Monitoring of Real-Time SOL and IROL Exceedances

Transcription

1 APPLICABILITY: Reliability Coordinator I. Purpose Provide the Reliability Coordinator System Operators (RCSO) with established procedures for monitoring System Operating Limits (SOL) and Interconnection Reliability Operating Limits (IROL) in real-time operations for both pre- and post-contingency conditions to secure the safe and reliable operation of the Western Interconnection Bulk Electric System (BES). II. Introduction All terms used herein shall have the meaning provided in the Glossary of Terms Used in NERC Reliability Standards: Term Definition Cascading The uncontrolled successive loss of system elements triggered by an incident at any location. Cascading results in widespread electric service interruption that cannot be restrained from sequentially spreading beyond an area predetermined by studies. Contingency The unexpected failure or outage of a system component, such as a generator, transmission line, circuit breaker, switch or other electrical element. Facility A set of electrical equipment that operates as a single Bulk Electric System Element (e.g., a line, a generator, a shunt compensator, transformer, etc.) Facility Rating The maximum or minimum voltage, current, frequency, or real or reactive power flow through a facility that does not violate the applicable equipment rating of any equipment comprising the facility. Interconnection Reliability Operating Limit (IROL) A System Operating Limit that, if violated, could lead to instability, uncontrolled separation, or Cascading outages that adversely impact the reliability of the Bulk Electric System. Real-time Assessment An evaluation of system conditions using Real-time data to assess existing (pre-contingency) and potential (post-contingency) operating conditions. The assessment shall reflect applicable inputs including, but not limited to: load, generation output levels, known Protection System and Special Protection System status or degradation, Transmission outages, generator outages, Interchange, Facility Ratings, and identified phase angle and equipment limitations. (Realtime Assessment may be provided through internal systems or through third-party services.) Classification: Public Page 1 of 17 Effective Date: June 30, 2018

2 System Operating Limit (SOL) The value (such as MW, Mvar, amperes, frequency or volts) that satisfies the most limiting of the prescribed operating criteria for a specified system configuration to ensure operation within acceptable reliability criteria. System Operating Limits are based upon certain operating criteria. These include, but are not limited to: Facility Ratings (Applicable pre- and post-contingency Equipment Ratings or Facility Ratings) transient stability ratings (applicable pre- and post- Contingency stability limits) voltage stability ratings (applicable pre- and post- Contingency voltage stability) system voltage limits (applicable pre- and post-contingency voltage limits) Note: In addition, for the purpose of this document, the following terms which are not included in the Glossary of Terms Used in NERC Reliability Standards shall be defined as follows: T M (mitigation time) T M is the target mitigation time for returning the system to within a System Operating Limit. The Reliability Coordinator (RC) monitors Facilities in the RC Area 100 kv and above, select lower-voltage network facilities, status of Remedial Action Schemes, and pertinent Facilities of adjacent RC areas to identify any SOL exceedances and to determine any IROL exceedances within its RC Area. 1 The RC has requested MW/MVAR measurements for all equipment 100 kv and above, as well as lower voltage facility measurements that impact the BES or that could impact the RC state estimator solution quality. The RCSO is able to monitor the reliability and security of the RC Area BES through monitoring of stability limits and IROLs and through observance of branch and voltage limit exceedances identified by SCADA 2 alarms and the RC state estimator. III. SOLs Used in Real-Time Operations SOLs are established in the RC Area by Transmission Operators (TOP) consistent with the RC s System Operating Limit Methodology for the Operations Horizon. 3 Per this methodology, SOLs include Facility Ratings, system voltage limits, and stability limitations. For more information on SOL (and IROL) establishment, refer to Peak s SOL Methodology for the Operations Horizon. 1 NERC Standard IRO Requirement R5 2 Supervisory Control and Data Acquisition 3 NERC Standard FAC Requirement R2 Classification: Public Page 2 of 17 Effective Date: June 30, 2018

