POWER

The Electric Power Industry is undergoing rapid institutional and technological change. Utilities are splitting up into generation, transmission, and distribution companies, and members of the first group especially are becoming more competitive, with more new independent power producers entering the fray. Technologically, the primary change is the availability of relatively low-cost gas-turbine-driven generators having short lead-times, and high efficiencies.

Meanwhile, transmission and distribution systems are being reorganized, subject to radical regulatory reforms. The general trend is toward regional transmission organizations—either independent grid operators or independent transmission companies. As a result of both new competition and more dispersed transfers of electricity, power trading has soared by an order of magnitude over just a couple of years. Thousands of power schedules now change hourly, in networks designed for quite different schedules and power flows.

The 1996 outages

All this restructuring was just getting under way in the western grid system of the United States when in July and August 1996 two large-scale power outages occurred. They were the culmination of a series of four increasingly severe failures [Table 1].

The reasons for the 1996 failures were many, and in some respects they may represent "a bad statistic." That year, conditions for the generation of hydro power in the Pacific Northwest were better than they had been in any year since 1976, so that power transfers to California were much greater than usual. Still, the failures served as a wake-up call that high reliability must be maintained in the more competitive environment that was emerging. In what follows, a brief description of the summer-of-1996 failures precedes an outline of the most important lessons learned and the actions taken to reduce the risk of similar events.

The roots of power loss

Interconnected power systems span large portions of continents and can be described as the world's largest machines. Interconnections make economical use of the power generated and generally improve overall reliability, in that every part of the large system has more connected generation and transmission elements to fall back on than it would otherwise.

But that complexity exacts a toll. Synchronous generators thousands of kilometers apart must operate stably and in synchronism during infinitely many load and power transfer conditions, equipment outages, and power disturbances. Following a short circuit or other disturbance, one group of generators could accelerate relative to another group, causing instability and loss of synchronism.

Large power systems are resilient machines and wide-area blackouts are exceedingly rare. Nevertheless, when power is transferred from low-cost to high-cost generation areas over long transmission paths, the potential for failures increases.

When large-scale power failures occur, multiple contributing factors are almost always present. Power system planning and operation aim to balance the risk of failure against economical design and operation, and when problems arise, to have mitigating measures on hand. These measures are designed to minimize the cascading of failures and the size of the area affected.

A system's inherent risk of failure depends on factors such as the magnitudes of population and loads in relation to generation resources. Highly meshed transmission networks with evenly distributed load and generation are more reliable than networks arranged longitudinally, in loops, or radially (as on peninsulas, for instance).

Characteristic of the western North American interconnected power system are long distances between generation and load areas [Fig. 1]. Geographic features like large unpopulated desert areas mean that the transmission network is weakly meshed, with major lines forming a loop network around areas in Utah and Nevada. The Pacific Ocean blocks support from the west.

In spring and summer, the main power transfers flow from hydroelectric resources in the Pacific Northwest (including British Columbia) to California. Power also flows from coal-fired generation far inland to the load centers on the Pacific coast. The major power transfer path from northern British Columbia to Pacific coast load centers approximates a longitudinal power system. Load and generation sites along this path include Vancouver, Seattle, Portland, San Francisco, Los Angeles, and San Diego.

The 2 July failure

On Tuesday, 2 July, temperatures were around 38 °C in southern Idaho and Utah, and loads were very high. Also, power exports from the Pacific Northwest to California on the Pacific AC and DC interties were high (4300 MW and 2800 MW, respectively). The Pacific AC Intertie rating at the California-Oregon border is 4800 MW, and the Pacific HVDC Intertie rating is 3100 MW.

The trigger event occurred at 14:24 hours with a flashover to a tree on the Jim Brid-ger-Goshen 345-kV line. Faulty operation of a ground unit of an analog electronic relay tripped the parallel Jim Bridger-Kinport 345-kV line. The two long, series-compensated lines integrate the four-unit, 2000-MW Jim Bridger power plant in Wyoming through a transmission network with Pacific North-west load centers some 1300 km away.

