critical condition management CCM applications detect, monitor, and guide human operators through periods of abnormal operation. These applications have become more accepted in process manufacturing, especially in the chemical and petrochemical industries. The properties of these abnormal periods have much in common with the details that have been reported thus far concerning the Eastern US blackout of August, 2003

1. THOUGHT LEADERS FOR MANUFACTURING & SUPPLY CHAIN
ARC INSIGHTS
By Harry Forbes
INSIGHT# 2003-37MP&H
SEPTEMBER 10, 2003
The US Blackout of 2003 is a classic
example which illustrates the need for
effective Critical Condition
Management. Both the process and
power industries have wrestled with
this need, but independently.
2003 Blackout:
A Case for Critical Condition Management
Keywords
US Blackout, Critical Condition Management (CCM), NERC
Summary
CCM applications detect, monitor, and guide human operators through
periods of abnormal operation. These applications have become more ac-
cepted in process manufacturing, especially in the chemical and
petrochemical industries. The properties of these abnormal periods have
much in common with the details that have been reported thus far concern-
ing the Eastern US blackout of August, 2003.
Yet applications for dealing with abnormal situa-
tions have been developed independently in the
process and power industries and without much
awareness in either camp of the related work done
by others. Most major automation suppliers have
partnered with application specialists to deliver
CCM solutions.
In the future, US power system operations, operating policies, and practices
will become much more harmonized among geographic regions. This har-
monization will include more advanced online condition diagnostic tools
such as those developed for critical applications both in the process and
power industries.
0
10
20
30
01530456075
Number of Abnormal Events vs. Minutes Before Blackout

2. ARC Insights, Page 2
©2003 • ARC • 3 Allied Drive • Dedham, MA 02026 USA • 781-471-1000 • ARCweb.com
Analysis
The North American Electric Reliability Council (NERC) sets the highest
level operating policies for the US and Canadian electric grid. NERC is a
policy-making organization, not an agency responsible for the implementa-
tion of policy. Policies of NERC are embodied in their operating manual,
which governs the content of policies and procedures
developed by operating organizations. Thus NERC pol-
icy is implemented by a wide variety of organizations
that exercise the operating responsibility for parts of the
North American electric grid. These same organizations
contribute time and personnel to NERC for the devel-
opment and refinement of NERC policy.
The NERC Control Area Concept
Operation of grid assets is performed by numerous op-
erating entities. Each entity has responsibility for a
particular subset of the grid, referred to as its “control
area”. The control area may include all types of assets (Generation, Trans-
mission, and Distribution) or only some types, such as Distribution
components. The North American grid is the aggregate of all these control
areas, plus the interconnections between various control areas, over which
energy can be transferred.
In the traditional model of a vertically in-
tegrated electric utility, control areas were
highly autonomous and largely responsi-
ble for both the operations and the
reliability of service in their own area. In-
terconnections served merely to enhance
the overall system stability and reliability.
During the 1990s the US government man-
dated open access to the transmission
system and utility companies restructured
toward organizations which would operate
in emerging wholesale electric markets.
NERC Transmission Policy
NERC has as its highest operating policy goal the prevention of cascading
outages such as occurred on August 14th 2003. The preamble to the NERC
Supplier Product Name
Emergin WirelessOffice
Gensym Optegrity
Honeywell @sset.MAX
Matrikon ProcessGuard
Nexus Oz
OSIsoft PI System
PAS AMOplus
Software Products Used for CCM
Control Area 1
Area Power Distribution
Area Power Generation
Area
Transmission
Components
interconnection
Control Area 2
interconnection
Control Area 3
Control Area 1
Area Power Distribution
Area Power Generation
Area
Transmission
Components
Control Area 1
Area Power DistributionArea Power DistributionArea Power Distribution
Area Power GenerationArea Power Generation
Area
Transmission
Components
Area
Transmission
Components
interconnection
interconnection
Control Area 2Control Area 2
interconnection
interconnection
Control Area 3Control Area 3
Conceptual View of an Electrical Control Area

