The fundamental aspects of system reliability

©RTE 2004
17
The fundamental aspects of System reliability2 2.1 Power system
2.1.2 POWER SYSTEM OPERATION
Three major objectives govern power system operation:
• ensure operating reliability,
• favourtheeconomicperformanceandopeningoftheelectricitymarket,
• meet contractual commitments towards customers connected to the
transmission network.
System operation must guarantee:
• the maintenance of operating reliability (cf. § 2.2), i.e. controlling the
evolution and reactions of the power system in the face of the different
contingencies to which it is subjected (short-circuits, unexpected load
trends, unscheduled unavailability of generation or transmission
facilities, etc.), by reducing to the greatest extent possible any risk of
incidentsthatmayleadtoawidespreadpowerfailurecuttingofftheentire
countryorvastareas;
• the best utilisation of the network, serving the economic performance
of all the players of the power system; this means making the best
possible use of the service offers proposed by the players active within
the power system:
- the offers of generation and adjustment entities the managers of
which endeavour to ensure the best availability and improve
performances,
- the energy exchange possibilities with the other networks of the
European power system,
- the means of action on the supply-demand balance, within the scope
of contracts taken out by customers, control rules or emergency
measures,
- system services;
• the contractual commitments towards customers, notably as regards
quality of supply.
The System operator’s role is to simultaneously meet the
three objectives: reliability, economy and quality.

18
Power system operating
RELIABILITY
©RTE 2004
is the ability to:
Ensure
normal System operation
Limit the number of incidents
and avoid major incidents
Limit the consequences
of major incidents

©RTE 2004
19
The fundamental aspects of System reliability2 2.2 System reliability
2.2.1 DEFINITION
The notion of operating reliability was first introduced in the weaponry
sector in the 1940s and reliability study methods developed successively
during the 1960s and 1970s in aeronautics, nuclear power and land
transport.
The control of power system operating reliability is at the core of the
responsibilities entrusted to RTE under French law. It is defined as the
ability to:
• ensure normal System operation;
• limit the number of incidents and avoid major incidents;
• limittheconsequencesofmajorincidentswhenevertheydooccur.
Such a definition permits an active approach to improving reliability. It
encourages one to define the unacceptable consequences of incidents,
identify the initiating events and define mitigation measures limiting the
risks.These notions will be mentioned again in § 2.4.
The "Power system reliability" policy, defined and applied by RTE, is
presented in annexA.2.1.
2.2.2 STAKES OF SYSTEM RELIABILITY
A deterioration in power system reliability resulting in an increased
frequency of incidents and, should the occasion arise, in the occurrence
of a widespread incident over a large part or all of the French network,
would be a failure in carrying out the electricity quality public service
mission.
Over and above the direct human and economic consequences, the
outcome would be:
- the loss of public confidence that may weaken the new organisation of
the power sector, as well as giving up electricity for the benefit of the
other competitive energies;
- the loss of confidence of other foreign electricity company partners,
likely to call into question the management of interconnections;
- the calling into question of the professions concerned.

©RTE 2004
20
System reliability:
a determining stake
for all power system players
Supply interruptions
have an increasing impact
on the life of our society.
City of Rouen
SNCF
High-speed train
(TGV)

©RTE 2004
21
The reliability stake has been a determining issue for the System
operator for a long time. It is further reinforced today by the difficulties
encountered in installing new transmission facilities due to the increased
number of environmental issues. This obliges the System operator to
increasingly use the existing network under limit operating conditions. It
is essential, under these circumstances, to be able to ensure the level of
reliability if one does not want to increase the likelihood of a large-scale
incident occurrence.
2.2.3 OBLIGATIONS
It is obvious that electricity occupies an increasingly important place in
the day-to-day life of our society. Consequently, supply interruptions
have a greater and greater impact with the duration and geographical
extent of power cuts.The spectre of consequences is large, from local
inconvenience to the paralysis of the activity in extensive areas of the
country. It is the System operator’s responsibility, in conjunction with all
the network users, to control the risk of a widespread power cut.
The quality public service mission entrusted to the power transmission
system operator (TSO) comes with obligations which, as concerns
reliability, are defined in Act n° 2000-108 of 10 February 2000 relative to
the modernisation and development of the electricity quality public
service, article 15: "[…]The public power transmission system operator
shall ensure the balance of electricity flows on the network at all times, as
well as the security, reliability and efficiency of this network, while taking
into account the technical constraints weighing on the grid. It shall also
make sure that there is compliance with the rules relative to the
interconnection of the various national electricity transmission
networks. […]"

22
Constantly seeking economic performance
while guaranteeing operating reliability
and quality of service
©RTE 2004
RTE - East Power System Regional Dispatching Centre (SEE)

©RTE 2004
23
2.2.4 RELIABILITY/ECONOMICS AND RELIABILITY/QUALITY INTERACTIONS
Although reliability is a priority of the System operator, it cannot be
provided at simply any price. In particular:
• theacceptabilityofpowernetworksisonlyconceivableifelectricenergy
is economically competitive. The capital expenditure required for
System reliability must be consistent with the cost, frequency and
seriousness of the incidents that it enables to avoid;
• furthermore, thanks to its flexibility of use, electricity has a
determining competitive edge, but the modern uses of electricity
also require a quality product, guaranteed in terms of power cut
time, voltage and current waveform. Here, too, the measures taken
in operation to ensure reliability must be compatible with the
contractual commitments made concerning the quality of supply.

