The Gulf Cooperation Council Interconnection Authority (GCCIA) owns and operates the 400kV interconnector linking the power systems of the GCC Member States. The interconnector reliability is based on certain level of adequacy and security. Adequacy is the ability of the interconnector to supply the load at any moment while the security of the interconnector qualifies its ability to withstand disturbances that can be either a fault affecting a transmission line or the sudden trip of a generator. To evaluate the security level, GCCIA periodically carry out probabilistic and deterministic analysis of the Combined System through independent consultants. During the recent Operational Studies for the year 2015-17, it was established that the existing margins for the N-1 contingencies are adequate. However, the defense plans implemented for the security of the Interconnected System to cover the contingencies beyond the N-1 level, needs to be revisited due to the topological changes and expansion. The study proposed to enhance the adequacy and security of the Combined System by considering Remedial Action Schemes that will take corrective actions within the Member State(s), in which high severity event occur, to prevent its isolation from the Interconnector and a potential blackout. This paper briefly highlight the existing adequacy & security levels of the Interconnector and the proposed approach to further secure the stability of the Combined System against high severity events that cannot be secured

1. Page 1 of 7
Reliability of the GCC Interconnector
Ikram Rahim
Senior Operational Planning Engineer
GCC Interconnection Authority
irahim@gccia.com.sa
Hatim Elsayed
Operational Planning Section Head
GCC Interconnection Authority
helsayed@gccia.com.sa
Nasser Al-Shahrani
Director, Operations and Control
GCC Interconnection Authority
nshahrani@gccia.com.sa
Ossama Ahmed
Operation Planning Engineer
GCC Interconnection Authority
oahmed@gccia.com.sa
Hashim Al-Zahrani
ICC Operations Section Head
GCC Interconnection Authority
icch@gccia.com.sa
Abstract
The Gulf Cooperation Council Interconnection Authority
(GCCIA) owns and operates the 400kV interconnector
linking the power systems of the GCC Member States. The
interconnector reliability is based on certain level of
adequacy and security. Adequacy is the ability of the
interconnector to supply the load at any moment while the
security of the interconnector qualifies its ability to
withstand disturbances that can be either a fault affecting a
transmission line or the sudden trip of a generator.
To evaluate the security level, GCCIA periodically carry
out probabilistic and deterministic analysis of the
Combined System through independent consultants.
During the recent Operational Studies for the year 2015-17,
it was established that the existing margins for the N-1
contingencies are adequate. However, the defense plans
implemented for the security of the Interconnected System
to cover the contingencies beyond the N-1 level, needs to
be revisited due to the topological changes and expansion.
The study proposed to enhance the adequacy and security
of the Combined System by considering Remedial Action
Schemes that will take corrective actions within the
Member State(s), in which high severity event occur, to
prevent its isolation from the Interconnector and a potential
blackout.
This paper briefly highlight the existing adequacy &
security levels of the Interconnector and the proposed
approach to further secure the stability of the Combined
System against high severity events that cannot be secured
by margins.
Keywords
OSM: Oscillatory Stability Management
OST: Out of Step Protection
PMU: Phasor Measurement Unit
RAS: Remedial Action Scheme
RTU: Remote Terminal Unit
SIPS: System Integrity Protection Scheme
SPS: Special Protection Scheme
TCP: Transmission Control Protocol
WAMS: Wide Area Monitoring System
2. Introduction
Most of the time, a power system operates under a
condition known as secure or normal. This is so when all
the operating parameters of the single power system
components have values which are within the rated limits
and when the power generation meets the load demand with
adequate regulation margins available.
The power system remains to be operating under such
conditions until a contingency upsetting its operating
balance occurs. In this case, the system condition can be
defined either in alert stage or unstable. These
contingencies are usually due to unexpected malfunctions,
such as the loss of a generating unit, the trip of a tie line, or
the unpredictable increase of the load demand. When a
contingency occurs, protection and control actions are
required to stop system degradation, restore the system to a
normal state, and minimize the impact of the imbalance.

