1

Network-Security Measures for Highly Loaded

Power Systems
R. Krebs, M. Wache, Siemens, Germany

Abstract—The paper describes typical developments of Widespread failures and blackouts in America and Europe
blackouts from simple cause to cascading outages. Possible have confirmed that the interconnection of neighboring grids
measures to increase the system observability, combined with for operational and efficiency-related purposes also involves
power electronic equipments as controlling elements, can lead to
the risk of cascading power outages. Stability and protection
a future closed loop control of the power supply. The possible
increase of the overall network security by protection security are particularly problematic when the networks are working
assessment (PSA) and dynamic network security assessment with a high level of capacity loading.
(DSA) will be shown. The described network and protection
simulations, which are available today for the transmission II. BLACKOUTS AND HOW THEY OCCUR
sector, have to be adopted to future distribution systems with
dispersed generation.
What is the difference between a blackout and a system
disruption?
"A blackout is a widespread collapse in the power supply
Index Terms—Transmission system, distribution system, caused by a fault in the grid or in the provision of electrical
blackout prevention, dispersed generation, observability, power. Faults in distribution networks, on the other hand,
controllability, security, PMU, DSA. merely lead to interruptions in local supply."
Let us assume that the transmission network is currently in a
normal operating condition, all equipment is working within
I. INTRODUCTION the limits for which it was designed, the grid is steady and

T HE growing consumption of electrical energy in recent well within the bounds of stability – under such circumstances
decades has led throughout the world to the development large-scale disruptions are always triggered by a simple cause.
and physical expansion of synchronously operated AC This could be a short circuit, failure of a particular item of
grids as well as to higher voltage levels. In Europe, the equipment or a planned power shutdown. If protection
technical and economic advantages of interconnected equipment now quickly and selectively disconnects the short
operation led to the linking of neighboring national grids, circuit, or if the operator makes the right decisions, the grid
resulting in the creation of the synchronously operated UCTE will return to a normal operating state. If this is not the case
(Union for the Co-ordination of Transmission of Electricity) because, as in the Italian blackout for example, synchrocheck
system, which today supplies over 500 million people with settings in distance protection devices were wrong thus
2300TWh. preventing "automatic reclosing", and operators did not make
As a result, larger, and therefore more efficient, generating the right decisions to switch off pump storage, cascading
plants can now be utilized while the need for reserve power power failures may be the result.
has been reduced. At the same time transmission networks Fig. 1 shows this process in terms of the times involved.
reached the highest possible levels of reliability and There was a good twenty minutes between the initial cause
availability. and the cascading failures: time which could have been used
With deregulation and privatization, the load placed on the to return to normal operating conditions.
network is currently increasing. This means transport Once such cascading failures begin, the point of no return has
bottlenecks and deterioration in reliability. Global warming been reached and when this has been passed, the grid consists
and the need to reduce CO2 emissions will lead to a significant of non-controllable islands in which overshoots and shortfalls
shakeup in the resources used and in the energy mix. Because lead to a frequency collapse, or reactive power problems
in the past the transmission and distribution structures were cause a voltage collapse.
adapted to the generation and load structures of the time, If one compares the disruption to the Italian grid on
major structural and operational changes are now required in September 28, 2003 with the UCTE disturbance of November
the systems. 4, 2006 [1, 2], it is recognizable that control was regained
over the UCTE network before the point of no return by
means of stable islanding as well as planned load shedding
R. Krebs, M. Wache are with Siemens AG, Germany, Energy Sector, and generator disconnection. Normal operating conditions
P.O. 3220, 91050 Erlangen (e-mail: [email protected]). were restored within 30 minutes. In contrast, the Italian grid

978-1-4244-4241-6/09/$25.00 ©2009 IEEE

 2

collapsed following disconnection from the UCTE network, Using such equipment, oscillation can be detected and
leading to a full-scale blackout. analyzed online and direct countermeasures derived to
dampen it [9]. Furthermore, such well correlated
measurements are absolutely essential for dynamic power
flow control (Fig. 3).

