Why are power distribution systems so prone to massive faults?

Question

Many region-wide blackouts (like this one or this one) are described as follows: some high-voltage equipment (like a generator or a transformer) fails and the grid gets overloaded and then protective devices start tripping everywhere and millions of consumers are in the outage.

I don't get it. Okay, some generator or transformer fails, but there's dozens of such generators and transformers in the region grid.

Why is the load not partially disconnected so that the consumption matches the production again? Why would a relatively small deficit of delivered power lead to a region-wide blackout?

Answer 1

TLDR: better design is not affordable.

Technical root cause is the limited speed of light. Natural root cause is the conflict of economy of scale vs redundancy requirement.

Every energy supplying element in system is protecting itself by disconnecting, stopping the supply. Disapperance of supplier, causes increase of individual load on other suppliers. Which in their turn disconnect themself. The blackout escalation behaves very much like an avalanche.

The proper design must have granularity of demand control (consumer's pool) be finer than smallest individual supplier, and total supply capacity must be greater than total demand by at least one unit of supplier's granularity. In theory the redundance of suppliers must protect from blackouts. But in reality the granularity on both sides is too coarse, and is impossible to be made finer. Because downsizing is in conflict with economy of scale. Every power plant, distribution line and other elements are built to be as large as possible and point of connection to consumer always exceeds the optimal size granularity wise. Just because of market competition it is not possible to limit the size of lines, power plants and other elements.

The solution can be found only in regulatory space. Say: add the smart load control capability to all household Energy-Star rated equipment and introduce concept of "quality of service", complex system of tariffs, uplinks, protocols, etc.

Answer 2

If a link, generator, switch, or other part of the electrical grid becomes overloaded, it will be necessary to disconnect some parts of it relatively quickly to prevent damage. If the distribution network were a tree with a single supply at the root, it would be simple to figure out what to disconnect: whenever a node is overloaded, drop the lowest-priority descendent, and keep doing that until no more nodes are overloaded. If the descendent nodes are widely distributed, there might be some technical challenges arranging for rapid communication so that a node won't drop unless the dropping of its lower-priority relatives was insufficient to solve the problem, but determining which nodes should drop is fundamentally not difficult if one assumes that the quality of a solution depends solely upon the priority of the highest node dropped (and, of course, the fact that it solves the overloads).

The actual electrical grid, however, is not such a tree structure. Disconnecting part of a single-source tree will, for all other parts, either reduce the demand while leaving the supply unchanged, reduce the supply to zero, or have no other effect. Disconnecting part of the more-strongly-connected grid, however, will often reduce the supply but not to zero, thus leaving a live part of the grid even more overloaded than it was before the disconnection. Ideally, all parts of the grid could negotiate the optimal combination of nodes to disconnect to resolve overloads with minimal disruption. Unfortunately, overloaded nodes often can't afford to wait very long for relief lest they suffer damage. Sometimes a node will have to sever a link to protect itself, and such severance may end up creating an immediate and severe overload somewhere else.

As a simple example, imagine that A, B, and C (capacity 100 units each) source D, which source E, F, G, H, and I (demand 60 units each). Something happens which reduces C capacity by 10 units, so A and B are at maximum capacity, and C is 10 units overloaded. Dropping I would solve overload, but if the network can't resolve quickly enough that I should drop, C would have to remove itself from the network. When that happens, A and B will now be overloaded by 50% each. Even with C gone, the overloads could be fixed by dropping H and I, but a race would ensue between whether A or B (both 50% overloaded) would drop before H and I. If A or B drops first, then the race would be to see whether four of the loads could be shed before the other generator drops.

Answer 3

It is called cascading failure.

Let's take an example scenario involving three cities and three power stations, all interconnected. This involves a lot of made up numbers but work with me here.

Power consumption:
 City A = 10 MW
 City B = 20 MW
 City C = 30 MW

City A uses PP A (10 MW) entirely. 
City B uses PP A (4 MW) and PP B (16 MW.) 
City C uses PP B (10 MW) and PP C (20 MW.)

Available capacity and used capacity:
 Power plant A = 15 MW (14 MW)
 Power plant B = 30 MW (26 MW)
 Power plant C = 28 MW (20 MW)

Oh shucks! A power line coming from PP C to City C goes down - half its capacity is lost. 
The computer automatically switches City C over to use PP B entirely because 
it is designed to keep City C going. 

Now PP B is loaded down with 30 MW + 16 MW = 46 MW. Its breakers trip. PP B goes down. 
City B and City C go dark. 
City B switches over to use PP A. 
Oops! PP A is now loaded down with 14 MW + 16 MW = 30 MW. So its breakers trip. 
Now due to a simple fault originating with City C, all three cities have gone dark. 

A well designed system will be designed to handle this simple example, where a single fault can cause the failure of the entire network. However, it is often not a single fault that can be the problem. On a cold day people might switch on their heaters. The lines are running at capacity. But the storm gets stronger and one line goes down... no problem. Then another line goes down, and another... eventually the problem gets worse and worse until the situation described above occurs.

In fact, the northeastern US black out was caused by this issue, but it was air conditioning and hot days causing lines to sag. A few too many faults, mixed with a bit of human error, left the northeastern US dark for about a day.

Answer 4

This is "as I understand it. You judge how good my understanding is :-).

If there was a perfect answer to why and how such things happen then they wouldn't happen - as systems would be put in place based on the reasons such as to prevent the occurrences. It's "things getting out of control quicker than can be reasonably anticipated" that causes the problem. Software bugs don't help.

Note that extremely major outages are very uncommon. Protection against the sort of faults that you describe occurs regularly, leading to blackouts of local areas - often to as little as a block or so, sometimes to a few blocks, or a local substation level outage and sometimes a large part of a city.

Problems caused by overload of a local circuit or area generally lead to disconnection of power, downstream outages and an excess of generation capacity (as its load has gone) and the need to back the system down to keep voltage and frequency within limits.These are thes easy ones. as long as the system can stand the brief oversupply situation as stations are taken offline or powered bcak then all is well enough.

A rolling outage occurs where a combination of fault and load places a power station or supply circuit in a situation where it either cannot sustain the load and "sags" or is overloaded enough that it must shut down to protect itself. Where generation capacity is dropped but load remains, trouble begins.

Where the rate at which this occurs can be reasonably anticipated means are available to load shed. Some industries operate under agreements by which power can be dropped instantly. Water heating and night store heating is able to be shed as rapidly as control system response allows. Notionally a section of the network will come to constitute an overload and can or must be shed. In a distributed grid system where power can flow bidirectionally depending on demand and routing, Worst case a condition can be reached (as shown by experience) where an escalating overload tends to shed capacity to protect the capacity than shedding load. ie on an overloaded circuit the 'generator' may shed a load to protect itself - but if the load is effectively upstream of the generator this just has the effect of transferring its load, and thus its problem, to somewhere else.

A situation is soon enough reached where loads must be able to be pre-emptively dropped without being the actual contributors to the problem. If this is not possible failure is certain. If it is possible the question is "which non involved circuit needs tripping to save this situation?" Getting it wrong, or not radical enough leads to mass failure.