Because the plant lost two of its three outlet lines, preplanned stability controls correctly tripped two 500-MW Jim Bridger units, a response that should have ensured stability and prevented further outages. Unfortunately, a voltage depression in southern Idaho followed: approximately 20 seconds after the initial fault, generators at a small hydro plant in southern Idaho started a power runback and tripped about 4 seconds later. Generators at another smallpower plant also tripped. The tripping was due to high reactive power output associated with supporting transmission voltage [see "Explaining reactive power,"].

Meanwhile, in central Oregon, 500 km away, voltage was slowly decaying along

the Pacific AC Intertie. Generation had been cut at The Dalles hydro station on the Columbia River because of a spill related to migratory fish (spilling was a fairly new requirement designed to protect fingerling salmon). Independently of that, a combined-cycle power plant was operating in power-factor control rather than voltage control, as it should have been. Also, after-the-fact simulations showed the Pacific AC Intertie as having a highly destabilizing sensitivity to west-to-east power flow on the 500-kV line from Summer Lake, in central Oregon, to Midpoint, in southern Idaho.

About the same time as the southern Idaho hydro plant was tripping, so was a key 230-kV intertie line between western Montana and southern Idaho. The reasonwas an impedance relay, installed to detect short circuits but which operated on overload. The tripping of the small generators may have been enough to cause this relay operation. A parallel 161-kV line tripped subsequently. The interruption of 300 MW or so on the two lines was reflected in power swings through eastern Washington and eastern Oregon, further overloading lines between the Hells Canyon generation complex on the Snake River and the Boise, Idaho, load area.

Loading on the Summer Lake-Midpoint line also increased. Voltage decayed rapidly and four 230-kV transmission lines from the Hells Canyon generation complex tripped three seconds later. Separation of the Pacific AC Intertie followed about two seconds later [Fig. 2]. Further cascading separated the power system into five electrical islands.

The next day the same initial events occurred. Conditions were slightly less stressed, however, and Idaho Power Co. operators were able to trip 600 MW of load when voltage started to collapse. This action contained the disturbance, preventing a repeat of the 2 July wide-area failure.

The 10 August failure

The Saturday afternoon of 10 August was unusually warm in the Pacific Northwest— 38 °C in Portland, Ore. Record rainfall meant hydroelectric conditions were excellent. In late summer, in any case, generation capability is highest in British Columbia, and power transfers from Canada through the states of Oregon and California were near rated values. But the rain and hot weather between them had made trees grow faster than usual, and right-of-way maintenance had not kept up.

So tree faults, even before the main outage, had put three 500-kV line sections from the lower Columbia River to the Portland, Salem, and Eugene load centers in Oregon out of service. While these lines were lightly loaded, their capacitance provided much-needed reactive power support for the high Canada-to-California power transfers.

The serious trouble started with an outage of the Keeler-Allston line, when an element sagged into a tree, severing the

500-kV path between Seattle and Portland to the west of the Cascade Mountains. The line loading was over 1300 MW. The Canada-to-California power increased on the lines east of the Cascade Mountains, causing a voltage depression in the lower Columbia River area. Improper voltage control at three power plants then contributed to the problem, with voltages sagging from around 540 kV to 504-510 kV.

The transmission line outages overloaded parallel lower-voltage lines in the Portland area. About five minutes later, a relay failure tripped a 115-kV line, and a 230-kV line sagged into a tree, also tripping. About the same time generators at the McNary hydroelectric plant started tripping because of faulty relays. In the course of 80 seconds, all 13 units tripped, further reducing voltage support and adding to system stress.

Increasing oscillations soon caused synchronous instability The ensuing cascade tripping of transmission lines broke the interconnection into four electrical islands, with massive load and generation loss [Table 1].

Reacting to the power failures, committees of the Western Systems Coordinating Council (WSCC) prepared reports recommending 144 actions. The WSCC is one of the 10 regional reliability councils of the North American Electric Reliability Council (NERC).

Lessons learned, actions taken

An important conclusion of the WSCC reports was that power system conditions on 10 August had not been adequately studied earlier, and that operators had unknowingly operated the system in a condition in which outage of the Keeler-Allston line could led to cascading outages. Cascading outages resulting from outage of a single line are not allowed under the WSCC's reliability criteria.

