An electricity market is a description of a system. The system is physical: rotating mass, protection relays, converters that decide within a cycle whether to keep feeding a fault. The description is an abstraction: bids, five-minute dispatch intervals, and a price that is meant to summarise what the system needs. Most of the time the two agree closely enough that we forget they are different things. The interesting moments are the ones where they part company, and Australia’s National Electricity Market (NEM) has produced two of the clearest examples on record.
On 28 September 2016 the physics ran ahead of the abstraction. South Australia went black about ninety seconds after the first transmission fault, and the regional spot market was switched off within minutes because the thing it was pricing no longer existed. On 15 June 2022 the abstraction ran ahead of the physics. The system was intact, but the price stopped describing it: an administered price cap severed price from cost, capacity withdrew, and the operator ended up resolving dispatch by hand before suspending the market in all five regions for the first time in the NEM’s history.
Told together, the two events are mirror images. Each shows the abstraction failing from a different side, and each ends the same way: an engineer in a control room issuing directions. This article walks through both — what happened, why, and what changed afterwards — and uses the pair to ask a question that applies to every system where synchronous plant is retiring: how much of the physics does a market actually know about?
What the spot market assumes — and cannot see
The NEM spot market is a five-minute, security-constrained economic dispatch. Generators bid, a dispatch engine clears the cheapest offers subject to network constraint equations, and the marginal offer sets the regional price. Four assumptions sit underneath that loop.
- Energy is the product. The market clears megawatt-hours. Inertia, fault current, voltage stiffness and ride-through behaviour — the things that decide whether a system survives the seconds after a fault — are not traded in that loop. Historically they came free with the synchronous machines dispatched for energy. Separate mechanisms exist for some of them (frequency control services in real time; since 2024, planning-timeframe procurement of inertia and system strength), but none of them lives inside the five-minute price.
- Five minutes is fast enough. Primary protection clears a fault in 80 to 120 milliseconds; an under-frequency load-shedding relay needs 150 to 250 milliseconds from measurement to open breaker. The market’s job is to leave the system in a state from which it can survive those milliseconds on its own. It cannot take part in them.
- A constraint equation is a faithful summary of the physics. The dispatch engine sees the network as a set of limits computed offline from models of the plant. If a model is missing a behaviour — a protection setting, a counter in a converter’s firmware — the constraint is silent about it, and so is the price.
- Price is enough. If the price is high enough, capacity shows up; if it falls, capacity withdraws gracefully. This assumption is behavioural, not physical, and it is the one that fails when the price is prevented from doing its job.
In 2016 the second and third assumptions failed: the physics moved faster than any market signal and involved a behaviour no model contained. In 2022 the fourth failed — and dragged the operator into the physics anyway.
South Australia, 28 September 2016: Physics outruns the abstraction
The system before the event
Just before the event, South Australian demand was 1,826 MW, supplied by 883 MW of wind, 330 MW of gas-fired generation (three Torrens Island B units and two at Ladbroke Grove) and 613 MW of imports from Victoria over the Heywood AC interconnector and the Murraylink HVDC link. Wind was close to half of supply; the combined inertia of the online thermal units was around 3,000 MWs. AEMO’s real-time tools showed a secure operating state and a market operating normally. The loss of both Heywood circuits was a non-credible contingency, and no advice of abnormal risk to the network had been received. In the abstraction, everything was in order.
The abstraction was missing one thing. Many of the state’s wind farms carried a protection feature that counted ride-through events: after a pre-set number of voltage dips within 120 seconds — two for some turbine types, five for others — the turbines would disconnect, stop, or reduce output. The feature was not represented in any simulation model AEMO held. The operator learned of it from the event.
Ninety seconds
At around 16:16, tornadoes with estimated wind speeds of 190–260 km/h damaged three 275 kV lines some 170 km apart. Between 16:16:46 and 16:18:14 the network saw five faults producing six voltage dips: a 66 kV feeder fault (voltage at Davenport down to 85%), a two-phase-to-ground fault on the Brinkworth–Templers West line (60%), and four dips to about 40% on the Davenport–Belalie and Davenport–Mt Lock lines, the last two a second apart when an auto-reclose attempt failed. Every fault was cleared within 80 to 120 milliseconds. Every turbine rode through every individual dip.
But the counters were counting. Ten of the thirteen online wind farms entered ride-through mode between three and six times, and nine of them lost output as their limits were reached — 456 MW in less than seven seconds. The interconnection with Victoria, already carrying about 600 MW, tried to fill the hole; flow on Heywood surged towards 900 MW. About 700 milliseconds after the last wind farm dropped out, the loss-of-synchronism protection at South East substation tripped both Heywood circuits. South Australia was an island with a supply deficit in the order of 1,000 MW.
Schematic redraw of the 28 September 2016 sequence. Panel A: the six voltage dips over about ninety seconds; Panel B: the last ten seconds, in which the ride-through counters reach their limits, the interconnector loses synchronism and the island collapses. Event times, voltages and MW figures are taken from AEMO’s Final Report (March 2017); the traces are illustrative, not measured data.
