- Email: [email protected]
General philosophy of emergency control in the UPG of the USSR
General philosophy of emergency control in the UPG of the USSR V A Venikov, Ja N Luginsky, V A S e m e n o v and S A Sovalov M o s c o w Power Institute, USSR
Large power system interconnections now cover vast areas of the developed countries of the world. For the economic and reliable operation of such complex networks, it is essential that adequate stability control measures are adopted in order to deal quickly and effectively with emergency situations. This paper describes the development and implementation of the automatic emergency control system used in the Unified Power Grid of the USSR. Keywords: on-line control strategies, operational reliability, emergency control
I. I n t r o d u c t i o n The creation of national and international bulk power systems is the main feature of modem power industry development. Large interconnections serving some hundred million people now cover vast areas of the developed countries of the world. The economic effect of such a development is evident. It is possible to reduce operating reserves and to use the effect of decreasing the coincident peak load. Economical energy resources are used in these interconnections in the most effective way. On the other hand, such large interconnections also have some well known shortcomings - such as the increased probability of cascading of faults when blackouts cover large areas. The experience gained by the Soviet power industry shows that most of such disasters occur because of the lack of attention paid to emergency control. The Unified Power Grid (UPG) of the USSR covers about 10 million km 2 and spreads from east to west over 7000 km and from south to north up to 3000 km. The main feature of the system is the interconnection of many industrial regions separated from each other by long distances. The U P G now consists of nine Interconnected Power Pools (IPP) with installed capacities from 10 to 50 million kW. The total installed capacity is 240 million kW and the coincident peak load is up to 180 million kW. The U P G includes some concentrated areas connected by a backbone supergrid system with very long transmission lines. The structure of this system is depicted in Figure 1. It consists of large areas covering highly populated industrial regions. Each area can be treated as Received 7 January 1987
Vol 11 No 1 January 1989
a superpool importing and exporting large amounts of power. The distances between the centres of these regions reach several hundred km in the western part of the country and up to a thousand km in the eastern part. Transmission lines are very long and expensive and the cost/efficiency of these lines is one of the most important problems. Many specialists have been involved in this problem and intensive studies have been carried out since the early 1930s. As a result of emergency control measures, the major tie-lines and trunk-lines are now operated with minimal pre-fault steady-state stability margin, being loaded in many cases well above the maximum of the power-angle curve for post-fault conditions. Using the term proposed in CIGRE and IEC publications, one can call this a 'conditional stability'. But the security of the main grid and supergrid is very high: total outages caused by faults in these grids during the year do not exceed 5-6 system minutes and there have been no system collapses for many years. This high standard of service is gained by the very efficient organization of the emergency control system which has been developed and continuously improved during the last 30-35 years.
I1. Types of control classification There are many different approaches to the types of emergency control classification. In this paper we use the classification depicted in Figure 2 where the types of operating conditions and control actions are shown. Under normal conditions all state variables are in the area permissible for continuous operation and reliability constraints and quality requirements are met. Alert conditions are featured by one or several state variables reaching levels permitted only for a specified period of time. In emergency conditions one or several variables have values which can be permitted for a very short period of time only. Post-emergency operating conditions may occur after emergency conditions and may be normal or alert. The types of control actions that prevent transfer from normal to alert conditions are called 'preventive control'. The control may also be called preventive if it prevents the transition from the alert to the emergency state according to the stability constraints. In the case of thermal stability constraints the control which prevents the transition from
0142-0615/89/010019-08/S03.00© Butterworth ~t Co (Publishers) Ltd
19
To NORDEL
t North26 GWWest
J
MiddleVolga
Centre 39.3 GW
15.7GW
I
[
Urol 30.8 GW
]
S i b e r i a To power system'MIR'
South 44.6 GW Kazokhston I 8.4 GW J
GW
To Mongolia
I oGw N°r'hc°uc°susI Tronscaucosus J 10.5 GW ToTurkey Figure 1. The Unified Power Grid of the USSR; the number in each box is the installed capacity for that region
Post-emergency Restorative ~jJ
Normal
Preventive ~lJ
Alert
Preventive Protective corrective
Emergency I_ Protective I -- corrective
Figure 2. Emergency control classification showing the types of operating conditions and control actions the alert to the emergency state is referred to as 'corrective'. 'Protective control' is used to terminate emergency conditions and transfer the system to the post-emergency state. In some cases corrective control must be added when necessary. 'Restorative control' allows the system to return to normal operating conditions again. The problem of emergency control consists of two main parts: operating control and automatic control.
III. Dispatch control There is a three-tier hierarchical system of dispatch control in the UPG: national control (NC), area control (AC) and regional control (RC). The outstanding feature of the system is the large number of regional controls
20
subordinated to each area control. Dispatch control is characterized by strict operational discipline. Orders issued at higher levels are mandatory for those at lower levels. But this does not mean that dispatchers at lower levels cannot work independently in their own zone provided they take into account the operational guides. Under post-emergency conditions they must take immediate actions to restore the power supply and bring the system under control. Operating staff at the higher level coordinate their activity to provide secure and economic operation of the system as a whole. All equipment under control is divided into two types: major equipment affecting the operation of large areas may be used only by command or permission from the higher level; minor equipment may be used by the lowerlevel staff independently but these operations must be reported to the higher level. A number of the largest plants in the U PG are under direct control from NC and AC levels. The national control centre, the area control centres and most of the regional control centres are equipped with modem computerized information and control systems. Four-machine configurations are used consisting of two large- or medium-scale general-purpose computers and two minicomputers which serve as part of SCADA. Microcomputers are also being introduced into the system to facilitate data acquisition functions. More than 50 such systems have already been implemented and 30 more are under construction. Animated mosaic-wall diagrams are used at these centres together with colour pseudographic CRT displays, because these diagrams give an overall view of the system under consideration.
Electrical Power ~t Energy Systems
Security functions are the most important part of the set of information and control system functions. There are two groups of such functions: security monitoring and contingency evaluation. Security monitoring is carried out by continuous comparison of nodal voltages and line loads against predetermined levels. Steady-state stability limits are usually used at this level rather than the thermal limit. Sometimes continuous real-time calculations are made to obtain the real value of the steady-state stability limit by taking into account current operating conditions. This permits an increase in line usage and economical power exchange. Contingency evaluation is carried out by taking into account the automatic emergency control system which is used in the UPG (see Section IV). Two system models are used for this purpose: a model for AC load flow calculations and a model representing the emergency control system. As a result of calculations made for the (n - 1)-elements case, possible automatic corrective actions for each credible fault may be obtained. These actions are then introduced into the AC power flow model and new operating conditions are obtained corresponding to the system post-fault state. This state is evaluated from the point of view of system security. After a total cycle of n - 1 calculations, the dispatcher is informed about the concrete system state after each credible fault and a generalized estimation of the severity of the current operating conditions is given. This estimation is defined as the sum of the loads which will be disconnected by underfrequency relays and special stability control schemes. Load decreases due to the frequency decreasing may also be taken into account. A special function is implemented in the system under consideration which consists of stability control schemes monitoring whether or not the system has been adjusted according to the current operating conditions.
