Reliability Criteria and Their Enforcement

by J. A. Casazza

Value of a Human Life

30 or 40 years ago those setting the regional reliability standards wanted to do the right thing. And we had a lot of discussion; I want to mention some of the things we discussed. We know, when there are power interruptions people lose their lives. We all know this. If you look at the statistics for the New York blackouts and what happened in the hospitals, the death rates went up. People with iron lungs died; people with bad hearts tried to walk up a few floors and had a heart attack. The death rates have gone up every time there has been a blackout. Some said, these people are going to die anyway but none of us want to die any sooner than we have to.

Then we started arguing over what a human life is worth. And we began to realize, throughout our entire society people are making this evaluation without recognizing it. To me, my life is worth a lot of money. Each of you probably thinks the same about yours. How much do you want to see somebody spend to save your life? This is an important question. We began to realize that in building highways, building airports, building airplanes, those responsible are making this decision somewhere along the way. For example, the civil engineers want to build a highway. They can make the lanes wider. If you make the lanes wider, you have fewer fatalities; if the curves are not as sharp, you have fewer fatalities. But these things cost more.

So in all the design inherent in all of our systems, our infrastructure, someone is making an estimate of what a human life is worth, hardly ever realizing it. Some calculations have been made in the past. I don't have them any more, but they were quite interesting. We tried to make sure what we were doing with electric power systems was reasonably consistent. So this question, what a human life is worth is a key one. Some claim that the birth rate went up after the blackouts and that natural laws resulted in replacing the lost lives. We still need to be concerned about them.

What We Can Learn From Others

I want to give you a little background from history, things that I have seen. I go back a long way. I have had dinner once with Edison's son, and we talked about his father. I went back to the office and dictated some notes about his father but when I moved from one job to another I lost them. Part of my history has involved a lot of international activities, I believe that we in the United States were not given by God any particular insight to do things right all the time. We can learn from a lot of other people and I did want to mention, just briefly an important activity that can help us to learn from others. This is CIGRE. The CIGRE committee I'm on has two principle activities.

One is taking a look in all the countries of the world--on how regulation is affecting their planning and operating. Seeing what works or what doesn't work in Egypt or Italy or France, doesn't necessarily mean that it would work the same way here. But we can learn from some of them the impact of regulation on cost, reliability, planning, and operating power systems. We can get ideas. For example, in India, the price paid for generation is increased when frequency is below normal.

The second important activity is the compiling of an international glossary of terms. There are many glossaries of terms in existence. The Institute of Electrical and Electronic Engineers has put one together. And the basic problem that we face, is that by the same English words people do not mean the same things. If you pick up almost any contract, the first part has a section of definitions. All lawyers write definitions, and they all differ. This is a world-wide problem. American firms are involved in other countries and European firms are beginning to own American properties. This problem of the words and what they mean is a very important one. An international glossary giving the definitions assigned by the various organizations will be a valuable contribution. This glossary should be available in a few months. I spend about one month a year representing the United States in some of these activities because I try to bring back to the USA what's going on in other countries. If any of you want to find out how to obtain this information, call me or contact me by FAX.

What Others Can Do to You

I want to tell you about the first major USA blackout. Con Ed used to be an isolated company. It was not interconnected with any other system outside of New York. They did not want to be in interstate commerce since they did not want to be under the jurisdiction of the Federal Power Commission. At this time, I was working for the Public Service Electric and Gas Company across the river in New Jersey. Our studies showed that by putting a tie line to Staten Island, we could both save a lot of money. They could provide emergency generating capacity to use and we could provide it to them. We could put in less generation, reduce our reserves and save money. We went to see them two or three times and said look, we want to make a study of an interconnection between us. They said: "No."

Finally, Con Ed's views changed. In about the late '50's, we sat down and made some studies and agreed that we should build a transmission line to Staten Island from New Jersey. And at this time I was in charge of planning in my company and I presented the project to the top PSEG officials. Quite a bit of money was involved, and it was a business relationship. At that time they asked me, "Are you sure that when we interconnect with these people they can't do some thing to hurt us?" I said, "We have made joint studies of the next 10 years. Everything that they plan to do and what we plan to do. We checked it all out and there is no problem."

