Are We Prepared

Against Blackouts
During the Energy
Tr risitic~n? By

Probabilistic
Risk- Based /h~.. ~
Decision
Making
Encompassing
ii
1,1
j~I

IL’
$1
— I

Jointly Security
and Resilience

MANY MAJOR TRANSMISSION

power grids’ blackouts occurred world
wide, including grids with modern in c6H1JrTuMSivCt(co,4S~NDR

frastructure, since the infamous one

affecting parts of North America in 1965. Blackouts have had
devastating social impacts (deaths, chaos, and severe discom
fort due to disruption in sectors dependent on electricity, such
as heat, transport, water, and communication) and economic
impacts (exorbitant costs stemming from, e.g., the loss of pro
duction and equipment damage). The postmortem analysis of
Digital Object Identifier l0.1109/MPE.2023.3247053
Date of current version: 19 April2023
blackouts reveals root causes and enhances the understand
ing of grid operation, triggering organizational and technical
improvements. Blackouts will continue to happen, at least
because the complex grid neither was planned nor can be op
erated to cope with massive natural disasters damaging sev
eral grid components. However, despite previous experiences,
there have been recurrent but avoidable blackouts due to the
lack of fuffilling or inefficient handling of N-i security, which
degenerated into cascading outages.

may/june 2023 1540-7977/23©20231 EEE IEEE power & energy magazine

 The world is transitioning to sustainable electricity grids, (lightning, flashover leading to short circuits, and com
powered by variable renewable generation. This digitalization- ponent failure), extreme weather hazards (e.g., floods,
enabled energy transition is producing major transformations wildfires, and storms), and man-made hazards (e.g.,
in the grid, notably a massive penetration of distributed en terrorism and cyberattacks); some hazards have not
ergy resources (DER5) (e.g., renewable generation) interfaced been foreseen or utilized in grid design due to budget
with the grid through power electronics. This transformation limitation and exorbitant associated costs.
radically changes the known grid dynamics, generates new A power grid cannot operate 100% securely, i.e., be
forms of instability, and requires rethinking grid operation, fully secured with respect to any possible contingencies and
control, and markets. In this context, new threats and atypi potential blackouts; such an attempt is cost-prohibitive if at
cal vulnerabilities of grids, not yet experienced by operators, all physically feasible, while establishing this percentage of
may materialize. Accordingly, the lessons learned from past security is still a difficult open question. Accordingly, the grid
blackouts serve little during the energy transition. To reliably is operated in practice at a tradeoff between the operation
succeed in the energy transition, one needs better anticipation cost and desired security level. This tradeoff is set by the so-
and cautiousness than seen so far. called N-i security criterion, which states that a grid with N
available components must~ be able to withstand at anytime
Why Blackouts Occur, Root Causes the failure of.ány. single component (e.g., a power. line or a
Classification, and Principles of generator) (see Figure 1). Withstanding contingencies iiicliide
Security and Resilience operator-initiated rule- or software-based corrective actions
The transmission power grid is a vital and complex infrastruc (e.g., grid topology control, generators, and redispatch) and
ture that underpins our society; therefore, it needs to operate automatic closed-loop controls. The ongoing grid digitaliza
securely but also at a reasonable cost. Security, or operational tion fosters corrective actions to the detriment of more costly
reliability, is the power grid’s ability to withstand distur preventive actions (decided before real time) but increases
bances, e.g., contingencies (unexpected failures of system decision-making compl~xit~’.
components), with an uninterrupted electricity supply. Ensur A blackout is an unplanned complete interruption of power
ing security is a difficult task for operators due to the follow in a certain area that lasts for an indeterminate period. Many
ing reasons: blackouts with catastrophic societal and economic effects
v’ the mathematical and physical complexity of phenom (e.g., hospitals, railways, airports, traffic, water supply, and
ena occurring in the grid wastewater treatment) occurred all over the world in the last
V the diversity of threats that power grids are exposed five decades. The average estimated societal cost of black
to (see Figure 1), such as plausible/frequent hazards outs (e.g., economic losses from lost output and damage)
is huge, e.g., hundreds of deaths
__________________ and US$130 billion for the Texas
blackout in 2021, dozens of deaths
Man-Made Hazards and US$6 billion for the U.S.
(Cyberattacks errorism ...)
blackout in 2003, and US$1.2 bil
lion for the Italy blackout in 2003.
Two classes of root causes of
blackouts can be distinguished.
Generator 1 Generator 2 Generator 3 V The first is a temporary
or permanent asset failure
N-3 ~ N-3 (e.g., due to short circuits).
Such a credible event is the
major cause of most black
outs. The common sequence
of events in such a blackout
starts with the failure of a
grid component, which de
teriorates operating condi
tions beyond the limits that
grid-automated protections
can tolerate, leading to a fast
and uncontrollable cascade
of components trips, in
figure 1. Threats to power grid operation and two examples of contingencies cluding power lines, power
(N-i and N-3). plants, and loads (e.g., entire