2. Page 2 of 7
Figure-1, Four states of Power System
The contingency becomes a non-expected event that cannot
be anticipated and the severity of a contingency can be
qualified as one of the following states [2]:
1) Alert State is when the power system experiences a
high probability contingency and does not cause
interruptions.
2) Emergency State is when the low probability
contingency develops into a cascading effect. For
instance, the tripping a transmission line might
overload another transmission line, and to avoid a
cascading impact, immediate automatic or manual
actions are required to adjust the power on
transmission system.
3) Major Disturbance caused by a sequence of low-
probability multiple contingencies with complex
interactions, characterized by a partial or complete
blackout.
The security against the high probability events is based on
margins and is a common worldwide practice, called N-1
criteria. Thanks to the adequate level of redundancy
(defined and decided at the planning stage), high
probability events have the lowest severity [2].
Table-1, Risk Matrix
In contrast, high severity events are more improbable, yet
they still might occur. Such events can be extremely
dangerous for the power system and cannot be secured by
margins. Hence, if an initial contingency is followed by a
chain-reaction of other events, which go out of control, the
power system may successively evolve to an even more
critical operating condition, known as emergency.
In normal and alert states, the system can be controlled
manually by the operator and/or through slow controllers
(AGC, on load tap changer etc.). In emergency, in order to
avoid a further degradation, the system must be controlled
by fast automatic actions or the system would lead to total
or partial blackout state. These automatic actions are
identified as special protection schemes or defense plans.
Figure-2, Operators tasks
3. GCCIA Assessment Criteria
The GCC interconnected system is characterized by several
blocks (Member States) connected together by relatively
long AC lines. In case of long lines, the maximum
transmissible power between the Member States might be
lower than the nominal thermal rating of the lines, cables
and transformers, due to stability limit.
Figure-3, GCC Interconnected System [3]

3. Page 2 of 7
Figure-1, Four states of Power System
The contingency becomes a non-expected event that cannot
be anticipated and the severity of a contingency can be
qualified as one of the following states [2]:
1) Alert State is when the power system experiences a
high probability contingency and does not cause
interruptions.
2) Emergency State is when the low probability
contingency develops into a cascading effect. For
instance, the tripping a transmission line might
overload another transmission line, and to avoid a
cascading impact, immediate automatic or manual
actions are required to adjust the power on
transmission system.
3) Major Disturbance caused by a sequence of low-
probability multiple contingencies with complex
interactions, characterized by a partial or complete
blackout.
The security against the high probability events is based on
margins and is a common worldwide practice, called N-1
criteria. Thanks to the adequate level of redundancy
(defined and decided at the planning stage), high
probability events have the lowest severity [2].
Table-1, Risk Matrix
In contrast, high severity events are more improbable, yet
they still might occur. Such events can be extremely
dangerous for the power system and cannot be secured by
margins. Hence, if an initial contingency is followed by a
chain-reaction of other events, which go out of control, the
power system may successively evolve to an even more
critical operating condition, known as emergency.
In normal and alert states, the system can be controlled
manually by the operator and/or through slow controllers
(AGC, on load tap changer etc.). In emergency, in order to
avoid a further degradation, the system must be controlled
by fast automatic actions or the system would lead to total
or partial blackout state. These automatic actions are
identified as special protection schemes or defense plans.
Figure-2, Operators tasks
3. GCCIA Assessment Criteria
The GCC interconnected system is characterized by several
blocks (Member States) connected together by relatively
long AC lines. In case of long lines, the maximum
transmissible power between the Member States might be
lower than the nominal thermal rating of the lines, cables
and transformers, due to stability limit.
Figure-3, GCC Interconnected System [3]

4. Page 4 of 7
have to provide tools to limit the effects of high severity
low probability events well beyond the single or multiple
credible contingencies. To do so, a combination of
emergency actions on load or generation, triggered
automatically by event or system conditions, are required.