GPS Time
Δf
V I f
ΔT

Detailed Timeline
IEEE C37.118
PMUs PMUs

Fig. 1. Timeline of Italy Blackout September 28th 2003, 3:01 o’clock

Fig. 3. Dynamic System Measurement with PMUs and Fault Recorders

III. OBSERVABILITY OF NETWORKS

Dedicated PMU-Devices or multifunctional devices with
As can be seen in Fig. 2, transmission networks are currently integrated PMU functionality are state of the art, and the
observed on a quasi-static basis, as a rule with asynchronous standardized communication interface for synchrophasor data
measurements, e.g. using RTUs with refresh cycles ranging IEEE C37.118 is supporting well the use of them.
from tens of seconds to a number of minutes. The measuring Nevertheless, the centralized use of synchrophasor data from
data, sometimes weakly correlated, is perfectly adequate for PMUs for consequently tracking the system stability status is
quasi-static control of the network, for example with still a quite new issue. An example for a phasor data
corrective switching based on the results of the state processing and visualization tool is shown in Fig. 4 with the
estimator. The data is also sufficient for advance calculation SIGUARD®-PDP Phasor Data Processing system.
of load/overload conditions prior to switching actions.

Fig. 2. Quasi Steady State System Measurement

Fig. 4. Structure of SIGUARD® Phasor Data Processing sytem
The extremely high capacity loading of transmission networks
means they are operated close to their stability limits; they SIGUARD®-PDP enables the user to both online and offline
tend more easily to oscillations during disruptions and, in analysis of the power system stability. The basis for this are
future, will thus require improved observability for measurements from widely spread PMUs in the electrical
monitoring, protection and control. Today's existing PMUs network, delivering phasor measurement data via the IEEE
(Phase Measurement Units), or devices with PMU C37.118 protocol. SIGUARD®-PDP shows the relevant data
functionality such as fault recorders, are characterized by four in three areas (Fig. 5). On top, the power system status is
major points: shown to give an immediate impression whether the system is
stable or not. This status is derived from all limits which are
time-stamped measurements with GPS configured in the system. On the left side, a geographical view
synchronization shows the significant parts of the network. If a critical
highly accurate measurement of amount and situation occurs (for example an overloaded line), this is
gradient by current and voltage phasors shown with red colour in this area. The right part of the screen
highly accurate frequency measurement and df/dt is reserved to the display of measurements in time scale or as
measurement vectors. The user can online configure the view he needs for
refresh cycles of 20 to 100ms analysis. If necessary, archive data can be retrieved and used
also.
 3

Fig. 5: User interface of a Phasor Data Processing System

With such a tool, the centralized analysis of network stability take up electrical power generated from renewable
based on phasor measurements is possible. The damping of sources means that generation is increasingly subject
power swings can be judged. In the geographical view, the to an overlying stochastic process.
location of problems is easily possible. Such visualization can
be a valuable enhancement of control center systems. On the one hand, this development must be met by a
modification in the structure of the transport network; on the
other hand, the power flow and dynamic processes resulting
IV. NETWORK CONTROLLABILITY from the stochastic aspects in generation and consumption
must be controlled. It is no longer sufficient to switch circuit-
According to the German Power Industry Act, every customer breakers to CLOSED or OPEN; what are now needed are
must be supplied with sufficient electrical power within the regulable system elements such as phase angle regulators,
constraints of available technology. In the past, estimated static var compensators, HVDC back-to-back links – in other
consumption went hand in hand with the controllability of words: power electronics. As shown in Fig. 6, with the use of
power generation. It was sufficient to intervene in the grid power electronics a number of aims can be achieved at the
operation with switching actions and to control generation. same time:
Today, use of the transport network is determined by two new
aspects: 1. By reducing transmission losses and avoiding
circulating flows, the transport network contributes
1. Electricity trading: The purchase and sale of to the reduction of CO2 emissions.
electrical energy are determined by economic aspects 2. The controllability (including in dynamic terms) of
only, regardless of the structure of the transporting such system elements means they are in a position to
network. considerably improve network stability whether they
2. Use of renewable forms of energy: The obligation, exercise local control or are integrated in national
imposed by the German Renewable Energy Act, to control strategies. Particular attention should be
 4