3 The SOL Methodology considers SOL exceedance to be a condition characterized by any of the following: 1. Actual/pre-Contingency flow on a Facility is above the Normal Rating 2. Calculated post-contingency flow on a Facility is above the highest Emergency Rating 3. Actual/pre-Contingency bus voltage is outside normal system voltage limits 4. Calculated post-contingency bus voltage is outside emergency system voltage limits 5. Operating parameters indicate a Contingency could result in instability RCSOs are required to: monitor elements of the BES in the RC Area that could result in an SOL or IROL exceedance including generators, transmission lines, buses, transformers, and breakers; know the status of all critical facilities whose failure, degradation, or disconnection could result in an SOL or IROL exceedance; monitor applicable transmission line status, real and reactive power flows, voltage, loadtap-changer settings, and the status of rotating and static reactive resources; and monitor current pre- and post-contingency element conditions (voltage, thermal, or stability), including any applicable mitigation plans to alleviate SOL or IROL exceedances. 4 IV. Acceptable System Performance The SOL Methodology for the Operations Horizon document describes acceptable system performance for the pre-contingency state and the post-contingency state (for single Contingencies): Pre-Contingency: Acceptable system performance for the pre-contingency state in the Operations Horizon is characterized by the following: 5 a. The BES shall demonstrate transient, dynamic and voltage stability. b. All Facilities shall be within their normal Facility Ratings and thermal limits. c. All Facilities shall be within their normal system voltage limits. d. All Facilities shall be within their stability limits. 4 NERC Standard IRO Requirement R5 5 NERC Standard FAC Requirement R2.1 Classification: Public Page 3 of 17 Effective Date: June 30, 2018

4 Post-Contingency: Acceptable system performance for the post-contingency state for Single Contingencies in the Operations Horizon is characterized by the following: 6 a. The BES shall demonstrate transient, dynamic and voltage stability. b. All Facilities shall be within their Emergency Ratings and thermal limits. c. All Facilities shall be within their emergency system voltage limits. d. All Facilities shall be within their stability limits. e. Cascading or uncontrolled separation shall not occur. V. Pre- and Post-Contingency Monitoring The RC ensures acceptable system performance in the pre-contingency state by monitoring real-time SCADA and/or state estimated values, and ensuring that flows and voltages remain within Facility Ratings and voltage limits. The RC ensures acceptable system performance in the post-contingency state in two ways: 1. Monitoring the Real-Time Contingency Analysis (RTCA) results to evaluate expected post-contingency conditions in the event of single Contingencies; and 2. Monitoring identified stability limits to ensure acceptable system performance upon occurrence of the Contingency(ies) associated with the stability limit. RCSOs must be aware of unacceptable system performance in real-time operations and must understand the conditions that exist when a SOL exceedance occurs in both real-time and in RTCA. VI. General Monitoring Considerations RCSOs have the authority to act or instruct action any time they believe that action is necessary to preserve the integrity and reliability of the RC Area BES. Refer to OP-330 Communication Protocol Procedure and SOP-230 Operating Communications for additional detail regarding issuance of Operating Instructions. The RCSO shall notify impacted TOPs and BAs within its RC Area, and other impacted RCs when results of Real-time Assessments indicate an actual or expected condition that results in, or could result in a sustained SOL or IROL exceedance within its RC Area. 7 These same impacted TOPs, BAs, and RCs shall be notified when the SOL or IROL exceedance has been prevented or mitigated. 8 6 NERC Standard FAC Requirement R2.2 7 NERC Standard IRO Requirement R5 8 NERC Standard IRO Requirement R6 Classification: Public Page 4 of 17 Effective Date: June 30, 2018

