PRC-012-2 – Remedial Action Schemes

Purpose
To ensure that Remedial Action Schemes (RAS) do not introduce unintentional or unacceptable reliability risks to the Bulk Electric System (BES).

Applicability
4.1. Functional Entities:

4.1.1. Reliability Coordinator
4.1.2. Planning Coordinator
4.1.3. RAS-entity – the Transmission Owner, Generator Owner, or Distribution Provider that owns all or part of a RAS

4.2. Facilities:

4.2.1. Remedial Action Schemes (RAS)

Effective Date
See the Implementation Plan for PRC-012-2.

Requirements and Measures
R1. Prior to placing a new or functionally modified RAS in service or retiring an existing RAS, each RAS-entity shall provide the information identified in Attachment 1 for review to the Reliability Coordinator(s) where the RAS is located. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]

M1. Acceptable evidence may include, but is not limited to, a copy of the Attachment 1 documentation and the dated communications with the reviewing Reliability Coordinator(s) in accordance with Requirement R1.

R2. Each Reliability Coordinator that receives Attachment 1 information pursuant to Requirement R1 shall, within four full calendar months of receipt or on a mutually agreed upon schedule, perform a review of the RAS in accordance with Attachment 2, and provide written feedback to each RAS-entity. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]

M2. Acceptable evidence may include, but is not limited to, dated reports, checklists, or other documentation detailing the RAS review, and the dated communications with the RAS-entity in accordance with Requirement R2.

R3. Prior to placing a new or functionally modified RAS in service or retiring an existing RAS, each RAS-entity that receives feedback from the reviewing Reliability Coordinator(s) identifying reliability issue(s) shall resolve each issue to obtain approval of the RAS from each reviewing Reliability Coordinator. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]

M3. Acceptable evidence may include, but is not limited to, dated documentation and communications with the reviewing Reliability Coordinator that no reliability issues were identified during the review or that all identified reliability issues were resolved in accordance with Requirement R3.

R4. Each Planning Coordinator, at least once every five full calendar years, shall: [Violation Risk Factor: Medium] [Time Horizon: Long-term Planning]

4.1. Perform an evaluation of each RAS within its planning area to determine whether:

4.1.1. The RAS mitigates the System condition(s) or Contingency(ies) for which it was designed.
4.1.2. The RAS avoids adverse interactions with other RAS, and protection and control systems.
4.1.3. For limited impact1 RAS, the inadvertent operation of the RAS or the failure of the RAS to operate does not cause or contribute to BES Cascading, uncontrolled separation, angular instability, voltage instability, voltage collapse, or unacceptably damped oscillations.
4.1.4. Except for limited impact RAS, the possible inadvertent operation of the RAS, resulting from any single RAS component malfunction satisfies all of the following:

4.1.4.1. The BES shall remain stable.
4.1.4.2. Cascading shall not occur.
4.1.4.3. Applicable Facility Ratings shall not be exceeded.
4.1.4.4. BES voltages shall be within post-Contingency voltage limits and post-Contingency voltage deviation limits as established by the Transmission Planner and the Planning Coordinator.
4.1.4.5. Transient voltage responses shall be within acceptable limits as established by the Transmission Planner and the Planning Coordinator.

4.1.5. Except for limited impact RAS, a single component failure in the RAS, when the RAS is intended to operate does not prevent the BES from meeting the same performance requirements (defined in Reliability Standard TPL-001-4 or its successor) as those required for the events and conditions for which the RAS is designed.

¹ A RAS designated as limited impact cannot, by inadvertent operation or failure to operate, cause or contribute to BES Cascading, uncontrolled separation, angular instability, voltage instability, voltage collapse, or unacceptably damped oscillations.

4.2. Provide the results of the RAS evaluation including any identified deficiencies to each reviewing Reliability Coordinator and RAS-entity, and each impacted Transmission Planner and Planning Coordinator.

M4. Acceptable evidence may include, but is not limited to, dated reports or other documentation of the analyses comprising the evaluation(s) of each RAS and dated communications with the RAS-entity(ies), Transmission Planner(s), Planning Coordinator(s), and the reviewing Reliability Coordinator(s) in accordance with Requirement R4.

R5. Each RAS-entity, within 120 full calendar days of a RAS operation or a failure of its RAS to operate when expected, or on a mutually agreed upon schedule with its reviewing Reliability Coordinator(s), shall: [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]

5.1. Participate in analyzing the RAS operational performance to determine whether:

5.1.1. The System events and/or conditions appropriately triggered the RAS.
5.1.2. The RAS responded as designed.
5.1.3. The RAS was effective in mitigating BES performance issues it was designed to address.
5.1.4. The RAS operation resulted in any unintended or adverse BES response.

