IEEE Power & Energy Magazine - March/April 2021 - 40

rotating reserve), the system is considered to be in a normal
state in terms of its frequency security.
The Alert State

When a system's security level is weakened and the probability of a disturbance increases, a credible contingency
would cause the system to reach a state where some network equipment would be overloaded or voltages at key
bus bars or system frequencies would exceed the limits. In
this state, all constraints are satisfied, but there are no sufficient reserve margins to make sure that parameters will
be satisfied when a severe contingency occurs. Therefore,
preventive actions can be taken to restore the system to
its normal state. The ENTSO-e Operational Security Code
defines the deficiency as being 20% or more of the fast
frequency and primary frequency reserves for 30 min or
longer and says that at least one of the credible contingencies can lead to an operational limit violation even after
the effects of remedial actions. In this state, an amber alert
is sent to system participants.
The Emergency State

A system can move from an alert state to an emergency state
if a severe contingency occurs before any preventive action
is taken. In this state, some inequality constraints will be
violated, which means that certain network components
are overloaded or that voltages at key bus bars or system
frequencies are outside their limits. Nevertheless, the system remains intact and can be restored to its normal state
or at least to its alert state if appropriate corrective actions
are taken. ENTSO-e adds that an emergency state can be
declared if at least one measure of the system defense plan is
activated and if there is a complete loss of system monitoring
and control tools and facilities (energy management system/

Operational Security

Steady State

Dynamic

Short Circuit
Current Level

Synchronous (Rotor
Angle Stability)

Thermal

Nonsynchronous
(Fault Ride-Through)

Voltage

Voltage Stability

Frequency

Frequency Stability

Reserves

Oscillatory Stability

Ramping
Static Limits

Stability Limits

figure 2. Operational security components.
40

ieee power & energy magazine

supervisory control and data acquisition, state estimators,
and other online system analysis and monitoring tools). In
this state, a red alert is sent to system participants. A system
defense plan includes the automatic disconnection of part of
the load (load shedding) in case more than one big generator
trips, the projected operational active power reserve is not
been activated, or both.
The Blackout State

A system can move to the blackout state from the emergency state if no appropriate corrective action is taken, and
it can move from the alert state to the blackout state when a
severe disturbance occurs. In the blackout state, equality and
inequality constraints are violated. Many generators may
lose synchronism, leading to cascading transmission system
component outages. A system may split into islands, and significant parts of the transmission network may shut down.
Control actions, such as load shedding and system separation, are used for saving as much of the network as possible
from a widespread blackout. ENTSO-e defines this state as
a loss of more than 50% of the load in a TSO's responsibility area and as the total absence of voltage in an island for
at least 3 min. A blue alert is sent to system participants,
a black-start restoration plan immediately is triggered, and
the system enters the restorative, or black-start, state. A restoration plan provides steps to restart the system following
a blackout. Such steps include activating a black-start generator, sequentially energizing a black-start path, gradually
picking up the load, creating frequency islands, synchronizing the islands, and restoring the load.
The Restorative (Black-Start) State

In this state, an operator performs control actions to reconnect facilities and restore the system load. These actions are
performed according to the black-start restoration plan to
gradually bring frequency, voltage, and other parameters
within operational security limits. A system can reach the
normal state or the alert state, depending on conditions.

Operational Security Definitions and Criteria
Operational security can be defined in terms of steady-state
and dynamic security criteria. Steady-state criteria are also
called static limits and refer to thermal, short circuit current,
voltage, and frequency bounds. Active power and ramping
reserves are included. Dynamic criteria, on the other hand,
are also known as stability limits and refer to transient stability (the rotor angle for a synchronous plant and the fault
ride-through for a nonsynchronous plant), voltage stability,
and frequency stability. We also include oscillatory stability, which describes the ability of a power system to damp
oscillations. It deals with small-signal stability and cases of
transient and frequency stability, where disturbances could
result in unstable oscillations of active powers, voltages, and
frequencies. A proposed structure for operational security
components is shown in Figure 2.
march/april 2021

IEEE Power & Energy Magazine - March/April 2021

Table of Contents for the Digital Edition of IEEE Power & Energy Magazine - March/April 2021