Why the island could not hold
The under-frequency load-shedding scheme starts below 49 Hz and is designed to have shed all of its allocated load by 47.5 Hz. It never got the chance. With so little synchronous inertia left, frequency fell from 49 Hz to below 47 Hz faster than the 150 to 250 milliseconds the relays and breakers needed to act. AEMO’s later analysis suggests that even a complete, timely load shed of 60% of demand might have left too much load — roughly 800 MW — for the surviving generation. At 16:18:16 the island collapsed and around 850,000 customers lost supply.
The market switched off
Within minutes, AEMO declared the spot market suspended in the SA region. A black system is one of the three conditions in the National Electricity Rules under which the market is suspended, alongside a direction from a jurisdiction that has declared a state of emergency and a determination by AEMO that operating the market under the Rules has become impossible. Two of the three applied here: the following day the South Australian government directed AEMO to keep the market suspended; the direction was revoked on 11 October, and AEMO lifted the suspension at 10:30 pm that evening, twelve days after the event.
Notice what those twelve days looked like. Most customers had power back within eight hours, and the last, behind bypassed towers, on 11 October. So for almost the whole suspension the system was running again while the abstraction was switched off. Prices came from a published suspension schedule rather than from bids. Dispatch continued, but AEMO ran the region with the physics rather than the price in charge: from 3 October it reclassified the loss of multiple wind farms as a credible contingency and constrained their output until the ride-through limits were raised; it capped Heywood flow so that loss of the interconnector alone could not push the rate of change of frequency above 3 Hz/s; and it required a minimum number of synchronous units online. AEMO’s own final report is candid about the experience — its key conclusion on the suspension was that there was, in its words, “a lack of detailed procedures on how to operate the power system” during an extended market suspension. The Rules knew how to switch the market off; they had far less to say about running the system without it. When the AEMC was later asked to clarify which Rules apply during a suspension, it determined in June 2021 that all of them do unless the Rules say otherwise. The abstraction is not paused when the market is. Only its pricing is.
Root cause, lessons, mitigations
It is tempting to summarise 2016 as “wind farms tripped.” That is not what AEMO found. The turbines rode through the faults as designed; what removed them was a control setting responding to the number of disturbances, and AEMO’s scenario studies indicated that without that sustained reduction SA would have stayed connected to Victoria. Three physical shortfalls then decided the island’s fate: not enough inertia to slow the frequency fall so that load shedding could act; not enough local frequency control to hold an island over the longer term; and not enough system strength to control voltages, run protection correctly and keep inverter-based plant stable. None of the three appears in a spot price. Table 1 sets out what failed, why, and what changed.
Incident card for the 2016 South Australian black system: trigger, mechanism, root cause, lessons and mitigations. Source: AEMO Final Report (March 2017) and subsequent AEMC and ElectraNet actions.
The NEM, June 2022: The abstraction outruns physics
A safety net designed for a different problem
The NEM has an administered price cap (APC) that comes into force when the rolling seven-day sum of spot prices in a region exceeds a cumulative price threshold — at the time about $1.359 million. The APC then limits the spot price to $300/MWh. It was conceived to keep trading going through a sustained price spike. It was not conceived for a winter in which international coal and gas prices had pushed the fuel cost of many plants above $300 for every megawatt-hour they produced, on top of coal-plant outages, low wind and solar and high winter demand — the ingredients AEMO lists in its own summary.
On Friday 10 June, as the seven-day sum approached the threshold in some regions, AEMO observed noticeable changes in generator bidding and the first withdrawal of capacity — enough to produce actual Lack of Reserve level 2 conditions and the first reliability directions of the episode. On Sunday 12 June the threshold was exceeded in Queensland and the $300/MWh cap applied there; on Monday 13 June in New South Wales, Victoria and South Australia.
A dispatch engine run by hand
When the cap applied, the amount of generation bid into the market fell. A generator whose fuel costs more than $300 for every megawatt-hour is not behaving irrationally when it declines to offer at $300; it is doing what the abstraction told it to do. AEMO’s response was the tool the Rules give it when the price fails: directions under clause 4.8.9, instructing plant to bid in and run. On 14 June it directed about five gigawatts of generation. Without those and other interventions, AEMO’s forecasts showed shortfalls at some times of up to around a third of NEM winter peak demand.
Directions are managed inside the dispatch engine as constraints. So many were needed that AEMO’s automated systems and processes could no longer keep up: dispatch pricing in up to half of the five-minute intervals had to be resolved manually. A market whose central promise is an algorithmic price every five minutes was being cleared by people. On 15 June at 14:05 AEST, AEMO suspended the spot market in all regions, judging that operating it under the Rules while keeping supply secure and reliable had become impossible. Suspension simplified operations, but it did not resolve the underlying problem — as the Australian Energy Council later observed, directions kept increasing after suspension because a price-capped dispatch process still cannot ration energy. Over the following days AEMO deferred network maintenance, kept directing generators, activated emergency reserves and worked with jurisdictions on fuel supply; the mainland came close to load shedding more than once. The market resumed at 2 pm AEST on 24 June, nine days after suspension.
