National Academies Press: OpenBook

Terrorism and the Electric Power Delivery System (2012)

Chapter: Appendix G: Controlling Power Systems

« Previous: Appendix F: Substation Configurations
Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.


Controlling Power Systems


Terrorist attacks and other disturbances can evolve into instability in a few seconds or tens of seconds—too fast for control room operator actions. Operators may act within a few minutes during relatively familiar events with alarms, but in new situations, 15 to 30 minutes may be required to make assessments and act, especially if load shedding is required. Thus, various types of automatic controls are required. Improving the control of voltage and reactive power may also require relatively low-cost high-voltage equipment additions such as shunt capacitor banks.

Automatic controls constitute one or more layers of the defense in depth or multiple layers of defense principle for preventing or mitigating blackouts. In comparison to the addition of new transmission lines, control improvements can be rapidly implemented.

This appendix provides details on automatic controls for electric power systems, including new technology and best practices. Such best practices help power systems to survive major disturbance events, both at power plants and in the transmission network. Besides the more conventional controls, emergency controls often termed “special protection systems” are applied to mitigate extreme disturbance events. Information technologies hold promise to advance control capabilities in the near future.

In short, power system robustness, resilience, and survivability in the face of major disturbances, including terrorist attacks, can be increased significantly, economically, and rapidly by the use/addition of automatic controls. However, there are several necessary requirements, namely, (1) implementation of industry best practices, (2) prioritized upgrading of old analog controls (and actuators such as generator field circuit exciters), and (3) development and implementation of wide-area controls. North American Electric Reliability Council (Electric Reliability Organization) reliability standards for automatic controls, including performance monitoring, should evolve to better reflect best practices. Kundur et al. (2007) describes best practices in detail, listing over 50 best practices.

Automatic Controls

Additional information is provided below on the following means of automatic controls that are listed but not described in Chapter 6.

Techniques for Shedding Load and Generation to Enhance Power System Dynamic Response Capabilities

Power system dynamic response following disturbances can, to some degree, be separated between real (active) power phenomena and reactive power/voltage phenomena. Real power (measured in MW) is always held in balance when the system is operating normally. A disturbance upsets this balance and initiates dynamic response from the rotating synchronous generators in the system. An important aspect of the real power balance deals with the availability of spinning reserve (unloaded generation synchronized and ready to serve additional demand) and the activation of such reserves following islanding. This would also include measures such as load and generator shedding. Activation of reserves at power plants by prime mover/energy supply system control is limited. The tendency to carry reserves on fewer units, with many units base-loaded, reduces performance. The response of units is difficult to predict because power plant operators can select from several control modes such as traditional governor control of speed and system frequency, MW control override of speed control, or coordinated boiler/turbine control with limited speed/frequency control. System frequency regulation by secondary control (automatic generation control) or operator actions often takes tens of minutes for large upsets. Operator-directed or automatic demand-side actions are potential aids during emergencies.

With automatic underfrequency load shedding and with proper coordination between power plant control and

Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.

protection as described below, power system survivability following real-power imbalances is quite probable. System frequency excursions are typically limited to 1 to 2 percent of 60 Hz. One continuing concern, however, is unnecessary tripping of generation during frequency excursions because of boiler upsets and other problems. Prioritized control and protection improvements and modernization would reduce tripping and improve system survivability following events with load-generation imbalance.

There are, however, relatively simple and low-cost practices that greatly improve reliability. However, these practices are not always followed—the August 14, 2003, cascading failure providing a prime example (Nedwick et al., 1995; U.S.-Canada Power System Outage Task Force, 2004). Best practices for voltage reactive power require modern excitation equipment at generators. Replacement of very old equipment with modern thyristor exciters and digital voltage regulators will improve generator reliability. Generator voltage regulator controls including limiter circuits should be coordinated with protective relaying. A lack of coordination has contributed to the severity of blackouts. Automatic voltage regulator line drop compensation or automatic transmission-side voltage control should be considered for better regulation of the transmission network voltage profile.