24
Physical electricity exchanges in Europe in 2004
©RTE 2004
PhysicalenergyflowsinGWh
1st synchronous UCTE region
Synchronous operation with UCTE region
Former 2nd synchronous UCTE region, from November 2004 synchronous with 1st UCTE region
* Associate member
4633
4053
2382
17357
2213
4042
1270
213
1125
3158
144
13116
9154
450
2375558
7597
1179
10324
812
6034
760
8523
1434
2130
17125
3092304
9820
751
1572
15482
396
11830
8922
4928
4419
14
3
544
19915
6248
80
6045
9
26
4465
1621
6180
394
31
1575
2624
64
4573
853
2786
919
478
234
1785
54371040
2002
740
1499
731
463
8546
5130
1000
222099
3228
2001
3633
516
1424
191
151
102
2014
833
F
E
P
B
L
NLGBIRL
S
UA_W
N
CH
A
I
D
DK_W*
PL
CZ
SK
H
SLO
HR
BY
BiH
SCG
TNDZMA
RO
BG
GR
AL
FYROM
TR
MD
1
205
1907
732
989
424
DK
East
18
1294
1446
282
1194
1
8
1482
3780637
1349
Physical exchanges

©RTE 2004
25
2.2.5 STAKES INVOLVINGTHE OPENING OFTHE EUROPEAN ELECTRICITY MARKET
With the opening of the electricity market, the environment of energy
exchanges carried out through the European transmission grid has
developed appreciably together with:
- a noteworthy increase in the levels of exchanges between countries
and a diversification of the types of exchanges,
- the emergence of a great many new players.
It is a real challenge for TSOs to be able to know how to best use the
interconnections to the advantage of economic performance while
ensuring reliability.This they must do in compliance with the principle of
equity of access to the network, in the face of a great variety of situations
and in a context where the energy transfers desired by the players are
confronted with capacities that are not unlimited. To cope with the
insufficiency of cross-border capacities, the TSOs have set up various
transfer capacity allocation mechanisms in coordination with the Energy
Regulators of the countries concerned: first come first served, auctions,
in proportion to the request of users, as well as "coordinated
mechanism".
The energy exchanges between interconnected partners are not the only
means by which transmission system operators can contribute to the
opening of the market while ensuring operating reliability: one example
is the mechanism that RTE has chosen to cover transmission losses on
the french network, by launching calls for tender open to foreign players.

26
Four groups of contingencies
©RTE 2004

©RTE 2004
27
The fundamental aspects of System reliability2 2.3 Modes of reliability degradation
2.3.1 CONTINGENCIES
The System, by nature, is constantly subjected to various contingencies
which can be divided into four groups.
Load contingencies
Due to the non-storable character of electric energy, supply and demand
must be matched at all times.
The System is therefore, so to speak, steered by load. A reflection of the
country’s economic and social activity, this load presents a globally
foreseeable character, but with a substantial uncertain margin. An
overall image of a great amount of individual behaviour, it is influenced,
even in the short term, by multiple factors the main one of which is of
meteorological origin: thus, in autumn, winter or spring, a temperature
drop of 1°C results in additional French load that may reach 1,600 MW,
while in summer, when the temperature exceeds 25°C, a rise of 1°C may
bring about an extra load of up to 600 MW. On the other hand, the
formation of clouds over the greater Paris area gives rise to an increase of
several hundred MW.
Meteorological contingencies
The power system, spread out geographically and with a strong
relationship with the environment (overhead lines, hydro power plants,
cooling of thermal power plants, etc.) is subjected to events of a
meteorological nature (lightning, storms, frost, floods or drought, extreme
cold, etc.), which cannot always be well foreseen and which give rise to
notable disturbances: short-circuits, tripping of generation units, etc.
Outages and external hazards
The System components themselves, often including high-technology
equipment operating under severe industrial conditions, are not safe
from outages (unforeseeable equipment failures) or external hazards
(mechanical shovels which sever cables, accidents involving aircraft or
people, etc.).

©RTE 2004
28
→ Load fluctuations
→ Meteorological hazards
(lightning, storms, frost, floods, cold, etc.)
→ Outages and external hazards
→ Human errors in operation
and maintenance
One must provide protection
against these contingencies
by setting up margins

©RTE 2004
29
Some have immediate consequences (tripping of facilities), others may
remain hidden (latent outages) and arise unexpectedly during an
activation; the power system therefore copes with this activation in a
more vulnerable situation.
Malfunctions linked to the human factor
The level of performance of System components depends, to a large
extent, on the human factor which is involved at all levels, from design
and implementation of the equipment (quality of manufacture,
stringency of commissioning tests, etc.) up to its operation (quality of
maintenance, stringency of repair actions, etc.). Here, too, the
consequences may be immediate (case of the "screwdriver fault", etc.) or
make their presence felt during a later activation (case of a wiring error or
faulty adjustment, for example).
2.3.2 SECURITY MARGINS
In order to maintain satisfactory System operation despite the
contingencies weighing on it, security margins are systematically set up,
from development to operation.The System is typically sized so that it is
able to withstand a number of events set out in the planning and operating
rules.
Complying with these security rules leads most of the time to additional
costs.They result in setting up margins the constitution of which certainly
comeswithacost,whereastheireffectiveutilisationremainsinthedomain
of likelihood and the precise assessment of avoided power cuts is an
extremely delicate matter.
For example, a certain expense is consented when the start-up of a
generationunitisrequiredtocopewithanytrippingofafacility.Ontheother
hand, the gain -avoiding, for example, a customer power cut- is uncertain.

30
©RTE 2004
Reliability not at just any price …
Zone1
Zoneofout-of-normevents
TheN-kruledefinesthemaximumacceptedrisklevel
Extentof
potential
powercut
(MW)
Unacceptable
consequences
limit
(600MW
fora“single”
eventatEHV)
Non-dimensioningevents
(outageofanuclearsite,
outageofa400kVsubstation)
Lowprobability
Dimensioningevents
Auto-transformer
outage
Line
outage
Generationset
outage
Probability
400kVbusbar
outage
Zone3
Unacceptableriskszone:
tokeepoutofthisarea,preventivemeasuresaretaken,
ifnecessary,eveniftheyarecostly.
Isoriskcurve
(correspondingtothemaximumacceptedrisk)
Zone4
Acceptableriskszone:
theimplementationofpreventivemeasures
mustbetheresultofatechnicalandeconomicanalysis.
Zone2
Unacceptableconsequenceszone:
tokeepoutofthisarea,preventivemeasuresaretaken,
ifnecessary,eveniftheyarecostly.

