LARGE

SYSTEMS --. Power/energy

- - - -

Operating under stress and strain

This, part two of the blackout series, defines control objectives for various levels and types of emergencies
In the U.S. today, complex power systems are able to provide reliable electric service at low cost with the help of automatic control-simultaneously tracking the randomly varying system load, optimizing generation to minimize cost, and coordinating the action of many independent control centers. When an emergehcy develops in one of these systems, however, the picture changes completely and new control objectives must be met if the system is to be restored successfully to normal operation. The control objectives of a power system are related to the level of security at which the system is operating, and (see box on p. 50) as this level decreases below an acceptable threshold, preventive measures must be taken to restore the system to a robust state. It is rare that a major system failure is the result of one catastrophic disturbance that wipes out an apparently secure system. Usually such failures are brought about by a reduced level of security that renders the system vulnerable to the cumulative effects of a sequence of moderate disturbances. The systems have been designed and built to operate as efficiently as possible under normal circumstances. In the event of the loss of a piece of major equipment (whether due to an internal fault or an external event) with its resultant instantaneous surges of power, the system must be able to al,sorb these stresses without further damage and to find a new balance of energy flows. Coincidence of disturbances and/or hidden weaknesses in system components or control functions can combine to produce momentary local stresses beyond any level of endurance to which the system could possibly be designed within reasonable economic limits. Emergencies can strike suddenly-or build slowly. During these emergencies, the system operator (human or automatic) struggles to keep the system under control-to maintain balance between load and generation, or demand and supply, through all available means. However, there are two factors that can doom these efforts to failure: time constraints-the inability to responcl quickly enough; and capacity constraints-demand outstripping available supply. Recent blackouts have been in the first category. Hut in January 1977, several interconnected utilities appeared to be headed toward a failure of the second kind when, in some areas of the U.S., unusually severe winter temperatures froze such crucial resources as coal piles and waterways and greatly limited generating ,capacity. S y s t e m f r e q u e n c y , a s e n s i t i v e mcasure o f discrepancy between load and generation, sagged to 59.84 Hz, and remained below 60 Hz for almost seven hours. During this period, the available power supply was reduced to a critical level. When the carefully constructed and maintained dynamic system structure (see box on p. 51) begins to reel under the impact of a major disturbance, and is on the verge of disintegrating, the conlrol regimes tlcsigricd for normal circumstances are no longer adequate, or relevant, and new controls are necessary. However, before such controls can be discussed, the general states of operation of a power system should be considered.

States of operation ,
Power system conditions are described by five operating states, as shown in Fig. I. Three sets of generic equations-one differential and two algebraic-govern ~OWCI--system operation: The differential set encodes the physical laws governing the dynamic behavior of the systems components. The two algebraic sets comnrise equality constraints, which refer to the systems total load and total generation, and inequality constraints, which state that some system variables, such as currents and voltages, must not exceed maximum levels r-epresentidg the limitations of physical equipment. In t h e Norma/ opera/& stale, a l l c o n s t r a i n t s a r e satisfied, indicating that the generation is adequate to supply the existing total load demand, and that no equipment is being overloaded. In this state, reserve margins (for transmission as well as for generation) are sufficient to provide an adequate level of security with respect to the stresses to which the system may be subjected. If the security level falls below some threshold of adequacy, or if the probability of distur-bance increases, then the system enters the nlert stale. In this state, all cow straints would still be satisfied, but existing reserve margins would be such that some disturbance could result in a violation of some inequality constraints; e.g., equipment would be overloaded mot-e or less severely above its rated capabilities. In this (insecure) alert state, preventive action can be taken to restore the system to the normal state (see Table I). If a sufficiently severe disturbance takes place before such preventive action can be taken, the system enters the ormvpvcyslale. Here, inequality constraints are violated, and system security would have been breached since the security level would be below zero and practically nonexistent. The system, however, would still be intact, and emergency control action (heroic measures) cor~ld be initiated in order to restore the system to at least the alert state. If these measures are not taken in time, or are ineffective, and if the initiating disturbance or a subsequent one is severe enough to overstress the system, the system then starts to disintegrate and is irr e.ufrcmiy (see

Lester H. Fink U.S. Department of Energy Kjell Carlsen General Electric Company -.__--

,,

..