drawn to the impact of power electronics elements 6, 7, 8]. Based on the current switching condition of the
connected in series, as they act as firewalls in the network, an automatic analysis of the selectivity of the
network, blocking both short-circuit currents and network and generator system can be conducted. This requires
blackouts. of course the functions of the deployed relays, their
characteristics and settings as well as communication between
Reduction of CO2 Emission
devices. With PSSTMSINCAL as the basic functionality as
Generation Transmission Distribution
shown in Fig. 7, any imaginable type of fault can be
Increase in Reduction in Reduktion in
generation transmission distribution losses automatically placed at any location; starting and shutdown of
efficiency losses
the relays are simulated and then evaluated in terms of
Use of Avoidance of loop Power factor selectivity aspects. The results of the analysis can be alarm
regenerative flows correction
energy sources lists, which may serve as information for any protection study.
However, an expert system can also be used which proposes
Use of power Use of power
Use of energy mix
for base and peak electronics electronics improved, selective protection settings. These can be verified
load demand
and documented within the scope of a further simulation loop,
Use of wide-area protection and control
before actual parameterization in the relay.
Increase of operability and controllability
Automatic Check of all Results
Fig. 6. Reaching 2 Goals with Power Electronics

Network studies can help to determine in advance the rated

performance and the optimal installation locations of the
power electronics elements.
Once such elements have helped to achieve a sufficient level
of controllability in the transport network, and an appropriate
level of observability has been attained by means of PMUs, a
great many more stochastic generators, such as wind farms,
can be integrated into the transport network.

V. NETWORK SECURITY WITH SIGUARD® Fig. 7. Protection Security Assessment with PSSTMSINCAL

A. Protection Security Assessment (PSA)

B. Dynamic Security Assessment (DSA)
Analysis of network disruptions in various countries and
Network disruptions such as short-circuits, equipment
continents has shown that there has been scarcely any
failure, generator failure or sudden changes in the network
blackout not involving protection devices with wrong or
resulting from switching actions trigger electromechanical
critical settings.
compensation processes. A prior dynamic security assessment
must be conducted to ascertain whether such processes pose
Recurring problems included:
not only a static but also a dynamic threat to network stability
[3, 4, 10, 11, 12]. In so doing, all passive equipment (such as
zone 3 openings of distance protection devices. This
wiring, cables, transformers, ...) as well as actively switched
zone often also serves as overload protection instead
or controlled equipment (generators, capacitor banks, FACTS,
of the thermal model as implemented in numerical
...), including their controllers, must be simulated.
relays
Fig. 8 shows how well this can be achieved using
uncoordinated or unselective short-circuit or overload
PSSTMNETOMAC as the basic tool.
protection, e.g. crossing borders between various grid
During an actual failure at a power plant in Spain, the local
operators
network frequencies were shown in various countries as well
synchrocheck settings too low
as compensation statistics between countries. These records
reserve overcurrent-time protection working parallel to
served as a benchmark for the PSSTMNETOMAC program, in
distance or differential protection without added time
which the UCTE network 2004 was simulated with 610
delay
generators, 4400 nodes, 12000 branches and 1050 controllers.
primary networks extended, developed or modified
A comparison of the simulation results with the actual
without adjusting the protection concept or protection
disruption clearly shows that the dynamic electromechanical
settings.
network behavior following disruptions can be determined
and evaluated in advance.
An important element in the prevention of blackouts is the
This network model can be simulated in a fraction of the
online or offline Protection Security Assessment (PSA) [4, 5,
real time on a standard laptop with an operation lasting 10-
 5

