A4 Annex
A4 Annex 44
Major incidents
throughout the
throughout the world
world
A.4.1 Introduction
A.4.2 France: incident of 19 December 1978
A.4.3 France: incident of 12 January 1987
A.4.4 Quebec: incident of 18 April 1988
A.4.5 Italy: incident of 24 August 1994
A.4.6 United States: major power failures
of summer 1996
A.4.7 Major power failures of 2003
251
©RTE 2004
EDF - Cordemais fossil-fired power plant
252
©RTE 2004
A Annex 4 - Major incidents
throughout the world
A.4.1 INTRODUCTION
Power system operating reliability is a constant challenge. Despite the existing
lines of defence at the level of the different power systems, the latter are not
shielded from widespread incidents, leading to large-scale customer load
shedding operations.
No-one has forgotten the incident that the French system sustained on 19
December 1978, when 75% of national load was affected. This incident, not a
recent one to be sure, is the most serious that EDF has experienced since the
end of the post-war period of shortage.
Less than a decade later, the incident of 12 January 1987, initiated by the
successive tripping of the generation units at Cordemais, near Nantes, where
the power supply to the west of France was interrupted, was a reminder to
power system operators to be watchful.
Since then, several other widespread incidents have occurred all over the world
and deprived millions of customers of electricity. Particular mention can be
made of the sizeable power failures that hit Quebec in 1988, the southern half
of Italy in 1994, the west of the United States in 1996 and, more recently, the
incidents in 2003 which affected the eastern part of the United States and
Canada, as well as southern Switzerland and the whole of Italy.
These events remind us how more or less important anomalies in the system
of defence can combine to seriously jeopardise System reliability, due to the
four phenomena described in § 2.3 and often a combination of them:
- cascade tripping,
- voltage collapse,
- frequency collapse,
- loss of synchronism.
Analysing how some of these major incidents occurred helps illustrate these
phenomena and gain a better understanding of their causes.
Although the defence systems and the measures taken by the various
companies differ, an in-depth look at these incidents and the succession of
events that led to the total or partial collapse of the network generally provides
many lessons about malfunctions that arose on the lines of defence set up, as
well as on the improvements that it would be advisable to make.
253
©RTE 2004
Part of the French grid still live
at 8.26 a.m. on 19 December 1978
immediately after the first collapse
BELGIUM
MERY
GERMANY
MARMAGNE
SWITZERLAND
EGUZON
BAYET
ITALY
TRICASTIN
SPAIN
Voltage trend on the 400 kV grid
in the west of France
during the incident of 12 January 1987
Voltage
t (min)
254
©RTE 2004
A Annex 4 - Major incidents
throughout the world
A.4.2 FRANCE: INCIDENT OF 19 DECEMBER 1978
(CASCADE OVERLOADS AND COLLAPSE OF MOST OF THE NETWORK)
On a day that was cold and overcast, the load escalation proved to be more rapid
and higher than forecast (38,500 MW dispatched). All available generating
facilities were used to the maximum of their possibilities (active and reactive) and
over 3,500 MW were imported from neighbouring countries, mainly Germany.
The rise of the load increased the already high transits, from the east to the Paris
region and, as a result, voltages turned out to be extremely low in a large part of
the network (Paris region, west).
Starting at 8 a.m., overloads were observed on the grid and, at 8.06 a.m., an
alarm "overload 20 minutes" appeared on the Bézaumont-Creney 400 kV line in
the east of France. Despite various switching operations on the network topology,
this overload was unable to be reduced and the line tripped due to the action of
its protection at 8.26 a.m.
Upon load transfer, three 225 kV lines tripped due to overload.The four generation
units at Revin were subsequently disconnected from the grid (due to their current
protection). A 400 kV interconnection with Belgium then tripped and the voltage
dropped further. The tripping (hard to explain) of a new 400 kV interconnection
with Belgium was accompanied by a further voltage drop and the loss of stability
of a large part of the grid. The next phase witnessed the opening of lines and
tripping of generation units (notably due to their voltage minimum and frequency
minimum protection devices). Isolated sub-networks formed, where the
generation-load balance could not be restored (insufficient load shedding,
generation unit outages).