IEEE power & ener~y rna8azine may/june 2023

 feeders in a substation due to underfrequency or under- security beyond N-i failures as their ultimate goal is to keep
voltage load-shedding protections or stalling of induc the lights on.
tion motors). Figure 2 illustrates the relationship between security and
The second is several (e.g., k) damaged or failed assets resilience via the likelihood and impact of events. Note that
during a short period of time, the common mode being they differ in terms of event probability but overlap to some
some natural disaster (e.g., hurricanes and floods). extent in terms of impact. Specifically, poorly managed ordi
The blackouts in the first category are due to the opera nary events (N-i contingencies) may also lead to high-impact
tors not satisfying, as required, the N-i security criterion, blackouts, as will be justified later.
including subsequent contingency handling that may not be
efficient or timely. The security was not met either deliber Salient Features of and Lessons
ately (including human error to factor in last-minute changes Learned From Some Major Blackouts
in the system) or due to large forecast errors and grid model The arduous work of experts released detailed documents
and inaccuracy in decision-making tools as compared to the analyzing each blackout, including the chronology of events,
real world. Should N-i security have been met, the blackout lessons learned, and mitigation measures. The main specifici
would have been avoided. This situation is worrying as it is ties of some notable blackouts are briefly highlighted for each
a recurrent pattern in most blackouts, and we have not yet class of root cause.
learned enough from it. In addition, as will be argued later, the
operation variability with a large share of renewable genera Blackouts of Power Grids
tion requires adopting a probabilistic assessment and manage Operating N-i Insecurely
ment of security. The first major blackout, affecting 25 million people and last
The blackouts in the second category occurred as the ing 13 h, took place in the northeast United States in 1965. It
power grid was not designed or operated to withstand implau was triggered by a defective protection relay that tripped, at
sible beforehand N-k (k> 1) contingencies, i.e., the failure of peak load, a healthy transmission line, leading immediately to
two or more grid components (see Figure 1). In the best case, fast overload cascade line outages and blackouts. This black
the operators could plan actions to mitigate but not fully avoid out is the richest in lessons and subsequent innovations. Spe
the impact of such blackouts. However, extreme events are cifically, Dr. Tom Dy-Liacco pioneered the concept, deployed
no longer deemed implausible or singular because worsen soon after, of a modern power grid control center, based on
ing climate change has resulted in recurrent extreme events the supervisory control and data acquisition and energy man
(e.g., natural disasters) and blackouts over the past decades agement system, a framework for computer-aided security
in various and unexpected places worldwide. This situation assessment and control using system states (normal, alert,
has spurred a growing interest of both researchers and utili emergency, in extreme circumstances, and restorative). It also
ties to further explore N-k (k> 1) security but also thoroughly determined the deployment of underfrequency load shedding.
address grid restoration. The combined consideration of N-k The blackout in the northwest United States on 2 July 1996,
(k> 1) security and grid restoration has recently been named was provoked by the faulty trip of a power line, which led
resilience. Resilience is defined as the power grid’s ability to to fast voltage depression causing generation and 11 GW of
mitigate and recover after extreme damaging events (natural load disconnection. This event primarily highlights the impor
disasters) of low probability and high impact. In other words, tance of fast reactive power compensation and raises aware
in operation, “resilience = N-k (k> 1) security + grid resto ness about voltage instability. Accordingly, fast-switching
ration.” While N-k (k> 1) security
has received substantial research
attention in the context of black- Event
Probability
outs, with various cascadmg out
age simulators being developed
for its assessment, transmission
grid restoration has been under- High Ordinary Event
addressed, as testified by the (Pertain to N 1 Securi
research literature.
This deficit constitutes a game
changer in setting an adequate Medium
level of grid security. Note that
even today, when operation risk is Low xtreme N-k (k > 1 vents ertain to esc ence
deemed high, e.g., under adverse
No/Low Medium High Event Impact
weather (a forecasted storm) or
stressed operating conditions, figure 2. The relationship between security and resilience regarding event
operators assess and may maintain likelihood and impact.

