2017 MRO Regional Risk Assessment

Transcription

1 2017 MRO Regional Risk Assessment March St. Peter Street, 800 St. Paul, MN P F W. MidwestReliability.org CLARITY ASSURANCE CLARITY RESULTS ASSURANCE RESULTS

2 Page 2 Table of Contents 1. Preface Regional Risk Assessment System Performance Assessments Requirements with High Risk Violations MRO Standing Committees Identified Risks MRO Staff Identified Risks MRO Performance Areas Conclusion Additional Reference Materials... 23

3 Page 3 1. Preface Midwest Reliability Organization s (MRO) vision is to maintain and improve the quality of life through a highly reliable regional Bulk Power System. MRO operates as a cross-border Regional Entity and is headquartered in Saint Paul, Minnesota. The MRO Region covers roughly one million square miles spanning the provinces of Saskatchewan and Manitoba, and all or parts of the states of Illinois, Iowa, Minnesota, Michigan, Montana, Nebraska, North Dakota, South Dakota and Wisconsin. The region includes more than 106 organizations that are involved in the production and delivery of electricity to more than 20 million people. These organizations include municipal utilities, cooperatives, investor-owned utilities, transmission system operators, a federal power marketing agency, Canadian Crown Corporations, and independent power producers. MRO's primary responsibilities are to: ensure compliance with mandatory Reliability Standards by entities who own, operate, or use the interconnected, international Bulk Power System (BPS); conduct assessments of the grid's ability to meet electricity demand in the region; and analyze regional system events.

4 Page Regional Risk Assessment This 2017 MRO Regional Risk Assessment (RRA) is an annual report that identifies risks specific to MRO entities and the MRO footprint that could potentially impact the reliable operations of the BPS and supports the 2017 Compliance Monitoring and Enforcement Plan (CMEP) Implementation Plan (IP). Each Regional Entity performs an analysis of its footprint and proposes regional Risk Elements, if any are identified, to supplement the ERO Risk Elements which are: Critical Infrastructure Protection Extreme Physical Events Maintenance and Management of BPS Assets Monitoring and Situational Awareness Protection System Failures Event Response/Recovery Planning and System Analysis Human Performance The 2017 MRO RRA did not identify any additional regional Risk Elements to add to the suite of ERO Risk Elements. In order to ensure that the ERO Risk Elements as well as any significant risks recognized by the MRO RRA are addressed, MRO has developed Performance Areas. Performance Areas organize requirements according to the activities performed by entities in order to promote reliable operations of the BPS and simplifies the process of identifying those requirements that should be monitored in order to effectively address identified risks. The 2017 MRO Performance Areas list can be found at the end of this report and is also available on MRO s website 1. Each Performance Area includes a description of the identified risk and a list of associated requirements that address those risks. The following sections of this report highlight significant risks identified by MRO that could impact the reliability of the BPS in the region and highlights ongoing work by MRO stakeholders to improve reliability and resiliency. 1

5 Page System Performance Assessments Misoperations Since 2012, NERC Event Analysis 2 metrics have identified protection system misoperations as a significant contributor to the severity of BPS events. In 2016, MRO s Protective Relay Subcommittee (MRO PRS) released a whitepaper 3 identifying causes of and opportunities to prevent misoperations observed within MRO s Region. The whitepaper discusses the misoperation modes of protection system schemes that have been observed to have a disproportionate share of misoperations within the MRO Region, and approaches to reduce the occurrence of those misoperations. The MRO PRS whitepaper reviewed MRO regional misoperation submissions between 2010 and 2014, and identified those misoperations that were attributed to overcurrent relay setting issues, Directional Comparison Blocking schemes (DCB), and Direct Transfer Tripping (DTT). The review found that of the 206 settings errors identified, overcurrent relay settings accounted for 68 (33%) of the errors. There were also misoperations attributed specifically to modeling errors as it relates to overcurrent settings issues. In particular, incorrect or non-existent mutual coupling modeling of Figure 2.1.1: Transmission System Misoperation Rates transmission lines in short circuit models has been found to result in incorrect ground overcurrent settings. The DCB misoperations all involved a failure to receive a blocking signal, and all occurred during an external fault. Of the DTT scheme misoperations, 80% were associated with communication channel transients that results in the undesirable receipt of a DTT. The 2016 NERC State of Reliability 4 also discussed a focus on the instantaneous ground overcurrent function and improving relay system commissioning tests, and reports an ERO-wide relay misoperation rate decrease from 10.4% in 2014 to 9.4% in pdf 4