IV. A u t o m a t i c e m e r g e n c y c o n t r o l Owing to the rapid dynamic character of the spreading of power system emergencies, automatic emergency control is the main part of the complex of measures to prevent system collapses. Many types of automatic devices are included in this system (Table 1): automatic voltage regulators; automatic major tie-line load limiters (as part of the automatic generation control - AGC); relay protection and auto-reclosing; stability control schemes; out-of-step protection; a complex of devices to initiate actions in the case of a frequency or voltage decrease; autoreclosing to pick up the load disconnected by underfrequency relays and to restore the normal system configuration. IV.1 Large generating sets are usually equipped with automatic voltage regulators in combination with power system stabilizers. These devices, providing what is termed 'forced excitation control', were implemented for the first time in the USSR in the late 1950s and played a very important role in increasing the transmission capability. They were created when large hydroelectric plants on the Volga river were under construction. Together with
Vol 11 No 1 January 1 989
fast-response exciters and a high level of excitation ceiling they had to provide the transmission of a large amount of power from Kuibishev to Moscow over one doublecircuit 400 kV (then 500 kV) line. There were no large computers available for the necessary calculations at that time and most of the studies were conducted using a special electrodynamic model with synchronous generators from 10 to 15 kW representing real industrial units. The main problem to be solved was the type of system variables to use for power system stabilization. The best variables are the power angles 6 and 6'. But special communication channels had to be used to obtain the signals needed for power-angle measurement. It was decided that these channels were not reliable enough to provide a good service, so the value of the line current I was used instead as the analogue of the power angle, together with I' and I". The line voltage deviation A U and U' were also added. The experience gained with this installation showed that it operates very successfully and makes it possible to improve stability and to have an angle between line terminal voltages of close to 90 °. But line current as a variable for power system stabilization (PSS) has some drawbacks from an operational point of view and cannot be used when a number of lines are connected to the same bus. New force excitation regulators were therefore equipped with frequency (f) transducers and the PSS variables used were Af, f ' together with A U, U' and the excitation current It. Regulators of this type were installed at the Volgogradskaia (on the Volga river) and Bratskaia (on the Angara river) hydropower plants. They are now used on all hydro and turbo generators rated 100-200 MW or more. Some problems remain however. The stability domains of these regulators are closed and the occasional period of operation out of these domains resulted in selfoscillations being observed in some part of the UPG. Thus adaptive regulators of this type are now under development as well as new methods for their adjustment. Microcomputers are being used to solve the problem.
Table 1. Types of devices used in automatic emergency control Type of control
Type of automatic devices and schemes
Preventive
Automatic voltage regulators Automatic generation control
Protective
Relay protection Out-of-step protection Underfrequency load shedding Undervoltage load shedding
Corrective
Stability control schemes Automatic tripping to household Automatic generator start-up and loading
Restorative
Autoreclosing Transfer to standby power supply
21
Table 2. Methods of reliability improvement Type of back-up protection Remote
Local
Back-up relay protection with time delay installed at remote substations
Duplication of mains protection Circuit-breaker fault protection Group protection with selectors
IV.2 One of the main functions of the control-centre computer systems is automatic generation control (AGC). A special form of AGC is used in the UPG which is closely related to emergency control and is called automatic line load limitation (ALL). The normal mode of operation of the UPG is one with free line load flows, so that the dispatcher on duty has special responsibility for line load control. ALL helps him to cope with the problem while operating in the mode mentioned above. The difference between automatic load frequency control (LFC) and ALL is that the latter operates as a relay preventing line overloads above the predetermined level. Special measures are taken to provide correct operation of this system, which acts very fast. Overshooting may occur, but it is suppressed and the line load level remains at the predetermined uppermost level or below it. This system permits the most economical form of operation to be used, while at the same time preventing emergencies due to line overloading. Thus it is one of the most important preventive measures. It can suppress line load swings within a period of 2-3 min, which is considerably less than the LFC system. Other forms of AGC are also used in the UPG: flat tieline control, biased tie-line control and so on. The hierarchical structure of the AGC system provides two or three levels of control. The highest level is national control, which coordinates the operation of low AGC levels to provide correct loading of inter-area ties. Area control (and/or in some cases regional control) operates power plants in corresponding areas. ALL is a part of this system and has the same structure. IV.3 Relay protection is the oldest form of emergency control. All lines of the main grid and supergrid are protected by high-speed mains protection, mostly using carrier-current phase comparison. The general philosphy is to equip lines with back-up protection having another principle of operation, mainly distance protection (in the case of phase-to-phase short-circuits) and zero-sequence current protection. The most difficult problem in the relay protection of heavily loaded long transmission lines is that of reliability in providing short-circuit clearing in the case of mains protection or circuit-breaker failure. Some methods for reliability improvement are shown in Table 2. Historically the oldest type of back-up protection is remote back-up designed to provide fault clearing in the cases mentioned above.