may/june 2023 lIFE power & ener~~y ma~’azine

 capacitor banks and undervoltage load-shedding control were
installed. Furthermore, the event raises awareness about hid
den failures (e.g., protection relays that erroneously trip a
healthy and more critical line and the failure of a breaker to
disconnect a faulty line), the major cause of disturbances in
the United States and a subject that has received substantial
research interest.
The intricate Italian blackout in 2003, affecting 56 million
people for up to 16 h, happened at night, so at a low load, while
Italy was massively importing power (around 7 GW), mostly
from Switzerland and France. The initiating event was a line
trip, due to a flashover caused by a tree, in Switzerland, which
overloaded two lines in Switzerland. These lines tripped after
an unsuccessful attempt by the Swiss operator to reduce the
overload, including tardy communication and coordination
with the Italian operator aimed to reduce the power import.
Consequently, the largest chunk of power import (4 GW) was
flowing instantaneously from France. This action overloaded
the interconnection lines between France and Italy, also ensu
ing in very low voltages at Italian substations. The intercon
nection lines tripped in a matter of seconds, isolating Italy
with a large power deficit from the rest of the European sys
tem. Consequently, generators in Italy lost synchronism and
tripped, ensuing in a complete blackout. This blackout teaches
us about the following situations:
The role of exchanging information in day ahead (e.g.,
for congestion forecast) and real time between opera
tors of interconnected transmission grids (e.g., Europe)
is important since electric phenomena can spread wider
beyond a country’s border.
Every operator must maintain the same N-i security
level in the interconnected European system; at that
time, Italy maintained security only through preven
tive actions, while Switzerland also allowed correc
tive actions.
This blackout also highlighted the high complexity and some
times counterintuitiveness of power flows in the operation of
big meshed interconnected grids.
The root cause of the European blackout in 2006, which
occurred outside peak load and affected 10 million people,
was a human error consisting of the deliberate disconnection
of a power line without reassessing grid security online. This
error left the grid in an N-i insecure situation, triggering cas
cading overload line tripping. This event led to the European
transmission grid splitting into three independent subsystems,
for a period of 2 h, and automatic load shedding to keep the
power balance in each subsystem. The N-i security criterion
was again not fulfilled, and the impact of this disconnection on
the security of the network was not properly, if at all, assessed.
The largest blackout to date in terms of the number of
people affected (more than 620 million) took place in 2012 in
the inadequately reliable power system of India, in a context
where the country already had issues with generation short
age to meet demand. The blackout occurred similarly twice,
in two consecutive days, at peak demand. The trip of an
ower & eI?er~,’y I,,al4a7ine
overloaded line caused a chain reaction of several line outages
within seconds, resulting in a blackout. On the first day, it
took 15 h to restore 80% of service. The next day, the system
failed again for the same reason, and the restoration process
ultimately succeeded.
In 2015, Turkey experienced the fastest blackout to date,
with the entire power grid collapsing in a few seconds after
the initiating failure, leaving 70 million people in the dark
for several hours. This blackout was again caused by human
error; despite four important lines being in outage for mainte
nance, the grid operated N-i insecurely.
Recently, a low-impact blackout occurred when the Euro
pean grid split on 8 January 2021, due to a fault in Croatia, fol
lowed by a cascading overload outage of more than 10 power
lines. All these outages occurred in fewer than 43 s, triggering
the curtailment of a 1 .7-GW load. Given the large number of
disconnected lines, the system’s automated protection reacted
rather well, saving the system from worse consequences.
Last but not least, sometimes blackouts occur while the
transmission grid is already weakened by multiple scheduled
line outages (e.g., Turkey and India). Although this is to a good
extent business as usual (but it needs enhanced scheduling
accounting for the renewable generation effect on power flows),
it should be accurately considered in security calculations.
Blackouts of Grids Operating Purposely
With Limited Resilience
It is hard to quantify how resilient a grid is and set an adequate
level of resilience as these depend on a huge set of poten
tial sequences of low-probability contingencies assumed to
happen. The meshed grid structure ensures redundancy and,
together with intricate control loops, naturally allows the
grid to withstand the loss of some combinations of two or
more components.
The blackouts of grids operating rightfully with limited
resilience were produced by multiple correlated trips of com
ponents under the following conditions:
i” normal weather
b’ adverse weather (natural disasters) damaging grid
I
infrastructure
Three prominent examples of the former cause are ad
dressed next.
The Southern Brazil blackout in 1999 was the largest power
outage to that date, affecting more than 80 million people. It
was caused by a lightning strike on an electricity substation,
causing most of the power lines connected to the substation
to disconnect simultaneously. Accordingly, many generators
automatically shut down in the absence of transmission lines
available to ship their power to load. The main lesson of this
blackout is to pay attention to the remedial actions to faults
impacting an entire substation, where several lines can be
connected, or a busbar of it.
The blackout of parts of North America and Canada in
2003, which affected 50 million people and interrupted
60 GW of load, initially had a slow development. After the
may/june 2023