6 Page 6 MRO uses Figures and to trend misoperations in the region. Figure indicates the percent of misoperations per total number of operations dating back to Figure is the total number of misoperations that have been reported to MRO since Analysis of misoperations of protection systems provide a valuable opportunity to identify ways to improve the Figure 2.1.2: MRO Total Misoperations reliability of the BPS. Therefore, MRO has created the Misoperation Analysis performance area to monitor risks associated with misoperations. Regional Event Analysis The Event Analysis process begins as soon as possible after an event to determine the significance of the event and level of analysis required. The lead entity prepares a brief report which is reviewed by MRO Operations Staff. During the event review process, MRO Operations staff and the Registered Entity work together to: Determine the underlying causes of events and supporting identification and tracking of recommendations to prevent reoccurrence Disseminate important event information and lessons learned to BPS owners, operators, and users to improve operations Provide feedback to NERC s development of Reliability Standards, training and education, and trend analysis In addition to the Event Analysis process, MRO Risk Assessment and Mitigation (RAM) staff perform Event Evaluations for all reported events and disturbances. The Event Evaluation focuses on compliance with Reliability Standards. The Event Evaluation allows RAM staff to determine

7 Page 7 whether to close the event from the compliance perspective or request that a registered entity perform a Compliance Assessment, as described in the 2017 CMEP Implementation Plan 5. RAM staff also use the Event Evaluation to identify reliability risks that may inform future compliance monitoring activities. The Event Evaluation may become input to the determination of a registered entity s inherent risk, or become part of the oversight of NERC Reliability Standards and Requirements that are event-based. If and when identified risks are considered regional or might impact multiple entities, MRO would utilize the RRA to investigate the issue further. The Event Evaluations are also used by RAM staff to identify and share risks that are not covered by a NERC Reliability Standard. Recent reportable events have been associated with human error, misoperations, breaker failures, commissioning errors, and weather. Weather continues to be the primary driver of events associated with a loss of load. Figures and provide a high level overview of the attributes and event severity for events reported since September As discussed earlier in this report, the most common attribute associated with the 69 total events reported has been misoperations. Figure 2.1.4, the Total and Average Event Severity Index (ESI), illustrates the number of events per year, broken down by ESI rating. Figure 2.1.3: Attributes of MRO Events 5

8 Page 8 It is difficult for registered entities to prepare for high-impact, low-probability system events because they likely have not gained the necessary knowledge through experience. The knowledge that has been gained through analysis of events across the NERC footprint is reflected in the requirements that are included in the Adequacy of Facilities for Event Response Performance Area. Other event related Performance Area s include Emergency Plan Development and Coordination, Preparation for Physical Events, and Operations During Events. The specific event-related risks for each Performance Area are included in the table at the end of this report. Figure 2.1.4: Total and Average Event Severity Index, per Year Figure above depicts the ESI rating system MRO staff has developed to analyze and trend events in the region. The ESI value is a weighted sum of the generation loss, load loss, and number of facilities outaged during an event. Each year is composed of several bars representing each reported event, with the size of the bar corresponding to the ESI rating for that event. The category of each event is denoted by the color of the bar as indicated in the legend. The green bar in each column represents the average ESI per event that year. The causes of the 2016 uptick in event count are under consideration by MRO staff and the MRO PRS, which has launched detailed event peer reviews for four of the larger and more complex events that occurred. The intent of the peer review is to fully understand the root cause and share any lessons learned with the rest of the region and ERO.

