IEEE Transactions on Power Apparatus and Systems, Vol. PAS-99, No. 1 Jan./Feb.

1980

37

OPERATION OF THE LARGE INTERCONNECTED POWER SYSTEM BY DECISION AND CONTROL John Zaborszky

Krishna Prasad
Department of Systems Science and Mathematics Washington University St. Louis, Missouri 63130

Keh-Wen Whang

ABSTRACT
A comprehensive approach to the control of the large interconnected power system in conditions rangThe ing from normal to disintegrated is outlined. basic decision is between normal and abnormal conditions or, more precisely, on the degree of abnormality with normality rating as zero degree abnormality. The applicable control algorithms would then be aimed at maintaining normalcy when it is present or leading the system back to normalcy with the least disruption when the condition is abnormal. In a sense one could say that in Decision and Control operation a system is always in a restoratory state seeking the best way back to normalcy when it finds nothing to restore the system is in a normal condition. To lead the system back to normalcy five Regimes of Control are defined and the measures and means used in each are defined and developed. New ancillary algorithms to use as tools in these operations have been developed. An illustration of a sequence of emergency events under Decision and * Control Operation is also included. A measure of the effectiveness of the new techniques is a consistent tenfold increase of critical clearing times. This indicates a large potential saving in new transmission equipment.
-

1.

INTRODUCTION

In 1975 ERDA gave out four contracts for the study of computer control of the large interconnected power system during emergencies with the aim of preserving the system's integrity as much as possible and at any rate preventing a total breakdown and blackout. One of these contracts came to Washington University and this paper presents the principal accomplishments of the last three years of research effort in this area including work outside the scope of the ERDA contract. In the course of this research, it soon became apparent that really meaningful results could be obtained only in the context of the entire operation of the large interconnected power system. Extensive thinking and research finally boiled down to an overall insight and organization of the power system operation which is referred to as operating with Decision and Control. The fundamentals of this type of operation are introduced in the next Section.Let it only be nmentioned here that with the increasing size and complexity of the systems, increasingly automatic computer controlled action becomes necessary, especially at the fast end of the events where the time scale is a few cycles or seconds and even when it is a few minutes. In fact, the fastest Control Regime in emergencies, on the few cycles level, was always automatic since it was entrusted This research was supported in part by the Energy Research and Development Administration under Contract #EX76-C-01-2073, and in part by the Department of Energy under Contract #ET-78-D-01-3090. F79 689-1 A paper reconmended and approved by the IEEE Power System Engineering Committee of the IEEE Power PES presentation at the IEEE Engineering Society for Summer Meeting, Vancouver, British Columbia, rCanada, subDmitted February 1, July, 15-20, 1979. Manuscript 1979; made available for printing May 17, 1979.

These in today's to the selective protection relays. terminology are special purpose microcomputers - originally electromechanical, later partially electronic and increa'singly solid state. The desirable development for the future seems to be towards expanding this automatic range to longer time periods and, to more complex tasks of preserving system wide Viability and Stability. The eventual system restoration, however, will always have to remain the responsibility of the operator aided by the computer in supplying data and optimized solutions through a multiplicity of ancillary algorithms like state estimation, load flows, security evaluations, AGC, etc. For expanding automatic operations into a wide range of emergency control, it becomes necessary to develop a number of new ancillary techniques. One such fundamental new tool is the "Observation Decoupled (Local Equilibrium) State Space". This new state space was shown to be equivalent to the conventional state the latter its components can be space but unlike locally estimated in a small fraction of the time it takes to estimate the conventional state components[4]. Fast local control action utilizing the new state space was shown to be capable of effectively stabilizing the system in emergencies, at least temporarily. An additional new ancillary technique which is reported in a companion paper [5] makes it possible to evaluate' the Another new techsystem Viability in milliseconds. nique allows the estimation, based on the Observation Decoupled (Local Equilibrium) State Space, of lasting changes in bus injections while the system is in a transient state. This and another new technique for selecting control measures to Viabilize the system telaporarily within a few seconds are presented in detail in [4].

2.

OPERATION OF THE LARGE INTERCONNECTED POWER SYSTEM BY DECISION AND CONTROL

Functions, particularly computer control andsystem operating functions, on the large interconnected power system fall into two broad categories.

2.1.

Housekeeping

or

Ancillary Processes

These include computational, algorithmic and other tools and solutions which basically provide auxiliary information and operating data. Thus, they would serve sometimes as the basis of decisions or they may establish future operating conditions,but they are not really part of the on line operation. Some customary processes of this type are 1. Load flow 2. State estimation 3. System security evaluation 4. Economic dispatch 5. Unit conmitment 6. Optimal load flow and Optimal dynamic load flow 7. Load forecasting 8. Load management Additional processes were introduced asa result oL the research activities presented here. These are 9. Computation of Area Load Excess (ALE) [6], 10. Computation of Economic Target Curves for Unit

