TOP-004-2 R4 Unknown Operating State September 30, 2014 Greg Sorenson, PE Senior Compliance Engineer gsorenson.re@spp.org 501.688.1713
Outline Requirement Language Study Outcomes and Limitations Self-Check Questions Case Studies Internal s Audit Questions we might ask 2
TOP-004-2 R4 If a Transmission Operator enters an unknown operating state (i.e. any state for which valid operating limits have not been determined), it will be considered to be in an emergency and shall restore operations to respect proven reliable power system limits within 30 minutes. 3
NERC Definition - System Operating Limits The value (such as MW, MVar, Amperes, Frequency or Volts) that satisfies the most limiting (emphasis added) of the prescribed operating criteria for a specified system configuration to ensure operation within acceptable reliability criteria. System Operating Limits are based upon certain operating criteria. These include, but are not limited to: Facility Ratings (Applicable pre- and post-contingency equipment or facility ratings) Transient Stability Ratings (Applicable pre- and post- Contingency Stability Limits) Voltage Stability Ratings (Applicable pre- and post- Contingency Voltage Stability) System Voltage Limits (Applicable pre- and post- Contingency Voltage Limits) 4
Studies Routinely Performed Transmission Planning Studies (TPL-001, 002, 003, 004) Tariff Studies (MOD-001, MOD-030) Interconnection Studies (FAC-002) Next Day Studies (TOP-002 R11) Outage Coordination Studies (TOP-004 R6, TOP-002) Real Time Contingency Analysis (TOP-002 R11) 5
Facility Ratings Final facility ratings are the basis for all studies Inaccurate facility ratings lead to invalid system studies Ask Yourself. Are operations and planning working off the same set of ratings? Are the same ratings reported to the Planning Coordinator and the Reliability Coordinator and Transmission Service Provider? Are interconnection ratings verified with neighbors? Do flowgate limits correspond to your ratings? 6
Planning Studies N-1 in planning horizon N-2 studies, many entities run all N-2 contingencies Stability studies consider single phase and 3 phase faults, establish clearing times Form the baseline seasonal study Ask Yourself Do operators have access to the results of these studies? 7
State Estimator Uses meter inputs to calculate a best guess of what is happening Can compensate for a broken RTU Forms the basis for the Real Time Contingency Analysis tool and flowgate monitoring tools Ask Yourself What actions should be taken if an RTU fails? What actions should be taken if the State Estimator alarms? 8
Next Day Studies Typically study the outages planned to ensure that no problems are anticipated at peak hour Risks: Switching may not occur at peak hour, generators online may be significantly different, Flows may be higher at non-peak due to wind generation output Forced outage(s) between next-day and current day 9
Real Time Contingency Analysis (RTCA) Takes all N-1 contingencies periodically from the current state Should be referenced after forced outages (30 minutes) Assumes protection systems clear only one element Ask Yourself Do you have a procedure that covers what needs to be done if the RTCA fails? What if a contingency case does not converge? Is this routinely checked? Is this checked after switching/forced outages? 10
Planning vs. Operational Studies Lines in Service - All vs. 10-40 out for maintenance Generation available All vs. Actual Dispatch - Chosen vs. Market/Variable Protection Systems - Operational vs. Broken Time - Peak hour vs. Minimum or switching hour In-service Date - Estimated vs. Actual Ratings - Fixed vs. Dynamic 11
Stability Concerns Clearing times are assumed by studies (25 cycles) Certain areas may be determined to have more stringent requirements (4 cycles) If these clearing times cannot be met, the circuit needs to be switched out or the effect of the cascade studied Plants should not be operated above the output in the stability study 12
Protection System Failures Do operators know what relays are redundant? What actions need to be taken in the case of a relay alarm? (POTT vs. DCB) What if the relay cannot be fixed in the field? Ask Yourself What carriers are out of service? Have they been studied? What actions will be taken for relay alarms? 13
Example #1 - Post Event Investigation Entity had numerous facility ratings that were incorrect which led to invalid studies Entity was relying on a third-party to conduct operational studies, but did not provide accurate ratings Entity did not study the effect of numerous carrier failures Entity had protection systems that were failed long enough that a transmission planning study should have been used $350,000 penalty and $2,000,000 of compliance improvements 136 FERC 61,132, FERC Order Approving Stipulation and Consent Agreement, penalty assessed for several violations, not just TOP-004 R4 14