©RTE 2004
31
Despite all this, it is not conceivable to provide protection against any type
of contingency. First of all, because one cannot conceive all the
combinations of outages or incidents likely to arise on as large a number of
components;then,becausethereisnoeconomicjustificationforwantingto
provide protection (in the sense of wanting to maintain normal System
operation) against contingencies of which the probability of occurrence
becomes extremely low (combination of contingencies each with little
likelihood and independent).
For combinations of particularly severe, but highly unlikely contingencies,
oneconsequentlyacceptstheoccurrenceofSystemoperationdegradation
havingnoteworthyrepercussionsonthecompany’scustomers.Thepriority
hereistomaintaincontroloverthedevelopmentoftheincidentsinorderto
keep their final impact to a minimum.
In the most serious cases, a reduced part of the System may be sacrificed if
this step allows one to effectively eliminate the degradation.
ConsideringthestakesrelatedtoSystemreliability(cf.§2.2.2),theprospect
ofalarge-scaleincidentisnotacceptable.Systemoperationmusttherefore
be carried out in such a way as to reduce the occurrence of such an event to
a maximum.
A look at the past, both in France and abroad, shows that the likelihood of a
major event occurring on the System -disconnection of all or a large part of
theFrenchnetwork-canbeevaluatedat10-1
peryear,i.e.onemajoreventon
the System every ten years.
Thistypeofincidentisgenerallytheresultofunfavourablecombinationsof
elements: precarious situations due, for example, to insufficient or already
consumed margins, multiple or successive contingencies on transmission
orgenerationfacilities,abnormaloperationofprotectionorcontroldevices
or systems, outage of telecommunication and/or telecontrol systems.

32
©RTE 2004
• cascadetripping • voltagecollapse
• frequencycollapse • lossofsynchronism
In order to
• ensure normal System operation
• limit incidents and avoid major incidents
• limit the consequences of major incidents
protection must be provided against:

©RTE 2004
33
2.3.3 PHENOMENA CAUSING RELIABILITY DEGRADATION
The origin of a large-scale incident is always characterised by a few
typical operating phases linked to four main phenomena that,
independently of their initial causes, which may be multiple, occur one
after the other or combine throughout the incident.
These phenomena are:
• cascade tripping,
• voltage collapse,
• frequency collapse,
• loss of synchronism.
Their occurrences under extreme conditions are presented hereafter.The
measures taken to protect the System against them and/or to limit their
consequenceswillbeanalysedin§2.4"Defenceindepth".

34
©RTE 2004
RTE - 400 kV lines
The right estimation of load transfers
in case of contingency N-1 / N-k is determining
so as to avoid cascade tripping.

©RTE 2004
The fundamental aspects of System reliability2
35
2.3 Modes of reliability degradation
2.3.3.1 Cascade tripping
Maintaining overly high intensities in a facility leads to heating which may
damage the components of the link (line or cable) itself. In addition, as
concerns overhead lines, the heating of conductors also leads to their
extension: they get closer to the ground, reducing the insulation distances
(electricarchazards)andcreatingrisksforpeopleandproperty.
Toguardagainsttheserisks,overloadprotectionsareusedinFrance.
If the overload is not cleared before a given time (20 minutes, for example,
even several tens of seconds, depending on the extent of the out-of-limits
observed), the facility concerned will trip upon action of its overload
protection. The transit previously conveyed by this facility will then be
transferredtootherfacilities,accordingtotherelativeapparentimpedances.
Depending on the seriousness of the phenomena, and particularly the initial
load status of the facilities concerned, this tripping may generate new
overloads, new tripping actions and, by successive load transfers, the
occurrence of a cumulative phenomenon, the new overloads being more
numerousandincreasinglydifficulttoremovewithinthetimeallotted.
The initial appearance of one or more overloads may be the outcome of
severaltypesofsituationsorevents,inparticular:
• thesuddentrippingoffacilities:lineoutage(s)(followingtheoccurrence
and subsequent clearance of a short-circuit, untimely action of a
protection without fault occurrence, etc.), tripping of a generation unit,
etc.
• a load trend incompatible with the facilities available at a given time,
possibly combined with low voltage values.

©RTE 2004
36
RTE - EHV/HV transformer
The action of the automatic on-load tap changers
of transformers must be blocked
as soon as the voltage collapse phenomenon occurs.

©RTE 2004
37
2.3.3.2 Voltage collapse
Other than its contractual aspect with regard to customers, voltage
control throughout the power system is necessary to ensure proper
equipment performance, guarantee overall System operation and avoid
the occurrence of voltage collapse type phenomena.
Voltage is a local magnitude, greatly influenced by load variations and
reactive power flows (cf. annexA.1.3). It is not easily conveyed and at the
cost of substantial voltage drops. Voltage is therefore controlled via
reactive power sources (generation units, capacitors, reactors, etc.)
spread out over the network.
For a given area, the reactive power sources may no longer be sufficient
to meet needs following, for example, an event such as the tripping of
transmission facilities or generation units, or an unexpected load trend.
Importing the outstanding reactive power from neighbouring areas
brings about substantial voltage drops on the EHV network. Without
other measures, this would result, at the customer loads level, in not
complying with the voltage contractual ranges. To overcome this
drawback, automatic on-load tap changers installed in the transformers
of networks supplying customers normally make it possible to make up
for these voltage drops. Nevertheless, this leads to reducing the
impedance of the dipole between the source and the load, increasing the
current and, therefore, further lowering the voltage of the area at the rate
of the transformer tap-change operations.
If, in addition, the reactive power demand of the area exceeds the
emergency capacity of the neighbouring zones -which is by nature
limited- the extra reactive power demand produces the same effects on
the adjoining areas and leads to the extension of the phenomenon.
Below a certain low voltage level called critical voltage, one comes up
against transmissible active power limit problems.This brings about the
collapse of the voltage plan if no measures are taken.

©RTE 2004
38
EDF - 1,300 MW nuclear generation unit
The correct sizing and appropriate implementation
of the reserves are indispensable so as to ensure
generation-load balance at all times.

©RTE 2004
39
2.3.3.3 Frequency collapse
Frequency stability on a power network expresses the balance between
generation and load, i.e. between the motive force of power plants and the
resisting torque that the loads represent. If demand (load) exceeds supply
(generation), the System is in imbalance, the speed of the turbines and,
consequently, the network frequency, drop. On the other hand, if supply is
greater than demand, the System witnesses the units accelerate and the
frequency increase.
As load fluctuates by nature, the generation level must be constantly
adapted so as keep the frequency at a stable reference value: 50 Hz in
Europe.
The frequency must be maintained around this reference value, on the one
handbecauseanever-changingfrequencywouldmakeelectricityunusable
for numerous uses, on the other hand, because most System components
are optimised and specified to operate within a given frequency range.
Outside this tolerance range, serious equipment malfunctions arise (in
particular on control devices) and, if the imbalance is too high, the units
separatefromthegridunavoidablybringingaboutthecollapseofallorpart
of the power system.
The frequency collapse phenomenon is rapid. For example, a frequency
drop dynamic of 3 Hz/s was observed in the course of the incident of
19 December 1978 (cf. annex 4).
In France, the admissible range is 50 Hz +/- 0.5 Hz.Automatic load shedding
takes place starting at 49 Hz; frequency drops of several Hz lead to the
separation of the generation units brought about when their under-
frequency protection is actuated.

