises because under current and near future power system operating environments, the correlation between on-line operational data and presumed off-line analysis data can be minimal or, in extreme cases, the two can be irrelevant to one another. In other words, in a nottoo-extreme case, off-line presumed analysis data may become unrelated to on-line operational data. This uncorrelated relationship is partly attributed to the imminent bulk power transactions resulting from deregulation. The first four requirements should not be degraded by different operating conditions as dictated by the requirement for robust performance. The current power system operating environments call for a great need to develop a dynamic contingency screening scheme which satisfies the above five essential requirements. The existing AIbased methods for dynamic contingency screening all rely tremendously on extensive off-line simulation results. These methods unfortunately fail to meet the on-line computation requirement and cannot guarantee the reliability requirement. It is also not clear whether the time-domain based approach can meet these requirements. In this regard, the energy function based method can meet the requirements [2,3].

4-101

4.12.3.3 The Architecture of TEPCO-BCU

The TEPCO-BCU is an integrated package developed under joint multi-year efforts between Tokyo Electric Power Company, Tokyo, Japan and Bigwood systems, Inc., Ithaca, NY, USA, for fast and yet exact stability assessment and control (including accurate energy margin calculation and controlling UEP calculations) of large-scale power systems for on-line mode or on-line study mode, or off-line planning mode [4,5,6]. The algorithmic methods behind TEPCO-BCU include BCU method [7,8], BCU classifiers [3,9], improved energy function construction [12], and BCU-guide time domain method [4]. Several advanced numerical implementations for BCU method have been developed in TEPCO-BCU. The improved energy function construction has been developed to overcome the longstanding problem associated with the traditional numerical energy function which have been suffering from severe inaccuracy. The main functions of TEPCO-BCU include the following: Fast screening of highly stable contingencies Fast identification of insecure contingencies Fast identification of critical contingencies Computation of energy margin for transient stability assessment of each contingency BCU-based fast computation of critical clearing time of each contingency Contingency screening and ranking for transient stability in terms of energy margin or critical clearing time. Detailed time-domain simulation of selected contingencies TEPCO-BCU performs dynamic security screening primarily through its (improved) BCU classifiers. The core techniques behind BCU classifiers are the BCU method [7,8]. Descriptions of the BCU method can be found in books such as [14-18]. The theoretical foundation of BCU method has been established in [7,11,13]. Another distinguished feature of TEPCO-BCU is that it provides useful information regarding derivation of preventive control against insecure contingencies and of enhancement control for critical contingencies. TEPCO-BCU is an integration of dynamic contingency screening and a fast time-domain stability program for performing on-line dynamic security assessments and control is shown in Figure 4-53 . There are two major components in this architecture: a dynamic contingency screening program made up of a sequence of BCU dynamic contingency classifiers and a fast and reliable time-domain transient stability simulation program. In this architecture, the function of the state monitor is to determine the need to initiate a new cycle of DSA based on the present state, network topology and the predictive data of the power system,. When a new cycle of DSA is warranted, a list of credible contingencies, along with information from the state estimator and topological analysis, are applied to the dynamic contingency screening program whose basic function is to screen out contingencies which are definitely stable. Contingencies which are classified to be definitely stable are eliminated from further analysis. It is the ability to perform dynamic contingency screening on a large number of contingencies and filter out a much smaller number of contingencies requiring further analysis that would make on-line DSA feasible. Contingencies which are either undecided or identified as unstable are then sent to the time-domain transient stability simulation program for detailed stability analysis. The block function of control actions decisions determines if timely post-fault contingency corrective actions such as automated remedial actions are feasible to steer the system from unacceptable conditions to an acceptable state. If appropriate corrective actions are not available, the block function of preventive actions determines the required pre-contingency preventive controls such as real power re-dispatches or line switching to maintain the system stability should the contingency occur.

4-102

Real - Time Data

Predictive Data

Topological Analysis

A List of Contingency

State Monitor

State Estimation

Dynamic Contingency Screening

Dynamic Contingency Screening

Marginal Stable Cases

Dynamic Contingency Classifiers

Unstable and/or Undecided Cases

Highly Stable Cases

Detailed Time-Domain Stability Analysis

On - Line Time - Domain Stability Analysis Time- Domain Energy Index (optional)
Ranked Stable Contingencies Ranked Unstable Contingencies

Control Actions Decision

Enhancement Actions Preventive Actions

Figure 4-53 An architecture for on-line dynamic security assessment and control

In this architecture, a fast and yet reliable method for performing dynamic contingency screening plays a vital role in the overall process of on-line DSA. It is imperative that a dynamic contingency screening program satisfies the five requirements listed above. A sequence of BCU classifiers for online dynamic contingency screening has been developed in [3]. A sequence of improved BCU classifiers for on-line dynamic contingency screening has been developed in [9]. The main design objective of BCU classifiers is to ensure that the five requirements listed above for on-line contingency screening are met. Contingencies which are classified as definitely stable at each classifier of BCU classifiers are eliminated from further analysis. The conservative nature of the BCU method ensures that the results obtained from BCU classifiers are also conservative (i.e. no unstable

4-103

cases are mis-classified to be stable). Classifying a stable contingency, either first-swing or multiswing, as unstable is the only scenario in which the BCU classifiers give conservative classifications.

4.12.3.4 Evaluation of TEPCO-BCU

To evaluate TEPCO-BCU program, we consider a large-scale power system consisting of more than 12,000 buses and 1,300 generators. In this test data, the system was modeled by a network-preserving network representation. Of the 1,300 generators, 25% are classical modeled generators while 75% are detail-modeled generators with excitation system. A contingency list composed of 200 contingencies are considered Under on-line operating environments, it is generally true that a great majority of contingencies are stable and only a few contingencies are unstable. Indeed, the majority of contingencies in a contingency list associated with a well-planned power system should be highly stable in the sense of large CCTs (critical clear times). For highly stable contingencies, one may not be very interested in the their degree of stability or their accurate energy margins; instead the assurance of the assessment that they are indeed highly stable is the focus. On the other hand, all unstable contingencies and critical contingencies in the sense that its corresponding CCT and fault clearing time are close to each other must be all correctly identified. Of the 200 contingencies, 2 are unstable, about 20 are critically stable while the others are stable. The capture of unstable contingencies by TEPCO-BCU is 100%, i.e. no unstable (single-swing or multiswing) contingencies are missed. In other words, the ratio of the number of captured unstable contingencies to the number of actual unstable contingencies is 1. The ratio of the number of stable contingencies screened out by TEPCO-BCU to the number of actual stable contingencies is about 86%. The average time per contingency by TEPCO-BCU on a single processor is 1.18 second.

4.12.3.5 Development of Parallel TEPCO-BCU

To meet the on-line dynamic contingency screening for large power systems, TEPCO-BCU needs to be implemented on a parallel processing architecture. Parallel processing is the simultaneous execution of the same task (split up and specially adapted) on multiple processors in order to obtain faster speed. The parallel nature can come from a single machine with multiple processors or multiple machines connected together to form a cluster. It is well recognized that every application function benefit from a parallel processing with a wide-range of efficiency. Some application functions are just unsuitable for parallel processing. The test bed system is made up of two IBM 236 IBM eServer xSeries Servers interconnected by a Gigabit Ethernet Switch. The configuration for each of the IBM 236 eServers is a follows: CPU:Xeon 3.6 GHz (Dual processors) with 2 MB L2 cache per Processor, Hyper-Threading Technology and Intel Extended Memory 64 Technology, 1 GB DDR II SDRAM - ECC - 400 MHz - PC2-3200, Storage Control: SCSI (Ultra320 SCSI) - PCI-X / 100 MHz (Adaptec AIC-7902), RAM: 1 GB (installed) / 16 GB (max) - DDR II SDRAM - ECC - 400 MHz - PC2-3200. TEPCO-BCU was run on the test data to determine the average time needed to process a contingency for each configuration tested. Two tests were ran, first using a single compute-node and then using two compute-nodes. Time was marked at the beginning of the test and again when TEPCO-BCU completed the screening to give the duration of the test or the wall clock time. Table 4-9 presents the average time per contingency per node and the average time per contingency per processor. The test shows that the parallel implementation of TEPCO-BCU cut the average processing time per node by 50% when a second compute-node was added. This indicates that the reorganization of the TEPCOBCU computation was partitioned such that a high percentage of it is now solved in parallel.

4-104

Table 4-9 The average time per contingency per processor and the average time per contingency per node calculated from the total CPU time.

# of compute nodes

Clock time duration

# of CPUs Average Average time per time per contingency contingency per processor per node

1 node 2 nodes

118 seconds 0.59 second 61 seconds 0.31 second

2 CPUs 4 CPUs

1.18 second 1.22 second

Table 4-10 presents data that was collected during the tests to record the total CPU time spent during the TEPCO-BCU run on processing of the contingencies. The average time per contingency per processor and the average time per contingency per node calculated from the total CPU time are also presented in the table. The following observations should be noted. The average time per contingency per processor should remain essentially unchanged irrespective of the number of processors given uniform testing conditions. The 2-node and 4-node test comparison is provided to observe the small degree of variation.
Table 4-10 The average time per contingency per processor/per node

# of CPUs

Total processing time

Average time per contingency per processor

# of compute nodes

Average time per contingency per node

2 CPUs 4 CPUs

211.7 seconds 209.3 seconds

1.059 second 1.046 second

1 node 2 nodes

0.529 second 0.523 second

Table 4-11 The wall clock time calculated to process 3,000 contingencies. The timings for the 1-node and the 2-node configurations are calculated for the 3,000 contingencies directly from the test results.

# of Compute Nodes 1 node 2 nodes 10 nodes

Reference Test results Test results Conservative Estimate

Wall Clock Time 29.5 minutes 15.5 minutes 3.1 minutes

The timings for the 1-node and the 2-node configurations are calculated for the 3,000 contingencies directly from the test results. A 5% overhead was used in the estimation of the 10-node timing, despite

4-105

the fact that the testing showed overhead to be in the vicinity of 3%, in order to be on the conservative side (Table 4-11 ). In addition, since the test dataset resulted in a high number of unstable and critical stable cases, it is likely that datasets that produce a more typical percentage of stable cases will result in even faster performance results for the TEPCO-BCU fast screening.

4.12.3.6 Development of Security Constrained OPF Based on TEPCO-BCU

Fast screening out of critical contingencies from a contingency list can be performed TEPCO-BCU system. However, an operator may prefer not only stability assessment but also control solutions to instability problems. In order to provide such solutions, a preliminary dynamic security constrained OPF algorithm, which is realized by applying the TEPCO-BCU engine, was proposed by [6]. In general, conventional economic dispatch problem without dynamic stability is expressed as follows.

min P
G

f ( PG ) = ( i PGi 2 + i PGi + i PGi )

i =1

nG

s.t. g ( x, PG ) = 0 h( x, PG ) 0
where, nG : number of generator PGi : i-th generator output

(1)

x: general parameters To take dynamic stability constraint into account, we define a energy margin sensitivity as a function of energy margin Em .

Em PGi

(2)

Sensitivity of (2) is calculated by TEPCO-BCU. To consider dynamic stability constraint, the following inequality constraint is sufficient because the energy margin Em calculated by TEPCOBCU is conservative.

Et Em 0 where Et : Threshold value for energy margin

(3) can be linearized as follows.
nG E Et Em 0 m PGi 0 i =1 P Gi

(3)

(4)

Em 0 : initial value of energy margin

Applying the Lagrangian relaxation method to the above equations, the objective function with the considerations of transient stability constraints is rewritten as follows:

min
PG

nG E f ( PG ) + Et Em 0 m PGi i =1 P Gi

(5)

4-106

where : weight coefficient

The above optimization problem can be solved if the weight coefficient is determined. To this end, the following problem is introduced.

min
PG

f ( PG 0 + PG )

s.t.

P
i =1

nG

Gi

=0

(6)

nG E Et Em 0 m PGi 0 i =1 P Gi

where, PG 0 : initial generator output PGi : difference from PG 0 for i-th generator
The dual variable vector for constraint can be obtained by solving the above problem. Note that means sensitivity of cost to energy margin; the sensitivity of cost to generator output can be calculated as follows.

Dynamic stability constraint can be considered as long as the cost coefficient of generators as described in equation (1) is modified.

Em PGi

(7)

i ' = i +

Consequently, security constrained OPF can be performed by using ' instead of in (1). The proposed overall solution algorithm (SCOPF) for solving the transient security constrained OPF algorithm is shown as Figure 4-54 . We applied the SCOPF to a sample system shown in Figure 4-55 . (Threshold Energy margin: 0.2, Maximum iteration: 10, initial cost coefficient : (G1,G3)100.0, (G2,G4)110.0). A feasible solution was found in 3rd iteration. Figure 4-56 lists the objective function value (fuel cost) and energy margins at each iteration. The value on 1st iteration means a solution without dynamic security constraint. We can see that an increase of energy margin is accompanied by an increase of fuel cost. The additional cost can be explained as the `price to pay for satisfying the transient security constraint. The proposed technique is very useful because it can consider the dynamic security constraints as well as conventional constraints of OPF. To apply the proposed technique to EMS, there are several issues to be addressed; for example, the improvement of energy margin and its sensitivity calculation is needed.

Em PGi

(8)

4-107

START

OPF

BCU

Stable for all cases NO determin weight coefficient

YES

END

Figure 4-54 Flowchart for solving SCOPF based on TEPCO-BCU

Figure 4-55 Test System

4-108

10 300

1.1

290

0.8

Objective Function Value

280 0.5

Objective Function Value

270 0.2

Energy Margin Energy Margin

260 -0.1

250 1 2 3

-0.4

Iteration
Figure 4-56 Calculation Results

4.12.4 References:
[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] N. Balu, T. Bertram, A. Bose, V. Brandwajn, G Cauley, D. Curtice, A. Fouad, L. Fink, M. G. Lauby, B. Wollenberg and J. N. Wrubel, On-line power system security analysis, (Invited paper) Proceedings of the IEEE, Vol. 80, No. 2, Feb., 1992, pp. 262-280. V.Chadalavada, V.Vittal, G.C.Ejebe, et al., An On-Line Contingency Filtering Scheme for Dynamic Security Assessment, IEEE Trans. On Power Systems, Vol. 12, No. 1, Feb. 1997, pp. 153-161. H.D. Chiang, C.S. Wang and H. Li, Development of BCU Classifiers for On-Line Dynamic Contingency Screening of Electric Power Systems, IEEE Trans. On Power Systems, Vol. 14, No. 2, May 1999. H.D. Chiang, Y. Zheng, Y. Tada, H. Okamoto, K. Koyanagi and Y.C. Zhou, Development of an On-line BCU Dynamic Contingency Classifiers for practical Power Systems, 14-th Power system Computation Conference (PSCC), June 24-28, Spain, 2002. Y. Tada, A. Kurita, Y.C. Zhou, K. Koyanagi, H.D. Chiang and Y. Zheng, BCU-guided TimeDomain method for Energy Margin Calculation to Improve BCU-DSA System, IEEE/PES Transmission and Distribution Conference and Exhibition 2002 Y. Tada, T. Takazawa, H.D. Chiang, Hua Li and J. Tong, Transient stability evaluation of a 12,000-bus power system data using TEPCO-BCU, 15-th Power system Computation Conference (PSCC), August 24-28, Belgium, 2005. Chiang, H.D., The BCU method for direct stability analysis of electric power systems: pp. theory and applications Systems Control Theory for Power Systems, volume 64 of IMA Volumes in Mathematics and Its Applications, pp. 39--94. Springer-Verlag, New York, 1995. Chiang, H. D., F. F. Wu and P. P. Varaiya, A BCU Method for Direct Analysis of Power System Transient Stability, IEEE Transactions on Power Systems, vol. 8, no.3, Aug.1994, pp. 1194--1208. U.S. Patent 5,789,787, 2004. F. A. Rahimi, M. G. Lauby, J. N. Wrubel and K. L. Lee, Evaluation of the transient energy function method for on-line dynamic security assessment, IEEE Transaction on Power Systems, Vol. 8, No. 2, May, pp.497-507, 1993. Chiang, H.D., C.C. Chu and Gerry Cauley, Direct Stability Analysis of Electric Power Systems Using Energy Functions: Theory, Applications and Perspective, (Invited paper) Proceedings of the IEEE, Vol. 83, No. 11, November, 1995, pp. 1497-1529.

4-109

[12] [13] [14] [15] [16] [17] [18] [19] [20]

Chiang, H.D., Study of the existence of energy functions for power systems with losses, IEEE Trans. on Circuits and Systems, CAS-36(11): pp.1423--1429, 1989. Chiang, H.D. and C.C. Chu, Theoretical Foundation of the BCU method for direct stability analysis of network-reduction power system model with small transfer conductances, IEEE Trans. on Circuits and Systems, Part I: CAS-42(5): pp.252--265, 1995. Fouad, A. A. and V. Vittal, Power System Transient Stability Analysis: Using the Transient Energy Function Method. Prentice-Hall, New Jersey, 1991. Pai, M. A. Energy Function Analysis for Power System Stability, Kluwer Academic Publishers, Boston, 1989. Ribbens-Pavella, M.. and P.G. Murthy, Transient Stability of Power Systems: pp. Theory and Practice, Wiley, New York, 1994. Kundur, P., Power System Stability and Control, McGraw Hill, New York, 1994. Sauer, P. W and M.A. Pai, Power System Dynamics and Stability, Prentice-Hall, New Jersey, U.S.A. 1998. Chiang, H.D., F.F. Wu, and P.P. Varaiya, Foundations of direct methods for power system transient stability analysis, IEEE Trans. on Circuits and Systems, CAS-34 (2): pp. 160--173, Feb. 1987. S. Koishikawa, S. Ohsaka, M. Suzuki, T. Michigami, and M. Akimoto, "Advanced Control of Reactive Power Supply Enhancing Voltage Stability of a Bulk Power Transmission System and a New Scheme of Monitor on Voltage Security," Session Paper CIGRE 38/39-1, 1990.

4-110

4.13 State-of-the Art of DSA in Malaysia Tenaga Nasional Berhad

Tenaga Nasional Berhad (TNB) is the national electricity utility company of Malaysia, with installed generation capacity of over 11 GW and a transmission grid operating at 500 kV, 275 kV, and 132 kV. Its power system is interconnected with Thailand (EGAT) through HVDC and interconnected with Singapore through 230 kV submarine cables. Voltage and transient stability has been a security constraint in the TNB transmission system. As a solution to this, TNB is in the process of deploying a real-time Dynamic Security Assessment System (DSAS). It is expected that DSAS will become a necessary and critical dispatch tool to improve TNB system reliability and to make system operations more economical. TNBs DSAS is implemented by Powertech with assistance from TNB. The system is built on TNBs existing EMS data platform with computation engines and user interface from Powertechs DSAToolsTM software package.

4.13.1 Requirements 4.13.1.1 Scope

TNBs DSAS is designed to address the following power system security issues. Static Security TNB has strict static security requirements for the operation of its transmission system with the following criteria: Thermal loading on transmission lines and transformers Pre- and post-contingency voltage limits

These criteria must be met for all system operating conditions. Voltage Security TNB performs voltage security assessment (VSA) based on the concept of the voltage stability margin using the P-V method. Sufficient voltage stability margins must be met at pre and post-contingency for all system operating conditions. Transient Security TNB performs transient security assessment (TSA) using the conventional time-domain based simulation method. System must be transiently stable for criterion contingencies for all system operation conditions.

4-111

4.13.1.2 Performance Requirements

DSAS is installed in a dedicated computer system at the TNB control center and operates in real time to provide TNB system operators and study engineers with critical information regarding the voltage security and transient security of the TNB system, including, (1) Voltage security and transient security status of a given system condition subject to all criterion contingencies. (2) Power transfer limits at key interfaces subject to voltage security and transient security constraints. (3) Effectiveness of corrective actions (i.e., relays and special protection systems) implemented at TNB for certain critical contingencies. The real-time DSAS has the following performance requirements: (1) Assessment cycles. A complete real time dynamic security assessment cycle is completed within 15 minutes for both basecase and stability limit analysis (refer to the descriptions below for these terms). (2) System size. The current TNB real-time network models have about 800 buses and 110 generators. It is however recognized that such models will be expanded, as sub-transmission network will be gradually included in the real-time system models. (3) Models. The stability analysis modules include the following models: Complete reactive capability models for major generators. All dynamic models included in the existing TNB planning studies. The HVDC model interconnecting TNB and EGAT. Relay models and Special Protection Systems (SPS) that are critical for maintaining the system frequency, voltage, and transient security within the study time frame.

(4) Contingencies. Within an assessment cycle, up to 1,000 contingencies are analyzed for the current system condition (this is referred to as the basecase analysis). These include N-1, selected N-2, and some special contingencies. For transient security analysis, each contingency includes a 10-second time-domain simulation. (5) Stability limit analysis. Within an assessment cycle, stability limits at 2 key interfaces are computed with any or all security criteria. Determination of each stability limit may be done with either of the following schemes: If all contingencies are found to be secure for the current system condition, power transfer will be increased, with pre-specified powerflow dispatch methods, to a level beyond which the system will be insecure for at least one contingency. This gives the secure operation boundary for the system condition within which the system may be dispatched to meet the operation requirements. This is referred to as forward stability limit search. If one (or more) contingency is found to be insecure for the current system condition, power transfer will be reduced, with pre-specified powerflow dispatch methods, until the system is secure for all contingencies. The required powerflow dispatches will then be presented to the system operators for immediate actions. This is referred to as backward stability limit search.

For stability limit analysis, a reduced set of contingencies (about 250) is applied.

4-112

(6) Corrective action verification. The applicable under-frequency load shedding (UFLS), undervoltage load shedding (UVLS), and special protection systems (SPS) are included in the security assessment to verify the effectiveness of these schemes for the deign contingencies and system conditions. (7) Software/hardware platform and interface. DSAS software operates on the MS Windows platform. User interface is fully graphical, and compliant to common Windows standards.

4.13.2 DSAS Architecture 4.13.2.1 Hardware View

The DSAS hardware installed at TNB is shown in Figure 4-57.

Users workstations Application Administrator: access DSA Manager through Terminal Service General users: DSA Monitor + Off-line DSATools programs (local)

. . . . . . Ethernet

Data server Data server hosts Computation servers DSA clients DSA servers Off-line study servers

EMS

Figure 4-57: TNB DSAS hardware view

This system consists of several components: Real-time DSA clients (2). These are 3.6 GHz dual CPU Xeon servers. The dual client structure is used to provide redundancy and failover protection, and to allow on-line system maintenance. At any given time, only one client is utilized; the other may be in live backup mode or in off-line maintenance mode. Real-time DSA servers (5). These are 3.6 GHz dual CPU Xeon servers. These servers provide the computation power to perform security assessment. Computational scenarios are prepared and submitted to servers by the client. After the computations are finished, all results from each server are sent back to the client where they are assembled, displayed, and archived.

4-113

Off-line study server (1). This is a 3.6 GHz dual CPU Xeon server. This server is intended for the off-line studies that can be performed by engineers using either the archived real-time data or offline prepared planning cases. Data server. The data server stores three types of data: (1) Real-time input data (such as powerflow and contingencies) sent from EMS. (2) Fixed input data for security assessment (such as generator dynamic data) that does not change for every real-time case. (3) Archived real-time analysis cases including all results. The current data server is set to store about 10 days of full DSA results as well as up to three months of the archived real-time cases.

User workstations. These are users regular desktop or laptop workstations. They can be used to monitor DSAS in real-time mode and also perform off-line studies.

4.13.2.2 Software View

As mentioned earlier, DSAS is driven by DSAToolsTM software package. Specifically, the following programs in DSAToolsTM package are used: PSAT (Powerflow & Short-circuit Analysis Tool): this is used to perform powerflow solution for the incoming EMS SE powerflow data as a sanity checking tool. VSAT (Voltage Security Assessment Tool): this is used to perform voltage security assessment. TSAT (Transient Security Assessment Tool): this is used to perform transient security assessment. DSA Manager: this consists of two applications that work together: DSA Service: this manages all real-time DSA functions such as input data processing, computation task management, case archiving, etc. DSA Manager (or DSA Monitor): this includes display and visualization functions for DSAS results. It can also be used to configure and customize DSAS features and functions. In addition to the above standard DSAToolsTM modules, a custom developed tool, Data Preparation Tool (DPT), was developed to interface with TNB EMS data platform and DSAToolsTM. The DSAS software operation is illustrated in Figure 4-58 As shown in the figure, the DSAS software operates in the following manner: The real-time system condition is captured by SCADA and passed to the Westinghouse EMS. This data is processed by the custom-built state estimator to provide the solved powerflow. This is a standard function in the EMS.

4-114

Users workstation Off-line TSAT/VSAT/PSAT DSA Monitor

EMS DPT
Data Server

DSA Manager DSA Service

DSAS client

TSAT Client

VSAT Client

TSAT Server
DSAS Servers

......

VSAT Server

......

TSAT Server

VSAT Server

Figure 4-58 DSAS Sofwtare View

DPT obtains the solved powerflow and converts it to the format accepted by DSAToolsTM. In addition, DPT creates other real-time data required by DSAS (such as contingencies). Once all realtime data is ready, DPT sends it to the DSAS data server at a pre-set interval (currently at 30 minutes) with a specified data exchange protocol. The core software of DSAS is DSA Service running in the DSA client. Once DSA Service detects a new set of real-time data on the data server and DSAS is available (i.e., not case is being processed), a DSA computation cycle will be started. The operation of DSA Service can be customized by DSA Manager (also running in the DSA client) and can be monitored by DSA Monitor which can run on any authorized workstations in the network. After computational cases for VSA and TSA are prepared by DSA Service, they are passed to VSAT and TSAT Client Services running in the DSA client. These services perform case/data integrity and consistency checks, and if no problems are found, the cases are sent to the DSA servers where they are picked up by VSAT and TSAT Server Services to go through the security assessment. The computation results obtained in the DSA servers are sent by VSAT and TSAT Server Services back to the DSA client where they are assembled by DSA Service in the formats that can be displayed in DSA Monitor and stored in the Data Server.

For the current TNB real-time network model and for the computational tasks described in Section 4.13.1.2, a DSA cycle can be completed in 10 minutes with the hardware described in Section 4.13.2.1. This meets the design performance requirements.

4-115

4.13.3 General Features

In addition to achieving the performance requirements, the DSAS installed at TNB has a number of general application features, as outlines below. Security assessment options A wide range of security criteria is available for security assessment of the power system. These include, Thermal loading Static voltage limits Voltage stability margin Reactive power reserve margin Transient stability margin Damping of low frequency oscillations Transient voltage violations Transient frequency violations Relay margin

Application of these criteria is totally customizable. For example, when assessing voltage stability margin, system can be stressed in many different ways in terms of load variations and generator dispatches. Modeling capabilities In addition to the conventional models necessary for security assessment, advanced modeling is available to ensure the adequacy and accuracy of the on-line DSA results. One of such modeling capabilities is to represent the Special Protection Systems (SPS) employed in the TNB system. A sample SPS model is described in the next section. Data integrity and consistency check DSAS performs many data integrity and consistency checks, and applies appropriate fixes if necessary, to resolve possible problems from the real-time data captured. This is necessary as human intervention is not possible for an on-line system. Result visualization DSAS has comprehensive functionality to present the security assessment results including, Voltage and transient security of the system for the given condition (basecase analysis): Overall status of the system (secure or insecure) Security trend analysis Security history display Potentially insecure contingency list (with contingency details such as fault location and circuits/units lost) Security indices for potentially insecure contingencies Responses (P-V curves, swing curves, etc.) of user-specified quantities for potentially insecure contingencies If stability limit analysis is performed, limits (or security boundary) at key interfaces, the limiting powerflow dispatches, limiting security type, and the limiting contingencies.

4-116

Full results of all archived history cases can be browsed easily.

Some of the key DSAS results are also posted on TNBs Intranet. Figure 4-59 shows a sample overload report. Such reporting capabilities make it convenient for operators, planners, and other personal to access the DSAS results.

Figure 4-59 DSAS overload report on TNBs Intranet

Robustness and reliability The use of the dual client and multiple server structure in DSAS helps provide superior robustness and reliability. This design ensures that failure of any single server would not impact the operation of DSAS. Scalability DSAS uses the distributed computation technique to handle large amount of computations. This allows for the easy customization of the system for different computation performance requirements. For example, fewer servers can be used in a training system, or additional servers can be added to the production system when the power grid expands. Software security DSAS has two levels of security measures for controlling its operation and accessing the computation results: The first level manages the right for on-line system configuration changes with password-protected log-ins. Only authorized personnel (application administrators) can configure on-line system parameters such as security criteria.

4-117

The second level determines who can access the computation results by network broadcasting control. Only the designated users can receive on-line computation results and also gain access to the archived history case data.

Data storage and case archiving Real-time cases analyzed can be archived in the data server using user-defined rules. An archived case contains full input data and computation parameters, as well as computation results. It is therefore possible to retrieve an archived case to View details of the results obtained from real-time analysis Perform additional off-line voltage security (with VSAT) or transient security (with TSAT) analysis using history data to investigate various study scenarios.

Off-line study capabilities DSAS is integrated with Powertechs off-line security assessment tools (programs in the DSAToolsTM package). These tools can be started from DSAS with options to open a selected archived real-time history case, or any off-line cases that the user has prepared.

4.13.4 Special Modeling Features

As mentioned earlier, TNB employs a number of Special Protection Systems (SPS) to protect its power grid following severe events (such as loss of multiple circuits). An SPS usually uses a look-up table to determine the necessary actions (generator, load, and/or circuit tripping) when the designed events occur. The look-up tables are obtained using off-line studies and updated periodically. It is therefore possible that the system conditions used in the look-up table computations are very different from a real-time system condition for which the SPS is armed. This calls for an important function for an on-line DSA system to validate (or even update) the SPS look-up tables for the real-time system conditions. Real-time SPS validation was one of the requirements for the on-line DSA system at TNB. Real-time updating of the look-up tables is currently considered as a future option for DSAS. The major issue in considering SPS in an on-line DSA system is its modeling, particularly the inclusion of look-up tables. Since such tables may be updated from time to time, it is not desirable to have a hard-coded model that is mostly machine readable. Rather, some degree of flexibility is required to allow data examination and change. In DSAS, this is handled by using the user-defined modeling approach. This is illustrated here with the FGTS scheme. The FGTS scheme is concerned with the PAKA power plant in the eastern TNB system. This power plant (with 12 units) is located in a region that is connected to the rest of the system through two transmission paths (Figure 4-60): East corridor: this consists of six 275 kV circuits PGAUTMGR: this consists of two 275 kV circuits

Under a rare common-mode failure scenario, the six circuits on the East Corridor may all be lost. If PAKA is in the high export mode, only the PGAUTMGR path is available to take the power export to the rest of the system. This could cause system instability. The FGTS scheme is implemented to prevent such instability by tripping selected PAKA units determined from Table 4-12 (FGTS look-up table).

4-118

To rest of the system

75208 63206 TMGR275 275.

TMRH275 75201

275.

PGAU275

275.

PGAU_U1 75931

16.0

TMGR_U1 63904

13.8

KDIS275

275.

4 units total (3 O/S)

75205 75920 75921 75922 75923

PGAU TMGR
4 units total (3 O/S)
KNYR275 275. 75202

9 units total

PAKA plant

75949

75948

75947 75944

75941 PAKAGT1A 11.5 PAKA132 132. 75104 75911 75209

75942

75943

YPKA275

275.

PAKA275 75203

275.

East Corridor
TKLG275 275. 75204

PWSM275 75210

275.

75945

75946

74210

GBID275

275.

74209

KTNN275

275.

KAWA275C 275. 74206

To rest of the system

Figure 4-60: PAKA power plant and the neighboring region

Table 4-12: FGTS look-up table

Sum of interface flow on PGAU TMGR and East Corridor 0 P < 800 800 P < 900 900 P < 1000 1000 P < 1100 1100 P < 1200 1200 P < 1300 1300 P

No. of PAKA units armed for tripping 0 3 4 5 6 7 9

From Table 4-12, the number of units at PAKA armed for tripping by the FGTS scheme depends on the total MW flow on the two transmission paths (PGAUTMGR and East Corridor). For example, when the total flow is between 900 and 1000 MW, 4 PAKA units are armed. If all six East Corridor circuits do get lost in a contingency, these armed units will be tripped. This look-up table is subject to update as the loads, generators, and transmission system in the region changes. This scheme is incorporated in DSAS with a user-defined model which has three components: 1. Determination of the number (N) of units armed for tripping (Figure 4-61).

4-119

This component takes the initial MW flow on the two transmission paths and goes through some logic operation to determine the number of armed units according to the look-up table. For example, if the initial MW flow sum is 950 MW, it is clear that this logic will result in an output of 4 (thats, 4 units are armed).

P on East Corridor P on PGAU TMGR Initial value

Sum of interface flow (MW) 800 3

No. of units armed for tripping (0, 3, 4, 5, 6, 7, 9) N

900

1000

1100

1200

1300

Figure 4-61: Determination of the number of armed units

2. Detection of the tripping condition (C) (Figure 4-62). This component detects the status of all six circuits on the East Corridor. If they are all lost, the tripping condition (C) is met and the armed PAKA units should be tripped by the tripping logic described below.

0 to 6 No. of in-service circuits on East Corridor 0.5

C=

True (1): tripping condition met False (0): tripping condition not met

Figure 4-62: Detection of SPS tripping condition

3. Tripping logic (Figure 4-63). This component does two things: Rank the outputs of all 9 PAKA units that may be tripped so that units with higher outputs are tripped first if required. Once the tripping condition is met (C is true), all armed units (those with ranking number smaller than or equal to N) are tripped.