22
Nowadays local back-up protection is added, which results in less time for clearing and more sensitivity and selectivity by using circuit-breaker failure protection (CBFP). In practice such protection is installed at all main grid substations. The time delays of the CBFP operation are up to 0.35-0.4 s at 330-750 kV substations and up to 0.5 s in 110-220 kV networks. 750 kV lines are equipped with two mains protections based on different principles (for example, phase comparison and distance), the operational time being less than 20 ms. An under-reaching approach is used. At large power stations a special type of local back-up protection is used called 'group protection with selectors' (GP). As can be seen from Figure 3(a), overcurrent or distance relays (R) are fed by the sum of the generator currents. These relays will operate if there is any kind of short-circuit in the lines connected to the station buses and will be very sensitive. Special line selectors (S) are used to discriminate the faulted line (Figure 3(b)). Auto-reclosing plays an important role in system restoration and the prevention of cascading. There are several types of auto-reclosing scheme used in the UPG: 110-220 kV lines are equipped with three-phase autoreclosing of various kinds; UHV lines usually have combined auto-reclosing schemes which operate as single-phase in the case of line-to-ground faults and as 'accelerated' three-phase in the case of phase-to-phase faults and false line tripping. The percentage of successful auto-reclosing operations in UHV lines is slightly less than in lines with lower voltages. IV.4 IV.4.1. The idea of power system stability control appeared more than 50 years ago. There were many
b
/ RI[
S
E ]
1 I ii Cl
-ii
a
SI
b
S2 /
~
R2
$3 /
=
R3
Figure 3. Group protection with selectors
Electrical Power Et Energy Systems
tifferent suggestions in this area, but in practice stability :ontrol only began to be used widely in the late 1950s when very long and heavily loaded lines were constructed. In the Soviet Union it was the large Kuybishevskaja hydropower plant project that initiated many special studies in this field. Series capacitors were used, with the value of the capacitance being decreased during the faults. The use of breaking resistors as a means of preventing instability in the case of severe faults was studied first. But it was recognized that in the case of the large receiving part of the system the best results are gained by simple generation dropping. This method was used until the middle 1960s as the sole means of decreasing the line load in an emergency. Subsequently fast valve control of modem systems with a once-through boiler was developed and implemented at several large power plants. This method does not permit a decrease of an acceleration area but substantially increases a deceleration area, thus providing transient stability of the generators in the case of severe faults. A special control was developed to restore the steadystate stability margin after the fast valve control operation, so this measure can be used when the pre-fault load exceeds the steady-state stability limit of the postfault conditions. To provide the necessary decrease in load, the positions of the valves are controlled by the duration of the pulse sent to a governor pilot valve through an electrohydraulic convertor EGC. The controllers regulating the new level of generation according to post-fault conditions are of the closed-loop type and respond to the electrical or mechanical power of the system. IV.4.2. Analysis has shown that the main factors affecting system stability and corrective actions needed are the system configuration, the pre-fault line loads and changes in the system configuration. The value of the active power drop following a shortcircuit must be taken into account during the most severe faults (or if fault clearing is delayed). Thus the first type of stability control scheme used in the USSR included the means for monitoring the system configuration and the pre-fault operating conditions as well as for the detection of line tripping. Signals for corrective actions were sent by special carrier-current communications equipment of high reliability. This local system embraced a region including some lines or line sections of the main grid and several power plants. Transient stability and the minimal post-fault steady-state stability margin were provided by decreasing the line load using stability control. These schemes, used in the 1960s and 1970s, gave improved stability and allowed line loads to be increased up to the pre-fault steady-state stability limit within a margin of 20% or less. However, the requirements for improving automatic stability control increased as the UPG of the USSR developed into a very complex system including many regions connected by long and heavily loaded lines. Thus the need for an improved centralized stability control system became of paramount importance and the design and construction of such a system was begun. There are now some centralized systems of this kind which are based on modem minicomputers and microcomputers and permit control in emergencies in large regions of the UPG of the USSR.
Vol 11 No 1 January 1989
The structure of the full stability control system used is shown at Figure 4. The main parts of the system are automatic action adjusters (AAAs) - computerized devices designed to issue commands for control actions (generator deloading and tripping, load disconnection and so on) - operating together with fault detectors which indicate the location, type and intensity of the disturbance. Together they define the location, character and degree of action(s) needed. As was shown in References 1 and 2, this must be done on the basis of the system vector So and the disturbance vector V. Devices of this kind may be classified according to the method used3: Class I
operating on the basis of on-line stability calculations;
Class II using the results of off-line studies. There can be two types of device: after-the-fact acting and before-the-fact acting. Devices of the first type develop control commands immediately the fault occurs. Devices of the second type prepare a set of control actions for each type of disturbance possible in the power system state S O. The difference between these two types of device can be seen in Figure 5. Figure 5(a) represents the after-the-fact device. The decision-making part (DMP-1) receives signals S Oand V and develops control signals U. In Figure 5(b) the structure of the before-the-fact system is depicted. The decision-making part (DMP-2) differs from DMP-1; it operates continuously and cyclically determines a set of actions appropriate to the current system state S o. The set is stored in a special memory (solid-state or electromechanical relays). When a fault occurs and a signal Vi appears, an action corresponding to V~ and So.~ is read and implemented. The cycle duration AT is determined by the rate of change of the load flow and can be in the range from 10-15 s to 1-2 min. The area served by one AAA is determined by the power system configuration. The total number of AAAs in the UPG is expected to be 20-25. To coordinate the operation of these facilities, special systems are set up which provide coupling of neighbouring AAAs according to the whole power system state. IV.4.3 Algorithms of AAA operation Decision-table algorithm. The simplest algorithm used for the number of AAAs is based on a decision-table technique. The system state vector So consists of two components: the initial power flow Po and the system configuration index V.The disturbance vector V is defined by the number of fault detectors, Ni, operating at the instant of the fault. The value of Po is digitized and expressed in terms of steps Pk, k = 1 , 2 , . . . , n. Thus we can describe the control vector as U=Vc~PknNi This relationship is defined by off-line stability studies (Class II device); so the DMP may be referred to as a sophisticated memory device containing the tables mentioned.
23
Action distributor
Automatic action adjuster
Actionimplementation
/
At hydropowerstation J I Pre-fault I I I Breaker I Watt I iL _"t _JI status
I r i
Breaker status "
_•
[
t Choiceof gte;;re~tOrs
At thermal (nuclear) power station Pre-foult
AAA
Watt
aPg,t aPs
~Pt Store
Generators
II
t ~j
-J
~ l
Tripping
~lsig nals
F'Lt_ ~I-- qj Breaker status t
Master station controller
I
:Wft::l:r ii [
[ i:/sBtret°uler
Te~mSUSt delo~indi~lrN _1 tory
Unit
~l
controI let
deloading
. .
_~
Generator
division
~EHC F Synchr°m°tor Boiler
Figure 4. Full stability control system of the Unified Power Grid of the USSR: AP~.t, load decreasing by generator tripping; APs, sustained load decreasing by turbine control; APt, temporary load decreasing by turbine control
The decision-making process is very simple and can be implemented after-the-fact as well as before-the-fact. The memory required for the D M P may be defined by the method outlined in Reference 2. Its capacity grows rapidly with increasing complexity of the network.
SO
~|
DMP-I
~U
a
O
i
DMP-2
Algorithm based on steady-state stability considerations. This algorithm is designed for special cases when control actions may be determined on the basis of steadystate stability calculations. It is implemented by means of a before-the-fact Class II device. Let us consider the case when one of two lines operating in parallel is tripped. To secure system stability, generator disconnection is needed. Transient stability studies show that the amount of generation decrease must be APt,s and the post-fault power flow can be determined as P~,= Po - P,,,
=-!