3. ARC Insights, Page 3
©2003 • ARC • 3 Allied Drive • Dedham, MA 02026 USA • 781-471-1000 • ARCweb.com
operating manual states: “All control areas shall operate so that instability, un-
controlled separation, or cascading outages will not occur as a result of the most
severe single contingency."
The term “most severe single contingency” refers to any potential failure
that causes a disturbance within the control area. Any such event, no mat-
ter how serious, cannot be allowed to destabilize the control area. At any
time if any single such event would destabilize a control region and/or its
interconnections, then that control regions is no longer operating within
“single contingency coverage”. It is the responsibility of regional system
operators to manage their power system configuration so that these abnor-
mal conditions are avoided. If their operations move outside this
boundary, the NERC operating poli-
cies specifies that they may remain in
this state for a maximum of 30 min-
utes. Furthermore the NERC policies
regarding emergency operations dic-
tate that a control area experiencing or
anticipating an operating emergency
shall communicate its status to
neighboring systems. These commu-
nications are to include notification of
conditions such as the lack of single
contingency coverage.
Events of the August 2003 Blackout
The complete sequence of events that occurred on August 14th 2003 is be-
ing investigated in detail by numerous agencies. Nevertheless, key events
leading up to the blackout have been detailed by NERC, AEP, and ITC
(which owns and operates transmission assets in Michigan). Some of these
event chronologies are listed on the websites of these organizations.
The sequence of abnormal events began at about 2 PM with a trip of a 550
MW generating unit. The sequence of events then follows a classic pattern
as the both the number and severity of abnormal events continue to build
during the next two hours and 11 minutes (see the Figure on Page 1). Dur-
ing that time system operators had to deal with the continuing degradation
of the power transmission system they were charged with operating.
Shortly before to 4:11 PM the abnormal events arrived in a virtual ava-
t=0 t=30
Control area
can withstand a
first contingency
event.
Time in Minutes
Operating Security
Limit Violation
Occurs
Control area
CANNOT
withstand a first
contingency
event.
Must be < 30
minutes.
Control area
can withstand a
first contingency
event.
t=0 t=30
Control area
can withstand a
first contingency
event.
Control area
can withstand a
first contingency
event.
Time in Minutes
Operating Security
Limit Violation
Occurs
Control area
CANNOT
withstand a first
contingency
event.
Must be < 30
minutes.
Control area
can withstand a
first contingency
event.
Control area
can withstand a
first contingency
event.
The NERC Single Contingency Coverage Criterion

4. ARC Insights, Page 4
©2003 • ARC • 3 Allied Drive • Dedham, MA 02026 USA • 781-471-1000 • ARCweb.com
lanche. Plotting the cumulative number of abnormal events versus their
time to before the blackout began shows that operators were confronted
with a continuously changing power system configuration during the entire
evolution of the sequence. Only two periods between major abnormal
events were longer than 15 minutes.
Key Questions Remaining To Be Answered
The international investigation of the blackout is likely to fork into two dis-
tinct areas of study. The first and simpler task is to assemble and
reconstruct the physical events that transpired, including the transient
loads on various equipment and the reasons for equipment responses. This
will be a matter of weeks, not months. The second, and far more difficult
task, will analyze both the communications between control centers and the
actual operator actions in terms of their conformance to written operating
procedures. The task force must also determine if the existing procedures,
had they been scrupulously followed, could have prevented the events
which eventually transpired. The answers to these questions will lead to
concrete recommendations concerning future policy changes, but that sec-
ond task will take months, not weeks. The US Congress is not likely to wait
that long before making up its own mind and taking some action of its own.
Recommendations
• Both CCM systems and procedures for emergency operation must be
periodically tested to insure their feasibility and effectiveness.
• Human factors in abnormal operation are as critical as automation func-
tions.
Please help us improve our deliverables to you – take our survey linked to this
transmittal e-mail or at www.arcweb.com/myarc in the Client Area. For further
information, contact your account manager or the author at hforbes@arcweb.com.
Recommended circulation: All MAS-P and H clients. ARC Insights are published
and copyrighted by ARC Advisory Group. The information is proprietary to ARC
and no part of it may be reproduced without prior permission from ARC.