4-120

PAKA#1: P

Initial value

1 N C AND Trip Unit 1

PAKA#2: P

Initial value

Rank Function Rank on descending order

AND

Trip Unit 2

......

...... 9

......

...... Trip Unit 9

PAKA#9: P

Initial value

AND

Figure 4-63: SPS tripping logic

The SPS model created using the above method has the following advantages: The entire model is in the format of TSAT user-defined model. It can be maintained easily with the graphical UDM Editor as shown in Figure 4-64. To use this model in TSAT simulations, simply specify it as one of the data files. The model can be used for any system conditions and any contingencies. No tripping action is issued if the arming and/or tripping conditions are not met. There is no need for any programming. If the look-up table is changed, it is very easy to update the model.

Generator Active Power (PU) Bus ID 9090 1

IVPG1 Initial Value

Trip Generator

AND

Bus ID

9090 1

Generator Active Power (PU) Bus ID 9091 1

IVPG2 Initial Value

I1 I2

Trip Generator

AND

Bus ID

9091 1

Generator Active Power (PU) Bus ID 9092 1

IVPG3 Initial Value

Trip Generator
I1 I2

AND

Bus ID

9092 1

Generator Active Power (PU) Bus ID 9093 1

I1

IVPG4 Initial Value

I2

Trip Generator

AND

Bus ID

9093 1

Generator Active Power (PU) Bus ID 9094 1

I1

I2

IVPG5 Initial Value GN

I1 I1 I2 I3 I4 I5 I2 O1 O2 I2 O3 O4 O5 I1

Trip Generator

AND GN800 3.0

I2 I1

Bus ID

9094 1

GN

FLOW800 1.0

800.0
Interface Active Power (MW)

GN

FLOW900 1.0

900.0

Block PGTMMW GN CKTHRSH 1.0 0.5

GN FLOW1000
I2

1.0

1000.0
TOTMW Initial Value
I2

RNK

PGRNK

GN

TRIPNUM 1.0

Descending
O6 I6 I7 I8 I9 O8 O7

I1 I1

GN FLOW1100
I2

I1

1100.0

1.0

Number Of In-Service Branches Block ECORRNUM

I1

GN FLOW1200
I2

1200.0
Interface Active Power (MW) Block ECORRMW

O9 I1

1.0

Generator Active Power (PU) Bus ID 9095 1

I1

I2

GN

GN1300 2.0
I2

GN FLOW1300 1.0

1300.0
Trip Generator

IVPG6 Initial Value

I1 I2

AND

Bus ID

9095 1

Generator Active Power (PU) Bus ID 9096 1

IVPG7 Initial Value

I1 I2

Trip Generator

AND

Bus ID

9096 1

Generator Active Power (PU) Bus ID 9097 1

IVPG8 Initial Value

I1

I2

Trip Generator

AND

Bus ID

9097 1

Generator Active Power (PU) Bus ID 9098 1

IVPG9 Initial Value

Trip Generator

AND

Bus ID

9098 1

Figure 4-64: FGTS scheme viewed from TSAT UDM Editor

4-121

4.13.5 Operation Experience and Application Plan

TNBs DSAS is currently going through the full evaluation and trial operation stage. The VSA function is already being used for the day-ahead operational planning and also as the backup tool for system operators. The following are among the expected applications once DSAS is in full operation: Remedial measure arming Load forecasting Outage management

4.13.6 Conclusions
TNBs DSAS was designed and implemented in response to TNBs requirements for the improved power system security and reliability. This system takes full advantages of the comprehensive off-line security assessment package DSAToolsTM and is completed with necessary features for on-line real-time operation. It is anticipated that this system will become a necessary and critical dispatch tool for TNB system operation once it is in full operation.

4-122

4.14 State-of-the-Art of DSA in New Zealand Transpower

Transpower (TP) is the transmission Asset Owner and the System Operator in the New Zealand electricity supply industry. The System Operator group (SO) within Transpower provides the services of an Independent System Operator under contract to the Electricity Commission which oversees and controls the operation of the New Zealand Wholesale Electricity Market. The national grid owned and operated by Transpower includes voltage levels ranging from 220 kV down to 33 kV AC and a 1040MW HVDC link operating at 257 and 342 kV DC between North Island and South Island of new Zealand. The New Zealand Wholesale Electricity Market is a gross pool design market with a peak demand of approximately 6500 MW. The SO provides a security constrained economic dispatch of the pool at five minute intervals using an n-1 security constrained DC OPF based dispatch engine (SPD).

4.14.1 General Description

Static Security The SO is responsible for operating the offered power system assets (transmission and generation) in a secure manner. In terms of the static security of the system, this requires that no item of plant should be operated beyond the rated capability determined by the asset owner. The SO uses industry standard EMS Contingency Analysis programs to analyze static security. In this analysis every credible contingency is analyzed for the components within SOs oversight. Overloads on lines and transformers, over-voltage and under-voltage conditions, as well as maximum angle difference are all monitored during the contingency analysis. Some critical n-2 contingencies are also examined where these are considered credible contingencies. The monitored limits can be categorized as: Thermal ratings of lines and transformers and terminal equipment Over-voltage ratings Under-voltage limits Node pair angle difference limits Interface flow limits (these limits tend to represent other dynamic forms of stability limits) The thermal constraints used for transmission circuits in SPD are designed to allow a 15 minutes off-load time for contingency loaded circuits.. Voltage Security There are a number of voltage instability issues in both islands in the New Zealand power system. The SO started using the voltage security assessment tool (VSAT) developed by Powertech from 2005 to address these voltage stability problems. The tool is used both on-line (realtime) and off-line (planning and investigation) applications for assessing voltage stability limits. VSAT has been integrated with the SOs EMS systems from AREVA for real-time use. VSAT uses user Specified Scenario Definition, and performs Contingency Screening, Security Assessment, Transfer limit, and Modal analysis (optional). For on-line application, Areva has provided DCP (Dynamic case Preparation) and the data transfer takes place through the DCP. The input files it uses are:

4-123

Source (dispatch group) and Sink (load area at risk) Transaction - transfer from source to sink to find limit Interface (Inflow) Monitoring group Contingency group Calculation Parameters Case Definition Files can be common to more than one scenario

The output files it uses are VSA Power Transfer Limit Search VSAT Limit Margin Summary VSAT Scenario Overview

The voltage stability constraints are then built in terms of interface flows and the transfer limits and applied in the SPD.

Transient and Small signal Security In the New Zealand power system there are a number of transient and dynamic instability issues. At present a large number of off-line studies are performed to determine the post-contingent stability response and damping response of the power system. These studies are used to derive constraints which define the stable operating limits. The constraints are then applied in the dispatch process (SPD).

Frequency Security The SO needs to maintain frequency to satisfy required frequency operating standards within each island in NZ Electricity Market. The SO calculates the instantaneous reserve required for N-1 generator , N-2 generator and HVDC pole outage contingencies using the reserve management tool (RMT), close to real time. The RMT interacts in real-time with the SPD, and uses the cleared generations from the SPD to determine the net free reserves (NFRs) for different kinds of contingencies. The results of these studies (NFRs) are embedded into the riskreserve constraints in SPD. SPD co-optimises the dispatch of energy and instantaneous reserve. The instantaneous reserve cleared through the co-optimisation will satisfy each of the constraints so that the cleared reserve will cover any of these contingencies.

4-124

4.15 State-of-the-Art of DSA in Panama - ETESA

4.15.2 General Description
Panamas bulk transmission network is longitudinal and encompasses several substations on the high voltage side of the grid (230 KV). In 2005, the maximum demand was approximately 957 MW. The load is concentrated mostly in Panama City, approximately 50% of it being supplied by generators situated in the west side of the country at about 250 miles away from the city. Reactive compensation is provided by three reactor banks and four capacitor banks. The reactors are strategically located in the central and western regions in order to prevent over voltages during low demand periods. The capacitors are used to raise the voltage during the maximum demand period and are located in the substation Panama near the load center. Although the real-time and study-mode network analysis and stability assessment tools used at the National Dispatch Center (CND) of Empresa Electrica de Transmision (ETESA) since May 2002 have prevented major disturbances so far, nearly critical situations did occur, e.g. on August 22, 2002 when the system experienced low voltage conditions [2] that could have deteriorated into a blackout. The situation was quickly identified and successfully acted upon by the system operator and security engineers. The real-time stability analysis tool was successfully used in study-mode with historical data that reconstructed the system states during the event to assess the incident. The simulation results correctly indicated that the system was indeed approaching conditions that could have caused a blackout and were subsequently used in a report presented to the agents of the Panamanian Electricity Market. With the advent of the coordinated operation in Central America, it was further felt that the impact of the MW transfers in the region will have to be continuously monitored in order to detect and prevent the risk of blackouts. Since operators and security engineers must rely on the predicted distance to instability, CND considered important to validate the accuracy of the results computed by the voltage and steady-state stability application by comparing them with results from simulations conducted with the PSS/E load-flow and transient stability programs. The computations were performed at CND [5], [6]. The load-flow model covered the entire interconnected system in Central America, but the stability calculations focused only on the actual transmission network of ETESA. The study assumptions were based on the actual operating guidelines adopted at CND. The load modeling options of the stability tool were set to replicate the way PSS/E represents the load in load-flow calculations. Although the main benefit derived from the fast stability application is the ability to detect operating conditions that may lead to voltage collapse, it is felt that both the insight gained from the post-facto analysis of the August 22, 2002 near-blackout event, and the methodology deployed to validate the accuracy of the real-time voltage and steady-state stability assessment tool, are worth being presented to the community of experts interested in detecting and preventing the risk of blackout. The Panamanian experience in this area is briefly summarized in the following.

4.15.1 Architecture 4.15.1.1 Operational Environment and Integration with the Real-Time System
CND is responsible for both the dispatching of the electric power system and the operation of the electricity market. The system dispatching tool consists of a SCADA/EMS Ranger implemented by ABBNM in

4-125

2001. The system encompasses a collection of Compaq (now HP) Alpha processors in dual redundant configuration running under Compaq Unix. Supported applications include conventional SCADA functions, load shedding, generation control, such as AGC and reserve monitoring, and real-time and study-mode network analysis, such as state estimation and dispatchers power flow. The SCADA/EMS also includes a Historical Information System (HIS) which stores the complete SCADA snapshot at every scan cycle and provides the ability to subsequently reconstruct past cases by using the state estimator in study mode. Seamless integrated with the Ranger SCADA/EMS Real-Time Network Analysis Sequence is a fast voltage and steady-state stability assessment tool (QuickStab [7]). This capability become fully operational in 2002 and has been used on a daily basis to monitor the risk of voltage collapse. In addition, ETESA is also using the off-line PSS/E software provided by Siemens PTI to perform load-flow and transient stability analysis. The fast voltage and steady-state stability application was recompiled under Compaq Unix by ABBNM and runs on the Compaq Alpha server. It is not triggered automatically after each state estimation cycle, but it can be invoked manually at any time to evaluate the most recent state estimate. In addition, it can be executed in conjunction with the Dispatchers Power Flow, is available on the Dispatcher Training Simulator (DTS) and can be triggered in conjunction with cases reconstructed in study-mode from the HIS.

4.15.1.2 Functional Description

The real-time stability application is predicated on steady-state stability analysis and uses the method pioneered by Paul Dimo [1] and extensively described in the technical literature, e.g., [4] and related references. In a nutshell, the program starts from a load-flow solution or state estimate of the Central American interconnected network modeled in the SCADA/EMS and: Computes the system-wide maximum loadability and safe system loading of the Panamanian transmission network for a user-defined security margin Identifies the generators that may cause instability and ranks them, along with the tie-line injections, in the order of their impact on systems stability Computes the MW generation schedules for the system-wide critical and security margin states, as well as for an ideal, or hypothetical, state where the maximum loadability would be maximum. These calculations are performed on a system-wide basis. A more recent off-line version of the stability application is also used at CND and provides additional capabilities, e.g., voltage and steady-state stability analysis on a bus level, i.e., for any load-bus specified by the user.

4.15.2 Distinguishing Features

In addition to its computational speed, an important feature of the real-time stability analysis capability implemented by ABBNM in Panama is its seamless integration with the real-time system. On one hand, this provides the benefit of a single, consistent and uniform user interface. On the other hand, the user can run this application: with the most recent state estimate; with a load-flow case solved by the Dispatchers Power Flow; from the DTS; or with data retrieved from HIS. The later capability is best illustrated in the following.

4.15.2.1 Post-Facto Analysis of August 22, 2002 Near-Blackout Event

On August 22, 2002, Panamas electrical grid experienced a major disturbance that started with a phase-toground short-circuit and brought the system near voltage collapse. Neither significant frequency excursions nor transient phenomena took place, but the bus voltages throughout the system fell to critical levels.

4-126

The blackout was eventually averted, but the event had to be reported and explained to the Market Agents. The systems behavior during the disturbance was reconstructed and analyzed, and a stability evaluation of the system conditions prior and during the event was performed. The data used for reconstructing the events were retrieved from HIS and the stability analysis was conducted with the real-time version of the voltage and steady-state stability application running on Ranger. Sequence of Events 15:14:37.560 hours After a lightning strike on the PANAMA II - Bayano transmission line (Figure 4-66 - left), the phase C conductor remains hanged on the metallic pole and turns the fault into a permanent short-circuit. Line protections work correctly and open the line at both ends. Due to the rapidly changing real-time status indications and analog value readings, the state estimators execution is suspended and the real-time stability application is left without real-time input. 15:15:00 hours Twenty-three seconds later, the COPESA generators trip also (Figure 4-66 - right). The frequency drops to 59.79 Hz and the voltage reaches 211 KV. The primary regulation responds immediately and the systems

Figure 4-66 Line affected by lightning (left) -- COPESA generator trips (right)

Figure 4-65 - Frequency and voltage excursions during the event

frequency goes back to normal (Figure 4-65 ). 15:18:43 hours Approximately three minutes later the three PANAM power plant generators trip and the frequency and voltage drop to 59.71 Hz and 216 kV, respectively. The reduction of reactive supply is severe. Prior to tripping, each unit was generating approximately 6.36 MVArs for a total of 19.09 MVArs. Considering the 8.43 MVArs lost from COPESA, the reactive power deficit now amounts to 27.52 MVArs. As a result, the system cant meet the reactive demand from the distribution network and the voltage profile remains low. 15:21 to 15:25 hours Since no generators are available to supply reactive power to the load center, the distribution companies are alerted of the situation and the system operator asks them to shed approximately 20 MW each. As shown in Figure 4-65 , the load reduction helped the frequency but didnt solve the voltage problem. Therefore, the system operator asked for additional load shedding but the distribution companies did not honor the request.

4-127

15:26 15:27 hours The three PANAM generating units that had tripped at 15:18:43 hours come back on line and are used to produce MVArs. 15:30 hours The voltage profile begins to improve due to the reactive power supplied by the PANAM generators. Analysis The CND engineering group in charge of system security analyzed this event by using historical data from HIS. Since the state-estimator had been suspended during the event and couldnt converge in study mode with snapshot data either, the last successful run before the event was taken as reference (Case 1). Then, two additional load-flows (Cases 2 and 3) were calculated with data taken from the real-time snapshots stored in HIS. These cases were subsequently analyzed with the real-time voltage and steady-state stability tool running in study-mode. The Case 1 indicated that the Panamanian grid was operating within acceptable security margins (Figure 4-69). The generating units were up and running as scheduled. The total reactive demand was 229.49 MVArs and the voltage levels were acceptable. The Case 2 was built from data retrieved immediately after the tripping of the line 230-2A and the loss of COPESA generation. The distance to steady-state instability is depicted in Figure 4-68. At that time, the network was relatively close to the security margin but the disturbance was in progress and the transmission grid was entering the alert zone (shown on the speedometer chart with yellow color). Its important to note, however, that although the stability reserve (distance to instability) was acceptable, the operating point was slowly moving towards instability, i.e., the systems critical state (shown in red). Note, also, that the total reactive demand had increased to 237.5 MVArs. In the third and last case of our analysis, the two PANAM units that had actually tripped during the event were outraged from the base case. As clearly shown in Figure 4-67, this caused the system to quickly approach the steady-state stability limit. The total reactive demand increased to 250.65 MVArs. These results are fully consistent with the real-time readings shown in the events chronology, where the loss of the third PANAM unit caused the voltage profile to reach near-critical values.

Figure 4-69 Steady-state stability conditions before event

Figure 4-68 Conditions after tripping of COPESA generation

Figure 4-67 Getting closer to instability

The 22 August 2002 event brought the Panamanian high voltage transmission grid to near-blackout conditions due to a significant loss of reactive power supply near the load center. The post-facto steady-state stability analysis was performed with the real-time version of the stability tool by using historical data. The assessment indicated that after the COPESA and, subsequently, PANAM generators tripped, the system was operating in an unsafe region and was getting dangerously close to voltage collapse. The analysis also revealed that the systems behavior, documented by the real-time measurements stored in HIS, was reliably predicted by the stability tool.

4-128

4.15.3 Performance and Accuracy Testing of the Real-Time Voltage and SteadyState Stability Tool 4.15.3.1 Methodology
The real-time stability tool used at the CND performs fast voltage and steady-state stability calculations that are predicated on the algorithm described in [4]. Given a state estimate or a solved load-flow, the program computes, in addition to several other indicators, the total system loading and the MW generation schedules for the: Critical state where voltages collapse and units may get out of synchronism Security Margin state that corresponds to a user-defined security margin, typically 15% below the critical state. Accuracy Testing of the Critical State Predictions If a load-flow calculation were executed with the MW generation schedules computed for the critical state, one of the following mutually exclusive outcomes would be expected:
a.

The load-flow solution was found critically stable, i.e., by further increasing the load, the system would become unstable

b. The load-flow solution was found unstable by the stability tool c. The load-flow diverged and the generated MW would be reduced until a solution is obtained. The critical MW loading is not a fixed constant. It changes depending upon the topology, reactive compensation and voltage schedules in the base case. The critical MW is higher if the base case entails large amounts of reactive sources, and is lower when voltages are lower and reactive sources are fewer in the base case. Therefore, the idea was to compare the stability limits predicted from the base case with those computed for a load-flow solution near instability -- and to repeat the procedure for different system MW and voltage levels. The first step of the procedure entailed solving a base case load-flow, called Case 1, for peak-load level conditions. The second step entailed running the stability tool to compute the: MW output of the generators for the critical state MW output of the generators for the security margin state corresponding to a steady-state stability reserve of 15%. The third step consisted of executing a load-flow calculation with the generators MW computed by the stability tool for the critical state in Case 1. If the load-flow would converge, then: Run the stability tool with the results of this critical state load-flow -- it was expected that the stability tool would find this new case either unstable or critically stable Calculate new load-flows by maintaining the critical state MW schedules and increasing the slack-bus generation in small steps until the load-flow program diverges Run again the stability tool for the last load-flow that converged -- this case should be found unstable by the stability assessment tool. If the critical state load-flow would diverge, reduce the slack-bus generation in small increments until convergence has been reached, then: Run the stability tool again -- this case should be found either unstable or critically-stable

4-129

Reduce by 1% the total generation and run a new load-flow, then execute the stability tool -- this case should be found either critically stable or stable but close to the stability limit. Repeat Steps 1 through 3 for scenarios with lower MW load and different levels of reactive compensation, e.g., medium-high and, respectively, medium-low load levels, then: Calculate security margin load-flows by using the generators MW schedules determined by the stability tool for the security margin state in the peak, medium-high and medium-low load cases Run the stability tool for the security margin load-flows and compare the results. Testing the Security Margin Predictions The security margin state corresponds to a safe MW system loading, referred to as security margin, such that, for any system state with a stability reserve smaller than this value, no contingency would cause transient instability [1], [3]. Just like the critical MW loading, the security margin, which is expressed as a percentage below the critical MW loading, is not a universal constant. It depends upon the specific combination of topology, loads, generators and reactive compensation, and must be determined and periodically reassessed for each particular transmission system through extensive transient stability simulations. The expected outcomes of such transient stability calculations are as follows: d. For load-flow cases with MW loadings higher than the security margin, at least one fault or contingency should result in transient instability e. For load-flow cases at the critical MW level, all the faults and contingencies cases should be unstable f. For load-flow cases where the system MW load is equal to, or below the security margin, all the fault and contingency cases should be stable.

Since transient stability calculations are time consuming and require significant person power to prepare the data and set-up the study cases, and, also, in order to keep the stability tool accuracy testing effort to a reasonable level, the following procedure was followed: Identify a small number of faults and contingencies known a prior to correspond to the worst case scenarios Perform transient stability calculations for the base case and security margin state load-flow solutions for peak-load level conditions -- skip the critical state because, most probably, all the faults and contingencies would result in transient instability Repeat the procedure for the medium-high and medium-low load level scenarios and, for these cases, run transient stability simulations also for the critical state. Accuracy Testing for Line Contingency Cases The theory predicts that during line contingencies the system gets closer to its stability limit -- when lines trip, the overall system reactance increases and, accordingly, the steady-state stability reserve decreases. If the procedure for testing the accuracy of the critical state predictions were repeated for a contingency case, one should except that the critical MW in the contingency case would be lower than the critical MW in the base case, i.e., the contingency case would have a smaller steady-state stability reserve -- and the same is true for the security margin, too. In order to verify the accuracy of the stability tool predictions for a contingency case, the complete validation suite was executed by starting from a load-flow base case that simulated a major line contingency at the medium-high load level scenario.

4-130

4.15.3.2 Load Level Scenarios

The validation suite that was used to compare the stability tool calculation results with PSS/E load-flow computations included the following load-level scenarios: Maximum Expected Demand in this scenario, all the shunt capacitors are on-line, the shunt reactors are disconnected, and a small unit that normally is not needed to generate MW is brought on-line to generate MVArs. These reactive compensation sources ensure that the highest possible MW load can be met without risk of voltage collapse Medium-High Demand in this scenario, several steps are taken to reduce the reactive compensation: 15 MVArs in capacitor banks are taken off-line; 40 MVArs in shunt reactors are reconnected; and the machine used to generate MVArs is not activated. These provisions in the load-flow set-up emulate the operating procedures at lower MW levels where the amount of reactive compensation is reduced to ensure that the system voltages would not violate the higher limits Medium-Low Demand this scenario is similar to the Medium-High scenario, but at a further reduced MW load level and 15 MVArs less in capacitor banks.

4.15.3.3 Results
The outcome of the voltage and steady-state stability assessment tool accuracy testing performed at CND has been extensively documented [5] and will not be repeated herein. In order to provide a feeling of the experiment, however, we reproduce in the following the series of bar charts that illustrate the results (Figure 4-70).

Figure 4-70 Accuracy testing results

4-131

Two important conclusions become instantly apparent: The stability margins predicted by the stability tool are verified with great accuracy The stability limit where voltages may collapse and units may get out of synchronism seams to shift upwards when the system MW loading increases. This conclusion is 100% consistent with the: Study assumptions -- when the system moves from the medium-low demand towards the expected maximum demand, more and more reactive compensation is added the fore increasing the networks maximum transfer capability Computational algorithm used by the stability tool -- as shown in [4], during the case worsening step of the solution technique, the topology is assumed to be fixed, which, obviously, cannot reflect structural network modifications such as transformer tap changes, adding capacitors, and removing shunt reactors. But the maximum demand case also shows that when all the system reactive resources are used, i.e., when the network is in a state that cannot be improved any longer, the prediction of the distance to instability is very accurate -- in other words, the fast voltage and steady-state stability assessment tool performs better when it really counts.

4.15.3.4 Performance
For practical purposes, all the simulations performed with the stability tool converged instantly, which was expected both because the program is intrinsically fast and because the network area evaluated for stability encompassed only about 200 buses, out of approximately 1000 buses in the load-flow model of the Central American interconnected power system. In order to evaluate the performance of both system-wide and bus-level voltage and steady-state stability calculations for a large network, a 3289 bus power transmission system was modeled and analyzed. The system-wide calculations completed in 1 second, and the bus-level calculations converged at the rate of approximately 1 second per bus, on a PC equipped with Intel Pentium 4 running at 2.8 GHz.

4.15.4 References
[1] Dimo, Paul, "Nodal Analysis of Power Systems", Abacus Press, Kent, England, 1975 [2] Gonzalez, L.A., Post-Facto Analysis of a Near-Blackout Event, 7th International Workshop on Power Control Centers, May 26 28, 2003, Orisei, Italy [3] Magnien, M., Rapport spcial du Groupe 32 Conception et Fonctionnement des Rseaux, Confrence Internationale des Grands Rseaux Electriques Haute Tension, CIGRE Session 1964 [4] Savulescu, S.C., "Fast Assessment of the Distance to Instability. Theory and Implementation", in Real Time Stability in Power Systems, Edited by S. C. Savulescu, Springer, Norwell, MA, 2005 [5] Vergara, J. S., Resultados de las Pruebas de Validacin de QuickStab, Congreso ALTAE 2005, IEEE Seccin Panam, July 28, 2005 [6] Vergara, J. S., Thai, T.A., Cuong, N. D., Nam, N.T., Campeanu, H.S., Savulescu, S.C., Accuracy Testing and Real-Time Implementation of Dimos Stability Analysis Technique, in Real Time Stability in Power Systems, pp. 65-92, Springer Verlag, Norwell, MA [7] http://www.eciqs.com home page and related links

4-132

4.16 State-of-the-Art of DSA in Romania - Transelectrica

4.16.1 General Description 4.16.1.1 Background
The Romanian power system engineers have been aware of the need to evaluate the stability conditions of the electric power system, and to do it as often as possible, for a very long time. As early as the late 1950s, Paul Dimo and other Romanian experts had developed techniques for fast steady-state stability assessment by quantifying the distance to instability via the steady-state stability reserve indicator, and by identifying a security margin, i.e., a safe distance to the state where voltages may collapse and generating units may get out of synchronism. Starting with the early 1960s, this solution technique has been extensively documented in the European literature and used, on a daily basis, in operations and planning [6], [7], [8], [9]. In fact, the Special Report of CIGRE Group 32 prepared by M. Magnien in 1964 stated explicitly that any network that meets the steady-state stability conditions can withstand dynamic perturbations and end in a stable operating state -- where meets steady-state stability conditions was meant to imply that the steady-state stability reserve of the operating point would be big enough for the network to remain stable for any credible contingency [14]. Of course, at that time there was no question of doing this kind of computations in real-time, but the technique pioneered by Paul Dimo was introduced in the United States in the early 1990s [23], [29] as a strong candidate for real-time implementation and, just a few years down the road, it started to gain acceptance -- initially off-line [10], and then, after 2002, in real-time SCADA/EMS installations[20], [21], [22], [30]. Then theres another venue where the Romanian experts have pioneered the development of fast technologies aimed at assessing the risk of blackout -- the detection, evaluation and ranking of transmission paths, or links, between source and sink areas that have stability limitations and, if the MW transfer between the two areas at each side of the link exceeds a certain value, may cause instability [17], [18], [24]. These techniques form the background for the real-time and off-line stability assessment tools used by Transelectrica S.A. (Transelectrica). An enhanced version of Paul Dimos fast stability assessment method [20] has been seamlessly integrated by AREVA T&D on the SCADA/EMS solution delivered to Transelectrica. The voltage and steady-state stability application, known as QuickStab [30], is executed automatically after each successful state estimate. The real-time monitoring of the distance to instability, both on a system level and across critical area interfaces, represents a first, and very efficient, line of defense against blackouts. The next step consists of periodically performing detailed off-line simulations predicated on what-if scenarios. This functionality is supported by two off-line stability assessment applications -- Eurostag, developed by Tractebel, and SAMI, which is a stability analysis application developed by Romanian engineers based on the technique published in [4].

4.16.1.2 Computational Methods and Features

In the context of electricity market operations, a primary concern is the ability to transfer power across large interconnected networks while meeting a broad range of operating reliability constraints. A common scenario consists of compensating load increases and/or generation outages in a system area by raising the generation elsewhere. These energy transactions typically encompass vast multi-area systems and may cause parallel flows, excessive network loadings and low bus voltages. Under certain conditions, such degraded states may lead to blackouts. The analysis of recent blackouts due to instability revealed that most of them follow a similar pattern:

4-133

Large MW blocks get transferred from areas with inexpensively priced energy toward areas where the load demand has increased due to an actual increase in load, or perhaps because one or several local generating units are scheduled for maintenance, or simply because the local generation is too expensive As a result, certain transmission paths get loaded closer and closer to their stability limits and their stability reserves get smaller and smaller At this moment, a generation or transmission outage takes place. Typically, such incidents evolve into cascading outages Since the link was already operating with a small stability reserve, the physical phenomena leading to blackout are triggered and the wide-spread disturbance becomes unavoidable. In order to ensure that the grid does not get too close to its stability limits, one should evaluate both the risk of steady-state instability and voltage collapse and the maximum transfer capability across the transmission paths that interconnect the areas involved in such transactions. In order to provide for an effective defense against blackouts, this assessment should be performed continuously, which obviously leads to the need to monitor the stability limits in real-time. Distance to Instability Traditionally, the operating reliability studies encompass: Load-flow and contingency evaluation Stability assessment. An important goal of stability assessment is to determine whether the system can withstand a set of large, yet credible, contingencies. This is the realm of transient stability analysis. An equally important objective is to evaluate the risk of approaching instability in small steps, e.g., via small load changes accompanied by slow bus voltage changes that may trigger a voltage collapse, or by gradual load changes that may eventually cause one or several generators to get out of synchronism. Traditionally, this topic has been addressed by steady-state stability analysis. At the present time, the industry refers to it as voltage stability analysis, but this terminology is neither uniformly understood nor universally accepted. In order to avoid confusion, throughout this section we will say voltage and steady-state stability analysis. There is no way to handle all the aspects of stability at once. Each one requires detailed models and adequate tools tailored to the physical phenomena being evaluated. The problem becomes even more complex when the target is a vast interconnected system. The sheer amount of data, the large computing times, and the technical skills needed to interpret the results render the analysis difficult. The latter point is not academic. Even if computational speed is achieved and the stability calculations are performed in real-time, or, as a minimum, off-line with real-time data, the end-users may have neither the time nor the background needed to assess the results. This opens the door for fast methods that not only are based on sound modeling assumptions but also produce the output in formats that are easy to interpret and understand. On the transient stability venue, much work was done to develop transient stability indices and other tools that would determine the degree of stability [31]. These techniques provide for a comprehensive analysis but are hampered by computational burden and non-convergence of load-flow calculations near instability. Voltage stability analysis tools, on the other hand, are quite popular but have their own limitations. To begin with, the results are affected by the assumptions made about the load. Ionescu and Ungureanu [16] demonstrated that if the loads were modeled as constant impedances, successive load increases would first cause the generated MW to increase until the point of maximum power transfer -- and then, beyond that point, the total generated power would get smaller and dual power states (same power at different voltages) would be obtained, which is the reason for the nose shape of the PV curves. But dual states cannot happen in real life and more

4-134

realistic load models lead to P-V graphs that stop at the point of instability. Also questionable is the practice of assessing voltage stability by running load-flows at successively increased load levels and stopping when the load-flow diverged [19], [28, pp. 1380]. As shown in the following, however, a fast and reasonably accurate solution to the problem of quantifying the distance to instability and performing the calculations in real-time comes from the realm of steady-state stability. Conceptually, the stability limit is a local property of the system state vector: for each new solution of the system of equations that describe the system state there is a new stability limit. Each time static capacitors and shunt reactors are switched, the reactive compensation varies and the voltage profile and stability conditions change. Likewise, each transformer tap change, line switching, load variation and generator trip may affect the distance to instability. Simply stated, stability limits exist, are not fixed, and change with the systems loading, topology and voltage profile. It is precisely this changing nature of the stability limits that makes it necessary to recompute them after each state estimate and after each load-flow computation. The Steady-State Stability Connection Steady-state stability is the stability of the system under conditions of gradual or relatively slow changes in load [5]. Accordingly, the Steady-State Stability Limit (SSSL) of a power system is a steady-state operating condition for which the power system is steady-state stable but for which an arbitrarily small change in any of the operating quantities in an unfavorable direction causes the power system to loose stability [32]. Voltage collapse, units getting out of synchronism, and instability caused by self-amplifying small-signal oscillations are all forms of steady-state instability. Empirically, the risk of steady-state instability is associated with low real/reactive power reserves, low voltage levels, and large bus voltage variations for small load or generated power changes. Recurring temporary faults where breakers trip without apparent reason, i.e., are disconnected by protection without being able to identify the fault, might also be indicative of steady-state instability. Breaker trips can happen when loads increase due to balancing rotors of generators that operate near instability trip, and then get back in synchronism. The importance of computing the SSSL for any given state does not stem from an improbable wish to operate at such a dangerous limit -- knowing this limit is important because it allows determining the steady-state stability reserve, which is a system-wide index that quantifies the distance between the operating state and the system loading near instability. Also, the SSSL makes it possible to define a safe system loading, or security margin, as a percentage of SSSL such that, for system conditions below this margin, transient instability is unlikely to occur [14]. Simply stated, the concept of security margin allows identifying a "stability envelope" that is very similar in nature to the TRM. The security margin, which is expressed as a percentage of the SSSL, depends upon the specific combination of topology, loads, generators and reactive compensation. It must be determined and periodically reassessed via off-line studies, perhaps once or twice a year, for each particular transmission system. For example, extensive studies conducted in Romania in the 1960s and 1970s on the power system as it was at that time recommended that the security margin be set at 15% for normal operating conditions and at 8% for contingency cases [8]. These values are still used today in system dispatching but they are re-evaluated on a yearly basis. There is no mathematical formula relating the security margin and the SSSL, but an empirical approach has been developed [27] based on the following heuristic:
Figure 4-71 The "stability envelope" concept

4-135

1. Start with a base case load-flow for peak load conditions and compute the SSSL and related security margin. 2. Run an extensive suite of transient stability simulations. If no instability has been detected, go to Step 5. If at least one contingency (fault) case was found to be unstable, go to Step 3. 3. Use the Step 1 security margin MW generation schedules to calculate a new base case load-flow. 4. For the load-flow computed in Step 3, run an extensive suite of transient stability simulations. 5. If no instability has been detected, repeat Step 4 for successively increased MW levels until at least one contingency causes transient instability. The steady-state stability reserve for the immediately precedent state is the security margin of the system under evaluation. 6. If the stability calculations in Step 4 detected at least one contingency (fault) that would cause instability, build a new load-flow case for a slightly reduced load level and repeat the transient stability checks. If no instability has been detected, recalculate the SSSL and the steady-state stability reserve, which is the security margin of the system under evaluation. The importance of this concept resides in the fact that, once a percent value of the security margin has been determined and accepted, the computation of the MW value of the security margin becomes a by-product of the fast voltage and state-state stability assessment algorithm. Stability Constrained Links For vast interconnected systems it is essential to assess stability when large blocks of power are transferred across the network. This, in turn, requires evaluating the maximum transfer capability across links, i.e., between the areas that get involved in the transactions, when a reduction in generation in one area is compensated by raising the generation elsewhere. In this context, and without diminishing the importance of conventional voltage, small signal and transient stability analysis, it becomes clear that the assessment of the maximum loadability of a transmission system for a given operating state should encompass both the: Computation of the system-wide 2 steady-state stability reserve and security margin, and the Evaluation of the maximum power transfer capability and related steady-state stability reserve across certain links, or transmission corridors, when large blocks of MW are transferred between system areas. A link identifies a group of transmission lines that form a topological cut-set, i.e., their removal splits the network in two areas, one on each side of the link. The maximum power that can be transferred across a link is limited by thermal and stability constraints. In a sense, the concept of "stability constrained link" is similar to the concept of congestion path, with the difference that the former is concerned with stability, rather than thermal, violations. "Stability constrained links" may appear in any multi-area power system where large MW blocks are transferred between weakly interconnected areas. For example, the populated areas and industrial zones in Romania are aggregated in concentric areas divided by the Carpathian mountain chain. In the center there is a highly meshed 110 kV network sustained by a 220 - 400 kV backbone. Around the center there is an outer ring of major power plants that inject their output into a strong 220 - 400 - 750 kV transmission system. The power flows from south-southwest towards the center, from south-southeast towards the northeastern part of the outer ring, and from the northern part of the central area towards the northeastern part of the outer ring. 5 stability constrained links have been identified. The sub-areas circumscribed by these links are not necessarily disjoint, and some of them overlap. They are not fixed, either, and change depending upon the pattern of load, generating reserves, transmission outages, line flows, voltage levels and reactive resources.

