1166
3, August 1996
Industry Experience with Special Protection Schemes
IEEEKIGRE Committee Report
P. M. Anderson
Power Math Associates, Inc.
San Diego, CA
IEEE WG on Special Stability Controls
Abstract
Special protection schemes are those designed to detect one or
more predetermined system conditions that have a high probability
of causing unusual stress on the power system, and for which
preplanned remedial action is considered necessary. The failure of
these schemes to accurately detect the defined conditions, or their
failure to carry out the required preplanned remedial action, can
lead to very serious and costly system disturbances. It is natural,
therefore, that a concern for the reliability of these schemes has
been expressed. This paper reports on a joint IEEE-CIGRE survey
to determine the experience with special protection schemes, and
to question the designers and operators of these schemes regarding
the reliability of performance. Questions were also directed to the
design process itself, the reliability criteria used for the design, and
the analytical methods used to assure reliability in the design.
Key Words
Special protection schemes, remedial action schemes, contingency
arming schemes, reliability criteria, reliability modeling, reliability
analysis, reliability assurance, reliability monitoring, reliability
tracking, failure, failure analysis, failure cost, failure consequences.
1. Introduction
This paper reports on the results of a joint survey performed by
CIGRE and IEEE to determine the experience of the power
industry in the application of Special Protection Schemes. First, it
is appropriate to define what is meant by a Special Protection
Scheme (SPS). This is a protection scheme that is designed to
detect a particular system condition that is known to cause unusual
stress to the power system, and to take some type of predetermined
action to counteract the observed condition in a controlled manner.
In some cases, SPSs are designed to detect a system condition that
is known to cause instability, overload, or voltage collapse. The
actions prescribed may require the opening of one or more lines,
tripping of generators, ramping of HVDC power transfers,
intentional shedding of load, or other measures that will alleviate
the problem of concern. Common types of line or apparatus
protection are not included in the scope of interest here.
One design parameter that sets these schemes apart is that many of
them are "armed" and "disarmed" in response to system conditions.
For example, a watchdog type of scheme may be required and
armed at high load levels, but not at lower load levels. In some
cases, the arming conditions measure several different parameters
as a part of the decision process. Some SPSs are armed
automatically by the system control center computer, others require
human operator action or approval, and others are manually
operated. Some schemes are armed all of the time.
94 WM 1 8 4 - 2 PWRS A paper recommended and approved
by the IEEE Power System Engineering Committee of the
IEEE Power Engineering Society for presentation at the
IEEE/PES 1994 Winter Meeting, New York, New York,
January 30 - February 3 , 1994. Manuscript submitted
August 31, 1993; made available for printing
December 22, 1993.
0885-8950/96/$05.000 1994 IEEE
IEEE Transactions on Power Systems, Vol. 11, No.
B.K. LeReverend
Ontario Hydro
Toronto, Ontario
CIGRE WG05 of Study Committee 39
In different parts of the world, these schemes are called by
different names. Some common names in use are "contingency
arming schemes," "discrete supplementary controls," "remedial
action schemes," and "special protection schemes." The latter term
has been used for several years, and will be med throughout this
report.
2. Brief History of Special Protection Schemes
It is not known how long SPSs have been designed and used by the
utility industry, but some of them have been in service for many
years. In 1988, CIGRE performed a survey similar to the one
reported upon here [l]. That survey reported on a total of 9 3
schemes in operation in 18 utilities located throughout the world.
IEEE has had committee activity within the Power Engineering
Society for some time with interest in special controls. The IEEE
Working Group on Special Stability Controls has discussed
schemes of this type and raised the question as to their reliability.
This resulted in a panel session at the 1987 Summer Meeting,
where the experience of four complex schemes were reported
upon. The design reliability and field experience of the schemes
were summarized by the panelists. This led, in 1992, to the present
survey actiyity. As the activity gained momentum, it was learned
that CIGRE was planning a second survey on the subject. This
resulted in the two efforts being merged into one. The IEEE
approach was to contact SPS designers throughout the world and to
inquire as to their methods of design, with emphasis on reliability
analysis, and to inquire regarding their field experience. The
CIGRE approach was to contact the member countries of their
organization, with the member country representative asking
known experts in that country to respond. As a result of this effort,
a total of 111 schemes are reported upon from the survey. This is
believed to be a reasonable cross-section of all schemes in service,
but is certainly not exhaustive. For example, Russia alone is
reported to have thousands of schemes in service, but the survey
received only one response from Russii], which was necessarily
general and did not cite their experience with ilny particular
scheme. Many countries were not heard from at all. It is not
known how many such schemes exist throughout the world.
IEEE and CIGRE are not the only engineering organizations that
have shown concern for the reliability of special protective
schemes. The Instrument Society of America (ISA) has been
involved in a concerted effort for several years in the preparation
of a standard for the design and reliability evaluation of what they
refer to as "Programmable Electronic Systems." The emphasis of
their analysis is directed toward "safety systems," which are
common in many industrial systems, such as chemical or nuclear
plants. The ISA Committee has also worked closely with the
International Electrotechnical Commission (IEC), which also has
an activity aimed at establishing standards for this type of
equipment. A number of reports and papers have described these
efforts [2-221. It is noted that much of the work of the IEC and the
ISA are applicable to many of the SPS designs, and their recent
emphasis on digital processing is appropriate for many of the
newer designs. The SPS designs used in the power industry cover
a wide range of protective functions [23-441, and most of them
have characteristics similar to safety systems, although the
emphasis is different.

3. Summary of Survey Results
The preparation of the survey used in the IEEE/CIGRE effort was
prepared jointly by the authors, with the assistance and suggestions
of committee members from both organizations. The survey
questionnaire is provided in Appendix 1. The results provide
information on many different schemes from all over the world,
which have been designed with many different objectives. Nearly
all of them share the objective of requiring high reliability and
security, as the cost of failure for any system is high. Following is
a summary of the responses that can be summarized numerically.
Questions resulting in written comments are not summarized in
detail, due to the need for privacy of information as well as the
requirement for brevity in a paper of this kind. However, these
comments were used to clarify the understanding of the schemes
and the interpretation of the results. Some ut
questionnaire several times, as a separate response is required for
each SPS.
Responses to the survey originated froin 49 utilities in 17
countries, for a total o f l l l schemes. The participating utilities are
listed in Appendix 2. The participating regions and their percent
contribution are shown in Figure 1. Since the survey is not an
exhaustive survey of all utilities or all countries, the results must he
considered as showing trends only, rather than a quantitative
representation of the experience with all schemes.
Canada
19.8%
USA
20.7%
Figure 1 Schemes Reported by Geographical Regions
A breakdown of SPSs by type is useful for noting the most
commonly used schemes. This breakdown is provided in Table 1.
Generation Rejection (G/R) schemes remain very much in use,
accounting for about 21.6% of the total responses. Next in
frequency of use are Load Rejection (LIR) schemes and
conventional Underfrequency Load Shedding (ULS) schemes, with
10.8% and 8.2% of the total responses, respectively. Regarding
1167
Underfrequency Load Shedding, it is expected that most utilities
would have such a scheme in place, based o n the data gathered in
the previous CIGRE survey [I]. In terms of trends, it should be
noted that Turbine Valve Control (TVC), HVDC Controls, and
System Separation ( S E ) are being used with increasing frequency.
The relatively high percentage of schemes in the "Others" category
suggests a diversification of SPSs and may be an indicator of the
increased reliance of the industry on these schemes.
Additional evidence of the growing popularity, or necessity, for
SPSs is indicated by the tabulation of the initial year of operation
of schemes, shown in Figure 2.
6
3 5
e
E 4
2 3
2
1
0
Year
Figure 2 Initial Year of Operation of Special Protection Schemes
Figure 2 shows that, based on survey data, 29% were installed in
the 1970's, 46% in the 1980's and about 14% in the early 1990's.
About 64% of all SPSs have been installed since 1980. One SPS
not shown in Figure 2 was installed in 1930. Of all those installed,
almost 95% are still in service.
One of the types of data requested on SPS performance is the
number of successful operations, unsuccessful operations, failures
to operate, and unnecessary operations for each year during the
period 1986-1992. In addition, the total percent of time the SPS is
armed during each year was also requested. These responses
provide statistics that should be useful in computing performance
measures of the collective installations of SPSs worldwide.
Section 4 provides an evaluation of SPS performance.
One observation that stands out from all these statistics, is that the
number zero was the number most frequently recorded in all
categories. Stated another way, zero operations were recorded by
most of the SPSs, either successful or unsuccessful. Similarly,
zero failures were recorded by most systems, and zero unnecessary
operations were also recorded most frequently. This suggests that
the system condition requiring action does not occur often, but
when it does occur, the SPS usually performs its function correctly.
In terms of the arming of the SPS, 100% was recorded most
frequently by those responding. This means that many SPSs are
required to be in service all of the time, not just during particular
system operating conditions.
One question In the questionnaire asked for the dominant cause of
failure or problems with the SPS. The response to this question is
summarized in Figure 3. In constructing this and subsequent
graphs, the only data used were actual responses to the question so
that the totals displayed sum to 100. Questions receiving no
answer have been omitted from these graphs. If a utility chose
more than one answer to a question, each selection received :in
equal share of that utility's response.
The primary effect on the power system that occurs as the result of
SPS failure is an important issue. The survey responses to this
question are shown in Figure 4. Generator Instability is the effect
cited by the majority, which indicates that many schemes in service
are used to improve stability. Voltage Stability and System
Separation were also cited by many.
1168