Techniques for Maintaining Proper Transmission Network Voltage Profiles

Voltage should be near the maximum of the allowed voltage range and should be fairly uniform at all locations. This high, flat voltage profile reduces losses that cause heating and sagging into trees. Extensive use of relatively low cost shunt capacitor banks in both transmission and distribution systems allow a high and flat voltage profile, with substantial reactive power reserves at generators for emergencies. Voltage and reactive power are more complicated with separate ownership of generation and transmission systems. Rigorous standards with performance monitoring are required. Overly complex payments for reactive power or reactive power markets should be avoided. The section titled “Examples of Voltage/Reactive Power Practice” below in this appendix describes how poor voltage/reactive power practice played a critical role in the August 14, 2003, blackout (U.S.-Canada Power System Outage Task Force, 2004).

Primary Automatic Controls to Prevent Cascading Instability

Primary automatic controls, which are located mainly at power plants, include automatic voltage regulators and prime mover controls such as speed governors. Automatic voltage regulators include functions such as power system stabilizers, excitation limiters, and possibly connection of line-drop compensation. Prime mover controls include speed and power regulation. Modern controls are digital, allowing a wide variety of sophisticated features, such as deadbands and control mode shifting.

Transmission-level Power Electronic Devices and Mechanical Devices

Transmission-level power electronic devices such as static volt-ampere reactive (var) compensators are employed to provide continuous voltage control, similar to a generator voltage regulator, and/or other functions. Mechanically controlled shunt capacitor/reactor banks are switched by local voltage relays, by SCADA operators, and sometimes by emergency controls. With digital technology, there is room for more sophisticated control similar to that possible with power electronic devices.

Local Load-shedding Practices and Techniques

Local underfrequency load shedding is commonly employed at bulk power delivery substations. Underfrequency load shedding generally requires islanding of a portion of the interconnection with large generation-load imbalance. In a growing number of power companies, local undervoltage load shedding is also employed (Taylor, 2007). Also, to avoid possible blackouts during lightning storms or other transient events, automatic reclosing or single-pole switching is employed. Since most terrorist actions are likely to cause permanent outages, however, automatic reclosing will likely be unsuccessful.

Special Protection Systems or Remedial Action Schemes

Another widely used class of controls is termed special protection systems (SPSs) or remedial action schemes (Taylor, 2007). These are emergency controls that initiate powerful discontinuous actions, such as controlled separation/ islanding, load tripping, or generator tripping at the sending end of an inter-tie. Other possible actions are steam-turbine fast valving, capacitor/reactor bank switching, HVDC fast power changes, and dynamic braking. At present, most of these controls directly detect single or multiple outages and then make logic decisions about whether to initiate feedforward action. The event-based controls are often implemented to prevent cascading for multiple outages, but are sometimes implemented even for N-1 outages. Many SPSs are wide area with outage detection at several sites, binary transfer trip signals to logic computers perhaps at control center(s), and then transfer trip signals to power plants and substations for control action. Reliability for the mission-critical actions must be at least as high as primary protective relaying, requiring as a minimum redundancy so that no single component failure will cause overall control system failure. A large-scale SPS implementation is described below in this appendix.

Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.

Wide-area Feedback/Response-based Controls

A promising alternative or complement to local controls or to SPS is wide-area feedback/response-based controls. Two types of these controls are continuous feedback control, and discontinuous control, which take actions similar to those taken by SPSs. Compared to local controls, wide-area controls provide greater observability and controllability. Positive sequence, synchronized phasor measurements are the preferred sensors for control inputs. High-speed digital/ optical communications are required.

Continuous Wide-area Control

Continuous wide-area control is being studied by many utilities, vendors, and universities. Perhaps the most serious work is that by Hydro Quebec for power system stabilization (oscillation damping improvement) through generator excitation control, and through the use of static var compensators and other power electronic devices.

Wide-area Discontinuous Feedback Control

Wide-area discontinuous feedback control is based on power system response to disturbances rather than on direct detection of only certain outages, as in most SPSs. Control action occurs for outages anywhere in the interconnection that causes a threatening response. Notable is the Wide-Area Stability and Voltage Control System (WACS) in development at BPA (Taylor et al., 2005).

Figure G.1 shows a block diagram of power system stability controls. The SPS path is feedforward. The continuous feedback controls are normally local and mainly at generators, but could be wide area. The feedback (response-based) discontinuous controls are often wide area, but could be local (e.g., underfrequency or undervoltage load shedding).


