Back at the ranch, part 2

On Tuesday, I received emails from two knowledgeable people, commenting on Monday’s post. The emails were both fairly long and detailed, but both people made some very good points (they both have a lot of experience to draw on). Here are the comments from the first of those people. I’ll put up the comments from the second person next week.

The first commenter was Andrew Gallo of Proven Compliance. He was formerly the Assistant General Counsel of ERCOT and was the Director of Corporate Compliance of Austin Energy for 11 years. He commented on particular statements in my post, so below I’m reproducing first a statement from my post, and then his comments on it in red.

1) In reference to this sentence in my post: “Had the operators not been able to bring frequency above 59.4 Hz by nine minutes later, a protection scheme called ‘generator under frequency ride-through’ (I hadn’t heard of that, either) would have been automatically activated”, he says:

I’m not an engineer but this is my understanding as a person who has worked in the industry a long time.  I understand generator “ride through” to be when a generator does “ride through” a system event (like a frequency drop). Generator control systems are set in such a way as to not trip during momentary fluctuations of voltage or frequency. When voltage or frequency recovers quickly, the generator “rode through” the event. If it’s not a short-lived event, the generator’s protection scheme will trip off the generator to protect it from physical damage.

Andrew is clarifying that this protection scheme really works at the generator level – it’s not something triggered on a system-wide level, as I had thought.

2) In my post, I said “ERCOT is technically not regulated by FERC, although they do enforce a lot of the FERC and NERC requirements – including all of the NERC CIP requirements – anyway.” In this statement, I misspoke. I really meant to say that ERCOT follows FERC and NERC reliability requirements (including all NERC CIP requirements) voluntarily, although I was wrong about the voluntarily – they are a NERC entity and have to follow them. Enforcement of those requirements in ERCOT’s service area (i.e. on the utilities as well as ERCOT itself) is the responsibility of the Texas Reliability Entity, which at one point was part of ERCOT but separated about ten years ago.

However, Andrew pointed out that FERC doesn’t regulate markets in ERCOT (so they bear no blame for the $9,000 price!), because Texas’ grid is separated from the Eastern and Western Interconnects. This makes it exempt from FERC’s market regulations. But the NERC Reliability Standards (including the CIP standards) potentially apply to all power entities in the US (and certain provinces in Canada, at the discretion of the individual province) – except for those that don’t own or operate assets that are part of the Bulk Electric System.

3) Regarding my discussion of ERCOT’s blackstart plan, Andrew says:

ERCOT does have a system-wide blackstart plan and ERCOT is regulated by FERC (for reliability; the ERCOT market is not regulated by FERC). ERCOT must comply with the NERC Reliability Standards per the Energy Policy Act of 2005.

4) Andrew continued by making notations on my post in red (so what’s in black below is from my post):

The writer of the article wondered about this and checked out what ERCOT has said. He found that “there is a reference saying ERCOT has a black start plan, but it has never been used since there has never been a system-wide blackout.” Fair enough, but the plan should be tested regularly through non-intrusive means. Was this done?  [Yes. See below] The writer couldn’t find any reference to drills. [See below]

…In fact, he found another reference that said “…there are 13 units capable of black start operations in ERCOT, but six of those units experienced outages because of the extreme weather.” In other words, even if the blackstart plan had been tested, it might not have worked if needed, probably because the plan was written in anticipation of a hot-weather outage, when the generation would still all have been available. [Yes, all the blackstart units would have to be available to fully restore the grid; the units that were available could have re-energized their “islands.” Additionally, I believe there are other black start units in the ERCOT Region but ERCOT may not have contracted with them for black start service. Those units may have been available (although I don’t know if they were).]

He later provided some information on ERCOT’s blackstart tests and the generator under-frequency ride-through protections:

• I believe ERCOT tests its blackstart plan every two years w/ a simulation
• ERCOT has a blackstart plan template as Section 8(E) of the Nodal Operating Guides for utilities to use when they provide black start service
• Per the ERCOT Operating Guides (Sec. 2.6.1), Transmission Operators must have Under-Frequency Load Shedding (UFLS) relays set to shed load as follows:
• 5% of load automatically sheds at 59.3 Hz
• 15% of load automatically sheds at 58.9 Hz
• 25% of load automatically sheds at 58.5 Hz
• Per ERCOT Nodal Operating Guides Sec. 2.6.2, generators must have UFLS relays set as follows:
• > 59.4 Hz – generator cannot trip (i.e. the generator must ride through the frequency drop)
• 58.4 – 59.4 Hz: generator can be set to trip after 9 minutes or more
• 58.0 – 58.4 Hz: generator can be set to trip after at least 30 seconds
• 57.5 – 58.0 Hz: generator can be set to trip after 2 seconds
• < 57.5 Hz: No delay 

• Thus, the information in your blog about ERCOT having ~9 minutes to correct the frequency drop seems correct (so long as the frequency was <59.4; in which case generators would have begun automatically tripping off-line after ~9 minutes). 

Andrew then came back with some further clarification of the generator ride-through:

…the concept of “ride through” applies to generators. The gist of it is ERCOT wants to ensure generators don’t trip randomly and in an unsynchronized way. Thus, the ERCOT Nodal Operating Guides (Sec. 2.6.2) require generators to ride through frequency drops down to 59.4 Hz. Once the frequency gets to (or below) 59.4 Hz (and above 58.4 Hz), the generator must ride through at least 9 minutes. If the frequency drop lasts > 9 minutes, the generator can trip.

Now you know why you read my blog: People have to explain stuff to me in great detail – and repeatedly – for me to finally understand it. If I were really “Tom Alrich, Boy Engineer” (rather than just playing him on TV), you wouldn’t see half of this. Worth every penny you pay me, right?

Comments by Kevin Perry, former Chief CIP Auditor, SPP Regional Entity

Andrew said all of the black start units needed to be available to fully restore the grid.  I disagree.  All units would have to be available to fully restore the grid as quickly as possible per the written and tested plan.  Otherwise, as Andrew noted, there will be multiple islands that then need to be knitted together.  And there will be segments of the grid that are not energized but will need to be in order to bring the island boundaries together.  That will take some time to accomplish because the engineers will need to plan a new cranking path from an island to get energy to a unit to be started.  Once you get a unit up and stable in a blacked out TOP’s grid segment, “initial restoration” is complete and the TOP continues to bring up load and generation as the assets and conditions permit.

Remember, some entities plan on receiving cranking power from a neighbor if all else fails.  And some only have neighbors in their plan, having no declared black start units of their own.  But each TOP is normally expected to bring up its own island and await coordination at the regional level to knit the islands together.

Knitting together islands is planned for in the regional plan and the TOP’s plan.  It requires phase angle synchronization, which is accomplished at substations equipped with synchroscopes and protective relays that will not allow breakers to be closed unless the phase is within synchronization tolerance.  Those are usually the tie substations.  The same equipment is used at a generating plant when bringing a unit online.  Now, if you are connecting to a de-energized grid segment, synchronization is not necessary.  In all cases, you still have to be balancing load and generation in order to maintain frequency and voltage stability as you bring the grid back up.

Any opinions expressed in this blog post are strictly mine and are not necessarily shared by any of the clients of Tom Alrich LLC. If you would like to comment on what you have read here, I would love to hear from you. Please email me at tom@tomalrich.com.