©RTE 2004
40
The short-circuit clearance time
is a determining parameter
with regard to loss of synchronism.
RTE - Distance relay

©RTE 2004
41
2.3.3.4 Loss of synchronism
In a non-disturbed network, all generator rotors turn at the same electric
speed.This is known as synchronous operation and the common speed
defines the power system frequency.
This synchronism is due to the existence of an elastic link called
"synchronising torque" which, through electric magnitudes, couples the
generators.
So long as the driving torque applied to the rotor by the turbine and the
resisting torque due to the loads connected to the stator do not stray too
far from balance, synchronism is ensured by the action of speed and
voltage controllers.The System is stable.
In some situations, as, for example during an excessively long short-
circuit, the elastic link which couples the generators may be severed.
Slipping may take place between the generators which no longer turn at
the same speed. System frequency no longer has a precise meaning.The
voltage wave observed at each point of the network results from the
composition of voltage sources at different frequencies; voltage and
current beats causing unacceptable stresses on the equipment now
occur: overintensities, overvoltages, etc. The System has lost stability.
Due to the action of their protection systems, the facilities then separate
from the network if no measures are taken, which results in the splitting
up of the System.

42
System defence in depth
=
©RTE 2004
Prevention /
preparation
Monitoring /
action
Ultimate
mitigation
measures
a succession of defence lines
which come under three domains

©RTE 2004
43
The fundamental aspects of System reliability2 2.4 Defence in depth
2.4.1 DEFINITION
In the course of a major incident, the different phenomena described in the
previous section may occur successively or combine. System reliability is
based on the implementation of various types of measures, adapted to the
dynamicofeachphenomenonandwhichhelpprevent,detectanddealwith
any malfunctions that may lead to the emergence of the incident and/or to
control its development.
These measures, which also come within the domain of equipment,
organisationandqualityofprofessionalaction,arecalleddefencelines.The
implementation of successive defence lines constitutes the defence in
depth concept.
This principle is commonly applied in the field of nuclear safety as in the
operating reliability of many complex industrial systems for which a high
level of reliability is required.
2.4.2 STRUCTURING OF DEFENCE LINES
The defence lines concern three main complementary fields:
• prevention / preparation,
• monitoring / action,
• ultimate mitigation measures.
Power system defence in depth is based on the consistent
structuring of successive defence lines, making it possible to avoid
or control the main phenomena that may lead to its collapse.

44
©RTE 2004
Defence lines at the
Prevention / preparation level
Do what is necessary so that
the feared phenomena do not get started

©RTE 2004
45
2.4.2.1 Prevention / Preparation
It concerns first of all doing what is necessary so that the previously-
mentioned phenomena do not get started.
In this field, the actions carried out aim at:
• maintaining the level of reliability, availability and performance of the
components, so that they provide the expected service and that the
number of initiating events is minimised; this is the essential purpose of
preventive maintenance on the various components;
• ensuring a quasi absolute permanence of some vital functions even in
case of the failure of the equipment units which perform them.This is
obtained by seeking material and functional redundancy for these
systems.This is, for example, the case for 400 kV line protections;
• ensuring the smooth carrying out of activities considered to be at risk
for reliability by placing them within the scope of quality assurance.This
isthepurposeofthesocio-managerialprojectsconductedinthe1990sto
improve settings, maintenance and control, followed by a global
programme at RTE in the field of quality.
The purpose is also to strengthen the System so that it can cope with any
outages of some facilities following the occurrence of failures and/or
contingencies deemed likely and taken into account in the sizing of
System operation.
Thus the "N-k" rule applied at the operation preparation level helps avoid
some of these faults or contingencies putting the System in a situation
which might lead to a major incident.
As regard events of the facility outage type, the "N-k" rule defines the
maximum risk level acceptable for System reliability and specifies the
consequences that are tolerated for some of them (cf. annexA.1.4).

©RTE 2004
46
Ultimate mitigation measures level
Controlling incident operating conditions
to avoid System collapse
Preparing System restoration
after a large-scale incident
Monitoring / action level
Detecting and correcting any variances

©RTE 2004
47
The measures taken concerning the sturdiness of operating schemes, the
presence of generation units other than those scheduled for the supply-
demand balance, the switching of reactive power compensation
equipment (capacitor or reactor), the limitation of the power supplied by
the generation units, etc.
2.4.2.2 Monitoring / action
This domain groups all of the automatic (primary voltage control, for
example) or manual actions (such as dispatcher control actions), which
serve to detect any deviations in some magnitudes characteristic of good
System operation and, if necessary, initiate the appropriate remedial
actions so as to ensure the protection of equipment and System reliability.
The aim is above all to keep incidents and/or failures, taken into account in
the sizing of the System, from degenerating into a large-scale incident.
2.4.2.3 Ultimate mitigation measures
The actions coming under the final level are those which aim, on the one
hand, at controlling incident operating conditions of a certain scale,
characterised by phenomena described in § 2.3, in order to avoid a total
network collapse and, on the other hand, at placing the System in a
situation making it easy to restore it should this event take place.These
measures concern exceptional control actions (load shedding, for
example).