In the case of large multi-area networks, "system-wide computations" should be understood as computations performed at the level of one or several areas, or sub-areas

4-136

Fast Voltage and Steady-State Stability Assessment As shown in [20], [21], [22], approaching the stability limit from the perspective of steady-state stability analysis brings promising results. First, the SSSL of the system as a whole is mathematically definable and does represent an operating limit. Then, SSSL can be quantified: it is the maximum MW loading of the transmission system, including both internal generation and tie-line imports, right before instability. In other words, it is possible to measure how far from SSSL is a given operating state. Known as steady-state stability reserve, this metric has been used in Europe since 1950s [6], [7], [8], [15] and it can be expressed as a percentage of SSSL. Most importantly, it is also possible to quantify a safe amount of stability reserve, referred to as security margin, such that, for any system state with a steady-state stability reserve smaller than the security margin, no contingency, no matter how severe, would cause instability. Each system has its own security margin. For example, for the power system of Romania, as it was in the 1960s and 1970s, Paul Dimo and his colleagues were recommending a 20% security margin [8]. Reference [27] describes the procedure used by ETESA, Panama, to validate the value of the security margin (15%) that is currently used in conjunction with its real-time stability assessment application. The fast and versatile voltage and steady-state stability assessment technique developed by Paul Dimo [6], [7], [9] was predicated on this background. Its validity and usefulness for real-time applications were demonstrated in the EPRI Research Project RP2473-43 [29] and presented in various US and international publications [10], [20], [23]. In a nutshell, this technique uses the: Short-circuit currents transformation to convert the meshed network to a radial scheme of short-circuit admittances Bruk-Markovic reactive power stability criterion dQ/dV to evaluate stability Classic representation of generators via a constant e.m.f. behind the transient reactance x'd Zero Power Balance Network to aggregate the system loads into a single load-center Case worsening procedure, instead of a succession of load-flow computations, to stress the system until it becomes unstable. The reader interested in further details is directed to [6], [9], [20], [29] and related references. The following sections focus upon the approach taken by Transelectrica and AREVA T&D (AREVA) to implement this technique in real-time and to deploy it to continuously monitor the power systems distance to instability -by using real-time data, performing split second computations and presenting the results on user-friendly charts and diagrams.

4.16.2 Architecture 4.16.2.1 Hardware and System Environment

The dispatching of the electric power system and the operation of the electricity market in Romania are supported by an integrated information system that creates and maintains an extensive raw data and processed information reservoir available, based on appropriate access jurisdiction, to all the electricity market agents in Romania. This information architecture encompasses a Hierarchical SCADA/EMS and a Balancing Market System. Both systems are operated by Transelectrica and are located at the National Dispatch Center (DEN). Transelectricas SCADA/EMS encompasses an extended array of system dispatching support applications:

4-137

SCADA applications, such as: analog, status & accumulator data processing; limit checking; value replacement; calculations; historical data recording; intersite data processing; tagging; controls; and load shedding Generation Control and Scheduling applications, including: AGC; reserve monitoring; AGC performance monitoring; historic loss model update; transaction scheduling; transaction evaluation; load forecasting; market interface Network Analysis applications such as: topology processing; state estimation; real-time stability monitoring (QuickStab); monitored element processing, bus load model update; loss sensitivities; contingency analysis; security enhancement; power flow; optimal power flow/voltage VAr dispatch; offline short-circuit analysis; and off-line stability analysis (Eurostag).

4.16.2.2 Functional Description

The Romanian network sustains MW transfers between parties situated beyond its geographical borders and, to further complicate things, consists of electrical areas interconnected through stability constrained links. The system operation is quite complex and, in order to maximize the use of the grid while avoiding blackouts, the dispatchers continuously monitor the: Distance to the voltage and steady-state stability limit and the safe operating margin of the system as a whole Stability reserve across the interfaces between system areas separated by stability constrained links. The calculations are performed both for the entire interconnected system of Romania and for the areas on each side of the "stability constrained links" that were identified via off-line studies. The "stability constrained links", or weak transmission paths where the primary limitation comes from stability considerations, rather than thermal limits, are dynamically reconfigurable. The configuration of the stability constrained links is periodically re-assessed off-line with an application that identifies, for a given load-flow solution, all the links in the network and computes the steady-state stability reserve index for each link [17], [18]. The security constrained links are then ranked in the descending order of their steady-state stability reserve and the most critical five are selected. This procedure is executed twice a year. Since the actual stability limits across the links may differ substantially from those computed off-line for the postulated conditions, the problem is solved in real-time by QuickStab which computes the stability reserves both for the entire system and for the areas separated by the most severe constrained links in the network.

4.16.2.3 Seamless Integration of the Real-Time Stability Function with the Network Analysis Subsystem
Figure 4-72 illustrates how the fast voltage and steady-state stability application was seamlessly integrated in the real-time network analysis sequence of Transelectricas SCADA/EMS. After a successful state estimation run, a snapshot file in a standard format (PSS/E) is created and, together with a dynamic generator data file is used as input by QuickStab. The application predicts the maximum power transfer (or MW loadability) of the transmission network and computes the distance to the critical state where steadystate instability occurs. The distances to the stability margin state (user specified margin) and the optimal state (re-dispatching of generation to maximize the distance to critical state) are also evaluated.

4-138

Figure 4-72

Integration of QuickStab with the real-time network analysis sequence

4.16.2.4 Off-Line Stability Assessment with Real-Time Data

In addition to real-time stability monitoring, which supplements the conventional real-time and study mode network analysis, Transelectrica also performs off-line stability assessment by using load-flow and state estimation cases from the real-time system. The off-line stability assessment is performed with Eurostag, from Tractebel, and SAMI, which is an off-line stability application developed in-house based on the solution technique described in [4]. The data interfaces between the real-time system and Eurostag and, respectively, SAMI are shown in Figure 4-73.

Figure 4-73 Off-line integration of Eurostag and SAMI with the Transelectricas SCADA/EMS

4-139

4.16.2.5 Other DSA Tools Supported by AREVA

In the frame of its other EMS projects, AREVA has implemented real-time and study interface between its Energy Management System (e-terraplatform) and the following Dynamic Stability Assessment (DSA) packages: Voltage Stability Assessment Tool (VSAT) and Transient Stability Assessment Tool (TSAT) from Powertech Labs (Figure 4-74).

Figure 4-74 DSA integration with e-terraPlatform

The interface between EMS and DSA packages is provided through the following components: Stability scenarios definition and validation on the EMS platform using the Dynamic Case Preparation (DCP) application Data exchange between the EMS and the VSAT/TSAT server Stability analysis output results and visualization on the EMS platform

4.16.3 Distinguishing Features of the Real-Time Stability Application

The results are posted on intuitive graphics, including the industry-unique real-time stability trending chart. The trend of the stability indices over several hours provides very useful information about the stability evolution over time, as shown in Figure 4-75. The information that is relevant to the system dispatchers is summarized in a results table display and in a bar chart providing a graphical indication of the current stability reserve as displayed. Furthermore, after each analysis an alarm is sounded if the stability reserve percentage is below a user-specified danger level.

This approach to visualizing the computational results in a user-friendly manner allows the operator to continuously monitor, on standard SCADA trending displays, the evolution of the stability reserve both for the interconnected system and for the areas separated by stability constrained links. At the present time, the real-time monitoring of the distance to instability at Transelectrica is

4-140

performed both via conventional flat panel monitors and on the video projection system installed in the control room.

Figure 4-75 Real-time stability monitoring display (left) and trending charts (right) at Transelectrica

4.16.4 Performance and Reliability

The performance of Transelectricas real-time stability application is best illustrated by saying that, after each successful run of the state estimator, 6 (six) real-time stability calculations are performed -- one stability calculation for the entire Romanian transmission system, which encompasses approximately 1000 buses, and 5 additional stability calculations for each area that is connected with o the rest of the system via stability constrained links. Each real-time stability calculation is performed in less than 1 (one) second. The complete set of 6 real-time stability runs is executed in 3 to 4 seconds, depending upon the loading of the SCADA/EMS servers. No reliability problems have been detected. Of course, in order for the system to work, a converged state estimate is needed in the first place, which, in turn, requires that a minimum set of RTUs be available to ensure sufficient status and analog data redundancy -- but these are sine qua non conditions that apply to any real-time network analysis system and are not specific to the stability assessment functionality.

4-141

4.16.5 Operating Experience. Benefits

Transelectrica has a track record of successfully using the stability assessment technology developed by Dimo, as summarized in the previous sections and further described in detail in [10], [13], [25] and related references. The steady-state stability reserve concept was formally introduced in operations and planning in the late 1960s and early 1970s [12], [20], it has been used ever since, and its computation is a standard component of the operational and planning studies conducted at Transelectrica. The fast voltage and steadystate stability assessment application described herein was first implemented off-line in 2003 [1], then it was implemented in real-time in 2005 and became fully operational in early 2006. Today, the real-time monitoring of the risk of blackout is one of the key software tools used at DEN. It helps anticipate critical system conditions that may lead to instability and allows the system dispatchers to maintain and enhance the operating reliability of the Romanian transmission system.

4.16.6 References
[1] [2] [3] Aldea, C., Savulescu, S.C., Evaluation of the Stability Reserve of Transelectricas transmission System buy using QuickStab Professional, paper S2p-12-en presented at the National Conference of Energy CNE 2004, 13-17 June 2004, Neptun, Romania Barbier, C., Barret, J.P., "An analysis of phenomena of voltage collapse on a transmission system", RGE, special edition CIGRE, July 1980, pp. 3-21 Campeanu, H.S., L'Helguen, E., Assef, Y., Vidal, N., Savulescu, S.C., Real-Time Stability Monitoring at Transelectrica, Paper PSCE06-1288 presented at the Real-Time Stability Applications in Modern SCADA/EMS Panel, IEEE Power Systems Conference & Exposition 2006 (IEEE PSCE'04), Atlanta, GA, October 29 - November 2, 2006 Constantinescu, J., Study of the transient Processes in Large-Scale Poqwer Systems, Rev. Roum. Sc. Tech., Srie Elect. et Energ., Tome 27, 1982, No. 2, pp. 211-227 Crary, S. B., 1945, Power System Stability, General Electric Series, Schenectady, New York, Copyright 1945, Third Printing October 1955 Dimo, Paul, "Etude de la Stabilit Statique et du Rglage de Tension", R.G.E., Paris, 1961, Vol. 70, 11, 552-556 Dimo, Paul, "L'Analyse des Rseaux d'Energie par la Mthode Nodale des Courants de Court-Circuit. L'Image des Nuds", R.G.E., Paris, 1962, Vol.7pp., 151-175 Dimo, P., Manolescu, G., Iordanesscu, I., Groza, L., Ionescu, S., Albert, H., Moraite, G., Ungureanu, B., Computation and design of electrical energy systems (Romanian edition), Editura Tehnica, Bucharest, Romania, 1971 Dimo, Paul, "Nodal Analysis of Power Systems", Abacus Press, Kent, England, 1975 Erwin, S.R., Oatts, M.L., Savulescu, S.C., "Predicting Steady-State Instability", IEEE Computer Applications in Power, July 1994, pp. 15-22 Ionescu, S., Ungureanu, B., "The Dual Power States and Voltage Collapse Phenomena", Rev. Roum. Sc. Tech., Srie Elect. et Energ., Tome 26, 1981, No. 4, pp. 545-562 Kundur, P., Power System Stability and Control, Mc Graw Hill, 1994 Kundur, P., Morison, G.K., Classes of Stability in Todays Power Systems, IEEE Trans. Pow. Sys. Vol. 8 T-PWRS, No. 3, pp. 1159-1171 Magnien, M., Rapport spcial du Groupe 32 Conception et Fonctionnement des Rseaux, Confrence Internationale des Grands Rseaux Electriques Haute Tension, CIGRE Session 1964 Moraite, G., Ionescu, S., Feldmann, S., Chenzbraun, I., 1966, Problmes soulevs par la stabilit statique des rseaux boucls, Confrence Internationale des Grands Rseaux Electriques Haute Tension, CIGRE Session 1966 Navarro-Perez, R., Prada, R.B., "Voltage Collapse or Steady-State Stability Limit", in Proceedings of the International Seminar on Bulk Power System Voltage Phenomena II, pp. 75 84, (Edited by L. H. Fink, 1993) Pomarleanu, M., The Selection and Ranking of Power System Dangerous Cuts, Symposium Bulk Power System Dynamics and Control IV Restructuring, Santorini, 1998, 08 24-28

[4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17]

4-142

[18] Pomarleanu, M., Bejuscu, L., Selectarea operativa a seciunilor unui sistem electroenergetic cu rezervele de stabilitate statica cele mai mici, Energetica 47, nr. 2, 1999 [19] Sauer, W.P., Pai, M.A., Relationships between Power System Dynamic Equilibrium, Load-Flow, and Operating Point Stability, in Real Time Stability in Power Systems, pp. 1-30, Springer Verlag, Norwell, MA, 2006 [20] Savulescu, S.C., Fast Assessment of the Distance to Instability. Theory and Implementation", in Real Time Stability in Power Systems, pp. 31-64, Springer Verlag, Norwell, MA, 2006 [21] Savulescu, S.C., A Metric for Quantifying the Risk of Blackout, Paper 04PS0294 presented at The Real-Time Stability Challenge Panel, IEEE Power Systems Conference & Exposition 2004 (IEEE PSCE'04), New York, New York, 10 - 13 October 2004 [22] Savulescu, S.C., Real-Time Detection of the Risk of Blackout, Invited paper 04GM0484 presented at the Control Center Issues session, IEEE PES General Meeting 2004, Denver CO, June 9, 2004 [23] Savulescu, S.C., Oatts, M.L., Pruitt, J.G., Williamson, F., Adapa, R., "Fast Steady-State Stability Assessment for Real-Time and Operations Planning", IEEE Trans. Pow. Sys., Vol. 8 T-PWRS, No. 4, Nov. 1993, pp. 1557-1569 [24] Savulescu, S.C., Pomarleanu, M., WeakLinks Finder User Instruction Manual, Copyright 2006 Energy Consulting International, Inc. [25] Venikov, V.A. "Transient Processes in Electrical Power Systems", Edited by V. A. Stroyev, English Translation, MIR Publishers, Moscow, 1977 [26] Venikov, V. A., Stroev, V. A., Idelchick, V. I., Tarasov, V. I., "Estimation of Electrical Power System Steady-State Stability", IEEE Trans. on PAS, vol. PAS-94, No. 3, May/June 1975, pp. 1034-1041 [27] Vergara, J. S., Thai, T.A., Cuong, N. D., Nam, N.T., Campeanu, H.S., Savulescu, S.C., Accuracy Testing and Real-Time Implementation of Dimos Stability Analysis Technique, in Real Time Stability in Power Systems, pp. 65-92, Springer Verlag, Norwell, MA [28] Vournas, C.D., Sauer, P.W., Pai, M.A., Relationships between Voltage and Angle Stability of Power Systems, Electrical Power and Energy Systems, Vol. 18, No. 8, pp. 493-500, Elsevier Science Ltd, 1996 [29] PRI, "Power System Steady-State Stability Monitor Prototype", Final Report EPRI TR-100799, July 1992. and "Power System Steady-State Stability Monitor", Final Report EPRI TR-103169, December 1993 [30] http://www.eciqs.com home page and related links [31] IEEE PES, Techniques for Power System Stability Search, A Special Publication of the Power System Dynamic Performance Committee of the IEEE PES, TP-138-0, 1999 [32] IEEE PES Task Force on Terms and Definitions, Proposed Terms and Definitions for Power System Stability, IEEE Trans. on PAS, vol. PAS-101, No. 7, July 1982

4-143

4.17 State-of-the-Art of DSA in Russia

Although no current Russian Cigre member was available as a contributor to this report, contributors were available whom had previously worked in the Russian (formerly USSR) system and were able to provide some insight, through selected publications [1-5], into the use of DSA the that region of the world.

4.17.1 Overview of the Russian Power System

The Unified Electric Power System (UPS) of Russia has been touted as the worlds largest centrally controlled power system interconnection which boasts of high reliability (annual outage duration of 5-6 system minutes) with no system collapses for many years (for example, the last blackout in Moscow was in 1948). The structure of the system is shown in Figure 4-76 [1]. The UPS has a number of distinguishing features which make security assessment and control a significant challenge [1]. 1. A number of the UPS subsystems are connected by heavily loaded weak ties operating at voltages of 220, 330, 500, and 750 kV. Consequently, following disturbances associated with these links, the system is prone to instability unless special measures are taken. 2. The maximum flows throughout the system can vary widely over the course of a day. 3. The capacity transmission lines rated at or above 330 kV is limited generally by stability rather than over-current.
Figure 4-76: Structure of the UPS of Russia

4. Increases in transfers over the very long transmission lines results in a significant increase in losses. 5. The total reactive compensation is less than 30% of the total load, and the total reactive power from adjustable compensation devices is less than 3%.

4.17.2 Approach to Ensuring Security

The Russian philosophy, based on many years experience, is that most widespread blackouts are a result of insufficient emergency control systems. As a result, a focus of Russian power system engineering has been on the design and operation of diverse and robust emergency control systems in which both off-line and online DSA are necessary components. In the UPS of the former USSR, two types of centralized systems were implemented [3], Type 1: Designed to maintain stability in relatively small control areas where it may be difficult to separate problems of dynamic and steady-state stability in the post-contingency condition. The Type 1 system relies largely on off-line calculations the results of which are stored in the central computer. However, some functions are performed on-line, including identification of the condition of the present calculation cycle and selection of the corresponding stability regions stored in the central computer (look-up).

4-144

Type 2 : Designed to operate on a vast control area considering the interdependencies of stability conditions in different parts of the control areas. In the Type 2 system, practically all problems, including stability estimation, selection and optimization of control actions, are solved on-line. The system uses information about the current system state, together with a list of the emergency contingencies, and a list of available control actions. Stability regions are not computed, but rather, the stability (and associated required control actions) for the specific condition are computed. All required calculations are performed within a 1 2 minute cycle time using specifically designed high-performance software for system equivalencing, steadystate stability estimation, selection of control schemes.

4.17.3 References
[1] Gerasimov and L. Koshcheev, Main Principles of automatic counter-emergency control in UPS of Russia, 2005 IEEE PES PowerTech Conference, St., Petersburg, Russia, June 2005, Paper 337. [2] V.N. Avramenko, Power System Stability Assessment for Current States of the System, Paper 192 [3] N.I. Voropai et al, Reliability in the Restructured Russian Utility Industry, IEEE Power Engineering Review, February 1998. [4] N.I. Voropai et al, Organization Principles of Emergency Control of Electric Power Systems in a Market Environment, 2005 IEEE PES PowerTech Conference, St., Petersburg, Russia, June 2005, Paper 700 [5] Y.V. Makarov et al, Blackouts in North America and Europe: Analysis and Generalization, 2005 IEEE PES PowerTech Conference, St., Petersburg, Russia, June 2005, Paper 699.

4-145

4.18 State-of-the-Art of DSA in the USA TSA at PJM

4.18.1 Introduction
The electric industries in the world are transitioning to more competitively structured systems. The load demands are increased and market economics have pushed the operation of the system closer to all of the operational limits. Thats all making the operation of the real time power systems increasingly difficult and more complex. Rrecent system outages in North-eastern United States and Europe have brought an awareness of the vital need for reliable operations. The system-wide and local monitoring and control of large scale power systems and efficiently detecting and preventing the system instability or the system collapse are the challenges for the most power system control centres. The real time DSA has not been so far put in practical use in the most of control centers. The off-line stability assessment is used in the system operations, which may cause incorrect operations. PJM transmission system is the largest centrally dispatched control area in North America by coordinating the movement of electricity in all or parts of Delaware, Illinois, Indiana, Kentucky, Maryland, Michigan, New Jersey, North Carolina, Ohio, Pennsylvania, Tennessee, Virginia, West Virginia and the District of Columbia. As additional members joined PJM market. PJM operates the largest competitive wholesale electricity market in the world. Transient stability has been a security constraint in the PJM transmission system, and it often results in reduced transfer limits at key interfaces. As the PJMs footprint extends to include ComEd, AEP, DPL, this problem will become more critical, due to the transient stability constraints in the Midwest areas. As a solution to this, PJM planed to deploy a real time Transient Stability Analysis and Control (TSA&C) system. The TSA&C system will become a necessary and critical dispatch tool to improve PJM system reliability and to make system operations more economical. This section describes a Real Time Transient Stability Analysis and Control (TSA&C) system for on-line Dynamic Security Assessment (DSA).

4.18.2 Objectives and requirements

The objective of a real time TSA&C system is to provide PJM system operators with critical information regarding the transient security of the PJM system, including, (1) Transient stability of the system subject to credible contingencies. (2) Transfer limits at key interfaces subject to transient stability constraints. (3) Transient stability control measures required to prevent the system from losing transient stability for potentially unstable system condition and/or contingencies. The real time TSA&C system will meet the following performance requirements: (1) Assessment cycles. A complete real time TSA&C assessment cycle will be completed within 15 minutes. (2) System size. The current PJM EMS model has about 13,500 buses and 2,500 generators. With the planned model expansion, the system size may grow to 25,000 buses and 3,000 generators in the near future. The TSA&C system will be designed to handle the current system size with the

4-146

capability, by increasing the computation power, to accommodate the planned PJM EMS model expansion. (3) Models. The stability analysis modules will include the following models:

Generator: classical to two-axis 6th order modals Excitation system: all IEEE standard exciter/AVR and PSS models and common extended models Speed governing system: all IEEE standard models and common extended models Load: ZIP model, voltage/frequency dependent model, induction motor, discharge lighting model Relay: under-voltage/frequency load shedding, switchable shunts, distance relay User-defined modeling FACTS models: SVC, TCBR, STATCOM, TCSC, SSSC, TCMCT, TCPST HVDC model: two and multi terminal HVDC models, converter based FACTS models

(4) Contingencies. Within an assessment cycle, 3,000 contingencies will be processed as the full set of credible contingencies. The contingency types will initially include three-phase fault with primary clearance and eventually cover single-line-to-ground fault with backup clearance. The following modeling capabilities will be available in contingency analysis:

Faults may be at buses or anywhere on lines For unbalanced faults, fault impedances can be specified or computed with sequence network data provided Branch (single or three phase) tripping and reconnection, shunt switching, adding or modifying branch Generator tripping Load shedding, load ramping Pre-simulation circuit outages and powerflow dispatches Dependent contingencies

(5) Transfer limit computations. Within an assessment cycle, transfer limits at up to 10 key interfaces will be computed if necessary. Each transaction might be done with either of the following schemes:

If all contingencies are found to be stable for the current system condition, transfers will be increased, with pre-specified powerflow dispatch methods, to a level beyond which the system will be unstable for at least one contingency. This gives the transiently secure operation boundary for the system condition within which the system may be dispatched to meet the operation requirements. This is referred to as forward stability limit search. If one (or more) contingency is found to be unstable for the current system condition, transfers will be reduced, with pre-specified powerflow dispatch methods, until the system is stable for all contingencies. The required powerflow dispatches will then be presented to the system operators for immediate actions. This is referred to as backward stability limit search.

The number of contingencies considered for each transaction analysis will be reasonable (no more than 20). (6) Transient stability control measure determination. A preventive control measure was required for insecure contingencies. (7) Software/hardware platform and interface. The TSA&C software will be developed on the MS Windows platform. User interface will be fully graphical, compliant to common Windows standards.

4-147

4.18.3 Overview of Transient Stability Analysis and Control (TSA&C) system Computation Flow Chart of TSA&C
This real time TSA&C system has been designed and implemented by PJM and Powertech Labs Inc., and installed at PJM control center. It is primarily based on the following components in the DSAToolsTM software suite offered by Powertech:

TSAT (Transient Security Assessment Tool) DSA Manager (the on-line interface module)

In addition, the powerflow analysis module, PSAT, of the DSAToolsTM suite is also integrated with the TSA&C system in the off-line study mode. The computation flow chart of TSA&C is shown in Figure 4-77 . A computation flow starts when a realtime system snapshot is available and ends when all computations are done and results are stored/displayed. The following main data/result processing and computation steps are involved in a computation flow. The features of this TSA&C system are described as following sections.
Data server EMS Real time data Real time case and result archive

DSA Manager & DSA Service

DSA Monitor Data processing: Data conversion Data validation Security assessment result processing TSA&C result display If required Creation of real time TSAT cases Creation of special TSAT cases

Very stable contingencies are early terminated and ignored

Detailed stability analysis using timedomain simulations

Determination of preventive control measures (PCM) for insecure contingencies Determination of stability limits for specified transfers, outages, and contingencies

Stability indices for unstable and fully simulated contingencies TSAT

Figure 4-77 TSA&C Computation Flow Chart

4.18.3.1 Data Processor

Operation of TSA&C includes handling of different sets of data (both input and output) as shown in Figure 4-78 .

4-148

Real time data: Powerflow Dynamics (optional) Contingency (optional) Stability limit (optional) Fixed data: Dynamics Contingency Monitor Powerflow solution parameters Configuration data: Computation parameters Real time plot specifications

TSA&C

Output data: Basecase security report Preventive control measure (PCM) report Stability limit report Real time case archives Real time plot archives Event/messages logs

Figure 4-78 - Relationship of different data sets

Input Data
A number of input data sets are required by TSA&C to perform DSA:

Powerflow: this data can be in any format supported by Powertech TSAT (including PFB, PSS/E, PSLF). Powerflow data is prepared using the real-time system snapshot and passed from EMS system. Dynamics: this data can be in any format supported by Powertech TSAT (including TSAT, PSS/E, PSLF). Dynamic data matches the real-time powerflow and passed from EMS system. Contingency: this data is in Powertech TSAT format. The contingency data matches the powerflow data in the same way as the dynamic data and passed from EMS. Stability limit: this data can be in either native Powertech TSAT format or special TSA&C format, but for on-line analysis only data in TSA&C format is supported. Stability limit data is prepared together with the powerflow data in real time and passed from EMS system Stability limit data matches the powerflow data in the same way as the dynamic data. Monitor: this data is in Powertech TSAT format. The monitor data matches the powerflow data in the same way as the dynamic data. Powerflow solution parameters: these are in Powertech TSAT format. Powerflow solution parameters are optional for the real-time TSA&C system operation. Computation parameters: these parameters are stored in TSA&C client servers in a format internal to TSA&C. Real time plot specification: this data is stored in TSA&C clients in a format internal to TSA&C.

All input data is parsed and processed for sanity check and validation. Fixable data problems are automatically corrected.

Output Data
All output data from a real-time case is stored in the output folder specified in the TSA&C configuration. This data can be used in various ways: Displayed in DSA Manager or DSA Monitor Operator Console Loaded in TSAT or PSAT for off-line studies Examined by study engineers with text editor

4-149

4.18.3.2 Fast Contingency Screening

A fast contingency screening tool is included in the design and is currently under development.
4.18.3.3 Time Domain Integration
The heart of the TSA&C system is the Powertech TSAT program which uses the following techniques for Transient Security Assessment. Nonlinear time-domain simulations This is the core technology of Powertech TSAT and is used in every analysis function in the TSA&C system. Powertech TSAT uses a numerical integration algorithm [1] with these features: Support to all modeling requirements Choice of integration algorithm, such as second order or fourth order Kunge-Kutta method Efficient solution of the network algebraic equations

Transient stability margin Transient stability margin is a key element in a TSA&C application. There are three options to choose from in the TSA&C system:
Stability margin
More stable

Search threshold Stability boundary Search range

More unstable

Fault clearance CCT

Figure 4-79 - Computation of CCT

Power swing-based energy margin (SM): this is a stability margin based on the energy exchange in each power swing during transients. The algorithm is based on the method described [2]: Power angle-based margin (AM): this is a stability margin based on the power angle separation of the generators during the simulations. Critical clearance time (CCT) of fault: this applies only for contingencies involving faults. The longest fault clearance time without losing stability is computed and served as a margin to measure the degree of stability. The determination of stability while computing CCT can be based on either SM or AM. Computationally, CCT is obtained using a binary search within a specified range of fault clearance time, as shown in Figure 4-79

4-150

Damping index This refers to the damping ratio of the worst oscillatory mode following a contingency. Poorly damped, sustained, or growing oscillations in the system can be detected using this index which is computed with a multi-channel Prony algorithm from the time-domain simulation results. The frequency at which the worst damping occurs, and other modes identified from the Prony algorithm are also available. Descriptions on the Prony method can be found in [3] Other transient security criteria These include transient voltage violations, transient frequency violations, and relay margins. These are all computed from the time-domain simulation results. Early termination of simulations In order to meet the speed requirement of the real time TSA, the assessment of contingencies must be done as quickly as possible. A scheme is implemented in the TSA&C system to speed up the contingency analysis by terminating the simulation of a contingency once it can be definitely classified as stable or unstable. Early terminated stable contingencies are ignored for further process and result visualization.

4.18.3.4

Stability limit computation

TSA&C includes a stability limit computation module that determines the limit of a power transfer subject to a set of relevant contingencies and security criteria. This works as follows: A power transfer is defined using the source/sink concept and a set of relevant contingencies is assigned to the transfer. The security constraint is defined using any or all of the security criteria available. Depending on the security status of the assigned relevant contingencies from the basecase analysis, either a forward search or backward search can be performed, as shown in Figure 4-80 . A number of search strategies can be used to find the limit, including curve-fitting based automatic search, binary search, and fixed step search.

Stability margin
More stable

Forward search Base system condition secure Stability limit is the largest transfer increase without violating any security criteria

Stability margin
More stable

Reverse search Base system condition insecure Stability limit is the smallest transfer decrease without violating any security criteria

Stability boundary
More unstable More unstable

Stability boundary

Stability limit

Transfer increase
Figure 4-80 - Stability Limit Computation

Stability limit

Transfer decrease

4-151

4.18.3.5 Preventive control measure (PCM) determination

For each contingency with security violation (insecure contingency) at the base system condition, PCM, in terms of possible generation dispatch schemes, can be determined so as to keep the system in the secure region should the contingency happens.