Hiii~ianError < US$lOk

Incorrect Setting US$lOk - $100k
Hardware Failure US$100k - $500k
Software Failure
> US$SOOk
Inadcquate Des~gn
0.0 10.0 20 0 30.0 40.0
Otlier
Percent of those Responding
0.0 10.0 20.0 30.0 40.0 50.0
Figure 7 Estimated Cost of Unnecessary SFS Operation
Percent ot Ihose Responding
The cost to design, construct, install, and commission an SPS was
Figure 3 Dominant Causes of SPS Failure the subject of the next question The results are shown in Figure 8.

Gen Instability < US$100k

US$100k- 1,000k
Loss of Load

Sys Separation
0.0 It1.6 2O.i. 3(1o 40.0 50.0
Volt Instability Pcr.wit OI tli~ixRr qioiiJiiii:

0.0 10 0 20.0 30.0 40.0 50.0 Figure 8 Estim:itcd Cost o f Spccial l'r,)tcctiL)ii Sshcnics
Percent of those Responding 'l'hc cost data o f Figurr., 5. 7 , :ind d a r c very r\iugh zsiiinntes and
should be interpret4 \ v i l l i c'itrr.. T l i ~plt)ltz~lgr:iphs d a not dcpict
Figure 4 Primary Effects of SPS Failure
pre-ise ini'orni:ition, bur they Jd givc n seiisc o f the l c t ~ of l cost
The questionnaire asked for an estimate of the cost of an :isuci:itc.d with these three c:itc~~:,)r~i'b.

operational failure of the SPS, with responses blocked into groups.

The responses to this question are summarized in Figure 5. It is -4nothcr question pr,>brJ the :ilternnti\,cs :i\r:iil:ible 1,) thr utility t h a t
clear that the cost of SPS failure can be very high as most of those could ha\rr. been uscif instc:iJ 01' in\t:tlling the SPS. The most
responding selected the highest cost category. frcquent response t o this q t i r s t i , ) ~ ~\v:ls "po\ver triinsftr
c U r t ;Ii I m c n t ." 0 Ihc r f re q 11 c n t r t s pa nse s w i're " ge 11 c ra t i c ) t i
rcs:heduling" and "iii<)rcconsen,ntiw qwration."
< US$lOk The next question requcstrd int'orm:ition rr.yr.ling the reliabiliiy
US$lOk - $look
criteria used for the SPS dcsign. hlost of thosc rrspmding nntcd
that only a qualitative, r:it!Ier th:in quantii:itivc critcrion \v:is used
US$100k - $5OOk ior their design. Others noted t h a t thew \\'as nu specific rr.li:ibility
criterion set by a n y :iuthority. hl:lny ntJtcd the :ipplic;iiion of :I
> US$500k reliability criterion x t by their own mnn:iScmcni. Others noted : i n
agreement with neighlmring utilities regirding Ihc' rtli:ibiliiy
00 100 200 300 400 50.0 design standard. Finally, f o r uiiliiie'i in Sorih Aincricx, ninny ciicd
reliabiliiy criteria tint arc' prrscrihed b y rcgionnl councils. Many
Percent of those Responding mentionrd that rCdund:incy in the Jesigi \\.:IS csnsiJr.rcd iinportnnt.
Figure 5 Estimated Cost of SPS Failure
Qualrtitative Goal
The effect of false or unnecessary operation of the SPS was also
questioned. The responses to this question are summarized in No Cnteria
Figure 6. Most systems report that such a false trip will result in
the loss of either a generator or load System disturbances were Utility Standard
also cited by many respondents Utility Agreement
Regional Council

00 100 200 300 400 500

Gen Instability
Pcrccnt of ihoce Responding
Loss of Load
Sys Separation Figure 9 Reliability Criteria for SPS Design
Generator Trip
The reliability criterion specified by most of those responding to
Sys Disturbance this question was a general requirement for equipment redundance
(15 responses). Frequency of fAse operation (10) and frequency of
00 10.0 20 0 30.0 40 0 failure (7) were the only reliability based specifications noted that
Pcrcent ot tho@,eResponding
could be checked by reliability modeling and computation
Finally, several mentioned that qpecifications for SPSs were
Figure 6 Effect of SPS Unnecessary Operation similar to those for transmirqion protection in general

The estimated cost of false trips was also requested. The results of
the responses to this question are summarized in Figure 7. Note
that the costs of false trips is generally much lower that the cost of
failure of the SPS to operate when required, shown in Figure 5.
Reliability of a physical system is often checked by analytical
methods to assure compliance with design criteria The next
question asked the type of analytical methods used to assure the
required reliability standdrds were being met Figure 10 provides a
summary of the responses to this question
 1169

Fault Tree question are summarized in Figure 12. A majority of responses

mention system monitoring with subsequent adjustments, as
Markov Model required, to meet reasonably reliable operation. Many mentioned
Network Model the use of design standards similar to those used in all of their
system protection systems, although these criteria are not
Failure Prob necessarily uniform throughout the industry. Others used testing
Failure Frequency
and simulation methods.
Failure Duration
FMEA Perfomled
No Reliab Model
No Computations