©RTE 2004
48
Most of the safeguard actions
pass through the relays of the control operators
of transmission and distribution networks
and generating facilities.
Nuclear power plant control room
RTE - Regional
Dispatching Centre
RTE-Transmission area control centre EDF - Hydroelectric control centre
EDF- Gaz de France
Distribution control room

©RTE 2004
49
2.4.3 SAFEGUARD ACTIONS AND DEFENCE PLAN
The defence lines of the "monitoring / action" and "ultimate mitigation
measures" domains correspond to curative actions the implementation
ofwhichisdictatedbytheurgencyofthesituationandtheextenttowhich
the System has been weakened.
This justifies the radical nature of the measures taken, sometimes at the
expense of some deterioration in the quality of supply for a limited
number of customers.The philosophy adopted, in particular for extreme
situations where the action tried is often a last resort, based on the
principle that it is preferable to willingly separate from some loads or
some particularly weakened areas so as to save the remainder, rather
than lose everything by allowing the System to deteriorate.
These curative actions can be grouped into two levels acting at different
time scales.
A first level groups the actions intended to contain the phenomena the
dynamic of which is still compatible with human intervention
(diagnosis, decision-making and action on the System). These are
safeguard actions; they concern the fields of "monitoring / action" and
"ultimate mitigation measures".
They group actions ensuring the supply-demand balance, such as the
modification of generation unit schedules (rapid transition to maximum
set power, fast drop), rapid customer load shedding, remote emergency
load shedding, etc., as well as those for the purpose of controlling the
voltage plan, such as the reactive overload of the units, the blocking of
on-load tap changers, etc.
To increase their rapidity of execution, these actions come under
predefined switching commands which can be sent via a specific
transmission system: the Security and Alert System, at the disposal of
dispatching centre operators.These switching commands can be emitted
globally to an area or to a set of given players.

©RTE 2004
50
Successful automatic disconnection to house load
of nuclear and fossil-fuel units on their auxiliaries
conditions the rapidity of network restoration
and resupply of all customers.
EDF - Flamanville nuclear power plant - 1,300 MW turbogenerator unit

©RTE 2004
51
A second level is made up of the curative actions intended to counter the
phenomena the swiftness of occurrence and development of which
excludes any possibility of human intervention. Only automatic devices
can efficiently perform the remedial actions needed.
This is the defence plan. It constitutes a real protection of the overall
System with the purpose of acting before the own protections of its most
sensitive elements. The actions carried out all fall with in the field of
"ultimate mitigation measures".
The defence plan comprises the following actions:
• automatic separation of regions that have sustained loss of
synchronism,
• automatic load shedding upon frequency drop,
• automatic blocking of on-load tap changers of EHV/HV(1)
and HV/MV
transformers upon voltage drop,
• automatic disconnection to house load of nuclear and fossil fuel units
on their auxiliaries.
All of these safeguard and defence plan actions are supplemented by the
network restoration plan (cf. § 2.5) the purpose of which is to favour the
effective and fast restoration of the disconnected areas.
Westillsometimeshavethehabit,inthisversionoftheReliabilityMemento,ofusingthe
abbreviationsHVandEHVwhichfromnowonarebeingrespectivelyreplacedbyHV1on
the one hand, and by HV2 and EHV on the other hand (cf. glossary page 266).
(1):

52
©RTE 2004
• Have a perfectly coordinated protection plan
• Have sturdy operating schemes
• Define preventive or curative mitigation measures
• Monitor the flows in N on high-load links and the absence
of unacceptable stresses on the load transfer in N-k
• Remove facility overloads through a switching operation
on the network or by action on generation units
Monitoring / action
• Deliberately carry out customer load shedding
Ultimate mitigation measures
Prevention / preparation
Countering cascade tripping

©RTE 2004
53
2.4.4 DEFENCE IN DEPTH APPLIEDTOTHE FEARED PHENOMENA
The defence lines are structured as follows for each of the phenomena
likely to lead to System collapse.
2.4.4.1 Defence lines to counter cascade tripping
a) Prevention / preparation
First of all, it is essential to have a perfectly coordinated and sufficiently
selective protection plan so that, when a short-circuit occurs, only the
facilities needed to clear the fault are tripped.
As concerns the lines, the smooth operation of the reclosing function is
particularly decisive because it ensures the automatic restart of the
facilities after a few seconds, in the case of transient faults.
Secondly, one must be able to make use, in real time, of sufficiently
"sturdy" operational diagrams to avoid the occurrence of the
phenomenon.This is achieved by applying the "N-k" rule to the various
stages of preparing System operation and control, in such a way as to
ensure, for a number of incidents referred to as "reference likely
incidents", that the consequence level remains within a predefined
threshold.
The reference likely incidents are the outage of a single line, the outage of
a double line, the outage of one or two 1,300 MW units and the outage of
a busbar section.The measures taken concern the operating scheme and
the generation unit start-up plan.
b) Monitoring / action
What has to be done at this stage is to carry out appropriate control
actions so as to remove any facility overload occurrences before they
reach the end of their tripping time,by means of switching operations on
the network or by action on the generation units (the overload
protections generate an alarm which is sent on to the dispatching
centres).

©RTE 2004
54
• Properly size the means of reactive power compensation
• Have reactive power sources to meet requirements with
all necessary performance and placed near load sites
• Be able to effectively call up reactive power reserves
thanks to reliable and operational control systems
• Control the voltage plan in real time by means
of automatic (primary and secondary control)
and manual (tertiary control) actions
Monitoring / action
• Voltage alert
• Start-up of combustion turbines
• Blocking of on-load tap changers
• Lowering MV voltage by 5%
• Generation unit reactive overloads
• Emergency load shedding, or even disconnection
of transformers or autotransformers, etc.
Countering voltage collapse

©RTE 2004
55
c) Ultimate mitigation measures
When transfer operations prove to be insufficient to put a stop to the
present overloads, the ultimate action is to deliberately carry out load
shedding of customers or generating facilities.
2.4.4.2 Defence lines to counter voltage collapse
What this involves is to:
1) properly size the means of reactive energy compensation and
network facilities, so as to have the necessary and adequate
reserves and be able to convey them;
2) have sources of reactive power capable, whenever needed, of
providing it with the expected level of performance. The measures
taken concern the generation unit start-up plans from the standpoint
of their reactive generation capacity, the closing of network
compensation equipment (capacitors and/or reactors), the utilisation
of synchronous compensators and other devices;
3) be able to effectively call up the reactive power reserves that have
thus been set up; which assumes having reliable and operational
secondary and tertiary voltage control systems, as well as systems
controlling effective means of compensation.
Thismainlyconsistsinmonitoringandcontrollingthevoltageplanunder
normal operating conditions.
Voltage control under normal operating conditions is achieved through a
succession of three command levels with staggered time constants
making it possible to mobilise the reactive reserves over increasingly
extensive area:

56
©RTE 2004
The rapid start-up of combustion turbines
provides fast reactive power.
EDF - Gennevilliers combustion turbine