Memory
~U
b Figure 5. Structure of (a) after-the-fact device and (b) before-the-fact device
24
(1)
where P0 is the total value of the pre-fault power flow. Another approach to determine Pp, is to consider the post-fault steady-state conditions of the system. Here this value can be obtained as Pp;= Po - P1 zpf(1 - AP,,,)
(2)
where P12pf is the steady-state stability limit under postfault conditions and APs., is the steady-state stability
Electrical Power Et Energy Systems
margin under post-fault conditions, determined by special standards. In the UPG an 8 ~o margin is usually taken. Thus a certain deceleration area is formed. Sometimes Pp'f
f(P,,P2,...
,P.-,)= ~ ~,auPiPj =0 i=1
(3)
j
where P1,P2 . . . . . ,°,-1 are power flows over the ngenerator chain network and P, is taken equal to 1. The chain networks under consideration include as a rule not more than three generators; the value of a,, = - 1. Thus equation (3) can be rewritten as
a11p2 +a12P1P2 +a13P1 q-a22p2-i-a23P2 - 1=0
(4)
Inside the stability area boundaries the value of the lefthand side of(4) is negative and changes its sign when these boundaries are crossed. Thus the stable operating conditions for each network configuration can be determined. To increase the accuracy of calculation of the post-fault power flow, it can be determined as
P~=PIo+AP~
(5)
where i is the number of lines under consideration and
AP~=~ Kj~APj j=l
with n the number of buses where the balance of power has changed and AP~ the values of the imbalances. The distribution factors K~ can be determined from linearized simultaneous balance equations. The equation for bus l is = APtR
= aPg, aPd,
(6)
k=l
where m is the number of buses connected to bus l, APg~ and APd~are the increments of the generation and demand at bus I and AP, k is the increment of the power flow in the branch connecting bus l with neighbouring bus k.
aelk =
emax~ /k
n/2
(At}t- At~k)
(7)
where Pma.,lk is the maximum of the power-angle curve and Ar, and A6k are the increments of the load angles at buses l and k. Now the same algorithm is developed for the beforethe-fact Class I system. This algorithm differs from that
Vo111 No 1 January 1989
described above in that the stability estimation is performed on-line.
The comprehensive AAA algorithm. This algorithm is designed for general cases when transient stability problems must be taken into account as well as steadystate stability considerations. It can be applied to a large control area and may be implemented by means of rather small computers. The algorithm is based on three main factors concerning the stability problem. Control actions are determined to meet the following requirements: 1 to maintain system transient stability after the fault; 2 to provide the steady-state stability margin before turbine governor action given by special standards; 3 to secure system stability when the turbine governor is adjusting line power flows in response to stability control actions made. Requirement 1 is checked in a similar way to the algorithms described earlier. The difference is that the power drop during the fault, APs.c, is included in the polynomial expression for the stability area boundaries. Thus the control actions (APgi and AP0~) are determined by three or four iterations as
APg,= f (Po,, APe,c,,,APJ
(8)
Requirement 2 is also checked by analytical approximation of the steady-state stability area boundaries determined off-line. To check requirement 3, special calculations are made on-line to determine the power flows under postemergency conditions after the control actions have been implemented and the turbine governors are operating. The actions determined by requirements 1, 2 and 3 (APc,a,l, APc,a, 2 and APe,a,3) are compared and the largest is taken for implementation. The outstanding feature of the algorithm under consideration is its ability to compare a number of control actions which may be initiated for various credible faults, by its total power supply interruption value taking into account frequency decreases caused by generation shortfall. Actions including system isolation may also be compared using this algorithm.
IV.4.4 Implementation of computerized AAA systems Five computerized AAA systems are currently in operation, two are under commission and four are under development. The first computerized AAA system was implemented at Votkinsk hydropower station in 1978, based on general-purpose minicomputers and using the decisiontable algorithm. A similar algorithm is used with the 16bit microcomputer AAAs commissioned in 1983. Special-purpose minicomputer systems using majority rules were commissioned in 1981. The first system of this kind uses the steady-state stability algorithm (version 1) for networks with more than 20 buses ~nd a set of about 50 credible faults. The cycle time is 20-30 s. The second system of this kind uses the comprehensive
25
AAA algorithm for networks with 12 buses and a set of 40 credible faults. The cycle time is about 5 s. The two systems which are now under commission will be built using the same algorithms, one of them based on special-purpose and the other on general-purpose minicomputers. The outstanding feature of the systems based on the comprehensive algorithm is that they are organized as programmed controllers with only very simple language needed for readjustment in the case of changes in the power system configuration. The wide use of stability control schemes and systems has made the contingencies evaluation function fulfilled by the SCADA computers more complicated. In this evaluation we have to take into account actions initiated by the stability control in the case of emergencies, and the result of such actions is of equal interest to the system operator as the system stability itself. In simple cases we can incorporate a model of stability control directly into the contingency evaluation program. In more complicated systems, when the AAA functions are performed by minicomputers or microcomputers, it is difficult to simulate their operation in the contingency evaluation program. Another approach seems more suitable: to send to the control-centre computers realtime data representing AAA settings for credible emergency conditions in the current operating situation.
V. Conclusions One of the main problems in the modem power industry is to prevent widespread blackouts from affecting large
26
areas with severe economical and social consequences. To solve this problem, it is necessary to establish and support a strictly organized emergency control system including operating and automatic subsystems. Experience gained in the USSR shows that proper emergency control can provide full usage of line transmission capability up to the values determined by the steady-state stability limit (with minimal margin). The control must develop from a local level to a centralized level embracing large areas and a rational combination of local and centralized principles. Modem systems of this kind must be based on a computer network (including SCADA computers as well as special control computers) in order to implement the necessary information, monitoring and control functions. Cascade emergencies are a secondary sequence of phenomena associated to a large extent with emergency control failures. The reliability of the emergency control devices must be extremely high.