FIGURE G.1 Power system stability controls.

Sophisticated Control Algorithms

Sophisticated control algorithms use various techniques such as adaptive or “Intelligent” control as part of digital control and communication capabilities. Integration with the energy management system (EMS) functions, such as dynamic security assessment, is possible to adapt control to present operating conditions. The description of wide-area controls above focuses on actions to prevent instability and controlled or uncontrolled separations and islanding. If these actions fail, controlled separations could be initiated. This is relatively easy for well-defined inter-ties between areas, but more difficult in a highly meshed system. Adaptive islanding is a research area. Some aspects of this concept have been demonstrated recently in simulation on a large, realistic test system (Yang et al., 2006).

Example of Impact of Voltage/Reactive Power Practice

An example of the impact of voltage/reactive power practices on system performance from the August 14, 2003, blackout is presented (U.S.-Canada Power System Outage Task Force, 2004). The initial outage of the Eastlake 5 generator on August 14 was related to excitation equipment problems during production of high reactive power. (The outage likely would have been avoided with modern equipment.) As an example of poor voltage/reactive power practice, Figure G.2 and Figure G.3 show conditions on August 14, 2003. Figure G.2 shows the 345 kV voltage profile that many engineers would regard as terrible, especially considering that the load was less than 80 percent of peak summer load and that the

Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.


FIGURE G.2 August 14, 2003, voltage profile from west to east across northern Ohio. SOURCE: U.S.-Canada Power System Outage TaskForce (2004)


FIGURE G.3 August 14, 2003, reactive power production and reserves. SOURCE: U.S.-Canada Power System Outage Task Force (2004).

Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.

13:00 voltage profile was before any outages. Figure G.2 also shows a more desired voltage profile of 103 percent (which could be even higher: standard voltage range is 345 kV ± 5 percent). Voltage at the west (left) end near Detroit is very good. Voltage at a large Ohio River power plant on the east end is relatively low. Despite substantial reactive power reserves in the American Electric Power area (Figure G.2) and a 765 kV infeed, voltage at the South Canton bus is poor.

Figure G.3 shows the very low reactive power reserves at power plants in the Cleveland area. Again, the corresponding high reactive power output combined with old excitation equipment caused the initial Eastlake 5 outage. The poor voltage profile contributed to lines sagging into trees (with heating and sagging inversely proportional to voltage squared). Although inadequately discussed in the reports on the August 14, 2003, blackout, the disaster would likely have been avoided with many more capacitors banks in the Cleveland/Akron area. The power system would have been much more robust and resilient.

Example of Special Protection System Implementation

Bonneville Power Administration (BPA) may have the world’s largest implementation of SPSs. The most important SPSs involve the Pacific AC and DC interties, where the main action is tripping of up to 2,700 MW of hydro generation. This is for high power transfer from the Pacific Northwest to California, where the generator tripping prevents instability (loss of synchronousness among generators). Load tripping at the California end would have a similar benefit for stability.

The most complex scheme involves preventing separation of the 4,800 MW Pacific AC inter-tie where high-speed outage detection of around fifty 500 kV lines is installed (detection at both line ends). Outage detection is transmitted over redundant microwave or fiber-optic communications to BPA’s two control centers. Fault tolerant (triple-redundant) programmable logic controllers are at the control centers. Each logic computer has the equivalent of around 1,000 logic gates to detect the many combinations of single, double, and triple line outages in the series/parallel transmission line path. Commands are then sent to generating plants. Besides hydro generation tripping in the Northwest sending end to reduce power transfer, the controls also switch 500 kV capacitor/reactor banks. If an intertie separation does occur, controlled separations of the northern and southern portions of the western interconnection into two electrical islands is initiated. Following a severe outage, control actions are executed in less than a second.


Kundur, P. , C. Taylor, and P. Pourbeik. (co-chairs and secretary). 2007. Blackout Experiences and Lessons, Best Practices for System Dynamic Performance, and Role of New Technologies. IEEE Special Publication 07TP190, July.

Nedwick, P., A.F. Mistr Jr., and E.B. Croasdale. 1995. Reactive Management: A Key to Survival in the 1990s. IEEE Transactions on Power Systems 10(2): 1036–1043.