--.

lable I). In this staie, equality as well as inequality constraints have been violated; the system would no longer be intact, and major portions of the system load would be lost. Emergency control action should be directed toward salvaging as many pieces of the system as possible from total collapse. Once the collapse had been halted, if there were any remaining equipment operating within rated capability, or some equipment had been restarted following total collapse, the system co.uld enter the restorative stute, with control action being taken to pick up all lost load and reconnect the system. From this state, the system could transit to either the alert or to the normal state, depending on circumstances. So far, precise definitions characterizing the several states discussed have not been provided. Without such definitions, the indicated framework can be of heuristic value only; judgment as to whether the system has moved from one state to another will be subjective at best, and possibly arbitrary. Nevertheless, even at this level this framework can contribute significantly not only by clarifying analyses of the histories of disturbances but, more important, by providing some guidance as to the controls to be effected under certain circumstances or the operator decisions to be implemented (see Fig. 1). Given a consistent set of definitions of each state, necessary and/or sufficient conditions for state transi-

the problem involved in on-line security assessment and could provide considerable insight into the design of control strategies proper to the several states.

Emergeqcy

prevention

Historically, system security pas been approached by way of reliability; planning and building systems that could be inherently robust in the face of credible (and some incredible) disturbances. Typically, the assessment was carried out in the planning stage by way of simulating the response of the projected system to a number of hypothesized severe (worst case) disturbances. Such tests have served as a means to measure the strength and capacity of a system to withstand the entire spectruq of disturbances under stress conditions. Systems designed to such criteria have proved reliable under all but the most unusual circumstances. However, no absolute guarantee of reliable performance can be provided by the system planner for even the best planned and constructed system. The system operator is ultimately responsible for maintaining effective operation of the system under all circumstances. Following the Northeast blackout of 1965, increasing at-

111 System operating states.

/I /I

Reduction in reserve mareins and/or increased probability of disturbance

Table I). In this state, equality as well as inequality constraints have been violated; the system would 110 longer be intact, and major portions of the system load would be lost. Emergency control action should be directed toward salvaging as many pieces of the system as possible from total collapse. Once the collapse had been halted, if there were any remaining equipment operating within rated capability, or some equipment had been restarted following total collapse, the system cquld enter the resforufive s/o/e, with control action being taken to pick up all lost load and reconnect the system. From this state, the system could transit to either the alert or to the normal state, depending on circumstances. So far, precise definitions characterizing the several states discussed have not been provided. Without such definitions, the indicated framework can be of heuristic value only; judgment as to whether the system has moved from one state to another will be subjective at best, and possibly arbitrary. Nevertheless, even at this level this framework can contribute significantly not only by clarifying analyses of the histories of disturbances but, more important, by providing some guidance as to the controls to be effected under certain circumstances or the operator decisions to be implemented (see Fig. 1). Given a consistent set of definitions of each state, necessary and/or sufficient conditions for state transi-

(ions could be identified. Such definitions could simplify the problem involved in on-line security assessment and could provide considerable insight into the design of control strategies proper to the several states.

Emergency prevention
Historically, system security has been approached by way of reliability; planning and building systems that could be inherently robust in the face of credible (and some incredible) disturbances. Typically, the assessment was carried out in the planning stage by way of simulating the response of the projected system to a number of hypothesized severe (worst case) disturbances. Such tests have served as a means to measure the strength and capacity of a system to withstand the entire spectrum of disturbances under stress conditions. Systems designed to such criteria have proved reliable under all but the most unusual circumstances. However, no absolute guarantee of reliable performance can be provided by the system planner for even the best planned and constructed system. The system operator is ultimately responsible for maintaining effective operation of the system under all circumstances. Following the Northeast blackout of 1965, increasing at-

[l]

System operating states.