5.2. Provide the results of RAS operational performance analysis that identified any deficiencies to its reviewing Reliability Coordinator(s).

M5. Acceptable evidence may include, but is not limited to, dated documentation detailing the results of the RAS operational performance analysis and dated communications with participating RAS-entities and the reviewing Reliability Coordinator(s) in accordance with Requirement R5.

R6. Each RAS-entity shall participate in developing a Corrective Action Plan (CAP) and submit the CAP to its reviewing Reliability Coordinator(s) within six full calendar months of: [Violation Risk Factor: Medium] [Time Horizon: Operations Planning, Longterm Planning]
• Being notified of a deficiency in its RAS pursuant to Requirement R4, or
• Notifying the Reliability Coordinator of a deficiency pursuant to Requirement R5, Part 5.2, or
• Identifying a deficiency in its RAS pursuant to Requirement R8.

M6. Acceptable evidence may include, but is not limited to, a dated CAP and dated communications among each reviewing Reliability Coordinator and each RAS-entity in accordance with Requirement R6.

R7. Each RAS-entity shall, for each of its CAPs developed pursuant to Requirement R6: [Violation Risk Factor: Medium] [Time Horizon: Operations Planning, Long-term Planning]

7.1. Implement the CAP.
7.2. Update the CAP if actions or timetables change.
7.3. Notify each reviewing Reliability Coordinator if CAP actions or timetables change and when the CAP is completed.

M7. Acceptable evidence may include, but is not limited to, dated documentation such as CAPs, project or work management program records, settings sheets, work orders, maintenance records, and communication with the reviewing Reliability Coordinator(s) that documents the implementation, updating, or completion of a CAP in accordance with Requirement R7.

R8. Each RAS-entity shall participate in performing a functional test of each of its RAS to verify the overall RAS performance and the proper operation of non-Protection System components: [Violation Risk Factor: High] [Time Horizon: Long-term Planning]
• At least once every six full calendar years for all RAS not designated as limited impact, or
• At least once every twelve full calendar years for all RAS designated as limited impact

M8. Acceptable evidence may include, but is not limited to, dated documentation detailing the RAS operational performance analysis for a correct RAS segment or an end-to-end operation (Measure M5 documentation), or dated documentation demonstrating that a functional test of each RAS segment or an end-to-end test was performed in accordance with Requirement R8

R9. Each Reliability Coordinator shall update a RAS database containing, at a minimum, the information in Attachment 3 at least once every twelve full calendar months. [Violation Risk Factor: Lower] [Time Horizon: Operations Planning]

M9. Acceptable evidence may include, but is not limited to, dated spreadsheets, database reports, or other documentation demonstrating a RAS database was updated in accordance with Requirement R9.

Compliance

1. Compliance Monitoring Process

1.1. Compliance Enforcement Authority:
As defined in the NERC Rules of Procedure, “Compliance Enforcement Authority” means NERC or the Regional Entity in their respective roles of monitoring and enforcing compliance with the NERC Reliability Standards.
1.2. Evidence Retention:
The following evidence retention period(s) identify the period of time an entity is required to retain specific evidence to demonstrate compliance. For instances where the evidence retention period specified below is shorter than the time since the last audit, the Compliance Enforcement Authority may ask an entity to provide other evidence to show that it was compliant for the full-time period since the last audit.

The applicable entity shall keep data or evidence to show compliance as identified below unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.

The RAS-entity (Transmission Owner, Generator Owner, and Distribution Provider) shall each keep data or evidence to show compliance with Requirements R1, R3, R5, R6, R7, and R8, and Measures M1, M3, M5, M6, M7, and M8 since the last audit, unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.

The Reliability Coordinator shall each keep data or evidence to show compliance with Requirements R2 and R9, and Measures M2 and M9 since the last audit, unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.

The Planning Coordinator shall each keep data or evidence to show compliance with Requirement R4 and Measure M4 since the last audit, unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.

If a RAS-entity (Transmission Owner, Generator Owner or Distribution Provider), Reliability Coordinator, or Planning Coordinator is found non-compliant, it shall keep information related to the non-compliance until mitigation is completed and approved, or for the time specified above, whichever is longer.

The Compliance Enforcement Authority shall keep the last audit records and all requested and submitted subsequent audit records.