4.18.3.6 GUI visualization

TSA&C has comprehensive result visualization tools to provide key information to Dispatchers and operation engineers. These include, Transient security of the system for a real-time condition (basecase analysis results), Overall status of the system (secure or insecure) Security trend Critical contingency list with contingency details such as fault location and circuits lost Security violation details with information such as critical cluster of generators, frequency of critical oscillatory mode, etc. Security indices for complete set of fully assessed contingencies Histogram of all enabled security indices for customized time window Customized real-time plots of selected quantities showing critical time-domain system responses Access to full simulation results with TSAT ResultView If PCM option is enabled and performed, recommended PCM (in form of powerflow dispatches) for all insecure contingencies. If stability limits are computed, information for each transfer: Base MW values of the source variable and monitored interfaces Limit MW values of the source variable and monitored interfaces Stability limit trend Limiting factor Limiting outage System dispatch details at the limiting condition Histogram of all transfer limits for customized time window

4.18.3.7

TSA&C Real Time Mode and Study Mode

TSA&C has two modes: Real Time mode and Study mode Real time mode: For the designed model size and computation features, a real time TSA&C assessment cycle will be completed within 15 minutes using the recommended hardware architecture. Study mode. It is used to perform off-line studies. An off-line study mode is available with access to standard off-line versions of Powertech TSAT and PSAT programs with full graphical user interface. Any archived real-time case or other off-line case can be directly loaded in off-line programs. The TSA&C system operation and results can be accessed by remote users.

4-152

4.18.3.8

Hardware

The TSA&C installation at PJM consists of the hardware as shown in Figure 4-81 . In the figure, An IBM blade center hosts the main computation power. It consists of two chassis, each containing 7 blade servers. 2 blade servers are designated as TSA&C clients (backup of each other) 10 blade servers are used as computation servers (for distributed processing) 2 blade servers are configured as off-line study servers (also as backup computation servers) 2 standalone clustered servers to run data server and also FTP. A San storage is connected to these as TSA&C data server Real-time cases on EMS send it to TSA&C data server.

Users workstation

IBM blade center (Computation center)

1 Gb/s Ethernet

Standalone clustered servers San storage (TSA&C data server)

FTP

EMS (Unix)
Figure 4-81 -TSA&C hardware structure

4.18.4 Conclusions and Remarks

The TSA&C was integrated with PJM real time system in Jan. 2006, receiving real time data including State Estimation solution with network model, dynamic data, contingency data and data for stability limit calculations and running in real time sequence about every 15 minutes, to process

4-153

3000 contingencies and calculate 16 interface stability limits. Based on the operational testing, PJM TSA&C system is approved as a critical real time transient stability monitoring tool to improve PJM system security and reliability. PJM is preparing using these real time stability limits to replace the existing stability limits calculated by off-line models. This is the first version of PJM TSA&C. The new development of TSA&C is under way , which includes a fast screening method, improvement of the preventive and corrective control schemes.

4.18.5 References
[1] P. Kundur, Power System Stability and Control, McGraw-Hill, 1994. [2] M. Pavella, D. Ernst, and D. Ruiz-Vega, Transient Stability of Power Systems A Unified Approach to Assessment and Control, Kluwer Academic Publishers, 2000. [3] J.F. Hauer, Application of Prony Analysis to the Determination of Modal Content and Equivalent Models for Measured Power System Response, IEEE Trans. on Power Systems, Vol. PWRS-6, No.3, pp.10621068, August 1991.

4-154

4.19 State-of-the-Art of DSA in the USA VSA at PJM

Introduction
On-line security assessment requires evaluating the static as well as dynamic effects of hundreds or even thousands of credible contingencies on power systems. Static security assessment (SSA) checks all relevant static constraints of post-fault (post-contingency) steady states. From a computational viewpoint, SSA needs to solve a large set of nonlinear algebraic equations. Dynamic security assessment (DSA) requires the handling of a large set of nonlinear differential equations in addition to the nonlinear algebraic equations involved in the SSA. The task of performing on-line DSA is a rather challenging task. On-line voltage security assessment (VSA) ensures the ability of the power system to withstand a list of credible contingencies against voltage collapse. From a computational viewpoint, on-line voltage security assessment needs to solve a large set of nonlinear algebraic equations and among other functions, calculate the load margins to static security limits. It should be pointed out that the existing tools developed for on-line SSA are inadequate for on-line voltage collapse assessment. A majority of modern energy management systems do not perform on-line VSA and on-line DSA to ensure the ability of the power system to withstand certain credible contingencies. Indeed, it is increasingly difficult for power system operators to generate all the operating limits against voltage collapse and voltage instability for all possible operating conditions under a list of credible contingencies. For many utilities around the world, there has been considerable pressure to increase power flows over existing transmission corridors. This consistent pressure has prompted the requirement of extending EMS to perform on-line VSA and DSA; even real-time VSA and DSA. Such extension, however, is a rather difficult task and requires several breakthroughs in analysis tools, computation methods and control schemes Real-time voltage security assessment and enhancement, VSA&E is an integrated computer package developed by Bigwood Systems, Inc. Ithaca, NY for voltage security assessment, enhancement and preventive control of large-scale power systems in real-time mode. This tool, which is designed for largescale interconnected power systems in the FERCs open-access transmission, has been successfully evaluated on several power systems ranging from 2,000 buses to 50,000 buses. Another version of Real-time VSA&E is designed for on-line study mode. The integrated package, including two embedded patented technologies, provides the following analysis and control functions with respect to voltage stability, thermal limits and voltage limits. The package handles the full AC nonlinear model of the study power system under a comprehensive contingency list. It takes the general characteristics of power system operating environments and the effects of control devices into account. Many aspects of power system operational characteristics are modeled in the package; such as generator capability curve, limits of real power generations, the sequence of generator pick-up, generator participation factor, user-defined priority of employing control devices, and the physical limitation of control devices. The major features of VSA&E are the computational speed of the package, the accuracy of simulation results, the innovation of control action design and the reliability of its simulation engine. The current version of the package can handle power systems up to 100,000 buses. It can accept power flow data files in the following formats: PTI (up to version 30), EPRI and IEEE. The modeling capability of VSA&E is very comprehensive including SC, ULTC, phase-shifter, reactive power capability curve, nonlinear loads, DC Transmission Lines and FACTS. The integrated package provides the following voltage stability analysis and control functions with respect to a contingency list under single or multiple power transactions:

4-155

4.19.1 On-line Analysis and Look-ahead Analysis

To make on-line voltage security assessment feasible, it is essential to significantly reduce the computational burden required without sacrificing analysis accuracy. The strategy of using an effective scheme to screen out a large number of secure/stable contingencies and to identify a number of potentially insecure/unstable contingencies and to apply detailed simulation programs only to potentially insecure/unstable contingencies is widely adopted in power industry. We note that the voltage collapse load margin with respect to a contingency can be negative. Under this situation, the study power system will undergo voltage collapse should the contingency occur. This contingency is hence termed as an insecure contingency. This strategy has made on-line SSA a routine task in EMS. This strategy is composed of two stages of assessment. Stage I is usually a screening and ranking stage while Stage II entails the application of detailed analysis to insecure or critical contingencies identified at Stage I. It is fair to state that the success of the two-stage strategy for on-line applications depends largely on the effectiveness of the screening and ranking of Stage I. The strategy of using an effective scheme to screen out a large number of secure contingencies and to identify a number of potentially insecure contingencies and to apply detailed simulation programs only to potentially insecure contingencies can be applied to on-line voltage security assessment as described in the following Stage 1: performs the task of static contingency screening to screen out contingencies, which are definitely secure in the voltage stability sense, and to identify and rank insecure and critical contingencies, from a set of credible contingencies Stage 2: performs detailed voltage stability analysis to each insecure or critical contingency identified in Stage 1.

4.19.2 Load Margin and Sensitivity

VSA&E includes contingency selection and screening and provides a list of the most severe contingencies, in terms of voltage stability margins, from a full, comprehensive contingency list. These most severe contingencies contains insecure contingencies and critical contingencies. The VSA&E load margin calculation determines the voltage stability margin in megawatts (MW) and megavar (MVAR), between the voltage collapse point and the current power system operation point. Mathematically speaking, the nose point of P-V curve, or Q-V curve, or P-Q-V curve with respect to a load-generation vector can be due to either the saddle-node bifurcation point or the Q-induced limit point. Physically speaking, in the context of transfer capability evaluation, the saddle-node bifurcation is closely related to the transfer capability limit of the study power system with respect to the load-generation vector. On the other hand, the Q-induced limit point is closely related to the reactive power generation limit of one or some generators involved in the power transfer. The integrated package accurately computes the following points and computes their corresponding load margins and sensitivities Saddle node bifurcation point (nose point) Q-induced limit point (nose point). The program also accurately calculates the voltage violation points and the thermal limit violation points. Sensitivity calculations at these points (violation points, bifurcation point or limit point) provide a variety of valuable information. Information of these points allows the calculation of three system load margins described below.

4-156

Given a load demand vector (i.e. real and reactive load demands at each load bus) and a real generation vector (i.e. real power generation at each generator bus), one can compute the state of the power system (the complex voltage at each bus) by solving the set of power flow equations. Let Pi Pgi Pdi and

Qi Qgi Qdi . The lowercase g represents generation and the lowercase d represents load demand. The
set of power flow equations can be represented in compact form as

P( x ) P f (x ) = 0, where x = (V , ) Q( x ) Q

(1)

where the vector P (respectively, Q) represents the real (respectively. reactive) power injection at each bus. Next, it will be explained how one can examine the power system steady-state behaviors under slowly varying loading and real power redispatch conditions. For example, if one needs to trace the power system state from the base-case load-generation condition specified by the following vector

[P , Q , P ]
0 d 0 d 0 g 1 d 1 d 1 g

to a new load-generation condition specified by the following vector

[P , Q , P ],

then one can parameterize the set of power flow equations as the following parameterized power flow equations

F ( x, u , ) f ( x, u ) b = 0

(2)

where u is the control vector and the load-generation vector b is

P1 P 0 b 1 0 Q Q

(3)

It is clear that the set of the parameterized power flow equations (2) become the base-case power flow equations when = 0 ,

P(x ) P 0 F ( x,0 ) = =0 0 ( ) Q x Q

And when = 1 , the set of parameterized power flow equations describes the power system steady-state 1 , Pg1 and is described by behavior at the new load-generation condition Pd1 , Qd

P(x ) P1 F ( x,1) = f ( x ) b = =0 1 Q( x ) Q
Thus, one can investigate the effects of varying real power generations as well as varying load demands on power system steady-state behaviors via solving the set of parameterized power flow equations (2). In fact, one can parameterize any change in PQ loads in conjunction with any change in P generations by selecting an appropriate vector b. We next apply the above general setting to the problem of computing the available load margin of the basecase interconnected power system. In this application, the vector b is used to represent one or several of the following power transactions and transmission service:

4-157

 Point-to-point MW transaction - the real power at one load bus of the receiving area varies while the others remain fixed and the real power at one generator bus of the sending area varies while the others remain fixed, Slice-of-the-system sale - both the real and reactive power demand at a load bus of the receiving area vary and the real power generation at some collection of generators of the sending bus varies while the others are fixed, Network service - the real and/or reactive power demands at some collection of load buses of the receiving area vary and the real power generation at some collection of generators of the sending bus varies while the others are fixed. We shall call the vector b the proposed power transaction vector when the parameterized power flow equations (2) is used for ATC evaluation, and the scalar , the load-generation margin. The proposed power transaction vector b can be used to represent a power transaction involving simultaneous power transfers by summing each power transaction vector, i.e. b = b1 , i = 1,2,... where the vector b1 represents the ith power transaction. Definition: The voltage collapse load margin of a power system under a contingency with respect to a loadgeneration vector is the distance (in terms of MW and/or MVAR) from the current operating condition to the nose point of the parameterized power system subject to the contingency. Definition: The voltage-limit load margin of a power system under a contingency with respect to a loadgeneration vector is the (minimum) distance (in terms of MW and/or MVAR) from the current operating point to the state vector, of the parameterized power system subject to the contingency, at which the voltage constraint at some bus is violated. Definition: The thermal-limit load margin of a power system under a contingency with respect to a loadgeneration vector (3) is the (minimum) distance (in terms of MW and/or MVAR) from the current operating point to the state vector, of the parameterized power system subject to the contingency, at which the thermal limit constraint of some transmission line is violated. These three load margins are defined under the following conditions: Given (i) the current operating condition (obtained from the state estimator and the topological analyzer), (ii) a set of proposed power transactions, (iii) a list of credible contingencies, the three look-ahead schemes are developed for estimating the load margins, along the proposed power transactions, with respect to voltage stability limit (nose-point load margin), bus voltage limit, line flow thermal limit, for the power system with the proposed power transactions, subject to the list of credible contingencies. The following analysis functions are implemented in real-time VSA&E. Contingency screening and ranking of a large set of credible contingencies, say 3,000 contingencies, in terms of load margins to voltage instability Identification of insecure contingencies with zero or negative load margins Identification of critical contingencies with small load margins Computation of P-V, Q-V, and P-Q-V curves for base-case and selected contingencies with a variety of load and/or generation variations Computation of the exact load margin to voltage collapse for the base case and each top-ranked contingency Detailed Look-ahead Analysis

4.19.3 Preventive Control and Enhancement Control

The VSA&E package also provides the operators and reliability engineers enhancement control and preventive control along with the load margin and sensitivity information with respect to voltage collapse,

4-158

voltage violation and thermal limit violation. In particular, the integrated package provides the following reinforcement control functions with respect to voltage collapse under single or multiple power transactions: Preventive control against voltage collapse of all insecure contingencies Enhancement control to increase margin to voltage collapse of critical or selected contingencies When the load margin to voltage collapse for the base case or each highly ranked contingency is not sufficient, the integrated package determines effective enhancement controls to increase the load margin by exercising the following level-1 control actions before resort to load shedding. Level-1 Control selects from the following controls: (1) reactive power-compensating devices, (2) ULTC, (3) phase-shifters, (4) real generations and (5) generator terminal voltage. Level-2 Control: (6) placement of new reactive power-compensating devices (i.e. optimal locations to install new reactive power-compensating devices and amount to be installed), (7) load-shedding (i.e. optimal locations to perform load-shedding and amount of load-shedding to be performed). When one or multiple insecure contingencies are identified (note that the load margin to voltage collapse for each insecure contingency is negative), the integrated package determines effective preventive controls to avoid voltage collapse, should any of insecure contingencies occur, by exercising the above level-1 control actions before resort to level-2 control actions. Priority-based Control Schemes Both the enhancement control schemes and the preventive control schemes developed and implemented in the integrated package are practical and yet innovative. They are practical from users viewpoint and innovative from control theory viewpoint. These two schemes allow users to set priority on the selection of different controllers in level-one control actions. In addition, they allow users to set desired properties of control actions based on the following two criteria:

Minimum-number of control actions; or Minimum-amount of control actions; or Minimum-cost of control actions

4.19.4 Contingency and Power Transactions

This tool supports various types of contingencies and power transactions. A contingency is composed of a single or multiple items. Line, transformer, shunt, load and generator outages are considered in the contingency. Multiple outages of up to 30 pieces of equipment are allowed in a contingency. The tool supports multiple power transaction definitions described by the power transfer including: between bus and bus, between area (zone) and area (zone), between bus and area, sequential generator pick-up list and hybrid definition; in particular, the package supports the following power transactions:

Point-to-point MW transaction - the real power at one load bus of the receiving area varies while the others remain fixed and the real power at one generator bus of the sending area varies while the others remain fixed, Slice-of-the-system sale - both the real and reactive power demand at a load bus of the receiving area vary and the real power generation at some collection of generators of the sending bus varies while the others are fixed,

4-159

Network service - the real and/or reactive power demands at some collection of load buses of the receiving area vary and the real power generation at some collection of generators of the sending bus varies while the others are fixed.

4.19.5 Real-Time Voltage Stability

As actual system conditions become more severe and load demand in the system increases, system operators require a powerful tool to evaluate voltage security of the system based on the ebb and flow of actual system operating conditions. Indeed, increasing real and reactive load demand, net power interchange, and/or a configuration change (contingency) can result in voltage collapse. VSA&E analysis and control recommendations provide the system operators a quantitative view of where voltage problems lie ahead, the proximity of the system operating point to the problem and what operations can be taken to steer the system into highly secure operation regions.
Table 4-13 Contingency Ranking Report showing the first 9 in the ranking, including 4 insecure, ranked 1 4.

Contingency Ranking & Estimated Margins

Session: __buildin.ses Conting. List: __buildin.ses Run Date: 6/6/06 18:00 Contingency Rank 1 2 3 4 5 6 7 8 9 Number 18550 18520 6820 18180 18250 18010 6780 18730 18020 Name P 0.000 0.000 0.000 0.000 2429.753 2579.699 2658.051 3062.834 3081.472 Margin Q 0.000 0.000 0.000 0.000 235.050 249.556 257.135 296.293 298.096

Preventive Control
The VSA&E voltage stability capability secures safe voltage stability load margins by using controls such as: (1) reactive power-compensating devices, (2) ULTC, (3) phase-shifters, (4) real generations, (5) generator terminal voltage and (6) load-shedding by location and load amount. The Preventive Control Table above shows the output of Preventive Control processing by VSA&E. The 5 recommended control actions shown in the table when taken will mitigate all 4 insecure contingencies identified by the Contingency Ranking Analysis, see Table 4-13 . The load margins of the 4 insecure contingencies, which are zero or negative before the preventive control, are all raised such that the load margin of all 4 contingencies are increased to the range from 839 MW to 2832 MW after the preventive control.

Enhancement Controls
Using the same set of available controls as the preventive control, the enhancement control of VSA&E allows the operator to specify a desired (target) amount in MW of increase in load margin for a contingency or the base case. Enhancement control returns a priority-based, minimum set of control actions to execute the desired load margin increase. Suppose the target load margin increase is 200 MW. VSA&E identifies 4

4-160

control actions that meet the target value and satisfies their physical limits. The output table below shows that by executing the 4 recommended control actions the load margin is enhanced by 207 MW increasing the margin from 2710 MW to 2917.
Table 4-14 VSA&E identifies Preventive Control to mitigate the 4 insecure contingencies so that after the 5 controls are executed all will have positive load margins and all satisfy their physical limits.

Table 4-15 VSA&E Enhancement Control gives control actions to increase the margin

We emphasize that it is imperative in determining the load margin to voltage collapse to take into account all the credible contingencies. This task however is computationally intensive. The strategy of using effective schemes to rank all credible contingencies and of applying detailed analysis programs only to critical contingencies is widely accepted. In order to identify critical contingencies which will severely violate static security constraints, we developed three look-ahead ranking schemes which are to be incorporated into the tool. The first look-ahead scheme ranks the set of all credible contingencies in terms of load margin to system collapse and to select the top few critical contingencies. The second look-ahead scheme ranks the set of all credible contingencies in terms of branch MVA violation and selects the top few critical contingencies. The third scheme ranks all credible contingencies in terms of bus voltage violation and selects the top few critical contingencies.

4-161

4.19.6 Parallel VSA&E Software Architecture

The performance requirements for RT/VSA&E of large-scale power systems are very demanding. The current production system, which executes a new analysis and control cycle every 3 minutes, consists of 12,500 buses, 4,250 generators and a contingency list numbering 3,000 and growing. To meet this need, BSI developed Parallel RT/VSA&E, a software architecture designed to run on tightly coupled multi-processor systems and loosely coupled distributed systems interconnected by high-speed communications networks. A parallel version of the user interface for the architecture is also developed. User 1 User 2
Computation Node1 Computation Node 2

Low (medium) speed network

High-speed Network Gi bit Eth t S it h

User 3

User m

Computation node 3

Computation node n

Figure 4-82 Representation of a distributed parallel computing platform for Parallel RT/VSA&E

VSA&E User Interface

Parallel Operation

Transport Channel

Analysis Results

Real-Time

Computation Node Manager VSA&E Engine

Energy Management System

Figure 4-83 Parallel RT/VSA&E software architecture

The Parallel RT/VSA&E software architecture, shown in the Figures 4-82 and 4-83 , provides a flexible distributed computing environment for parallel computations hosted by blade servers, multi-processor computers, single processors distributed across a LAN or WAN and combinations of these platforms. The heart of this design is the Parallel Operation Manager that handles the VSA&E user requests and the real time feed of data received continuously from the Energy Management System. The Parallel Operation Manager monitors the availability of processors running the VSA&E computational engine, assigns work the processors and monitors work progress to effectively balance the workload. The VSA&E engine can run on all processors in the system. It receives real-time input data, runs the analysis and control functions of VSA&E as instructed by the Parallel Operation Manager and returns detailed VSA analysis and the required preventive and/or enhancement control results.

4-162

Field Proven in a 12,000 Bus System

The entire implementation, installation and validation procedure of VSA&E based on real-world data conducted over an extended period of time. The VSA&E system is now operating as tightly integrated application in PJM real-time EMS environment. The system features two modes of operation. The real time mode offers periodic voltage security assessment and control, 24 hours per day, 7 days per week. The on-line study mode of the system allows all users to easily execute shared planning activities and cooperative problem study and solving to mitigate potential operating shortfalls in voltage security. It can be also used for longer-range planning applications.

Figure 4-84 RT/VSA&E main user interface window display showing summaries for each interface and trending over time. At the bottom of the window are buttons to access detailed information about a selected interface.

4.19.7 System Modeling

1. Generators Generators are modeled as active and reactive power sources which also provide voltage control. The MVAR output of each on-line generator is adjusted during power flow solutions in order to control the voltage of the local bus (the bus where the generator is connected to) or a remote bus. The generators MW output has fixed limit. And the generator's MVAR output has is limited by fixed limits the so-called capability curves.

4-163

2. Loads Loads can be modeled as constant power (P-Q), constant current (I), or constant impedance (Z), or any linear combination of them. The tool can also accept nonlinear load models as long as they are expressed as nonlinear functions of voltage. 3. Control Devices The following control devices are modeled Switchable shunts and static VAR compensators Interchange schedules ULTC Transformers ULTC phase shifters Static tap changer and phase shifters 4. DC Network

4-164

4.20 State-of-the-Art of DSA in the USA Southern Company

4.20.1 General Description
Southern Company is a super-regional energy company with more than 40,000 megawatts of electric generating capacity in the southeastern United States (Figure 4-85). Southern Company supplies energy to a 120,000-square-mile service territory spanning most of Georgia and Alabama, southeastern Mississippi, and the panhandle region of Florida. Approximately 53 tie lines interconnect the Southern Company grid to neighboring utilities in the southeastern United States. The desire to implement transient stability assessment on a real-time basis at Southern Company is driven by several factors. Reliability concerns arise when an increasing Figure 4-85 Southern Companys service territory number of merchant generating plants interconnect to the transmission system, and opt not to procure the long-term transmission service necessary to solve various thermal and/or stability concerns which may exist from time to time as a result of this new generation. Transmission service may then be requested and offered on a shorter-term basis usually as a result of a daily evaluation. Given the ever-changing system conditions encountered in real-time system operations, it simply is not feasible to study every conceivable system snapshot in the planning environment. Therefore, the risk exists that transmission service may be granted without realizing that a potential stability limit could be violated. Conversely, there may be occasions when the planning models and any resultant limits identified may be too conservative in the determination of a stability limit. Whatever the case, a greater degree of certainty should be derived from a transient security assessment based upon an accurate real-time state estimator power flow model. For all the reasons stated above, a goal was established to implement real-time transient stability assessment on at least an hourly study cycle in Southern Companys system control center. At the time this project was first initiated at Southern Company in 2003, very few utilities were actively pursuing the implementation of a real-time stability application. With limited commercial software availability because of a small user base, evaluation of different software packages was often times an apples to oranges comparison since different packages tend to focus on different features or functions. After considerable evaluation, Southern Company ultimately purchased the Transient Security Assessment Tool (TSAT) application from Powertech Labs Inc. in December of 2003. Details of the real-time system are provided in [1].

4.20.2 System Model

The Southern Company state estimator network model used for steady-state power flow analysis applications has insufficient internal machine detail required for transient stability analysis. Because of limited measurement availability or other reasons, combined cycle units and hydro units are often modeled as a single generator. In order to provide sufficient detail for transient analysis, expanded internal generator representation is accomplished by mapping any aggregated machine output to an

4-165

assumed explicit machine output as derived from more detailed planning models. The first step in creating a transient stability base case, therefore, is to internally expand the latest state estimate and to solve the expanded case. The external equivalent portion of the state estimator network model is also inadequate for performing transient stability analysis. A replacement external equivalent is generated from a reference planning base case which has a custom-built, dynamically reduced external model. The second step in creating a transient stability base case is to remove the external equivalent from the state estimate and to attach the dynamic equivalent. One unique aspect of this enhanced state estimator model is a highly reduced external system, which provides a virtually identical dynamic response as the much larger original from which it was derived. An empirical process was developed to build this special dynamics-ready external equivalent, which included use of a small-signal analysis program to identify the inter-area modes of oscillation that should be retained. A summary comparison of the original and reduced models is shown in Table 4-16 below. The CPU time represents a total number of seconds for the entire set of benchmark contingencies evaluated.
Table 4-16 Size Comparison of Base and Reduced Case.

Original Buses Branches Machines D-States CPU time 43,138 57,740 7,019 296,086 9,285

Reduced 7,977 16,950 2,548 111,254 1,405

% of Orig. 18.5% 29.5% 36.3% 37.6% 15.1%

4.20.3 System Architecture

Southerns on-line TSA system is based on two pieces of software from Powertechs DSAToolsTM package:

Users workstations

. . . . . . Ethernet

TSAT (Transient Security Assessment Tool): this is the computation engine that actually performs TSA. TSAT uses time-domain simulations as the core technology from which a number of TSA functions are built, including swing-based stability margin calculation, Prony analysis for damping determination, a versatile stability limit computation module. Special features for on-line applications are also included, such as early termination of simulations, and automatic detection and correction of bad data in real-time cases.

Real-time system snapshot DSA Client EMS

Optional computation Servers

Figure 4-86 Southerns on-line TSA architecture

DSA Manager: this is the interfacing module for on-line operation. It provides three main functions: (1) data connection between EMS and TSAT; (2) on-line system configurations; (3) computation monitoring and result visualization.

4-166

Figure 4-86 shows the on-line TSA system architecture implemented at Southerns system control center. The real-time system snapshots are created on EMS side and passed to the DSA Client through a defined data exchange protocol. The TSA software (TSAT and DSA Manager) processes the cases primarily on the DSA Client (a workstation with dual 2.4 GHz Xeon CPU), with options to include multiple servers so as to distribute computation scenarios. Users can access TSA results on the DSA Client as well as on any workstations in the network on which the DSA monitoring software is installed. The initial phase of the TSA project implemented at Southern in June 2005 has the following capabilities and features:

The real-time system snapshots are created on an hourly basis. For each system snapshot, roughly 250 contingencies are processed to evaluate transient security of the system. This takes about 30 minutes without optional computation servers. Security assessment results, including insecure contingencies, stability margin information, swing curves, etc., can be examined on any workstations properly configured, by operators, operation support engineers, and planners. Real-time cases of up to one month are archived in the form that can be directly opened in TSAT. These cases can be readily used for various off-line scenario studies.

4.20.4 Operational Experience

Southern Company has already derived significant benefit from incorporating key results of this realtime stability assessment into the reliability decision-making process. Following Hurricane Katrina in late August and early September of 2005, hourly real-time studies revealed problems with damping and transient voltage recovery in Mississippi and Alabama. Additional studies were quickly performed off-line to determine safe generation limits in the Gulfport/Biloxi (Mississippi), Mobile (Alabama), and Pensacola (Florida) areas as the transmission system was being restored. On other occasions during periods of heavy transmission system maintenance, certain other generators were identified as contributors to stability limit violations and appropriate system adjustments were then made to alleviate the reliability concern. While the initial on-line TSA implementation can presently be made available to Southern Company transmission system operators, results are presently monitored by an operations support engineer on an as-needed basis. Deployment to real-time floor operations is being deferred until the next phase of development (see below) is complete, and a suitable operator training program has been developed.

4.20.5 Development Plans

Recognizing the benefits that the initial implementation of the on-line TSA system bring, Southern and Powertech are working together on the next phase of the development which will include the following: Enhancing the selection of contingencies to be evaluated. Increasing the processing power: multiple servers will be used to distribute computation scenarios. Improving the system reliability: a dual client structure will be used to allow better failover protection. This is already a standard feature in DSA Manager. Including advanced analysis features: under considerations are stability limit computation and preventive control measure determination which are also standard features of TSAT and DSA Manager.

4-167

Including other security assessment options: voltage security assessment using Powertechs VSAT software will be added. Integrating summary results of the stability studies into Southerns EMS alarms processing subsystem.

4.20.6 References
[1] James Viikinsalo, Alan Martin, Kip Morison, Lei Wang, and Frederic Howell, Transient Security Assessment in Real-time at Southern Company, paper to be presented at the IEEE PSC&E Conference, October 2006.

4-168

5 2
Chapter 5

ON-GOING RESEARCH AND DEVELOPMENT

CHAPTER 5. On-going Research and Development

5.1

Introduction

Chapter 3 presented a general set of requirements for on-line DSA systems. Some of these requirements have clearly been achieved as indicated in the state-of-the-art implementations described in Chapter 4. However, on-line DSA remains an emerging technology and the potential capabilities, and need for such capabilities, is enormous. Aside from the ever increasing power of computers, a number of developmental areas include,

improved system architectures and computing methods use of intelligent systems new analytical tools and techniques use of new technologies such as PMUs or real-time damping measurement devices improvement in state estimation and modeling application of DSA results to protection and control

This Chapter outlines some of the on-going research and development underway in various parts of the world.

5.2

On-going R&D in Canada - Hydro Quebec

Off-line studies, based on stability robustness and respect of different criteria and constraints, try to find the best optimal limits applicable for a large range of operation. These limits are stored in the LIMSEL system as previously described. For some real-time power network conditions, these limits sometimes computed more than one year before, are still conservative and could be improved. Since 1994, Hydro-Qubec has stored all historical snapshot data in every 5 minutes coming from the state estimator with the corresponding dynamic models. These data can be accessed by an in-house developed software called CILEX and have already been used for stability studies on real cases or for post-mortem analysis and also for giving feedback to off-line studies. Hydro-Qubecs specificities in term of security and organization require, due to its challenging power network dynamic characteristic, strong and strict interrelation, continuity and coherency between operation planning and operational environments. An on-line DSA system, if just indicating the real operational state is secure or not, is not sufficient because we already have this information in LIMSEL system. An on-line DSA system computing real-time transfer limits provide limited economic gains because these limits are not available for planned transactions. However, economic analysis has shown that the best gains happen for specific constraint situations in operation planning.

5-1

Currently, an on-going DSA research project at Hydro-Quebec takes knowledge from expertise and develops a systematic approach to determine off-line, optimized transfer limits for the Hydro-Quebec transmission system for a specific network configuration corresponding to a constrained planning operation or operation situation or to a network event (see Figure 5-1 ). The transfer limit determination process has to be revised and optimized to allow a global response time of only a couple of days for a constrained situation foreseen by example one week in advance. Presently, this process as described before takes several months for a complete study on a main corridor. Limits are stored in LIMSEL system and correspond to off-line study done often on a worse case scenario. The new approach has the potential for a specific configuration to raise the transfer limits by taking into account a better knowledge of the real state of the network (CILEX can be used) and the uncertainties associated with certain variables. The new limits will replace, just for a short period of time corresponding to the constrained forecasted situation, the limits already stored in the control center LIMSEL system covering this specific configuration.
MW

Available power
ds ee N

Captive

New Limits

James-Bay

f it o L m Li MSE LI

G ai ns

Captive

Manic-Qubec

MW

Figure 5-1 - Transfer limits optimized by the new approach

The new approach will provide operation planning engineers a fast and systematic process to establish in advance secure transfer limits and also to optimize the daily operation scheduling over a horizon of up to a few weeks. This process is expected to reduce the study time from several days to a few hours eventually. It will also be used for off-line studies and give operation planning engineers opportunities to explore more network configurations which can not be covered before. The challenge of this research project is to generate, for a constrained situation and in a time frame compatible with the operation planning (ideally a few hours), a systematic way to output limits which will be valid for a specific period of time. The way to determine the limits has to be built in continuity with the current process. In the first step (short term horizon), the limits will be computed in a more systematic way with the help of the operation planning engineers supported with data processing and decision making tools. This process can last a few days. In the second step (mid term horizon), the engineers will only supervise the process execution and validate the results before entering them in the LIMSEL system at the control center. Another challenge of this research project is the performance of the contingency analysis which is crucial for the success of the second step of the project. With the complex and detailed modeling required for a good simulation of the power system behavior and with the use of specific voltage and

5-2

frequency criteria by operation planning engineers, it is difficult if not impossible with current contingency analysis methods to provide 100% reliability with a good efficiency.

5.3

On-going R&D in China - CEPRI

CEPRI is developing a number of projects related to DSA, including,: (1) Improved dynamic security assessment. Based on the results of the parallel computation, the DSA system will carry out fast stability sensitivity analysis, which gives the pre-decision to improve the stability level of the power system, even give the real-time control. The sensitivity analysis includes transient stability assessment, small signal stability assessment and voltage stability assessment. The national dispatch center of China is now establishing the dynamic stability monitoring and control system, which is based on the DSA and other advanced technology. (2) Dynamic security area visualization research. The function is based on parallel computation, using the stability maximum of the transmission power of the important power system interfaces and uses 2D and 3D visualization software to draw the current operation point and the security area. Thus the operator of the dispatch center can quickly understand the stability level of the power grid at any point in time.

5.4

On-going R&D in Europe

5.4.1 Transient stability assessment and control

Current and further research activities in the field of SIME-based TSA and control are/will be focused around testing and possible refinements of E-SIME (most notably extension to the use of phasor measurements) and Open Loop Emergency Control (OLEC), development of SIME-based adaptive emergency control, application of OLEC technique in liberalized electricity markets as well as design of system protection schemes (more specifically through so called contracts for system protection schemes). E-SIME Following a disturbance inception and its clearance, the E-SIME aims at predicting the system transient stability behaviour and, if necessary, at deciding and triggering control actions early enough to prevent loss of synchronism. Further, it aims at continuing monitoring the system, in order to assess whether the control action has been sufficient or should be reinforced. The method relies on real-time measurements, informing about machines parameters.