9 Compliance Severity Index 2017 MRO Regional Risk Assessment Page Requirements with High Risk Violations In order to evaluate progress toward a key reliability goal of fewer, less severe events and instances of noncompliance, MRO developed the Compliance Severity Index (CSI) to represent the total risk that all instances of noncompliance present to the reliability and/or security of the BPS in the MRO Region. The MRO RAM staff undertake a rigorous process to evaluate each instance of noncompliance, based upon an analysis of the specific facts and circumstances, to determine the potential and actual risk to the reliability and/or security of the BPS. The product of this evaluation is a Risk Determination with an assigned Risk Level of Minimal, Moderate, or Serious. MRO uses the Risk Determination and the finding discovery method (Audit Finding, Self-Certification, Self- Report, etc.) to calculate the CSI. MRO has mapped all historic instances of noncompliance into the current, equivalent Reliability Standards and requirements. This allows the same risk associated with varying instances of noncompliance to be analyzed, regardless of new associated Reliability Standards or requirements. Figure provides the 15 highest risk requirements based on the Total CSI which reflects noncompliance history in the MRO Region. 15 Highest Risk Requirements based on Total CSI (2007-December 31, 2016) Minimal Moderate Serious Figure 2.2.1: 15 Highest Risk Requirements based on Total CSI MRO utilizes this information to ensure appropriate attention is paid to the highest risk requirements, including inclusion in the MRO performance areas. In particular, MRO utilizes the CSI to evaluate trends in instances of non-compliance for higher risk requirements. If a requirement is showing a year over year uptick in total CSI, MRO may prioritize the oversight for that requirement. Prioritized oversight might include additional spot-checks or increased monitoring frequency through a Compliance Oversight Plan.

10 Page MRO Standing Committees Identified Risks In February 2015, twenty-five MRO board members, stakeholder committee members and MRO staff gathered in St. Paul to review the NERC RISC Priority List, identify top reliability risks to the bulk power system in the MRO Region, and create strategies for the technical committees to address those risks. Committee and board members identified six risks from the NERC RISC Priority List 6 as the top risks in the MRO Region. They are: Human Performance Cybersecurity/Physical Security and the work of the E-ISAC Changing Resource Mix Regulatory Uncertainty Situational Awareness Protection Systems These risks were assigned to one of four MRO stakeholder committees, Compliance, Operating, Planning, and Standards, to develop mitigating strategies. The MRO Compliance Committee undertook a number of initiatives, including outreach to MRO registered entities on the self-logging program and completing a survey of MRO registered entities to identify ways to simplify compliance monitoring and enforcement and improve guidance where needed. The Performance and Risk Oversight Subcommittee (PROS) developed example internal controls for 30 key requirements, including the 10 most violated, the top 10 serious risk and the top 10 having the most impact on reliability. These example internal controls were published in 2016, and presented at MRO s 2016 CMEP Conference by the chair of the MRO PROS 7. Finally, the committee worked to increase engagement with the Mid-Continent Compliance Forum. The MRO Operating Committee worked on two risk areas: Human Performance and Protection Systems. To address Human Performance, the committee drafted a whitepaper to help registered entities identify ways to reduce knowledge-based human performance errors for higher risk activities that can impact the reliable operations of the bulk power system. In addition, the MRO Protective Relay Subcommittee has been categorizing historic misoperations according to scheme type to identify which protective schemes are most associated with misoperations in the MRO Region. The goal is two-fold: first, to provide recommendations and helpful advice on how to proactively reduce misoperations specific to these schemes; and second, to provide helpful advice on how to properly mitigate misoperations that have already occurred to avoid recurrence. The MRO Planning Committee is addressing the regional changing resource mix by reviewing quarterly reports provided by Planning Coordinators in the MRO Region. The committee is closely monitoring risks associated with a rapid increase in variable energy resources in the region and the growing dependence on natural gas generation due to environmental rules and regulation. Regional concerns are also being addressed through seasonal and long-term reliability assessments and