0.0 10.0 20.0 30.0 40.0

Percent of t h e responding
Other Methods
Figure 10 Reliability Computations Performed
0.0 5.0 10.0 15.0 20.0 25.0
Figure 11 shows a breakdown of the reliability criteria that
prompted a given method of reliability analysis. Note that the Prrrent of tliosc Rcspoiidiiig
reported reliability criteria most often used are specified by the
individual utility rather than some governmental or administrative
authority. Figure 12 Methods Used to Verify Reliability of SPS Operation
The next question asked about the requirement for quantitative
reliability analysis imposed by a n y government, industry, or other
Fault Tree
Fault Tree I I I I authority. About 87 percent reported no such standard, and 11
percent did not know of any standard of this kind. Only two
percent reported the existence of standards for quantitative analysis
Markov Model
Markov Model I I to assure reliability. Several mentioned that such standards are
being developed.
Network Model
Another question probed the respondent's assessment of the actual
reliability of the SPS compared to their computed reliability or
Failure Prob their expectation. Of those responding, about 86 percent noted that
the performance was about the same as that computed, ten percent
Failure Frequency
I I noted better performance than computed, and only about four
percent noted poorer perfbrmance that computed.
The next question asked about the trade-offs to be considered in
the design of a future SPSs, the results of which are shown in
Figure 13. Most of those responding recorded that an SPS would
be chosen for installation i f its cost and reliability were both
comparable with other available alternatives. Others selected cost
0.0 10.(1 20.0 30.0 40.0 50.0 60.0 70.0 as the principle criterion. Some selected reliability as the primary
Perccnt of tbow respoiidii~gper inclhod factor to be considered. None of those responding said that they
would not consider another SPS under a n y circumstances, hence
the zero for this category in Figure 13.
Regioiial Ulilily Utilily NoStandard
Agrceincnt Standard

GxttReliability
Figure 11 Reliability Computations Performed in Compliance to
Established Design Criteria cost
Reliability
Most of those responding made no reliability computations or had Not Considered
no reliability model of their system on which computations could
have been made. Of thme performing computations, several 0.0 10.0 20 0 30.0 40.0 50.0
methods are reported and several reliability measures were noted. Percent at h s e Responding
The next question asked if the reliability computations were Figure 13 Factors in Considering New Special Protection Schemes
compared with the design criteria to assure compliance. Only
about twenty percent of those responding made this comparison. The next question asked for an estimate of the frequency of
This is probably due to the fact that many had no reliability design occurrence of events that should cause operation of the SPS. The
requirements specified by a n y authority (see Figure 9). However, response to this question is shown in Figure 14.
about half of those responding mentioned that redundancy was
used in the design of their system, although this was not :i design
requirement in 59% of the cases.
Another question asked for the planned frequency of testing for the
Since reliability analysis was not used in many cases, the next SPS in order to validate the continued reliable operation of the
question is of particular interest This question asked what system. Most utilities test this type of equipment annually, but
methods were used to verify a reliable design without performing utility practices vary over a rather wide range, as noted in Figure
any reliability calculation?. The results of those responding to this 15. A rather large percentage plan no testing at all.
 1170

More OnceNear n, = Number of Successful Operations

Once a Year n2 = Number of Failures
Once in 5 Years s = Number of Unsuccessful Operations
Once i n 10 Years n, = Number of Unnecessary Operations
Don't Know ny = Number of Scheme - Years of Operation

()() jo 100 150 200 2.50 300 Then, the following performance indices are defined [l]
. . and
plotted using data from the recent survey.
Percent ot those Respoiidiilg

Figure 14 Estimated Frequency of SPS Operation Effectiveness Index = I' '

More than Annual
Test Once a Year
I I I I
Every 2 Years
Every 3 Years
Every 4-6 Years
No Routine Tests
0.0 5.0 10.0 15.0 20.0 25.0
Pcrcent of those Rcsponding
Figure 15 Planned Frequency of SPS Testing
Another question probed the dependence of SPS availability on the
power system characteristics. Most (73%) responded that the
power system characteristic does not affect SPS availability.
i The SPS design is destined to become obsolete in many systems,
depending on the type of SPS and its design. Therefore, one of the
questions asked how often the SPS design might need to be
examined to assure continued correct operation in view of system
changes. About 82 percent of those responding noted no specific
plans for future design review, although about 13 percent review
their design annually. Other responses were scattered between
these two extremes.
4. SPS Performance
In a previous publication [l], the following performance indices
were presented by CIGRE to measure the historical behavior of the
installed schemes. Three indices were presented and were defined
in [l] as follows:
Successful Operation A scheme operation that achieves the
performance objective of the Bulk Energy System (BES), or better.
Failure A scheme operation that (i) fails to prevent or minimize
the effect of a BES disturbance in the event of a contingency of
severity equal to, or less th:in, that specified or (ii) a scheme
operation that should not have occurred and that results in, or
contributes to, a BES disturbance.
Unsuccessful Operation A scheme operation that fails to prevent
or minimize the effect of a BES disturbance in the event of a
contingency of severity greater than that specified in the design of
the scheme.
Unnecessarv Operation A scheme operation th;it should not have
occurred (i.e., resulted from inadequate discrimination in the
scheme design, equipment malfunction, human error, etc.) and that
does not result in, or contribute to, a BES disturbance. Local
customer interruptions or generating unit outages may occur.
/71 + 11: + / I ;
This is a measure of the extent to which the scheme is effective or
achieves its purpose.
Dependability Index = A
IZ, i/I,
This is a measure of the extent to which the scheme achieves its
designed level of performance.
Unnecessary Operation Rate = 2
/I,,
This is a measure of the vulnerabilitv of the scheme to unnecessarv
30.0 operations (that do not contribute to'BES Disturbances)
Using data from the survey, the following data are derived for all
schemes. Also, a separate calculation is made for the Load
Rejection (L/R) schemes. The three indices defined above are
plotted in Figures 16-18. These results are very similar to those
reported in the 1988 survey except for the Unnecessary Operation
Rate, which has about doubled over the previous report. There is
insufficient data to justify this difference. It is also noted that the
Load Rejection schemes have a much lower Unnecessary
Operation Rate than the totals for a l l schemes.
Operations reported for all the schemes over the seven year period
(1986-1992) can be summ:irized as follows:
n l = successful operations = 1093;
n2 = number of failures = 36;
n 3 = unsuccessful operations = 20;
n4 = unnecessary operations = 306;
Using the CIGRE definitions, performance indices have been
calculated for Generation Rejection (G/R) and Load Rejection
(L/R) schemes. These schemes were selected because together
they account for about 32.4% of the total (G/R=21.6%,
L E = 10.8%).
Figures 16-18 show the Effectiveness, Dependability and
Unnecessary Operation Rate for both G/R and L/R schemes. For
comparison purposes the perfoririance indices from the CIGRE
1987 survey are also shown on the same figures. From these
figures it can be observed that the performance of GIR schemes
continue to be effective and dependable, while the performance of
L/R schemes appears to have deteriorated. Regarding unnecessary
operation rate the trends for G/R and L/R schemes appear to have
reversed.
Effectiveness Index
G/R Schenics
L/R Schemcs R 1992
70.0 75.0 80.0 85 0 90 0 95.0 100 0
Ef'l'cc-tivcnrss i n Pcrccnl
Figure 16 Effectiveness Index Results

Using the foregoing definitions, the enumeration of operations are

defined by the following symbols.