Vl. References 1 Vasilchenko, V V, Venikov, V A, Zeilidzon, E D, Portnoy, M G, Sovalov, S A, Khachaturov, A A and Khvostchinskaya, Z G 'Ensuring security of USSR power systems' C/GRE (1974) Paper 32-12 2 Bogdanov, V A, Venikov, V A. Luginsky, T I~ and Chernja, G A Power System Contro/ Mir Publishing House, Moscow (1982) 3 Iofiev, B I, Cosheev, L A, Lagusker, V M, Luginsky, Ja N, Sadovsky, Ju D and Semenov, V A 'Process control computers in power system stability control' C/GRE (1984) Paper 39-16
Electrical Power 6"Energy Systems
Large power system interconnections now cover vast areas of the developed countries of the world. For the economic and reliable operation of such complex networks, it is essential that adequate stability control measures are adopted in order to deal quickly and effectively with emergency situations. This paper describes the development and implementation of the automatic emergency control system used in the Unified Power Grid of the USSR. Keywords: on-line control strategies, operational reliability, emergency control
I. I n t r o d u c t i o n The creation of national and international bulk power systems is the main feature of modem power industry development. Large interconnections serving some hundred million people now cover vast areas of the developed countries of the world. The economic effect of such a development is evident. It is possible to reduce operating reserves and to use the effect of decreasing the coincident peak load. Economical energy resources are used in these interconnections in the most effective way. On the other hand, such large interconnections also have some well known shortcomings - such as the increased probability of cascading of faults when blackouts cover large areas. The experience gained by the Soviet power industry shows that most of such disasters occur because of the lack of attention paid to emergency control. The Unified Power Grid (UPG) of the USSR covers about 10 million km 2 and spreads from east to west over 7000 km and from south to north up to 3000 km. The main feature of the system is the interconnection of many industrial regions separated from each other by long distances. The U P G now consists of nine Interconnected Power Pools (IPP) with installed capacities from 10 to 50 million kW. The total installed capacity is 240 million kW and the coincident peak load is up to 180 million kW. The U P G includes some concentrated areas connected by a backbone supergrid system with very long transmission lines. The structure of this system is depicted in Figure 1. It consists of large areas covering highly populated industrial regions. Each area can be treated as Received 7 January 1987
Vol 11 No 1 January 1989
a superpool importing and exporting large amounts of power. The distances between the centres of these regions reach several hundred km in the western part of the country and up to a thousand km in the eastern part. Transmission lines are very long and expensive and the cost/efficiency of these lines is one of the most important problems. Many specialists have been involved in this problem and intensive studies have been carried out since the early 1930s. As a result of emergency control measures, the major tie-lines and trunk-lines are now operated with minimal pre-fault steady-state stability margin, being loaded in many cases well above the maximum of the power-angle curve for post-fault conditions. Using the term proposed in CIGRE and IEC publications, one can call this a 'conditional stability'. But the security of the main grid and supergrid is very high: total outages caused by faults in these grids during the year do not exceed 5-6 system minutes and there have been no system collapses for many years. This high standard of service is gained by the very efficient organization of the emergency control system which has been developed and continuously improved during the last 30-35 years.
I1. Types of control classification There are many different approaches to the types of emergency control classification. In this paper we use the classification depicted in Figure 2 where the types of operating conditions and control actions are shown. Under normal conditions all state variables are in the area permissible for continuous operation and reliability constraints and quality requirements are met. Alert conditions are featured by one or several state variables reaching levels permitted only for a specified period of time. In emergency conditions one or several variables have values which can be permitted for a very short period of time only. Post-emergency operating conditions may occur after emergency conditions and may be normal or alert. The types of control actions that prevent transfer from normal to alert conditions are called 'preventive control'. The control may also be called preventive if it prevents the transition from the alert to the emergency state according to the stability constraints. In the case of thermal stability constraints the control which prevents the transition from
0142-0615/89/010019-08/S03.00© Butterworth ~t Co (Publishers) Ltd
19
To NORDEL
t North26 GWWest
J
MiddleVolga
Centre 39.3 GW
15.7GW
I
[
Urol 30.8 GW
]
S i b e r i a To power system'MIR'
South 44.6 GW Kazokhston I 8.4 GW J
GW
To Mongolia
I oGw N°r'hc°uc°susI Tronscaucosus J 10.5 GW ToTurkey Figure 1. The Unified Power Grid of the USSR; the number in each box is the installed capacity for that region
Post-emergency Restorative ~jJ
Normal
Preventive ~lJ
Alert
Preventive Protective corrective
Emergency I_ Protective I -- corrective
Figure 2. Emergency control classification showing the types of operating conditions and control actions the alert to the emergency state is referred to as 'corrective'. 'Protective control' is used to terminate emergency conditions and transfer the system to the post-emergency state. In some cases corrective control must be added when necessary. 'Restorative control' allows the system to return to normal operating conditions again. The problem of emergency control consists of two main parts: operating control and automatic control.
III. Dispatch control There is a three-tier hierarchical system of dispatch control in the UPG: national control (NC), area control (AC) and regional control (RC). The outstanding feature of the system is the large number of regional controls
20
subordinated to each area control. Dispatch control is characterized by strict operational discipline. Orders issued at higher levels are mandatory for those at lower levels. But this does not mean that dispatchers at lower levels cannot work independently in their own zone provided they take into account the operational guides. Under post-emergency conditions they must take immediate actions to restore the power supply and bring the system under control. Operating staff at the higher level coordinate their activity to provide secure and economic operation of the system as a whole. All equipment under control is divided into two types: major equipment affecting the operation of large areas may be used only by command or permission from the higher level; minor equipment may be used by the lowerlevel staff independently but these operations must be reported to the higher level. A number of the largest plants in the U PG are under direct control from NC and AC levels. The national control centre, the area control centres and most of the regional control centres are equipped with modem computerized information and control systems. Four-machine configurations are used consisting of two large- or medium-scale general-purpose computers and two minicomputers which serve as part of SCADA. Microcomputers are also being introduced into the system to facilitate data acquisition functions. More than 50 such systems have already been implemented and 30 more are under construction. Animated mosaic-wall diagrams are used at these centres together with colour pseudographic CRT displays, because these diagrams give an overall view of the system under consideration.
Electrical Power ~t Energy Systems
Security functions are the most important part of the set of information and control system functions. There are two groups of such functions: security monitoring and contingency evaluation. Security monitoring is carried out by continuous comparison of nodal voltages and line loads against predetermined levels. Steady-state stability limits are usually used at this level rather than the thermal limit. Sometimes continuous real-time calculations are made to obtain the real value of the steady-state stability limit by taking into account current operating conditions. This permits an increase in line usage and economical power exchange. Contingency evaluation is carried out by taking into account the automatic emergency control system which is used in the UPG (see Section IV). Two system models are used for this purpose: a model for AC load flow calculations and a model representing the emergency control system. As a result of calculations made for the (n - 1)-elements case, possible automatic corrective actions for each credible fault may be obtained. These actions are then introduced into the AC power flow model and new operating conditions are obtained corresponding to the system post-fault state. This state is evaluated from the point of view of system security. After a total cycle of n - 1 calculations, the dispatcher is informed about the concrete system state after each credible fault and a generalized estimation of the severity of the current operating conditions is given. This estimation is defined as the sum of the loads which will be disconnected by underfrequency relays and special stability control schemes. Load decreases due to the frequency decreasing may also be taken into account. A special function is implemented in the system under consideration which consists of stability control schemes monitoring whether or not the system has been adjusted according to the current operating conditions.