0018-9510/80/0100-0037$00.75 (1980 IEEE

38 Controls [6] 11. Computation of Coordinated Unit Control to follow the target curves [6] 12. Computation of the Observation Decoupled (Local Equilibrium) State Vector [4] 13. Computation of local load imbalance from the Observation Decoupled (Local Equilibrium) State [4] 14. Computation of Sectional or Area power imbalance [4] 15. Fast contingency evaluation by Concentric Relaxation [4], [5] As expressed here Decision and Control then becomes the basic format of the system operation. A new decision on system conditions and applicable algorithms is made at every time step and the next command step of the currently applicable control algorithm is carried out at every time step. The basic Decision is between normal and abnormal conditions or, more precisely, on the Degree of Abnormality with Normality rating as Zero Degree Abnormality. The applicable control algorithms would then be aimed at maintaining normalcy when it is present or leading the system back to normalcy through a least objectionable path when the condition is abnormal. In a sense one could say that in Decision and Control Operation a system is always in a Restoratory condition seeking the best way back to normalcy - when it finds nothing to restore the system is in a normal condition. The word abnormal is used to avoid semantic arguments over the meaning of emergency. For instance, one could argue whether losing a line or a generator when adequate reserves are present is, or is not, an emergency. It clearly is an abnormal condition, however. Abnormal conditions simply mean that everything is not as expected. There are many degrees and many time scales of abnormality which can be classed as follows: 2.2.1. Degree #0. Normal Operating Conditions. Conditions are normal when they are as expected - all equipment working which was supposed to work, loads, fuel supplies, water and weather conditions within the expected ranges. The principal applicable algorithms are 1. Monitoring and Estimation of the load and generation 2. Static State Estimation 3. Monitoring of the system loading conditions and Security 4. Economic Dispatch or Optimal Load Flow 5. Unit Commitment 6. Automatic Generation Control 7. Load Management 2.2.2. Degree #1. Normal Operating Conditions with Structural Defect. Conditions are normal. The system is Secure and Viable except that its structure has been altered by an earlier event from what was expected - a line is missing, for example. The principal operating algorithms are as in Degree #0 but, in addition, future consequences of the structural change must be evaluated and, if necessary, remedied. For instance, the structural change may foreshadow Security or Viability problems during an

2.2.

Operating Processes.

Degrees of Abnormality

Given a large comprehensive power system operating with the aid of such advanced devices as multiterminal DC networks, microwave communications, micro, mini, and macro computer establishments, all under the authority of a Control Center with satellite Local Control Centers, a Decision and Control approach emerges as the natural way to approach system operation. The Decision Phase of the process consists of a continuous surveilance, monitoring and decision on the condition of the system and also the decisions on selecting the best Regime of actions, specifically, control actions in order to move the system towards its normal condition. The Control Phase then proceeds with the algorithms comprising the Control Regime selected during the Decision Phase and carries out the control action which are commanded by the algorithms. Something of this nature, in fact, is implicit in the famous DyLiacco diagram [1] (Figure 1) and its modified versions, the most recent and pertinent of which is the Fink-Carlsen diagram [2] shown in Figure 2 and even in current operating practices. It needs to be followed more consciously in the future in the context of much more advanced devices and algorithms.

Figure 1

2.2.3. Degree #2. Security Defect or Alert Conditions are still normal and the system is Viable but the security margin is smaller than desired. Applicable algorithms would include those for Degree #0 but overruled in some instances in order to restore security, specifically in the area of Economic Dispatch and Load Management which may then be replaced by special algorithms such as 1. Readjustments of the network load flows by the use of the DC network 2. Modified tie line schedules, modified load dispatch, etc. 3. Bringing on new generation or other equipState.

approaching peak.

.Figure

Of course, if effective control in crisis conditions is available many situations which would be insecure without such control would become secure. This is part of the financial benefit resulting from installing such control. 2.2.4. Degree #3. Stability Crisis. The system is in a momentary dynamic state, normally caused by a fault, which is sufficiently violent to endanger the integrity of the system.

ment

SELECTION OF DEGREE OF ABNORMALITY

DEGREE #0 NORMAL

NO

DEGREE #1 STRUCTURAL DEFECT?

NO7
DEGREE #2 SECURITY DEFECT?
NO

DEGREE #3 STAR IL TY CRISIS?

NO

DEGREE #4 VIABILITY CRISIS?

NO

#5 IINTEGRITY )CRISIS?
-_
I START AT EACH

,DEGREE

SAMPLE TIME

t_>~ REG#3
DECISION PHASE
ACTION ON CONTROL REGIME
YES YES

CONTROL PHASE
SELECTION OF CONTROL MEANS
CONTROL ACTION

39

(SEE TABLE 2)
REGIME

#0

REG #O

1 .NORMAL OPERATION

2.NORMAL WITH MINOR RESTORATION REGIME #1 SELECTIVE PROTECTION, STABILIZING SINGLE MACHINE FIRST SWING

REG #0

(25 CYCLES)

-'

REG #0

PRELIMINARY STABILIZING MULT IMACH INE MULT ISWING (12 CYCLES-3 SECONDS)
REGIME #3 PRELIMINARY VIABILIZING (0.5- 60 SECONDS)
-

REGIME #2

REG #1

C)
V ui

NO

YES

REG #2
RG#

0', I
_ a

_--

NOt

YES

AND

STABILIZING

(O 5

3 SECONDS) v* 0

/GREG 3_
REG #4

NO

YES

YES

NOti

VIABILIZING
-

REGIME #4

C)

YES

60 MINUTES

REG #5

REG #3
REGIME #5 RESTORATION

NO

YES

YES

NOI

REG #4

YES

RED 05

Table 1.

Structure of the Operation with Decision and Control.

NORMAL

ql fI\

NORMAL WITH STRUCTURAL DEFECT,

'

SECURITY DEFECT

'i

Ite1
dl

oLi

STABILITY CRISIS

ILi

Figure 3.

Some Fictitious Case Histories.