Taylor, C.W. 2007. Power System Stability Controls. Chapter 12, Power System Stability and Control volume of The Electric Power Engineering Handbook. Boca Raton, Fla.: CRC Press/IEEE Press.

Taylor, C.W., D.C. Erickson, K.E. Martin, R.E. Wilson, and V. Venkatasubramanian. 2005. “WACS: Wide-Area Stability and Voltage Control System: R& and On-Line Demonstration.” Proceedings of the IEEE [special issue on energy infrastructure defense systems] 93(5): 892–906.

U.S.Canada Power System Outage Task Force. 2004. Final Report on the August 14, 2003, Blackout in the United States and Canada: Causes and Recommendations. Natural Resources Canada and the U.S. Department of Energy. April.

Yang, B., V. Vittal, and G.T. Heydt. 2006. Slow-Coherency-Based Controlled Islanding—A Demonstration of the Approach on the August 14, 2003, Blackout Scenario. IEEE Transactions on Power Systems 21(4): 1840–1847.

Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.
Page 137
Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.
Page 138
Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.
Page 139
Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.
Page 140
Suggested Citation:"Appendix G: Controlling Power Systems." National Research Council. 2012. Terrorism and the Electric Power Delivery System. Washington, DC: The National Academies Press. doi: 10.17226/12050.
Page 141
Next: Appendix H: R&D Needs for the Power Delivery System »
Terrorism and the Electric Power Delivery System Get This Book
Buy Paperback | $49.00 Buy Ebook | $39.99
MyNAP members save 10% online.
Login or Register to save!
Download Free PDF

The electric power delivery system that carries electricity from large central generators to customers could be severely damaged by a small number of well-informed attackers. The system is inherently vulnerable because transmission lines may span hundreds of miles, and many key facilities are unguarded. This vulnerability is exacerbated by the fact that the power grid, most of which was originally designed to meet the needs of individual vertically integrated utilities, is being used to move power between regions to support the needs of competitive markets for power generation. Primarily because of ambiguities introduced as a result of recent restricting the of the industry and cost pressures from consumers and regulators, investment to strengthen and upgrade the grid has lagged, with the result that many parts of the bulk high-voltage system are heavily stressed.

Electric systems are not designed to withstand or quickly recover from damage inflicted simultaneously on multiple components. Such an attack could be carried out by knowledgeable attackers with little risk of detection or interdiction. Further well-planned and coordinated attacks by terrorists could leave the electric power system in a large region of the country at least partially disabled for a very long time. Although there are many examples of terrorist and military attacks on power systems elsewhere in the world, at the time of this study international terrorists have shown limited interest in attacking the U.S. power grid. However, that should not be a basis for complacency. Because all parts of the economy, as well as human health and welfare, depend on electricity, the results could be devastating.

Terrorism and the Electric Power Delivery System focuses on measures that could make the power delivery system less vulnerable to attacks, restore power faster after an attack, and make critical services less vulnerable while the delivery of conventional electric power has been disrupted.

  1. ×

    Welcome to OpenBook!

    You're looking at OpenBook,'s online reading room since 1999. Based on feedback from you, our users, we've made some improvements that make it easier than ever to read thousands of publications on our website.

    Do you want to take a quick tour of the OpenBook's features?

    No Thanks Take a Tour »
  2. ×

    Show this book's table of contents, where you can jump to any chapter by name.

    « Back Next »
  3. ×

    ...or use these buttons to go back to the previous chapter or skip to the next one.

    « Back Next »
  4. ×

    Jump up to the previous page or down to the next one. Also, you can type in a page number and press Enter to go directly to that page in the book.

    « Back Next »
  5. ×

    Switch between the Original Pages, where you can read the report as it appeared in print, and Text Pages for the web version, where you can highlight and search the text.

    « Back Next »
  6. ×

    To search the entire text of this book, type in your search term here and press Enter.

    « Back Next »
  7. ×

    Share a link to this book page on your preferred social network or via email.

    « Back Next »
  8. ×

    View our suggested citation for this chapter.

    « Back Next »
  9. ×

    Ready to take your reading offline? Click here to buy this book in print or download it as a free PDF, if available.

    « Back Next »
Stay Connected!