IV. A u t o m a t i c e m e r g e n c y c o n t r o l Owing to the rapid dynamic character of the spreading of power system emergencies, automatic emergency control is the main part of the complex of measures to prevent system collapses. Many types of automatic devices are included in this system (Table 1): automatic voltage regulators; automatic major tie-line load limiters (as part of the automatic generation control - AGC); relay protection and auto-reclosing; stability control schemes; out-of-step protection; a complex of devices to initiate actions in the case of a frequency or voltage decrease; autoreclosing to pick up the load disconnected by underfrequency relays and to restore the normal system configuration. IV.1 Large generating sets are usually equipped with automatic voltage regulators in combination with power system stabilizers. These devices, providing what is termed 'forced excitation control', were implemented for the first time in the USSR in the late 1950s and played a very important role in increasing the transmission capability. They were created when large hydroelectric plants on the Volga river were under construction. Together with
Vol 11 No 1 January 1 989
fast-response exciters and a high level of excitation ceiling they had to provide the transmission of a large amount of power from Kuibishev to Moscow over one doublecircuit 400 kV (then 500 kV) line. There were no large computers available for the necessary calculations at that time and most of the studies were conducted using a special electrodynamic model with synchronous generators from 10 to 15 kW representing real industrial units. The main problem to be solved was the type of system variables to use for power system stabilization. The best variables are the power angles 6 and 6'. But special communication channels had to be used to obtain the signals needed for power-angle measurement. It was decided that these channels were not reliable enough to provide a good service, so the value of the line current I was used instead as the analogue of the power angle, together with I' and I". The line voltage deviation A U and U' were also added. The experience gained with this installation showed that it operates very successfully and makes it possible to improve stability and to have an angle between line terminal voltages of close to 90 °. But line current as a variable for power system stabilization (PSS) has some drawbacks from an operational point of view and cannot be used when a number of lines are connected to the same bus. New force excitation regulators were therefore equipped with frequency (f) transducers and the PSS variables used were Af, f ' together with A U, U' and the excitation current It. Regulators of this type were installed at the Volgogradskaia (on the Volga river) and Bratskaia (on the Angara river) hydropower plants. They are now used on all hydro and turbo generators rated 100-200 MW or more. Some problems remain however. The stability domains of these regulators are closed and the occasional period of operation out of these domains resulted in selfoscillations being observed in some part of the UPG. Thus adaptive regulators of this type are now under development as well as new methods for their adjustment. Microcomputers are being used to solve the problem.
Table 1. Types of devices used in automatic emergency control Type of control
Type of automatic devices and schemes
Preventive
Automatic voltage regulators Automatic generation control
Protective
Relay protection Out-of-step protection Underfrequency load shedding Undervoltage load shedding
Corrective
Stability control schemes Automatic tripping to household Automatic generator start-up and loading
Restorative
Autoreclosing Transfer to standby power supply
21
Table 2. Methods of reliability improvement Type of back-up protection Remote
Local
Back-up relay protection with time delay installed at remote substations
Duplication of mains protection Circuit-breaker fault protection Group protection with selectors
IV.2 One of the main functions of the control-centre computer systems is automatic generation control (AGC). A special form of AGC is used in the UPG which is closely related to emergency control and is called automatic line load limitation (ALL). The normal mode of operation of the UPG is one with free line load flows, so that the dispatcher on duty has special responsibility for line load control. ALL helps him to cope with the problem while operating in the mode mentioned above. The difference between automatic load frequency control (LFC) and ALL is that the latter operates as a relay preventing line overloads above the predetermined level. Special measures are taken to provide correct operation of this system, which acts very fast. Overshooting may occur, but it is suppressed and the line load level remains at the predetermined uppermost level or below it. This system permits the most economical form of operation to be used, while at the same time preventing emergencies due to line overloading. Thus it is one of the most important preventive measures. It can suppress line load swings within a period of 2-3 min, which is considerably less than the LFC system. Other forms of AGC are also used in the UPG: flat tieline control, biased tie-line control and so on. The hierarchical structure of the AGC system provides two or three levels of control. The highest level is national control, which coordinates the operation of low AGC levels to provide correct loading of inter-area ties. Area control (and/or in some cases regional control) operates power plants in corresponding areas. ALL is a part of this system and has the same structure. IV.3 Relay protection is the oldest form of emergency control. All lines of the main grid and supergrid are protected by high-speed mains protection, mostly using carrier-current phase comparison. The general philosphy is to equip lines with back-up protection having another principle of operation, mainly distance protection (in the case of phase-to-phase short-circuits) and zero-sequence current protection. The most difficult problem in the relay protection of heavily loaded long transmission lines is that of reliability in providing short-circuit clearing in the case of mains protection or circuit-breaker failure. Some methods for reliability improvement are shown in Table 2. Historically the oldest type of back-up protection is remote back-up designed to provide fault clearing in the cases mentioned above.