11 Page 11 planning activities. Further discussion on the risks associated with a changing resource mix are provided in the section below. The MRO Standards Committee addressed Regulatory Uncertainty and Cybersecurity/Physical Security, particularly Reliability Standards that may be ambiguous, duplicative, administrative in nature, or do not directly address risk to the bulk power system. One key element of a risk-based approach to compliance monitoring and enforcement is establishing a feedback loop from riskbased activities to the standards development process. The committee identified an example of a requirement that presented no, or minimal, reliability impact to the bulk power system and used the opportunity to create and test this feedback loop. Once the requirement was identified, the committee drafted a NERC Standards Authorization Request (SAR) to implement a change to the Reliability Standard(s). The SAR was submitted to NERC to remove the redundant requirement VAR-001-4, R3. The SAR was forwarded to the VAR Enhanced Periodic Review Team (ERPT) for review. In 2016 the ERP concluded that the approval of the NERC Reliability Standard TOP addressed the concerns in the SAR, and therefore, they did not approve the SAR. Although the SAR was not approved, it did successfully test the feedback loop. Changing Resource Mix Changing resource mix is a significant issue in MRO region. One primary risk of integrating variable generation such as wind is replacing the energy currently produced by large rotating machines. Large rotating machines provide diverse characteristics such as inertia, the ability for the power system to recover from a frequency event, and voltage support. The power system must have the ability to raise and lower generation or load, automatically or manually, under normal and post contingency conditions. Historically, conventional generators with large rotating mass and the ability to respond automatically to frequency changes have provided most of the grid s so called essential reliability services. As variable generators, like wind and solar, are introduced to the power system, it is becoming necessary to examine each of the essential reliability service requirements to ensure the bulk power system remains reliable. In the past, the grid has operated reliably without explicitly quantifying each essential reliability services element, as most conventional resources provided these services by default. The significant increase in variable resources, coupled with retirement of conventional generation, will increase the complexity of commitment, dispatch, and control room operations. 2.4 MRO Staff Identified Risks Interconnection Reliability Operating Limits (IROL) The number of IROLs in the MRO region is decreasing over time and no new IROLs are being established. Some, but not all, of the retiring IROLs have been tied to changes in the BES. However, many retirements may be related to the interpretation of criteria for defining an IROL, which is currently being reevaluated by industry groups. MRO staff have been attending the System Operating Limit (SOL) Standard Drafting Team meetings for Project , which includes revising the language regarding establishment of IROLs. The decreasing number of IROLs results in risk posed to the BES, including constraints unknown to operators and the

12 Page 12 reduced applicability of Reliability Standards and Requirements to a number of facilities in the MRO region. In addition, if Real-Time Assessments (RTA) or other operational tools fail, an IROL can act as a proxy to monitor the system across interfaces that could cause the most severe impact if violated. When a number of failures affect the system, operating the system below IROLs will help limit the impact on the grid. In planning models, generation, load, and transactions can be dispatched to achieve conditions that approach the IROL, producing a stressed case. This can be useful and is the recommended approach to analysis when performing Under Frequency Load Shedding (UFLS) studies, Under Voltage Load Shedding (UVLS) studies, or geomagnetic disturbance studies, amongst other planning activities. New High Risk Reliability Standards and Requirements FAC, TOP, and IRO Operating Limits Reliability Standards As part of Project , several FAC, TOP, and IRO related Reliability Standards are subject to enforcement in The project was developed to address FERC technical concerns identified in the 2013 NOPR 8, including operating within System Operating Limits and Interconnection Reliability Operating Limits. Revised Reliability Standards enforceable January 1, 2017: IRO Reliability Coordination Data Specifications and Collection TOP Operational Reliability Data Revised Reliability Standards enforceable April 1, 2017: FAC System Operating Limits Methodology for the Planning Horizon FAC System Operating Limits Methodology for the Operating Horizon IRO Reliability Coordination - Responsibilities IRO Reliability Coordination - Monitoring and Analysis IRO Reliability Coordination Operational Analysis Real-time Assessments IRO Coordination Among Reliability Coordinators IRO Outage Coordination TOP Transmission Operations TOP Operations Planning Included within these Reliability Standards is a new requirement that TOPs ensure a Real Time Assessment (RTA) be performed at least every 30 minutes. Many medium and small TOPs in the MRO footprint have historically relied on their RC to provide this technical support. These entities are at risk of having issues if their RC s RTA or communication capabilities prevent the TOP operators from ensuring the RTA is performed every 30 minutes. MRO has increased its oversight and outreach to educate entities on this new requirement. 9 Possible remedies to manage risk pdf, Pg. 22