5 For purposes of this procedure, sustained SOL exceedances mean exceedances that are not momentary based on RCSO judgement and discretion. For these actual or expected SOL exceedances, or any exceedance where the RCSO requires BA/TOP action to mitigate, all impacted RC Area BAs and TOPs as well as impacted neighboring RCs will be notified of the exceedance and the mitigation. Notification is also required when the exceedance has been prevented or mitigated. Although RCSOs will determine the appropriate notification method, a RMT message to All Reliability is preferred. For any sustained exceedance, the RCSO should identify appropriate mitigation and issue Operating Instructions as needed to ensure the integrity and reliability of the RC Area BES. Reference the Load Shed Philosophy guideline to help determine when it is appropriate to issue an Operating Instruction to shed load. The following sections describe how the RCSO shall respond to sustained SOL exceedances. A. SCADA/RTNET Indicates Actual Exceedance of a Facility Rating or Voltage Limit Actual exceedance of a Facility Rating or a voltage limit constitutes SOL exceedance. Upon receiving indication of an actual exceedance of a Facility Rating or voltage limit, the RCSO shall perform the following actions: 1. If the SOL exceedance is identified by SCADA, proceed to Step 2. If the SOL exceedance is detected by the state estimator only, check the state estimator solution quality in the area of the exceedance to validate the existence of the SOL exceedance. If the state estimator solution quality is deemed acceptable, proceed to Step Contact the responsible TOP to discuss the apparent SOL exceedance. This discussion should include, but is not limited to, the following: a. Verify that the condition is real (SCADA indications, loading levels, voltage levels, etc.); b. Validate the SOL values and the associated time duration for each available rating (voltage limit or Facility Rating). i. Update the SOL in the SCADA application as necessary. 3. If it is confirmed that a Facility is actually exceeding its Facility Rating or voltage limit, proceed to Step Determine the targeted mitigation time (T M) based on the associated time duration limits available. a. T M for Facility Rating exceedances will be based on the defined length of time that the Facility can be operated beyond the rating being exceeded. For example, if the Facility is exceeding a continuous Facility Rating but the Facility has a higher two- Classification: Public Page 5 of 17 Effective Date: June 30, 2018

6 hour Facility Rating that is not being exceeded, the TOP is expected to return within the continuous Facility Rating within two hours. In this example, the T M = 2 hours. 5. Determine the mitigating actions being taken by the TOP and/or BA to alleviate the SOL exceedance and establish an expected timeframe for completion of mitigating actions. BAs may need to be contacted if generation redispatch is required to mitigate the SOL exceedance. 6. Notify impacted RC Area TOPs and BAs as well as impacted neighboring RCs about the exceedance and mitigation undertaken. A RMT message to All Reliability is the preferred method for this notification. Initiate a conference call as appropriate. 7. Closely monitor the affected Facilities to evaluate the effectiveness of mitigating actions. 8. Examine the RTCA results to determine how the system is positioned to handle the next worst Contingency. RTCA may indicate a need to mitigate more aggressively than the T M would otherwise suggest. 9. Use the Study Network Analysis tool (STNET) to perform studies as needed to further evaluate the expected impact of losing the affected Facility. The RCSO should use this study to help determine the urgency of returning the system to within limits and can help refine the T M. 10. Evaluate the actions being taken to address the SOL exceedance. If the actions taken are not appropriate or sufficient to return the system to within limits in light of the actual or potential impact to the reliability of the RC Area, issue Operating Instructions as deemed appropriate to return the system to within limits as necessary. 11. Notify impacted TOPs, BAs, and RCs when the exceedance has been mitigated. A RMT message to All Reliability is the preferred method for this notification. B. SCADA/RTNET Indicates Actual Exceedance of an identified stability limit Stability limits have the Contingency(ies) built-in to the limit itself (i.e., if the stability limit is exceeded, the associated Contingency(ies) would be expected to result in system instability). If the stability limit is not exceeded, the system would be expected to remain stable upon occurrence of the associated Contingency(ies). Upon receiving indication of exceedance of a stability limit, the RCSO shall perform the following actions: 1. Contact the responsible TOP to discuss the stability limit exceedance. This discussion should include, but is not limited to, the following: a. Verify the stability limit is correct. Any reported increase to stability limits must be fully coordinated among impacted BA/TOPs and the RC. Classification: Public Page 6 of 17 Effective Date: June 30, 2018