22
Nowadays local back-up protection is added, which results in less time for clearing and more sensitivity and selectivity by using circuit-breaker failure protection (CBFP). In practice such protection is installed at all main grid substations. The time delays of the CBFP operation are up to 0.35-0.4 s at 330-750 kV substations and up to 0.5 s in 110-220 kV networks. 750 kV lines are equipped with two mains protections based on different principles (for example, phase comparison and distance), the operational time being less than 20 ms. An under-reaching approach is used. At large power stations a special type of local back-up protection is used called 'group protection with selectors' (GP). As can be seen from Figure 3(a), overcurrent or distance relays (R) are fed by the sum of the generator currents. These relays will operate if there is any kind of short-circuit in the lines connected to the station buses and will be very sensitive. Special line selectors (S) are used to discriminate the faulted line (Figure 3(b)). Auto-reclosing plays an important role in system restoration and the prevention of cascading. There are several types of auto-reclosing scheme used in the UPG: 110-220 kV lines are equipped with three-phase autoreclosing of various kinds; UHV lines usually have combined auto-reclosing schemes which operate as single-phase in the case of line-to-ground faults and as 'accelerated' three-phase in the case of phase-to-phase faults and false line tripping. The percentage of successful auto-reclosing operations in UHV lines is slightly less than in lines with lower voltages. IV.4 IV.4.1. The idea of power system stability control appeared more than 50 years ago. There were many
b
/ RI[
S
E ]
1 I ii Cl
-ii
a
SI
b
S2 /
~
R2
$3 /
=
R3
Figure 3. Group protection with selectors
Electrical Power Et Energy Systems
tifferent suggestions in this area, but in practice stability :ontrol only began to be used widely in the late 1950s when very long and heavily loaded lines were constructed. In the Soviet Union it was the large Kuybishevskaja hydropower plant project that initiated many special studies in this field. Series capacitors were used, with the value of the capacitance being decreased during the faults. The use of breaking resistors as a means of preventing instability in the case of severe faults was studied first. But it was recognized that in the case of the large receiving part of the system the best results are gained by simple generation dropping. This method was used until the middle 1960s as the sole means of decreasing the line load in an emergency. Subsequently fast valve control of modem systems with a once-through boiler was developed and implemented at several large power plants. This method does not permit a decrease of an acceleration area but substantially increases a deceleration area, thus providing transient stability of the generators in the case of severe faults. A special control was developed to restore the steadystate stability margin after the fast valve control operation, so this measure can be used when the pre-fault load exceeds the steady-state stability limit of the postfault conditions. To provide the necessary decrease in load, the positions of the valves are controlled by the duration of the pulse sent to a governor pilot valve through an electrohydraulic convertor EGC. The controllers regulating the new level of generation according to post-fault conditions are of the closed-loop type and respond to the electrical or mechanical power of the system. IV.4.2. Analysis has shown that the main factors affecting system stability and corrective actions needed are the system configuration, the pre-fault line loads and changes in the system configuration. The value of the active power drop following a shortcircuit must be taken into account during the most severe faults (or if fault clearing is delayed). Thus the first type of stability control scheme used in the USSR included the means for monitoring the system configuration and the pre-fault operating conditions as well as for the detection of line tripping. Signals for corrective actions were sent by special carrier-current communications equipment of high reliability. This local system embraced a region including some lines or line sections of the main grid and several power plants. Transient stability and the minimal post-fault steady-state stability margin were provided by decreasing the line load using stability control. These schemes, used in the 1960s and 1970s, gave improved stability and allowed line loads to be increased up to the pre-fault steady-state stability limit within a margin of 20% or less. However, the requirements for improving automatic stability control increased as the UPG of the USSR developed into a very complex system including many regions connected by long and heavily loaded lines. Thus the need for an improved centralized stability control system became of paramount importance and the design and construction of such a system was begun. There are now some centralized systems of this kind which are based on modem minicomputers and microcomputers and permit control in emergencies in large regions of the UPG of the USSR.
Vol 11 No 1 January 1989
The structure of the full stability control system used is shown at Figure 4. The main parts of the system are automatic action adjusters (AAAs) - computerized devices designed to issue commands for control actions (generator deloading and tripping, load disconnection and so on) - operating together with fault detectors which indicate the location, type and intensity of the disturbance. Together they define the location, character and degree of action(s) needed. As was shown in References 1 and 2, this must be done on the basis of the system vector So and the disturbance vector V. Devices of this kind may be classified according to the method used3: Class I
operating on the basis of on-line stability calculations;
Class II using the results of off-line studies. There can be two types of device: after-the-fact acting and before-the-fact acting. Devices of the first type develop control commands immediately the fault occurs. Devices of the second type prepare a set of control actions for each type of disturbance possible in the power system state S O. The difference between these two types of device can be seen in Figure 5. Figure 5(a) represents the after-the-fact device. The decision-making part (DMP-1) receives signals S Oand V and develops control signals U. In Figure 5(b) the structure of the before-the-fact system is depicted. The decision-making part (DMP-2) differs from DMP-1; it operates continuously and cyclically determines a set of actions appropriate to the current system state S o. The set is stored in a special memory (solid-state or electromechanical relays). When a fault occurs and a signal Vi appears, an action corresponding to V~ and So.~ is read and implemented. The cycle duration AT is determined by the rate of change of the load flow and can be in the range from 10-15 s to 1-2 min. The area served by one AAA is determined by the power system configuration. The total number of AAAs in the UPG is expected to be 20-25. To coordinate the operation of these facilities, special systems are set up which provide coupling of neighbouring AAAs according to the whole power system state. IV.4.3 Algorithms of AAA operation Decision-table algorithm. The simplest algorithm used for the number of AAAs is based on a decision-table technique. The system state vector So consists of two components: the initial power flow Po and the system configuration index V.The disturbance vector V is defined by the number of fault detectors, Ni, operating at the instant of the fault. The value of Po is digitized and expressed in terms of steps Pk, k = 1 , 2 , . . . , n. Thus we can describe the control vector as U=Vc~PknNi This relationship is defined by off-line stability studies (Class II device); so the DMP may be referred to as a sophisticated memory device containing the tables mentioned.
23
Action distributor
Automatic action adjuster
Actionimplementation
/
At hydropowerstation J I Pre-fault I I I Breaker I Watt I iL _"t _JI status
I r i
Breaker status "
_•
[
t Choiceof gte;;re~tOrs
At thermal (nuclear) power station Pre-foult
AAA
Watt
aPg,t aPs
~Pt Store
Generators
II
t ~j
-J
~ l
Tripping
~lsig nals
F'Lt_ ~I-- qj Breaker status t
Master station controller
I
:Wft::l:r ii [
[ i:/sBtret°uler
Te~mSUSt delo~indi~lrN _1 tory
Unit
~l
controI let
deloading
. .
_~
Generator
division
~EHC F Synchr°m°tor Boiler
Figure 4. Full stability control system of the Unified Power Grid of the USSR: AP~.t, load decreasing by generator tripping; APs, sustained load decreasing by turbine control; APt, temporary load decreasing by turbine control
The decision-making process is very simple and can be implemented after-the-fact as well as before-the-fact. The memory required for the D M P may be defined by the method outlined in Reference 2. Its capacity grows rapidly with increasing complexity of the network.
SO
~|
DMP-I
~U
a
O
i
DMP-2
Algorithm based on steady-state stability considerations. This algorithm is designed for special cases when control actions may be determined on the basis of steadystate stability calculations. It is implemented by means of a before-the-fact Class II device. Let us consider the case when one of two lines operating in parallel is tripped. To secure system stability, generator disconnection is needed. Transient stability studies show that the amount of generation decrease must be APt,s and the post-fault power flow can be determined as P~,= Po - P,,,
=-!