REGIME #l TO HOLD SYSTEM SYNCHRONIZED IN STABILITY TO RESTORE PRELIMINARY

REGIME AZ

REGIME AD
REGIME

M4
REGIME MO

REGIME, ITS ROLE,

STABILITY CRISIS VIABILITY CRISIS RESTORATION STATE INSTABILITY YULTI YULTI MACNINE SUING iNOTABILITY VIABILITY CRISIS RESTORATION STATE

TO ELIMINATE FAULTED EQUIPMENT AND TO PREVENT INSTABILITY OF ONE SPECIFIC MACNINE WITM A NEARBY FAULT

TEMPORkARY

VAIBILITY
TO RYESTORE INTERMEDIATE TIME RANGE VIABILITY

RESTORATION OF NORMAL OPERATION

CLASSIFICATION

STABILITY CRISIS

COMMON NAMES

SINGLE MACNINE INSTABILITY FIRST SUING INSTABILITY AFTER A FAVLT TAB SYSTEMWIDE OSCILLATIONS SPREAD SO VIOLENT THAUT BREAKUP INTO SEGMENTS OR ISLANDS THREATENS

SELECTIVE PROTECTION

PHENOMENON

0.

VENTED FROM TRANSMITTING POWER TO THE SYSTEM BY TUE FAULT, IT SPEEDS VP 'SUFFICIENTLY TO LOSE SYNCHRONISM

A PIECE SF EQUIPMENT IS FAULTED ANILE A MACNINE IS TEMPORARILY PRE-

TAE BALANCE OF GENERATION, LOAD AND TRANSMISSION FAILS ON TUE SYSTEM, ON AN AREA, OR ON A SEGMENT OF AN AREA RESULTING,_IN POWER FLOWS EXCEEDING PERMISSIBLE LIMITS FOR A. STABILITY B. LOADABILITY (10 MINUTES) TO AN EXTENT WHICM REQUIRES FAST REMEDIES. SUCH CONDITIONS MAY OR MAY NOT RESULT FROM A FAULT

GENERATION, LOAD AND TRANSMISSION ARE OUT OF BALANCE ON THE SYSTEM, ON AN AREA ON ON A SEGMENT OF AN AREA RESULTING IN CURRENT AND VOLTAGE CONDI1TIONS AHICH CANNOT BE ALLUNED TO PERSIST

TNE CRISIS IS OVER, TUE SYSTEM IS NUT IN IMMEDIATE DANGER OF FURTHER BREAEUP BUT SOME LOADS MAY BE DISCONNECTED AND THE SYSTEM MAY BE OPERATING IN UNCONNECTED ISLANDS. AOLTAGE AND FREQUENCY RAY BE OFF

CONSEQUENCES
FAILURE:

SUCCESS: FAILURE:
AND DURATION OF SYSTEM DIGRUPTION PROBABLY ARBITRARY ISLANDING AND AT LEAST PARTIAL BLACEOUT

REMOVAL OF EQUIPMENT WILL PUT THE SYSTEM INTO ABNORMALITY

SUCCESS:

SUCCESS:

SUCCESS:

MINIMIZE EXTENT, UNDESIRABILITY

SUCCESS:

FAILURE:

SYSTEM GOES RACE TO NORMAL OPERATION SYSTEM GOES BACK TO ABNRA-

FAILURE:

DEGREE Al1 THROUGH 0 DEPENDING ON THE CIRCUMSTANCES DEFECT OR CRISIS SPREADS FAILURE: I2 CYCLES
-

SYSTEM IS PREUENTED FROM BREAKOP UNTIL IT CAN SETTLE BACE TO NORMAL IF IT IS VIABLE OR UNTIL A VIABILIZATION IN REGIME AD CAN COMMENCE ISLANDING

MINIMIZE EXTENT AND UNDESIRABILITY OF SYSTEM DISRUPTION PROBABLY ARBITRLARY ISLANDING AND AT LEAST PARTIAL BLACEOUT

AIYDEREA-

ERE#-

ACTIVE TIME YANGE

25 CYCLES
B.

3 SECONDS

A.

0.0

0.0
-

- S SEC. -FOR LACE OF STABILITY - GO SEC.- FOR LACE OF LOADABI LITY

60 MINUTES

0.5

SEVERAL 'HOURS

TTAL TIME SPAN

-

25.CYCLES
LOCAL MINI COMPUTER FOR THE UNIT OR STATION ESTIMATE LOCAL EQUILIBRIUM STATE COMMOMENTS AND COMMAND LOCAL NORM REDUCING, AIMING OR "OPTIMAL" CONTROL PULSES
0.

0
S SECONDS

IS MINUTES

HOUR OR MORE
CONTROL CENTER COMPUTER

SEVERAL

YOURS
CENTEY COMPUTER
THE SYSTEM

CONTROL AGENT IN CHARGE

LOCAL SPECIAL PURPOSE MICRO-COMPUTERS INCLUDING SELECTIVE PROTECTION RELAYS

CONTROL CENTER COMPUTER

OP'ERATOR

AIDED BY THE CONTROL

CHOICE OF CONTROL MEASURES

0.

I.

I.

2.

SELECTIVE RELAYING TO REMOVE FAULTY EQUIPMENT ONLY AND ONLY IF FAULTED PERMANENTLY (STRUCTURAL CONTROL) ESTIMATE EXCESS TRANSIENT ENERGY OF MACHINE ROTOR AND REMOVE IT BY CONMANDING ENERGY PULSES (DYNAMIC CON-

COLLECTION, FROM LOCAL STATIONS, OF IMBALANCE INFORRLATION BASED ON LOTT CA QIIRU CHOOSE LEAST UNDESIRABLE METHOD TO

TROL)

4.