Undesirable generator tripping in southern Idaho on 2 July and at the McNary hydro plant on 10 August contributed heavily to the cascading. The deliberate 2 July trippings of the small generators were unnecessary: best practice is to provide overexcitation limiters (to automatically reduce generator field current) and reactive power (to prevent damage from overheating)—and not to trip the generators.

During both the 2 July and 10 August failures, protection of generator field current excitation equipment failed at the McNary hydro plant. There the problem was poor design of a phase unbalance relay protecting the three-phase thyristor bridge rectifiers. In addition, overexcitation limiters on many units turned out not to be well designed.

Following the cascading, undesirable generator tripping was the main factor in the severity of the disturbances. Islanding (separation of portions of an interconnection) almost always results in tripping of units because of the voltage and frequency excursions. But control and protection can be poorly coordinated. Various types of generator protection may operate undesirably, among them stator overload protection, transmission fault backup protection, volts/hertz protection, and loss of excitation protection. For both disturbances, boiler protection tripped generators minutes after the disturbance.

Such deficiencies in equipping and operating generator-protection systems underscore the importance of best-practice engineering and state-of-the-art digital control and protection solutions. Best-practice engineering needs to be better documented, perhaps as a comprehensive IEEE guide.

Some transmission protection devices also fell short. Unwanted operation of relays has contributed to many blackouts—recall that those installed to detect short circuits sometimes operate during overload with depressed voltages.

What the 1996 outages did for oversight

Controlling for rare abnormalities

Since it is exceedingly expensive to design a power system to completely prevent very rare multiple outages and withstand their consequences, it is common practice to provide controls to mitigate the effect of disturbances. Following the 1965 northeastern North Amer-ica blackout, for example, underfrequency load shedding became standard utility practice. (These controls are often termed remedial ac-tion schemes or special protection systems.)

Load shedding or fast capacitor-bank switching in southern Idaho would have contained the initial 2 July outages. Undervoltage load shedding operating during the first 1-1.5 seconds of fast voltage decay would have been one possibility, but was not installed. More sensitive load shedding is based on a combination of high reactive-power output at generators and depressed voltages. Capacitor bank energization and load-shedding controls have now been installed.

Controlled separation that cleanly separates the system into islands is an effective mitigating measure. In cases of instability or other opening of the Pacific AC Intertie—by tripping all ac lines between Oregon and California—signals are sent to open lines running between the Rocky Mountain states and the desert southwest.

This kind of controlled separation of the WSCC network into north and south islands had been in service for many years, but was not normally employed after 1993, when a third 500-kV transmission path was added between the Oregon border and the San Francisco area. Today, controlled separation is back in service with three separation signals sent from the Pacific Northwest to Four Corners, New Mexico. Two-out-of-three voting—if at least two separation signals are received, lines are opened—is used for high reliability.

Many other emergency controls have been added. For 500-kV line outages, shunt capacitor banks may be energized or generators at the sending end may be tripped.

Stabilizing voltage control

Voltage support along transmission paths improves synchronous stability. On 10 August, reduced voltage support in the lower Columbia River area following the Keeler-Allston outage fed the instability that arose minutes later. The depressed voltage in the lower Columbia River area affected operation of the Pacific HVDC Intertie rectifier station in the same area. The low ac voltage caused an increase in direct current, and a corresponding increase in reactive power demand by the converter station. This reactive power demand further reduced the ac voltage. In response, the Bonneville Power Administration (BPA) has implemented a new control that reduces direct current when ac voltage is depressed.

The need to spill water to aid downstream migration of young salmon reduced the number of generating units on-line at The Dalles and John Day. This in turn reduced lower Columbia River area voltage support—a condition that had not been adequately studied in simulations, so that planning allowed for excessively high power schedules to California.

The water spill requirement is ongoing, but units at each plant have been modified. Some units can now be operated as unloaded synchronous motors providing voltage support by excitation control. Compressed air is used to "unwater" the units so that the turbine is spinning in air.

As additional reactive power support, two 550-kV, 460-MVAr shunt capacitor banks were installed in the lower-to-mid Columbia River area. Probably the world's largest, the banks assure the nearby generators of an increased reserve of continuously controlled reactive power.