7 b. If a stability limit increase is properly coordinated and accepted by the RCSO, update the Energy Management System (EMS) as needed to the newly revised stability limit value and create an RC Log entry to capture all pertinent information. c. If an increase of the stability limit is not an option, or if the stability limit is still being exceeded after the increase, then proceed to Step Review any pre-determined or previously reported mitigation or Operating Plans that are already in place to determine viability, scope, and the expected time duration required to complete mitigation. a. If pre-determined mitigation plans have not been developed and reported or if previously reported plans are no longer viable, require the TOP to develop, communicate, and implement a mitigation plan that will return the system to within limits. b. Work with the TOP or in parallel with the TOP to develop the mitigation plan as necessary. Mitigating options to be considered include: i. Redispatch generation ii. Reconfigure transmission iii. Curtail transmission schedules iv. Shed load (TOPs may choose to do so at their own discretion, but Operating Instructions for load shedding are to be consistent with the Load Shed Philosophy guideline) 3. Notify impacted TOPs and BAs in the RC Area as well as any impacted neighboring RCs about the exceedance, mitigation undertaken and expected duration. A RMT message to All Reliability is the preferred notification method. Initiate a conference call as appropriate. 4. Evaluate the actions being taken to address the stability limit exceedance, if the actions taken are not appropriate or sufficient, issue Operating Instructions as deemed appropriate to return the system to within limits as necessary. 5. Notify impacted RC Area TOPs and BAs and any impacted RCs when the stability limit exceedance has been mitigated. Classification: Public Page 7 of 17 Effective Date: June 30, 2018

8 C. RTCA Indicates Post-Contingency Exceedance of a Facility Rating or System Voltage Limit in Response to a Single Contingency RTCA indication of any of the following post-contingency conditions constitutes SOL exceedance for single Contingencies: Post-Contingency exceedance of the highest available Facility Rating; or Post-Contingency exceedance of the lowest available emergency low voltage limit or the highest available emergency high system voltage limit Upon receiving RTCA indication that a single Contingency may result in the exceedance of the highest available Facility Rating, the lowest available emergency low system voltage limit, or the highest available emergency high system voltage limit, the RCSO shall perform the following actions: 1. Check the state estimator solution quality in the area of the exceedance to validate that RTCA started with an accurate representation of the area. 2. Ensure that the SOL exceedance does not qualify as an N-1 insecure state. Reference Section VII Identifying and Addressing N-1 or Credible N-2 Insecure Operating States. 3. Contact the responsible TOPs to discuss the nature and causes of the RTCA results. This discussion should include, but is not limited to, the following: a. Ensure that the Facility Ratings or system voltage limits in the EMS are correct. b. Check to see if the TOP is observing the same condition in its real-time tools. c. Review any pre-determined or previously reported mitigation or Operating Plans that are in place to determine viability, scope, and the expected time duration required to complete mitigation. d. Coordinate the possible revision of the Facility Rating or voltage limit. It is acceptable for the TOP to provide a less restrictive, shorter term limit. These limits can be provided at the discretion of the TOP and may include drastic action limits that sacrifice equipment life to acceptable levels. These limits must be accompanied by a time duration. 4. If Facility Rating or voltage limit revision is not an option, or if the revision does not address the post-contingency exceedance as indicated by RTCA (for single Contingencies), then a post-contingency mitigation plan is not acceptable and the TOP shall be required to take pre-contingency actions to mitigate the exceedance. If this is the case, take the following actions: a. Inform the BA/TOP of the following: i. RTCA is indicating that an SOL is being exceeded on the monitored Facility; and Classification: Public Page 8 of 17 Effective Date: June 30, 2018