©RTE 2004
57
• primary control, which brings on line the reactive reserve of the
generation units closest to the disturbance, through the action of
their primary voltage controller when voltage variations are
observed at the stator, so as to keep this voltage equal to the
displayed set point value;
• secondaryvoltagecontrol,whichbringsonlinethereactivereservesofall
the generation units and capacitors by electrically homogeneous zones
from the standpoint of voltage behaviour. These zones are called
"secondary voltage control areas".The purpose of secondary voltage
control is to keep the voltage constant at a central point of the zone known
as"pilotpoint";
• tertiary voltage control, which is manual. It concerns all of the actions
commanded by the operators of dispatching centres to coordinate the
voltageplanbetweenthedifferentsecondarycontrolareas.
These commands concern the changes of the set point voltage of pilot
points, as well as switching commands to reclose or trip compensation
equipment. It may also involve the start-up of generation units or the
modification of network topology.
Their purpose is to control the evolution of the voltage plan under incident
operating conditions when the voltage collapse phenomenon gets under
way, through action on the loads by:
- blocking automatic the on-load tap changers of EHV/HV and HV/MV
transformers as soon as the voltage reaches a critical value at certain
points of the network (the voltage drop can evolve rapidly: about 10 to
20 kV/min);
- lowering the MV voltage level by 5%.
If need be, these actions give way to "drastic" measures commanded by
the dispatching operators, applied to generating facilities or load:
- utilisation of reactive overloads on the generation units,
- start-up of rapid means of generation, such as combustion turbines,
- and, as a last resort, activation of emergency remote load shedding or
even disconnection of EHV/HV transformers or 400/225 kV
autotransformers.

©RTE 2004
58
• Haveanaccurateandreliableloadforecast
• Haveagenerationplancapableofmeetingtheloadforecast
andexchangeswithasufficientmargin
• Havethenecessarypowerreserves
andbeabletomobilisethemefficiently
• Makesureoftheeffectivereal-timeavailability
ofthepowerreservessetup
• Controlthefrequencyundernormaloperatingconditionsbymeans
ofautomatic(primaryandsecondaryloadfrequencycontrol)
andmanual(tertiarycontrol)actions
Monitoring / action
• Switchover to Pmax of generation units in service
• Rapid customer load shedding
• Emergency remote load shedding
• Frequency activated load shedding (automatic system)
Countering frequency collapse

©RTE 2004
59
2.4.4.3 Defence lines to counter frequency collapse
The actions undertaken at this level are intended to make the means
availabletodispatchingcentressothattheycancontrolthesupply/demand
balance; it involves:
• having a load forecast (load level at peak load period, shape of load curve,
etc.)andaforecastofcross-borderexchanges;
• having a global generation plan capable of meeting the load forecast
and exchanges, with a sufficient margin to cope with the different
contingencies that may affect the supply/demand balance: outage of
generation units, imbalance between load forecast and actual load,
etc.
This is obtained by setting up power reserves made available either by
automatic control devices (primary and secondary reserves), or by the
action of operators (tertiary reserve) (cf. annexA.1.2);
• being able to bring these power reserves on line within the different
time periods required.
The effective availability of the power reserves set up must be checked
regularly in real time.The actions undertaken aimed at maintaining the
frequencyundernormaloperatingconditions,bysuccessivelybringingthe
various reserves on line according to the staggered time constants
(cf. annexA.1.2).
Each reserve level makes it possible to reconstitute the reserves of the
previous level.
These three reserve levels are managed and reconstituted by automatic
primary and secondary load frequency controls and tertiary control placed
under the control of the dispatchers.
• The purpose of primary control is to ensure the rapid restoration (a few
seconds)ofthesupply/demandbalance.Itisalocalcontrol,carriedout
by the speed controller of each generation unit subject to control,
which acts directly on the valves letting motor fluid into the turbine.At
the end of action, the new balance situation results in a frequency
imbalance and border exchanges differing from their scheduled value.

©RTE 2004
60
The performance of generation units is determining
with regard to frequency collapse:
contribution to primary frequency control
and to secondary power frequency control,
capacity of switchover to Pmax, etc.
EDF - Saint-Alban nuclear power plant

©RTE 2004
61
• The aim of secondary control is to bring the frequency back to the
reference frequency (50 Hz in general, 49.99 or 50.01 Hz in case of a
"time adjustment") and the cross-border exchanges back to their
scheduled values.This goal is met by modifying the set point capacity
of the generation units subject to secondary power frequency control
by means of a signal calculated on a centralised basis at the national
dispatching centre.
• Tertiary control consists in activating balancing bids (cf. annexA.1.5.2)
to readjust the generation schedules on some sets in order to
reconstitute the secondary reserve, or even part of the primary reserve
when it is started, so as to provide protection against a new
contingency. The corresponding actions are all under the control of
control operators at the dispatching centres.
In situations where normal operating actions no longer enable one to
control the frequency, exceptional control actions are carried out:
• on generation: switchover to Pmax,
• on loads: rapid customer load shedding, remote emergency load
shedding.
If the previous defence lines are bypassed upon a contingency exceeding
the primary reserve available on the interconnected network or possibly
on sub-networks which may be set up in case of a major incident, the last
line of defence is frequency activated load shedding. It is a load shedding
operation carried out automatically, on a frequency threshold criterion,
and selectively on the MV outgoing distribution feeders of main
substations and on the non-priority installations of customers connected
to the main transmission system.
The load shedding thresholds are set as follows: 49 Hz, 48.5 Hz, 48 Hz
and 47.5 Hz.A load shedding level is associated with each threshold.For
distribution, the volume of each level must correspond to 20% of the
total load.