Dependahility Index
G/R Sclicinrs
L/R Schelllcs
8n.n 85.0 90.0 95.0 1nn.o
Diyciidabilily iii Perccii~
Figure 17 Dependability Index Results
I
Unnecessary Oiieration Rate
I
-
I I
LIK Sclicmcs
0.0 0.2 0.4 (1.6 0.8
I
1.0
0pcr;itiims per Ywr
Figure 18 Unnecessary Operation Rate Results
In this report, a distinction is made between conventional
Underfrequency Load Shedding Schemes (ULS) and Load
Rejection (L/R) Schemes. ULS schemes disconnect the loads
through the action of normal system protections in response to
certain system conditions (examples: system underfrequency,
undervoltage, overcurrent). On the other hand, L/R schemes are
defined as the deliberate disconnection of preselected loads
through special control actions designed to maintain stable and
acceptable operating conditions following certain contingencies. It
is expected that most utilities now employ some form of ULS.
However, the results indicate that many utilities, for one reason or
another, did not include them in their reply to the questionnaire.
5. Future Activity
There is considerable interest in developing methods of reliability
analysis for SPS systems that take into account the unique
characteristics of these systems. Many of the newer systems are
digital, which means that both hardware and software failures must
be evaluated. The current efforts in standards development are
helpful in this regard, but may not entirely meet the requirements
of the SPS designer. These concerns will probably be the focus of
future activities in the professional societies.
Another area of interest is the development of guidelines for
reliability assurance. The reliability requirements for SPSs are not
uniform, varying from country to country, and even varying within
countries that have more than one operating utility. Some utilities
are given definite guidelines, or even requirements, to be met,
while others rely on their best judgment as to the adequacy oftheir
SPS. This is a complex issue and is not likely to be solved easily.
However, this would be an excellent activity for professional
deliberation and possible action, such as the creation of guidelines
for SPS design, reliability evaluation, and performance monitoring.
It has been noted that the cost of SPS failure is very high, and the
industry will surely have high interest in assuring reliable
performance of these important systems.
6. Acknowledgments
The authors wish to thank a11 those who contributed to this effort,
especially those who took the time to complete the questionnaires.
This type of activity would not be possible without the cooperation
of many engineers, a n d we hope that they find the results of the
survey to be worth the effort they put forth. The entire engineering
community is indebted to them for their u n i q u e contributions.
We also recognize the unique contribution of CIGRE and IEEE in
making this joint effort possible. Without this type of cooperation,
many individuals would have been contacted twice, and asked to
complete different questionnaires. We are fortunate that the
duplicate effort w a s discovered, almost by accident, and that the
1171
two efforts were combined. This gave both societies a broader
coverage than they would have had from individual efforts and the
survey results will be available tc) inore engineers through
publication by both societies.
The authors also acknowledge the excellent assistance of Jaime
Libaque of Ontario Hydro and Simon Magbuhat of Power Math
Associates in their compilation of data and iInillysis of results that
are an essential part of this report.
I
7. References
1. Winter, W. H., and B. K. LeReverend, "Operational
Performance of Bulk Electricity System Control Aids,"
Electra, n. 123, March 1989, p. 97-101.
2. ASChE, Guidelines for Hazard Evaluation Procedures, The
Center for Chemical Process Safety, American Institute of
Chemical Engineers, New York, 1985.
3. Christensen, James H., and Odo J. Struger, "Programmable
Controller Software Architectures for Advanced Machine
Diagnosis,," IEEE Trans. on Industry Applications, IEEE,
New York, Jan./Feb. 1985.
4. Livison, Nancy G., "Software Safety: What, Why, and How,"
Association of Computing Machinery, Computing Surveys,
June 19861.
5. Balls, Basil W., Allan B. Rentcome, and James A. Wilkenson,
"Specification and Design of Safety Systems for the Process
Industries," 8th International System Safety Conference, New
Orleans, 1987.
6. Programmable Electronic Systems in Safety Related
Applications, Volumes 1 and 2, Her Majesty's Stationery
Office, London, 1987.
7. Redmill, F. J., Dependability of Critical Computer Systems,
guidelines produced by the European Workshop on Industrial
Computer Systems (EWICS), Elsevier Science Publishers,
Ltd., Londlon, 1988.
8. Frederickmn, Anton, A., "Fault Tolerant Control Systems for
Use in Safety Applications," ISA/88 International Conference,
Houston, 1988.
9. Smith, Steven E., "Triple Redundant Fault Tolerance: A
Hardware..Impletnented Approach," 5th Annual Symposium
on Microprocesscir-Based Protection Systems, London, 1988.
10. Pre-standard: DIN V VDE 0801: Principles for Computers
in Safety-Related Systems (Grundsatze fur Rechner in
System mit S i c h e r h e i t s a u f g a h e n ) , Deutsche
Electrotechnische Kommission im DIN und VDE, Germany,
1989.
11 Meffert, Karlheinz, "Principles for Computers in Safety-
Related S:ystems, Advisory Committee on Safety (ACOS)
Workshop on Safety Related Control Systems, Institute of
Electrical ]Engineers (IEE), Savoy Place, London, 8-9 March
1989.
12 Clark, B. J. and G. R. Ward, "The Application of
Programmable Electronics Systems to the Control of
Machinery: The Scene in Europe," ACOS Workshop, see [3].
13 Lagana, Tom, "Guidelines for Sxfe Automation of Chemical
Processes, ACOS Workshop, see [3].
14. Balls, Basil W., "Determination of Specified Availability for a
Process Plant Safety Protection System," Control Expo,
Chicago, 1989.
15. Goble, William M. "High Availabtlity System for Safety and
Performance - The Coverage Factor," Annual Programmable
Controller Conference and Exhibit, Philadelphia, 1989.
1172
16. Bell, Trudy E. and Karl Esch, "The Space Shuttle: A Case of
Subjective Engineering," IEEE Spectrum, IEEE, New York,
June 1989.
17. International Electrotechnical Commission (IEC) Draft
Standard: Software for Computers in the Application of
Industrial Safety-Related Systems, IEC reference: 65A
Secretariat 94), IEC, 1989.
18. IEC Draft Standard: Functional Safety of Programmable
Electronic Systems: Generic Aspects: P a r t 1, IEC
reference: 65A Secretxiat 96, IEC, 1989.
19. Balls, Basil W. and Paul Grund "Design Considerations for
High-Risk Safety Systems," InTech, Official Journal of the
Instrument Society of America, Research Triangle Park, NC,
v. 38, n. 5, May 1991.
20. Smith, Steven E., "System-Level Reliability Analysis for
Applying Fault Tolerant Controls," ISA CHEMPID Spring
Symposium, Edmonton, Alberta, April 29, 1991.
21. Billinton, Roy and Ronald N. Allan, "Continuous Markov
Processes," Reliability Evaluation of Engineering Systems,
Concepts and Techniques, Longman Scientific & Technical,
Harlow, Essex, England, 1983, p. 225-52.
22. Redmill, F. J., Dependability of Critical Computer Systems,
Elsevier Applied Science, Barking, Essex, England, 1989.
23. ISA Committee Report, Programmable Electronic Systems
(PES) for Use in Safety Applications, ISA-dS84.01, Draft
OA, July 1992.
24. Klinger, M., W. A. Mittelstadt, and C. W. Taylor, "Transient
Stability Controls Used by Bonneville Power Administration
to Mitigate Delays of Planned Facilities," CIGRE paper 32-01
presented at the 1982 session, Paris.
25. Taylor, Carson W., "Hydro Generator Tripping in the Pacific
Northwest for Stability Enhancement," a paper presented as
part of a Generator Tripping Panel discussion at the 1983
IEEE PES Summer Meeting, Los Angeles, July, 1983.
26. Alexander, G. E., ;ind T. IJ Patel, "Severe Line Outage
Detector (SLOD) Generation Reduction Scheme for a
Generating Station," IEEE paper 85 SM 323-1, presented at
the IEEE PES Summer Meeting, Vancouver, July 1985.
27. Lubkeman, D. L., and G. T. Heydt, "The Application of
Dynamic Programming in a Discrete Supplementary Control
for Transient Stability Enhancement of Multimachine Power
Systems," IEEE paper 85 WM 056-7, presented a t the IEEE
PES Winter Meeting, New York, February, 1985.
28. Ohura, Y., K. Matsuzawa, H. Ohtsuka, N.Nagai, T. Gouda, H.
Oshida, S. Takedil, and S. Nishida, "Development of a
Generator Tripping System for Transient Stability
Augmentation Based on the Energy Function Method," IEEE
paper 86 WM 117-6, presented a t the IEEE PES Winter
Meeting, New York, February 1986.
29. Doudna, J. H.,"Application and Implementation of Fast
Valving and Generator Tripping Schemes a t Gerald
Gentleman Station," IEEE paper 87 SM 459-1, presented at
the IEEE PES Summer Meeting, San Fran
30. Gove, Erwin H., "Reliability Improvements to Special
Stability Controls on the Pacific AC Intertie," contribution to a
panel session, IEEE PES Summer Meeting, S a n Francisco,
July 14, 1987.
31. Yamamoto, N., "Reliilhility Analysis of the IPP Contingency
Arming Scheme," contribution to :I panel session, IEEE PES
Summer Meeting, San Fr;incisco, J ~ l y14, 1987.
32. Clerfeuille, J. P., "The Defence Plan a t EDF," contribution to a
panel session, IEEE PES Summer Meeting, S a n Francisco,
July 14, 1987.
33. Doudna, John H., "Reliability Maintenance of Special
Stability Controls," contribution to a panel session, IEEE PES
Summer Meeting, San Francisco, July 14, 1987.
34. Neudorf, E. G., "Ontario Hydro's Bruce Load and Rejection
Scheme - Reliability Considerations," contribution to a panel
session, IEEE PES Summer Meeting, San Francisco, July 14,
1987.
35. Beshir, M. J., J. H. Gee, and R. L. Lee, "Contingency Arming
System Implementation for the Intermountain Power Project
HVDC Transmission System," IEEE Paper 88 SM 643-9,
presented at the IEEE PES Summer Meeting, Portland, July
1988.
36. Knight, U. G., "The Control of Power Systems, During
Disturbed and Emergency Conditions," CIGRE Study
Committee 39, CIGRE, Pwis, 1989
37. WSCC Relay Work Group, "Guide for Remedial Action
Schemes," Western Systems Coordinating Council, Salt Lake
City, Utah, April 1991.
38. Bhuiyan, M. R., A. E. Taylor, and N.C. Kezman, "Designing
the Hardware and Software of the Pacific HVDC Intertie
Remedial Action Scheme Using a Programm;ible Controller,"
A paper presented a t the IEEE T&D Conference, D$las, 1991.
39. Perrachon, M., "Les Autqmates de Sauvegarde du Reseau
d'HydpQuebec," CIGRE paper 3A-06, presented at the
CIGRE conference on Electric Power Systems Reliability,
September 16-18, 1991, Montreal.
40. Trudel, G., "Les Automatismes de Reseau: Un Complement
Essentiel Pour Ameliorer La Fiabilite du Reseau d'Hydro;
Quebec," CIGRE paper 3A-10, presented at the CIGRE
conference on Electric Power Systems Reliability, September
16-18, 1991, CIGRE Pub. 338-91, Montreal.
41. Craven, R. H., "Reliability Improvements via the Application
of Special Control Actions," CIGRE paper 3A-07, presented
a t the CIGRE conference on Electric Power Systems
Reliability, September 16-18, 1991, CIGRE Pub. 338-91,
Mon trea I.
42. Lau, P. C. K., M. S. Grover, and W. H. Tanaka, j'Reliability
Assessment of Special Protec,tion Systems," ClGRE paper 3A-
11, presented a t the CIGRE conference on Electric Power
Systems Reliability, September 16- 18, 1991, Montreal.
43. Treewittayapooni, C., "Experiences on EGAT's Dircct On-
Line Load Shedding Scheme," CIGRE paper 39-301,
presented at the 1992 Session, 30 August-5 September, 1992,
Paris.
44. Trotignon, M., C. Counan, F. Maury, J. F. Lesigne, F.
Bourgin, J. M. Tesseron, and J. Boisseau, "Defence Plan
Against Major Disturbances on the French EHV System,:
Present Realization and Prospects of Evolution," CIGRE
paper 39-306, presented :it the 1992 Session, 30 August-5
September, 1992, Paris.
45. Charman, Charles E. and Jeffray W. Littman, "A Generation
Shedding Scheme for the Jim Bridger Steam-Electric Plant,"
presented a t the 19th Annual Western Protective Relay
Conference, Spokane, Washington, October 21, 1992.
 1173