--------------___

il

Reduction in reserve margins and/or increased probabhty of disturbance ------v-s

v
System not Intact E: equality constrarnts I: inequahtyconstramts -: negation

v
System Intact

lf3lllUll was duected to the problem of security assessment-the provision of data-gathering and -processing systems that would assist the operator in anticipating potential trouble and then deciding how to prevent it or to minimize its impact. Naturally, the problem has been approached as suggested by established planning procedures. Present test procedures consider the given circumstances (loads, line flows, generating capacity, spinning reserve,etc.)and then check to see whether the system can withstand possible specific disturbances-such as the loss of a major generating unit or station or of one or more major transmission lines. This planning-oriented approach to such security assessment involves two operations: gathering information about the present status of the system (the power system state estimation problem), and calculating whether the system will maintain stable operation in the face of a designated list of severe disturbances. These operations, straightforward in a planning environment, become very difficult to handle in an operating, real-life situation by virtue of the vast amount of.system-derived data that must be processed, the practically limitless number of contingencies (possible combinations of equipment losses) that must be considered, and the length of time needed to determine by simulation the response of the system to any one (let alone all) of these contingencies. Despite these procedural difficulties, rudimentary security assessment programs are being developed and some have been implemented.

State estimation programs filter incoming data on generation, bus loads, on-line currents, and/or bus voltages in order to provide an Accurate picture of the systems condition. Contingency lists are carefully assembled. The ability of the system to maintain stable, steady-state operation following a disturbance is assessed either by inspection of precalculated distribution factors (approximate but very rapid) or by on-line load flows (more accurate but more time consuming). However, because of the time required for simulation, it is not practical to calculate the systems stability performance during the transient period between the predisturbance and postdisturbance steady state. These procedural problems-the amounts of data, the number of contingencies, and the time required to assess transient stability-could be resolved at a more basic level by taking a more operator-oriented approach to security assessment. As has been mentioned, major system disruptions almost invariably result from the inability of a system operating at a reduced level of security to endure the consequences of a series of less than major disturbances. Consider the possibility of a sequence of rather minor events that may result in the removal of equipment such as transmission lines or generation units. This sequence of events will gradually reduce the security level or the robustness of the system to such an extent that even a normal contingency may be all that is needed to cause a drastic system failure. Even under normal operation, the

Basic definitions
Reliability, security, and stability are related terms. For the purposes of this article, reliabilily is considered as
referring to the probability (in the heuristic sense of relative frequency over the long run) of satisfactory system performance. This is a function of the time-

relatively modest disturbances whose cumulative impact on the system can be severe.
Consider a well-known example-the New York blackout of July 13, 1977. Initially, the Consolidated Edision system was experiencing a normal summer peak. Most of the generation was located in a northern section of the service area and considerable power was imported irom the north. Hence the situation was fairly typical for Con Edison. However, at the same time, the area within the Con Edison System was experiencing a severe thunderstorm. Under those conditions, lightning struck two 345kV transmission lines connecting Con Edison to Ihe north of New York. This constituted a very severe disturbance and may be regarded as a multiple contingency due to the resulting loss of two major transmission lines. The system did hold together and recover, but the newly established operating situation was at a considerably lower security level. In addition, the weather in the New York area was still very bad. At this reduced security level, subsequently another section of the system was struck by lightning and the resulting switching operations isolated additional equipment. Under normal conditions, this contingency by itself would not have been difficult to contend with. However, due to the extreme reduction in the security level of the system at this time, this additional disturbance caused a number of critical transmission-line overload situations, which eventually ted to the total collapse of the system. (This discussion has been simplified in order to illustrate the concept of security level. For more complete details, see the February issue of Spectrum, pp. 38-46.) Finally, it may be helpful to distinguish between securily a s s e s s m e n t and security e n h a n c e m e n t . S e c u r i t y assessment refers to the evaluation of system-derived data 16 assess its relative robustness in its present state. Security enhancement refers to specific operations ontine to improve system robustness, and to raise the performance level of system security.