We then committed to spending this money, putting this tie in, by signing a contract with Con Ed. And then we started studying another tie, the 500-kv tie from New Jersey to New York. In the process a meeting was held in Syracuse, to discuss the studies of the 500-kv tie. At the end of the meeting Walter Fisk, who was in charge of the planning at Con Ed, said "I want to tell you people something. You're going to read in the paper tomorrow about it." He said, "I personally didn't know about it, but our Chairman of the Board has committed to putting a 1,000 megawatt unit in New York City. He wants to do this because we've got a very negative image and we want to seem progressive. We want the largest generator in the United States and we're going to put in a 1,000 megawatt unit."

The people at this meeting were astounded, particularly the man from Niagara, Mohawk. I thought he was going to have a heart attack. He said, "Well, we've been making studies with you for a year. You didn't mention it." Walter Fisk apologized saying, "The Chairman of the Board made the decision on his own." That's an example of the real world.

Early Reliability Enforcement

What has this got to do with blackouts? I will explain further. The next step was to study the effect of the 1,000 megawatt unit. All except Con Ed were convinced that they couldn't operate this unit at 1,000 Mw. If the unit tripped out, lines as far west as Ohio would burn down. The Chief Executives of the affected companies had a meeting with the Con Ed Chief Executive. They asked Con Ed to limit the output of the unit to 600 Mw. Their initial reaction was no. We won't. The other chief executives said, then we will then open all the ties to New York City and you're on your own. We will not burn down our lines because of a decision you made without study. Finally Con Ed agreed to the limit. So this is an example of how reliability was enforced in the real world.

When I went back to my office we thought a little more and we said, how can we be sure that their word is good? They had agreed to operate the unit at a lower output than it was capable of, and also agreed to operate certain amounts of spinning reserves to cover a unit trip out. Since about 70% of the unit output came through New Jersey from Pennsylvania and the west, on a trip out this flow had to be reduced very quickly so it wouldn't burn down the lines. They had agreed to do that, but we said how can we be sure they're going to do it?

We decided to put a special relay on this line to New York so that if this unit tripped out, and they didn't do what they were supposed to do, it would trip the line and not cause a problem in our system or the other systems. What this was akin to cutting the ties to the other climbers in mountain climbing. You know, interconnections are like mountain climbing, where you tie a rope around your waist to the others. The idea is that if one of you slips, the others keep you from falling. This relay would "cut the rope." We told them at what particular point and conditions this tie should trip.

About four years later I'm driving from Newark up the New Jersey Turnpike to go to my home in northern New Jersey, and I looked over at Manhattan Island and saw everything go black. I'll never be able to forget how I felt. I said God, Jack, what have you done? What have you done to all those poor people in New York? I just felt I had done something terrible and the proof was right there in front of me.

It turned out that the relay didn't have anything to do with it, but for about two or three hours I just felt I had trapped people--personally trapped those people in subway trains and buildings. Afterwards, we recognized that the steps we had taken could have been valuable in preventing the blackout from spreading further.

This is one of the things you learn from blackouts. The reliability enforcement must come about through both institutional and technical mechanisms. We had a technical means, the relay, and an institutional means, which basically forced them to lower the output and operate under in certain ways which helped limit the blackout spread.

Reliability enforcement generally requires a combination of technical means and institutional means. You get enforcement not just by writing the rules. You get enforcement by combining rules with some technical means that enforce them. Economic penalties can be levied. That's a lot harder to do than install a relay that is set and all know when the tie is going to be cut. Period. And they know they will suffer the consequences for their actions. This was easier to do with the vertically integrated company. Now with all of these different players that we have, both the institutional and technical means become more complex.

Blackout Reports and What They Say and Don't Say

The second blackout I want to discuss is the blackout in 1967. We shut down five states and some outages lasted for a number of days. The Governor of New Jersey a day after the blackout, met with the officials from the utilities and said, "I don't care what you do or how you do it, but don't ever let this happen again." We tried to tell him that we will do everything to minimize the probability, but no one, except God, can tell you this isn't going to happen again.