1.3. Compliance Monitoring and Enforcement Program
As defined in the NERC Rules of Procedure, “Compliance Monitoring and Enforcement Program” refers to the identification of the processes that will be used to evaluate data or information for the purpose of assessing performance or outcomes with the associated Reliability Standard.

Attachment 1
Supporting Documentation for RAS Review

The following checklist identifies important Remedial Action Scheme (RAS) information for each new or functionally modified² RAS that the RAS-entity must document and provide to the reviewing Reliability Coordinator(s) (RC). If an item on this list does not apply to a specific RAS, a response of “Not Applicable” for that item is appropriate. When RAS are submitted for functional modification review and approval, only the proposed modifications to that RAS require review; however, the RAS-entity must provide a summary of the existing functionality. The RC may request additional information on any aspect of the RAS as well as any reliability issue related to the RAS. Additional entities (without decision authority) may be part of the RAS review process at the request of the RC.

I. General

1. Information such as maps, one-line drawings, substation and schematic drawings that identify the physical and electrical location of the RAS and related facilities.
2. Functionality of new RAS or proposed functional modifications to existing RAS and documentation of the pre- and post-modified functionality of the RAS.
3. The Corrective Action Plan (CAP) if RAS modifications are proposed in a CAP.
4. Data to populate the RAS database:

a. RAS name.
b. Each RAS-entity and contact information.
c. Expected or actual in-service date; most recent RC-approval date (Requirement R3); most recent evaluation date (Requirement R4); and date of retirement, if applicable.
d. System performance issue or reason for installing the RAS (e.g., thermal overload, angular instability, poor oscillation damping, voltage instability, under- or overvoltage, or slow voltage recovery).
e. Description of the Contingencies or System conditions for which the RAS was designed (i.e., initiating conditions).
f. Action(s) to be taken by the RAS.
g. Identification of limited impact³ RAS.
h. Any additional explanation relevant to high-level understanding of the RAS.

____________________________________

² Functionally modified: Any modification to a RAS consisting of any of the following:
• Changes to System conditions or contingencies monitored by the RAS
• Changes to the actions the RAS is designed to initiate
• Changes to RAS hardware beyond in-kind replacement; i.e., match the original functionality of existing components
• Changes to RAS logic beyond correcting existing errors
• Changes to redundancy levels; i.e., addition or removal

³ A RAS designated as limited impact cannot, by inadvertent operation or failure to operate, cause or contribute to BES Cascading, uncontrolled separation, angular instability, voltage instability, voltage collapse, or unacceptably damped oscillations.

II. Functional Description and Transmission Planning Information

1. Contingencies and System conditions that the RAS is intended to remedy.
2. The action(s) to be taken by the RAS in response to disturbance conditions.
3. A summary of technical studies, if applicable, demonstrating that the proposed RAS actions satisfy System performance objectives for the scope of System events and conditions that the RAS is intended to remedy. The technical studies summary shall also include information such as the study year(s), System conditions, and Contingencies analyzed on which the RAS design is based, and the date those technical studies were performed.
4. Information regarding any future System plans that will impact the RAS.
5. RAS-entity proposal and justification for limited impact designation, if applicable.
6. Documentation describing the System performance resulting from the possible inadvertent operation of the RAS, except for limited impact RAS, caused by any single RAS component malfunction. Single component malfunctions in a RAS not determined to be limited impact must satisfy all of the following:

a. The BES shall remain stable.
b. Cascading shall not occur.
c. Applicable Facility Ratings shall not be exceeded.
d. BES voltages shall be within post-Contingency voltage limits and post-Contingency voltage deviation limits as established by the Transmission Planner and the Planning Coordinator.
e. Transient voltage responses shall be within acceptable limits as established by the Transmission Planner and the Planning Coordinator.

7. An evaluation indicating that the RAS settings and operation avoid adverse interactions with other RAS, and protection and control systems.
8. Identification of other affected RCs.

III. Implementation

1. Documentation describing the applicable equipment used for detection, dc supply, communications, transfer trip, logic processing, control actions, and monitoring.
2. Information on detection logic and settings/parameters that control the operation of the RAS.
3. Documentation showing that any multifunction device used to perform RAS function(s), in addition to other functions such as protective relaying or SCADA, does not compromise the reliability of the RAS when the device is not in service or is being maintained.
4. Documentation describing the System performance resulting from a single component failure in the RAS, except for limited impact RAS, when the RAS is intended to operate. A single component failure in a RAS not determined to be limited impact must not prevent the BES from meeting the same performance requirements (defined in Reliability Standard TPL-001-4 or its successor) as those required for the events and conditions for which the RAS is designed. The documentation should describe or illustrate how the design achieves this objective.
5. Documentation describing the functional testing process.