Predictive transient stability assessment The prediction relies on real-time measurements, acquired at regular time steps, t i s, and refreshed at the rate t i , in post-fault stage. The procedure consists of the following steps. (i) Predicting the OMIB structure: use a Taylor series expansion to predict (say, 100 ms ahead), the 5-3

individual machines rotor angles; rank the machines according to their angles, identify the largest angular distance between two successive machines and declare those above this distance to be the candidate critical machines, the remaining ones being the candidate non-critical machines. The suitable aggregation of these machines provides the candidate OMIB. (ii) Predicting the Pa curve: compute the parameters of this candidate OMIB, and in particular its accelerating power and rotor angle, Pa and , for three successive data sets acquired at t i 2t i ,

t i t i , ti . Write the equation Pa ( ) = a 2 + b + c

(1)

for the three different times and solve for a, b, c . Subsequently, using newly acquired sets of measurements and processing a least squares technique, which shows to be particularly robust, refine the estimated curve. A further improvement consists of using a weighted least-squares (WLS) technique, by giving more important weights to the last sets of measurements. (iii) Predicting instability: search for the solution of

Pa ( u ) = a u + b u + c = 0
2

(2)

to determine whether the OMIB reaches the unstable conditions

& ( ) > 0 . Pa ( u ), P a u
If not, repeat steps (i) to (iii) using new measurements sets. If yes, the candidate OMIB is the critical one, for which the method computes successively [1] , [2], [3], the unstable angle u the unstable margin

= Pa d Mi2
i

1 2

(3)

the time to instability

tu = ti +
i

d (2 / M ) Pa d + i2
i

(4)

where i stands for (t i ) and i for (t i ) . (iv) Validity test. The validity test relies on the observation that under given operating and contingency conditions, the value of the (negative) margin should be constant, whatever the time step. Hence, the above computations should be repeated at successive t i s until getting a (almost) constant margin value.

5-4

Salient features

The method uses real-time measurements acquired at regular time intervals and aims at controlling the system in less than, say, 500 ms after the contingency inception and its clearance. The prediction phase starts after detecting an anomaly (contingency occurrence) and its clearance by means of protective relays. Note that this prediction does not imply identification of the contingency (location, type, etc.). The prediction is possible thanks to the use of the OMIB transformation; predicting the behavior (accelerating power) of all of the system machines would have led to totally unreliable results. There may be a tradeoff between the above mentioned validation test and time to instability: the shorter this time, the earlier the corrective action should be taken, possibly before complete convergence of the validation test. Above descriptions aim at giving a mere flavor of the method. Detailed developments may be found in [1], [2], [3], [4]. Emergency control On the basis of real-time measurements taken at the power plants, the method pursues the following main objectives: to assess whether the system is stable or it is driven to instability; in the latter case to assess how much unstable the system is going to be; accordingly, to assess where and how much corrective action to take (pre-assigned type of corrective action); to continue assessing whether the executed corrective action has been sufficient or whether to proceed further. Block 2 of Figure 5-2 covers the two first steps: prediction of instability, and appraisal of the size of instability, in terms of margins and critical machines. Block 3 takes care of the design of control actions. For example, when generation shedding is of concern, the action consists of determining the number of generators to shed. Further, the method sends the order of triggering the action, while continuing to monitor and control the system in closed-loop fashion, until getting power system stabilization.

Observations:

The prediction of the time to (reach) instability may influence the control decision (size of control; time to trigger it; etc). The hardware requirements of the emergency control scheme are phasor measurement devices placed at the main power plant stations and communication systems to transmit (centralizedecentralize) this information. These requirements seem to be within reach of todays technology [5]. The emergency control relies on purely real-time measurements (actually a relatively small number of measurements). This frees the control from uncertainties about power system modeling, parameter values, operating condition, type and location of the contingency.

5-5

Power System

Real Time Measurements (1)

Predictive TSA (2)

No

Unstable Case (margin<0)? Yes

Applying the emergency action

Stability Margin Critical Machines Design of Control Action

Find appropriate action to stabilize the system (3)

Figure 5-2 General framework for closed-loop transient stability emergency control (E-SIME)

Using phasor measurements Measurements acquired by Phasor Measurement Units (PMU) such as voltage and current magnitudes, and voltage and current phase angles, are not directly usable by E-SIME and have to be pre-processed. Current research efforts are focused around the use of Artificial Neural Networks (ANN) to estimate (and predict) internal machine angles, rotor speeds and accelerations from the measurements acquired by PMU located at extra-high voltage side of the substation of a power plant. The important engineering observations about PMU measurements with respect to their use in transient stability assessment and control are: The rotor angles and speeds of the synchronous generators are the most important quantities in power system transient stability assessment and control. PMU measured quantities are electrical variables that may experience fast changes unlike rotor angle which is a mechanical variable. PMU measured quantities can experience discontinuity under switching in the electrical network. Wrong or noisy rotor angles and speeds may result in wrong transient stability prediction and wrong determination of control actions. The rotor angle is a nonlinear function of the machine terminal variables and the main idea is to employ a pattern recognition scheme to map the patterns of inputs (variables measured by a PMU) to the required rotor angle (and speed, two schemes are currently under investigation [6], [7], estimation and prediction of rotor angles, and rotor angles and speeds). This mapping can be represented by

f : {u k } R n { k } R1
T

(5)

where {u k } = [Vk (t ), I k (t ),Vk (t 1), I k (t 1), vk (t )...] at any instant k , and n depends on the number of input variables as well as number of previous measurements used.

5-6

To realize the mapping of the machine terminal variables measured by a PMU to the rotor angle we use the multi-layer feed-forward ANN. Multi-layer feed-forward ANNs with back propagation supervised learning have several advantages over conventional computing methods. Those advantages are robustness to input and system noise, learning from examples, ability to memorize, handling situations of incomplete information and corrupted data, and performing in real-time. The results of our initial and current research efforts in solving this problem can be found in [8] and [9]. Further refinements Current E-SIME technique has some limitations that have to be tackled in near future research activities. These limitations are as follows: Though E-SIME prediction scheme has been validated on various realistic power systems other power systems may bring some new phenomena and prediction scheme should be adjusted accordingly. It is expected that prediction scheme will be system dependent. Methodology relies on the proper contingency occurrence and its clearance identification. Both problems may be solved by using consecutive phasor measurements (this problem is to be investigated in terms of proper fault clearance detection procedure). This requests for additional processing power and will tight requirements on time delays. Appraising various types of control actions such as load shedding, fast excitation control, fast valving, dynamic breaking, mechanical power modulation, etc., should be examined (in the available version, E-SIME deals only with the generation tripping). The emergency control scheme will be strongly system dependent and appraising different types of control action will make algorithm much more flexible. Even existing generation tripping scheme should be modified to meet different requirements that different systems can impose (generation pattern in the system, giving slight priority to hydro plants, taking into account benefits and impacts of generator tripping, etc.). The generators could be ranked (prioritized) according to some specific criteria that are to be investigated. E-SIME deals with global rather than local control. In emergency one should rely on local control actions that are fast enough and less demanding in terms of information needed and corresponding communication requirements. For the time being, E-SIME assumes that the rotor angles, speeds and acceleration are known for all system machines. It would be interesting to explore how to reduce the number to a small subset (of course, w. r. t. a given fragilized area of the power system). It could happen that the system problem cannot be solved by generation tripping at one power plant only and coordinated control should be examined. The E-SIME provides the amount of generation to be tripped. There are two possible approaches. The first is to trip at once all the estimated generation to be tripped, as soon as the first unstable margin appears, by tripping the most advanced machines that comprise the estimated generation to be tripped (this is the case when estimated time to instability is tight with respect to the delays in control action application). The second approach is to trip machines one by one, by tripping the most advanced machine first, then monitor system state, if the computed stability margin is still negative and time to instability is large enough trip again the most advanced machine and continue until the margin becomes positive, but if after tripping the first machine the time to instability is tight with respect to the delays, trip all the remaining generation (estimated to be tripped) at once. Because of short time frame (system emergency states) delays in data collecting, processing and delays in determined control actions application can considerably influence whole system. The delays due to data acquisition and processing in the PMU are:

Tacq = Tc + T p Trate
where:

5-7

Tc sampling period of instantaneous quantities measured at PMU site T p adjourning period of processing by PMU Trate sampling rate (e.g., every cycle of fundamental frequency)
The whole cycle (data acquisition and processing - prediction, assessment, decision on control action control action application) can be expressed as:

T = Trate + Ts + Te + Tsime + Ts + Tsw Tu

where, Ts delay in communication system (it is assumed that delay in receiving measurements are approximately the same as the delay in sending control signal to the system, in reality the delays are slightly different), Te identification of the fault clearing.

Tsime time occupied by E-SIME to properly predict instability and to decide on appropriate control
action. Tsw delay in switchgear operation ( Ts + Tsw delay in application of the control action).

Tu the time to instability.

The longer the delays in communication system the shorter the time to E-SIME to predict instability (appearance of the first unstable margin). All this can result in a too late control action application, for some particular situations. Current E-SIME algorithm is intended to first-swing instability control and has to be disarmed as soon as the system goes into back-swing. Further development is needed to assess its applicability in backswing and multi-swing modes. OLEC The leading idea is to mitigate preventive actions (generation shifting) by complementing them with emergency actions (generation tripping) that would automatically be triggered only if the postulated contingency actually occurs. The procedure realizing this idea is summarized in the following steps [8]. 1. For an initially unstable scenario (operating condition subject to a pre-defined harmful contingency and its clearing scheme), compute the corresponding (negative) margin and determine the corresponding critical machines. 2. Assuming that (some of) these machines belong to a power plant equipped with a generation tripping scheme, select the number of units to trip in the emergency mode. 3. Starting with the initial scenario, perform SIMEs simulations up to reaching the assumed delay of generation tripping; at this time, shed the machines selected in step 2, and pursue the simulation until reaching instability or stability conditions. If stability is met, stop; otherwise, determine the new stability margin and corresponding critical machines (to check whether they are the same or not with the previous simulation). 4. Run the transient stability control program to increase to zero this new (negative) margin. To this end, perform generation shifting in the usual way, from the remaining critical machines to non-critical machines. 5. The new, secure operating state results from the combination of the above generation rescheduling taken preventively, and the consideration of the critical machines, previously chosen to trip correctively. 6. Repeat the above steps 1 to 5 with each one of all possible patterns of critical machines to trip, until getting an operating condition, which realizes a good compromise between security and economics. 5-8

7. After the optimal number of machines to trip is determined, the settings of the special protection activating the generation tripping scheme in the plant is adapted so as to automatically disconnect these machines in the event of the contingency occurrence. Application of OLEC technique to liberalized electricity markets In the restructured electric industries, the operating condition of the system is set up in several cascading markets, which can be purely financial futures markets, used for expanding the system, or short-term markets for the physical delivery of electric energy. Generators scheduling is performed by bilateral contracts and auction markets that run one-day up to 1 hour ahead of real time operation. After this new unit commitment process, the system operator conducts real-time markets in order to balance system generation and load and solve transmission constraints or congestions. The specific rules of these real-time markets vary from one system to another, but they share a common feature: generators submit their prices for being re-dispatched up or down (if necessary) and the operator performs this security rescheduling with the economic objective of minimizing its total cost. Most of the current markets take into account thermal constraints only. The near-optimal preventive control techniques proposed in [9] provide valuable tools for including transient stability limits in the auction mechanism of the balancing market. Note that these techniques may call upon an OPF software, as advocated in [9], or be adapted to any auction market software currently in use. In the context of optional balancing markets, an additional advantage of the near-optimal preventive control techniques is that they can perform transient stability control using only a sub-set of the critical machines [9]. This allows meeting requirements regarding transparency of operators decisions and non-discriminatory access of all transactions to the transmission system. Nevertheless, the examples described in the present paper show that, in some cases, the sole redispatch mechanism of the balancing market becomes very expensive. In such cases, the OLEC technique provides interesting alternatives, allowing considerable reduction of the power to redispatch preventively and hence of its cost. Another interesting aspect of OLEC is that it can enhance significantly the security of the system by making economically possible its protection against the whole set of harmful contingencies, considered simultaneously. OLEC is also helpful in adapting on-line the optimal number of generators to trip to the current system operating conditions, so as to minimize the imbalance between generation and load. Note that, depending on the amount of disconnected generation, this imbalance is generally compensated either by bringing on-line spinning reserve (in less severe cases), and/or by shedding load (in the most constraining cases). Hence, whenever necessary, i.e., if generation tripping is too important or generation rescheduling too difficult to realize, the amount of load to automatically shed in the emergency state should be assessed preventively by OLEC. A final notice: other congestion management methods, like counter trading, can also be adapted to include transient stability constraints, using SIME-based information about critical machines identification and corresponding amount of power shifting. Contracts for system protection schemes Installing system protection schemes is significantly easier in vertical utilities than in liberalized electric industries where, however, such schemes could be fully justified. Indeed, experience has always shown that system protection devices have a positive impact on the overall financial account of the electric utilities, besides improving power system dynamic performance. They allow operating the system under conditions very close to those established by economic considerations (minimum cost in traditional utilities, equilibrium of the auction market in restructured electric industries) while 5-9

ensuring system stability, thus achieving a good compromise between economics and security. In order to apply OLEC, the system operator can sign contracts with the companies owning the generating plants in which system protection schemes are installed. This type of contracts, which have already been implemented in some electricity markets [10], can also be used in other transient stability-constrained systems. An advantage of using contracts for emergency control is that it allows mitigating considerably the preventive countermeasures and hence keeping almost unchanged the power system operating conditions established by the market; generally, the emergency control scheme remains inactive, since the triggering event does not occur often. SIME-based adaptive emergency control Converting a remedial scheme in an adaptive system protection is a very hard task, because their action should consider the overall system dynamic behavior. One of the solutions to this problem consists in using pre-calculated arming tables (computed off-line in the operation planning context) for updating the settings of the generation tripping device. Solutions to compute on-line the settings of the remedial scheme can be classified into the following two main approaches: System protection scheme (SPS) becomes response-based, and use (almost) instantaneous real measurements to assess system stability and adapt their control action depending on the current dynamics, after the contingency has actually occurred [11] System protection scheme remains as an event-based device, automatically triggered by system protections when a pre-selected contingency takes place, but their settings (like the amount of generators to shed and the time to perform the control), are updated by simulations performed on-line at the EMS (or other location) under changing system operating conditions, on a periodical basis [11] SIME-based control is now able to perform, and combine, both types of system protection

schemes against transient instabilities:

E-SIME as a response-based system protection scheme. OLEC as the event-based system protection scheme.

This combination is described below.

Coupling E-SIME with OLEC Generally speaking, closed-loop and open-loop controls have more or less complementary features and assets [12], [13]. Hence the idea of combining closed-loop with open-loop emergency control techniques. The idea is even more appealing when the two techniques rely on the same basic method. Indeed, despite important assets, E-SIME needs some delay (say, 450 ms from the disturbance inception) before triggering the control action, and the larger this delay, the larger the generation shedding needed. This delay can even become fatal to the system integrity, if the contingency is very severe. On the other hand, OLEC is likely to act much faster (say, 150 ms after the disturbance inception) since the automatic protection activating the generation tripping scheme uses only local measurements to detect the fault and act, in contrast to E-SIME, which- at least in principle- needs all machines rotor angles and powers. But the suggested action may be incorrect, at least partly, given the uncertainties about the anticipated operating conditions. Coupling the above two techniques may combine their advantages while avoiding part of their weaknesses, at least from a theoretical viewpoint. In short, this combination yields the following scenario of events.

5-10

 At t0: disturbance inception. At t1 = 150 ms: triggering the generation shedding pre-defined by OLEC. At t2 = 180 ms: based on sets of real-time measurements (supposed to arrive every 20 ms): E-SIME predicts instability size (margin); time to instability (when the system will lose synchronism irrevocably in the absence of control action); CMs) and decides about control action (number of CMs to shed). Further, E-SIME compares the above control action based on the measurements with the one decided by OLEC and already triggered 30 ms earlier, and: if E-SIME assesses the latter to be sufficient, it does not take any additional action but simply continuous monitoring the system, based on incoming sets of measurements; if, on the contrary, it deems the OLEC action insufficient, it predicts the system new transient stability status (new instability size and time to instability), given the action already triggered.

Note that the new time to instability is larger than the one assessed under the assumption of no OLEC action; hence, there is more time left to refine its assessment, if necessary, and/or to make the delay of 300 ms sufficient for preserving the system integrity.
Figure 5-3 sketches the main steps of the above procedure.
TSA periodical analysis (OLEC) 20 minutes TSA periodical analysis (OLEC) Fault

t0
150 ms

t1 t2
Triggering Emergency control action designed by OLEC

t3

Time

TSA simulations

180 ms TSA Predictive Stability Assessment of Emergency SIME simulations using the real-time measurements it receives Updating SPS with a sample rate of 20 ms settings 450 ms (some minutes) Periodical Whenever necessary, triggering Emergency analysis control action designed by Emergency interrumped SIME

Figure 5-3 SIME-based emergency control actions against transient stability (Adapted from [13].)

5.4.2 Voltage stability assessment and control

PREVENTIVE CONTROL Sensitivity analysis Sensitivities computed from the Jacobian matrix of the load flow or long-term equilibrium equations have been used for a long time. Within the VSA context, sensitivities have been proposed as voltage stability indicators, although in practice the latter are not likely to be as meaningful as the power margins provided by ATCs. A central contribution to sensitivity analysis has been provided by [14], where a general formula is obtained for the sensitivity of a loadability margin to parameters. It involves the left eigenvector relative to the zero eigenvalue of the Jacobian matrix computed at a saddle-node bifurcation point.

5-11

This formula was derived within the context of loadability limit computation. An extension to the analysis of post-contingency unstable scenarios was proposed in [15], which involves the computation of sensitivities along the system trajectory and eigenvector at the so-called critical point. Another early approach to the diagnosis of voltage instability relies on the modal analysis of the reduced Jacobian of reactive power with respect to voltages [16]. Information is retrieved from eigenvectors or participation factors relative to real dominant eigenvalues. This approach can suggest instability modes at normal operating points. However, owing to nonlinearities, the analysis has to be performed at the saddle-node bifurcation or at the critical point [17], where the Jacobian has an (almost) zero eigenvalue. The corresponding eigenvector is included in the eigenvector of the unreduced Jacobian, which is preferred in order to exploit matrix sparsity. The above two approaches identify the best remedial actions from the eigenvector of an (almost) zero eigenvalue. This, however, may suffer from two drawbacks. First, dominant eigenvalue computation methods may experience problems when the initial estimate of the dominant eigenvalue is not accurate enough. This is especially true when the loadability limit corresponds to a switching point, where a generator field current limit is imposed, in which case the real dominant eigenvalue jumps from a negative to a large positive value [18]. Second, in practice, voltages are often requested to stay above some thresholds (corresponding for instance to under-voltage tripping of equipments). In some cases, these minimum voltage limits can be more constraining than voltage stability limits. If so, the system response will be already unacceptable before the loadability limit is reached. At the last acceptable operating point, voltages are low but stable and the Jacobian eigenvalues are still on the stable side; hence, the eigenvector computation does not apply. A unified approach that encompasses the low voltage, the zero eigenvalue and the switching loadability limits described above has been proposed in [19], where it is proposed to replace the eigenvector computation by a simple sensitivity calculation which provides very close results, but is non iterative and can still be computed when the system reaches low but stable voltages. This method is combined to time simulation and consists of: identifying bus l that experiences the largest voltage drop (due to the load increase when computing loadability limits, or the contingency when performing contingency analysis); computing the sensitivities of the V voltage at that bus with respect to the candidate controls p (which are most often bus power injections):

Vl Vl = p p1

Vl K pn

(6)

evaluating these sensitivities: - in voltage unstable situations: at the point of the trajectory where a Jacobian eigenvalue passes through zero (this is easily detected through sensitivities changing sign through infinity); - in low voltage situations: at the final point of the system evolution.
It can be shown that in voltage unstable cases, the proposed sensitivities computed near the loadability limit or the critical point, yield practically the same control ranking as the eigenvector-based formula [14] and can be substituted to the eigenvector to compute the sensitivity of the power margin to p . In low but stable voltage cases, the information carried by sensitivities is also meaningful. Last but not least, the method is simple and reliable, since it is non-iterative and requires solving a single sparse linear system only. Security constraints An Optimal Power Flow can be used to optimally modify the controls p so as to restore power margins to a desired value M d . Denoting by M (p o ) the margin corresponding to the current value 5-12

p o of p , the following inequality constraint can be embedded in an OPF:

S j p j
j =1

M d M (p o )

where the sensitivities S j are computed as outlined in the previous section and p j = p j p o j is the change in the j -th control variable. A constraint (13) is considered for each contingency with a margin below of somewhat above the threshold M d . Further details and examples can be found in [19]. A similar formulation has been applied for the optimization of network autotransformer taps in order to maximize loadability margins in the presence of switching loadability limits [H].
Multiple (simultaneous) limits

Switching loadability limits occur when a sudden event, such as the activation of the over-excitation limiter of a generator, causes an immediate instability that prohibiting a further increase in system loading. Such limits can occur simultaneously which results in non-smooth loadability conditions, for which sensitivity formulas and other linearized indices cannot be used without further analysis. [20].

5.4.3 Improved Load Modeling

Loads play an important role in Voltage Stability. Many efforts have been devoted to collecting information about load behaviors and setting up appropriate models. However, work remains to be done in several directions The effect of induction machine load (and generation in some special cases where simple squirrel cage machines are used for wind power generation) is causing significant concern for VSA analysis. QSS simulation can easily incorporate induction machines by adding a single torque equilibrium equation for each motor. Alternatively, aggregate load models can be used that incorporate motor and static loads in a parametric representation. Motor stalling can be identified as a loss of short-term equilibrium and this can be further analyzed using the method outlined in Section 3.3 below. Finally, better models are needed for representing both short and long-term behaviors of load aggregates fed through sub-transmission networks (i.e. the loads seen from the bulk transmission system). The idea of parametric model can be re-used while properly accounting for the losses in the sub-transmission network as well as for the load power restoration by the multiple load tap changers controlling distribution voltages. A different, although somewhat related, issue is the representation of large wind parks in voltage security assessment. Studies are on the way to set up a model offering a good compromise between simplicity and accuracy.
Incorporation of Induction machine models in VSA

The effect of induction machine load (and generation in some special cases where simple squirrel cage machines are used for wind power generation) is causing significant concern for VSA analysis. On-line VSA can easily incorporate induction machines using equilibrium conditions as part of the QSS simulation. Possible short-term voltage instability in this case is identified as a loss of short-term equilibrium and this can be further analyzed using eigenvalue/vector techniques.

5-13

Alternatively aggregate load models can be used that incorporate motor and static loads in a parametric representation.
QSS SIMULATION IMPROVEMENTS AND EXTENSIONS Coupling between QSS and detailed simulations

The QSS approximation is very appropriate for checking voltage security with respect to normal (typically N-1) contingencies [21]. When dealing with severe disturbances, expectedly the QSS model meets some limitations. The first limitation lies in the implicit assumption that the neglected short-term dynamics are stable. After a large disturbance, the system may lose stability in the short-term time frame (within - say - the first 10 seconds after the disturbance) and hence never enter the long-term phase simulated under the QSS approximation. The second limitation is linked to the discrete events. A large disturbance may trigger controls with great impact on the system long-term evolution (e.g. shunt compensation switching, under-frequency or under-voltage load shedding, etc.). Since the sequence of controls depend on the continuous dynamics, it might not be correctly identified from the simplified QSS model. To deal with the above situations, a coupling between detailed and QSS simulation has been proposed in [22]. Detailed time simulation is used to analyze the short-term period following the simulated disturbance, detect possible instability and identify the discrete controls triggered. Next, QSS simulation is used to simulate the same time interval with the discrete controls imposed as external events before letting the system evolve as usual in the long term. Successful results have been obtained on the Hydro-Qubec system, where it is going to be used in combination with the PSS/E software.
Extension to frequency dynamics

QSS simulation belongs to the family of long-term dynamic simulation methods. The QSS model extensively used in long-term voltage stability studies can be extended to incorporate the frequency dynamics that takes place over the same time scale. This extended QSS model relies on a commonfrequency assumption. Its advantages, limitations and possible improvements are discussed in [23] where simulation results are provided on the Hydro-Qubec system, in particular a comparison with full time scale simulation. Disturbances with an impact on either frequency or voltages are considered and the coupling between these two aspects of long-term dynamics is briefly discussed.
Diagnosis of QSS singularities

When the QSS equations stop having a solution, the simulation undergoes a singularity. Reference [24] proposes a method to identify which component(s) are responsible for the loss of equilibrium. The corresponding equations are identified using the Newton method with optimal multiplier. The method has been validated with respect to full time simulation, in cases where long-term voltage instability triggers loss of synchronism. The proposed method enhances the QSS time simulation at very low computational cost and can also help correcting model and/or operating point errors.

5.4.4 References
[1] M. Pavella, D. Ernst and D. Ruiz-Vega. Transient Stability of Power Systems: A Unified Approach to Assessment and Control. Kluwer Academic Publishers, 2000. [2] D. Ernst, M. Pavella, Closed-Loop Transient Stability Emergency Control, Proc. of IEEE/PES 5-14

Winter Meeting, Singapore, 2000. [3] D. Ernst, A. Bettiol, Y. Zhang, L. Wehenkel and M. Pavella. Real Time Transient Stability Emergency Control of the South- Southeast Brazilian System, SEPOPE, Salvador, Brazil, May 1998, (Invited paper, IP044). [4] Y, Zhang, L. Wehenkel and M. Pavella. A Method for Real-Time Transient Stability Emergency Control, Proc. of CPSP97, IFAC/CIGRE Symp. on Control of Power Systems and Power Plants, August 1997, Beijing, China, pp. 673-678 [5] A.G. Phadke, Synchronized Phasor Measurements in Power Systems. IEEE Computer Applications in Power Vo1.6, No.2, 1993, pp. 10-15. [6] A. DelAngel, M. Glavic, L. Wehenkel, Using Artificial Neural Networks to Estimate Rotor Angles and Speeds from Phasor Measurements, ISAP2003, Lemnos, Greece, September 2003, Paper ISAP03/017. [7] A. Del Angel, P. Geurts, D. Ernst, M. Glavic, L. Wehenkel, Real-time Estimation of rotor angles of synchronous machines using artificial neural networks and local PMU measurements, Submitted to Neurocomputing, 2005. [8] D. Ruiz-Vega and M. Pavella. A Comprehensive Approach to Transient Stability Control. Part I: Near Optimal Preventive Control, IEEE Trans. On PWRS, (18), 4, pp. 1446-1453, November 2003. [9] D. Ruiz-Vega and M. Pavella. A Comprehensive Approach to Transient Stability Control. Part II: Open Loop Emergency Control, IEEE Trans. on Power Systems, (18), 4, pp. 1454-1460, November 2003. [10] L. Clarke, M. E. Bradley and A. O. Ekwue. Development of a General Intertrip Monitoring System for the NGC Network. Control Engineering Practice, Vol. 9, pp. 785 789, 2001. [11] CIGRE task force 38.02.19. System Protection Schemes in Power Networks. Technical Brochure. June, 2001. [12] L. Wehenkel. Emergency Control and Its Strategies. Proc of PSCC 1999, Vol. 1, pp. 35-48. Trondheim, Norway, June28-July2, 1999. [13] D. Ruiz-Vega, M. Glavic, D. Ernst. Transient Stability Emergency Control Combining OpenLoop and Closed-Loop Techniques, IEEE PES General Meeting, Toronto, Canada, June 2003. [14] Dobson, I., ``Observations on the geometry of saddle-node bifurcation and voltage collapse in electric power systems'', IEEE Trans. on Circuits and Systems-I, Vol. 39, No 3, pp. 240-243, 1992. [15] Van Cutsem, T., Jacquemart, Y., Marquet, J.-N., and Pruvot, P., A comprehensive analysis of mid-term voltage stability, IEEE Transactions on Power Systems, Vol. 10, pp. 11731182, 1995. [16] Gao, B., Morison, G.K., Kundur, P., Voltage stability evaluation using modal analysis, IEEE Trans. on Power Systems, Vol. 7, pp. 1529-1542, 1992. [17] Morison, G.K., Gao, B., Kundur, P., Voltage stability analysis using static and dynamic approaches, IEEE Trans. on Power Systems, vol. 8, pp. 1159-1171, 1993. [18] Capitanescu, F., Van Cutsem, T., Unified sensitivity analysis of unstable or low voltages caused by load increases or contingencies, IEEE Trans. on Power Systems, Vol. 20, pp. 321329, 2005. [19] Capitanescu, F., Van Cutsem, T., Preventive control of voltage security: a multi-contingency sensitivity-based approach, IEEE Trans. on Power Systems, Vol. 17, pp. 358-364, 2002 [20] C. Vournas, M. Karystianos, Load Tap Changers in Emergency and Preventive Voltage Stability Control, IEEE Transactions on Power Systems, Vol. 19, No. 1, pp. 492-498, February 2004. [21] Van Cutsem, T., Mailhot, R., Validation of a fast voltage stability analysis method on the Hydro-Qubec system, IEEE Trans. on Power Systems, Vol. 12, pp. 282-292, 1997 [22] Van Cutsem, T., Grenier, M.-E., Lefebvre, D., Combined detailed and quasi steady-state time simulations for large-disturbance analysis, Proc. 15th PSCC, Lige (Belgium), August 2005b [23] M.-E. Grenier, D. Lefebvre, T. Van Cutsem, Quasi steady-state models for long-term voltage and frequency dynamics simulation, Proc. IEEE Power Tech conference, St Petersburg, June 2005

5-15

5.5

On-going R&D in Finland

The testing of the on-line estimation of power oscillations started by off-line measurements in February 2004. An 1-year license of the system [1] with an option for a second test year was purchased in the beginning of year 2005. A Master's thesis is under way on the suitability of the online monitoring system [1] for the needs of Fingrid. Fingrid is also currently testing another method of on-line measurement of power oscillation. That method is based on a standard Power Quality (PQ) measurement device in which a tailored analysis software has been installed. The software is based on digital band-pass filtering of the measured active power and on the Fast Fourier Transform (FFT). The system is currently in operation in one substation and monitors the power oscillations on one of the 400 kV interconnecting AC lines between Finland and Sweden. Unlike the other system [1] the one based on a PQ measurement device does not continuously store the active power and the estimated modes of oscillations in memory but only those periods when the amplitude of oscillation exceeds an adjustable limit for an adjustable period of time. It is however possible to remotely inspect the power signal and the band-pass filtered signal continuously in realtime and to compare the measurements with the results given by other on-line monitoring systems. The test period has shown that on-line monitoring of power oscillations can be achieved by relatively inexpensive standard PQ measuring devices and by utilizing basic signal processing algorithms. The modes of frequencies and amplitudes can be estimated satisfactorily. More work is needed if such a system is to be made accessible simultaneously by several users or to be integrated to the SCADA/EMS system. Fingrid is currently planning to purchase a few PMUs and a system for analyzing the measurements. The other Nordic TSOs already have PMUs. By combining the phasor measurements done in the different parts of the synchronously operated power system it is possible to further increase the understanding of power system oscillations and possibly to create better practices for on-line security monitoring. This future work should take place as Nordic co-operation. PMU-measurements can also be utilized as input to the state estimator of the SCADA/EMS-system to improve the accuracy of the contingency analysis in the context of voltage instability.

5.5.1 References
[1] Douglas H. Wilson: Managing Oscillatory Stability using On-line Dynamics Measurement, Power Systems Conference and Exposition, New York, October 2004.

5.6

On-going R&D in Greece

5.6.1 Brief Summary

In isolated island systems with high wind power penetration, dynamic system security and control of frequency are major problems in the operation of the system. A common aspect to these problems is

5-16

the requirement to ensure that sufficient reserve capacity exists within the system to compensate for sudden loss of generation. Fast wind power changes and very high wind speeds resulting in sudden loss of wind generator production can cause frequency excursions and dynamically unstable situations. Moreover, frequency oscillations and high df/dt variations might trigger the under-frequency protection of wind turbines, thus causing further imbalance in the system generation/load. Such changes are more frequent in systems with high wind penetration due to the stochastic nature of wind power production. The dynamic behaviour performance of these systems depends not only on the total load and the size of the conventional units in operation, but also on their location and the response of the available spinning reserve [1]. In order to guard isolated power systems against the consequences of these disturbances it is necessary to keep acceptable security levels in the network. On-line dynamic security assessment and monitoring are very important functions to assure these requirements. The objective of the EU funded CARE (DGXII R&D JOULE Programme, JOR3-CT96-0119) [2] and MORE CARE (Contract ERK5-CT1999-00019) [3] projects financed within the Energy Program, is to develop an advanced control software that will optimise the overall performance of isolated power systems by increasing the share of wind energy and other renewable forms and providing advanced on-line security functions. The main features of the control system comprise advanced software modules for load and wind power forecasting, unit commitment and economic dispatch of the conventional and renewable units and on-line security assessment capabilities integrated in a friendly Man-Machine environment. Advanced inductive inference and statistical methods, as well as artificial neural networks have been used to provide on-line dynamic security assessment and security monitoring in this software, as described next. MORE CARE has been interfaced to the on-line SCADA Data Base and installed in the Control Center of Crete in July 2002. The evaluation of this installation has shown satisfactory performance, clear economic gains and timely assessment of dynamic security.