13 Page 13 include having a TOP run its own RTA, or contracting backup and/or primary RTA to a neighboring TOP or other third party. Either of these options would allow a level of redundancy that may reduce the entity s risk exposure. Geomagnetic Disturbance Reliability Standards EOP and TPL The enforceable standard EOP and NERC Project GMD (Reliability Standard TPL-007-1) were developed to address the impact of potential geomagnetic disturbances to the BPS. Geomagnetic disturbances are a temporary disturbance of the Earth's magnetosphere caused by a solar wind shock wave and/or cloud of magnetic field which interacts with the Earth's magnetic field. Geomagnetically induced currents (GICs) are electrical currents induced as a result of GMD. Geomagnetic disturbances are considered a risk in the MRO Region because: Geographic location in the northern hemisphere where the anticipated effects of GMD are significant The conductivity of the Earth is high in parts of the MRO Region based on its geology The BES in the MRO region largely consists of high voltage and lengthy transmission lines which are most susceptible to GMD Because GMDs are low frequency, high impact events, operating entities have little or no experience mitigating the effects. Therefore, studying and planning for operations during such events is critical. These GICs can have direct impact on the BES by potentially causing excessive VAR demand that can result in voltage collapse and possible damage to transformers and protection system misoperations. The primary impact of GMD is on large power transformers can be devastating given the long lead time to manufacture those devices. It is critical that large transformers are protected against such an event since maintaining spare transformers in large quantities is not a cost effective option. Until permanent protection equipment and system design changes can be put in place per TPL requirements, operators will be required to maintain temporary mitigation and actions per EOP-010-1, including implementation of a GMD Operating Plan. Model Data Reliability Standards Modeling, Data, and Analysis (MOD) Reliability Standards, MOD and MOD provide a framework for model data requirements and reporting procedures to support the creation and validation of interconnection-wide steady-state, dynamic, and short-circuit models. The cases developed through these processes form the foundation of power system analysis used to plan and operate the BPS. MOD-032-1, Data for Power System Modeling and Analysis, requires Planning Coordinators (PCs) and Transmission Planners (TPs) to jointly develop model data requirements and reporting procedures. Other requirements mandate applicable entities to provide the data specified under

14 Page 14 R1 to their PC and TP. Additionally, the PC is required to provide its models to the entity or entities designated by NERC in support of interconnection-wide case creation. MOD-033-1, Steady State and Dynamic System Model Validation, complements MOD and ensure that models used to plan and operate the BPS accurately reflect reality. The PC is required to develop and implement a process to validate its steady-state and dynamic models, while the Reliability Coordinator (RC) and Transmission Operator (TOP) must provide data to the PC as needed to perform the validation. Of particular interest is the validation of model frequency response, as incorrect load models, governor models, or plant-level control models can have a significant effect on a case s response to an event. When performing validation under MOD-033-1, the focus is on validating the PC s portion of its existing system. Three other NERC Reliability Standards are also closely related to the model validation work performed under MOD PRC-002-2, Disturbance Monitoring and Reporting Requirements, which ensures that PCs will have data available to facilitate analysis of BES disturbances. Transmission Owners (TOs) are required to determine where disturbance monitors will be located, and the TOs and Generator Owners (GOs) must provide captured data to their PCs. PRC provides an avenue for the PC to collect data for model validation under MOD The two other related Reliability Standards, MOD and MOD-027-1, are parallel generator model verification Reliability Standards that require the GO to perform verification of its exciter and governor models. The GO chooses its component models from those allowed by the TP (as detailed in MOD-032), and compares an individual unit s simulated response against the actual response to either a system disturbance or a staged test. The verification performed under MOD and MOD covers the individual components of a generator model, while MOD validates the system-wide generator and BES facility response. The MOD and MOD Reliability Standards require the GO to verify a percentage of its units over a phased-in implementation period. Understanding the many relationships between the PC, RC, TP, TO, and GO will be a critical aspect of successful model creation and validation. Obtaining assurance that this coordination is taking place will be a specific focus area for compliance monitoring activities in the MRO Region. Planning Standard TPL Reliability Standard TPL establishes the requirements needed to develop a BES that will operate reliably over a broad spectrum of system conditions following a wide range of probable events. The transmission planning and system analysis of the BES is considered a risk for the MRO Region primarily for the following reasons: The current standard lacks a requirement for Planning Coordinators (PCs) to jointly conduct system analysis as a whole system within the Eastern Interconnection (EI) Market-based dispatch is not required to be modeled and analyzed The power system will need to be assessed from an interconnection wide basis so that the generation and transmission plans developed by each of the PCs within an interconnection are

