Operating under siege

In preparing this post, we thought it was worth stepping back from covering minute-to-minute events in the NEM, but to draw from them a couple of illustrations of how market operator AEMO has dealt with threats to system security arising from the complex and shifting bushfire situation.

There’s now an active discussion about the robustness of the transmission grid and future investments to harden it against recurring fire and extreme weather threats.

This is an important discussion to have, but it’s also worth understanding how these threats have been managed within the capabilities of the grid as it currently exists. To do this requires a diversion into the world of system security and credible contingencies.

System Security – what is it and how is it managed?

Electricity grids are very large complex machines with a vast multitude of components, operating within relatively small tolerances. When working with complex machinery, we prefer to be in a tightly controlled environment – enough things can go wrong already without having all sorts of external risks and shocks to deal with.

Grid operators don’t have that luxury – by necessity their machinery extends over large distances in highly varied terrains, exposed to the full gamut of environmental factors – heat, cold, storms, lightning, and even fires. The last few months and weeks have brought that last point clearly to the forefront in the NEM.

Layered onto the challenges of operating the physical grid, AEMO also runs a market mechanism optimising the dispatch of hundreds of generating units to meet demand at least cost. These dual objectives play out by overlaying on market dispatch a large set of security constraints, steering power flows across the entire transmission network within a secure operating envelope where the system can provide uninterrupted supply in the face of the various shocks that the environment, as well as failures of its own components, might throw at it – trips of key transmission lines, major generator failures and so on.

Balancing dual objectives of least-cost market dispatch and secure grid operation requires important tradeoffs to be made – especially deciding what shocks should be allowed for in defining “secure”.

Loss of output from a single large generating unit can happen at any time and is a common occurrence in any large grid – clearly a secure system should be one operated continuously so as to withstand that possibility. On the other hand, suddenly losing output from an entire four unit power station is a much rarer contingency and the costs of continuously operating the NEM to remain secure against such low probability events could be prohibitive.

Note that the NEM and other systems have further backstop mechanisms designed to keep the system running – albeit with blackouts – if major non-credible contingencies occur. A key mechanism is automatic under-frequency load shedding which rapidly disconnects large blocks of load – smelter potlines, or if necessary sections of distribution networks. The aim being to avoid a complete “black system” wherever possible.

The general practice followed by AEMO (and many other operators) is to define “secure” with respect to a single “credible contingency”, or “N-1” standard. Credible contingencies are failures, or trips of a single key element or tightly linked group of elements that could reasonably occur in a single event, but with unpredictable timing. “Non-credible” contingencies are simultaneous or near-simultaneous failures involving multiple elements not normally at risk from a single triggering event.

Classifying Contingencies – and why it matters

A good example of the distinction between credible and non-credible contingencies arises with transmission lines consisting of two parallel circuits strung on a single set of towers. The loss of a single circuit is usually treated as a credible contingency: a given circuit might trip unpredictably for any number of reasons – an insulator might fail, a protection system might malfunction and so on. However simultaneous loss of both circuits would typically involve some much lower probability event like a tower collapse, and would usually be classified as non-credible.

But these classifications are not static – lightning strikes on some single-tower dual circuit lines can take out both circuits in one hit, so when there is a heightened risk of lightning in the relevant area, it becomes prudent and reasonable to reclassify simultaneous loss of both circuits as a credible contingency, and if necessary add a constraint requiring that market dispatch sets up flows such that the system remains secure against simultaneous failure. Watchers of AEMO market notices will have seen that at times of storm activity, there is often a flurry of such reclassifications.

Decisions to reclassify contingencies don’t come without cost – any constraint moving the market away from lowest-cost dispatch has price and cost effects, and at times these impacts may be very large. Lightning-related reclassification has been a standard feature of the NEM since its inception, but reclassification decisions related to other more occasional, low probability high impact risks such as major bushfires and severe storms have in the past proved quite problematic for AEMO and its predecessor NEMMCO.

Two stark examples are the widespread blackouts in Victoria in January 2007 when bushfires cut transmission links carrying power to Melbourne from northeastern Victoria and the Snowy scheme, and the South Australian system black in the extreme storm of 28 September 2016. Both events arose from shocks that had not been foreseen as credible contingencies – and therefore not formally reclassified.

In both cases the shocks caused electrical separation between NEM regions at times of high inter-regional power flow, which then led directly to blackouts. With the wisdom of hindsight, both might have been prevented – or substantially mitigated – had the system been dispatched differently, which would have involved applying additional, and potentially costly, constraints over the market.

The point of this article isn’t to rehash whether or not the correct operational decisions were taken in January 2007 or September 2016 (follow up that angle through links here and here), but to contrast some of the actions taken by AEMO more recently. Changes to Market Rules and AEMO procedures since the SA black system have clarified AEMO’s scope for action in these circumstances.

Managing recent threats

We can start with an example from winter last year when severe weather conditions affected Victoria and South Australia. AEMO’s market notice refers to a general risk of non-credible contingencies being more likely, but doesn’t formally reclassify any specific contingency.

Nevertheless, from early on that morning, AEMO had already applied constraints on dispatch across the Victoria – South Australia interconnector limiting flows to a much lower than normal range – to leave headroom in the case of “bad stuff happening” due to the extreme weather. Unlike September 2016, bad stuff didn’t happen on this occasion but the system was more robustly placed if it had done.

Jumping to a current example, bushfires impacted a number of transmission assets – lines and substations – in the Snowy Mountains region on January 4 and ultimately led to NSW and Victoria becoming electrically separated. AEMO had for days been issuing market notices highlighting the forecast extreme weather and heightened risk of non-credible contingencies (loss of multiple transmission elements).

As the day progressed, a number of lines in the region were tripped by fires. The graphic below (courtesy of Jonathon Dyson at Greenview Strategic Consulting) overlays transmission assets in the Snowy / southern NSW region (yellow, red and blue lines) on a map showing fire-affected areas – it’s clear why all this was happening:

As the situation worsened at 15:00 NEM time, AEMO imposed additional general constraints limiting flows northward from Victoria into NSW, first to 650 MW then shortly afterwards to 450 MW.

This proved to be inspired just-in-time risk management when the two regions separated just a few minutes later due to bushfire impacts on switching stations in the Tumut area:

As detailed in Paul’s article, consequences of the separation were extreme prices, Lack of Reserve 2 and activation of RERT capacity in NSW, which not only lost its access to flows from Victoria, but also from generation in southern NSW, including Snowy’s Tumut stations, Origin’s Uranquinty, and a number of smaller solar and wind generators. But this time the lights stayed on.

——————————————-

About our Guest Author

Allan O’Neil has worked in Australia’s wholesale energy markets since their creation in the mid-1990’s, in trading, risk management, forecasting and analytical roles with major NEM electricity and gas retail and generation companies. He is now an independent energy markets consultant, working with clients on projects across a spectrum of wholesale, retail, electricity and gas issues. You can view Allan’s LinkedIn profile here. Allan will be sporadically reviewing market events here on WattClarity Allan has also begun providing an on-site educational service covering how spot prices are set in the NEM, and other important aspects of the physical electricity market – further details here.