While control centers typically monitor transmission voltage magnitudes, the reactive power reserves at power plants are a more sensitive indicator of voltage security. If generators are near their reactive power limits, they can supply only limited support for disturbances, even if voltages are initially near normal. In 1997, the Bonneville Power Administration made this aspect of a generator's output more visible to its operators by implementing a reactive power monitor. If the reactive power reserve at a certain number of units slips below certain limits, alarms will alert operators to take corrective actions, perhaps by reducing power schedules.

Still other measures are being taken at power plants to improve voltage support capability. For example, automatically controlling the transmission network voltage is more effective than controlling generator terminal voltage.

Power oscillation damping

The mechanism underlying the 10 August instability was growing electromechanical oscillations (negative damping) due not only to high power transfers from British Columbia to California but also to the impairment of the Lower Columbia area. By and large, negative damping is caused by phase lags and high gain in a generator's automatic voltage control. Usually damping is added by equipping a generator voltage regulator with a supplementary control called a power system stabilizer.

That August day, though, the power system stabilizers at a large nuclear plant in Southern California were out of service. (Power system stabilization at this location is especially effective because it is near one end of the north-south intertie oscillation mode.) Other stabilizers also were out of service, or ineffective because of noisy frequency transducers. Nuclear plant stabilizers are now in service, and other PSS improvements are under way.

Other means of improving damping are under evaluation. Especially promising is switching between maximum and minimum output (bang-bang switching) of a thyristor-controlled series capacitor.

Better simulation modeling

Investigation found many data problems in simulation programs, including problems concerning the reactive power capability of key power plants. To remedy matters, the WSCC has made many improvements in simulation methods. A key requirement is validation of steady-state and dynamic simulation data by power plant testing. Dynamic simulation methods are more detailed and include modeling of slower-acting equipment such as generator overexcitation limiters.

Inter-area simultaneous transfer capabilities are determined season by season. Simulation procedures are more rigorous, and reliability criteria for planning and operation have been strengthened, especially for voltage support. Operation outside the conditions studied is not allowed.

The seasonal simulation studies need a lot of manpower. Actual operating conditions are inevitably different from the conditions studied. If there is a forced outage of, say, a 1000-MVA, 500/230-kV transformer, power transfers may have to be reduced until an engineer can modify a previous dataset, and simulate and analyze the new situation.

Real-time, on-line transfer capability and security assessment are as yet just a goal. The technology is essentially available, but implementation is no trivial task. On-line security assessment is based on a static state estimation involving thousands of measurements for even one region of an interconnected power system. Network state estimation is working on a regional basis, but further data exchange and development is required for WSCC-wide state estimation. State estimation and the resulting on-line power flow model are the starting points for evaluating transfer capability, as constrained by reliability criteria, for potential outages.

Implications of the failures

The power failures of the summer of 1996 show that only attention to detail and the application of best engineering practices will reduce the likelihood of large power failures. But the cost of reliability has to be balanced against the cost of failure. The commercial structure of the electric power industry will continue to evolve, with unrelenting competition and pressure to reduce costs. Mergers and consolidation of generation and transmission companies will not go away. Load will increase and generation will be added.

Few transmission lines will be added, however. During the transition from cost-based regulated monopolies to market-based competition, many companies are deferring investment in transmission until the potential return is better defined. Even with financial incentive, the lines are difficult to build because of environmental concerns and the not-in-my-backyard attitude.

How to maintain power system reliability in this environment? Technological innovation will be vital. While the emphasis here has been on gas turbines, technology such as high-voltage power electronics and various forms of smaller distributed generation (such as microturbines and fuel cells) will also play a role.

Perhaps the starring part will be played by Information Age technology. Just as an over-night courier service may spend more for computers than for trucks, the future transmission company may invest more in computer control and communications than in transmission lines. Transmission companies are currently adding thousands of kilometers of fiber-optic communications network, but few kilometers of transmission network.

Blackouts in the future can be minimized by technologies such as on-line security assessment and wide-area control. But concern with detail so that a protective relay installed to detect a short circuit does not go into action during an overload emergency remains vital. Since multiple failures are always possible, emergency controls such as load shedding and controlled separation provide defense in depth.

Spectrum editor: William Sweet