9 ii. the SOL will remain in an exceeded state until RTCA no longer indicates the unacceptable system performance condition (SOL exceedance). b. Require the TOP and/or BA to develop, communicate, and implement a pre- Contingency mitigation action plan to alleviate the unacceptable system performance condition (the SOL exceedance). BAs may need to be involved if generation redispatch is required to mitigate the SOL exceedance. 5. Work with TOPs and BAs to develop the mitigation action plan as necessary. Initiate a conference call with all TOPs/BAs required to take action in the mitigation action plan, as appropriate. Mitigating options to be considered include: a. Redispatch generation b. Reconfigure transmission c. Curtail transmission schedules d. Shed load (TOPs may choose to do so at their own discretion, but Operating Instructions for load shedding are to be consistent with the Load Shed Philosophy guideline) 6. Notify impacted RC Area TOPs and BAs as well as impacted neighboring RCs and disseminate information on the SOL exceedance and mitigation undertaken. A RMT message to All Reliability is the preferred method for this notification. Initiate a conference call as appropriate. 7. Evaluate the actions being taken to address the SOL exceedance and, if the actions taken are not appropriate or sufficient, issue Operating Instructions as deemed appropriate to return the system to acceptable system performance. 8. Notify impacted TOPs, BAs and RCs when the SOL exceedance has been mitigated. A RMT message to All Reliability is the preferred method. Note regarding high system voltage limit monitoring for the calculated post- Contingency state (i.e., through RTCA): Operating within emergency high system voltage limits for the calculated post-contingency state has historically proven to be a challenge in the Western Interconnection. Very often, TOP-provided emergency high system voltage limits are too low to be realistically operated within in the calculated post-contingency state (i.e., through RTCA), particularly during light load conditions. The overabundance of the post-contingency exceedance of emergency high system voltage limits in RTCA can distract RCSOs from having awareness of more critical and actionable operational risks. In such light load conditions, often there are no mitigation actions that the TOP can take to reduce the post-contingency voltages. For this reason, RCSOs are expected to use discretion and to contact TOPs for only those post- Classification: Public Page 9 of 17 Effective Date: June 30, 2018

10 Contingency exceedances of high system voltage limits that are particularly severe and actionable based on RCSO operational experience and judgment. Mitigation Plan Viability and Acceptability A pre- or post-contingency mitigation plan is viable when: The TOP understands exactly what the limiting conditions/elements are. The TOP knows specifically what the mitigation plan is, knows that the plan will actually resolve the reliability issue, and has communicated the specifics of that plan to impacted TOPs and to the RCSO. The TOP provides the RCSO adequate information on the time needed to complete mitigating actions that indicates that the plan can be implemented in sufficient time (within the T M). The mitigation plan does not adversely impact neighboring TOP and BA Areas unless the neighboring TOP and BA agree to the mitigation plan. The RCSO has evaluated the mitigation plan and determined that the plan resolves the reliability issue in a timely manner. A post-contingency mitigation plan is not acceptable when: The TOP does not have sufficient time to execute the mitigation plan; or The single Contingency causes exceedances beyond the highest available Facility Rating, or lowest/highest available system voltage limits. The exception to this rule is if the post-contingency exceedance is sufficiently mitigated automatically via Remedial Action Scheme (RAS). EXAMPLE: RTCA indicates that Contingency X causes Facility Y to exceed its one-hour emergency Facility Rating by 110 percent. The TOP has developed a post-contingency mitigation plan to split the bus at station A and shed 50 MW of local load at stations B and C if the Contingency occurs. The TOP indicates that the plan can be executed within 20 minutes. This plan is not acceptable because the highest available emergency limit will be exceeded for 20 minutes if the Contingency occurs. For this plan to be acceptable, the TOP will need to provide a less restrictive Facility Rating (i.e., a higher value Facility Rating with a time duration >20-minutes in this example) that can be used that will allow its operators sufficient time to implement the mitigation plan. If this higher, shorter term Facility Rating cannot be provided, the TOP is expected to take pre-contingency actions to mitigate the SOL exceedance. Classification: Public Page 10 of 17 Effective Date: June 30, 2018