Such emergency actions that protect the system stability
and when possible its integrity in comparison with classical
protections that protect individual equipment are termed as
defense plans. Defense plans are therefore a set of
coordinated automatic countermeasures intended to ensure
that the overall power system is protected against major
disturbances involving multiple or high severity
contingency events.
In this sense, a Defense Plan must guarantee the respect of
general stability definition of CIGRE “power system
stability can be defined as the ability of an electric power
system, for a given initial operating condition, to regain a
state of operating equilibrium after being subjected to a
physical disturbance, with most system variables bounded
so that practically the entire system remains intact”.
5. Implemented Defense Plan
To protect the Interconnector and the connected Member
States against frequency instabilities, voltage instabilities,
loss of synchronism and cascade tripping, the dynamic
behavior of the system was assessed as part of the Ph-I &
Ph-III system studies. Based on the assessment and
recommendations the below system protections were set as
part of the Defense Plan for the combined system;
Protection against Frequency Collapse [2]
Due to events severe than the secured contingency, the
holding of the frequency within acceptable range normally
performed by the units governor action is compensated by
the action of under frequency load shedding.
When different power systems are interconnected, a
coordinated load-shedding plan is able to limit the shed
load in each part of the interconnected system by applying
the “solidarity” principle: the load is shed not only in the
area where the imbalance occurs but also in the other parts
of the interconnected systems. This supposes that the
released excess power can be transmitted to the event
location.
The global percentage of the total load shedding is limited
to 50% due to the over-voltage problems arising during and
after the frequency restoration.
The practice suggested in the international guidelines to
share the UFLS, frequency thresholds is very important and
allow distributing the support through the interconnected
areas. If this practice would not be adopted the Member
States with the highest frequency thresholds would in
general shed load before others Member States.
Coordination was therefore required between the Member
States in order to maximize the chance to avoid a complete
or partial frequency collapse in the system and to share the
contribution at each stage of the frequency threshold.
Considering the harmonization in terms of frequency
thresholds and amount of load shedding, the recommended
changes are highlighted in red in the Table below.
Table-2, UFLS stages and Recommended Harmonization [3]
Protection against Voltage Collapse [2]
The GCCIA system, like other power systems located in
the hot summer parts of the world, is characterized by a
significant part of air conditioning in the load mix. The
related appliances especially the large numbers of motors
driving the compressor subject the power system to delayed
voltage recovery following voltage dips and faults located
in the transmission system.
Above a given proportion of induction motors in the load
mix, loading of the motors and most important the loading
of the distribution step down transformers, large scale
voltage instabilities can take place in large and dense urban
area. These instabilities are local and require to be
mitigated at the local level.
These mitigation measures need to be backed up by Under
Voltage Load Shedding located at the distribution level.
A back up under voltage protection was recommended to
be set up at all interface points with the Member States,
preventing the low voltages and the associated risk to the
Interconnected System.
The recommended settings are between 0.8 and 0.85 p.u.
with activation time comprised between 2 and 3 seconds.
Protection against Loss of Synchronism [1], [2]
Based on the transient stability results, it was recommended
to install out-of-step relays at key locations to detect loss of
synchronism and split the system according the various
group of coherent units in cases where inter-area out of step
phenomena occur.
The correct operation of these relays were tested during the
Ph-III studies for dynamic assessment of Combined
System. Among 74 analyzed cases, 68 of them have
showed successful operation – which corresponds to a
success rate of 92% with respect to the considered
operating conditions. In addition, it was observed that no
relay is activated following three phase faults eliminated in
base time (80 ms).

5. Page 5 of 7
The Out of Step detection is based on the proven ΔZ/Δt
principle associated with two concentric polygon
characteristic, as presented in figure below;
Figure-5, Out of Step Protection Detection Principle [2]
In order to configure the out of step relay the parameters
defining Zone 5 and Zone 6 have to be determined. Based
on the relay manufacturer recommendations and the
specifications of the GCCIA network, the below settings
for the OST relays were recommended.