Example #2 - Post Event Investigation Uninterruptible Power Supply at power plant for boiler controls were out of service (one for a week, one for 5 months) This condition was not reported to system operations Plant could not ride through nearby fault No study of this condition was done Dynamic and Stability Studies assume all equipment is in proper working order $3,925,000 penalty plus additional Reliability Measures 137 FERC 61,176 15
Example #3 Post Event Investigation While troubleshooting, primary and secondary (breaker failure) relay protection was disabled Effect of disabling protection was not studied, even though the live work was approved 37 minutes later, subsequent switching was conducted, fault occurred, cleared after 1.7 seconds 22 transmission lines, 4,300 MW of generation, 3650MW load lost $25,000,000 penalty plus additional reliability enhancements 129 FERC 61,016 16
Event #4 Post Event Investigation Next day plan (based on outdated powerflow) indicated: If both transformer A1 and A2 tripped, transformer B would trip Another line would be at 109% of normal, which would activate a Special Protection System RTCA indicated for 44 minutes that loss of A1 would overload A2 above its trip point (operator did not monitor RTCA except once per shift) 2.7 million customers lost $3,000,000 penalty plus $9,000,000 in improvements 148 FERC 61,108 17
TOP-004-2 Internal Examples (1 of 3) Procedure/ Process Activity Type Facility Ratings Construction Review Facility ratings are reviewed after construction is complete to ensure as built is correct and rating correct Detective Model development Configuration Management All rating changes to systems are reviewed, approved, and double checked after implementation to ensure accuracy of all study models Preventative SOL Correction Plan Pre-planned actions Plan to reduce flow was developed ahead of time. Operator takes action when SOL exceeded. Corrective Outage Approval Protection System review Review to see effect of Zone 2 tripping near area of proposed outage. Review to see if an unusual situation is created that would cause Zone 1 to fail. Preventative 18
TOP-004-2 Internal Examples (2 of 3) Procedure/ Process Activity Type Monitoring SOLs EMS Alarm Systems are configured to alarm when SOLs are approached. Detective RTCA monitoring Alarm RTCA alarms when it identifies a new contingency, does not solve, or cannot solve a case Detective Outage Switching RTCA check RTCA checked by operator after any forced or planned outage to verify system is safe for next contingency. Preventative Outage Approval Protection System review Review to see effect of Zone 2 tripping near area of proposed outage. Review to see if an unusual situation is created that would cause Zone 1 to fail. Corrective 19
TOP-004-2 Internal Examples (3 of 3) Procedure/ Process Activity Type Failed Equipment Reporting Effective Reporting TOP reviews expectations with GOPs and field personnel to ensure that failed equipment is reported so it can be studied. Preventative Failed Equipment Repair Management Review Management should review failed equipment reports to ensure that prompt repair action is being taken Corrective Alarm responses Training Drills Operators conduct training on various RTCA alarms, relay alarms, and SE failure alarms. Preventative Real-time SOL monitoring RTCA System TOP Operator reviews RTCA results at a specified interval and takes action when needed. Preventative 20
Auditing the Overall Study Process (including TOP-004) Evidence should answer Are Facility Ratings correctly determined? Are planning models and operational models correct? Are stability and voltage limits correctly determined and still valid? Are effects of protection systems studied? Is improperly functioning equipment assessed? How are protection systems reviewed during the outage approval and work approval processes? Do the operators review RTCA results often enough? 21
QUESTIONS????? Greg Sorenson Sr. Compliance Engineer 501-688-1713 gsorenson.re@spp.org 22
Summary TOP-004-2 R4 requires operating in a known state 30 minutes to study or take action Planning and operational studies can be used to demonstrate a safe state Large events often have this as a contributing factor Internal s help ensure proper operation Audit questions you may be asked 23