11 D. RTCA Indicates that a Credible Multiple Contingency is unsolved or results in flow greater than the lower of its relay trip setting or 125% of its highest Facility Rating Acceptable system performance for Credible multiple Contingencies (MCs) is different than that of single Contingencies. Per the SOL Methodology for the Operations Horizon, MCs shall not result in system-wide instability, Cascading, or uncontrolled separation. It is acceptable for MCs to result in exceedance of emergency Facility Ratings and emergency voltage limits provided that these SOL exceedances do not result in system-wide instability, Cascading, or uncontrolled separation. If a MC appears in RTCA at the lower of its relay trip setting or 125% or more of its highest available facility rating, the Cascading test shall be ran to evaluate the impact of that MC. If the results of the Cascading test conclude that the impact of the MC is system-wide instability, Cascading, or uncontrolled separation, pre- Contingency mitigation is required. Additionally, if the MC shows up in RTCA as an unsolved Contingency and is confirmed through validation in STNET, pre-contingency mitigation is required. For the evaluation process, refer to Section VII below. VII. Identifying and Addressing N-1 or Credible N-2 Insecure Operating States It is acknowledged that unanticipated Real-time events can render the BES in a state where Real-time Assessments indicate that the system is not secure for the next single P1 Contingency or credible multiple Contingency. Such N-1 or N-2 insecure conditions are addressed outside of the auspices of an IROL; however, these conditions are treated with the same level of urgency as IROLs. When such unanticipated conditions unexpectedly occur in Real-time operations, RCSOs are expected to bring the system to an N-1 or credible N-2 secure state within 30 minutes. The process described in this section is consistent with the SOL Methodology for the Operations Horizon for determining whether the system is in an N-1 or credible N-2 insecure state. An N-1 or credible N-2 insecure condition as used in the context of this procedure is an operating state, as indicated by the RCSO s Real-time Assessments and tools, where: The next single Contingency or credible multiple Contingency can result in instability, Cascading or uncontrolled separation, or It is unclear whether the system can sustain the next worst single Contingency or credible multiple Contingency. While TOPs are expected to take action (redispatch generation, reconfigure transmission, curtail transmission schedules) to resolve any SOL exceedance, the presence of an N-1 or credible N-2 insecure condition substantially increases the potential risk to the security of the BES and thus the urgency of immediate resolution. An Operating Instruction for load shed should be considered as an option to mitigate a potential N-1 or credible N-2 insecure condition if other mitigation strategies cannot resolve the condition within a 30 minute timeframe. Classification: Public Page 11 of 17 Effective Date: June 30, 2018

12 The study process outlined in this procedure is intended to be used by the RCSO in realtime. A. Overview of the Process 1. Flag N-1 or credible N-2 insecure conditions by examining RTCA results. In parallel with any evaluation, determine if procedures are already in place to address the condition. 2. Perform internal validation of RTCA results and test excessive branch exceedances for potential Cascading. 3. Contact the TOP for validation of limits and study results. 4. Require the TOP to take immediate corrective action to resolve the N-1 or credible N-2 insecure condition within 30 minutes of the validation process. B. Check for Existing Plans, Processes, or Procedures In parallel with the evaluation process, determine whether the operating condition was anticipated and has already been prepared for via TOP or RC documented operating guides, memos, plans, processes, or procedures. For example, it may be anticipated that a planned outage will render a contained local load area vulnerable to voltage collapse upon the next Contingency. This condition will be expected to cause RTCA to have one or more unsolved Contingencies during the outage. For these instances, TOPs are expected to develop prior plans, processes, or procedures to contain the adverse impacts of the outage and communicate those plans to the RC. If this is the case, RCSOs should reference existing procedures for the appropriate course of action. C. Part 1 Evaluation and Validation 1. Flag potential N-1 or credible N-2 conditions by examining RTCA results for indications of either of the following: a. Excessive branch exceedance: RTCA indicates that a single Contingency results in a branch exceedance (type BR) in excess of the lower of the Facility s relay trip setting or 125 percent of the highest available Facility Rating of the monitored Facility. b. Unsolved Contingency: An unsolved Contingency is present in RTCA. 2. For RTCA results that meet the above criteria, perform internal validations for the results: a. Check the Contingency definition and the state estimator solution quality in the area for these exceedances. b. Further validate the RTCA results by copying the latest good state estimator solution to STNET and manually simulate the Contingency. Classification: Public Page 12 of 17 Effective Date: June 30, 2018