IV. RAS Retirement

The following checklist identifies RAS information that the RAS-entity shall document and provide to each reviewing RC.
1. Information necessary to ensure that the RC is able to understand the physical and electrical location of the RAS and related facilities.
2. A summary of applicable technical studies and technical justifications upon which the decision to retire the RAS is based.
3. Anticipated date of RAS retirement.

Attachment 2
Reliability Coordinator RAS Review Checklist

The following checklist identifies reliability-related considerations for the Reliability Coordinator (RC) to review and verify for each new or functionally modified⁴ Remedial Action Scheme (RAS). The RC review is not limited to the checklist items and the RC may request additional information on any aspect of the RAS as well as any reliability issue related to the RAS. If a checklist item is not relevant to a particular RAS, it should be noted as “Not Applicable.” If reliability considerations are identified during the review, the considerations and the proposed resolutions should be documented with the remaining applicable Attachment 2 items.

I. Design
1. The RAS actions satisfy performance objectives for the scope of events and conditions that the RAS is intended to mitigate.
2. The designed timing of RAS operation(s) is appropriate to its BES performance objectives.
3. The RAS arming conditions, if applicable, are appropriate to its System performance objectives.
4. The RAS avoids adverse interactions with other RAS, and protection and control systems.
5. The effects of RAS incorrect operation, including inadvertent operation and failure to operate, have been identified.
6. Determination whether or not the RAS is limited impact. ⁵ A RAS designated as limited impact cannot, by inadvertent operation or failure to operate, cause or contribute to BES Cascading, uncontrolled separation, angular instability, voltage instability, voltage collapse, or unacceptably damped oscillations.
7. Except for limited impact RAS as determined by the RC, the possible inadvertent operation of the RAS resulting from any single RAS component malfunction satisfies all of the following:

8. The effects of future BES modifications on the design and operation of the RAS have been identified, where applicable.

________________________________________

⁴ Functionally modified: Any modification to a RAS consisting of any of the following:
• Changes to System conditions or contingencies monitored by the RAS
• Changes to the actions the RAS is designed to initiate
• Changes to RAS hardware beyond in-kind replacement; i.e., match the original functionality of existing components
• Changes to RAS logic beyond correcting existing errors
• Changes to redundancy levels; i.e., addition or removal
⁵ A RAS designated as limited impact cannot, by inadvertent operation or failure to operate, cause or contribute to BES Cascading, uncontrolled separation, angular instability, voltage instability, voltage collapse, or unacceptably damped oscillations.

II. Implementation

1. The implementation of RAS logic appropriately correlates desired actions (outputs) with events and conditions (inputs).
2. Except for limited impact RAS as determined by the RC, a single component failure in a RAS does not prevent the BES from meeting the same performance requirements as those required for the events and conditions for which the RAS is designed.
3. The RAS design facilitates periodic testing and maintenance.
4. The mechanism or procedure by which the RAS is armed is clearly described, and is appropriate for reliable arming and operation of the RAS for the conditions and events for which it is designed to operate.

III. RAS Retirement

RAS retirement reviews should assure that there is adequate justification for why a RAS is no longer needed.

Attachment 3
Database Information

1. RAS name.
2. Each RAS-entity and contact information.
3. Expected or actual in-service date; most recent RC-approval date (Requirement R3); most recent evaluation date (Requirement R4); and date of retirement, if applicable.
4. System performance issue or reason for installing the RAS (e.g., thermal overload, angular instability, poor oscillation damping, voltage instability, under- or over-voltage, or slow voltage recovery).
5. Description of the Contingencies or System conditions for which the RAS was designed (i.e., initiating conditions).
6. Action(s) to be taken by the RAS.
7. Identification of limited impact⁶ RAS.
8. Any additional explanation relevant to high-level understanding of the RAS.

_________________________________________
⁶ A RAS designated as limited impact cannot, by inadvertent operation or failure to operate, cause or contribute to BES Cascading, uncontrolled separation, angular instability, voltage instability, voltage collapse, or unacceptably damped oscillations.

Technical Justification

4.1.1 Reliability Coordinator
The Reliability Coordinator (RC) is the best-suited functional entity to perform the Remedial Action Scheme (RAS) review because the RC has the widest area reliability perspective of all functional entities and an awareness of reliability issues in neighboring RC Areas. The Wide Area purview better facilitates the evaluation of interactions among separate RAS, as well as interactions among RAS and other protection and control systems. The selection of the RC also minimizes the possibility of a conflict of interest that could exist because of business relationships among the RAS-entity, Planning Coordinator, Transmission Planner, or other entities involved in the planning or implementation of a RAS. The RC is also less likely to be a stakeholder in any given RAS and can therefore maintain objective independence.