©RTE 2004
62
• Haveoperationalandappropriatelyadjustedvoltageandspeed
controlsystemsonthegenerationunits
• Have a sufficiently effective protection plan
• Avoid network topologies conducive to the development
of the phenomenon
• Monitor the acceleration of generation units
through the automatic action of speed controllers
and threshold accelerometers
Monitoring / action
• Splitupallorpartofthenetworkautomatically
Countering loss of synchronism

©RTE 2004
63
2.4.4.4 Defence lines to counter loss of synchronism
The aim is to have sufficient stability margins at one’s disposal, which
implies:
• having operational and appropriately adjusted voltage and speed
control systems, capable of maintaining the stability of the generation
units upon event occurrences;
• having a sufficiently effective network protection planso as not to have
to use generation unit voltage and speed control devices beyond their
possibilities, due to short-circuits being cleared too late.With regard to
conventional thermal and nuclear generation units, the expected
performance level of this protection plan must maintain stability
regardlessofthetypeoffault:single-phaseorthree-phasefault,withor
without reclosing, on a line or busbar;
• operating the power system in such a way as to never be in a topology,
either naturally or subsequent to switching operations or tripping,
thatisconducivetothedevelopmentofthephenomenon:caseoflong
radial transmission networks, for example.This is ensured by applying
the "N-k" rule at the System operation and control preparation level. In
the field of stability, this rule consists in making sure that the System
remains stable upon a facility outage related to a fault correctly cleared
by the protection system.The measures taken concern the sturdiness
of the operational diagrams, limitations on the active power supplied
by the generation units or a minimum level of supply of reactive power
and voltage to be observed.
The main aim of the corrective actions undertaken is to counter the
acceleration of the generation units upon a short-circuit occurrence, by
releasing the motor torque applied to the rotor; this is performed by the
speedcontrollerwhich,duringmajordisturbances,controlsthefastclosing
of the turbine inlet valves, as well as by the operation of the threshold
accelerometer (thermal generation units).

©RTE 2004
64
Ring Opening upon Loss of Synchronism
Map of DRS(1)
areas in 2004
(1) : DRS: French acronym for "Détection de rupture de Synchronisme" local protection devices
which detect the voltage beats).
DECOUPAGE 2e BATTEMENT
SPLITTING2nd
BEAT
SPLITTING3rd
BEAT
SPLITTING4th
BEAT

©RTE 2004
65
When loss of synchronism occurs between generation units, the defence
principle consists in automatically splitting all or part of the network, so
as to quickly separate the region or group of power regions sustaining a
loss of synchronism from the main grid that is still sound.
This is achieved on the basis of local protection devices called "Ring
opening in case of loss of synchronism", which detect the voltage beats
and dips characterising the phenomenon.
These devices are installed according to the regularly updated DRS plan,
onanumberof400and225kVlinesprovidingapowerlinkbetweenareas
the generation units of which are highly likely to have a homogeneous
dynamic behaviour in case of loss of synchronism.
As the automatic splitting action generally leads to upsetting the local
balance between generation and load, automatic actions by frequency
activated load shedding relays may be necessary to restore balance in
the insufficient areas.
After the division, if the return to stable operating conditions can be
obtained in a given area, the thermal generation units automatically trip
to house load on their auxiliaries in order to be able to proceed with
service resumption more rapidly.
The basic principle is not to disconnect them too soon so as to allow the
System enough time to become stabilised through the action of controls,
and not disconnect them too late so as not to use the facilities beyond
their sizing limits; this assumes the perfect coordination of both
generation unit and network protection systems.

©RTE 2004
66
Initialload%re-supplied
Numberofhoursafterblackout
UnitedStates/Canadaincidentof14/08/03:
80%supplyrestorationafter19hours
Canada9/11/65Canada18/4/88France19/12/78Sweden27/12/83
Belgium4/08/82France12/01/87NewYork13/07/77Italy28/09/03
Long power cuts are to be seen
during large-scale incidents.

©RTE 2004
67
The fundamental aspects of System reliability2 2.5 Network restoration
2.5.1 STAKES FORTHE SYSTEM AND FOR NETWORK USERS
DespiteRTE’simplementationofallmeansofactionatitsdisposal,including
safeguard and defence actions, an exceptional combination of unfavourable
events may lead to the total collapse of the network of a region, of the whole
country,orevenbeyondthecountry’sborders.
RTE must then restore normal System operation ("network restoration"
action)withtheaimofacting:
• as quickly as possible, in order to limit to the utmost extent in time the
impact of the blackout on the country’s social and economic life,
• and to do so in a controlled way,while respecting the security of people
and property and especially by avoiding any further collapse of the
network, particularly fragile during the restoration phase. A second
collapse, like the one that France experienced on 19 December 1978,
may lead to the disconnection of areas not affected by the first incident
and considerably extend the time required to restore the power supply
that had been cut off.
The French fleet of power plants is characterised by the preponderance of
nuclear generation, with its constraints and specific performances; this
characteristic has the following consequences:
• the RTE strategy to restore all or part of the network after a widespread
incident, in the absence of any possible back-up from a powerful, still
live grid (France or abroad), is mainly based on nuclear generation
units that have tripped to house load;
• the eventual availability of tripped thermal generation units (in
particular nuclear sets), indispensable for fully restoring power to
consumers, depends on the rapidity of restoring the power supply of
their on-line auxiliaries;
• any constraints may require fast restoration of voltage to the
auxiliaries of nuclear units requesting such action.
The following actions are to be carried out during a widespread incident:
• network preparation and diagnosis of the situation,
• network restoration by the main regional structures,
• if necessary, voltage recovery to the nuclear units.

©RTE 2004
68
RTE - North-East Power System Regional Dispatching Centre (SENE)
When there is a widespread voltage loss,
a precise diagnosis of the situation
is absolutely necessary before undertaking
network restoration.

©RTE 2004
69
2.5.2 NETWORK PREPARATION AND DIAGNOSIS
When loss of voltage occurs, the grid must be prepared so that the
restoration can be carried out under good conditions. In particular, this
means:
• avoiding overvoltage problems during the subsequent re-energising
of network portions, while making sure not to leave a large unbroken
line of power lines or cables;
• preparing controlled load restoration by creating load pockets
designed so that they are compatible with the possibilities of restoring
load on a single generation unit (about 50 MW for a 900 MW unit).
With this aim in view, upon loss of voltage automatic network splitting is
carried out by specific programmable logic controllers, called "zero-
voltage automatic devices"); if necessary, supplementary actions are
performed by the operators.All of the measures relative to the location of
programmable logic controllers and the splitting into load pockets of
about 50 MW are known as the "zero-voltage plan".
In the case of a widespread loss of voltage, the national dispatching
centre works closely with the regional dispatching centres, to make an as
diagnosis of the situation accurate-as-possible (dead zones, zones still
"sound" from the frequency and voltage standpoints, generation units
operating on house load, possible need to restore voltage to nuclear
units).Onthisbasis,itdefinesthegeneralstrategyofserviceresumption:
restoration on the basis of the French network that is still sound or/and
restoration via foreign grids, or restoration implemented by the main
regional structures.
The pertinence and swiftness of the diagnosis (and, consequently, of
service restoration) rely to a great extent on remote information brought
back from the field (transmission substations and network user
installations) by the telecontrol system, the reliability of which is
essential.