13 c. Examine existing RC Workbook notes to view any documentation regarding the Contingency or the monitored element. Determine whether that RC Workbook note is still valid for the time being studied. 3. Once the correctness of the Contingency definition and the state estimator solution have been determined and RC Workbook notes have been checked to determine if there are modeling issues or known operating conditions associated with the unsolved Contingency, proceed to the next step. 4. For unsolved Contingency conditions: a. Use analysis techniques to determine if the unsolved Contingency might represent a potential voltage collapse scenario. b. Work with the Real-time Operations Engineer (ROE) and the TOP to further validate the condition and assess the extent of the potential voltage collapse area and the amount of load at risk. c. If the extent of the voltage collapse cannot be determined and contained, then the condition qualifies as an N-1 or credible N-2 insecure condition. 5. For excessive branch exceedances, determine whether the next single Contingency could result in potential Cascading. Work with the ROE and the TOP to assess the extent of the potential Cascading and the amount of load at risk. The next steps describe the process. 6. Evaluate the results for potential Cascading: Potential Cascading occurs when studies indicate that a single Contingency results in severe loading on a Facility, triggering a chain reaction of Facility disconnection by relay action, equipment failure, or forced immediate manual disconnection of the Facility (for example, due to line sag or public safety concerns). Evaluate the Contingency assuming that if the Contingency occurs, the monitored element experiencing the excessive flow will be disconnected. This assumes that associated trip settings are not known. If actual trip settings less than 125% of the highest available Facility Rating are known, they should be used as part of this evaluation. Classification: Public Page 13 of 17 Effective Date: June 30, 2018

14 Potential Cascading Analysis Process a. Copy the latest good state estimator solution to STNET and manually take the contingent element and the monitored element out of service. Ensure appropriate RAS are enabled. b. Run powerflow and flag instances of Facility loading in excess of the lower of: i. The Facility s trip setting (if known), or ii. 125 percent of the highest available Facility Rating. c. Open the most heavily loaded Facility(ies) that meet the above criteria and rerun powerflow. d. Repeat step (b) and (c), and continue with this process until tripping stops within a defined area or the solution diverges. e. A diverged solution may indicate presence of a potential voltage collapse scenario or an unknown operating state, and thus is indicative of a potential N-1 or credible N-2 insecure condition. 7. Contact the responsible TOP to validate information identified regarding the potential N- 1 or credible N-2 insecure condition: a. Ensure that the Facility Ratings and voltage limits the RCSO is using are correct. b. Find out whether the TOP uses real-time tools such as state estimator and RTCA, and ask if the TOP is seeing the same issues. c. Discuss RTCA indications and the initial results of the potential N-1 or credible N-2 insecure condition tests performed. d. Determine if RAS actions or automatic load shedding schemes are associated with the branch exceedances or the Contingency and if they are expected to operate upon occurrence of the Contingency. Review powerflow results to determine if the RAS was simulated during the RCSO study process. e. Determine if there are relay trip settings that cause tripping below 125 percent of the highest available Facility Rating. If relay trip settings cannot be provided, assume that tripping will occur at 125 percent of the highest available Facility Rating. f. Work with the TOP to assess the extent of adverse impact and the amount of load that may be at risk of being lost as a result of the next worst single Contingency or credible multiple Contingency. 8. If discussions with the TOP indicate that the condition is valid (i.e., the system is in an N- 1 or credible N-2 insecure state) proceed to the next section. Classification: Public Page 14 of 17 Effective Date: June 30, 2018

15 D. Part 2 Require the TOP to Take Immediate Action At this stage the RCSO has confirmed the presence of an N-1 or credible N-2 insecure condition. The RCSO s objective at this point is to mitigate the N-1 or credible N-2 insecure condition without delay (within 30 minutes from the time the N-1 or credible N-2 insecure condition was confirmed). 1. Review and summarize the current operating condition with the TOP. Ensure the TOP understands the consequences of an actual occurrence of the next worst single Contingency or credible multiple Contingency as indicated by the RCSO s Real-time Assessments. 2. Inform the TOP that the current condition represents an N-1 or credible N-2 insecure condition and that the TOP is required to take immediate action to resolve the condition within 30 minutes from the time which the condition was confirmed. This action may include load shedding. 3. Notify impacted RC Area TOPs and BAs as well as impacted neighboring RCs and disseminate information on the N-1 or credible N-2 insecure condition and mitigation undertaken. A RMT message to All Reliability is the preferred method for this notification. Initiate a conference call as appropriate. 4. Communicate with the TOP to determine what immediate actions can be taken to mitigate the condition. Realities of system design might render it impossible to mitigate the condition without shedding load pre-contingency. 5. It is appropriate to issue an Operating Instruction (as specific as possible) to take immediate pre-contingency actions up to and including shedding load to mitigate the N- 1 or credible N-2 insecure potential IROL condition. 6. Once these immediate actions are determined and Operating Instructions are issued to the TOP, monitor the TOP actions and the real-time tools to verify that the actions result in successful mitigation of the N-1 or credible N-2 insecure condition. 7. Understand the actions that the TOP is taking. 8. Confirm that the TOP s actions were actually taken. 9. Once the N-1 or credible N-2 insecure condition has been mitigated, inform the TOP that it needs to sustain those mitigation measures for as long as is required to ensure that the system remains out of the N-1 or credible N-2 insecure condition. 10. Notify all impacted TOPs, BAs and impacted neighboring RCs when the N-1 or credible N-2 insecure condition has been mitigated. A RMT message to All Reliability is the preferred method for this notification. Classification: Public Page 15 of 17 Effective Date: June 30, 2018