YESTORE PRELIMIN4ARY BALANCE CHOOSE TOOLS AND LOCATIONS OF TOOLS CHOOSE QUANTITATIYE COMMANDS

TOOLS AND POSSIBLE CHOICES ARE THE SAME AS IN REGIME AD BUT THEME IS TIME TO TT ETR EUA SIAINADTO' RUN ALGORITHMS WHICH NEED A FEW MINUTES. ALSO LOADS ON SOME EQUIPMENT MUST BE REDUCED FROM TME 0 - 10 MINUTE OVERLOADS PERMITTED IN REGIME A3 TO MOOR OVERLOADS
SAME US IN REGIME AS BUT LOADS ONLY

THE OPERATOR FINDS SOURCES OF POWER HELP FROM NEIGHBORING SYSTEMS, COLD STARTS, INTERRUPTED MAINTENANCE ETC. RESTORATION OF LOADS AND RESYNCHRONIZATI01S OP SEPERATED SEGMENTS AS SOON AS POSSIBLE. RETURN TO ECONOMIC DISPATCH AND NORMAL AUTOMATIC GEISERATION CONTROL

PRINCIPAL CONTROL TOOLS

OF GENERATOR RESERVES

VALVING

I) SELECTIVE NETWORK PROTECTION EQUIPMENT, 01 BRAKING RESISTOR, 3) SNUNT AND SERIES CAPACITOR SWITCHING, 4) FAST

SOME TOOLS

SOME TOOLS I) BRAKING RESISTOR, 0) LOAD SKIPPING, 3) SERIES OR SNUNT CAPACITOR SWITCHNGA, 4) NUDE LINE CONTROL, U) FAST VALVING

SOME TOOLS IN ORDER OF UNDESIRABILITY. I) FREQUENCY REDUCTION (AGC). 2) USE (NUT AND COLD) OR FAST GENERATOR RUNBACK, 0) EARLY RETURN OF EQUIPMENT FROM MAINTENANCE, A) TIE LINE RESERVE HELP, A) USING SNORtT TIME (U - 10 MINUTES) OVERLOAD CAPACITY OF EQUIPMENT, A) VOLTAGE REDUCTION, 7) LOAD DROPPING, 0) ISLANDING. AVAILABILITY, SPEED, AND DISRUPTIONS ARE FACTORS IN CHOICE

MOOR DOVER-

ALL AVAILABLE RESOURCES

SYSTEM, TELEPMONE

SF TUE PONER

MEASUREMENTS

VOLTAGE AND CURRENT MEASUREMENT, AND ACCELEROMETER OR FREQUENCY MEASUREMENT

IN

CONVENTIONAL MEASUREMENTS OF VOLTAGE, CURRENT AND POWER

NONE

CONVENTIONAL .MEASUREMENTS OF VOLTAGE. CURRENT, AND POWER

BASIC EXTRA RELIABLE
COMMUNICATION
TO

CONVENTIONAL MEASUREMENTS OF VOL7AGE, CURRENT, AND POWER

CONVENTIONAL SYSTEM INSTRUMENTATION

COMMUNICATION

NONE

NEEDED

EYCEPT POSSIBLY
SELECTIVE
NEEDED

AND TELEMETERING PROTECTION

SF
CENTER OF, ~~~~~~~~~~~~~~~~~~CONTROL I. LOCAL EQUILIBRIUM STATE OR LOAD IMBALANICE 2. STATUS OF MAIN TRANSMISSION

OP
BREAKERS AND GENERATORS (BUT NOT OF OR LOADS)

SUBTRANSMISSION

MAIN THE CONTROL CENTER THE STATUS TRANSMISSION BREAKERS AND GENERATORS. CONVENTIONAL TELEMETERING TO THE CENTER OF AND PONER VALVES FOR STATE ESTIMATION

UOLTAGE
INACTIVE

THE CONTROL CENTER THE STATUS OF MAIN TRANSMI SSI ON AND GENERATORS. TELEMETERING TO THE CENTER OF VOLTAGE AND POWER FOR STATE

SF CONVENSTIONAL AREAKERS
INACTIVE ACTIVE. WILL TEND TO ALLEVIATE LOAD EXCESS BY FREQUENCY ADJUSTMENT OF THE
SYSTEM

BASIC

EXTRA

COMMUNICATION

ESTIMATION.

VALVES

SCONOMIC DISPATCH
INACTIVE

INACTIVE

INACTIVE

RESTORED
ACTIVE
RETURNS TO NORMAL

AUTOMATIC GENERATION

CONTROL

INACTIVE

OPERATION

ON LINE STATE EST IMATION

INACTIVE
VUSSES

INACTIVE. SUPERSEZ..U BO LOCAL EVUILIBAIUM STATE ESTIMATION AT THE INOIVIDUAL

INACTIVE: SUPERSEDED BY LOCAL EQUILIBRIUM STATE ESTIMATION AT THE INDIVIDUAL BUSSES

REACTIVATED

ACTIVE

Table 2.

The Control Regimes.

41

Principal algorithmic features can be 1. Local structural control or protective relaying to eliminate faulty conponents and local control action (Regime #1)* to preserve stability of an individual generator. 2. Stability augmentation utilizing the DC network, braking resistors, load skipping, etc. (Regime #2). 3. Load Dropping or major Structural Surgery to separate the system in the least objectionable, manner when integrity cannot be maintained (Regime #3). Note that 3. pushes the system into an Integrity Crisis (explained below). 2.2.5. Dearee #4. Viability Crisis. The system in its present condition is incapable o operating continuously or of settling back to normal operation because the loads, the available generation, and the available transmission capability are not in balance. then This condition can result from a fault and is frequently preceded by a Stability Crisis. Noqnviable conditions can also, however, come on quietly; for instnace, major generation or other equipment does not become available when it is scheduled to come on line for a peak. Principal algorithmic features include in a rough order of increasing undesirability (Regime #3): 1. Frequency reduction of the AGC type 2. Use of spinning reserves or cold reserves 3. Special measures such as fast turbine runback 4. Help from neighboring areas 5. Drawing on time-limited overload capability of the equirment 6. Special measures such as voltage reduction 7. First stage structural control such as adding new generation or returning equipment from maintenance or load dropping (for min8.