first generator trip, for approximately 1 h, a few normally
loaded lines tripped unexpectedly due to tree contact pro
voked by untrimmed vegetation. Then, fast cascade outages
occurred, resulting in collapse. The operators could have had
time to take remedial actions, but they lacked situation aware
ness of unfolding operating conditions as the state estimator
and real-time security assessment were not functional. This
blackout emphasizes, among other things, the importance of
the adequate visualization of emergency conditions, under
pinning remedial actions in the control center, and prompted
research in this direction.
The U.K. blackout in 2019, affecting more than 1 mil
lion customers, was initiated by a line disconnection due to
a lightning strike. During the transient period, a few wind
farms, interfaced with the grid through power electronics, did
not ride through fault and tripped suddenly, leaving the grid
with a power production deficit. In addition, three small gas
power plants, responsible for restoring the power balance def
icit, tripped due to an erroneous overspeed signal. The lesson
drawn is how sensitive to unusual operating conditions and
how little understood is renewable generation, controlled by
power electronics, as compared to conventional synchronous
generators. This blackout highlights the difficulty of trading
off grid codes (legal contracts of mandatory simplicity) and
the technical requirements of renewable generation to ride
through multiple successive voltage drops.
Some key blackouts caused by natural disasters,
which damaged multiple grid components and affected
smaller regions and a number of people for a long time,
are the following.
Hurricane Sandy left around 10 million people without
power in the United States in 2012 for up to two weeks.
Flooding and downed trees damaged vulnerable areas, cutting
their power supply.
The Australian blackout in 2016 occurred during a very
rare heavy storm, during which two lines tripped due to
fault. The grid experienced unusual electric transients during
which many power electronics-controlled wind farms did not
respond according to the grid code, either tripping or reducing
substantially their power production. These events overloaded
a key interconnector and caused its subsequent trip, splitting
the grid and resulting in a blackout. Two wind farm owners
were fined around US$1.2 million for their negative role in
the blackout. As in the U.K. blackout in 2019, the capacity
of wind power generation to ride through unusual transients
is in question.
The state of Texas, which is not connected electrically
with the rest of the U.S. grid, experienced during two weeks
in February 2021 a highly unexpected massive shortage
of power production (e.g., around 13 GW at the peak, the
demand being the highest ever recorded) due to a severe win
ter storm causing extremely low temperatures and the freez
ing of some generating equipment. Rolling blackouts were
implemented by operators to equitably share the available
power; still, 5 million people were not supplied for several
may/june 2023
days. Several hundred people died, and the cost of the black
out was estimated at US$155 billion. Two main lessons were
learned. First, one needs to redesign the electricity market to
avoid the huge profit (in billions of U.S. dollars as the whole
sale market price was almost 20 times larger than normal) of
some energy firms as well as the bankruptcy of other firms.
Second, one needs to profoundly rethink and enhance grid
resilience. “Winterizing” the power sector in Texas remains
a big challenge.
Finally, the recurrent natural disasters occurring in many
places over the world, e.g., Chile (earthquakes), the United
States (hurricanes and tornados), and Greece (wildfires),
clearly indicate the need for a systematic approach.
To summarize, the contingencies causing blackouts are
generally correlated and conditioned, and therefore, of non-
negligible joint probability, as in the case of hidden failures in
protections. Very rarely, a blackout is caused by uncorrelated
contingencies of negligible joint probability. For example,
such a blackout occurred in Sweden and Denmark in 2003,
where the trip of a large nuclear power unit was followed,
5 mm later in a far remote location, by a trip of a double bus-
bar and disconnection of four lines.
Enhancing Grid Security
and Resilience Today
Lifting the Fog: Commonaiities and Differences
Between Security and Resilience
It is first necessary to elucidate the confusion that exists in
the community regarding the overlap and differences between
security and resilience. Everybody agrees that power grids
must become more resilient, but different people have dis
tinct definitions and interpretations of what resilience means.
The source of confusion stems from a straight translation of
the original definition of resilience from the dictionary into
the power grid realm, without considering grid specifics and
existing concepts. Accordingly, resilience can be directly
translated into power grids as the ability to quickly adjust to
contingencies and recover normal operation after them. How
ever, this definition is too generic since, by design, the power
grid must already be “resilient” and secure without the need to
recover, in this sense, for N-i events. Furthermore, the power
grid is even “resilient” and secure to the vast majority of N-2
or more dangerous contingencies, although it was not planned
to achieve such robustness.
The power grid realm agrees to limit the dictionary defi
nition of resilience only to extreme events, with high impact
and low probability. Hence, according to the definition pro
vided at the beginning of this article, resilience is concerned
only with extreme N-k (k> 1) events, generally leading to
lasting damaged infrastructure and subsequent grid restora
tion process. These are the key differences as compared to
security, which focuses generally on N-i events such that
the grid provides nominal services without a noticeable
impact on its users.
IEEE poller ~ ener~l magazine
V improving situation awareness