Table-3, OST Protection Settings [2]
6. Analysis of the Existing Defense Plan
Based on the probabilistic and deterministic analysis of the
Combined System as part of the Operational Studies for the
year 2015-17, it was established that the existing defense
plans for the security of the interconnected system needs
reassessment.
The load demand growth, expansions and the topological
changes within the Combined System over the years has
drastically reduced the possibility to share UFLS between
the Member States. The augmented strength of the Member
States systems interconnected through long Interconnector
lines do not permit the joint activation of the UFLS stages.
The amount of generation deficit required to activate the
first stage of UFLS trigger strong transients, making
imbalanced frequency variation across the Combined
System [3].
Resultantly, after a severe event of generation loss and
depending on the pre-contingency power flows on the
interconnector, the following situations may occur [3]:
• Frequency drop in the interconnected system will not
reach to the level of joint activation of UFLS stages
• The severe deficit will result in large imbalance
between the load and the generation, a fast increase of
the flow across the Interconnector, voltage drop at the
interface and hence an un-unstable power swing
• The frequency in the deficit Member State drops faster
than the frequencies of the others Member States while
the system integrity is still in place. Hence, a stability
limit will reach and the system behavior become
unstable.
• The imbalanced frequency variation leads to angular
stability. This behavior indicates the beginning of a
loss of synchronization. The out of step phenomenon
between the deficit Member State and the rest of the
system occur before the frequency drop in the whole
system.
Figure-6, Voltage & Active Power Flow Measurements during
unstable Swing
Figure-7, Frequency Measurements during unstable Swing
The Out of Step protection is used to split the power system
into possibly stable areas of generation and load balance
during unstable power oscillations. The points at which the
system should be split are determined by detailed system
stability studies. The same principle was adopted for the
GCCIA Interconnected System based on Ph-1 & III studies
to isolate the system under disturbance through OST
protection, to ensure the security of the rest of the system.
However, due to the structure of the GCC Interconnected
System and the OST separation points, it is not possible to
obtain a load-generation balance in the isolated portion of
the system. Hence, the loss of synchronism and the out of

6. Page 6 of 7
step action further destabilize the system already under
disturbance.
In simulation results it was found that the load related
instabilities and voltage instabilities in the system under
disturbance, occur before the out of step action [3].
Figure-8, Simulation Plots showing Voltage Instabilities
These situations might lead to a partial or complete
blackout in the isolated Member State. Hence, it is essential
to prevent the separation of the system under disturbance
due to angular instability or overload phenomena.
7. Remedial Action Scheme
Remedial Action Schemes (RAS) also known as Special
Protection Scheme (SPS) or System Integrity Protection
Scheme (SIPS_IEEE Term) is;
• A scheme designed to detect predetermined System
conditions and automatically take corrective actions
that may include, but are not limited to, curtailing or
tripping generation or other sources, curtailing or
tripping load, or reconfiguring a System(s) [6].
Table-4, RAS Actions against Probable Contingencies
RAS accomplish one or more of the following objectives:
• Meet requirements identified in the Reliability
Standards;
• Maintain System stability;
• Maintain acceptable System voltages;
• Maintain acceptable power flows;
• Limit the impact of Cascading; or
• Address other Bulk Electric System (BES) reliability
concerns.
RAS is to solve single and credible multi-contingency
problems not protected by standard equipment protection.
RAS address specific pre-determined problems such as
equipment overloads, low voltages, unstable generation,
and unstable load.
RAS can be event-based that directly detect outages and/or
fault events and initiate actions, parameter-based that
measure variables for which a significant change confirms
the occurrence of a critical event or response-based that
monitor system response during disturbances and react to
actual system conditions.
RAS are generally designed to mitigate three types of
power system problems and time scales [5]:
• Transient instability (cycles to seconds); results from
disturbance that might lead to out of step conditions.
Examples of mitigation include fast load shedding and
fast shunt capacitor / reactor switching
• Voltage instability (seconds to minutes); results from
increased reactive load or loading beyond SIL limits.