16 RCSOs have the authority to act or instruct action any time they believe that action is necessary to preserve the integrity and reliability of the RC Area BES. Refer to OP-330 Communication Protocol Procedure and SOP-230 Operating Communications for additional detail regarding issuance of Operating Instructions. VIII. Identified IROLs: RCSO Actions IROLs are identified one or more days prior to the current day. The RC has Operating Procedures for each identified IROL in the RC Area. These s identify actions the RCSO shall take, or actions the RCSO shall instruct others to take (up to and including load shedding), that can be implemented in time to prevent exceeding those IROLs. 9 These s also identify actions the RCSO shall take, or actions the RCSO shall instruct others to take (up to and including load shedding), to mitigate the magnitude and duration of exceeding that IROL such that the IROL is relieved within the IROL s T v. 10 When an assessment of actual or expected system conditions predicts that an identified IROL in the RC Area will be exceeded, the RCSO shall implement existing IROL procedures to prevent exceeding that IROL. 11 Reference existing IROL s for specific actions to prevent exceeding identified IROLs. When actual system conditions show that there is an instance of exceeding an identified IROL in the RC Area, the RCSO shall, without delay, act or issue Operating Instructions to act to mitigate the magnitude and duration of the instance of exceeding that IROL within the IROL s Tv. 12 Reference existing IROL s for specific actions to mitigate identified IROL exceedance within the IROL s T v. The default T v for IROLs within the RC Area is 30 minutes unless conditions warrant a shorter T v. The RCSO shall evaluate the actions being taken to address the IROL exceedance and, if the actions taken are not appropriate or sufficient, issue Operating Instructions to return the system to within limits as necessary. RCSOs have the authority to act or instruct action any time they believe that action is necessary to preserve the integrity and reliability of the RC Area BES. Refer to OP-330 Communication Protocol Procedure and SOP-230 Operating Communications for additional detail regarding issuance of Operating Instructions. 9 NERC Standard IRO Requirements R1 and R NERC Standard IRO Requirement R NERC Standard IRO Requirement R2 12 NERC Standard IRO Requirement 3 Classification: Public Page 16 of 17 Effective Date: June 30, 2018

17 Approved: Managing Director of Operations Version History Rev. Date Action By Change Tracking /19/2013 Revised and Reissued M Granath Updated to Peak Reliability template and modified associated language /27/2014 Revised and Reissued Vic Howell Updated to reflect the revised SOL Methodology for the Operations Horizon effective 3/3/ /09/2016 Revised and Reissued M Granath Reliability Directive updated to Operating Instruction throughout document, WECCNet updated to RMT /23/2017 Revised and Reissued Vic Howell M Granath /14/2018 Revised and Reissued Vic Howell J Hoyt Major revision to address new SOL Methodology Replaced SOL violation with SOL exceedance throughout. Updated Section VI regarding actions to take for sustained SOL exceedances. Clarified Section VI A- D that for notifying impacted BAs/TOPs, RMT is the preferred method. Modified Section VI C to include a note regarding high system voltage limits. Other errata changes. Classification: Public Page 17 of 17 Effective Date: June 30, 2018