5.6.2 Crete DSA Context

The Power System of Crete is the largest isolated system in Greece, with the highest increase in energy demand (8%), nationwide[4] . In 2000, when the MORE CARE software was developed, the peak demand was 435MW and the Consumed Energy 2078 GWh. At that time, there were two thermal stations with total installed capacity of 490MW, comprising 20 steam, diesel, and gas turbines units. The latter are used to cover the peak demand at increased costs. The installed Wind Power capacity was 67 MW producing 10% of the energy consumed [4]. The maximum hourly wind penetration exceeded 30% and the maximum monthly wind penetration was 12.7%. Extensive simulations on the power system model using EUROSTAG software have shown that for the most common wind power variations, the system remains satisfactorily stable, if adequate spinning reserve is provided [3]. On the other hand for various short-circuits and conventional unit outages, the system frequency might undergo fast changes and reach low values that can activate load shedding. In any case, the dynamic security of the system depends critically on the amount of spinning reserve provided by the conventional machines and the response of their speed governors. As an example, Figure 5-4 shows the change of the system frequency in two different operating conditions, following the disconnection of three wind parks producing approximately 30 MW. First, the system is considered to operate with 28% of wind power, equal to 46 MW and with fast thermal units, such as the Diesel machines to provide the spinning reserve (fast spinning reserve). The lower value of the frequency is 49.31Hz. Secondly, the system is again considered to operate with the same 5-17

high penetration of wind power, but with the slower machines, such as the steam turbines to cover mainly the spinning reserve plus some Diesel machines (slow spinning reserve). In this case, the lower frequency value, which is equal to 49.04Hz, can possibly cause the operation of the protection devices of the rest of the wind parks. The total wind power disconnection may lead the system to collapse.

Figure 5-4 Frequency change during disconnection of three Wind Parks.

The effect of the wind power penetration, as well as of the response of the available spinning reserve is further shown by simulating the disconnection of a Gas Turbine producing 20MW. In Figure 5-5 the change of frequency and the diesel machine power in three different operating conditions, are shown. First, the system is considered to operate without wind turbines and it seems to be quite stable. Second, the system is considered to operate with 28% of wind power, equal to 46MW and with the fast conventional units, such as diesel machines and gas turbines to be in operation (fast spinning reserve). In this case, the system seems to be stable again. The lower value of the frequency is almost the same as in the previous case. Third, the system is again considered to operate with the same high percent of wind power but with the slow machines, such as steam turbines, to cover the main spinning reserve (slow spinning reserve). In this case, the lower frequency value is equal to 49.14 Hz. This shows that spinning reserve needs to be optimized both in quantity but also in speed of reaction.

Figure 5-5 Frequency and Power change in case of a GT outage

5-18

5.6.3 MORE CARE on line DSA

The MORE CARE software includes various modules for forecasting, operational planning and Security Assessment [5-8]. Its basic architecture is shown in Figure 5-6 .

OPERATOR

SCADA s y s te m

LO AD F O R E C A S T IN G

SCHEDULER

M A N -M A C H IN E IN T E R F A C E

RENEW ABLES F O R E C A S T IN G

D A T A -B A S E

S E C U R IT Y ASSESSM ENT

U N IT C O M M IT M E N T

E C O N O M IC D IS P A T C H

S E C U R IT Y M O N IT O R IN G

Figure 5-6 More-Care Architecture

The Dynamic Security Assessment functions provide on-line monitoring of the system in the event of pre-specified, probable disturbances and detect insecure dispatching recommendations to the operator in preventive mode. Artificial intelligence techniques, like Decision Trees and Artificial Neural Networks have been applied to achieve the essential on-line performance. Figure 5-7 shows the execution cycles and the succession of the MORE CARE modules to generate the power system operation schedules. This flow-chart is appropriate for relatively larger systems comprising steam and diesel or gas units. The power system of Crete is typical of such island systems. Units requiring both longer and shorter scheduling times characterize these systems, therefore both longer and shorter horizon forecasts and unit commitment functions are included. For island systems comprising only diesel units or gas turbines, it is possible to simplify these execution cycles. The following two modules responsible for the evaluation of dynamic security relatively to a number of pre-specified disturbances:

5.6.3.1

The Dynamic Security Assessment Module (DSA)

The security assessment module has the task of evaluating if a given unit commitment dispatch policy is dynamically secure. In case an insecure situation is detected, relevant security constraints are extracted in the form of rules and are supplied as input to the Unit Commitment module. These rules concern attributes relevant to control variables mainly affecting the frequency behaviour of the system, i.e. active generation and spinning reserves of the conventional units and possibly wind production or penetration and active load. The UC is solved again with security restrictions in the form of penalties, provided by the output of ANN and introduced in the fitness function used by the GA approach.

5-19

5.6.3.2

The Dynamic Security Monitoring Module (DSM)

The dynamic security monitoring module is used, upon operator request, for evaluating the dynamic robustness of the economic dispatch module and the present system operating state. As in the DSA Module, the DSM will also provide corrective control measures, i.e. the produced generator set-points will be modified, in case an insecure state is detected.

Figure 5-7 Overview of the MORE CARE execution cycles

5.6.4 Software Description

The following "Learning from examples techniques have been used to provide fast evaluation of system frequency stability by defining security rules and security functions.

5.6.4.1

Decision Trees

The Decision Trees (DT) method, uses an inference inductive procedure, and derives classification structures of the type "if-then-else", able to provide a fast secure or insecure classification of each operating point. The DTs provide an overview and understanding of the dependence of the system's security on its pre-disturbance state. Thus, they have proven suitable not only for the assessment of operating scenarios or states, but also for corrective control advice. If the proper control variables are used as candidate attributes, they are able to provide explicit and quantitative information about the actions to be taken, if a potentially unsafe operating state is detected. The DTs are readily converted to a set of rules that can be very easily stored and incorporated in the security assessment software.

5.6.4.2

Artificial Neural Networks

The Artificial Neural Networks (multi-layer perceptron type), uses as inputs relevant system attributes to provide the frequency deviation and the derivative of frequency relatively to time (df/dt). A previous feature selection stage is performed to select from the initial set of characterizing features the ones that are less correlated with each other.

5-20

5.6.4.3

OFF-Line Modules Preparation

The application of both methods is based on previous knowledge about the behaviour of the system, obtained from a large number of off-line dynamic simulations. A learning set (LS) is required consisting of operating points (OPs), covering the most probable states of the power system under study. Each OP is characterised by a vector of pre-disturbance steady-state variables, called attributes, which can be either directly measured or indirectly calculated. The performance and the reliability of the designed classifiers is evaluated with an independent test set (TS), which has the same structure as the LS, but comprises different OPs of the power system. The DSA learning set has a fixed structure, comprising: A number of pre-disturbance steady-state variables related to frequency, e.g. active powers and spinning reserves of all units, production of wind parks, active loads, wind penetration, etc. (attributes). Three disturbances for which the system safety is assessed. These include outage of a major gas turbine, a three-phase short-circuit and loss of wind generation Two attributes related to frequency that characterise the system safety when subjected to each one of the 3 disturbances, i.e. maximum frequency excursion and frequency rate of change.

5.6.5 Performance and Reliability

The output of the developed models comprises: Minimum frequency value is provided by ANN Rate of change of frequency or maximum rate of frequency for only negative rates is provided by ANN OP classification is provided by the DT and ANN methods. Corrective security rules in the form of ifthenelse are provided by the DT and sensitivity measures by ANN methods. The Decision Tree structure developed for the short-circuit disturbance is shown in Figure 5-8. The attributes selected concern the spinning reserves and operating levels of the thermal units. In this example, the system is classified as insecure, if the Combined Cycle production is less than 54 MW and the Gas turbines provide less than 43 MW. This is apparently related to a lower spinning reserve provided by on-line Gas turbines. In the lower part the performance of the DT structure as tested by the TS is shown.

5-21

Figure 5-8 Indicative D structure and Performance

The ANN trained for the short-circuit disturbance is presented in Figure 5-9 (2 hidden layers with 12 and 8 units). The 17 inputs include the power productions and spinning reserves of all units, the load, wind power and wind penetration. The testing set (TS) errors obtained with this ANN are presented in the lower parts of Figure 5-8. In this figure, each point represents one OP of the TS, where its vertical distance to the diagonal presents the prediction error of the ANN to that OP.

Figure 5-9 ANN structure and Performance

5-22

Figure 5-10 Display of DSA results

In Figure 5-10 , the Dynamic Security Assessment results for 48 hours ahead, are displayed in a form of lines that represent the frequency that is expected in case of the considered disturbances under the predicted load demand and wind production. The acceptable limits of the frequency (49-51 Hz for Crete) are also shown. The upper waveform shows the forecasted load, while the lower curve the forecasted wind power.

5.6.6 Proven Benefits

Figure 8 shows the information recorded during the trip of a 17 MW Gas Turbine on the 23rd of June 1999. In Table 5-1 this is compared to the security assessment output.
Table 5-1 Data for Disturbance of 23rd June 1999

Actual Data from SCADA

TOTAL PRODUCTION

CARE Security Assessment

329,1 MW

DISTURBANCE FREQUENCY

Trip of a 17 MW Gas Turbine with small droop 50.02 Hz to 49,46 Hz

Trip of a 25 MW Steam Unit with high droop 49,4 Hz

From Figure 5-11 it can be seen that the frequency drop predicted by the security assessment is very close to reality considering the differences in the disturbance assumed. On the 25/10/2001 the Crete system experienced a total blackout [11]. The collapse of Crete system was due to cascading unit outages initiated by the loss of a gas turbine of the combined cycle unit. Figure 5-12 displays the frequency deviation assessed by the DSA module based on Neural Networks during October 2001. It is shown that although the disturbance that initiated the system collapse was different than the ones used to train the security modules, the DSA modules have successfully assessed insecure operation. The security modules were evaluated on actual load, wind and economic scheduling data. In the same figure the frequency deviation assessed by the DSA module based on the

5-23

proposed scheduling of the UC and ED MORE CARE functions. The improvement in the Dynamic Security performance of the system is noticeable.

Security Assessment on 23/6/1999

R e a l F re qu e n c y De via tion s F re q ue n c y D e via tion As s e s s m e nt

5 0,5 50 Fre q ue n c y 4 9,5 49 4 8,5 48 4 7,5 11 13 17 19 21 1 3 5 7 9 15 2 4 -h o u r 23

Figure 5-11 Actual Frequency compared to Frequency Deviation Assessment

Figure 5-12 October 2001 frequency deviations resulting from three disturbances, as assessed by the MORE CARE Neural Network function based on actual operation and based on the proposed operation.

5.6.7 REFERENCES
[1] CARE: Advanced Control Advice for power systems with large scale integration of Renewable Energy sources, contract JOR3-CT96-0119, Final Report, August 1999. [2] MORE CARE Final Report, NTUA, April 2003 [3] N. Hatziargyriou, E. Karapidakis, D. Hatzifotis, Frequency Stability of Power Systems in large Islands with high Wind Power Penetration, Bulk Power Systems Dynamics and Control Symposium IV Restructuring, Santorini, August 24-28, 1998. [4] John Stefanakis,CRETE: An ideal Case Study for Increased Wind Power Penetration in Medium Sized Autonomous Power Systems, IEEE PES Winter Meeting 1999.

5-24

[5] N. Hatziargyriou, J.A. Pecas Lopes, E. Karapidakis, M.H. Vasconcelos, On-Line Dynamic Security Assessment of Power Systems in Large Islands with High Wind Power Penetration, 13th Power Systems Computation Conference (PSCC), Trondheim, Norway, 28 June 2 July 1999. [6] N. Hatziargyriou, J.A. Pecas Lopes, J. Stefanakis, E. Karapidakis, M.H. Vasconcelos, A. Gigantidou Artificial Intelligence Techniques applied to Dynamic Security Assessment of Isolated Systems with High Wind Power Penetration, 2000 Session of CIGRE, Paris, August 2000. [7] J. Pecas Lopes, N. Hatziargyriou, H. Vasconcelos, J.N. Fidalgo, D. Georgiadis, E. Karapidakis, Dynamic Security Evaluation Functions in the MORE CARE Project, Proc. of MedPower02, MED02/005 Athens, Nov 2002. [8] N.Hatziargyriou ,A.Dimeas, A.Tsikalakis ,A. Gigantidou, E. Thalassinakis, Intelligent Techniques applied to the Economic and Secure Operation of Island Systems with Large Wind Power Penetration, Proc of ISAP03 Conf., ISAP 03/162, Lemnos,Sept 2003. [9] Control Functions for Secure Operation of Isolated Power Systems, N.Hatziargyriou, J.A. Pecas Lopes, M.Matos, PSCC02, 24-28 June 2002, Sevilla, Spain. [10] On-Line Preventive Dynamic Security of Isolated Power Systems Using Decision Trees, E. Karapidakis, N. Hatziargyriou, IEEE Trans. on Power Systems, May 2002, Vol. 17, Nr. 2, pp. 297-305. [11] J. Syllignakis, D. Georgiadis, N. Hatziargyriou ,Study of collapse of the Crete System due to large power generation loss, Proc. of MedPower02, MED02/286 Athens, Nov 2002.

5.7

On-going R&D in Italy

5.7.1 Examination of Steady State and Dynamic Assessment Approaches

5.7.1.1

Introduction

Due to the increasing power exchanges and new transactions, congestions are likely to occur in transmission grids, which will be operated closer and closer to their limits [1][2][3]. The operation under stress forces power engineers to provide fast and reliable tools to correctly compute security levels, considering both thermal and voltage constraints in different time-frames [4]. Security margins can be evaluated by different approaches, models and goals: the main available tools are steady state (SP) and time-domain dynamic (DP) procedures, characterized by a different degree of complexity in both modeling and interpretation of results; another procedure available for large real power systems relies on Quasi Steady-State approximation [5], which replaces the transient differential equations with equilibrium equations, resulting in a procedure that is conceptually a time-domain simulation, but characterized by a high computational efficiency. Depending on the system features, on the phenomenon under study, on the limiting constraints, the first or the second approach may be more suitable, and the results obtained may be more or less in agreement [6][7]. The SP tools are easier to use, do not require data difficult to collect and allow the determination of effective control actions; the DP tools allow the power engineer to study very accurately the power system behavior, provided that the data available are complete and updated: these requirements are not always easy to put into practice. Therefore, it is not trivial to study the same scenarios and operating conditions using both SP and DP and to compare their results with the field tests (in particular, e.g., for the analysis of significant perturbations). The results of this analysis allows the ISOs to use the SP for the screening of the most dangerous situations, and the DP tools and models only for those scenarios requiring the most accurate methodology. SP and DP can be

5-25

integrated to provide reliable information on the power system security against different phenomena. In the following, the results achieved on a real large power system, put in evidence the agreement between the steady state and the dynamic procedures in use at the Italian ISO (TERNA) to assess security. In order to focus on an application of modern EMS, the actual and peculiar issue of the interconnection between Italy and the remaining part of the UCTE system (called in the following foreign system) is considered. The computation of loadability margins through this border is important due to the increasing internal demand of cheap power to be imported from neighboring countries. The integrated framework of SP and DP has shown in particular: the loadability margins: both tools are adopted to evaluate the impact of a load ramp through the interconnection lines between Italy and the foreign system. Both N and (N-1) security constraints are considered, i.e., a detailed contingency analysis of the critical lines is carried out; the security enhancement due to the application of the Hierarchical Voltage Control (HVC). In the Italian transmission network, the voltage control is achieved by a hierarchical structure [14][15], made by a primary level (Primary Voltage Regulation, PVR), given by the generator AVRs, a Secondary Voltage Regulation (SVR) and a Tertiary Voltage Regulation (TVR). Both SP and DP procedures allow the simulation of the Secondary Voltage Regulation (SVR), which is already partially in operation in the Italian EHV system. The study cases used in the project are based on the Italian EHV system together with the UCTE network in both the current operation and some planned scenarios. The results show a good agreement between the SPs and DPs in the assessment of both the contingency severity and the impact of the SVR. Complete details of the project are given in [18].

5.7.1.2

SP and DP Tools Used

SICRE (Dynamic Analysis) The DP adopted for this study is based on SICRE [8], an interactive power systems dynamic simulator, covering different time-scale phenomena and modeling levels (grids, units, control systems and protections). It can simulate both electromechanical and long-term dynamics: an automatic adjustment of the models and larger integration steps allow speeding up the simulation when the electromechanical phenomena and the fast control loops reach their new steady state conditions. VOSTA (Steady-state Analysis) VOSTA (VOltage STAbility) [9][10] is the SP developed for the voltage collapse analysis, assuming that the involved dynamics are very slow. This assumption allows representing the behavior of the system by the power flow (PF) equations where also the steady state models of the primary and secondary voltage controllers and the voltage dependence of loads can be included. The SP adopted can perform: a reliable estimation of the MW distance of the current operating point from the voltage collapse conditions, through an iterative procedure based on successive load and generation increases along user-defined patterns; the computation of control actions to reduce the risk of voltage collapse: reactive compensation, load shedding and generation re-dispatch; the contingency screening and ranking, useful for (N-1) security analysis concerning both generators and lines.

5.7.1.3

Comparison and integration of SP and DP

The comparison and the integration of the SP and the DP approaches is based on the simulation of a slow load ramp. The adopted SP determines, at each step of the load ramp (in this case discrete):

5-26

a) the indices of the voltage collapse margin; b) the ranking of the critical contingencies; c) the pre-contingency secure power flow on the critical lines. The severity of each contingency is then evaluated by the Time Domain Simulation (TDS) on the basis of: d) the maximum post-contingency system loadability (PCL); e) at a particular load level P0, the trip of all the lines in the contingency set is simulated and, for the critical ones, the relevant time to collapse is computed. In both sets of dynamic tests, the PCL (point d) is computed starting from the outaged system in the base case loading conditions and increasing the load with a continuous slow ramp; this is carried out for all the lines in the contingency set. The contingency ranking computed in d) and e) is compared to the ranking evaluated in b) and c). The results show that it is suitable to filter contingencies using SP and to use the more detailed TDS only in the most critical cases. The possibility to integrate steady state and dynamic procedures is checked also from the voltage control point of view. Two different voltage control strategies, PVR and SVR, are investigated to evaluate the model adequacy, highlighting the HVC beneficial impact given by the coordination among area reactive resources, feature not available in PVR.

5.7.1.4

Tests and results

The simulations have been performed on the Italian EHV-HV network (400kV/230kV/132kV) in its interconnected operation with an equivalent model of the UCTE system. In the complete system (1400 nodes), about 200 generators supply a load of about 150 GW. The base case used is pertinent to the morning peak of a March 2001 working day. In the SP, the load ramp is applied to the Italian system busses and the incremental generation is supplied by the foreign system generators, thus resulting in the increase of the power flows through the interconnecting lines. The ramp at each bus is performed at a constant rate, according to load distribution factors evaluated at the base case. Four indices are used [11] for the contingency ranking: the sensitivities of max with respect to the considered line admittance and to the real power flow, both in absolute value and weighted by the initial admittance/flow value respectively. Table 5-2 shows the ranking based on the index ( max Pij )Pij after a 5000 MW load ramp that heavily loads the Italian network. The comparison of the SP results based on the power flows and on the admittances (columns I and III) shows a good agreement between the two SP ranking procedures. The efficiency of the ranking procedure has been tested by the TDS, first determining the PCL according to point d). A continuous 100 MW/minute load ramp is assumed, that can be considered slow on a system with 45 GW load. The TDS results are depicted in Figure 5-13 to Figure 5-16: the curves show the voltages of two pilot nodes as the load ramp proceeds (the contingencies take place at the beginning of the load ramp and therefore the initial transient due to the trip is not shown). Due to the ramp constant rate and to the constant PQ load model, the total load is proportional to the time: actually, Figure 5-13 to Figure 5-16 are obtained as (t,V) curves and can show only the upper part of the conventional (PV) curves; the remaining portion could be obtained, e.g., by a Continuation Power Flow (which is actually a SP). Bold lines are relevant to the intact network (no contingency); the other lines show the voltage profiles after a major single contingency (using the abbreviations of Table 5-3).

5-27

Table 5-2 - Ranking of the critical lines calculated after a 5000 MW load ramp
LINE Bulciago-Soazza Musignano-Lavorgo Rondissone-Albert. RondissoneTurbigo Cagno-Musignano Rondissone-Albert. Magenta-Pallanzeno Cislago-Sondrio Bovisio-Bulciago Sils-Soazza Marginone-Spezia Castelnuovo-Trino Soverzene-Lienz Spezia-Vingnole LacchiarellaLaCasella Scorz-Soverzene Villarodin-Venaus Baggio-Castelnuovo Bovisio-Verderio Vado-Vignole Gorlago-Verderio Redipuglia-Divaca Baggio-Lacchiarella Cagno-Cislago Leyni-Valpelline
max y yi j max yi j
max Pij Pi j
max Pi j

2.571 1.529 0.867 0.748 0.694 0.649 0.656 0.583 0.558 0.542 0.517 0.487 0.474 0.451 0.424 0.434 0.408 0.342 0.328 0.313 0.288 0.281 0.256 0.249 0.248

110012 42097 70788 21883 6.3 53142 17633 40343 4.3 14123 17782 12348 27544 24832 5.2 20370 5.9 5.6 2.5 6.8 2.7 4.1 1.1 1.4 14487

2.602 1.553 0.899 0.781 0.713 0.690 0.670 0.594 0.569 0.552 0.528 0.510 0.479 0.474 0.443 0.438 0.417 0.369 0.339 0.333 0.298 0.288 0.263 0.260 0.254

2.259E-04 1.434E-04 1.063E-04 9.839E-05 7.873E-05 8.387E-05 1.701E-04 2.384E-04 6.815E-05 5.220E-05 7.007E-05 7.536E-05 1.387E-04 2.416E-04 7.766E-05 1.439E-04 4.415E-05 7.381E-05 5.321E-05 8.048E-05 6.513E-05 4.276E-05 3.316E-05 3.787E-05 8.553E-05

All contingencies in the contingency set have been simulated; the results of the TDS show that the trips that most limit the PCL are captured by the SP (bold in Table 5-2). Some exceptions are justified by the network topology: according to the ranking, the line Redipuglia-Divaca seems to be not particularly critical, while it does according to the TDS: actually, the Italian system interconnection with Slovenia is made by a 400 kV line, in parallel to a 230 kV line; therefore, the first line must be operated at a low load and this results in an underestimation of the ranking index. The results of TDS for some contingencies are not shown: the line Bovisio-Bulciago, because it is in series to the line Bulciago-Soazza, already considered; the Marginone-Spezia, because not interested by exchanges with the foreign system. The Rondissone-Albertville is a double circuit: in Table 5-2, only the single trip is considered, while in Table 5-3 and Figure 5-13 to Figure 5-16 both the single (R-A1) and the double (R-A2) trips are evaluated. The voltages of the pilot nodes S.Rocco (Milan area) and Casanova (Turin area) are shown both with (Figure 5-14 and Figure 5-16) and without (Figure 5-13 and Figure 5-15) SVR in operation. The comparison of Figure 5-13 with Figure 5-14 and Figure 5-15) with Figure 5-16 and the analysis of Table 5-3, give further information on the SVR benefits: the SVR does not affect the DP ranking, but optimizes the reactive resources, allowing larger PCL. The security margins are always larger (about 400 MW more), for each contingency considered. The S.Rocco and Casanova voltages (Figure 5-14 and Figure 5-16) behave differently when the SVR is in operation. In the considered scenario, the Casanova area (Figure 5-16) has an average load level, with enough reactive margins on the controlling generators: thus, the regulator is able to keep the scheduled profile (400 kV) until area reactive resources are available. On the contrary, at a 2000 MW load ramp, the S.Rocco area is heavily loaded and the reactive margins of its generators are already exhausted: the regulator is not able to keep the scheduled voltage profile and the voltage progressively decreases (Figure 5-14). The oscillations in Figure 5-15 and Figure 5-16 are caused by the interactions between the AVRs of some generators (in the 220/132 kV system), close to the Casanova pilot node, that reach their reactive capability limit.

5-28

390

390

VOLTAGE [kV]
V-V B-S M-L R-A2 C-M R-D 5000

370

370

VOLTAGE [kV]

350

350

330

330

310

R-A1 R-T 5500 6000

310

R-A2 B-S M-L C-M

R-T V-V R-A1 R-D

290 2000

2500

3000

3500

4000

4500

LO AD RAM P [M W ]

290 2000

2500

3000

3500

4000

4500

5000

5500

6000

6500

Figure 5-13 - Voltage in the node S.Rocco (PVR), static load.

400

LOAD RAMP [MW]

Figure 5-14 - Voltage in the pilot node S.Rocco (SVR), static load.
390

380

VOLTAGE [kV]

360

VOLTAGE [kV]

370

350 C-M B-S R-T R-D R-A1 R-A2 M-L V-V

340

C-M R-T

330

320

B-S M -L R-A2 V-V

R-D R-A1

310

300 2000

2500

3000

3500

4000

4500

5000

5500

6000

LOAD RAM P [M W ]

290 2000

2500

3000

3500

4000

4500

5000

5500

6000

6500

Figure 5-15 - Voltage in the node Casanova (PVR), static load.

LOAD RAMP [MW]

Figure 5-16 - Voltage in the pilot node Casanova (SVR), static load.

Table 5-3 Loadability of the Italian network starting from the base case
LINE TRIP Bulciago-Soazza (B-S) Musignano-Lavorgo (M-L) Rondissone-Albertville (double circuit) double trip (R-A2) Rondissone-Albertville single trip (R-A1) Rondissone-Turbigo (R-T) Cagno-Musignano (C-M) Venaus-Villarodin (V-V) Redipuglia-Divaca (R-D) INTACT SYSTEM MAX LOAD RAMP IN PVR 4362 4562 4766 5395 5429 5012 4966 5283 5720 MAX LOAD RAMP IN SVR 4840 5015 5049 5729 5812 5312 5399 5650 6133

5.7.1.5

References

[1] K.Bhattacharya, M.J.Bollen, J.E.Daalder, Operation of restructured power system, Kluwer Academic Series in Engineering and Computer Science, 2001. [2] C. Caizares, ed., Voltage Stability Assessment: Concepts, Practices and Tools, IEEE/PES Power System Stability Subcommittee Special Publication SP101PSS, July 2003. [3] W. Rosehart, C. Caizares, and V. Quintana, Costs of Voltage Security in Electricity Markets, Proc. IEEE/PES Summer Meeting, Seattle, July 2000. [4] T. Van Cutsem, C.D. Vournas, Voltage stability analysis in transient and mid term time scales. IEEE Trans. on Power Systems, Vol. 11, n.1, February 1996. [5] T.Van Cutsem, R.Mailhot, Validation of a fast voltage stability analysis method on the HydroQubec system, IEEE Trans. on Power Systems, Vol. 12, n.1, February 1997. [6] B.H. Lee, K.Y. Lee, Dynamic and static voltage stability enhancement of power systems, IEEE Trans. on Power Systems, Vol. 8, n.1, February 1993. [7] G.K. Morrison, B. Gao, P. Kundur ,Voltage stability analysis using static and dynamic approaches, IEEE Trans. on Power Systems, Vol. 8, n.3, August 1993. 5-29

[8] P. Baratella, P. Scarpellini, R. Marconato, B. Cova, E. Gaglioti, R. Zacheo, "A power system simulator covering different time scale phenomena: models, algorithms, MMI and test results", Proc. Stockholm Power Tech, pp.376-381, Stockholm, June 1995. [9] A.Berizzi, P.Bresesti, P.Marannino, G.P.Granelli, M.Montagna, System-area operating margin assessment and security enhancement against voltage collapse, IEEE Trans. on Power Systems, vol.11, n.3, pp.1451-1462, 1996. [10] A.Berizzi, P.Finazzi, D.Dosi, P.Marannino, S.Corsi, First and second order methods for voltage collapse assessment and Security Enhancement, IEEE Trans. on Power Systems, vol.13, n.2, pp.543-551, 1998. [11] A.Berizzi, M. Merlo, Y.G. Zeng, P. Marannino, P.A. Scarpellini, Determination of the N-1 Security Maximum Transfer Capability through Power Corridors, IEEE Power Engineering Society Winter Meeting, 23-27 January 2000, Singapore; [12] C.A. Canizares, N. Mithulananthan, A.Berizzi, J.Reeve, On the Linear Profile of Indices for the Prediction of Saddle-node and Limit-induced Bifurcation Points in Power Systems, accepted for publication on IEEE Trans. On CAS, part I. [13] C.A. Canizares, A.C. de Souza, V.H. Quintana, Comparison of performance indices for detection of proximity to voltage collapse, IEEE Trans. on Power Systems, Vol. 11, n.3, pp. 1441-1449, Aug. 1996. [14] S. Corsi, P. Marannino, N. Losignore, G. Moreschini, G. Piccini, "Coordination Between the Reactive Power Scheduling and the Hierarchical Voltage Control of the EHV Enel System", IEEE Trans. on Power Systems, Vol. 10, n.2, 1995, pp. 602-608. [15] S. Corsi, "The Secondary Voltage Regulation in Italy", Panel Session on Power Plant (High Side) Voltage Control, IEEE/PES 2000 Summer Meeting, 16-20 July 2000. [16] P. Marannino, F. Zanellini, M. Merlo, S. Corsi, M. Pozzi, G. DellOlio, Evaluation of Load Margins with Respect to Voltage Collapse in Presence of Secondary and Tertiary Voltage Regulation, Bulk Power system Dynamics and Control V, Onomichi City, Japan, August 2631, 2001. [17] F.Saccomanno, Electric Power Systems, IEEE Press, John Wiley & Sons, 2003 [18] A.Berizzi, P.Marannino, M.Merlo, M.Pozzi, Fabio Zanellini "Steady-State and Dynamic Approaches for the Evaluation of Loadability Margins in the Presence of Secondary Voltage Regulation", IEEE Transactions on Power Systems, Vol. 19, No. 2, May 2004.

5.7.2 DSA-Integrated Load Shedding Scheme for Emergency control 5.7.2.1 Introduction

The growing security and stability needs, recently pushed in the Italian power network by the ongoing privatization and liberalization processes, strongly demand for a more powerful and affordable emergency control system, capable to effectively accommodate and optimize, on-line, both preventive and corrective remedial actions. At the same time, the availability of advanced methods for emergency control, as well as of the recent telecommunication facilities and progressive equipments, permits to develop and implement sophisticated protection schemes, mainly called Special Protection Systems (SPS), which may represent a solution to improve the transmission network security level in a deregulated scenario. The theoretical approaches, which have largely investigated in the past for the Static and more recently for Dynamic Security Assessment (SSA and DSA), represent an interesting and useful starting point for a revision process of the Italian defense plan. The Italian ISO, TERNA (formerly GRTN), has initiated some years ago such a process, mainly promoting the refurbishment of the existing system for automatic shedding toward an 'Evolved System for Automatic Shedding'

5-30

(ESAS)[6]. ESAS, based on the integration of SSA and DSA tools with a sophisticated loads/units interruption system, aims to automatically selects the most suitable remedial actions, in a predefined set of allowed maneuvers, for mitigating contingencies scenarios. The corrective remedial actions are autonomously activated on field and selected on the basis of preventive static and dynamic security analyses. ESAS, conceived for the real-time static and dynamic security assessment and control, represents an evolution of an existing system, actually in operation at TERNA, monitoring overload and tripping events of a set of tie lines, called "critical network sections" (cross-border or internal). Such evolution has addressed very substantial improvements, as mainly concerns the system architecture, the protection goals, the adaptation rules, the loads/units selectivity and the control room operators diagnostics.

5.7.2.2

The Italian Defense Plan

The Italian power system had in 2001 a total installed capacity of about 79 GW (21 GW hydro plants, 57 GW thermal plants, 1 GW renewable plants), for an overall energy consumption of 327 TWh (here included auxiliary systems and pumping units), 279 TWh coming for the internal power production and 48 TWh from the neighboring countries exchanges. The Italian transmission system has an overall extension of 65.000 km, here included both AC and DC lines; 16 interconnection border lines and 267 power stations. For such a large electrical system, an effective defense plan had to be conceived, including all the automatic and manual control actions capable to maintain/restore the power system itself, otherwise passing through an alarm status or evolved to an emergency status. The Italian Defense Plan [1] includes two main levels of remedial actions, those related to the interconnected system operation and those conceived for the islanded grid condition. The first level remedial actions are: control of the "critical sections" through a system for automatic shedding (SAS) with fixed thresholds; programmed fast tripping of critical generating units through Automatic Tele Tripping Equipment (ATTE); manual operation of Emergency Maneuvering Console (EMC), for medium voltage and residential loads, and Interruptible Maneuvering Console (IMC), for high voltage industrial loads; programmed action of the Emergency Plan for System Security (EPSS) for rolling blackouts. The following remedial actions belong to the second class: autonomous load shedding action based on frequency relays with fixed thresholds; programmed fast tripping of some relevant generating units by Automatic Tele Tripping Equipment (ATTE).