2.2.6. Degree #5. -Integrity Crisis or "In Extremis" Condition. The integrity of the system is violated; for instance, load was dropped or the system is islanded. Principal algorithmic measures include: 1. Restoration of the Viability of the individual islands as in Degree #4
2. 3.
Reconnection of the islands Restoration of loads, etc.

rity Crisis.

utes or hours) Second stage structural control-Islanding Note that 7. or 8. moves the system into an Integ-

(Regime #5) but has insufficient security (Degree #2) until Control is used to shift loads to eliminate deficient security. Finally, the faulty line is restored to operation and everything goes back to normal (Degree #0). Same initial Case event at peak load with a failed breaker and subsequent backup clearing. This creates a Stability Crisis (Degree #3) which is successfully handled by the Emergency Control (Regime #2). The system integrity is momentarily preserved (no loads are lost, no islanding) and the system remains viable although insecure until later a heavily loaded tie from a neighboring system is lost in an independent incident. This leaves the system temporarily nonviable (Degree#4) with not enough generation to cover the loads. Integrity Crisis (load dropping or breakup) is prevented by Emergency Control Regime #2 subsequently refined by Regime #3 using a judicious combination of spinning reserves, short time overloads, shifting of loads by the DC network, and voltage reduction until the waning of the peak load (it was decided to wait this out rather than try to bring in new generation) and the gradual return to normal if not quite fully secure operation (Degree #2). At this point, another fault on a transmission line creates a new Stability Crisis (Degree #3) with a subsequent breakup of the system with loss of load (Degree #5). Generation scheduled to come on line just before the peak rise becomes unavailable unexpectedly. This creates the development of a Viability Crisis (Degree #4) as the load rises without, however, Load dropping causing any stability problems. is avoided by Emergency Control in Regime #3, that is, by using reserves and voltage reduction as well as increased tie line help until a fault on a neighboring area cuts down on the availability of the tie line help in the face of still increasing peak load. This dangeroulsly overloads the generators which forces load Crisis dropping and thus acceptance of an Integrity (Degree #5) in order to avoid shutting off the generation. Eventually the loads are gradually reconnected
-

CaseD

as more

gins to drop taking the system back towards normal operation (Degree #0). In these examples as in the literature Stability In practice Crises play a dominant role. probably CaseG is more typical of the events than the other cases because most systems are not susceptible to Stability Crises. In this country, the Western Systems are prone to Stability Crises mostly.

generation

becomes available

and the load be-

3.

SOME FICTITIOUS CASE HISTORIES

4.

STRUCTURE OF DECISION AND CONTROL; REGIMES OF CONTROL ALGORITHMS

To elucidate the operating process visualized a group of qualitative case histories are shown in Figure 3. Broken lines indicate imposed events, and solid lines represent control algorithmic operations. A short circuit occurs on a transmission Case line which momentarily endangers the stability (Degree #3) but the selective protection relays and circuit breakers clear the fault (Regime #1) and successfully reclose the line. Back to normal almost instantly. Qbut with a failed reCase 9 Same as in closing and ultimate loss of the line.Regime 1#2 is sucof cessful in retaining system stability but the loss the system with a Security Defect the line leaves (Degree #2) until the DC system is used to shiift sufficient load to restore security although the structure is still altered from normal (Degree #1). Same initial events but the reclosing fails and so do efforts for stability augmentation in Regime #2. The system breaks up, falls into an Integrity Crisis (Degree #5) and is later resynchronized * The six regimes of control will be described in detail in Section 4.

CaseD

Case(Q

After this brief introduction and illustration of the Decision and Control Operation ideas, some details of the structure of this operation are now in order. This structure is sketched in Table 1. The operation is divided into a Decision Phase and a Control Phase. Each in turn subdivides into a Selection Task and an Action Task. In the Decision Phase, first selection is performed among six Degrees of Abnormality which were already described. Two of these Degrees are described as Defects (Structural and Security respectively). These require corrective action but not a "scramble to correct" since they do not lead to further deterioration of the situation without additional adverse as occurences. Three Degrees are described Crises These require (Stability, Viability and Integrity). immediate action because, in the absence of it the situation will degenerate, possibly into an ultimate total blackout. The urgency and the nature of this control action depends on the Degree of Abnormality and further specifics within each Degree. Depending on this judgement the Decision Phase in its Action Task assigns the situation to one of the six Regimes