15 Page 15 brought together and evaluated as a whole system. This is particularly important given the risks of multiple state and jurisdictional boundaries within the EI. The analysis performed must respect and recognize the reality of how electricity flows on the grid. For example, the 2008 frequency event that occurred in Florida resulted in a system oscillation that propagated across the EI all the way to Manitoba, showcasing how far electrical inter-area oscillations can travel. The TPL standard requires the distribution of planning assessment results to adjacent Planning Coordinators and adjacent Transmission Planners, but does not require entities to coordinate analysis jointly within an interconnection. The coordination requirement that was previously included in the retired fill-in-the-blank Standard TPL-005 was not mapped to the new Standard. MRO believes there needs to be assurance that a contingency event in one PC s footprint adversely impacting another PC s planning area is known by all PCs within an interconnection. The absence of a market based dispatch requirement in TPL specific to the treatment of imports and exports should be reexamined in order to ensure consistency with the market flowbased systems utilized by ISO/RTOs. Closer alignment of Commercial Flow (i.e., actual realtime market flow) will ensure that power flow models utilized in transmission planning are reflective of actual system conditions. Imports and exports are critical components of the power transfer calculation because they have significant impacts on flowgates and loop flows. Geography and Other Regional Risk Geography With a northern Midwest and central Canadian geographic area, the MRO region is exposed to the following risks tied to Geography and Topology: Weather o Extreme cold o Icing o Tornadoes o Thunderstorms and lightning o Flooding o GMD could have a significant impact on the MRO footprint as described above Extreme cold has been a particular focus of NERC in the past few years following the 2014 polar vortex. During the polar vortex, cold weather resulted in increased demand for natural gas (which must be coordinated with gas-powered generation), as well as stressing the cold weather design criteria of generators. In general, MRO generators have mitigated this risk and are ready for the cold as regular operations include temperatures well below freezing. Electric and natural gas coordination remains a key area of emphasis in the region. Other Regional Risks Changing resource mix (covered in depth in MRO Standing Committees Identified Risks, above) o Increasing level of wind penetration o Retiring of nuclear units

16 Page 16 o Possible retiring of base load coal units (See: NERC essential reliability services) o Increased reliance on natural gas This has an increased risk during an extreme cold event because many metropolitan areas rely on natural gas for heating. Complex interconnections between TO and TOPs o Many of MRO s registered entities in the Dakotas, Iowa, and Minnesota are highly interconnected with neighboring TO/TOP systems, with a significant number of jointly owned and operated transmission facilities. This increases risks associated with equipment maintenance, site access, situational awareness, communication, and coordination. NERC Reliability Standards addressing risk posed by changing resource mix and extreme weather conditions are still maturing. Possible methods of reducing exposure may be found in improving BES resiliency, specifically by improving recovery time and decreasing impact of weather events. 3. MRO Performance Areas In order to facilitate the analysis of Reliability Standards and ensure that significant risks identified by both the ERO Risk Elements and those discussed in the RRA, MRO has organized requirements into Performance Areas. Evaluating Performance Areas helps to simplify the identification of those requirements that should be monitored in order to effectively address the risks that are known to exist. The list of 2017 MRO Performance Areas can be found in the table below. The table includes the name of each Performance Area along with a description of the associated risks and a list of requirements that address those risks. Performance Area Backup/Recovery Associated Standard & Justification Requirement(s) These requirements address actions entities must perform to CIP R1, R2, R3 help mitigate the potential negative impact of a cybersecurity CIP R1, R2 incident or cyber asset or system failure that could negatively impact the reliability of the bulk power system. Change Management These requirements contain actions entities must perform to help mitigate the potential negative impact of changes or patches to cyber assets or systems, or physically changing or removing cyber assets or systems, could have on the reliability of the bulk power system. Cyber/Physical Asset/System Identification These requirements identify which cyber / physical assets and / or systems entities must include within their CIP programs. CIP R2 CIP R2, R3, R4 CIP R1, R2 CIP R2 CIP R1, R2

17 Page 17 Performance Area Transient Cyber Asset and Removable Media Associated Standard & Justification Requirement(s) Requirement contains actions entities must perform to help CIP R4 mitigate the potential negative impact transient cyber assets and removable media could have on the reliability of the bulk power system. User and Access Management Physical Security Actions to Prevent Emergencies Adequacy of Facilities for Event Response These requirements contain actions entities must perform to help mitigate the potential negative impact unauthorized cyber and physical access to cyber assets or cyber systems could have on the reliability of the bulk power system. Facilities that meet the criteria given in CIP R1 must be protected. These facilities, if rendered inoperable or damaged could result in widespread instability, uncontrolled separation, or Cascading within an Interconnection. The CIP requirements build upon each other to address the total risk. These requirements address actions that entities must perform once an emergency condition is foreseen, in order to prevent the occurrence of a system event. This Performance Area addresses: - imminent vegetation threats - coordination among RCs - coordination between RCs and TOPs - predicted or actual IROL exceedances - transmission planning studies It is difficult for entities to prepare for high-impact, lowprobability system events because they have not gained the necessary knowledge through experience with these events. The knowledge that has been gained through analysis of actual and theoretical events across the NERC footprint is reflected in the requirements that are included in this Performance Area. These requirements address issues related to: - backup control centers - UFLS - RAS - protection system settings CIP R2, R3, R4, R5 CIP R1, R2 CIP R1, R2, R3 CIP R1, R5 CIP R3 CIP R1 CIP R1, R2, R3, R4, R5, R6 FAC R4 IRO R1, R2 IRO R1 IRO R2 IRO R3, R4, R5, R6, R7 IRO R1 TOP-001-1a R3, R4 TPL R3, R5, R7 EOP R3, R4, R6, R8 PRC R9, R10, R15 PRC R3 PRC R3 PRC R2 PRC R2 PRC R2 PRC R2 PRC R1, R2