average performance of the system, and its achievement

is a system planning problem. By contrast, security is considered to be an instantaneous, time-varying condition that is a function of the robuslness of the system relative to imminent disturbances. Sfabilily Is a narrower condition concerning the continuance of parallel, synchronous operation of all operating units (synchronous generators) of a system;and is a very Important factor in security. Security, therefore, is an operating problem. Obviously, reliability and security are related: A system built to be reliable will not be vulnerable to run-of-the-mill disturbances and hence will evidence a reasonable degree of security most of the time. At times, it will pass through periods of relative insecurity. If major disturbances do not occur during insecure periods, or if the system manages to ride them out whenever they do occur, the system will have proved reliable even though sometimes less than secure. By contrast, an unreliable system will be subject to frequent complete breaches of its security. Thus defined, the security (or security level) of a system is determined by the relationship between its reserve margin (i.e., the margin between actual line power flows and the corresponding line power transfer capabilities) on the one hand, and the contingent probability of disturbances on the other. It seems clear that under normal conditions a given system could be considered secure with relatively modest reserve margins, whereas under more risky (unusual) circumstances (e.g., severe storms), much higher margins would be required for comfort. The threat posed by severe storms involves not only an increased probability of more severe disturbances, but, more important, an increased probability of a sequence of

outage of individual pieces of equipment due 10 failure, inadequate maintenance, etc., often reduces the system to a Slate less secure, less lobust than its design level. II is necessary to distinguish between the static description of hybtern reliability (which serves as a basis for system design and in large measure is still utilized as a basis fol- security assss5me11t) and the dynamic interplay in real time between a fluctuating level of security as a system responds to sequences of events and the continually chauging contingent probability of disturbances. In light of these corisidcr~ations, the role of security assessment might be viewed as providing to the operator information on the changing reserve margins of his equipment and 011 the continually changing probabilities of possible disturbances. Thus, the traditional system planning approach, as well as the system operators approach, must be used in emergency prevention. In addition to security assessment security enhancement must albo be taken into account. The system operator IIILISL operate the system with (just) enough margin to provide insurance against the ultimate loss of power to a large portion of his customers. He must take into account not only the security level of his system but also the possibility of disturbances that may threaten and disrupt the system. Thus, security enhancement must remain the sole domain of the operator. Experienced system operators continually make structural readjustments to the system, increase or adjust the level of operating reserves, and reschedule generation to maintain necessary levels within critical geographical areas. They take actions to provide the necessary assurance that, with the given physical state of the 5ystern and with the given contingent level of probability of disturbances, the system will be able to react reliably and to maintain its equilibrium. Table II lists, under the alert state, control means that are appropriate and available to the system operator for achieving his objectives in security enhancement.

dent that triggered the state transition had been sufficient: ly severe rrlative to the systems security level, reflexive local control action, whether or not successful in preventing damage to the equipment involved, wilt not adequately restore the overall balance of the system. Lines or other major equipment wilt be seriously overloaded, and more powerful, cdordinated action wilt be required. Table II also lists control methods appropriate to the emergency state that are at least potential candidates for inclusion in emergency control regimes. Of all the immediate and heroic means listed, only fault clearing has a long history of application. Underfrequency relaying for load shedding has come into fairly widespread use during the past decade (with performance that has not always been satisfactory, or even acceptable) and a large dynamic brake has been installed on the Bonneville Power Administration system in the northwestern part of the U.S. Although the possibility of using other devices has been discussed, they have all been viewed primarily as candidates for more powerful local control action. They are, however, of widely diverse characteristics, and may be classified according to a variety of criteria: Topologically, some involve interference with the flow of real energy into or out of the (electrical) system, whereas others only affect the paths of flow through the system.