5.7.2.3

The Existing System for Automatic Shedding

For the Defense Plan a set of 420 kV electrical lines is defined as "critical section" if their cascade tripping could evolve to network separation. In the Italian transmission grid the emergency control of critical sections is achieved by a system which aims to prevent separations, interrupting a certain amount of loads in a very short time (less than 1s). The system trigger is a line tripping event detected in predefined conditions, essentially related to fixed thresholds of power flows through the lines in critical section. Therefore, the operation of this system requires the acknowledgment of both a structural and an operational critical state of the

5-31

controlled section. In particular, the section is considered "operationally critical" if at least one of the following conditions is satisfied: over-exceeding the so-called "low" power threshold in any lines belonging to section with (k+2) where k lines are out of service; over-exceeding the so-called "high" power threshold in any lines belonging to section with (k+3) where k lines are out of service; Being in principle very different the post-contingency scenarios to be faced, the amount and localization of load to be shedded depends on which lines were out of service in pre-fault conditions, as well as on which threshold has been over-exceeded and which line has tripped. Until now, the structural design of the critical section configuration and power thresholds, as well as the remedial actions, have been off-line defined, based on steady-state and transient studies with different grid configurations and load-flow conditions. In general, the goals of the pursued remedial actions were: possible overloads on 420 kV and 245 kV lines have to be limited accordingly to their thermal security limits; under-voltage violations have to be everywhere contained and not associated to voltage instability phenomena; starting and action of line distance protections, following the electromechanical transients due to remedial interventions, have to be carefully prevented. Considering the Italian transmission network, the main cross-border and internal critical sections are: the overall cross-border section between Italy, France, Switzerland and Austria (Slovenia excluded); the partial cross-border section between Italy and France; the internal section between the Northern Italy and the Central Italy grids; the internal section between the Southern Italy and the Sicily island grids.

5.7.2.4

The Evolved System for Automatic Shedding

For the last 15 years the existing automatic shedding system have been proving itself to be very effective in increasing the system operation security, mainly in case of contingencies involving lines within critical sections. More precisely, for its design characteristics and conservative tunings, this system has never exhibited lacks of intervention; on the contrary, at least in one case, an inadequate intervention was experienced. However, the complete electric service after the unnecessary shedding was restored in 10 minutes. Due to the increase of power flows and the creation of new critical sections, TERNA [2, 3] has recently initiated the renovation of the existing system toward an evolved one (ESAS), with the goal to solve also some drawbacks and limitations: ESAS will be designed and erected through a flexible and modifiable architecture, based on state of art of standard telecontrol and network protocols; ESAS will control critical sections continuously following their configurations (i.e. for the insertion of phase-shifter transformers). Then, an adaptation of power thresholds and load shedding strategies will be implemented; ESAS will control sections which are not always structurally critical but could become critical only in particular market scenarios or weather conditions; ESAS will adapt the load shedding amount to the actual operating conditions related to the critical section, without the risk to activate, for facing the current contingency scenario, an insufficient or excessive interruption; ESAS will completely control the cross-border section, including the Slovenia border, and will monitor both the national and the foreign sides of the other border lines; ESAS will take into account of the actual load conditions as well as of the possibility to shed pumping units;

5-32

ESAS will be rich of diagnostic information for the control room operator (commands, alarms, warnings).

The goal of ESAS is to apply flexible intervention criteria and shedding strategies on the information coming, in real-time, from SCADA and EMS. At the same time ESAS should integrate SSA and DSA tools with a sophisticated loads/units interruption architecture, distributed on the field and based on standard tele-control equipment and protocols. These key features, which represent the basis for ESAS architecture (Figure 5-17), can be logically subdivided in two modules: the analysis module (ESAS-Analysis) is devoted to study, in both static and dynamic viewpoints, the grid reactions that follow a set of plausible single and multiple contingencies, which are by operator choice or automatically screened and ranked from a specific routine. The analysis module provides, at a preventive stage and starting from the current network state estimated from EMS, the list of possible steady-state and transient network violations, associated to each critical contingency in the examined set, and their index risk; the control module (ESAS-Control) is devoted to define, solving a linear programming constrained problem, the optimal load shedding remedial action, on the basis of the actual load forecast or measurements coming from SCADA. For each critical event, this module provides the list of necessary interruptions to be executed, at a corrective stage. In other words, ESAS-Analysis determines the IF part of the logical rules, distributed on the shedding architecture for their autonomous activation. The THEN part of such rules is defined by ESASControl. It aims to achieve a certain corrective security level N-k.

5.7.2.5

The functions of the ESAS-Analysis module

The ESAS-Analysis module computes the steady-state and transient responses of the power system, modeled in detail by sophisticated simulation tools [4, 5] and initialized from the current network state estimation. The list of contingencies may be manually set by operators, or defined according to a statistic extraction, or achieved from the historical archive of the really occurred contingencies. In alternative the contingencies of the list may be automatically screened and ranked based on a N-1 static security or sensitivity analysis. The complete system, which describe about 450 units, 1000 transformers and lines, 800 loads and some equivalent networks, have to be analyzed. The TD simulations and data analysis lasts from few seconds up to a couple of minutes in the worst cases where voltage or transient instability arise. A parallel computation on a different HW platform perform static N-1 analysis on the same system. This lasts for about a couple of minutes for the whole system, longer when stressed system occurs. The static and dynamic post contingencies responses of the power system are examined in terms of both steady-state violations and dynamic transients, such as voltage instability or collapse, transient instability, cascade line tripping.

5.7.2.6

The functions of the ESAS-Control module

The ESAS-Control module computes the real and reactive power amounts CPC and CQC, to be shed for facing the examined dangerous contingencies. These amounts are associated to a combination of load interruptions or generator trippings, derived from an on-line solving of an optimization problem. At the same time, it tries to mitigate different violations and to reduce the shedding strategy costs. Once solved this problem, the ESAS-Control module verifies also the effectiveness of the suggested remedial actions, whenever such a verification is not implicit in the optimization method. More precisely, the critical scenarios associated to static events may be directly solved and verified by non-linear approaches, such as resolution methods with integrated load-flow. On the contrary, critical scenarios associated to dynamic events may be firstly solved by linear

5-33

approaches, such as sensitivity based methods, and then post-verified with the complete dynamic analysis and simulation of corrective actions. To formulate the control problem as a linear programming one, the sensitivity matrices between the singular real and reactive sheds, PC and QC, and the risk indices are necessary. The verification of shedding strategy is performed by means of the same procedures previously used by the ESAS-Analysis, in presence of contingency scenarios inclusive of corrective control remedial actions. The possible causes of imprecision, requiring the introduction of conservative coefficients, are: linearization error, affecting both the computation of the sensitivity matrices and the related superposition effects. This error may be attenuated using realistic shedding amounts during the sensitivity computation phase, as well as introducing suitable corrective factors depending from the instantaneous values of the active and reactive shed; modeling error, related to the description of actual loads behavior. This error may be reduced using more precise static and dynamic models, mainly for large voltage or frequency variations in the post-contingency scenario; biasing error, suggesting too much extended shedding maneuvers, mainly in case of significant network violations with reduced shedding resources. This error may be attenuated pre-filtering too low sensitivity values, related to components very far from the violations.
Network extimated status

SCADA EMS

ASP
CONTINGENCY LIST
(CALCULATED) Load list Constraints Costs Contingence by manual entry

N-1 Static

Signals Measurands

Security Analysis Non linear

Dynamic Security Analysis Linear control Verification of dynamic violations

LSPUs
Armament

resolution of static violations

RTUs
Alarms

ATTE, SAS, IMC, EMC loads/generating units

Load shedding/tripping strategy

LSPU/RTU Communication interface

Figure 5-17 Overall architecture of the Automatic Shedding Processor (ASP): on the left side it is shown the interconnection of existing ATTE, SAS, EMC and IMC (exchanging with Load Shedding Peripheral Units - LSPU - and Remote Terminal Units RTU: tele-measurements TM, tele-signals TS, alarms and rules), on the right side it is shown the architecture of SSA and DSA modules, providing ESAS-Analysis and ESAS-Control functions, acquiring information from SCADA and EMS (state estimation), and exchanging data with ATTE, SAS, EMC and IMC (load configuration and measurements, control rules and sensitivity data).

5-34

After these analyses, which can take some minutes, it is foreseen that the central system remotely prepares (arms) the peripheral devices, in the grid sections potentially exposed to static or dynamic risks, with the corrective control actions needed to face the related critical contingency. The armament is calculated and implemented upon each significant variation occurring of the power systems operating condition. A prototype of the ESAS-Analysis and ESAS-Control modules has been running under experimentation at TERNA. At present, ESAS project appears quite well conceived and the related prototype is giving very promising results. The ESAS-Prototype will be a benchmark at TERNA for the static and dynamic security assessment methods, as well as for the preventive and corrective emergency control approaches, whose interest will certainly increase in the new deregulated energy market scenarios. Future developments will foresee the integration of the voltage and phases measurements coming from a set of Phase Measurements Units (PMU) already planned inside the TERNA Wide Area Measurement System (WAMS). As an example, the detection of dynamic instability could firstly focus the dynamic analysis on specific areas of the power control.

5.7.2.7

References

[1] TERNA, "Piani di difesa del sistema elettrico", Documento IN.S.T.X.1006, http://www.terna.it, in Italian. [2] TERNA, "Sistema di elaborazione distacchi automatici, Specifiche funzionali generali", Documento DRRPX02006, http://www.terna.it, in Italian. [3] L.Franchi, A.Gambelunghe, R.Salvati, M.Sforna, "Online Dynamic Security Assessment at the Italian Independent System Operator", Bologna IEEE Powertech, 2003. [4] M.Agostinelli, G.Demartini, L.Franchi, M.Mocenigo, "CRESO: an efficient use of the on-line data with a suite of programs for the off-line network analysis", CIGRE SC39 Colloquium, June 1989. [5] P.Baratella, P.Scarpellini, R.Marconato, B.Cova, E.Gaglioti, R.Zacheo, "A power system simulator covering different time scale phenomena: models, algorithms, MMI and test results", IEEE Powertech, 1995. [6] A.Danelli, G.Giannuzzi, M.Pozzi, R.Salvati, M.Salvetti, M.Sforna, "A DSA-integrated shedding system for corrective emergency control", 2005 Power Systems Computation Conference, August 22-26, 2005, Liege, Belgium.

5.8

On-going R&D in Romania

5.8.1 Introduction
In the context of electricity market operations, a common scenario consists of compensating load increases and/or generation outages in a system area by raising the generation elsewhere. In order to ensure that the grid does not get too close to its stability limits, it is therefore important to evaluate the maximum transfer capability across the "links" that interconnect the areas involved in such transactions. A "link" identifies a group of transmission lines that form a topological cut-set, i.e., their removal splits the network in two areas, one on each side of the link. The maximum power that can be transferred across a link is limited by thermal and stability constraints. The stability limit of a link can be quantified by the further loading of the link, i.e., the additional amount of power that can be sent

5-35

from one side of the link to the other side, without causing instability. This indicator, which is referred to as the stability reserve of the link, can be expressed either in MW or in percentage from the maximum link loading. In a sense, the concept of "stability constrained link" is similar to the concept of congestion path, with the difference that the former is concerned with stability, rather than thermal, violations. "Stability constrained links" may appear in any multi-area power system where large MW blocks are transferred between weakly interconnected areas. This is often the case in longitudinal transmission networks that span distinct system areas with significant load-generation unbalances. The analysis of recent blackouts due to instability revealed that most of them followed a similar pattern: Large MW blocks get transferred from areas with inexpensively priced energy toward areas where the load demand has increased due to an actual increase in load, or perhaps because one or several local generating units are scheduled for maintenance, or simply because the local generation is too expensive As a result, certain links get loaded closer and closer to their stability limits and their stability reserves get smaller and smaller At this moment, a generation or transmission outage takes place. Typically, such incidents evolve into cascading outages Since the link was already operating with a small stability reserve, the physical phenomena leading to blackout are triggered and the wide-spread disturbance becomes unavoidable. The detection of critical links is an intrinsically difficult proposition. To begin with, the search of all the possible links entails a graph topological procedure that may find hundreds of thousands of links even for moderately sized networks. Once the full set of links has been determined, a stability criterion should be used to compute the maximum transfer capability of each link. Then, the links need to be ranked in the order of their stability margins. In addition, it should also be possible to evaluate user-defined links. Recognizing the fact that current network analysis technologies neither provide for quickly detecting the security constrained links nor have the ability to recommend what generating units should be acted upon in order to avoid the blackout, significant research has been performed during the last decade to develop an innovative method that solves this complex problem thoroughly and expeditiously.

5.8.2 Approach Background

Traditionally, the operating reliability studies encompass: Load-flow and contingency analysis Stability assessment An important goal of stability assessment is to determine whether the system can withstand a list of large, yet credible, contingencies. This is the realm of transient stability analysis [6], [7]. An equally important objective is to evaluate the risk of approaching instability in small steps, e.g., via small load changes accompanied by slow changes in the bus voltages that may trigger a voltage collapse, or by gradual load changes that may eventually cause one or several generators to get out of synchronism. Traditionally, this topic has been addressed by steady-state stability analysis [3], [4], 13]. Steady-state instability occurs when a change of the state variables causes the Jacobian matrix associated with the dynamic state equation to become singular. One might think that instability happens in only one way regardless of how the system conditions were stressed, or "worsened", in order to reach the limit. Published references, however, indicate that the network characteristics that

5-36

generate the most probable system stressing patterns should be taken into account when selecting the procedures and indicators used for steady-state stability analysis. For vast interconnected systems, it is therefore essential to assess stability when large blocks of power are transferred across the network. This, in turn, requires evaluating the maximum transfer capability across the link, i.e., between the areas that get involved in the transactions, when a reduction in generation in one area is compensated by raising the generation elsewhere. Potentially, there are many such links in the network -- some with adequate margins to further increase the MW transfer without risk of instability, but some others where a further loading of the link might cause steady-state instability. The early identification of such stability constrained links is imperative for the operating reliability of the transmission system.

Stability Reserve of the Link

The stability reserve (steady-state stability margin) of the link can be expressed in terms of the further link loading, i.e., the additional amount of MW that can be transferred between the areas separated by the link, before reaching steady-state instability. The stability reserve of the link is an indicator computed by applying a steady-state stability criterion which assumes that the system is stressed by increasing the MW transfer between the areas on the two sides of the link. In order to identify the stability constrained links, a systematic search of all the possible links must first be performed, followed by the evaluation of each link and, finally, by ranking them in the order of their stability reserves. Given a solved load-flow case or a state estimate, the approach described originally in [9], [10] consists of: Detecting all the links within the transmission system Computing the steady-state stability reserve for each link Ranking the links in the order of their steady-state stability reserves Recommending a control strategy, i.e., raise or lower the MW output of certain machines, which can help increase the stability margin of the link. There are situations where certain links are known before hand. Therefore, the actual implementation of this technique also must provide for performing the same array of calculations on user-defined links. An additional, and obviously important requirement is that the computations be fast enough to enable the fast evaluation of the power transfers between areas known a priori to have stability limitations -- as often as needed, for each transaction, off-line and in real-time.

5.8.3 Algorithm
The first step of the algorithm consists of parsing the original power system transmission network and identifying all the available links. Figure 5-18 depicts schematically a link that separates the power

Figure 5-18 Original system separated in two areas by a link

5-37

system network in two areas. In order to determine how much additional power can be transferred between Area 1 and Area 2 before reaching the steady-state stability limit of the link, a network transformation must be applied to convert the original system to a simple network consisting of two equivalent generators interconnected through an equivalent link. An efficient and elegant solution to this otherwise difficult problem is achieved by building a special type of REI equivalent with 2 REI generators and 2 REI loads [5], [8], [11], [12]. The generators situated in Area 1 are aggregated in the equivalent REI generator REI G1, whereas the generators situated in Area 2 are aggregated in the equivalent REI generator REI G2. Similarly, the loads in each area are aggregated in the REI L1 and REI L2, respectively. Then, after the REI reduction has been performed, an equivalent model consisting of two generators connected by a link is obtained, as shown in Figure 5-19,

Figure 5-19 Power transferred between Area 1 (equivalent generator G1) and Area 2 (equivalent generator G2) across the equivalent link

where:

(1)

E1 = E1 arg 1 and E 2 = E 2 arg 2

are the e.m.f. of generators G1 and G2

(2)

12 = 1 2
Z 12 = Z 12 arg 12

(3) (4)

is the reciprocal (transfer) impedance of the equivalent link, i.e., the transmission system between equivalent generators G1 and G2.

12 = 900 12

(5)

5-38

From the maximum power transfer theorem [2], [13], the maximum power that can be transferred from Area 1 towards Area 2 is calculated with:

P12 max =

E1

Z 12

sin 12 +

E1 E 2 Z 12

(6)

at the critical angle given by:

12 crt = 900 + 12
According to Venikov, the stability reserve of the link in Figure 1 is given by;

(7)

R=

P12 max P12 P12 max

(8)

The alternate expression of the steady-state stability indicator R given in (9):

R = 1

P12 P12 max

(9)

provides the percentage amount of additional amount of power that can be carried across the link up to the limit of steady-state stability. Substituting P12 and P12 max from (1) and (6) we get:

R=

1 sin ( 12 12 ) 1+
E1 E2

(10)

sin 12

Let's note that the formulae (1) through (10) were originally developed for the very simple case of two generators connected by a line (Venikov) but here we applied them to an equivalent network consisting of two equivalent generators connected through an equivalent link. It may be useful to show how the values of E1 = E1 arg 1 and E 2 = E 2 arg 2 are derived in this case. Pomrleanu and Bejuscu [9], [10] have shown that the power generated by the machines in the Area 1 that are aggregated in G1 is given by:
m m m S g1 * * S1 = E1 . I 1 = S g 1 = E1 I 1 = E1 g g =1 g =1 =1U

(11)

g1

where:

S 1 - complex power generated by the REI generator G1

E1 - complex e.m.f. of REI generator G1 I 1 - complex current of REI generator G1

5-39

S g 1 - complex power generated by the machine g that is aggregated in the REI generator G1
I g 1 - complex current of generator g
U g 1 - complex voltage at the terminals of generator g
Based on these notations we obtain;

E1 =

g =1

S g1
m

g =1

S g1 U g1

= E1 arg 1

(12)

The generators m+1 ... n in Area 2 are aggregated in the REI equivalent generator G2:

E2 =

g = m +1

Sg2
n

g = m +1

Sg2 U g2

= E 2 arg 2

(13)

The transfer impedance Z 12 of the equivalent link results from the REI network reduction process. The accuracy of this technique has been verified by comparing its computational results with those obtained by using a conventional steady-state stability program [1]. In all the cases that were evaluated the difference between the stability reserve of the link computed with this method, on one hand, and the additional amount of power that could be transferred between the two areas determined with the conventional stability program, on the other hand, was in the range of 10% of the stability reserve, i.e., if the conventional stability program computed a stability reserve of 30%, the value determined with this technique was in the range of 27% through 33%. An early implementation of the algorithm described in this document has been used for quite sometime in an actual control center and the results obtained to date confirm the solidity of the technique and its suitability for detecting stability constrained links in a large transmission system.

5.8.4 Topological Search of all the Links in the Network

The identification of all the links in the transmission system is performed by using a graph topological search technique. Starting from each node of the graph (bus in the transmission network) new edges (lines and/or transformers) are added until a link, i.e., a group of edges that separate the network in two separate areas, is identified. Throughout this process, the numbers of generators assigned to Area 1 and, respectively, Area 2 change continuously but their sum remain constant. Also, if new links containing previously links are disregarded. Let's note that the aggregation of generators is based on topological considerations, rather than type (thermal, hydro, etc.) or ownership. The percentage of 90% of generator nodes identified in an area is used as a criterion for having completely covered the area.

5.8.5 Detection of Stability Constrained Links

For each one of the links identified during the topological search described above, a two-REI generator equivalent is built in accordance with the previously algorithm E1 , E 2 , 1 , 2 are

5-40

computed from (12) and (13); 12 is obtained from (3). The value of the transfer impedance between the equivalent generators G1 and G2 is Z 12 arg 12 and the angle 12 is given by (5). We can now determine directly from (10), for each link, the value of its stability reserve. The last step of the procedure consists of ranking all the links in the decreasing order of their stability reserves. For practical purposes, only the most dangerous links are retained in the final list of stability constrained links.

5.8.6 Remedial Action

Once the stability reserve of the link has been computed, the program identifies how the generators in both areas should be acted upon in order to unload the link, i.e., to reduce the transfer across it. Let's say the power is transferred from Area 1 towards Area 2. Increasing the stability reserve of the link, i.e., reducing the amount of MW that cross it, can be achieved by raising the generation in Area 2 and simultaneously lowering the generation in Area 1. The generators in each area are identified and the required control action +/-, i.e., raise/lower, is displayed in the output results.

5.8.7 Conclusions
The algorithm described in this section and further documented in [9], [10] solves a contemporary, and extremely important, problem: the stability of power transfers across vast interconnected systems. It determines the stability reserves of all the links in the network and ranks them in the order of their distance to instability, thus allowing the program user to identify those links that are potentially dangerous. The actual implementation of this solution technique [14] is fast and robust and is suitable for off-line and in real-time, in system and market operations, and for a broad range of operational and planning studies.

5.8.8 References
[1] Arie E., Pomrleanu M., Bejuscu L., Botgros M. - Determinarea rezervei de stabilitate static a sistemelor electroenergetice complexe - Studii i cercetri de energetic i electrotehnic - Tom 23, vol. 3, 1973 [2] Barbier, C., Barret, J.P., 1980, An Analysis of Phenomena of Voltage Collapse on a Transmission System, Revue Gnrale de lElectricit, 89, 7, pp. 3-21 [3] Crary, S. B., 1945, Power System Stability, General Electric Series, Schenectady, New York, Copyright 1945, Third Printing October 1955 [4] Dimo, P., 1961, Etude de la stabilit statique et du rglage de tension, Revue Gnrale de lElectricit, Paris, 70, 11, 552-556 [5] Dimo, P., 1975, Nodal Analysis of Power Systems, Abacus Press, Kent, England [6] Kundur, P., Morison, G. K., 1993, Classes of Stability in Todays Power Systems, IEEE Transactions in Power Systems 8 T-PWRS, 3, pp. 1159-1171 [7] Kundur P. - Power System Stability and Control - Mc Graw - Hill - 1994 [8] Oatts, M.L., Erwin, S.R., Hart, J.L., 1990, Application of the REI Equivalent for Operations Planning Analysis of Interchange Schedules", IEEE Transactions on PAS, PAS-109, 5, 1990, pp. 547-555 [9] Pomarleanu, M., The Selection and Ranking of Power System Dangerous Cuts, Symposium Bulk Power System Dynamics and Control IV Restructuring, Santorini, 1998, 08 24-28 [10] Pomarleanu, M., Bejuscu, L., Selectarea operativa a seciunilor unui sistem electroenergetic cu rezervele de stabilitate statica cele mai mici, Energetica 47, nr. 2, 1999 [11] Tinney, W. F., Powell, W. I., 1977, The REI Approach to Power Network Equivalents, PICA'77 Conference, May 1977, Toronto, Canada

5-41

[12] Savulescu, S.C., 1981, Equivalents for Security Analysis of Power Systems, IEEE Transactions on PAS, Pas-100, 5, 1981, pp. 2672-2682 [13] Venikov, V. A., 1977, Transient Processes in Electrical Power Systems, English Translation, MIR Publishers, Moscow [14] http://www.eciqs.com

5.9

Intelligent Systems for On-line DSA

There are significant opportunities for the introduction of intelligent system for use in on-line DSA. Many on-line DSA systems in use today may be referred to as deterministic systems since they rely largely on enumerated analytical solutions. Intelligent systems are seen to have four features which can bring benefits to the real-time environment,

Intelligent systems can be very fast. Although distributed computation is now commonplace, full simulation methods require minutes of time to reach a conclusion. For large power systems in which many contingencies must be assessed, even with multiple-CPU computing, this time may be of concern and for on-line analysis, time is critical; particularly if a system is entering an insecure state and decisions must be made quickly. Once developed, IS technologies such as neural networks (NN) or decision trees (DT) can provide solutions very quickly. Intelligent systems are learning systems. Deterministic systems will conduct the same computations every cycle even if some of the calculations could be deemed inconsequential or if conditions arise rendering the computations less accurate. IS systems have the ability to establish if a system condition has been seen previously and predict the solution accordingly. Similarly, if properly designed, an IS can adapt to new conditions by learning from situations previously seen. Intelligent system can provide a high degree of discovery. Discovery refers to the ability to uncover salient, but previously unknown, characteristics of, or relationships in, a system. For example, through the development of NN or DT, the system parameters which are crucial to security can be established, much in the same way as an operator would discover such traits over extended periods of time by observing the system behavior. Intelligent systems have the ability to synthesize large volumes of data into manageable and meaningful information. Considering the potentially massive volume of data provided from system measurements and simulation results, the ability to sift through such data and collate the useful results is critical for DSA systems.

The role of intelligent systems is seen as one that is complementary to the so-called deterministic DSA approach. The concept is that an IS will supervise the DSA and perform the following functions,

Establish if the system security can be established without full simulations determine what full simulations may be required assist in the interpretation of the simulation results and provide insight into system critical parameters learn from the results of simulations assist in the specification of remedial actions

Based on the above functions, the IS can provide (a) fast computational abilities with learning capabilities and/or (b) supervision to existing on-line systems, much in the same way that a human operator could if sufficiently experienced and fast.

5-42

Numerous applications of artificial intelligence methods to power system security have been reported. A review of some recent examples is detailed in the following. An automatic learning framework for power system security assessment, proposed in [18], is illustrated in Figure 5-20 . Random sampling techniques are considered to screen all relevant situations in a given context, while existing numerical simulation tools are exploited to derive detailed security information.

Figure 5-20 Machine learning framework for security assessment

The heart of the framework is provided by machine learning methods used to extract and synthesize relevant information and to reformulate it in a suitable way for decision-making. This consists of transforming the data base (DB) of case-by-case numerical simulations into a power system security knowledge base (KB). As illustrated in Figure 5-20 , a large variety of automatic learning methods may be used here in a toolbox fashion, according to the type of information they may exploit and/or produce. The final step consists of using the extracted synthetic information (decision trees, rules, statistical or neural network approximators) either in real-time, for fast and effective decision-making, or in the off-line study environment, so as to gain new physical insight and to derive better system and/or operation planning strategies

5.9.1 Supervised learning methods 5.9.1.1 Artificial Neural Networks

The field of artificial neural networks has grown since the early work on perceptrons to an important and productive research field. Figure 5-21 illustrates the classical feed-forward MLP. The first or input layer corresponds to the attribute values, and the last or output layer to the desired security classification or margin information. Intermediate layers enable the network to approximate arbitrarily complex input/output mappings, provided that its topology and its weights are chosen appropriately.

Figure 5-21 Feed-forward MLP

5-43

In recent years, much progress has been made in improving efficiency of optimization techniques for the learning procedures of MLPs, but the MLPs are still very slow at the learning stage, which may prevent extensive experimentations for data base sizes typical of security assessment of realistic power systems. One of the difficulties with MLPs comes from the very high number of weights and thresholds related in a nonlinear fashion, which makes it almost impossible to give any insight into the relationship learned.

[3] proposes a family of small ANNs with different network parameters whose estimates are combined through a voting mechanism, as illustrated in Figure 5-22 in order to have a better performance than a single large ANN.

Figure 5-22 Proposed model

The authors in [25] discuss an approach to on-line assessment of power system dynamic security using modular neural networks. This paper presents a first attempt to use the emerging technology of ANNs as a dispatcher's aid for power systems dynamic security assessment. In [2] ANN are applied to power's system DSA. The paper copes with the curse of dimensionality in power systems and proposes a methodology for feature selection. A case study is performed on the IEEE 50-generator system to illustrate the effectiveness of the proposed techniques.

5.9.1.2

RBFs

[11], proposes Radial Basis Function (RBF) Neural Networks to assess the security of the Greek mainland power system. Radial functions are a special class of function. Their characteristic feature is that their response decreases (or increases) monotonically with distance from a central point. The centre, the distance scale, and the precise shape of the radial function are parameters of the model, all fixed if it is linear. The most general formula for any RBF is

5-44

where is the function used, c is the centre and R is the metric. The term the distance between the input vector x and the centre c in the metric defined by R.

is

Often the metric is Euclidean. In this case R=r2I for some scalar radius r and where I is unity diagonal. If Gaussian, (z)=exp-z, is used then (1) simplifies to transfer function,

Its parameters are its centre c and its radius r and monotonically decreases with distance from the centre.

Each of d components of the input vector x feeds forward to M basis functions whose outputs are linearly combined with weights wj, j=1M into the network output f(x), as,

and the free variables are the weights $\w$.

The model f is expressed as a linear combination of a set of M fixed functions h which are often called basis functions. The flexibility of f, its ability to fit many different functions, derives only from the freedom to choose different values for the weights. The basis functions and any parameters, which they might contain, are fixed. If this is not the case, that is, the basis functions can change during the learning process or if there are more than one hidden layer, then the model is non-linear. Linear models are simpler to analyze mathematically. In particular, if supervised learning problems are solved by least squares then it is possible to derive and solve a set of equations for the optimal weight values implied by the training set. The same does not apply for nonlinear models, such as multi-layer perceptrons, which require iterative numerical procedures for their optimization. The proposed method has been applied to security classification of the Greek Mainland system projected to 2005 with increased wind power penetration in a critical area. The voltage level in the area is used to clarify security. For the verification of the method experiments have been performed using independent input load and wind data produced with a random procedure and the classification of each testing sample has been compared with the one of the corresponding stored testing sample.

5.9.1.3

Support Vector Machines

The foundations of SVMs have been developed by Vapnik [26]. The method is gaining popularity due to its many attractive features, and promising performance [9,10]. The main idea of a SVC is to construct a hyperplane as the decision surface, in such a way that the margin of separation between positive and negative examples is maximized. The machine achieves this desirable property by following a principled off-line approach rooted in the statistical learning theory. More precisely, the SVM is an approximate implementation of the method of Structural Risk Minimization (SRM) [9,10]. This induction principle is based on the fact that the error rate of a learning machine on the test data (i.e. the generalization error rate) is bounded by the sum of the training-error rate and a term that

5-45

depends on the Vapnik-Chervonenkis dimension(VC). The VC dimension is a measure of the capacity of a learning machine. A notion that is central to the construction of the support vector learning algorithm is the innerproduct kernel between a ``support vector'' xi and the vector x drawn from the input space. The support vectors consist of a small subset of the training data extracted by the algorithm. Depending on how this inner-product kernel is generated, different learning machines may be constructed, characterized by nonlinear decision surfaces of their own. In order to apply SVMs to regression problems, an alternative loss function that includes a distance measure needs to be defined. There are several kinds of loss functions, as, the conventional least squares error criterion, the -insensitive loss function, the Laplacian loss function and Huber's loss function.
Support Vector Classifiers

For a two-class partition a probability distribution P(x,y) is assumed, where for every input row (sample or operating state in our application) x \in Rn, y{-1,1} which is the corresponding class, i.e. secure or insecure. The SVC seeks an optimal separating hyperplane between the input vectors which belong to classes. This problem can be made easier if the vectors are mapped from the input space to a higher dimensional space H which is called feature space. The mapping is, : Rd --->H. The ,where M is equal to the dimensionality of the feature hyperplane assumes the form, space and is a non-linear function. This is a linear separating hyperplane on the feature space. This can be reformulated as, the inner product kernel defined as, presented as a Lagrange optimization is formed as, , where ai are the Lagrange multipliers. K is called . The optimization problem

subject to the constraints, Radial basis functions most commonly use a kernel of the form,

Note that the number of basis functions, the center parameters, that correspond to the support vectors and the weights in the output layer are all automatically determined via the optimal hyperplane. All basis functions have the same width parameter which is specified a priori.

Support Vector Regressors

The problem of approximating the set of data, , where xRn, y R$, by a function that has at most deviation from the targets (y_i) and is as flat as possible [30], is considered. Initially, a linear function of the form, f is considered,

The task is to minimize the empirical risk, condition , where c0 is a constant.

, subject to the

The loss function L(y)has the form, 5-46

A more challenging problem is to aim at solving the nonlinear regression task. Similar to the case of nonlinear classification, this will be achieved by considering a linear regression hyperplane in the socalled feature space. Then function f becomes The optimal regression function is given by the minimum of the function,

subject to the constraints, C is a pre-specified value and a trade off between flatness of $f$ and the amount up to which deviations larger than can be tolerated. the outputs of the system. are slack variables representing upper and lower constraints on

Then the problem is transformed into the dual form of the Lagrange optimization task and the solution is given by,

where

are the Lagrange multipliers, with constraints,

where K(xi,xj) is defined as in the SVC case, i.e. parameters must be defined by the user. Solving equation (9) with constraints (10) determines the Lagrange multipliers, regression function is given by,

The two and C , and the

5.9.1.4

Decision trees

The Decision Tree (D.T.) is a tree, structured upside down, built on the basis of a Learning Set (L.S.) of pre-classified states [4,13,15,28]. The construction of a D.T. starts at the root node with the whole L.S. of pre-classified O.Ps. At each step, a tip-node of the growing tree is considered and the algorithm decides whether it will be a terminal node or should be further developed. To develop a node, an appropriate attribute is first identified, together with a dichotomy test on its values. The test T is defined as:

5-47

The subset of its learning examples corresponding to the node is then split according to this dichotomy into two subsets corresponding to the successors of the current node. A more detailed technical description of the approach followed is described in [15,28]. D.Ts are evaluated using the Testing Set (T.S.). The most important evaluator of the D.T. reliability and performance is the rate of successful classifications, defined as the ratio of successfully classified O.Ps to the number of O.Ps tested. Decision trees have been quite extensively studied in the context of various security assessment problems [1,4,15,17,21]. A main asset lies in the explicit and logical representation of the induced classification rules and the resulting unique explanatory capability. In particular, the method provides systematic correlation analyses among different attributes and identifies the most discriminating attributes at each tree node. From the computational viewpoint it is efficient at the learning stage as well as at the prediction stage. In [31] DTs methodology not only performs DSA but also focuses on the application of DTs for the determination of optimal reserves and the provision of corrective advice. More specifically based on the DT classification, new unit dispatch is calculated on-line, until a dynamically secure operating state is reached. This technique provides the flexibility of displaying the cost of each proposed solution, it can therefore be used as a valuable on-line decision making aid. Results from the application of the method on actual load series from the island of Crete are presented. It is believed that the fast execution times required by the DTs for classification make the method suitable for online control of larger systems. Figure 5-23 illustrates the implementation of dynamic security function in the on-line control software.