We made an investigation of this blackout. I want to tell you abit about the blackout and its causes at a substation called Plymouth Meeting. It had a 220-kv bus. Some generators were connected at the bus and the bus was operated in two parts. When the load built up to a certain point, some of the transmission lines going out of one side of this station would be overloaded. The operators were supposed to transfer some of the generators over to the other side to balance the loading of the transmission system. This was supposed to happen at about 10:00 in the morning.

This particular day, the man in charge of this operation had with him a new operator he was supposed to be training. The man who was in charge was ill. He had diarrhea (it is not in the reports). He said to the trainee--"You handle it while I'm gone." Well, during this period, the load was building up, and this generator was supposed to be transferred and it wasn't. So the loading on a 220-kv circuit got heavier and heavier. And when it gets heavier, it gets hotter and it expands. It sagged down into some 4-kv circuits. The transmission circuits and some generation were lost and some load was lost. The frequency went down to about 52 cycles and everything stabilized. And this went on 10 to 12 minutes during which time the operators were trying to recover. And then all of a sudden, wham. Everything went. Most of the five states were interrupted. Apparently there had been a second disturbance.

What caused it? During this 10 minute period where the frequency was low, the voltage in a number of areas was declining. It got to the point where at a station called Brunner Island, it got so low that certain special relays on the generators operated. If the voltage gets low enough, these relays were supposed to automatically cause the generator field to go to the maximum--to give you the maximum vars to pick up the voltage.

What happened at Brunner Island when the voltage got low? The relays, instead of raising the field to a maximum, lowered it to the minimum. It was the first time that they had operated and nobody knew about the connection error. This was the second trigger.

The reason I'm telling you this is because we put together some official reports and not all of this is in the reports. The people I worked for were decent, honest people. They told me, "Jack, we want the truth. We want you to put in the report everything that happened. We've got to learn what happened, who was responsible, to determine what we have to change." And we did a complete report and it went to them. And they said well, before we make it public, we've got to let the attorneys see it.

And the attorneys of the companies looked at them and asked us to take some things out. "Because," they said, "we're going to end up being sued for negligence if some of this stays in." That's the real world. The first one was the original one which had a black binder on it. This is the one that told the complete story. The second one had a white binder. This is the one with the changes by the attorneys that was released to the public and this is the one that went to the Governor's Office and others.

Formation of NERC

Because of this blackout and the New York blackout, a number of us got together. We agreed that we've got to do something that will keep one company from doing things that will hurt another company. How do we do this? How do we control ourselves? Some people said we'll let the Federal Government do it. Most said no. The Federal Government should not do this. We should police ourselves. We don't want an outside policeman. We know what we're doing to each other. We are smart enough to do this. Let's do it ourselves. As a result, we began forming the Regional Reliability Councils. I was one of the eight people involved who met in St. Petersburg, Florida, and outlined what was needed.

Reliability Enforcement by the Reliability Council

The big question was and is "How do you enforce the rules?" This is the problem of every police department. The answer we came up with was something a lot of people laughed at when first mentioned. Moral suasion. Moral suasion, what it that? What techniques do you use? An example was provided by the MAAC reliability organization. All plans had to be submitted for review and approval that would affect other companies. If it affected only your system, it's your business.

Based on each reliability review we would write a report. If we found a particular company was planning to put in a generator or a line or were operating in a manner whereby they were going to adversely affect the reliability of other systems, we would draft a report saying this. Before the report would go out we would submit it to the companies who were creating reliability risks to review ahead of time.

And almost always they would back off and change what they were doing. Again, because of the lawyers. The lawyers said if such a report goes out, and it is in the public domain, and it states that you are not planning or operating in accordance with establish criteria and you have some kind of interruption, you're going to be sued. It's going to be prima facie evidence that you did not comply with good practice, and you're going to be guilty of negligence. So this "moral suasion" worked because the reliability council could write a report which would have an effect on their decisions. Companies did not want these reports public, and would revise their plans and procedures. This was an institutional means to protect reliability.

An example of a technical means to enforce reliability was provided on the west coast. Loop flow and parallel path flow was preventing the Southern California Edison from importing low cose power from its plants in Arizona. Southern California wrote letters, did everything in their power to try to get this siutation resolved, without success. One night Southern California opened some breakers and stopped the undesirable flow. A technical means was used to force the issue to resolve the institutional problem. As soon as the breakers were open, they got the attention of those causing the flow. It's like hitting them with a 2x4. They only kept the breakers open for one day, but it was enough to get them to sit down at the table and they resolved the problem.