18 Page 18 Performance Area Emergency Plan Development and Coordination Operation During Events Preparation for Physical Events Effective Information Exchange Justification Associated Standard & Requirement(s) These requirements address planning for emergencies, EOP b R1, R2, R3, including coordination with neighboring entities. Specific R4 areas of emergency planning include: EOP R8 - coordination of emergency assistance EOP R1, R2, R4, - restoration plan validity R5, R6, R9, R13, R14 - Blackstart maintenance and testing EOP R1, R6 - BUCC transitions EOP R1, R2, R7 - preparation for specific tasks that may need to be EOP R1, R2, R3, performed during an emergency R4 TOP R6 These requirements address operational risks that are present only during emergency conditions. Operating entities are required to meet performance requirements related to the following tasks: - mitigation of IROL exceedances - contingency reserves - TOP/BA/RC responsibilities - shedding of firm load - coordination and communication during emergencies Due to the extreme infrequency of harmful GMD events, operating entities have little or no experience mitigating the effects. Studying and planning for operation during such events is critical to BPS reliability. Incorrect actions caused by unclear communication can cause damage to equipment and unnecessary outages. COM replaces version 2 on 7/1/2016. BAL R4, R6 EOP R1, R4, R7, R8 EOP R5 EOP R5, R6, R7, R8, R9 IRO R3 TOP-001-1a R2, R5, R6, R7, R8 TOP R1, R2, R12, R14 TOP R4 TOP R1, R2, R3, R4 TOP R1 EOP R1, R3 COM R4, R5, R6, R7 IRO R3, R5, R6 TOP R15 TOP R3, R5, R6, R7 Operator Training Asset Inventory Management Operator competency is crucial to the reliable operation of the BPS during normal and emergency operations. Due to the infrequency of the need for system restoration it is important that operators are adequately trained to respond during such emergency conditions. It is very important for entities to develop appropriate ratings for their equipment in order to prevent equipment damage and forced outages, which could result from operating to invalid ratings. FAC R3 has been included because it specifies necessary elements of a rating methodology. EOP R10, R12, R17 EOP R9, R10 PER R1, R2, R3, R4, R5 PRC (ii) R1 FAC R3 FAC R6

19 Page 19 Performance Area Maintenance of BPS facilities Adequacy of Tools and Information to Monitor the BPS Operation Within Limits Justification Associated Standard & Requirement(s) Periodic maintenance and testing of equipment prevents EOP R16 future failures of that equipment. These requirements FAC R6, R7 address maintenance and testing of certain types of NUC R6 equipment that would pose a significant risk to the BPS if the PRC b R1, R2 equipment failed unexpectedly. PRC R3, R4, R5 PRC R1, R2 PRC R1 PRC R1, R2 PRC R1, R2 VAR R6 It is necessary for system operators to have adequate situational awareness in order to perform their functions. These requirements address the following areas: - system analysis tools - real-time data reporting obligations - system frequency - telecommunications - facility and equipment status - forecasted conditions These requirements address important tasks that are performed by operating entities in the following areas: - balancing load and generation - maintaining reserves - emergency assistance - identifying correct limits - IROLs - congestion management - safe nuclear plant shutdown - operator authority - voltage regulation BAL b R4, R5, R6, R13 COM R9, R10 EOP R15 EOP R2 IRO R4 IRO R8 IRO R3 IRO a R1, R9 IRO-010-1a R3 IRO R1 PRC (ii) R2, R6 PRC R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R11, R12 TOP R8, R9, R10, R11 TOP R1, R2, R7 VAR R3, R4 BAL R2 BAL R1 BAL R1 BAL b R7 IRO a R2, R10 IRO-006-EAST-2 R1, R2 IRO R2 NUC R5 PER R1 TOP R18 VAR R2 VAR R1