Figure 5-23 Implementation of dynamic security function in the on-line control software.

5-48

[21] demonstrates how decision trees can be constructed off-line and then utilized on-line for predicting transient stability in real-time. A non-trivial power system is simulated (New England 39 bus test system),under increased loading conditions in order to exhibit instances of instability caused by faults less than 8 cycles in duration (typical breaker failure time).Stability prediction is based on a short (8 cycle) window of realistic-precision, post-fault phasor measurement. A single tree is constructed to handle all fault locations in the network, including all the bus faults as well as randomly located line faults. Faults in the test set range from 1 to 8 cycles in duration. Every fault that is simulated is cleared by removing the faulted transmission line. The trees are constructed for a particular loading condition, but their robustness to variations in the operating point is investigated using a test set of 40,800 faults from 50 randomly generated operating points. A decision tree designed to work for arbitrary fault locations must have a sufficiently diverse training set. The training set contains examples of three-phase, short circuit to ground faults on either end of every transmission line with the transmission line removed at clearing time. Faults of several durations are simulated for each location. Each example contains the post fault phasor measurements, along with whether the fault produced instability. A decision tree is generated to fit the training set, and then tested on new, unseen data.

5.9.2 Unsupervised learning methods

In contrast to supervised learning, where the objective is clearly defined in terms of modeling the underlying correlations between some input variables and some particular output variables, unsupervised learning methods are not oriented towards a particular prediction task. Rather, they try to identify existing underlying relationships among a set of objects characterized by a set of variables or among a set of variables used to characterize a set of objects. Thus, one of the purposes of clustering is to identify homogeneous groups of similar objects, in order to represent a large set of objects by a small number of representative prototypes. Graphical, two-dimensional scatter plots may be used as a tool in order to analyze the data and identify clusters. Another application of the same techniques is to identify similarities (and redundancies) among the different attributes used to characterize objects. In the context of power system security both applications may be useful as complementary data analysis and preprocessing tools. The Kohonen self-organizing map (SOM) memory runs an unsupervised clustering algorithm. It is easily trained and has attractive properties such as topological ordering and good generalization. Kohonen Self Organizing Maps has been applied successfully in DSA and SSA [5,7,19,29]. The drawbacks of the method are on the one hand that it uses fixed network architecture and on the other hand that hierarchical relations between the input data are not mirrored in a straightforward fashion (Kohonen, 1999). Two approaches to resolve these limitations are the Growing Hierarchical SOM and the Growing Neural Gas. Below the application of GHSOM and GNG on DSA is discussed

5.9.2.1

Growing Hierarchical Self Organized Map

In [32] a GHSOM-based method is presented to calculate the estimate security index so that an output neuron calls the index corresponding to an input pattern. The effect of the control parameter for the depth/shallowness of the GHSOM is examined and the effectiveness of the proposed technique is demonstrated in a IEEE 9 bus power system.

5-49

Figure 5-24 Proposed model

The overall structure of the devised neural architecture is illustrated in Figure 5-24 . The Projection Network with Stochastic Interconnects (PNSI) is a supervised three-layer ANN which models an inputoutput relationship by clustering both input and output spaces and establishing a correspondence between the clusters of the two spaces by viewing the training data only once [16]. The pre-fault state vector is the input of an array of PNSIs which work in a parallel way. Their purpose is the fast prediction of the post-fault state vector for each contingency. The learning phase of the PNSIs is performed on a main training set composed of pre-fault and post-fault state vector pairs of every outage for many operating points of the power system. The number of the hidden layer units is not to be determined a priori, but adapts automatically to the learnt data. The outputs of the PNSIs are then fed into a GHSOM which has been trained for classifying the postfault vector in several bidimensionnal maps. The GHSOM training set is composed of the post-fault state vectors for all the contingencies. The underlying idea is that the generalization properties of the GHSOM which adapts its architecture during its unsupervised training process and when trained on a set of the post-fault state vectors, it could fix the rough estimates obtained by the PNSIs.

5.9.2.2

Growing Neural Gas

The GNG was proposed by Fritzke [8]. Similar to the SOM, feature vectors wj are distributed in an input space of training data. In contrast to the SOM, the neighboring structure will also be defined in the training process. Connections cvw can be set or deleted between states sv and sw and their feature vectors wv and ww. These connections represent the topological structure of the data space. Figure-5-25 shows the structure of the GNG and an example.

5-50

Figure-5-25 Structure of the GNG and an example of connected feature vectors in an input space

The advantage of growing neural gas is that the number of feature vectors and connections is not fixed. They will be adapted in a continuous process. An adaptation to a changing input data space can be realized easily. The principle accuracy of the input space representation is greater because of a higher degree of freedom in comparison to the SOM. On the other hand, the visualization of the results is not possible.

5.9.3 Probabilistic Neural Networks for On-line DSA

An online supervised learning method for multiclass classification of power system frequency stability ,tested with on-line data from an actual power system, is presented in [33]. The method is general and can be applied to all types of stability problems, by simply changing the security classification criteria. It is based on Probabilistic Neural Networks (PNNs) [27,34], and it is capable to capture automatically network changes. Figure 5-26 illustrates a Probabilistic Neural Network.

Figure 5-26 Probabilistic neural network implementation for one class c with input of dimension d.

5-51

The d components x1,...xd of the multivariate input X are forwarded to the hidden layer, whose activation functions (Gaussians) are used to compute the kernel densities fj(x), with mean j and variance j2, computed from the learning procedure, for all kernels j = 1,...,Kc, of class c. The outputs of the hidden layer are multiplied by the respective weights computed from the learning process and the output unit sums its inputs to compute . Typically there is one PNN for each possible class. Its output provides the corresponding classconditional Probability Density Function (PDF) p(x|c), where c is the class, and x is the input vector. These probabilities can be used in a subsequent decision-making stage to arrive at a classification. For the input PDF a particular parametric model, called finite Gaussian mixture model, is used. This model allows application of a parametric method of evaluating PDFs [22,24] that can be implemented by a feed-forward neural network. It approximates the unknown PDF by a mixture of Gaussian kernels, the parameters of which are computed from the set of the input samples, which are taken sequentially, one at a time. The number of kernels, their parameters and weights are iteratively estimated from the input samples using the Maximum Likelihood (ML) process. Simple statistical tests involving the mean, the variance and the kurtosis of the kernels are employed in order to decide when a kernel should split in two or when two kernels should join in one. Similarly, a simple test involving the mixing weight of a kernel to decide upon its removal, is used. This technique has been preliminary presented in [33]. The security structures developed by the on-line learning method show adaptability to changing operating conditions, when applied to the power system of Crete. Two distinct operating situations of the system with different distributions (non stationary), are identified. First the system is considered at its current configuration and seconds its future operation after the installation of a pumped hydro storage plant. For the verification of the method, experiments have been performed using actual load and production time-series provided by the EMS system. It is shown that the method is capable to adapt its security structures even to drastic changes of the system configuration.

Study Case System

The proposed method is applied to the Crete, island of Greece, power system in order to classify its dynamic security by on-line supervised learning. The Crete system is the largest isolated system of Greece, with an installed capacity of 572 MW, a peak load of 514 MW (summer 2002) and a low load of 114 MW. The generation system comprises two power plants, in Central and Western Crete, which consist of steam, gas and diesel units, and one combined cycle plant. Eleven wind parks with an installed capacity of 68.3MW are currently connected at the eastern part of the island reaching occasionally 30\% or higher wind power penetration, especially in low load periods. As an isolated system with no interconnections with larger ones, the Crete system experiences frequency stability problems in the event of generation outages. Operation with increased share of wind power deteriorates the problem, as wind turbines are non-controllable sources that cannot provide extra power in case of a power unbalance. The installation of a pumped hydro plant in the Crete system is currently studied. The operation of this system offers significant economic advantages and allows a better exploitation of the available wind power. In the proposed application two training sets are used. Each training set consists of 6552 patterns or operating points (OPs), each with its corresponding security status. The first training set corresponds to the current case of the Crete system and is based on actual operating points taken hourly from the database of the Crete Energy Management System. This is termed as system current case. The second training set corresponds to a future case of the Crete system that includes the operation of the hydro plant. This is termed as system future case. The OPs are labeled accordingly to classes, as follows: 5-52

IF V_min <= 0.9 THEN the system is insecure (class B) ELSE the system is secure (class A)

Results

Figure 5-27 and Figure 5-28 show the dynamic variation of the number of kernels (dashed line) for the training set of the future case of the system, during the training process for the secure (A) and insecure (B) class, respectively. In the described application the class-A density is approximated with a number of kernels up to 97 and the class-B density with up to 76 kernels. The larger number of kernels corresponds to rather unobserved and thus more difficult to learn samples. At each learning step n, the security of the current sample is evaluated using the PNN structures of the previous n-1 steps. In other words the current sample is used for testing and subsequently used for training. This is equivalent to use testing data that are decoupled from the training data. At each learning step, the success rate is calculated with two ways, first from the number of samples that were successfully classified in all previous n steps and second from the number of samples that were successfully classified in the last 500 steps. The second way provides a more objective index, as the first one has a rather masking effect on the calculations. The results are displayed by continuous (all previous steps) and dashed-dotted (last 500 steps) lines in Figure 5-27 and Figure 5-28 . It can be seen that the success rate exceeds 90 percent after the first 4135 samples for the secure state and after the first 485 samples for the insecure state in case of testing with all previous samples.

Figure 5-27 Dynamic variation of the number of kernels (dashed line) compared to the success rate (continuous and dasheddotted line) during the class B training process for the current-future case

5-53

Figure 5-28 Dynamic variation of the number of kernels (dashed line) compared to the success rate (continuous and dasheddotted line) during the class A training process for the current-future case.

5.9.4 Application of Decision Trees for On-Line DSA

One example of an IS technology developed for on-line use is the POSSIT project [34]. Completed in 2004, a software environment was developed which can use intelligent systems together with existing dynamic security assessment software to provide very fast on-line transient stability assessment of power system transient stability limits. The approach uses Decision Trees (DT) and Regression Trees (RT) as the primary component in the IS. This approach was chosen due to the maturity of DT and RT tools and their natural and simple fit to the power system problem. The concept is to develop DT onto which any given system condition (i.e snapshot in the form of a solved powerflow from the state estimator) can be dropped and the outcome of the tree used to establish the security of the system. The POSSIT environment allows the trees to be generated quickly and updated as new unseen system conditions occur. In this sense the system is learning system. Also, as noted earlier, the branches of the trees provide valuable information regarding the critical system parameters for which the system stability is most sensitive. The structure of the IS is shown in Figure 5-29. To initially develop the decision trees, a very large Data Base (DB) is created, using the Scenario Generator tool, which consists of a large number of objects, each representing a power system precontingency state (effectively, each object is a set of key attributes from a powerflow solution) together with the results (stable or unstable) of a transient stability simulation for a contingency as shown in Figure 5-30 . The stability condition reported in the DB is established using a full time-domain simulation. Prior to running the time-domain simulations, the Engineered Attribute Selector may be used to specify which output quantities (such as bus voltages or generator output powers) should be eliminated or retained. This assists in reducing the output database size. The large database can be interrogated and reduced to eliminate redundant data using special clustering and correlation methods in the DB Interrogator. The reduced database is then used as input to DT Builder tools that can build decision trees (DT). The POSSIT design is intended to be general such that different decision tree building tools could be used.

5-54

Data Builder
Scenario Builder Create Scenarios to be simulated for inclusion in database

Intelligent System Builder

DB Interrogator Analyze DB and select data to be used in Building Intelligent System

Engineered Attribute Selector Select attributes to be retained in simulation output

Run full time-domain simulations using existing DSA Engines

Reduced Database of scenarios and their associated stability limits

IS Function Builder Build Intelligent System

Powertechs DSA PowerToolsTM

Full Database of scenarios and their associated stability limits

Commercial Data Mining Software

Decision Trees

Figure 5-29 Structure of the POSSIT Environment

Figure 5-30 Database Structure

Once the trees are developed, they are placed in the on-line architecture shown in Figure 5-31. When a snapshot is taken from the real-time system, the full on-line DSA engine is started as usual. In

5-55

parallel, the DB is searched using a nearest neighbor (KNN) routine to ensure that the snapshot is within the scope of the DB; if it is not, the DT path is not used and conventional DSA is used. The snapshot is then dropped on the decision tree and the stability condition is provided virtually instantaneously. As the full DSA solution completes for all contingencies, the DB is appended, and new DT can be built at anytime. This process is critical to ensure the system learns over time. It is clear that this IS should perform very well when system conditions are within, or close to, the expected bounds of operation. The advantage is that a security indication is provided very quickly. If a condition arises that is well beyond criteria (i.e loss of multiple right-of-ways), it may be difficult for the IS to accurately predict the system stability due to lack of prior knowledge unless the IS was trained using such conditions. In such an event, the conventional DSA engine provides the accurate result. Work is currently underway to integrate the POSSIT technology into commercial DSA products. It is important to appreciate that although the approach described above was used for the assessment of transient stability, it can be readily extended to other applications provided the problem can be formulated to conform with the database structure shown in Figure 5-30 . That is, each condition analyzed (object) can be defined in terms of a set of initial conditions (attributes) and a result (outcome). If the outcome is a discrete binary result (such as stable/unstable) then decision trees are suitable. If the outcome is continuous (such as a stability limit or voltage) then regression trees must be used. The POSSIT approach has also proven to be very useful in the off-line mode such as encountered in system planning. In this application the main value of the method is in the level of discovery it provides in analyzing complex power systems. It is often difficult to establish what factors most significantly influence a systems stability; this is particularly true for large complex systems. Using the process described above, a large number of simulation s can be loaded into a database from which a decision tree can be developed. The branches of the tree provide good insight into the key system

Figure 5-31 Integration of IS into on-line DSA System

5-56

parameters which most heavily influence the system security. These may include such attributes as line loadings, generator outputs or angles, bus voltages, or load magnitude.

5.9.5 Kernel Ridge Regression for Transient Security Assessment

Integration of machine learning techniques and time domain simulations for fast transient security assessment has been widely explored and reported in literature. In particular, the application of multilayer perceptron (MLPs) and decision trees (DTs) have been widely explored and many case studies have been presented in the literature [35-37]. Recently the application of support vector machines classifiers (SVMC) for transient security assessment has been reported [38]. The benefit of these approaches is their ability to quickly assess the security of a power system based on the knowledge extracted from off-line calculations [39]. The method presented in this report is similar in concept to the above methods except the non-linear extension of well known Ridge regression algorithm, Kernel ridge regression (KRR), is employed as the learning algorithm. The important features of this method are: (1) the transient stability margin is expressed in a non-linear form yielding a high accuracy; (2) very high computational efficiency due to the use of an implicit mapping technique along with an appropriate linear estimation technique; (3) it has a very high accuracy for the operating points close to the boundary of stability. This feature ensures that any misclassified cases are those close to the boundary; (4) simple design procedure that can be easily programmed in software. The KRR approximates the stability margin (y) in the feature space (Z) with a linear function (i.e y w T z ; where w T is the transpose of the weight vector w of the linear function and z is the co-ordinate vector in the feature space.) The optimal value of the weight vector w is determined by minimizing the sum of square error (SSE) function appended with term w T w ,

E ( w ) = SSE + w T w
SSE is calculated by taking the summation of the square of error between predicted and actual stability index for the training data set. The user-defined parameter controls the over-fitting of approximated function. This parameter performs a similar function as feature selection, weight decay, early stopping, and pruning used in other machine learning methods. It can be shown [40-41] that the above error function leads to the linearly approximated function of z for the stability index,

$ y = i ( zT i z)
i =1

where l is the number of training samples and i is a real scalar value. It can be shown [40-41] that

i has a global and unique closed form solution. The inner product zT i z in the above equation can
be expressed in terms of original variables using Dot-product Kernel functions. There are several dotproduct Kernels such as Polynomial Kernels, Sigmoid Kernels (used in MLP), Radial basis Kernels that can be used to implicitly map the original variables to feature variables. For example, substitution T m of the mth order polynomial Kernel function zT in the above equation results in the i z = ( x i x + 1) following approximated function of original variables, x .
m $ y = i ( xT i x + 1) i =1 l

y to The above substitution is the key feature of the KRR method that allows the unknowns i s and $
m T be determined without expanding the expression ( xT i x + 1) . Note that the dot-product x i x is one dimensional regardless of the dimensionality of the original variable vector x .

5-57

In order to compare the performance of KRR method with other available methods, a test system with 470 buses and 45 generating units was used. Critical clearing times (CCT) for different power flow cases for two contingencies having the actual fault clearing time of 12 cycles were determined by means of transient stability simulation. The stability status (stable/unstable) for each power flow case was determined by comparing the corresponding CCT with the actual clearing time for each contingency. For the purpose of comparison, the decision tree (DT) and the support vector machines algorithms were used. SVMC and DT algorithms approximate the stability status (i.e. stable or unstable) while the KRR algorithm approximates the CCT from which the stability status can be directly determined. A training set of 200 data points was used in the learning process of each algorithm and an independent test set of 200 data points was used to evaluate the performance. The following table shows the training times and the performance indices for the independent test set. KRR 22 1.0 0.5 1.5 11.9-12.0 12.0-12.1 Contingency-01 SVMC * 8.0 6.0 14.0 11.4-12.0 12.0-15.3 DT 5.0 12.0 9.5 21.5 N/A N/A KRR 23 2.0 2.5 4.5 11.6-12.0 12.0-12.2 Contingency-02 SVMC * 10.5 5.0 15.5 11.2-12.0 12.0-13.4 DT 4.0 18.0 8.5 26.5 N/A N/A

Training time(s) % False Alarms % False Dismissals % False Classifications False Alarms Range False Dismissals Range

* Several minutes. Although the DT is the fastest in parameter training, it shows the worst classification accuracies (False classifications of 21.5% and 26.5% for two contingencies). The KRR shows the lowest values for all the error indices. False dismissals range for the KRR algorithm is 11.6-12.0 cycles; i.e. all dismissals with KRR in this case fall in the range of 11.6-12.0 cycles. Accuracy of SVMC lies in between those of DT and KRR methods, and it is the slowest in training among the three methods. The DT program used in this study is the commercially available CART software, the SMVC program is SVMlight software written in C (available in public domain), and the KRR program is written using MATLAB. The results of our comparisons show that the KRR method has a great potential as a machine learning technique for transient security assessment.

5-58

5.9.6 References
[1]. P. Kundur, "Power System Stability and Control", Mc-Graw Hill, 1994 [2] R. J Marks CA Jensen and M. A. El-Sharkawi, "Power system security assessment using neural networks: Feature selection using fisher discrimination". IEEE Trans. on Power Systems. [3]. Power Systems Engineering Research Center, "Integrated security analysis final project report". May 2003. [4]. N. Hatziargyriou D. Georgiadis, E. Karapidakis. "Application of machine learning technologies on the dynamic security of isolated power systems with large wind power penetration". SETN Proceedings ,Thessaloniki, Companion Volume, pages 257268, 2002. [5]. Alain J. Germond Dagmar Niebur. "Power system static security assessment using the kohonen neural network classifier". IEEE Transactions on Power Systems, 7(4):865871, 1993. [6]. D.J. Tylavsky, A. Bose. "Parallel processing in power systems computation". IEEE Transactions on Power Systems, 7(2):629638, May 1992. [7]. C. Rehtanz E. Handschin, D. Kuhlmann. "Visualization and analysis of voltage stability using self- organizing neural networks". Proc. of ICANN 97, Lausanne, Switzerland, 08. - 10. Octobre 1997, Lecture Notes in Computer Science, No. 1327, Springer-Verlag, Berlin, 1997. [8]. B. Fritzke. "A growing neural gas network learns topologies". Advances in Neural Information Processing Systems 7, MIT Press, Cambridge, MA, 1995. [9]. A. E. Gavoyiannis, D. G.Vogiatzis, D. P. Georgiadis, and N. D. Hatziargyriou. "Combined support vector classifiers using fuzzy clustering for dynamic security assessment". IEEE 2001 PES Summer meeting ,Vancouver,Canada, 2001. [10]. A. E. Gavoyiannis, D. G.Vogiatzis, and N. D. Hatziargyriou. "Dynamic security classification using support vector machines". International Conference on Intelligent System Application to Power Systems, 2001. [11]. A. E. Gavoyiannis, E. M. Voumvoulakis, and N. D. Hatziargyriou. "Radial basis functions for dynamic security assessment of power systems with increased wind power penetration". PSCC meeting, August 2005 , Liege Belgium, 2005. [12]. J.G. Waight V. Vittal G. Pieper F. Jamshidian P. Hirsch D. Sobajic G.C. Ejebe, C. Jing. "Online dynamic security in an EMS". IEEE Computer Applications in Power pages 43-47, January 1998 [13]. P. Georgilakis and N. Hatziargyriou. "On the application of artificial intelligence techniques to the quality improvement of industrial processes". SETN Proceedings, Thessaloniki, LNAI 2308, pages 473484, 2002. [14]. P. Kundur K. Morison, Lei Wang." Power system security assessment". IEEE power and energy magazine, 2(5):3039, 2004. [15]. Pavella M. L.Wehenkel. "Decision trees and transient stability of electric power systems". Automatica, 27(1):115134, 1991. [16]. Marks II., R.J. "The effect of stochastic interconnects in artificial neural network classification". IEEE International Conference on Neural Networks, 1988. [17]. S. Papathanassiou N. Hatziargyriou and M. Papadopoulos. "Decision trees for fast security assessment of autonomous power systems with large penetration from renewables". IEEE Trans. Energy Conv., 10, June 1995. [18]. Task Force 21 of Advisory Group 02 of Study Committee 38. Power system security assessment. CIGRE Technical Brochure, 2004. [19]. C. Rehtanz. , Carsten Leder, "Stability Assessment of Electric Power Systems using Growing Neural Gas and Self-Organizing Maps", European Symposium on Artificial Neural Networks Bruges (Belgium) 2000 ,pp. 400-406 [20]. IEEE Committee Report. "Dynamic security assessment practices in North America". IEEE Transactions on Power Systems, 3(3):13101321, August 1988. [21]. J. Thorp D. Brown S. Rovnyak, S. Kretsinger. "Decision trees for real-time transient stability prediction". IEEE Transactions on Power Systems. Vol. 9 ,Num 3, pp 1417-1426

5-59

[22]. R. L. Streit and T. E. Luginbuhl. "Maximum likelihood training of probabilistic neural networks". IEEE Trans. on Neural Networks, 5(5):764783, 1994. [23]. Van Cutsem T. and Vournas C. "Voltage Stability of Electric Power Systems", Kluwer Academics , Boston, USA, 1998. [24]. H. G. C. Traven. "A neural network approach to statistical pattern classification by semiparametric estimation of probability density functions". IEEE Trans. on Neural Networks, 2:366377, May 1991. [25] Aggoune M.E. Vadari, S.V. "Online assessment of power system dynamic security using modular neural networks". Expert System Application to Power Systems IV Proceedings p. 33844, CRL Publishing Aldershot, UK. [26]. Vladimir Vapnik. "The nature of statistical learning theory". Springer-Verlag, New York, 1995. [27]. N. Vlassis and A. Likas. "A kurtosis-based dynamic approach to gaussian mixture modeling". IEEE Transactions On Systems, Man, and Cybernetics,Part A 29(4), page 393399, 1999. [28]. L. Wehenkel. "Automatic Learning Techniques in Power Systems". Kluwer Academics, 1998. [29]. A. T. Johns Y. H. Song, H. B. Wan. "Kohonen neural network based approach to voltage weak buses/areas identification". IEE Proceedings Generation,Transmission Distribution, 144(3):340 344, May 1997. [30]. A. J. Smola and B. Scholk, A Tutorial on Support Vector Regression, NeuroColt 1998, NC2TR-1998-030, http://www.neurocolt.com [31]. E. S. Karapidakis, N. D. Hatziargyriou, Online preventive dynamic security of isolated power systems using decision trees Power Systems, IEEE Transactions on, Volume: 17, Issue: 2, May 2002, Pages:297-304 [32]. M. Boundour and A. Hellal, "Combined use of supervised and unsupervised learning for power system dynamic security mapping", Engineering Application of Artificial intelligence [33] A. E. Gavoyiannis, E. M. Voumvoulakis and N. D. Hatziargyriou, "On-Line Supervised Learning For Dynamic Security Classification Using Probabilistic Neural Networks", PES San Fransisco, June 2005 [34] J.A. Huang, A. Valette, M. Beaudoin, K. Morison, A. Moshref, M. Provencher, J. Sun, An Intelligent System for Advanced Dynamic Security Assessment, PowerCon 2002, Kunming, China, October 2002. [35] D.J. Sobajic, Y.H. Pao, Artificial neural-net based dynamic security assessment for electric power systems, IEEE Trans. Power Syst., Feb. ,1989, 220228. [36] J.D. McCalley, S. Wang, R.T. Treinen, A.D. Papalexopoulos, Security boundary visualization for system operation, IEEE Trans. Power Syst., May, 1997, 940947. [37] L. Wehenkel, Machine learning approaches to power-system security assessment, Expert IEEE, Sep./Oct, 1997, 6072. [38] L.S. Moulin, A.P. Alves da Silva, M.A. El-Sharkawi, R.J. Marks II, Support vector machines for transient stability analysis of large-scale power systems, IEEE Trans. Power Syst., May, 2004, 818825. [39] K. Morison, L. Wang and P. Kundur, Power System security assessment, IEEE Power & energy., Sep./Oct., 2004, 30-39. [40] V. N. Vapnik, Statistical Learning Theory, 1st ed., New York, USA: John Wiley & Sons, 1998. [41] B. Jayasekara, U. D. Annakkage, Derivation of an Accurate Polynomial Representation of the Transient Stability Boundary, Accepted to be published in IEEE Trans. Power Syst., TPWRS00837-2005.

5-60

6 2
Chapter 6

SUMMARY AND FUTURE DIRECTIONS

CHAPTER 6. Summary and Future Directions This report has documented various aspects of on-line DSA systems including the need for such systems, their requirements, the state-of-the-art, and on-going research work. This section summarizes the findings and provides closing observations including possible opportunities for future development work.

Power System Security Issues

Maintaining security in power system operation is a critical function which has become more challenging in recent years largely due to the growing complexity of power systems and their associated controls, deregulation, and a general trend for load growth to outpace generation and transmission additions. Traditionally, security has been achieved solely through off-line analyses using forecasted information. In the new environment, this approach has proven inadequate and often impractical. As a result, on-line DSA has emerged in which a snapshot of the current system is obtained and is used to conducted security assessment. This approach reduces the need for prediction of system conditions and therefore is expected to provide more accurate assessments. However, since all data must be assimilated in near-real-time, and computations must be conducted automatically with little or no human intervention (and in a tightly constrained cycle time), on-line DSA has many inherent challenges. Depending on the nature of a given system, the scope of DSA may be quite broad including the analysis of any or all of transient security, voltage security, small signal security, and frequency security.
On-Line Security Assessment Requirements

The requirements for on-line security assessment are very challenging and include such basic characteristics as speed, accuracy, and reliability. By definition, on-line systems must perform complex calculations on highly non-linear power system models and in addition, must be able to provide operators with the results that are critical to security operation of the system. The detailed requirements of any on-line system are determined largely by the specific characteristics of the power system under study. The basic scope of a DSA system is determined by, Security analysis required what types of phenomena and contingencies/transfers must be considered? Cycle time needed how fast must the computations be conducted? Output Information needed what should the system tell the operators?

Key considerations in developing a DSA system include, Inputs needed raw SCADA measurements, state estimator output, PMU outputs, etc Models needed what special device models are needed? What study system model and external models are needed and available? Automation how much human intervention is acceptable? 6-1

Reliability/Availability what levels are acceptable for the intended use? Users who will have access to the control and output of the DSA system? Visualization how should information be presented to the system users? Adaptability how flexible is the system in dealing with new or changing future requirements?

State-of-the-Art in on-line Security Assessment

It is clear that significant advances have been made in the field of on-line security assessment technologies; this report have documented some fifteen state-of-the-art installations and reported the existence of numerous others which are either in-service or under development. These systems include assessment of voltage security, transient security, and small signal security. The range of assessment capabilities includes determination of critical contingencies, transfer limits, and determination of remedial measured necessary to ensure security. The computational methods used fro each type of security assessment is varied, and depends on the specific requirements (speed, accuracy, reliability), system characteristics (large, small, meshed, radial, etc) and, in some cases, the techniques available in the state-of-the-art tools used.
Transient Security Assessment

Full time-domain simulation Direct methods Simplified methods Intelligent systems

Voltage Security Assessment

Steady-state methods Time-domain simulations Quasi-dynamic simulation Simplified or direct methods

Small Signal Stability Assessment

Time-domain simulation using Prony analysis Measurement based methods

The capabilities of state-of-the-art DSA systems include, Contingency screening and ranking Basecase security assessment Stability limit determination Determination of remedial actions

On-Going R&D

A significant amount research and development is on-going in the field of on-line; most R&D aimed at extending the features and capabilities of existing system. Areas of work include handling of new technologies such as wind farms, improving speed and scope of assessments, improving visualization of results to operators, using optimization in determination of remedial measures, and use of intelligent systems.

6-2

Research and Development Needs

In addition to the on-going R&D reported in this document, there are a number of areas that warrant a focus for the next-generation of on-line DSA systems.
Speed of Analysis

Although the current DSA system in-use have generally met the specified performance requirements, as the dimension of system models increase and the desire to analyze larger numbers of contingencies grow, there is an on-going need to enhance the performance of the DSA systems. Currently, acceptable performance (a balance between accuracy, comprehensiveness, and speed) is achieved through a combination of model simplification (equivalencing), distributed processing, and simplified or direct computation methods (such as used for contingency screening).
Solution Robustness

It is recognized that the basic task of obtaining a powerflow snapshot of the current system state can be challenging; the state-estimator model (i.e. components and topology) must be good and the power must solve to a valid solution. For dynamic analysis, the modeling process is further complicated since the powerflow model must be matched with the system dynamic model and then properly initialized. Relatively minor data errors, or incomplete data sets, can cause this process to fail, thereby resulting in no useable DSA result for that given cycle. Research work is need on ways of hardening the solution to flawed or inadequate data. Data problems may be quite likely during time of system upset (such as when the system is fragmented or has suffered numerous outages) when the DSA is most valuable.
Load Modeling

The importance of load modeling cannot be over-emphasized as it can affect the outcome of all forms of security assessment. While the concern for proper load modeling is not unique to on-line DSA (it is equally critical for off-line planning studies), on-line analysis provides no opportunity for sensitivity assessment or investigative studies of the impact of different load models. It is well understood that load modeling is a challenge due to the diversity of load types and characteristics, lumped load models used in many simulations, and the time-varying nature of load. Methods are needed to obtain load model information and to synthesize this information into a form that can reflect the important characteristics of the actual load.
System modeling

Most on-line DSA systems use a base simulation model derived from SCADA measurements (processed by a state-estimator). Since the geographical area covered by SCADA is limited, assumptions must be made regarding the unobservable (or external) parts of the actual systems. One current practice is to derive off-line equivalent of the external systems and patch them together with the state-estimator result. This approach can be quite approximate (since the number of equivalents must be limited) and time consuming. Until the day arrives when wide-area stateestimations are readily available, new techniques are needed to assist in the task of on-line system model development.
Risk Based Security Analysis

The concept of risk-based security assessment has been widely discussed and worked on the power system planning environment. The idea is to compute the risk of insecurity by assessing the probability of a given contingent event and evaluating the impact of the event (such as the loss of a 6-3

single load or a system-side blackout) should it happen. Assessing the impact, or damage function of a given event is often difficult when examining stability since many system control and protections may come into play to determine how widespread the event is. Also, the duration of the impact must be considered as well. However, a risk-based DSA system would provide operators with information to more fully utilize the existing system assets. Events that are low-probability/high-impact or highprobability/low-impact may be treated differently than those that at high-probability/high-impact.
Intelligent Technologies

While some on-line DSA systems currently use intelligent technologies (IT), there exists tremendous opportunity for the widespread use of such systems. Opportunities for intelligent technologies include, Extracting information from volumes of data Automatically learning from the results of on-going security assessment Providing smart decision recommendations Discovering important features or characteristics of the power system

Optimal Remedial Measures

Although the base function of an on-line DA system is to determine whether or not a system is exposed to a security threat, either in the current condition or some future state, perhaps the most important function is to provide some recommendations for remedial measures needed to avoid the risk. Operators are most interested in what to do when provided with a security alarm. A number of state-of-the-art DSA installations currently offer some methods for determination of remedial measures (such as load shedding or generation maneuvering), however, there is a need to extend the scope of such measures to provide operators with a number of choices for optimal control actions. Research is also needed in the implementation automated control action; that is systems in which the DSA tools make security assessments, determine remedial measures, and automatically take those actions (such as arming of load or generation tripping, switching of devices, or adjusting system control parameters). Such systems must be adaptive in order to response to ongoing system changes and require high degrees of robustness and reliability and must be designed to avoid false operations.

6-4