Physics symptoms, and what changed
It would be wrong to say the physics played no part. Two items on AEMO’s list of matters for its incident report make the point: on 13 June, the day the cap spread to three regions, the Queensland–New South Wales interconnector operated in excess of its secure transfer limits; on 17 June AEMO flagged a potential exceedance of the frequency operating standards. Neither was a stability event of the 2016 kind. Both are what happens when the abstraction stops describing the system and the operator is managing a directed fleet through hand-resolved dispatch: the security margins the market normally holds as a by-product get thin. So 2022 should not be filed as “purely a market failure.” The scarcity was physical; what failed was the market’s ability to describe it in its price.
The mitigation, accordingly, was to repair the description: the AEMC raised the administered price cap from $300 to $600/MWh from 1 December 2022, and made the higher level permanent from 1 July 2025 alongside staged increases to the market price cap and the cumulative price threshold, so that a repeat of June 2022 would let most plant recover its fuel cost inside the market rather than under direction.
The mirror
Set side by side, the two suspensions are almost perfectly inverted (Table 2 and Figure 2). In 2016 the system failed and took the abstraction with it: the island’s frequency collapsed before any market process could register a change, and suspension was a consequence, not a decision. In 2022 the abstraction failed and the system survived: capacity was physically available but priced out of the market, and suspension was a decision AEMO took after five days of manual operation.
The two suspensions compared.
Sources: AEMO Final Report on the SA Black System (March 2017); AEMO June 2022 event summary and reviewable incident report; AER June 2022 market events report; Australian Energy Council analysis.
What they share is the fallback. In both cases the recovery mechanism was not a better price but a person: a control-room engineer issuing directions, reclassifying contingencies, writing constraint equations by hand, deciding which units must run. Directions are the abstraction’s confession — the moment the market admits it cannot describe what the system needs and hands the description to a human.
Conceptual view of the two failure directions. In 2016 the physical layer collapsed and the market layer was switched off as a consequence; in 2022 the market layer broke first and the physical layer, intact but strained, was run by hand. The fallback was the same in both cases.
Where this leaves us
Both events forced the abstraction to learn, but notice where the learning went. After 2016 the physics was written into operating limits and planning frameworks — a RoCoF constraint, a minimum synchronous fleet, inertia and system-strength obligations on transmission companies, synchronous condensers — not into the five-minute price. The AEMC’s Improving Security Frameworks rule (March 2024) aligned the inertia and system-strength frameworks and gave AEMO the ability to enable security contracts in operational timeframes; AEMO’s 2025 Transition Plan for System Security flags inertia and system-strength deficits in New South Wales from 2027–28 on the current Eraring retirement date. But in October 2025 the AEMC decided not to create a real-time inertia market, judging the costs of running one greater than the benefits while synchronous condensers built for system strength supply inertia as a co-benefit; AEMO has since proposed a NEM-wide inertia floor with higher requirements in regions at risk of islanding — a proposal, not yet a rule. After 2022 the learning went into the price settings themselves.
That may well be the right division of labour: inertia is a system-wide, non-storable property that markets price awkwardly, and a price cap is a market object that a market body can fix. But it means the gap between the abstraction and the system is being managed rather than closed, and that the human in the control room remains the coupling between them. South Australia’s long islands of 2020 (17 days) and 2022 (about a week), when the market stayed formally open while AEMO held plant at zero output and directed demand floors, are the same lesson in a quieter form: “market open” and “market in charge” are not the same thing.
Conclusion: Directions are the confession
A market is a map. South Australia in 2016 is what happens when the territory changes faster than the map can be redrawn: ninety seconds of physics, then twelve days of engineers running a region without a price. June 2022 is what happens when the map is drawn wrong: nine days in which the operator cleared the market by hand because the price had been forbidden from telling the truth. The two are opposites in cause and identical in remedy.
For those of us who work on stability, the lesson is not that markets are bad at physics. It is that markets are silent about it, and that the silence is only safe while the system can look after itself for the seconds the market cannot see. As synchronous plant retires across every interconnected system, that self-sufficiency is exactly what is being withdrawn. Every direction issued in a control room is a measurement of the gap. Counting them, and asking what would make them unnecessary, is a more honest indicator of a system’s health than any price.
This article was originally published on the GridStab News Substack, and has been reproduced here with permission.
About our Guest Author
 |
Gilles Chaspierre is the founder of GridStab News and the author of “Grid Stability in the Era of Inverter-Dominated Power Systems” and “Impedance-based stability analysis: a practitioner’s guide”.
He has worked with major TSOs including RTE, AusNet and Elia on grid stability, EMT simulation and grid-forming converter deployment. You can find Gilles on LinkedIn here. |
Good article, however, a few things missing from the first event (SA Blackout). Specifically, the way the HVDC connection Murraylink was dispatched also affected the flow on the Heyward interconnector which contributed to its trip.
There is too much AI writing in this article; it is hard to read.
This is unreadable. Slop. Please do better. Do not let AI write your article.