75% of consumers were disconnected, although the south-eastern part of France
and areas in the vicinity of the northern and eastern borders remained connected.
Many generation units did not successfully trip to house load.
An initial power restoration was too rapid and led to a further collapse of the
network at 9.08 a.m. A more careful recovery, relying on hydro generation units
and imported power permitted almost complete network restoration at about
midday. Customers sustained power cuts lasting between 30 minutes and 10
hours.
This incident, resulting from a tight management of the network (high transits
and low voltages in some areas) and a cascade of overloads, clearly showed that
the defence plan at that time was unable to cope: automatic load shedding
operations were insufficient, the tripping of generation units occurred too soon
on voltage minimum criteria and the dividing up of the network was not
successful. Service restoration was also not satisfactory.
A great many actions were undertaken after this incident to improve all these
deficient areas.
255
©RTE 2004
A Annex 4 - Major incidents
throughout the world
A.4.3 FRANCE: INCIDENT OF 12 JANUARY 1987
(VOLTAGE COLLAPSE AND POWER CUTS IN THE WEST)
Although 12 January was a particularly cold day (the "extreme cold" alert had
been sent out since the previous Friday), all available generation units started up
and managed to ensure a satisfactory generation margin (5,900 MW) and normal
voltage in the west (405 kV at Cordemais).
Then, in the space of a single hour, from 10.55 to 11.42 a.m., Cordemais generation
units 1, 2 and 3 broke down due to independent causes (failure of a sensor,
explosion of an electric coupler pole, shutdown due to a fire). The last unit
available, which would have been sufficient to maintain the voltage in the zone,
tripped as a result of inappropriate adjustment of the maximum rotor current
protection and the disturbance created by the outage of unit n° 3.
The loss of Cordemais generation led to a sudden drop of voltage to 380 kV in the
area. It stabilised for about 30 seconds, but the automatic on-load tap changers of
the 225 kV/HV and HV/MV transformers, while attempting to restore a normal
voltage, triggered a rise in load and the voltage again began to drop quickly. In a
matter of minutes, nine thermal generation units near the area tripped
successively, giving rise to a loss of power of 9,000 MW and maintaining the
voltage downward trend. Load shedding was then carried out and, at 11.50 a.m.,
the voltage steadied, but at a very low level in the west, less than 300 kV. In view
of this extremely precarious situation, which jeopardised the national grid, the
dispatching centre decided to shed a load of 1,500 MW in Brittany and the region
of Angers, bringing the network voltage back to its normal level.
As of noon, the situation was well under control and the voltage of the network
could now be restored. It would be lengthy because of the difficulty in
reconnecting a sufficient number of generation units close to Brittany and
Normandy, which did not trip to house load during the incident. It took until night-
time to fully restore the power supply to these regions, when two and
subsequently three generation units were again in operation at Cordemais. At the
most serious time, the outages reached a capacity of about 8,000 MW.
The main cause of this incident can be attributed to a lack of quality of adjustment
of some System components, in particular of the voltage regulators and
associated protection devices of generation units. The corresponding functions
are now dealt with under quality assurance. The automation of some actions
(blocking of on-load tap changers), the reduction of load shedding execution time
(by means of remote load shedding) also appeared indispensable following this
incident.
256
©RTE 2004
A Annex 4 - Major incidents
throughout the world
A.4.4 QUEBEC: INCIDENT OF 18 APRIL 1988
(LOAD SHEDDING OUTAGE AND COMPLETE COLLAPSE OF THE NETWORK)
All day long on 18 April 1988, a strong storm beat down on the northern coast
of Quebec. In the evening, at about 8.10 p.m., a series of short-circuits, due to
snow and ice covering insulators, occurred at the Arnaud 735 kV substation,
causing the separation of the Churchill Falls power plant from the Hydro-
Québec network. The network load at that time was 18,500 MW (to which must
be added 2,600 MW in exports to neighbouring grids) and the power generated
by Churchill Falls 3,800 MW.
The safety automatic control devices intended to initiate load shedding did not
work. The Chamouchuane-Saguenay line tripped in a matter of seconds
following the start of the incident. Other generation units tripped in turn and
the whole network collapsed like a house of cards.