Let's talk about Texas. Texas was another region that didn't want to be under Federal jurisdiction. One of the companies, Central and Southwest, had properties on both sides of the point where the ties were open. They had properties in Oklahoma and they had properties in Texas. And the SEC told them you are not operating an integrated system, you've got to connect these two systems or sell one of them. The rest of the Texas companies said you're not going to interconnect them because that will put us in interstate commerce and under the control of those regulators in Washington. Texas had always wanted to, as John Wayne said, "Take care of your own needs. You don't depend on anyone else."

They had a real probnlem. Central and Southwest said we are going to interconnect, and they closed a tie and connected Texas with the rest of the United States. Other companies opened breakers. Litigation was initiated.

Studies made by a consulting firm recommended AC ties, 345-kv ties between Texas and the rest of the United States. The rest of the Texas companies would not go along with this plan. The reason was the reliability problem. They were planning to put in the South Texas project for a total of 2,000 MW. If tripped out, 90% of what it was supplying would be coming through the rest of the United States and causing transmission problems.

The litigation was going on and we were asked to try to find a solution. The solution we found was a combination technical and institutional one. By putting in DC ties, the loss of these large units wouldn't affect all these other systems. That's what kept the other systems satisfied.

The second concern was that the DC tie would put them in interstate commerce and under FERC jurisdiction. A very prestigious Washington law firm was involved. They got into new federal legislation a sepcification that if an interconnection was ordered by the Federal Energy Regulatory Commission for you to connect with another state, this did not put you into interstate commerce. After the legislation was passed, FERC ordered the interconnection. The DC tie went in. And that's how the problem in Texas was solved. The technical means and an institutional means, legal means, solved the problem.

The French Experience with VARS

Let me talk to you for a few minutes about the blackout of France. Some of you weren't even born in 1978, were you? No, I guess you weren't. All of France was blacked out. It was December 7, 1978. I remember it because December 7 is a date you don't forget if you were alive in 1941. All of France was blacked out and there was great concern in the US Government as to why. There were some rumors that this was sabotage. At the time Electricity de France said, "you have to do maintenance on weekends"--and the French workers said, "We don't work on weekends." EDF had found that there were cases where the union workers were delaying maintenance and causing problems.

Well, anyway, the US Government wanted an investigation. I went over and did a review of what happened. The interesting thing is that the situation on the day that they had the blackout was exactly the same as the day before. And the day before they had no interruption or problem. Same load. Same units available. Basically exactly the same situation. And we began to ask why was it okay this day and not on this day?

The answer was that when the load picked up in the morning, they had failed to schedule all generators in service soon enough to provide needed reactive power. The voltage began to decline. And once the voltage started to decline, it just kept going down, down, down and they had a voltage instability problem. This is 1978. That's not different from what they had on the west coast in 1997. This is the problem of how people operate the system. People who fly airplanes and who operate electric systems are human beings and you need to recognize this. And I don't care what you put into the regulations, what you approve or don't approve, it is--you're going to have this happen once in a while. In France they made some technical changes and they made some institutional changes in the way they operate. And they put in some computer systems and other things.

The Future

In the past when you had vertically integrated companies, each controlling all sources in their systems, the heads of these two companies could talk with one another and they could work reliability problems. Now with as many different players that we have, it is going to be much more difficult to work out.

We're going into the future with security coordinators, ISOs, control areas, power exchanges, and RTGs. All of these people have overlapping jurisdictions. The big question is who is going to be in charge? It's a real question here because with this overlapping, it's not clear who is in charge. I think we're heading, right now, from a reliability viewpoint into a chaotic situation. And I know FERC, NERC and all others are concerned.

Some key questions are: How many power exchanges should you have for each ISO? How many ISOs for each power exchange? How many control areas for each? What's the right ratios of some of these things here in order to have it viable and make it workable, keep reliability and save money? This is the challenge for the future. The future is bound to be interesting!

From a talk to the FERC staff, 1998

Previous | Home | Next