20ms, which is quite sufficient for electromechanical equipment, taking it right to its thermal limits. More use of
compensation operations. Many, possibly critical, network renewable energy (centralized by means of wind farms or
disruptions which must be examined online within the scope decentralized in the form of solar installations) leads to an
of the DSA can be processed in parallel on a PC cluster, increase in the non-controllable share of overall generation.
meaning that the results are available for evaluation at the Transport and distribution networks must be adapted to
same time. changes occurring in generation.
There are a number of new ideas and solutions which can be
applied in order to meet these challenges and to be able to
tim e
syn chr.
ensure a continued reliable supply of power:
by GPS
(

) ) ) ) )
(

) )
)

) ) )
m easu ring de vice )
(

) )
)

) )

An improvement in network observability can be

)
(

( ) )
)

1 st synch ron ous zon e ...

(

(
)

( (
(

(
( (
2 nd synch ro nou s zon e
)

(
(

( (

brought about today using protection devices and fault

(
)

(
(

(
(

(
)

recorders with PMU functionality, and decentralized or

( (
)

( (
(
)

(
)
)

centralized analysis via standardized communication

(
)

)
)

(
(
)

(
)
)

(
)

(
)

)
)
)

networks.
)
)

)
)

)
)

(
)

Controllability of transmission networks can be

(
)
)

(
)

considerably improved by the use of power electronics

(
)

such as HV- or MV-FACTS.

Wide-area networks are certainly the most efficient
solution for trouble-free operation, but disruptions
must be locally restricted. This can be accomplished
f [ Hz] Measured frequencies and active powers P [M W ] using HVDC for long-distance transmission or as a
B2B back-to-back link.
50 ,02 0
Spain
f requenc ies
F ranc e
50 ,01
G erm any (b order to F ranc e)
-1 0 0
Reliability of the overall network, provided by primary
50 ,00
and secondary protection systems, can be significantly
49 ,99 -2 0 0
enhanced if the right conclusions are drawn from
49 ,98 advance SIGUARD®-DSA and -PSA analyses, and
-3 0 0
49 ,97 such conclusions are then made available to the
G erm any
49 ,96
(east)
f= 0,26 H z -4 0 0 operator in the form of recommended action.
49 ,95
H ungary
Finally, from a control point of view, we should set our
Poland

49 ,94 ac tiv e power:

-5 0 0
sights on a Wide Area Monitoring Protection and
49 ,93
V igy (F ranc e) - U chtelfangen (G erm any)
(one 400-kV -sy stem )
-6 0 0
Control System for such complex non-linear systems.
33 35 37 39 41 43 45 47
1 7.0 1 .9 7 ;01 :38 :... tim e