Appendix 1 the following questions for each scheme, and attach the
completed questionnaire to the appropriate one-page
IEEE AND CIGRE description. The description should describe briefly what
QUESTIONNAIREON SPECIAL PROTECTION action the SPS is designed to perform (or what reaction it is
SCHEMES designed to prevent), briefly how this is accomplished, and the
geographical extent of hardware involved in the SPS. A
Foreward: Electric utilities throughout the world have designed, diagram would be helpful.
installed, and gained operating experience with control aids that
have been designated Special Protection Schemes (SPS). Such 2. Reports to the power industry on ,SPS experiences and
schemes are also commonly referred to as Special Stability information (through IEEE and CIGRE) will be most valuable
Controls or as Remedial Action Schemes. This questionnaire has if complete information can be conveyed. Is there any reason
been prepared by CIGRE and IEEE Working Groups to collect why we (can not use some of the information about your SPS
information on the specification, design, evaluation, and/or that you are providing in your response to the following
operating history of these schemes. The Special Protection questions?
Schemes of interest are those designed to aid power system 0 Yes
stability (or prevent instability) or to control the system behavior U No
following large disturbances that might otherwise cause extensive
loss of load or threaten system collapse. Examples of Special Note: The IEEE and CIGRE Working Groups participating in
Protection Schemes include the following: this survey will not divulge the name of the utility providing
information, but will only summarize the data in a statistical
1. Dynamic braking sense.
2. Discrete control of excitation system forcing
3. Controlled system separation 3. Has the lSPS described in your response to the questionnaire
4. Load shedding ever been described ,in the published technical literature
5. Series capacitor insertion (IEEE, ASME, CIGRE. etc)? If it has, please provide paper
6. Discrete control changes of HVDC systems titles, reference numbers, conference names, dates, etc.
7. Turbine bypass valving
8. Momentary and sustained turbine fast valving
9. Generator tripping
10. Combinations of the above 4. Would you or someone from your o r g a n i d o n be available to
participate in a panel session presenting experience with SPS's
Definitions and Performance Indices at a future IEEE PES meeting? If so, please list the name of
the participant and your preference of meetings that you would
Response most likely be able to attend.
Event Description vs. Requirement
Operation*
Number of
of
Performance
Design
Specification
-
Events 5. Do you k:now of other SPSs at other utilities in your region? If
Successful Performance Within or in so, please name the company and a possible contact person
Objective Excess of (telephone numbers would be appreciated).
Achieved Design Operation
Specification is
Unsuccessful Fails to Severity Required
n3 Prevent Greater and 6. When was the SPS described in #1 first utilized (e.g., placed
or Minimize Than Specified Special in service, armed, etc.) and made a part of your system
Effect of in Protection operation?
Disturbance Design of Scheme
Scheme
1-
Severity Equal
1s
h r d

Failure
Fails to
Prevent or
Minimize
or Less Thun
Specified in
I Operate
7. Is the SPS described in #1 presently being utilized?
0 Yes
U hfo

I
Effect of Design
Disturbance; 8. If "no," why is it no longer utilized?
No IJ Revised design criteria
n2 Operation No Severe IJ Changed expectations
Intended; Contingency Special 0 System has outgrown need
3pei-ationCont or Protection fl Bad experience with design
ribiites Con ti ngency Scheme IJ Operator objections
o Disturbance Should Not
Unnecessary No Operation 0 CJther(exp1ain)
Did Not Operate,
n4 Intended; Require but is
NO Sontrol Action Armed to Please provide the operating history of the SPS over as many
Contribution 9.
Operate years as possible?
o Disturbance
*Nc that -
1986 1987 1988 1989 1990 1991 1992
Number of Countuble Event C erations = N = n1 + n 2+ n3 +n,
Successful Operations n,-
Note that the events defined in the table refer to events that occur
when the system is armed. This clarification is necessary since Unsuccessful Operation n3-
some SPS's are enabled and disabled by the system operator
depending on the system condition. Failures to Operate n-
Unnecessary Operations n4
1. Please provide a separate one-page description of each SPS
with which you have experience. I f this includes more than
one such scheme, please prepare a description and complete Annual % of Time Armed __ _I ,-
1174