Load restoration took a total of over 8 hours.
QUEBEC: 18/04/88
COMPLEXE LA GRANDE
CHURCHILL
ARNAUD
CHAMOUCHOUANE
SAGENAY
QUEBEC AREA
MONTREAL AREA
2,600 MW
TO THE
UNITED STATES
257
©RTE 2004
A Annex 4 - Major incidents
throughout the world
At 8.30 a.m. the next day, a similar fault occurred, again depriving the grid of
power from Churchill Falls. Fortunately, the remote load shedding automatic
control device had been repaired during the night and worked correctly this
time, avoiding a further collapse of the network. Although different customers
had to be cut off in turn for five hours to shed a load of 600 MW, this operation
helped confine the event.
Of course, the Quebec power system is quite different from the French system.
This incident nevertheless highlights the determining role played by customer
load shedding actions so as to limit the extension of major incidents. These
actions serve to supplement the fundamental action of the frequency primary
control installed on the generation units, the purpose of which is to reduce the
imbalance between and generation and load and avoid the collapse of the
frequency (and of the network). In similar cases, cutting off a few customers
very rapidly can avoid losing all of them and facilitate restoring supply to those
who had been disconnected due to the initial incident.
A relatively similar incident occurred in Egypt on 24 April 1994, where the much
weaker action than expected of the frequency load shedding led to the complete
collapse of the network.
A.4.5 ITALY: INCIDENT OF 24 AUGUST 1994
(SEPARATION OF THE NETWORK AND COLLAPSE IN THE SOUTH)
The incident of 24 August 1994, at 11.28 a.m., in southern Italy, occurred in a
degraded operation situation during which the operators had decided not to
comply with the "N-1" principle in view of external conditions considered as
propitious: summer period, favourable weather conditions.
The connections linking southern Italy to northern Italy (Rome South) were made
up of (cf. map):
- a 400 kV line Latina - Garigliano,
- a 400 kV line Valmontone - Presenzano,
- a 400 kV line Villanova - Foggia,
- and a 225 kV line Popoli - Capriati.
Generation aspect:
- the three generation units of the Brindisi North power plant (each with a unit
capacity of 300 MW) were limited to 220 MW each owing to cooling water
temperature problems.The Brindisi South power plant (four 600 MW generation
units) was not allowed to operate;
- for the same reasons, the Rossano power plant (four 300 MW generation sets)
was limited to 170 MW per unit.
258
©RTE 2004
A Annex 4 - Major incidents
throughout the world
During the night of 23 to 24 August 1994, a current transformer of the Latina -
Garigliano 400 kV line exploded at Latina, damaging the circuit breakers of other
400 kV lines, notably those of the outgoing feeders to Valmontone and Rome West.
The Rome South - Latina line was shut down for works.
At 11.28 a.m. on 24 August, a fire beneath the Valmontone - Presenzano line caused
this connection to trip. High oscillations between the north and south of Italy were
observed. The Villanova - Foggia 400 kV and Popoli - Capriati 225 kV lines then
tripped, likely due to overload or loss of synchronism, bringing about the formation
of an insufficient separate network in southern Italy.
The frequency variation within this network was about 2 Hz per second, or even
higher, which probably made part of the load shedding frequency drift relays
ineffective and led to the outage of all generation on this network.
This incident caused customers to be cut off (about 4,500 MW) for a period of from
two to two and a half hours.
Even if the Italian network is not so fully meshed as the French grid, the operating
conditions which our transalpine colleagues have to face are not very different
from those encountered at certain periods on the French network near the
Mediterranean. They highlight in particular the importance of the "N-1" rule.
ITALY: 24/08/94
ITALY
Villanova
Popoli
Roma/O Valmontone
Capriati Foggia Brindisi/S
Roma/S
Latina Brindisi/N
Garigliano
Presenzano
Rossano
259
©RTE 2004
A Annex 4 - Major incidents
throughout the world
A.4.6 UNITED STATES: MAJOR POWER FAILURES OF SUMMER 1996
Three major incidents affected the American western network in the summer of
1996, causing its partial break-up and cutting off millions of customers.