The U.S. power system

The electric energy system of the United States includes approximately 6000 generating units, 600 000 km of bulk power transmission lines, 12 000 substations, and innumerable lower-voltage distribution lines and transformers. The electric energy processed by this system is produced, not to schedule, but in response to the instantaneous demands of some I33 million customers. At the present state of the art, it is not feasible to control this incredibly complex system monolithically, and there are theoretical indications that it may never be efficient to do so. This entire total of interconnected systems is presently controlled by some 117 independent control centers, some groups of which function in a coordinated manner. Thus, an operating utility may control from one to 300 generating un)ts in a tightly coordinated manner; a power pool of interconnection may consist of from two to 37 operating utilities, which operate in a cdordinated man.ner; and regional councils cooidinate the operation of several contiguous Interconnections. Finally, the North American Power Systems lnterconnectlon C o m m i t t e e (tiAPSIC) reviews the common operating problems of all U.S. interconnected systems. A control area may consist of anything from a single utility to a power pool, and an interconnection can include more than one pool. Under normal circumstances, power system controllers must: (1) continually adjust plant outputs to match the continuous random fluctuation in customer demand for power (a complex tracking problem); (2) continually adjust plant controls (valves, governors, burner tilts, rod positions, etc.) to maintain the balance of process variables-steam temperatures and pressures, etc.-within individual plants, and the balance of power levels (loads) among all the plants at their most efficient level (an optimization problem); and (3) avoid conflict between the thousands of control actions performed more or less independently by individual control centers each minute (a coordination problem).

Emergency

control

Once a system has entered the emergency state, the deliberate control decisions and actions that are appropriate to the normal, and even the alert, state are no longer adequate, and more immediate action may be called for Power engineering literature over the last half-century is replete with discussions of problems related to transient stability, and the steady increase in our understanding of those problems has been a major factor in the achievement of the reliable systems to which we have become accustomed. In recent years, the scope of those discussions has extended to the detailed study of large systems, which have been modeled in detail in order to simulate their response to specific disturbances. Until very recently, emergency control was identified with local reflexive action for the prevention of transient instability of individual machines. However, machine instabilities do not constitute-and may not even b c significan! f a c t o r s i n - m a j o r s y s t e m b l a c k o u t s . A s noted earlier, if the particular incident triggering the transition to the emergency state has only local significance (such as the instability and shutdown of a small generator), return of the system to the alert state may be effected solely by local control action-e.g., through operation of protective devices. Even the loss of a major unit may be accommodated by a sufficiently robust system without serious aftermath. If, however, the inci-

From a time-domain perspective, all can be very fast acting, but most can be of only short duration, whereas the rest can be sustained indefinitely. Each distinction provides a useful perspective frdm which to consider the devices relative usefulness, but incorporation of such diverse control means into effective automatic control regimes poses a variety of unsolved problems. The inability to gather, analyze, and respond to data reflecting the state of an entire system, combined with the futility of trying to preanalyze and prepare open-loop control actions to take care of the literally infinite number of emergency situations that could occur, has led us to focus exclusively on local emergency control. As a result of this limitation, iri extreme cases, the operator is left to cope as best he can with the overall situation without the aid of generalized emergency control. The picture is now changing, however. Improved understanding of power systems dynamics, advances in communication and data-processing technologies, and recent contributions of modern control theory have all continued to make feasible the development of general automatic control regimes appropriate to the emergency state. One class of problems resulting from the interaction of individual methods of control deals with the achievement of effective coordination in the use of multiple control means within an area, in the functioning of local and central (higher-level) control regimes, and in transitions between the several operating states. Particularly vexing are the problems involved in achieving rapid coordinated action from widely dispersed control techniques responding individually to locally available information. Pending fur-