Figure 3 illustrates conceptually the following three phases is the expected unserved energy (trapezoid area), i.e., exactly
of an event consisting of the trip of three lines: as in reliability calculation.
V Before the event: The grid is strengthened through pre
ventive actions. Measures to Strengthen Security
v’ During the event: The grid is managed through users’ and Resilience of Power Grids
nonintrusive actions (automatic control and corrective Blackouts have stimulated debate and initiated concrete
actions) and, if necessary, via last-resort automatic measures to enhance grids’ reliability and resilience, in
emergency actions (e.g., partial load shedding). planning, as well as security and resilience, in operation.
After the event: The grid recovers normal operation Sometimes blackouts pinpoint weak areas or assets in
through restorative actions, including other potentially the grid that need to be reinforced. The main measures to
affected infrastructures (e.g., telecommunication and enhance reliability, security, and resilience are of a diverse
transport). nature (administrative, organizational, and technical), such
In operation, phases I and U are common in security and resil as the following:
ience. Furthermore, at the planning stage, all phases are com v grid reinforcement
mon in reliability and resilience. v’ managing assets maintenance and replacing aging to
Table 1 summarizes the common and distinct aspects of the existing assets
security and resilience according to several criteria. A variety v managing vegetation around overhead power lines
of elaborate indicators have been proposed to characterize, v’ improving organization and procedures (e.g., commu
from a resilience viewpoint, the grid performance during a nication and coordination) between operators in large
certain trajectory (see Figure 3). However, the only one that interconnections
really matters and can be used to steer the operators’ decisions V increasing the capacity of interconnections between
countries (e.g., ongoing in Eu
rope) to better share renewable
System generation from remote sites
Performance (N-i) Security Enforced v’ developing blackout simulators
Function
N-i N-2 N-3 for operator training to be better
Anticipate
prepared for potential failures
Percentage and Prepare Absorb
of Load
Supplied (grid visualization) in the con-
Adapt Recover trol room in real time
Three Lines Outage Event v’ improving grid observability,
Reside using high-rate measurements
Phase 1 Phase 2 Phase 3
I via phasor measurement units
Before Event During Event After Event and deploying wide-area mea
(Preventive (Automated and~Emergency (Restorative surement and control ioops
Actions) Corrective Actions: Actions) Actions) exploiting such measurements,
______________ for global threats, as well as
ime decentralized control based on
Time Window
the idea of edge computing,
figure 3. Grid performance over time and the phases of an event in security acting as locally as possible in
and resilience. the grid, for more local threats