10. Please provide any measures of SPS reliability performance

that you have defined or used to classify the SPS operation.
a US$100,000 to $500,000 per failure (ffS00,OOO-
2,S00,000)
(For example, frequency of failure to operate, frequency of IJ More than US$S00,000 per failure (ff2,500,000)
false operations, etc.)
Also state the magnitude of the disturbance caused by failure,
for example, the amount and duration of load lost, system
separation, or other effects.
11. What is the most dominate cause of failure or problems (e.g.,
human error, hardware failure, design oversight, etc.)
HumanError
0 Incorrect SPS setting 16. Please provide a rough estimate of the cost to design,
0 Hardware failure construct, install, and commission the SPS?
0 Software failure 0 Less than US$lOO,OOO (ff500,OOO)
fl Inadequate design
fl Other, explain: Cl From US$$100,000 to 1,000,000 (ffS00,OOO-
5,000,000)
0 More than US$l,OOO,OOO (ffs,ooo,ooo)

12. What is the primary effect on the power system if the SPS
fails to perform its designed function?
0 Instability of one or more machines
17. What would have been the alternative to the use of the SPS for
0 Lossofload your system (e.g., new transmission line or lines, generation
reduction, power transfer curtailments, etc )?
0 System separation
0 Voltage Instability or Collapse

18. What consideration was given to reliability criteria in the

Comment
If LOSSof Load is checked, please estimate or report the
following items:
MW-minutes of unsupplied energy MW-min
Approximate Annual System Peak Load MW
13. It would be helpful to have at least qualitative information
regarding the cost of an operational failure of the SPS, as
described in question 12. This need not be a detailed estimate.
The following scale is provided for corivenience.
0 Less thanUSS10,OOO per failure (ffS0,000)
- US$10,000 to $100,000 per failure (ff50,OOO-
500,000)
fl
- US$100,000 to $500,000 per failure (ffSO0,OOO-
2,500,000)
0 More than US$SOO,OOO per failure (ff2500,OOO)
Please note the type and magnitude of the disturbance caused
by failure, for example, the amount and duration of load lost,
system separation, or other effects, if this is possible.
14. What is the effect on the power system if the SPS operates
falsely or improperly, that is, i t operates in response to a
system condition where it should remain quiescent?
0 Instability of one or more machines
IJ Loss of load
0 System separation
0 Loss of one or more generating units (but not through
instability)
0 System disturbance (classify: minor, moderate, severe)
Comment:
If Loss of Load is checked, please estimate or report the
following items:
MW-minutes of unsupplied energy MW-min
Approximate AnnuaISystem Peak Load MW
15. It would be helpful to have at least qualitative information
regarding the cost of a security failure of the SPS, as described
in question 14. This need not be a detailed estimate. The
following scale is provided for convenience.
0 Less thanUS$IO,OOO per failure (ff50,OOO)
0 US$lO,OOO to $100,000 per failure (ff50,OOO-
soo,ooo)
design of the SPS. Check all answers that are appropriate.
IJ Specific reliability criteria were set by a regional
reliability council
0 Specific reliability criteria were set by the utility, in
cooperation with neighboring utilities
0 Specific reliability criteria were set by the company
0 No specific reliability criteria were set by any authority
0 Reliability criteria were not specified numerically, but
only as a general statement of the desire for
dependable opera tion
What reliability criteria were specified for the design of the
SPS?
19. What type of reliability analysis was performed for the SPS?
Check all that apply.
0 A fault tree analysis was performed for qualitative
review
0 A fault tree analysis was performed for quantitative
review
IJ A Markov model of the system constructed and
evaluated
0 A network model of the system was evaluated
0 The probabily of failure was computed
0 The frequency of failure was computed
a The mean duration of failure was computed
0 A Failure Modes and Effects Analysis was performed
0 No reliability modeling was performed
0 No reliability measures were computed
a No component reliability data were available
0 No component reliability data were available, but
estimated data were used
a Any other type of analysis (not listed above) Describe
20. If numerical Computations were performed, as described in
#1Y, were these results compared with the reliability criteria
stated in #18?
a Yes
a No
If the answer here is "Yes," please briefly explain the
comparison.
 1175
If the answer here is "No," why was this not done? 28. What is the frequency of testing to validate the continued
There were no stated requirement criteria reliable operation of the SPS?
IJ There was no requirement to make this comparison. 0 Test once a year
21. Is redundancy of subsystems used in the SPS design?
a Test once every months
IJ Test once every years
fl Yes 0 Routine testing is not performed
a No
If the answer here is "Yes," please describe briefly. Explain:

~ ~ ~ ~~~

If the answer above is "No," why was redundancy not used 29. Are there specific power system characteristics that affect the
availability of ths SPS?
in the design? IJ Yes
0 NON

22. Was redundancy given as a design requirement? Explain:

0 Yes
Cl No
If the answer here is "Yes," please describe briefly. 30. How often do you require a new evaluation of the SPS design
to assure the correct response in view of system changes?
0 Review the design annually
23. If no numerical calculations of SPS reliability were performed, fJ Review the design once every __years
how was the design checked to verify adequacy of
performance and how was this adequacy defined?
a There are no specific plans for design review

Explain:

24. Is a quantitative reliability analysis of SPS required by a

government, industry, or other authority for the projects with
which you are familiar? Appendix 2 ]ParticipatingUtilities
0 Yes The following participating utilities are listed in alphabetical order
0 No of the home country of the utility:
a Don'tknow Hydra-Electric Commission of Tasmania (Australia)
Explain, if necessary: The Electricity Trust of South Australia (Australia)
Pacific Power (Australia)
Queensland Electricity Commission (Australia)
State Electricity Commission of Victoria (Australia)
25. What is your assessment of the actual reliability of the SPS Electrobras (Brazil)
compared to the computed reliability or reliability expectation Alberta Power Limited (Canada)
of the SPS (i.e,, better, worse, the same)? British Columbia Hydro and Power Authority (Canada)
0 Better Hydro Quebec (Canada)
Manitoba Hydro (Canada)
Worse New Brunswick Power (Canada)
IJ Same Ontario Hydro (Canada)
Comment TransAlta (Canada)
SaskPower (Canada)
26. Based on your SPS experience, and provided a situation arose Electric Power Research Institute (China)
where the application of another SPS might be an appropriate ELKIRAFT (Denmark)
alternative, how would you characterize your consideration of Electricit6 de France (France)
a new SPS? National Grid Company (England)
Electricity Supply Board (Ireland)
IJ SPS would be chosen if its cost was less than other ENEL SpA (Italy)
alternatives (identify which costs are most important: Chubo EPCO (Japan)
initial cost, operating cost, present worth cost, etc. Chugoku EPCO (Japan)
IJ SPS would be chosen if its cost and reliability were EPDC (Japan)
both comparable to other alternatives Hokuriku EPCO (Japan)
0 SPS would be chosen only if it were more reliable than Kansai EPCO (Japan)
other alternatives, regardless of cost differences Kyulshu EPCO (Japan)
0 SPS would not be considered under any circumstances. Shikoku EPCO (Japan)
Tohoku EPCO (Japan)
Explain: Tokyo EPCO (Japan)
KEF'CO (Korea)
Trans Power (NZ) Ltd. (New Zealand)
HVDC Power Transmission Research Inst. (Russia)
27. Please estimate the frequency of occurrence of events that will ESKOM (South Africa)
cause operation of the SPS. Sveinska Kraftnat (Sweden)
0 More than once a year Electricity Generating Authority of Thailand (Thailand)
IJ Onceayear AEP Service Corporation (USA)
a Once every 5 years Arizona Public Service Company (USA)
0 Once every 10 years Bonneville Power Administration (USA)
0 Unable to estimate the frequency Floi:ida Power & Light Co. (USA)
Indianapolis Power & Light (USA)
Los Angeles Department of Water & Power (USA)
1176

Montana-Dakota Utilities (USA)

Montana Power Company (USA)
Nebraska Public Power District (USA)
PacifiCorp (USA)
PJM (USA)
Southern Company Services (USA)
TU Electric (USA)
United Power Association (USA)
Biographies of the Authors
B. K. LeReverend was born in Ontario and holds a degree in
Electrical Engineering from the University of Toronto. He has
been with Ontario Hydro for 26 years in the Power System
Operations Division. As the Technical Studies Manager, he has
been responsible for establishing systems or predicting reliability
performance of power systems as well as providing other technical
services. He is also 21 member of the Canadian Electrical
Association and Vice Chair of its Power System Planning and
Operations Section.