ther useful developments in the theory of decentralized control, coordination between control centers must be sought heuristically, but it cannot be altogether neglected. Another class of problems involves coordination between means and ends. A definition of control objectives that are both adequate to system operational requirements and practicable for use in control synthesis must be developed. III addition, associated control algorithms for achieving those objectives must be formulated. A number of possible approaches have already been suggested, mostly in the context of normal state control, and more will undoubtedly emerge for consideration. In this connection, one consider-ation merits special mention. The pervasively nonlinear and time-varying nature of power systems, their inordinate complexity, which requires that analytic models must be grossly simplified to be usable, and the many contingencies that must be handled combine to make the use of Ieedbacktype (possibly even adaptive) control algorithms practically indispensable. Classical optimal control methods generating open-loop nonfeedback controls do not appear practicable at present. II must be stressed, however, that the emergency control problem transcends the transient stability problem, and that when the system is in the emergency state, whether or not following a unit in transient stability, coordinated systemwide action must be taken to restore it to at least the alert state.

Recovery from emergencies

Once an emergency has progressed to the loss of system integrity, return to the normal state ic realized by a

1. Uncontrolled state transitions

Normal-, alerf Nature of the transition: reduction in security level (Once the system has been stressed, and until an adequate margin has been restored, it is more vulnerable to subsequent disturbances ) Possible causes: 1. Reduction in supply margin, possibly due to: unusual load increase, nonstart of generating units, fuel shortage,loss derating due to environmental constraints, derating due to auxiliary failure, rescheduled maintenance of generating unit,

2 Reduction in delivery margin, possibly due to: loss of transmission line or transformer, unusual distribution of load, increase in power wheeling, derating due to unusually hot weather 3. Increased probability of disturbance, possibly due quakes), civil disturbances, accidents to approach or arrival of severe storms, natural disasters (such as floods, earth-

Alert

-emergency

Nature of the transltion: violation of inequality constraints Relevant constraints: line flows (emergency ratings), component loads (emergency ratings), voltage levels, system frequency, machine or bus voltage angles Proximate cause: malfunction and/or loss, temporary or permanent, of a major piece of equipment Potential triggers: internal electrical or mechanical failure, malfunction of protective or control device, external events such as lightning, plane crash, etc.

Emergency- in extremis Nature of the-transition: loss of system integrity; violation of equality constraints Proximate cause: loss of tles resultlng in formation of system island(s) that are uncontrollable and/or unable to carry their internal load Potential triggers: prolonged overloading of critical ties, malfunction of protective equipment, successive disturbances during emergency

II. Control methods

A. Alert state: preventive (deliberate) control to restore adequate reserve margins: generation shifting (security dispatch), increased reserves, tie-line rescheduling, manning of normally unmanned (sub) stations. voltage reduction (not always effective or desirable) B. Emergency state: immediate control to clear equipment overloads: fault clearing, fast valving, dynamic braking, exciter control, dc modulation, load control, capacitor switching, plus all controls mentioned in the alert state C. In extremis: heroic action to contain the disruption of the entire system: all of above, plus load shedding, controlled islanding D. Restorative state: deliberate (corrective) control to reestablish a viable functioning system: unit restartlng and/or synchronization, load restoration, resynchronization of areas

52

mrt~culous proctx ul system restoration. Al the pre5rnt state of the art, this remains a manual process that requires careful and thorough advance planning if it is to be achieved at all promptly. The design of the system must be such that equipment lost from service during the final stales of an emergency, while the system is in extrrttris, be protected from unnecessary damage. In addition, all necessary means m~lst be available for a systematic restart of the system, even from a complete blackout, and the operators musl be thoroughly familiar with the procedures for such a restart. The system must lend itself to sectionalizing so (hat thr load that has been lost can be reenergired in blocks small enough to be manageable; simultaneously, local energy sources at generating stations must provide adequate power to auxiliaries (such as pumps, exciters, etc.) required for unit start-up. Careful advance planning for system recovery following a widespread blackout can do much to minimize its duration and hence to limit the conseauences.