table 1. Differences and commonalities between security and resilience.

Criterion Security Resilience
Events considered N-k (k ≥ 1), mainly N-i N-k (k> 1)
Event probability High (credible) Very low (little credible)
Event impact Low/medium/high High
Objective Minimize operation cost (without unserved energy) Minimize the unserved energy
Control actions Preventive and corrective Preventive, corrective, and restorative
Computation tools Security-constrained optimal power flow, including Methodology, including a simulator for N-k
a simulator for (generally N-i) contingencies contingencies and grid restoration
Commonalities Operator-initiated optimal preventive and corrective actions; simulator for N-k (particularly N-i)
contingencies

Jill pun cr ~ (n(r14, Ina&~aziI,L. may/june 2023

 performing postmortem blackout or event analyses
based on recordings to validate and improve grid mod
els, although these would not be fully efficient with the
increased integration of power electronics at all volt
age levels; such analyses inform and foster grid code
improvement.
Reinforcing the grid to enhance security is not necessarily an
effective means as economics will naturally tend to push the
grid to operate near its limits. Based on previous experience,
satisfying operation principles (e.g., N-i security) is the first
step in preventing blackouts.
Sufficient evidence exists from recent blackouts that
assessing and improving grid resilience deserves careful con
sideration. Providing resilience becomes of utmost impor
tance during extreme conditions, and considering power grid
restoration for such events should not be ignored anymore.
Incentives to utilities to increase resilience are rising world
wide. Therefore, it is time that resilience considerations are
integrated into power grid planning and operation, but it is not
fully clear yet how. For instance, preemptively reinforcing the
power grid against extreme events is generally impractical at
the planning stage because such events have a very low prob
ability, although they may have a high impact. Indeed, costly
network investments to cope with highly unlikely events are
hard to justify. In operation, however, some natural disasters
(floods and storms) can be predicted with sufficient accuracy.
If their probability becomes plausible and their impact is high,
their associated risk (measured by the product of their prob
ability and impact) becomes high and should not be neglected
by the operator. The grid should be strengthened, e.g., with
corrective actions and closed-loop controls, to face such cred
ible extreme events.
The natural way of handling extreme events, whose proba
bility becomes credible at some time in operation, jointly with
ordinary N-i events is by operating the grid in a risk-based
manner, i.e., controlling the overall grid risk to remain below
some threshold. Operators are firmly contemplating migrating
the way of decision making from the current rigid determinis
tic N-i security criterion to an adaptive risk-based one. How
ever, suitable risk metrics, including unserved energy during
the grid restoration phase, that embrace the same umbrella
contingencies pertaining to both N- 1 security and resilience
are to be found.
Challenges to Security and Resilience
Posed by the Energy Transition
Transformations in Power Grids During
the Energy Transition
The world is transitioning from fossil fuels to low-carbon and
renewable energy supply. The main technological transforma
tions during this energy transition, some shown in Figure 4,
are as follows:
the accelerated penetration of a myriad of variable out
put renewable energy sources (RESs), mostly wind and
may/june 2023
solar, interfaced with the grid through power electron
ics in both transmission and distribution grids
V the deployment of DERs, other than RESs, mainly stor
age and electric vehicles (EVs)
V the progressive phase-out of large dispatchable con
ventional synchronous generators powered by environ
mentally unfriendly fossil fuel
V a trend to electrify other energy sectors (heat and trans
portation)
V the development of digital platforms as key enablers
of energy transition and more sophisticated electricity
markets, including local ones, for flexibility in distribu
tion networks.
These transformations are weakening the security and
resilience of the transmission grid through the follow
ing actions:
V introducing more variability and less predictability in
operating conditions
V introducing unexpected power flow patterns, unfore
seen at grid planning
V increasing peak load
V decreasing transmission grid controllability through the
scattering, volatility, and size reduction of controllable
assets (e.g., generators); this leads to a shift from to
day’s security control (dozens of big dispatchable gen
erators) to tomorrow’s challenging control [thousands
of variable output and smaller size DERs, most located
in distribution grids and hence not controllable by the
transmission system operator (TSO)]
recognizing that physical attacks are easy and could
use affordable technologies (e.g., drones and GPS
spoofing)
creating new grid vulnerabilities due to digitalization,
e.g., cyberattacks and failures in communication infra
structure.
Fortunately, besides typical grid flexibility (e.g., substa
tion reconfiguration, line switching, and power transformers),
some of the previously mentioned threats (especially DER5)
are also part of the solution to combat the deterioration of
security and resilience via the following (see Figure 4):
grid monitoring (e.g., phasor measurement units, dy
namic thermal line rating, and smart wires); control
modernization through high-voltage dc (HVDC) links
(allowing the cheaper shipment of renewable genera
tion from a remote location—whether Europe needs an
overlay dc supergrid has been debated for more than
a decade—fast control, and shielding harmful dynam
ics propagation); flexible ac transmission systems; and
hydrogen electrolyzers
exploiting much faster control capability, as com
pared to conventional generators, of DER power
electronics, which opens up the possibility to shift the
balance of generators’ dispatch effort from mostly
preventive (today) to mostly corrective or just-in-time
in the future
lUFF power & e:icrgy ,,,a~azine
 the support of the distribution system operator (DSO), Challenges due to a Massive Penetration
through appropriate coordination with the TSO, for us of Power Electronics in Power Grids
ing part of the DER flexibility present in the distribu The huge penetration of power electronics, controlling the
tion grid to meet the security of the transmission system behavior of millions of DERs and RESs, is fundamentally
since a blackout would severely affect both businesses changing the dynamics of power grids. Furthermore, accurate
the coupling of energy systems (e.g., hydrogen for dynamic models of increasingly active distribution grids, which
transportation and gas, fostering long-term seasonal affect stability, are to be found and included in dynamic simula
electricity storage). tions of the transmission grid. This trend prompted in 2021 a
Clearly, a wide front of research and development and revisit and extension of power grid stability, also including two
radical changes is awaiting progress to succeed in the energy new forms of instability, that is, resonance and converter driven,
transition. Power grid modernization and upgraded decision- which are exclusively due to the poor interactions of converter
support tools for operators do not seem to keep up with the control loops. It also necessitates research and engineering
fast transformations imposed by this transition. Digitalization efforts to ensure the interoperability of various DERs, RESs,
should receive special attention as the grid infrastructure (e.g., and HVDC links, proposed by different vendors.
the control center) faces more frequent cyberattacks. Indeed, Most notably, a high share of RESs dramatically reduces the
dangerous cyberattacks have been experienced in vital parts power grid’s inertia, provided hitherto by rotating masses of
of the electricity infrastructure, e.g., in Ukraine in 2015, synchronous generators that are being phased out. Although it
resulting in power outages for roughly 230,000 consumers, has not caused yet any blackouts, the low inertia challenge
or the Stuxnet malware attack that bit an Iranian power plant is receiving a lot of research attention. Possible, yet high-
in 2010. In this context, the catastrophic scenario produced by cost, solutions include synchronous condensers, the deloaded
long-lasting cyberattacks described in the book Blackout by operation of RES generation, and big battery storage systems.
Marc Elsberg in 2012 might not remain pure fiction. Further innovation is needed to come up with cheaper solu
One should not wait for a new blackout to happen to tions. The author envisions the huge cost of electricity, to be
improve security and resilience as this can be fatal to soci supported by the state and consumers, as the major technical
ety. The anticipation of blackouts and coping with new barrier in reaching 100% renewable supply power grids.
threats to power grids are the key to accomplishing the Another key issue with variable RESs is that they cannot
energy transition. provide the same quality of reactive power services (needed
to create variable electric and magnetic
fields allowing electricity transmission
from production sites to consumers) as
conventional synchronous generators.
Renewable This situation creates a reserves short
Energy Sources age for both reactive power production
Electrification of (Wind, Solar)
Energy Sectors Distributed and absorption in the transmission grid,
(Heat, Transport) Energy compromising its security through the
and Energy Resources inability to control voltages and maintain
Efficiency (Storage, EVs)
their stability. This shortage is owing to
the following reasons:
V Wind RES reactive power capa
Power Grid bility is roughly half that of a syn
Coordination of the Future TSO and DSO chronous generator of the same
for Flexibility Coordination
With Other for Flexibility size.
Energy Vectors V Unlike conventional generators,
(Heat, Gas) variable RESs were deployed where
Energy Advanced
Transition
the climate conditions are suitable
Technologies (e.g., off-shore wind power); there
Enablers (HVDC, DLR,
(Digital FACTS, PMU, fore, they may not be effective for
Platforms, Smart Wires) overall voltage control, particularly
loT)
close to high-load locations, as
shipping reactive power far away
figure 4. The key power grid transformations during the energy transition. is inefficient.
DSO: distribution system operator; TSO: transmission system operator; loT: V Millions of small RESs, deployed
the Internet of Things; EVs: electric vehicles; DLR: dynamic line rating; PMU: according to the grid code in dis
power management unit; FACTS: flexible ac transmission system; HVDC, tribution systems, are not control
high-voltage dc. lable and operate at a constant