It all began on 2 July, in the early afternoon, by a single-phase fault -electric arc
due to contact with a tree- on one of the three 345 kV lines which transmit
electricity from the Jim Bridger power plant in Wyoming (four generation units,
total capacity 2,000 MW) to the State of ldaho (cf. map). This incident occurred
when temperatures are very high in the west of the United States and when
loads and transits between different States are therefore substantial.
During the fault clearance sequence, a second line transmitting power from the
plant tripped due to a faulty protection operation. To avoid the overload of the
last remaining line, a programmable logic controller shut down 1,000 MW of
power plant output. This immediately brought about a considerable voltage
drop in Idaho and initiated a slower voltage drop with oscillations on Pacific
Inertie, made up of all the 500 kV AC and DC interconnection lines linking the
North-West (Washington-Oregon) to the South-West (California).
Twenty-four seconds later, the long Mill Creek-Antelope line tripped due to
overload because of the inappropriate setting of its distance protective system
and, in a matter of seconds, triggered a voltage drop in Oregon.
The incident then became widespread and a cascade of trippings led to the
formation of five separate networks. Thirty-five seconds after the initial fault,
two million customers, representing 12 GW of power, found themselves
without electricity.
On 3 July, this incident occurred again in the same way, but remained confined
to the Boise region, thanks to the load shedding command issued by the control
centre.
On 10 August, a similar incident took place, cutting off 7.5 million customers
representing a load of about 30 GW.
Several factors are the cause of these incidents:
- system operation at the maximum limits,
- faulty maintenance (pruning, protective devices),
- poor performance of generation units under transient operating conditions,
- insufficient exchange of information between partners at the forecast level,
- poor quality of setting of some protective devices.
260
©RTE 2004
A Annex 4 - Major incidents
throughout the world
A report was submitted to the President of the United States, defining five main
lines of progress together with action plans:
- ensure the responsibility of all sectors;
- place stress on System reliability;
- improve information on power system reliability;
- extend the scope of the analyses;
- enhance the professionalism of all those concerned.
On the other hand, these incidents showed that dividing up the networks was an
efficient measure to avoid complete collapse and facilitate service restoration.
UNITED STATES: 2 July 1996
261
©RTE 2004
A Annex 4 - Major incidents
throughout the world
A.4.6 MAJOR POWER FAILURES OF 2003
A number of incident occurrences in 2003 highlighted the issues of security of
supply and of the reliability of power systems.
Concerning the first issue, the revolving load shedding operations that Italy
experienced on 26 June 2003, confirming the California crisis in 2000-2001,
show how failures inescapably occur when generation and transmission
capacities no longer match the load to be supplied.
As for the issue of effective operating reliability, it is illustrated by the two
spectacular power failures presented hereafter.
A.4.7.1 THE AMERICAN INCIDENT (UNITED STATES AND CANADA) OF 14 AUGUST 2003
This power failure affected the Eastern Interconnection (one of the three
synchronous zones of the United States) and part of Canada.The grid concerned
stretches from Dakota to the East coast. Its organisation is complex. Supervised
by the operator Midwest ISO, it is intersected by networks covered by PJM. A
report on the incident referred to the grid as a "Swiss cheese network".
The situation before the incident was said to be sound, although the voltages
were low on First Energy’s network, while remaining above acceptable
minimum values (0.92 pu). The load was high (air conditioning), but the
operators managed to cope with more constraining situations on the previous
days. However, several control centres sustained information system failures,
which hampered the assessment of the risks run and the reaction of the
operators.
At 2.02 p.m., the Stuart - Atlanta 345 kV line tripped due to a contact with a tree,
causing a short-circuit to ground, and locked out. This fact of little importance in
itself was to disrupt a state estimator then in the course of reactivation.
From 3.05 to 3.41 p.m., three 345 kV lines connecting the northern and eastern
parts of Ohio tripped due to electric arcs between these lines and the
surrounding vegetation. The substantial load transfers and weakening of the
voltage plan brought about the tripping of lines and generation units which, as
of 4.10 p.m., occurred successively at intervals of a few seconds. A transit loop
was created from Pennsylvania to New York State, then Ontario and Michigan,
so as to get around the missing links.