20 Page 20 Performance Area Modeling Data Operating Studies Planning Assessment Coordination Study and Operating Plan Validity Justification Associated Standard & Requirement(s) Complete and accurate modeling data is essential to the MOD R1, R2, R3 planning process. The following items are critical for the MOD R2 accuracy of data and are addressed by these requirements: MOD R2 - field verifications of modeling parameters MOD R2 - clear statement of data requirements MOD R1, R2, R3, - protection system settings that impact system studies R4 PRC R4 TOP b R19 TPL R1 Operating studies are performed in order to establish the limits to which the system can be operated in real-time. These requirements address the performance of such studies. One of the greatest challenges in system planning is coordination with other planning and operating entities. These requirements address this issue to help ensure that complicated system boundaries do not cause errors in planning assessments. Operating studies are performed in order to establish the limits to which the system can be operated in real-time. These requirements address some of the technical concerns that must be included in operating studies in order to ensure their validity. The following topics are addressed: - operating reserves - interconnection studies - IROL determination - transfer capability - safe nuclear plant shutdown - generator capability - planned outages - documentation of studies - criteria for simulated system performance FAC R5 FAC R6 IRO a R6 IRO R1 IRO R1, R2, R4 NUC R4 TOP R13 TOP b R8, R11 TOP R1, R2, R4 TOP R4 NUC R3, R8, R9 TOP b R2 TPL R7, R8 BAL R2 FAC R1 FAC R3 FAC R4 FAC R1 FAC R2, R3, R4 IRO R1, R2 IRO R2 MOD R4 NUC R7 TOP b R14 TOP R2, R3 TPL R2, R3, R4 TPL R5, R6

21 Page 21 Performance Area System Event Analysis UFLS/UVLS Design and Implementation Misoperation Analysis Protection System Coordination Relay Loadability Justification Associated Standard & Requirement(s) Regional analysis of system events helps to improve EOP R2 reliability and depends on the submission of event reports and PRC R11, R12, R13 disturbance data. PRC R4 Because opportunities to observe actual underfrequency events are very rare, it is important to thoroughly assess the actual performance of UFLS programs when such events occur. PRC-006 provides the framework for a rigorous method to analyze underfrequency events and correct any UFLS program deficiencies. PRC-006 provides a framework for designing an adequate UFLS program. These requirements address technical aspects of the design process that are critical to the performance of the program. PRC-010 requires the entity to address technical concerns with any UVLS programs. Operations of protection systems and RASs provide a valuable opportunity to identify damaged or improperly set equipment. Coordination of generation settings with protection system settings ensures that units do not trip unnecessarily during stressed system conditions. Proper Protection System settings prevent the unnecessary outage of BPS facilities and reduce the risk of further cascading outages. PRC R2, R3, R4, R5, R6 PRC R1 PRC-004-4(i) R1, R2, R3, R4, R5, R6 PRC-004-5(i) R1, R2, R3, R4, R5, R6 PRC R4, R5 PRC R4, R5 PRC R1, R2 PRC R1, R2 PRC R1 PRC R1, R2 PRC R1, R6 PRC R1, R6 PRC R1

22 Page Conclusion The 2017 MRO Regional Risk Assessment discusses many key risks, some of which have already resulted in recommended action for NERC or MRO and its subcommittees and working groups. Each year, MRO will conduct and publish the RRA to identify and review risks posed to the BPS, and ensure the Reliability Standards and requirements are grouped into Performance Areas that are relevant and justified in order to best monitor those risks. The Performance Areas, in conjunction with the ERO Risk Elements, form the basis for MRO s compliance monitoring activities as a starting point for performing Inherent Risk Assessments, and culminating in the development of an entity s multiyear Compliance Oversight Plan. In addition, MRO staff seek to translate key findings and recommendations into region specific feedback for risk assessment and mitigation activities, standards development, and other process improvements.

23 Page Additional Reference Materials NERC 2016 State of Reliability Report _v1.pdf NERC Event Analysis MRO Protective Relay Subcommittee Misoperations Whitepaper 0White%20Paper.pdf NERC 2017 Compliance Monitoring and Enforcement Implementation Plan Enterprise_CMEP_IP.pdf MRO Operating Committee - Human Performance Guide %20Knowledge%20Work.pdf# NERC Reliability Issues Steering Committee (RISC)