IEEE power & energy magazine may/june 2023

 (unitary) power factor, e.g., photovoltaic panels in low-
voltage grids.
These reasons urge rapidly rethinking and planning additional
sources of reactive power (e.g., synchronous condensers and
static synchronous compensators), especially close to big load
centers, further increasing the overall cost of electricity.
Further changes in RES-rich grids pertain to protection
philosophy as, unlike synchronous generators, RESs can
not provide a large fault current. The blackouts in Australia
(2016) and the United Kingdom (2019) testify that, as com
pared to conventional generators, RES behavior is not yet well
understood and is more sensitive to unusual operating condi
tions; hence, RESs may unexpectedly disconnect, depriving
the grid of valuable production and reserves, possibly leading
to a blackout. Some uncertainty lies ahead, and blackouts can
occur in such circumstances.
Further, since energy consumption should be met at any time,
improved grid resilience and generation adequacy will be needed
at high shares (up to 100%) of inverter-based RESs due to the
“Dunkefflaute effect” that translates into simultaneously low pro
duction of wind and solar generators as experienced sometimes,
especially during Febmaiy in Europe. Preliminaiy studies report
that, in Europe, the mean frequency of Dunkefflaute is reduced
from roughly 3 to 9% at the country level to approximately 3.5%
at the regional level provided that the power transmission limits
of the interconnected grids increase. How to cover the deficit of
energy during this effect, besides energy storage, is a tough cit
izen-driven political matter pertaining to the optimal electricity
supply mix during the energy transition.
Despite these major threats to grid operation security and resil
ience, achieving a 100% renewable electricity supply (including
dispatchable hydropower and energy storage) is highly challeng
ing but technically feasible on a case-by-case basis. However, the
energy transition cost will not be affordable, at least in Europe,
unless low-carbon and dispatchable nuclear power is for some
time and to some extent part of the energy mix.
Decision-Support Tools for Operators
Are Largely Lagging Behind
Current decision-making tools to enhance security in day
ahead or real time, such as the security-constrained optimal
power flow, are largely deficient in properly modeling the
prevailing grid operation phenomena during the energy transi
tion. Accurate tools to enhance resilience are in their infancy,
and they should integrate and significantly extend modules
of tools for security. To ensure the security and resilience of
grids during the energy transition, the decision-support tools
for operators in all time frames need substantial advances in
the problems addressed, which should model the following:
fr’ temporal coupling and intrinsic uncertainties of DER
operation
V fine-time resolution since the current time resolution
(e.g., typically 30 mm if not 1 h) during which all
power flows in the grid are assumed constant is
largely inaccurate
may/june 2023
V updated models of increasingly active distribution grids
V grid dynamics
V a radical change in the philosophy to control grid fre
quency and voltages that should be implemented at high
inverter-based RES penetration, at an extremum using
the concept of grid-forming RESs, involving the droop-
based fine granularity control of millions of RESs
V risk metrics for managing security and resilience
V coordination for flexibility with DSOs and operators of
other energy vectors
V compound physical-cyber power grid model and
simulation.
The problems, including the previously mentioned features,
that need to be solved for computing optimal actions to
improve security and resilience are huge in size and highly
computationally challenging. Solving them will require pow
erful high-performance computers, if not the next generation
of quantum computers. Figure 5 illustrates (in red) the three
main sources of computation complexity.
Tools for part of the security problem, focusing on steady-
state (thermal and voltage) constraints, were addressed
recently in two Advanced Research Projects Agency—Energy
Grid Optimization competitions organized by the U.S. Depart
ment of Energy. The tools proposed for these competitions
demonstrate scalabilily to very large grids. However, they do
not incorporate any other dimensions of complexity from those
shown in Figure 5, except contingencies. This demonstrates
clearly that decision-support tools are currently severely lag
ging behind the speed as the energy transition evolves.
Algorithms embedded in these tools inherently require
decomposing the optimization and control problems as well
as relying on fast and reasonable quality approximations. Fur
ther, hybrid algorithms between machine learning, for solu
tion estimation, and rigorous classical optimization methods
are emerging. In particular, physics-informed machine learn
ing is deemed by some researchers as a promising option to
deal with the increasing complexity. Still, the validation of
machine learning techniques should depart from the straight
forward “learning by heart” of easy-to-estimate solutions and
be proved when really needed, i.e., under sudden and various
realistic changes in operating conditions.
Uncertainties
Decision Variables
(TSO-DSO Links)
Contingencies
Temporal Links
figure 5. The main dimensions of computation complexity
in future decision-support tools.
lIEU power & energy magazine
 Methods to enhance resilience should further address an
issue of nigh-impossible solution; scenarios modeled are gen