Examples of mitigation include shunt capacitor /
reactor switching or load shedding
• Thermal overloading (minutes); result from excessive
currents flowing through transmission circuits caused
by heavy or cyclic loads. Examples of mitigation
include backing generation or load shedding
RAS for the Combined System
RAS will increase the robustness of the Member States
power systems following severe disturbances. These severe
disturbances are typically worse than N-1 contingencies.
For example, covering the consequences of a three-phase
short circuit, followed by the loss of an entire power plant.
The proposal is to approach the security of the Combined
System in three nested levels. This strategy is known as
‘defense in depth’. This terminology is well known in the
nuclear sector, where above all a fatal incident must be
avoided. Level 1 consists of the normal protection means.
If for some reason this protection fails or is not able to
mitigate the incident, the next level contains additional
protection measures. Various levels of protection are
nested trapped, covering incidents having a progressively
reduced likelihood of occurrence.
If this strategy is translated into automatic protection
systems for the Combined System, the following approach
can be followed.

7. Page 7 of 7
Figure-9, Defense in Depth
With the existing level of system protection, the loss of
Interconnection after severe deficiency will possibly cause
higher level of load being shed in the deficit Member State.
The high level of load shedding will further destabilize the
Member State System and might lead to partial or total
blackout. This scenario is highly unwanted and therefore,
for keeping the Interconnector within stability limits, it is
required to shed load in a controlled way so the
interconnection can be maintained and the support
continued.
RAS is an intelligent scheme that will shed an amount of
load in the deficient Member State system in order to avoid
an apparent overload of the interconnection. Once the
interconnection is safeguarded, the Member State system
can be restored quickly to the normal operating state.
Figure-10, Simulation Plot with RAS Action on Measured Power
To keep GCCIA interconnection intact and to keep the
integrity of the Combined System after a major
contingency, it is required to design and implement RAS
at all Interface Points based on the trip of a pre-defined
load within the system under disturbance. The trigger of
the load disconnection can be based on delta angle for the
Interface corridor or local measurements. It is also
required for RAS to consider system under various
operating constraints. [3]
8. Conclusions & Recommendations
This paper highlight the existing adequacy and security
level of the Interconnected System and the defense plan
that was designed to protect the Combined System and the
connected Member States for contingencies beyond N-1. It
is to be noted that the present trend of load growth in the
region outpaced transmission expansion. Although the
Combined System demonstrated, a very good performance
in critical scenarios but the severe contingencies magnified
by this load / transmission imbalance do require alternative
solutions such as RAS to fill the gaps.
It is recommended to improve the maximum transfer
capacity towards the Member States and/or to minimize the
risk of disconnection of the interconnection.
Considering the importance of the interconnection for the
stability of the Member States, it is recommended to install
RAS at the Interface Points.
For the design of the RAS the below criteria is
recommended to be considered [4];
• Dependability: operate only when strictly necessary
• Security: not operate when not required
• Selectivity: identify the minimum impacting actions
for a predefined event
• Robustness: insensitive to disturbances, state changes,
“unexpected” events
• Adaptability: capable to adapt itself to system
expansions/evolutions
9. References
[1] “Preparation Of System Operation For The GCC
Interconnection Authority” Phase-1 Final Report,
24 April 2009
[2] “Preparation of System Operation for the GCC
Interconnection Phase-III” Final Report, System
& EMT studies July 18th
, 2011
[3] “Operational Standards Review and Operational
Studies for the 2015-2017 GCC Interconnected
Grid” Final Report, 12/12/2016
[4] “System control concepts for avoiding blackouts
using PMUs and monitoring in large power
systems”, Dr. Giorgio Maria Giannuzzi, TERNA
SpA, Dr. Roberto Zaottini, TERNA SpA
[5] Remedial Action Schemes (RAS), Brant Heap,
Salt River Project, March 19th
, 2014
[6] NERC “Remedial Action Scheme” Definition
Development, Project 2010-05.2 – Special
Protection Systems, June 2014
[7] GCCIA Interconnector Transmission Code, Issue
2.1 – May 2013