42
of Control for handling. Each Regime of Control is comprised of a set of applicable control tools and algorithms which provide a choice of measures and means dealing with a set of circumstances requiring remedies within a given time frame (Table 2). The Selection Task of the Control Phase (Table 2) will pick the best route to remedy the problem based on the available choices of tools, their location, and their disruptive consequences on service. Optimality in Regime #1-4 is mainly in terms of minimal disruption and particularly in the fast Regimes like Regime #1 or 2 it will have to be found from limited information and the control will have to be performed locally. The Action Task is finally initiated to carry out the control. 4.1. Regime #0: This is not shown in Table 2 and consists of the normal operating procedures such as AGC, Economic Dispatch, State Estimation, etc. as were listed in Section 2.2.1. Additionally, in the case of Structural of Security Defect special decision algorithms are required to establish the need for remedying these defects and the way of remedying them. Time is usually not pressing here and so relatively elaborate algorithms may be permissible [6]. 4.2. Regime #1: It controls the strictly local aspects of a situation where a fault may occur on some equipment. This equipment must then be selectively removed by the selective protection relays which are special purpose computers (classically electromechanical, increasingly microprocessors) so that only the faulty equipment is removed and - in case of transmission lines - retested in about 20 cycles by reclosing. While a short curcuit essentially shuts off power flow by reducing the voltage to nearly zero, a local generator may speed up enough to pull out of synchronism unless checked by taking out a quick pulse of energy from its rotor by some means such as a damping resistor. This operation is controlled strictly locally by a microprocessor much in the nature of selective protection relaying and shares Regime #1 with the latter. 4.3. Regime #2: This controls a system wide. problem on a very short time scale of a few seconds (less than 3 seconds). This arises when a disturbance puts the system into a violent dynamic state which threatens to break it into segments (Multimachine or The time scale does not Multiswing Instability). permit centrally coordinated action. Each unit must act alone under the control of its own minicomputer but the collective action must effectively stabilize the system. These contradictory requirements can be reconciled, as will be shown, by using a new state space, Observation Decoupled State Space, introduced by the authors. It is important to note, however, that although measures in Regime #2 preserve the system transient stability in the sense that they prevent our of step conditions on the system, this is accomplished with short range damping devices like braking So this Regime cannot be maintained inresistors. If definitely; it must end in a very few seconds. for either at that time, the system is not viable stability or overload reasons then it would still The disintegrate if remedial measures are not taken. few seconds gained in Regime #2 must then be used to get ready for activating the remedial measures of Regime #3. This is designed to deal with a 4.4. Regime #3: system which is severely nonviable either because of instability or because of overload. Since the condition is severe (as always in instability based Viability Crises) fast action is needed within a few seconds (for instability) or at most half a minute (for severe overload). The action must be central but it will have to be based on fast contingency evaluation using limited New ancillary information regarding the imbalances. techniques for these were developed in the course of

this project and are recorded in a companion paper [5]. These techniques which are based on the Observation Decoupled State Concept make it possible to take action in Regime #3 which will make the system viable provisionally although there may still persist overloads which cannot be allowed for more than 5 to 10min. 4.5. Regime #4: During the 5-10 minutes gained in Regime #3, an operating condition should be developed which assures Viability for an hour or more until full restoration becomes possible. In a less severe Viability Crisis, Regime #4 can be directly addressed without preceding it with Regime #3. In either case, in Regime #4, on the time scale of 5-10 minutes, Static State Estimation can be restored, Load Flows and other algorithms requiring a few minutes can be performed and so an overall solution can be reached with confidence which will make the system viable for the desired duration of an hour or more. It is also possible to select those measures which are least undesirable, that is, least disrupting; for instance, bringing in power from the neighbors or starting gas turbines is less disrupting than load dropping or islanding. In fact, it should be possible for instance to put back in Regime #4 some of the customer loads which were dropped in a preceding Regime #3 because fast action was required in the latter. On the other hand, some equipment loads may need to be reduced further because loads which can be tolerated for a few minutes may not be acceptable for an hour. 4.6. Regime #5: Finally comes an eventual reconstruction leading back to normal condition. This would best be carried out by the operator aided by the Control Center computer, both drawing on all the reserves o f the system. The structure sketched in Table 1 is meant to be scanned at every time sample point during the operation. For instance, at the time sample indicated as t1 in Figure 3 for Case Q the Decision and Control scan may run as shown in Table 1 by the dashed line leading to Regime #3 and the output control order may consist of orders to run back certain generators fast. Some time after such preliminary restoration of Viability, at another time sample, say t2, the Decision Phase may opt for Regime #4 resulting in an "optimal" system viable for an hour or so until full restoration to normalcy becomes possible in Regime #5.

5. DEMONSTRATION OF PERFORMANCE BY A SIMULATED CASE HISTORY; AN EXAMPLE

Several years of research work is represented by the Decision and Control type system operation summarized in this paper. Much detailed work in solutions, new insights, new concepts and new computational or algorithmic tools were developed in the course of this Some of these results were previously pubresearch. lished, particularly those relating to the Observation Decoupled State Space. Other details will be given in coming publications [4], [6], and in a companion With reference to Table 1, detailed repaper [5]. sults are now available for Control Regimes #0, #1,#2 #3, and-# 4. Because of the sheer bulk of the research results it is impossible to cover them even sketchily in one paper. All that is possible here is to illustrate by simulation, on a relatively simple emergency, the sequence of events which takes place in Decision and Control Type Operation. The system known as the IEEE 118 bus test system this [4] and shown in Figure 4 will be used for demonstration. Since, however, the IEEE 118 bus syswhich derives from the network of a large Midtem, western Utility as it was some years ago, is not susceptible to either Stability or Viability Crisis, (once a tornado took out several lines onthis system with no serious disruption of service), it is necessary to modify the system to illustrate a Stability