©RTE 2004
70
Map of main regional structures
SESO
SESE
SEO
SEE
SENE
SERAA
SENP
Main regional structure extension
Connecting axis (arrow points to the substation
where connection is made)
Main regional structures
Main regional structure bases
Substations with which nuclear
or hydro power plant is connected

©RTE 2004
71
2.5.3 NETWORK RESTORATION BY MAIN REGIONAL STRUCTURES
The aim of network restoration is to re-supply priority customers as soon
as possible,then gradually all customers, by supplying electrical sources
of generating facilities that have tripped so that they can take part in
network restoration as soon as possible.
If a sufficiently powerful network is available, service restoration gets
under way using that network. Otherwise, or as a supplement (if it serves
to speed up service restoration in zones remote from the network in
question), RTE undertakes network restoration by main regional
structures.
The principle is based on the independent and simultaneous
constitution, in each of the seven regions, of predetermined 400 kV
structures called "main regional structures". These structures are
designed so as to link, at each regional hub level, the nuclear units and a
number of large hydro generation sites to the supply substations of the
major load areas.
Under the supervision of the regional dispatching centre, each regional
structure is re-energised step by step by means of nuclear generation
units which had tripped to house load and, if necessary, by using pre-
established "load pockets". These pockets must be large enough to
ensure voltage control under steady and transient operating conditions,
while remaining compatible with the load restoration capacity of the
generation units connected to the main structure.
The System regional operating units are responsible for keeping the
zero-voltage plan operational (adapting the splitting to the structural
changes of the network, compatibility with voltage recovery scenarios,
verificationoftherightpositioningofprogrammablelogiccontrollers).

©RTE 2004
72
Thanks to their aptitude for gradual voltage recovery,
hydro generation units can be used as source units
for re-energising the main regional structures
or for voltage recovery scenarios.
EDF - Montézic hydroelectric power plant

©RTE 2004
73
Once these regional structures have been re-energised, after any partial
load restoration (fast restoration of power to priority customers in
particular), they are connected with one another or/and with foreign
networksontheinitiativeofthenationaldispatchingcentre.Theresumption
of load then continues depending on the availability provided by the
reconnected units and, if need be, on imports set up with foreignTSOs.
2.5.4 VOLTAGE RECOVERY SCENARIOS
Nucleargenerationunitsaresubjectedtopreciserulesrelativetothepower
supply of their auxiliaries.These rules require the fast restoration of the
powersupplyofatleastoneofthetwoexternalsourcessupplyingpowerto
the auxiliaries of a unit that has tripped in case of the outage of at least one
of its internal sources.
In a widespread incident situation, RTE is therefore likely to make public
transmission system components available to permit requesting nuclear
units to receive voltage either from a "strong" network in France or from
abroad, or if this is not possible, from another generation unit.
The "source unit - public transmission system components - target unit"
combinationconstitutesavoltagerecoveryline;alloftheoperationsforline
implementationarewhatisknownas"voltagerecoveryscenario".Thereare
several scenarios for each nuclear generation site.
Anucleargenerationunitrequestingthatvoltagerecoverybeimplemented
transmits specific remote information to the regional dispatching centre.
RTE chooses the scenario that is the best adapted and quickest to
implement.The source unit in the line is then called up according to RTE
instructionstore-energisetherecoverylinefollowedbythepoweringofthe
auxiliaries of the requesting nuclear generation unit.
Thefeasibilityofmainstructuresiscloselylinkedtotherateofsuccessof
thetrippingofnuclearunitstohouseload.

©RTE 2004
74
The aptitude for the successful tripping
of thermal units to house load
is checked on a regular basis by their operators.
EDF - Civaux nuclear power plant

©RTE 2004
75
2.5.5 SETTING UP AND KEEPINGTHE NETWORK RESTORATION PLAN
IN OPERATIONAL CONDITION
Network restoration is based on a succession of complex and delicate
operations which should be studied and prepared beforehand.
• The various actions to be carried out under such circumstance, along
with their sequencing, are described in a "network restoration plan"
which lays down the strategy to be followed, the measures to be
implemented, the equipment to be installed or configured, the
expected performances of this equipment and the respective
responsibilities of the various parties involved.
This plan is supplemented by all those concerned (RTE and users
connected to the public transmission system) by the drafting of
operating instructions and setting up of the corresponding training
actions.
• System operators constantly make sure that the network restoration
plan is always operational and do so with the other players:
monitoring of the performances of equipment taking part in the plan,
regular updating of instructions, etc.
• The voltage recovery scenarios are studied, simulated and
validated by tests before they are declared operational. Their
availability is checked on a regular basis under operating
conditions.
• The aptitude for the successful tripping of thermal units to house load
is checked on a regular basis by their operators.
• RTE organises distributor and consumer surveys periodically to make
sure that the load shedding plan is operational.
The Network Restoration Plan sets out the main stages in carrying
out network restoration.

76
©RTE 2004
The priority for System reliability:
avoid a widespread incident
A widespread incident would have
major repercussions on industrial production
which greatly depends on a continuous power supply.
Peugeot SA - Poissy plant

77
The fundamental aspects of System reliability2 Summary
©RTE 2004
SUMMARY OF SYSTEM RELIABILITY
Guaranteeing power system operating reliability means:
• ensuring normal System operation,
• limiting the number of incidents and avoiding major incidents,
• limitingtheconsequencesofmajorincidentswhenevertheydooccur.
System reliability is based on the notion of defence in depth ensured by
implementing different types of measures: defence lines which come
under the technical, human or organisational fields.
The purpose of these measures, taken in terms of prevention /
preparation, monitoring / action and ultimate mitigation, is to avoid or
control the following four main reliability degradation phenomena:
• cascade tripping,
• voltage collapse,
• frequency collapse,
• loss of synchronism.
Any weakening of a defence line reduces System reliability.

78
©RTE 2004
As in any system,
the performance of each component
has an effect on that of the overall system.
RTE - 225 kV substation

The fundamental aspects of system reliability

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to The fundamental aspects of system reliability

Similar to The fundamental aspects of system reliability (20)

More from Power System Operation

More from Power System Operation (20)

Recently uploaded

Recently uploaded (20)

The fundamental aspects of system reliability