The Eastern Interconnection network cut itself off along an east-west line. The
south remained unaffected, but the now isolated north was to sustain new
separations and collapse completely at 4.13 p.m., except for a few islands where
the performance of generation units and load shedding operations managed to
save the situation.
262
©RTE 2004
A Annex 4 - Major incidents
throughout the world
Service restoration was difficult; 19 hours after the incident, 20% of the load still
had to be re-supplied. Two days were needed to restore supply to some parts of
the United States, owing in particular to problems in restarting some generation
units.
The incident affected a total of 50 million people and resulted in the loss of
about 62,000 MW in load in seven American states and Ontario.
The investigation commission attributed the collapse to the combination of:
- an inadequate assessment of the degraded state of the network at First
Energy;
- the application of criteria unsuited to the risks of collapse of First Energy’s
system;
- a lack in dealing with pruning requirements at First Energy;
- the failure of the organisations responsible for the safety of the
interconnected network to make a diagnosis in real time.
A.4.7.2 THE SWITZERLAND - ITALY INCIDENT OF 28 SEPTEMBER 2003
The incident occurred at around 3 a.m., when Italy had a high import balance
and when the exchange capacity with Switzerland and the rest of Europe was
saturated. The Mettlen - Lavorgo 380 kV line in Switzerland was 86% loaded.
According to the reliability studies carried out by the operator ETRANS, the
outage of this line would require curative actions within 15 minutes, including
actions to be carried out by the Italian system operator GRTN.
At 3.01 a.m., there was an electric arc between the line and the surrounding
vegetation and subsequent tripping; reclosing proved to be impossible due to
a too wide transmission angle (42°). Because of a load transfer, another Swiss
line went over to overload. In 24 minutes time, it came into contact with a tree
and tripped.
The incident then got out of control with, in a matter of seconds, the tripping of
another Swiss line due to overload and the automatic disconnection of the
Lienz - Soverzene line connecting Switzerland and Austria. Italy sustained loss
of synchronism and was separated from the rest of the European grid through
the action of distance protection devices on the cross-border lines: considering
the low voltages and high currents, the impedances measured by these
protection devices correspond to the tripping criteria.
In Italy, the frequency immediately fell to 49.1 Hz and the voltage collapsed.
Some generating facilities connected to the distribution networks tripped,
followed by 21 of the 50 main generation units connected to the transmission
network. Frequency load shedding was unable to save the situation; 2mn30s
after the separation, the Italian network was completely dead.
263
©RTE 2004
An aerial view of Europe during the Italian black-out
of 28 September 2003
264
©RTE 2004
A Annex 4 - Major incidents
throughout the world
In the rest of the UCTE network, the frequency rose, but steadied at 50.2 Hz
through the action of automatic primary and secondary frequency controls.
Despite the tripping of some generation units, the incident was contained
thanks to the mostly appropriate reaction of the various power system
components and players.
Italy’s gradual reconnection with its neighbouring countries from 4.05 a.m. to
12.45 p.m. allowed the progressive resumption of imports and network
restoration, from 6 a.m. to 4 p.m. Re-supplying some southern areas took about
twenty hours.
Globally, the collapse affected 57 million people, with a power failure of 28,000
MW lasting several hours.
A.4.7.3 LESSONS DRAWN FROM THE INCIDENTS OF 2003
Feedback from these new incidents has shown the following noteworthy points:
- the way reliability is controlled may differ depending on whether the TSO is
in charge of the transmission infrastructures (case of France) or not (case of
Italy now and of the United States);
- the need to affirm the TSO’s role as conductor, particularly in the most
extreme situations where its orders must be executed without discussion
and delay;
- the indispensable nature of the independence of TSOs with respect to the
other players of the market;
- the need for an adapted reliability reference guide, in its different dimensions:
directives, laws, regulatory provisions, technical reference guide applying to
the TSO as to the other players (producers, distributors, consumers, traders,
etc.);
- the importance of the contractual relations between the TSO and the
producers, distributors and consumers, which require compliance with the
reliability provisions from the stage of connection to the grid to that of
control, by clearly stipulating the commitments of each party and the means
of monitoring these commitments;
- finally, the absolute necessity for strong coordination between TSOs, at the
different time scales concerned.
265
©RTE 2004