ing a basic mathematical theory (originally developed by Lyapunov) to the analysis of power system stability. The problem of conservative results, high computational burden, and the need for initial system time simulation associated with Lyapunovs theory have all been eliminated or reduced to a point where the new method may play a significant role in both the planning and operation of future power systems. The method can assess the relative stability of a system in a given operating state with limited computational burden, which may lead to an effective application in the security assessment of power systems. Subsequently, other program areas have been initiated that will have an impact upon the design and operation of systems during the non-normal system operating state. A subprogram entitled System Effectiveness Analysis is attempting to develop a framework and methodology to integrate system peformance with structural reliability, cost, and worth of service to the customer when planning future systems. Other programs, sponsored by the Electric Power Research Institute (EPRI). are developing tools and further knowledge that will be required to handle the diflicult problems of system operation during emergencies. For example, a large-scale computer program is being used in one project to develop improved simulation of the dynamics of turbine boiler systems, their auxiliary equipmerit, and their performance during emergency conditions such as reduced voltage and system frequency. Such a program can be instrumental in dealing effectively with system emergencies. As a matter of fact, the understanding developed through its design and use is already becoming a factor in system operation. A concerted effort to develop an approach to system planning, design, and operation that properly recognizes all the system operating states and the state-transition mechanisms is needed. The success of this effort requires not only the cooperation of the nations utilities, but of EPRI, the U.S. Government, and major U.S. manufacturing and consulting firms as well. +

Ongoing research
Control design has focused primarily on the normal state, in line with the philosophy of designing the system to be strong enough to withstand normal contingencies. The consideration of control during the emergency s t a t e h a s b e e n b a s e d m a i n l y o n t h e st~idy o f t h e characteristics and application of individual devices. However, an attempt to view the emergency state as a control regime and to develop an integrated control strategy for it came early in 1975 when the Energy Research and Development Administration (now part of the U.S. Department of Energy) issued a Request for Proposals for research in this area. Presently, four research projects on various aspects of emergency control are underway within that subprogram (Specrru,n, Oct. 1977, p. 21). One project, at Wayne State University, addresses problems associated with maintaining the synchronous operation of generators when subject to severe disturbances such as system short circuits (faults). An optimal aiming strategy attempts to guide the unstable generators back to equilibrium with the rest of the system. Considerable testing in a simulation and prototype environment is needed before actual system implementation, but the approach promises to be superior to existing open-loop approaches. In another project, Washington University (St. Louis, M O.) has developed a new state space called the local equilibrium state, which is mathematically equivalent to the existing one. It is a new equivalent system description that can be obtained with local information only, thus simplifying the simultaneous measurement problem. The project will demonstrate the practicability of this new state space and use it to develop strategies for coordinated control of the system during emergency situations. A third project, at the Massachusetts Institute of Technology, is addressing slower-speed aspects of system emergencies. The projects objective is to develop a framework for emergency control by considering the requirements for information flow and modeling at various levels in the system-including individual generating plants, transmission system buses, and the system control center. The fourth project, at Systems Control, Inc., aims at assessing the stability of a system when subjected to a dist.urbancc. This company hzs been successful in apply-

L. Ii. Fink (F) is Assistant Director for Systems Management and Structuring with the U.S. Department of Energy, Electric Energy Systems Division. His main interests are in the application of systems theory to the planning, design, and operation of electric energy systems. He has also worked in the application of field theory to energy systems and in the modeling, simulation, and control of generating plants and of individual and interconnected power systems. He has received the B.S.E.E. and M.S.E.E. degrees from the University of Pennsylvania. Kjell Carlsen (M) is a manager of systems analysis In the Electric Utility Systems Englneerlng Department (EUSED) at the General Electric Company in Schenectady, N.Y. He has worked with the ERDA as a Branch Chief for Systems Control and has planned, developed, initiated, and managed research in the area of control and operation of future electric energy systems. He has developed models and computer analysis tools for use in the investigation of subsynchronous resonance and shaft torsionals and has worked in the areas of excitation systems and general dynamic performance of power systems. He received the B.S.E.E., from Purdue University and the M.S.E.E. and Ph.D. from the University of Wisconsin.