43

LINE 15-33 19-34

BUS l 2 3 4

23-24

IMPEDANCES (p.u.) 0. 19+jO.62 0.3 +jo.988 0. 14+jO.5

LOAD (MVA) 36+j 27 6+j9 24+j 10 15+j 12 37+j22

7 15 16 17 18 19
BUS
10

20+j 10 O+jO 300+j93 O+jO O+jO

GENERATION (MW) 450 85 534

4+j2

12 25

Figure 4. The Modified IEEE System and Viability Crisis. Specifically, slort 1.neo and 140transformers were consolidated for computational purposes and impedances of lines 15-33,19-34 add Z3-24 were 105 modified as shown in Figure 4. Also shown in Figure 4 is the modified loads, and generation on the left side of the dotted line. Other base case line, generator,
70
10

and

load

data

are

available

in

With the modified line impedances, the segment of the system to the left of the dotted line becomes an Area connected to the larger system on the right by a set of four rather weak tie lines. In fact, the transient stability of this combination is so marginal that one would be unlikely to operate such a system in the state of art. -One point of the following illustration is that operating such systems becomes possible by using Decision and Control techniques. This would amount to great savings in installations of new equipment.

[4]

among

other

sources.

o
0.o
TIME (SECONDS)

Now the following contingency is assumed: 3 phase short circuit occurs at 1. A total bus 17. 2. Regime #1 controls initially consist of selective network protection which springs into action automatically and locally to isolate the faulted equipment. However, a curcuit breaker fails to function and the backup clearing takes a total of 12 cycles. Also line 17-38 and the total load of AP=300MW at bus 17 are lost during this operation. The stability augmentation part of Regime #1 does not come into operation since bus 17 contains no generator. conventional in Up to this point everything is this partitular contingency. If no further actions were taken then as the time history of bus phase anbe gles plotted in Figure 5 shows, the system would violently unstable and would break into two islands a classic case of multimachine multiwing instability. In contrast Figure 6 shows what happens if Decision and Control operation runs its course as follows: 3. Through all the Regimes (#0-5) computation of the Observation Decoupled State 6 proceeds at a fixed sampling rate on special, dedicated microprocessors
-

Figure 5. Wvith conly Conventional Selective the system breakEs up into two islands.
70

Protect ion

35

<

-v

-700.6 i.2

1.8
TIME (SECONDS)

With full Decision and Control Operation seFtgsoe 6. quence the system Stability and Viability is restored.

44

(about 5-10 milliseconds per computation on IBM 360/65). The output is near zero everywhere for 6 during normal operation but at the instant of the fault nonzero values or no solutions are obtained at some busses because of voltage collapse. The same microprocessors also compute (in about 10 milliseconds on the IBM 360/65) from the Observation Decoupled State data any sudden changes, AP, in the load balance at the local bus (See [4]). 4. Information on 6 and/or AP and on the action of the selective protection in Regime #1 is flashed to the Decision Phase in the Control Center which at the next sample time notes that an Abnormality is in prothe gress in the vicinity of bus 17 and gives alarm to operator. No action is, however, taken by the operator. The Decision Phase orders Regime #2 into action and (Table 1) by doing nothing Rfegime #2 is local automatic.
TIME (SECONDS)

tigurc

i'egime #2 the system stability is momentarily preserved even when the fault is cleared after 30 cycles.

-9.

Witlh only local staaility

augmentation

in

35

-35

TIME' (SECONDS)
-70
nt. Figure 7. Vii; oil;7 Local Stabilit-T- Aui-: on iii Regime #2 the system Stability is momentarily preserved buit the system is not Viable.

0.6

1.2
TIME (SECONDS)

1.8

2.4

0"
vs

.0

0.6

1.2

1.8

2.4

TIME (SECONDS)

Figure 8. 'Iith only conventional selective ar-otection two acting within 3 cycles the system breaks up into islands. the 5. Regime #2 waits till 0.2 seconds after that is long enough to let Regime onset of the fault #1 take care of the post fault switching and clearing of the fault (Figure 6). At that time it comes into action (Table 1) using braking resistors and short time load skipping at the various busses. The commanding of these control tools is strictly local using a norm control by The Regime #2 reducing control law [4]. itself is effective in stabilizing the system temporarily as illustrated by Figure 7. In fact the effectiveness of this control in stabilizing the system is truly remarkable. Figure 8 shows the course of this control is used but the emergency when no Regime #2 fault is cleared in 3 cycles. The system is still violently unstable. On the other hand Figure 9 shows that Regime #2 controls readily keep the system together even when the fault persists for 30 cycles. This represents a

clearing time.

critical more than 10 times increase of the This is a dramatic illustration of the effectiveness of Regime #2 controls which are the re-

sult of this project.

.igure 10. hilhen Local Stability Augmentation in Regime 12 is turned off and not followed by Regime #3, instability recurs. It can be further observed, however, in Figure 10 that the system will return to instability if the Regime #2 control is turned off - in this case it is turned off at 1.5 seconds. The point is that Regime #2 must eventually be turned off because the resistors heat up. So, it is important that appropriate measures be taken in this case before turning off the resistors. This calls for Regime #3 control. How is then the decision reached to turn to Regime #3, this latter being centrally rather than locally controlled? A reliable value for AP at bus 17 of about 30014W becomes available about 0.5 to 0.75 seconds after the onset of the fault. (Of course, the experimenter knows it is 300MW lost but the Decision Phase only finds out at this point). At this point the Decision Phase performs at the next sample (see dashed line in Table 1) the Concentric Relaxation Algorithm [5] around bus 17. seconds in This is estimated to take about 0.1 - 02 the Control Center computer. The conclusion is reached from this computation that the post fault steady state torque angles on the lines of the dashed line cutset in Figure 4 range 60-70 degrees if no change is made on the affected area. (This particular computation is presented in detail in a companion paper [5]). This is taken by the Decision Phase as evidence of a Viability Crisis on account of instability since it is clear that even a small transient cannot settle out at these large torque angles. Immediate Viabilization is called for on the affected area and the Degree #4 Decision block in Table 1 puts the Control Regime #3 in charge as This choice only takes a shown by the dashed line. few microseconds. Note that the existence of a weak cutset would be known and so this cutset would be tested as a matter of routine. 5. Regime #3 scans ths available control means on the area to the left of the dashed cutset in Figure 4 since viabilization clearly requires action on this segment given the just computed large steady state torque angles without such action. It finds that fast