P. M. Anderson was born in Iowa and holds the B.S., M.S., and
Ph.D. degrees i n Electrical Engineering from Iowa State
University. He has worked for a utility, taught E.E. at Iowa State
and Arizona State, and served a s a Program Manager for EPRI. He
is currently principal engineer at Power Math Associates, Inc., a
consulting engineering firm in San Diego, California.

Discussion
NAVIN B. BHATT
American Electric Power Service Corporation
Columbus, Ohio :
The authors have done a great service to the utility industry by
compiling the historical performance record of special protection
schemes employed around the world.
The discusser participated in the IEEE/CIGRE survey cited in the
paper by providing response with regard to momentary fast turbine
valving (MFTV) employed on AEPs two 1300 MW Rockport
units [A]. The purpose of this discussion is to update
developments regarding the Rockport MFTV. On February 8,
1994, we had the first set of system conditions, since Rockport
MFTV was put in operation in December 1989, for which the
Rockport MFTV was designed to operate. These system
conditions included a multi-phase fault on the Rockport-Jefferson
765 kV circuit with Rockport Plant at full output (2600 MW). The
MFTV equipment on both Rockport units operated as expected,
and the units remained in service. We are analyzing the dynamic
response of the Rockport generators during this incident in detail.
Needless to say, we are quite pleased with the appropriate
operation of the fast valving, as well as other protection schemes
employed at Rockport. We are interested in knowing how many
such successful fast valving operations have taken place across
North America or the world? We would like to hear from those
who responded to the IEEEKIGRE survey with regard to the
turbine valve control special protection scheme and others
knowledgeable in this area.
[A] Pasternack, B. M., and N. B. Bhatt, "The Rockport Plant -
Analysis of Temporary Fast Turbine Valving Tests," IEEE Trans.,
v. PWRS-2, May 1988, p. 529-40.
C. H. DIDRIKSEN
Consultant
Wellesley, Massachusetts :
None of the 111 Special Protection Schemes (SPS) described in
this paper were in use during the Northeast Blackout of November
9, 1965. Our report on that blackout recommended two of these
SPS schemes, Underfrequency Load Shedding and System
Separation. Our report also recommended regional system
information be made available at the Control Centers.
In our study of the 1965 Northeast Blackout we looked at what
others had done to prevent power outages. Utilities in the Los
Angeles area had been using Underfrequency Load Shedding
schemes for a number of years. This made it possible to continue
to supply power to critical facilities, such as hospitals and police
stations, whenever loss of power from Hoover Dam caused a
serious power shortage.
The work done so far on SPS is impressive. But, as this paper
describes in the section of Future Activity, there is still much to do.
A. E. HAMMAD
N. E. Swiss Power Co., Baden, Switzerland :
The authors are to be congratulated for their work that produces
excellent, organized and useful information.
With the utilization of fast-acting equipment that use power
electronics, there may be no sharp distinction between controls that
activate such equipment and power system protection schemes. In
fact, the definition as given in the paper for SPS may easily
encompass static var compensators that are used exclusively to
counteract voltage instability conditions in a power system. Such
thyristor-controlled compensators would be armed all of the time
and must be in a workable' condition (with a prescribed minimum
configuration) whenever they are called upon to save the system
from collapse. This means a reliability level of 100% for such a
minimum configuration. Therefore, these static compensators have
1177
several built-in redundancies both in their hardware and software
components.
The authors cite SPSs in conjunction with HVDC which have been
in use for some time. How would the authors categorize the case
described above since more of such schemes (also some of the
FACTS devices) would be realized soon? Or, perhaps, should the
definition of SPS be more focused?
M. Th. SCHILLING
Eletrobris, Rio de Janeiro, Brazil :
The authors are to commended for a timely paper on a subject that
has not received the attention it deserves. This discussant would
appreciate to know the author's opinion about the recommended
strategy to include the effect of special protection schemes in large
scale composite bulk power system reliability studies as applied in
operations planning. How to combine the fast dynamic effects of
these schemes (security) with the static approach used in
conventional composite reliability analysis (adequacy). The
following list of references is thought to be of related interest.
R1 C. Singlh, A.D. Patton, "Models and Concepts for Power
System Reliability Evaluation Including Protection - System
Failures", IJEPES ,v. 2, n.4, Oct. 1980, pp. 161-168.
R2 R.N. Allan, A.N. Adraktas, "Terminal Effects and Protection
System Failures in Composite System Reliability
Evaluation", IEEE Trans. ,v. PAS-lOl,n.12, Dec. 1982, pp.
4557-4562.
R3 J.A. Buzacott, G.J. Anders, "Reliability Evaluation of
Systems with After Fault Switching", IEEE Trans., v.
PWRS-z!, n.3, Aug. 1987, pp. 601-07.
R4 J. C. Ferreira da Luz. M.G. Santos, A.A.S. Praca, O.R.
Romei, "Generation Dropping Scheme at ltaipu Powef Plant,
50 H z Side", I SEPOPE, paper SP-16, ELETROBRAS, Rio
de Janeiro, Aug. 1987.
R5 C.E.V. ]Pontes, J.C.O. Aires, P.R.G.M. Barros, "Emergency
Control Scheme to Preserve the Priority Loads iq the Light
System", I SEPOPE, paper SP-18, ELETROBRAS, Rio de
Janeiro, Aug. 1987.
R6 E.K. Nielsen et al, "An Operations View of Special
Protection Systems", IEEE Trans., v. PWRS-3, n.3, Aug.
1988, PI>.1078-1083.
R7 R. N. Allan, "Effects of Protection Systems Operation and
Failures in Composite System Reliability Evaluation",
IJEPES;, v. 10, n.3, Jul. 1988, pp. 180-189.
R8 M.S. Grover, Y.L. Chan. "Methodology for Reliability
Assessment of Special Protection Systems During the Design
Stage", 17th Inter-Ram Conference for the Electric Power
Industry, Hershey, Jun. 12-15,1990.
C. W. TAYLiOR
Bonneville Power Administration, Portland, Oregon :
As chairman of the IEEE Special Stability Controls Working
Group that co-sponsored this work, I thank Dr. Anderson and Mr.
LeReverend {fora job very well done.
Several publications of the Special Stability Controls Working
Group provide additional description of these controls [A-D].
The future will likely see increased use of special stability controls
as cost-effective methods to increase transmission network
utilization, and to ensure power system reliability for infrequent
emergencies Presently available and future technologies such as
digital controls, digitdl communications, artificial intelligence, and
on-line transient stability analysis will increase the attractiveness
1178
of these controls. For transient stability, generator tripping is an
important control, and the feasibility or generator tripping is
increased by proliferation of gas turbine generation (steam turbines
are more difficult and costly to trip or fast valve). Voltage stability
problems have added new applications [E,F].
As described in the paper, reliability of the special controls is a
concern, with several approaches taken for reliability assurance.
More formal reliability analysis may be used in the future, along
with probabilistic (value-based) power system planning and
operation [GI.
Adequate reliability can be generally ensured by design. Large
scale special stability controls at BPA now use redundant sensors,
redundant communications, and triple redundant (voting)
computers [HI.
A. IEEE Committee Report, "A Description of Discrete
Supplementary Controls for Stability," IEEE Trans., v. PAS-
97, n. 1, Jan./Feb. 1978, p. 149-65.
B. IEEE Committee Report, "Turbine Fast Valving to Aid
System Stability: Benefits and Other Considerations," IEEE
Trans., v. PWRS-1, n. 1, Feb. 1986, p. 143-53.
C. IEEE Committee Report, "Bibliography on the Application of
Discrete Supplementary Controls to Improve Power System
Stability," IEEE Trans., v. PWRS-2, n. 2, May 1987, p. 474-
85.
D. IEEE Committee Report, "HVDC Controls for System
Dynamic Performance," JEEE Trans., v. PWRS-6, n. 2, May
1991, p. 743-52.
E. Taylor, C. W., "Concepts of Undervoltage Load Shedding for
Voltage Stability," IEEE Trans., v. PWRD-7, n. 2, Apr. 1992,
p. 480-88.
F. E E E Power System Relaying Committee, System Protection
and Voltage Stability., IEEE publication 93 THO 596-7
PWR, 1993.
G. Pereira, M. V. F., and N.J. Balu, "Composite Generation/
Transmission Reliability Evaluation," Proc. IEEE., v. 80, n.
4, Apr. 1992, p. 470-91.
H. Dodge, H. D., W. Doel, and S. Smith, "Power Systemstability
Control Using Fault Tolerant Technology, I S A
Instrumentation in Power Industry, v. 33, 33rd Power
Instrumentation Symposium, May 21-23, 1990, paper 90-
1323.
P. M. Anderson and, B. K. LeReverend :
The authors are pleased by the response provided by the several
discussions. We feel that active discussion on this subject can be
beneficial for the entire electric power community, as we share our
experiences on these critical matters of special protection and
control.
Mr. Bhatt provides an interesting review of new operating data
from their fast valving scheme and asks for information regarding
other similar schemes. This kind of exchange is sure to be
beneficial to all concerned, and we would also encourage this type
of one-on-one contact among SPS designers and operators. Fast
valving was a subject of great concern from the mid 1970's to the
mid 1980's in both IEEE and ASME, and was the subject of a joint
publication, of the two societies in 1985 [l]. It was also discussed
in a CIGRE paper at the 1986 session [2]. Since these publications
on the subject, little has been written on the subject to the authors'
knowledge. It seems appropriate that, as an industry, we keep
monitoring the performance of these important schemes. The
report by Mr. Bhatt is particularly welcome for this reason.
Mr. Didriksen provides valuable historical insight into the
development of special protection schemes following the 1965
Northeast Blackout. These schemes have apparently worked well
and are a credit to the designers of that time. The reference to the
underfrequency protection used in the Los Angeles area is also
interesting, and apparently goes back in time for a number of years.
Dr. Hammad raises a very interesting question as to the distinction
between Special Protection Schemes and controllers used for
power electronic devices that have the capability of fast response
and possibly of preventing or mitigating serious system upsets. It
is true that some of these devices have the capability of providing a
much needed control action in response to a system disturbance.
However, the controls for these devices are not usually designed to
respond to a predetermined emergency condition, which is the
reason for installing Special Protection Schemes. It must be
acknowledged, however, that such special control features could be
added to power electronics devices to provide assistance under the
prescribed emergency. In many cases, however, a device such as a
static var compensator, might provide the desired type of
corrective action without special programming. The actions taken
by the SPS are often of a somewhat heroic dimension, such as
dropping generation, opening lines, or shedding load. These
actions are beyond the ordinary types of control actions, and are
last ditch efforts to save the system from total collapse. It will be
interesting to see if the designers of power electronics devices will
add these types of control actions in the future, some of which may
require operating the devices above their normal ratings for brief
periods.
It should also be noted that, despite redundancy in the design of
power electronics devices, their reliability is not 100% as this is
impossible. In fact, redundancy in software does not improve
reliability at all unless special programming is performed on the
redundant codes.
Dr. Schilling raises the question of the inclusion of Special
Protection Schemes in large scale composite power system
reliability studies as applied to operations planning. This is an
excellent question, and it would be a valuable addition to
composite reliability programs if suitable reliability models of the
devices can be developed. Reliability of these devices was the
motivation of the joint task force effort and it is hoped that this will
be followed by greater emphasis on reliability modeling. Schilling
also makes the correct obseryation that it is the stability features of
these schemes that are the most important in many cases, not just
their adequacy. This type of analysis must await the development
of analytical tools to compute the probability of instability. The
adequacy assessment we can do now, using primitive models of the
protective system unreadiness [3]. The added references provided
by Dr. Schilling are greatly appreciated.
Mr. Taylor's comments are noteworthy. There seems to be a
world-wide trend in power systems that makes any new
transmission system additions very difficult to construct. The
design and implementation of SPS's may provide a way of
achieving the desired system loading while still maintaining a
reasonable level of reliability. We appreciate the reference to the
redundancy requirements of the schemes designed for the
Bonneville system. This should be encouraged in the design of all
systems, in addition to comprehensive reliability analysis of the
protection scheme. Redundancy alone does guarantee high
reliability and is not a substitute for rigorous reliability analysis to
determine the probability, frequency, and duration of SPS failure.
The added references cited by Mr. Taylor are a welcome addition
to the discussions on this subject.
In reflection, the authors have learned several lessons from the
collection and analysis of the data from the SPS survey. One point
that stands out is the very high cost of failure of these systems.
There is no way to determine the average cost, but the questions
we posed, being multiple choice questions, did not anticipate the
very high costs that would be reported. Clearly, the failure of these
schemes can be a very serious and costly matter. Another thing
that was striking is that, despite the high cost attributed to failure of
the SPS's, a very small percentage of respondents reported any
effort to determine the probability, frequency, or duration of SPS
failure. These two highly-contrasting results are not clearly