-Δf [mHz]
Simulated frequencies and active powers P [MW] VII. REFERENCES
15

5 Spain PSSTMNETOMAC
-5
-100
[1] Beck, G.; Povh, D.; Retzmann, D.; Teltsch, E.: Global blackouts – Lessons
Poland
learned. Power-Gen Europe, 28.-30. June 2005, Milan, Italy
-15 -200
[2] Union for the co-ordination of transmission of electricity (UCTE): Final
-25
-300
report on system disturbance on 4th November 2006.
-35 Germany
(border to France)
[3] Lerch, E.; Ruhle, O.; Kerin, U.: DSA-Visualisation, monitoring and
(border to France)
-45 -400 ranking of dynamic behaviour. IFAC, 2.-6. July 2007, Seoul, Korea
-55
[4] R. Krebs, E. Lerch, O. Ruhle, “Blackout prevention by dynamic security
-65
-500 assessment after severe fault conditions” Protection and Substation
active power France-Germany
(
(one 400-kV system) Automation of Modern EHV Power Systems, Cheboksary, Moscow,
-75
0 3 6 9 12 15
-600
Russia, Sep. 9-12, 2007.
seconds
[5] M.-R. Ganjavi, R. Krebs, Z. Styczynski “Design of a pilot knowledge-
Source: E.ON - RWE Net - Siemens 11/2002 based expert system for providing coordinated setting values” Modern
Electric Power Systems Conference, Wroclaw, Poland, Sep. 6.-8., 2006.
Fig. 8. Dynamic Security Assessment with PSSTMNETOMAC [6] Ganjavi, M.-R.; Krebs, R.: Protection settings using expert systems for
Trip of a 900 MW Power plant in Spain security improvement of power network operation. Critical Infrastructures
Society CRIS, DIGESEC-Workshop, 6.-8. Dec. 2006, Magdeburg,
Germany.
[7] Ganjavi, M.-R.; Krebs, R.; Styczynski, Z.: Design of a Pilot Knowledge-
VI. SUMMARY Based Expert System for Coordinated Settings of Protection Devices:
The challenges faced in power transmission and Power System Protection Conference PSP2006, Bled, Slovenja
[8] Chacraborty, P.; Ganjavi, M.-R.; Krebs, R.: Blackout prevention by
distribution are driven by a rising demand for electrical protection and dynamic network security assessment after severe fault
power, increasing urbanization, scarcity of resources and situations. 4th Int. Conf. on Power System Protection and Automation, 21.-
growing environmental awareness. This leads to increasing 22- Nov. 2007, New Delhi, India.
transport of large volumes of traded power over long
distances with an associated upsurge in the load placed on
 6

[9] P. Komarnicki, Z. Styczynski, G. Müller, R. Krebs, O. Ruhle ”Intelligent [10] Fu, C. and Bose, A. (August 1999). Contingency Ranking Based on
blackout prediction using synchrophasors measurement. Simulation study Severity Indices in Dynamic Security Analysis. IEEE Transactions on
case” 3rd Int. Conf. On Critical Infrastructure, New Alexandria, USA, Power Systems, Vol. 14. No. 3, pp. 980-986.
2006
[11] Tang, C.K., Graham, C.E., El-Kady, M, Alden, R.T.H. (August 1994). [12] Xue, Y., Xu, T., Liu, B., Li, Y. (August 2000). Quantitative Assessment
Transient Stability Index from Conventional Time Domain Simulation. for transient Voltage Security. IEEE Transaction on Power Systems, Vol.
IEEE Transactions on Power Systems, Vol. 9. No. 3, pp. 1524-1530. 15. No. 3, pp. 1077-1083

VIII. BIOGRAPHIES

Rainer E. Krebs, born 1958 in Markus F. Wache was born 1964

Germany (member of VDE, CIGRE, in Germany (member of VDE),
IEEE, IEC and DKE), received his received his Dipl.-Ing. degree
Dipl.-Ing. degree from the University of (electrical engineering) from the
Erlangen in 1982. From 1983 to 1990 University of Kaiserslautern in
he worked as an assistant professor at 1989. From 1989 to 1994 he
the Institute for Electrical Power Supply worked as a scientific assistant at
at the same University. In 1990 he the Institute for Electrical Power
received his Dr.-Eng. degree in Systems at the same University. In
Electrical Engineering. 1990 he joined 1994 he received his Ph.D. degree
Siemens AG, Power Transmission and in Electrical Engineering. 1994 he
Distribution, System Planning Department. Since 1998 he is joined Siemens AG, Power Transmission and Distribution,
director of the System-Protection and System-Analysis Tools Substation Control. He is currently working as a product
Department and since 2006 he is ‘Principal Expert for Power lifecycle manager for bay control units and for phasor
Technologies’. In parallel he started in 2003 as lecturer at the measurement unit data processing software.
University of Magdeburg. Since 2008 he is honorary
Professor for System Protection and Control at the same
University.