Memory
~U
b Figure 5. Structure of (a) after-the-fact device and (b) before-the-fact device
24
(1)
where P0 is the total value of the pre-fault power flow. Another approach to determine Pp, is to consider the post-fault steady-state conditions of the system. Here this value can be obtained as Pp;= Po - P1 zpf(1 - AP,,,)
(2)
where P12pf is the steady-state stability limit under postfault conditions and APs., is the steady-state stability
Electrical Power Et Energy Systems
margin under post-fault conditions, determined by special standards. In the UPG an 8 ~o margin is usually taken. Thus a certain deceleration area is formed. Sometimes Pp'f
f(P,,P2,...
,P.-,)= ~ ~,auPiPj =0 i=1
(3)
j
where P1,P2 . . . . . ,°,-1 are power flows over the ngenerator chain network and P, is taken equal to 1. The chain networks under consideration include as a rule not more than three generators; the value of a,, = - 1. Thus equation (3) can be rewritten as
a11p2 +a12P1P2 +a13P1 q-a22p2-i-a23P2 - 1=0
(4)
Inside the stability area boundaries the value of the lefthand side of(4) is negative and changes its sign when these boundaries are crossed. Thus the stable operating conditions for each network configuration can be determined. To increase the accuracy of calculation of the post-fault power flow, it can be determined as
P~=PIo+AP~
(5)
where i is the number of lines under consideration and
AP~=~ Kj~APj j=l
with n the number of buses where the balance of power has changed and AP~ the values of the imbalances. The distribution factors K~ can be determined from linearized simultaneous balance equations. The equation for bus l is = APtR
= aPg, aPd,
(6)
k=l
where m is the number of buses connected to bus l, APg~ and APd~are the increments of the generation and demand at bus I and AP, k is the increment of the power flow in the branch connecting bus l with neighbouring bus k.
aelk =
emax~ /k
n/2
(At}t- At~k)
(7)
where Pma.,lk is the maximum of the power-angle curve and Ar, and A6k are the increments of the load angles at buses l and k. Now the same algorithm is developed for the beforethe-fact Class I system. This algorithm differs from that
Vo111 No 1 January 1989
described above in that the stability estimation is performed on-line.
The comprehensive AAA algorithm. This algorithm is designed for general cases when transient stability problems must be taken into account as well as steadystate stability considerations. It can be applied to a large control area and may be implemented by means of rather small computers. The algorithm is based on three main factors concerning the stability problem. Control actions are determined to meet the following requirements: 1 to maintain system transient stability after the fault; 2 to provide the steady-state stability margin before turbine governor action given by special standards; 3 to secure system stability when the turbine governor is adjusting line power flows in response to stability control actions made. Requirement 1 is checked in a similar way to the algorithms described earlier. The difference is that the power drop during the fault, APs.c, is included in the polynomial expression for the stability area boundaries. Thus the control actions (APgi and AP0~) are determined by three or four iterations as
APg,= f (Po,, APe,c,,,APJ
(8)
Requirement 2 is also checked by analytical approximation of the steady-state stability area boundaries determined off-line. To check requirement 3, special calculations are made on-line to determine the power flows under postemergency conditions after the control actions have been implemented and the turbine governors are operating. The actions determined by requirements 1, 2 and 3 (APc,a,l, APc,a, 2 and APe,a,3) are compared and the largest is taken for implementation. The outstanding feature of the algorithm under consideration is its ability to compare a number of control actions which may be initiated for various credible faults, by its total power supply interruption value taking into account frequency decreases caused by generation shortfall. Actions including system isolation may also be compared using this algorithm.
IV.4.4 Implementation of computerized AAA systems Five computerized AAA systems are currently in operation, two are under commission and four are under development. The first computerized AAA system was implemented at Votkinsk hydropower station in 1978, based on general-purpose minicomputers and using the decisiontable algorithm. A similar algorithm is used with the 16bit microcomputer AAAs commissioned in 1983. Special-purpose minicomputer systems using majority rules were commissioned in 1981. The first system of this kind uses the steady-state stability algorithm (version 1) for networks with more than 20 buses ~nd a set of about 50 credible faults. The cycle time is 20-30 s. The second system of this kind uses the comprehensive
25
AAA algorithm for networks with 12 buses and a set of 40 credible faults. The cycle time is about 5 s. The two systems which are now under commission will be built using the same algorithms, one of them based on special-purpose and the other on general-purpose minicomputers. The outstanding feature of the systems based on the comprehensive algorithm is that they are organized as programmed controllers with only very simple language needed for readjustment in the case of changes in the power system configuration. The wide use of stability control schemes and systems has made the contingencies evaluation function fulfilled by the SCADA computers more complicated. In this evaluation we have to take into account actions initiated by the stability control in the case of emergencies, and the result of such actions is of equal interest to the system operator as the system stability itself. In simple cases we can incorporate a model of stability control directly into the contingency evaluation program. In more complicated systems, when the AAA functions are performed by minicomputers or microcomputers, it is difficult to simulate their operation in the contingency evaluation program. Another approach seems more suitable: to send to the control-centre computers realtime data representing AAA settings for credible emergency conditions in the current operating situation.
V. Conclusions One of the main problems in the modem power industry is to prevent widespread blackouts from affecting large
26
areas with severe economical and social consequences. To solve this problem, it is necessary to establish and support a strictly organized emergency control system including operating and automatic subsystems. Experience gained in the USSR shows that proper emergency control can provide full usage of line transmission capability up to the values determined by the steady-state stability limit (with minimal margin). The control must develop from a local level to a centralized level embracing large areas and a rational combination of local and centralized principles. Modem systems of this kind must be based on a computer network (including SCADA computers as well as special control computers) in order to implement the necessary information, monitoring and control functions. Cascade emergencies are a secondary sequence of phenomena associated to a large extent with emergency control failures. The reliability of the emergency control devices must be extremely high.
Vl. References 1 Vasilchenko, V V, Venikov, V A, Zeilidzon, E D, Portnoy, M G, Sovalov, S A, Khachaturov, A A and Khvostchinskaya, Z G 'Ensuring security of USSR power systems' C/GRE (1974) Paper 32-12 2 Bogdanov, V A, Venikov, V A. Luginsky, T I~ and Chernja, G A Power System Contro/ Mir Publishing House, Moscow (1982) 3 Iofiev, B I, Cosheev, L A, Lagusker, V M, Luginsky, Ja N, Sadovsky, Ju D and Semenov, V A 'Process control computers in power system stability control' C/GRE (1984) Paper 39-16
Electrical Power 6"Energy Systems