erally extreme (e.g., low voltages and abnormal frequency),
which questions the validity of power grid models and simu
lation accuracy outcome. Accordingly, the sequence of events
(cascading disconnections and restoration process) gets
increasingly uncertain, and the outcome of events exhibits
high variability.
Conclusions and Outlook
The lessons learned after each past blackout have allowed
power grids to better face contingencies. However, the key
lesson, namely meeting the N-i security operation require
ment, has not been systematically or efficiently enforced and
remains the cause of many high-impact blackouts. Thus, the evi
dence collected in this work contradicts some articles on resil
ience, which claim that only the lack of adequate grid resilience
to extreme weather can cause (high-impact) blackouts.
The world is transitioning to sustainable energy grids and
the electrification of some energy sectors, which is produc
ing major transformations in increasingly hybrid ac-dc power
grids, especially a massive adoption at all voltage levels of
variable RES generation, interfaced with the grid through
inverters. Grid monitoring and control modernization via
various technologies, including prevalent HVDC links,
are following alarmingly at a slower pace, weakening grid
security. This energy transition is fundamentally shifting the
known grid dynamics, creating new forms of instability, and
requiring rethinking grid operation, control, and markets. In
particular, it is of high interest to identify the critical turning
point of RES share in the sustainable electricity mix, also
encompassing conventional synchronous generator-based
hydro and low-carbon nuclear power, which will lead to a
radical change in the approaches to control frequency and
voltages. In the prevailing context, new threats (e.g., cyberat
tacks, low inertia, and reactive power reserves scarcity) and
atypical vulnerabilities (e.g., cyberphysical, counterintuitive,
and unpredictable power flows) of power grids, unknown to
operators, may materialize.
We are discovering the behavior of changing power grids
and can use little of the lessons learned from previous black
outs in this new environment. In particular, the fragility of
DERs to unusual operating conditions already conveyed
two warnings, which materialized in the blackouts in Aus
tralia and the United Kingdom. It is risky to ride a blackout
unprepared through the energy transition. To succeed, one
needs superior blackout anticipation than hitherto available.
Still, blackouts will continue to happen, at least because the
increasingly complex grid with millions of small-size DERs,
some uncontrollable, neither was planned nor can be operated
to cope with massive natural disasters. In this respect, grid
reliability, security, and resilience are increasingly vital due
to the electrification of key energy sectors, increased occur
rence of natural disasters, and unveiled new threats. However,
the decision-support tools to evaluate and enhance security
IEEE power & energy magazine
necessitate substantial enhancements in the relevance of prob
lems addressed and high-performance computers, if not the
next generation of ultrapowerful quantum computers, for
their solution.
The methodologies and tools pertaining to grid resilience are
under development. They face significantly more solution com
putational challenges than for security but could wisely benefit
from modules present in tools for tackling security. Enhancing
resilience to natural disasters (especially the restoration phase)
is cross-disciplinary and depends on diverse factors (e.g., crews
mitigating the disaster outside the power grid realm). However,
the incapacity to fight against and tame nature drastically limits
the capacity to enhance resilience. To properly address the entire
spectrum of threats, embracing it under the same framework of
security and resilience, probabilistic risk-based decision making
in grid operation must be urgently adopted.
Acknowledgments
The author acknowledges the funding from FNR Luxem
bourg in the frame of research projects ML4SCOPF, ECHO,
and TESTIFY.
For Further Reading
D. N. Kosterev, C. W. Taylor, and W. A. Mittelstadt, “Model
validation for the August 10, 1996 WSCC system outage,”
IEEE Trans. Power Syst., vol. 14, no. 3, pp. 967—979, Aug.
1999, doi: 10.1109/59.780909.
G. Andersson et al., “Causes of the 2003 major grid
blackouts in North America and Europe, and recommend
ed means to improve system dynamic performance,” IEEE
Trans. Power Syst., vol. 20, no. 4, pp. 1922—1928, Nov. 2005,
doi: l0.1109/TPWRS.2005.857942.
A. Berizzi, “The Italian 2003 blackout,” in Proc. IEEE
Power Eng. Soc. General Meeting, 2004, vol. 2, pp. 1673—
1679, doi: i0.1109/PES.2004.1373159.
N. Hatziargyriou et al., “Definition and classification of
power system stability—revisited & extended,” IEEE Trans.
Power Syst., vol. 36, no. 4, pp. 3271—3281, Jul. 2021, doi:
10.1 109/TPWRS.2020.3041774.
F. Capitanescu, “Evaluating reactive power reserves scar
city during the energy transition toward 100% renewable
supply,” Elect. Power Syst. Res., vol. 190, Jan. 2021, Art, no.
106672, doi: i0.1016/j.epsr.2020.106672.
M. I. Alizadeh, M. Usman, and F. Capitanescu, “Envi
sioning security control in renewable dominated power
systems through stochastic multi-period AC security con
strained optimal power flow,” mt. J. Elect. Power Energy
Syst., vol. 139, Jul. 2022, Art. no. 107992, doi: 10.1016/j.
ijepes.2022.107992.
Biography
Florin Capitanescu is with the Luxembourg Institute of Sci
ence and Technology, L-4362 Esch-sur-Alzette, Luxembourg.
may/june 2023