45 Security Defect is the condition of the system when the system is not Viable for some contingencies within the set of preselected potential disturbances used to define Security. System Viability is the ability of the system to operate in a given condition without the loss of load or stability and with the frequency, the voltages, the currents, etc. remaining within tolerances which are permissible for a given time period. The system is then viable in this given condition for this given time period. Viability Crisis is an ongoing condition where the time period of Viability is so short (including zero) that it requires emergency action to lengthen it sufficiently for continued system operation. Typical ranges: 0 - 0.1 seconds range-usually connected with stability or torque angle problems (Regime #3)
1 minute range-usually connected with thermal over load or undervoltage (Regime #3)

2. 1

TIME (SECONDS)

Figure 11. Regime 13 alone would make the rystem Viable but it cannot restore Stability. generator runback of 150MW each is available at units #10 and #25. This measure is chosen by the control algorithm [4] since the only less objectionable measure, frequency reduction (Table 2), is not effective in a Viability Crisis caused by instability. The torque angles with runback on the dashed cutset are checked by Concentric Relaxation [5] again and are found to be in the range 80 to 140 (another 0.1 - 0.2 This is quite satisfactorily seconds). stable. Consequently runback of 150MW each on units #10 and #25 is ordered and carried out at 2 seconds as shown in Figure 6 with clearly very satisfactory results. In contrast Figures 10 and 11 show that neither of Regime #2 or #3 alone is effective in stabilizing the system. 6. Using a combination of Regimes #2 and #3 as in Figure 6 the system remains stable and viable but further adjustments are needed in a matter of minutes since fast runback leaves the units in a condition which is only temporarily admissible. Thus Regime #4 will be initiated and it will order some action like the normalizing of the unit #10 and #25 generation at their reduced level or somewhat higher-drawing some additional power through the ties. AGC will need to be readjusted to do the latter. 7. Restoration - Regime #5 will see to the reconnection of the lost load and a rise back to normal of the generation after the faulted equipment is checked out or possibly bypassed. Regime #4 and Regime #5 algorithms have not yet been developed. This remains for further research.

10 minute range-usually connected with overload or undervoltage (Regime #3)

thermal

6.

CONCLUSIONS

System Integrity is a condition of the system where all loads are supplied according to their demand and all parts of the system are energized and interconnected as scheduled. Integrity Crisis is a condition where system Integrity is lost in some respect for instance, loads have been dropped, some parts of the system are deenergized or the system is islanded into disconnected segments. Note: Loss of individual pieces of equipment such as a generator, a transmission line, etc. is considered a Structural Defect (possibly combined with a higher level of Abnormality - a Viability or Integrity Crisis, for instance) but not per se as Integrity Crisis. Structural Control consists of structural changes (switching of lines, generators, islanding) ordered by the control and aimed at computer altering the behaviour or the Viability of the system. Two levels 1. Local or First Stage Structural Control: Structural Changes carried out locally based on local information. E.g. the functioning of selective protection or load skipping. 2. Second Stage Structural Control: Structural Changes ordered by the Control Center Computer. E.g.: Intentional islanding

The preceding case history illustrated just one relatively uncomplicated emergency situation where a system which would not be practical with state of art operating techniques is maintained stable and operating by the use of the Decision and Control Operation. Adoption of a fully developed operating practice along these lines would extend decisively the operating range and undisrupted times of the large interconnected power system. This, of course, would result in major savings by reducing the cost of equipment especially expansion cost of transmission. There sould be offsetting cost in telecommunication and control equipment but it is conjectured that the added expense would be dwarfed by the savings.

8.
1.

REFERENCES

2.3.

4.

7.

APPENDIX

DEFINITIONS OF A FEW TERHS

5. 6.

Stability Crisis is an ongoing dynamic condition of the system which will lead to system breakup unless emergency measures are taken. System Security is the ability of the system to remain Viable if stricken by any of a set of preselected potential disturbances (e.g.: First contingencies).

T.E. Dy Liacco, "The Adaptive Reliability Control System", IEEE Transactions on PAS, May 1967, pp. 517-531. L.H. Fink and K. Carlsen, "Operating under Stress and Strain", IEEE Spectrum, March 1978, pp. 48-53. J. Zaborszky, A.K. Subramanian, T.J. Tarn and K.M. Lu, "A New State Space for Emergency Control in the Interconnected Power System", IEEE Transactions on Automatic Control, August 1977, pp. 505517. J. Zaborszky, K.W. Whang and K.V. Prasad, "Monitoring, Evaluation and Control of Power System Emergencies", Report No. SSM 7907, Department of Systems Science and Mathematics, Washington University, St. Louis, Missouri, 63130. J. Zaborszky, K.W. Whang and K.V. Prasad, "Fast Contingency Evaluation Using Concentric Relaxation", Companion paper. J. Zaborszky, H. Mukai, and J. Singh, "Control of Power System in the Normal State", Report No. SSM 7902, Department of Systems Science and Mathematics, Washington University, St. Louis, MO 63130