understood. It may be that the methods of reliability analysis of
such systems is not well known. It is also possible that the
designers simply did not think such analysis was necessary. After
all, normal protective systems for power system components are
not usually subjected to detailed reliability analysis. In retrospect,
the authors believe the survey was worthwhile and that we can
learn from this type of process. It would be appropriate to consider
repeating this survey in a five years or so to identify any trends or
changes in the application of these important controls.
Finally, the authors would like to thank all of the discussers for
their valuable comments. It is through discussions of this type that
we can better appreciate the dimensions of the task of designing
and operating these complex systems. It is likely that we will be
seeing more of these systems in the future, and the reliability of
these systems will be of great interest to the operating utilities.
1179
Report on a panel discussion sponsored jointly by the IEEE
Discrete Supplementary Controls Working Group and the
ASME/IEEE Power Plant/Electrical System Interaction
Working Group, "Turbine Fast Valving to Aid System
Stability: ]Benefits and Other Considerations," IEEE paper 85
SM 468-4, presented at the IEEEPES Summer Meeting, July
14-19, 1985, Vancouver, B.C.
Debelle, J., G. Schatzmann, and F. Van de Meulebroeke, "Fast
Controlled Valving: Determination of the Speed
Characteristics of the Control Valves," CIGRE paper 39-15,
1986 session.
Anderson, P. M., and S. K. Agarwal, "An Improved Model for
Protective-System Reliability," IEEE Trans. on Reliability.
v. 41, n. 3, Sept. 1992.
Manuscript received April 18, 1994.