LONDON — National Grid’s interim report into the blackout which hit Britain earlier this month provides a useful timeline of the faults and trips on the network, but leaves important questions about reliability unanswered.
The interim report blames the blackout on lightning strikes on the transmission system north of London, which caused a series of outages that left the grid with insufficient generation to meet demand.
The lightning strikes caused a very brief disconnection of a main transmission line and triggered a longer loss of around 500 megawatts (MW) of local distributed generation, which automatically disconnected to protect itself and the network.
But the lightning also caused the rapid disconnection of the Hornsea windfarm, cutting grid infeed by 737 MW, and the Little Barford combined cycle gas turbine plant, which cut infeed by a further 641 MW.
The cumulative loss of 1,878 MW of infeed in less than 90 seconds overwhelmed the grid, which had only around 1,000 MW of fast-acting reserves available.
Frequency response reserves delivered 1,000 MW of emergency power, as planned, but it was not enough to arrest the rapid decline in grid frequency well below its target of 49.5-50.5 Hertz (Hz).
When frequency declined to 48.8 Hz, automatic protection systems on the local distribution networks acted to reduce demand by 5% by cutting supply to around 1.1 million customers.
Customers lost power for between 15 and 50 minutes, according to the report (“Interim report into the low frequency demand disconnection following generator trips and frequency excursion”, National Grid Electricity System Operator, Aug. 16).
The report is careful to note that the grid control room was maintaining reserves in line with its obligations under the Security and Quality of Supply Standards (SQSS) set by government regulators.
The security standards require the grid to hold enough reserves to cover the loss of the largest single infeed to the network (n-1) while maintaining frequency and other power quality aspects within normal operating limits.
The security standards do not require the grid to cope with multiple simultaneous generation or transmission failures (n-2 or higher).
The report also notes that frequency reserves behaved as expected and delivered 1,000 MW of extra power very quickly in response to the emergency.
But the extra power was not sufficient to cope with the multiple simultaneous failures of embedded generation, a large windfarm and a large gas-fired CCGT.
“These events resulted in an exceptional cumulative level of power loss greater than the level required to be secured by the security standards and as such a large frequency drop outside the normal range,” the report noted.
The key question is whether the reserve of 1,000 MW is adequate or should be increased to reduce the risk of load-shedding in future.
The report treats the disconnection of the distributed generation, the windfarm and the CCGT as three separate failures.
“Two almost simultaneous unexpected power losses at Hornsea and Little Barford occurred independently of one another – but each associated with the lightning strike,” it said.
“As generation would not be expected to trip off or de-load in response to a lightning strike, this appears to be an extremely rare and unexpected event.”
It went on to observe about the loss of local embedded generation: “The lightning strike also initiated … protection on embedded generation in the area and added to the overall loss of power experienced.”
“This is a situation planned for and managed by the electricity system operator and the loss was in line with ESO forecasts for such an event.”
The grid’s study eliminates the possibility of a cascading failure in which the failure of one generator caused under-frequency and the failure of the others (the description of the failures as “independent”).
But it does state that all the generation trips were caused by the same lightning strike and disturbance to the transmission system.
If that’s correct, the three generation losses were what is known as a common cause failure on the system (“Common cause failures and ultra reliability”, NASA, 2012).
Ultra-reliable systems must be designed to guard against common cause failures and include additional redundancy and hold extra reserves to cope with them.
National Grid’s report observes that lightning strikes on the transmission system are common events, routinely dealt with as part of normal operations.
Its infrastructure is hit around 1,000 times a year, or three times per day on average. There were multiple lightning strikes on the grid on Aug. 9. (“National Grid electricity blackout reports points to failure at windfarm”, FT, Aug. 16).
Generation embedded in the local distribution system, mostly small-scale solar as well as some gas and diesel generators, is routinely disconnected in the event of a fault to maintain the safe operation of the system.
But as the scale of the embedded generation has grown, the potential sudden loss of supply is increasing, putting more pressure on reserves.
Britain’s grid controllers had 1,000 MW of power in reserve but 500 MW of that was immediately absorbed by the loss of embedded generation, leaving only 500 MW to cope with larger contingencies.
The greater concern is that one lightning strike could cause three separate failures on the system, spread over a wide geographical area.
The current security standards assume generator failures are isolated events, so holding n-1 reserves is reasonable, but that did not prove correct on Aug. 9.
The system operator and regulators need to review the current n-1 standard to ensure it remains adequate. It may need to be raised to account for the loss of embedded generation and the probability of common cause failures.
Embedded generators may also need to be reconfigured so that they remain connected to the distribution network in the case of minor changes in frequency rather than disconnecting too soon.
Conventional power generation from coal, gas and nuclear plants helps stabilize grid frequency because the massive turbines have a lot of inertia.
Windfarms, solar generators, distributed generation, and interconnectors with neighboring grids in Scandinavia and continental Europe do not provide the same inertia and frequency stabilization.
As the proportion of generation from conventional sources declines, inertia is declining and the system may be becoming more vulnerable to rapid changes in frequency, increasing the risk of frequency excursions and load shedding.
In response, it will become even more important that major network generators and local embedded generators ensure protection systems on their equipment are set correctly.
Protection systems must contribute to system stability by “riding through” minor disturbances, rather than worsening it by disconnecting prematurely.
But National Grid as the system operator may also need to purchase more frequency regulating reserves and sources of inertia to reduce the risk of rapid frequency changes, unacceptable excursions, and blackouts.
– Britain’s blackout raises questions about reliability (Reuters, Aug. 15) (Editing by Jan Harvey)