LONDON (Reuters) - Britain’s widespread power outage last Friday, which cut electricity to hundreds of thousands of homes and hit parts of the rail network, has raised uncomfortable questions about the reliability of the electricity system.
The blackout was caused by the failure of a combined cycle gas turbine generator and a large offshore windfarm within minutes of each other shortly before 1600 GMT on Aug. 9.
The consequent generation shortfall caused a rapid drop in grid frequency, taking it outside acceptable limits, and triggered automatic load-shedding by local distribution companies across England and Wales.
Grid controllers were able to restore frequency in about five minutes and power to customers within 30 minutes by calling on reserve supplies from pump-storage and open-cycle gas turbines.
But reserves were not available quickly enough or on sufficient scale to prevent automatic load-shedding systems being triggered in the meantime.
The resulting loss of power to parts of the train network during the evening rush hour caused prolonged delays, while at least one hospital was left without power when its emergency generator failed.
At one level, the transmission system operator successfully executed its planned response to the supply-demand imbalance and resulting deviation of frequency outside prescribed limits on the grid.
By cutting power to a limited number of customers for a short time, the operator avoided the possibility of a much more serious imbalance developing and forcing more widespread and longer lasting power cuts.
In the worst-case scenario, the entire grid could have become unstable and shut down. Repowering the grid after a total shutdown, known as a “black start”, could take many hours or even a day or more.
Following a collapse of the power grid in the Northeast United States and Canada in August 2003 for instance it took four days to restore power to all affected customers.
The grid operator can therefore claim, with some justification, that its procedures worked as intended to prevent a small problem becoming a major emergency.
The last similar widespread power outage as a result of simultaneous generation failures occurred in 2008, so these are not frequent events.
Nonetheless, lessons need to be learned and the power failure should prompt tough questions for regulators, the system operator, generators and the distribution companies.
The power failure occurred when the grid was under only a relatively light summer load of 29 gigawatts compared with a peak load of 45-47 gigawatts last winter.
Many generators take the opportunity of light summer loads to do routine maintenance and upgrades, so the power failure raises questions about whether there was sufficient capacity readily available.
The CCGT generator that failed was medium-sized (664 megawatts), while the windfarm that failed was slightly larger (812 megawatts), according to outage data submitted to regulators.
Neither failure on its own should have caused a grid emergency, but two failures in quick succession significantly increased the pressure on the system.
Regulators require the system operator to have a dynamically updated plan to deal with the sudden loss of the single largest generation asset connected to the grid (“most onerous loss of power infeed” or “n-1”).
Grid controllers must have enough fast-acting frequency reserves, short-term operating reserves and rapid demand management options available to deal with the sudden loss of up to n-1 generation.
After any generation loss, the system must be restored to balance as soon as reasonably practical, by which time the control room should also be ready to cope be ready to cope with the loss of n-1 again.
The largest power generator on the UK grid currently is Sizewell B nuclear generating station, with a capacity of around 1.2 gigawatts.
Neither the CCGT nor the windfarm on its own was the largest generation asset on the grid, but the failure of both in rapid succession pushed the loss of power beyond the n-1 limit.
Rapid successive failures meant there was no time to restore reserves between the first failure and the second, so the two failures were for all practical purposes a single event that breached n-1.
The question for both regulators and the system operator is whether n-1 represents an adequate reserve to maintain reliability or should be increased.
Great Britain’s power grid is synchronised at 50 Hertz and the system operator is under a regulatory obligation to keep frequency within +/- 1% of this target.
When frequency dropped below 49 Hertz on Friday, more than 2% below target, automatic equipment started to disconnect consumers to arrest the fall in frequency and protect network equipment from damage.
Individual generators also have equipment that monitors grid frequency and will automatically disconnect them from the grid in the event of major deviations from target.
But the equipment must be set carefully. Generators are meant to disconnect in the event of a major frequency excursion but “ride through” more minor deviations.
If generators instead disconnect too early, it can make the decline in frequency even worse, and create a cascading failure.
In an emergency, what matters is not just how far frequency falls, but how fast the change occurs, and whether grid controllers and generators have sufficient time to react.
Both the transmission operator and generators must be able to cope with a very high rate of change of frequency (RoCoF) in a way that is stabilising rather than destabilising.
One key question for investigators is whether the failures of the CCGT and the windfarm were genuinely independent events that by chance occurred within minutes of each other, or whether the CCGT’s failure caused a decline in frequency that then caused the windfarm to disconnect.
The grid has multiple layers of protection to deal with an imbalance between generation and demand and avoid a cascading failure.
In the first instance, controllers can call on fast-acting frequency reserves, short-term operating reserves, pump storage, open-cycle gas turbines and interconnectors with neighbouring power grids to boost power supply.
Controllers can also call on demand-response contracts with industrial customers (including operators of major refrigeration facilities) to achieve a rapid and short-term reduction in load.
If all else fails, the grid can issue demand-reduction instructions to local distribution companies, ordering them to reduce voltage and in the worst case begin forcibly disconnecting customers.
On Aug. 9, however, the grid emergency blew through all these intermediate protection layers and went straight to forcible disconnection.
The generation imbalance was too large and too fast for the grid to deploy sufficient reserves or reduce demand in a controlled way.
But forcible load-shedding is a last line of defence and should never be considered an ordinary part of demand management.
The events of Aug. 9 suggest the intermediate protection layers may not be as robust as they should be and may need to be reinforced.
In an emergency, local power distributors are supposed to prioritise supplies to critical and vulnerable customers while cutting power to others first.
On Aug. 9, however, power was cut to some critical customers, including parts of the national rail network, some highway systems and at least one hospital.
The key question is why these were not prioritised and whether they would have been protected if manual demand reduction had been employed rather than automatic disconnections.
The electricity grid is already central to the modern economy and society and will become even more critical in future with the electrification of transportation systems as part of efforts to combat climate change.
But the challenges of managing it are becoming more complex as dispatchable fossil fuel generators with lots of spinning momentum that help stabilise frequency are replaced by intermittent wind and solar generators.
Power failures such as Aug. 9 have not been frequent in the past, but lessons must be learned urgently to ensure they do not become more common and serious in future.
Regulators, the system operator and generators need to consider whether the protective layers of short-term reserves and demand management are adequate or need to be reinforced.
More reserves and more demand management would increase costs but reduce the probability of power failures, so policymakers and the industry must consider the trade off and clearly communicate their decision.
Regulators, the system operator and distribution companies also need to consider whether current systems for automatic load-shedding adequately protect critical and vulnerable customers or need updating.
John Kemp is a Reuters market analyst. The views expressed are his own.
Editing by David Holmes