4.1.2 Planning Coordinator
The Planning Coordinator (PC) is the best-suited functional entity to perform the RAS evaluation to verify the continued effectiveness and coordination of the RAS, its inadvertent operation performance, and the performance for a single component failure. The items that must be addressed in the evaluations include: 1) RAS mitigation of the System condition(s) or event(s) for which it was designed; 2) RAS avoidance of adverse interactions with other RAS and with protection and control systems; 3) the impact of inadvertent operation; and 4) the impact of a single component failure. The evaluation of these items involves modeling and studying the interconnected transmission system, similar to the planning analyses performed by PCs.

4.1.3 RAS-entity
The RAS-entity is any Transmission Owner, Generator Owner, or Distribution Provider that owns all or part of a RAS. If all of the RAS (RAS components) have a single owner, then that RASentity has sole responsibility for all the activities assigned within the standard to the RAS-entity. If the RAS (RAS components) have more than one owner, then each separate RAS component owner is a RAS-entity and is obligated to participate in various activities identified by the Requirements.

The standard does not stipulate particular compliance methods. RAS-entities have the option of collaborating to fulfill their responsibilities for each applicable requirement. Such collaboration and coordination may promote efficiency in achieving the reliability objectives of the requirements; however, the individual RAS-entity must be able to demonstrate its participation for compliance. As an example, the individual RAS-entities could collaborate to produce and submit a single, coordinated Attachment 1 to the reviewing RC pursuant to Requirement R1 to initiate the RAS review process.

Limited impact
RAS are unique and customized assemblages of protection and control equipment that vary in complexity and impact on the reliability of the BES. These differences in RAS design, action, and risk to the BES are identified and verified within the construct of Requirements R1-R4 of PRC012-2.

The reviewing RC has the authority to designate a RAS as limited impact if the RAS cannot, by inadvertent operation or failure to operate, cause or contribute to BES Cascading, uncontrolled separation, angular instability, voltage instability, voltage collapse, or unacceptably damped oscillations. The reviewing RC makes the final determination as to whether a RAS qualifies for the limited impact designation based upon the studies and other information provided with the Attachment 1 submittal by the RAS-entity.

The standard recognizes the Local Area Protection Scheme (LAPS) classification in WECC (Western Electricity Coordinating Council) and the Type III classification in NPCC (Northeast Power Coordinating Council) as initially appropriate for limited impact designation. The following information describing the aforementioned WECC and NPCC RAS is excerpted from the respective regional documentation⁷. The drafting team notes that the information below represents the state of the WECC and NPCC regional processes at the time of this standard development and is subject to change before the effective date of PRC-012-2.

WECC: Local Area Protection Scheme (LAPS)
A Remedial Action Scheme (RAS) whose failure to operate would NOT result in any of the following:
• Violations of TPL-001-WECC-RBP System Performance RBP,
• Maximum load loss ≥ 300 MW,
• Maximum generation loss ≥ 1000 MW.

NPCC: Type III
An SPS whose misoperation or failure to operate results in no significant adverse impact outside the local area.

The following terms are also defined by NPCC to assess the impact of the SPS for classification

Significant adverse impact – With due regard for the maximum operating capability of the affected systems, one or more of the following conditions arising from faults or disturbances, shall be deemed as having significant adverse impact:
a. system instability;
b. unacceptable system dynamic response or equipment tripping;
c. voltage levels in violation of applicable emergency limits;
d. loadings on transmission facilities in violation of applicable emergency limits;
e. unacceptable loss of load.

Local area – An electrically confined or radial portion of the system. The geographic size and number of system elements contained will vary based on system characteristics. A local area may be relatively large geographically with relatively few buses in a sparse system, or be relatively small geographically with a relatively large number of buses in a densely networked system.

__________________________________
⁷ WECC Procedure to Submit a RAS for Assessment Information Required to Assess the Reliability of a RAS Guideline, Revised 10/28/2013 | NPCC Regional Reliability Reference Directory # 7, Special Protection Systems, Version 2, 3/31/2015

A RAS implemented prior to the effective date of PRC-012-2 that has been through the regional review processes of WECC or NPCC and classified as either a Local Area Protection Scheme (LAPS) in WECC or a Type III in NPCC, is recognized as a limited impact RAS upon the effective date of PRC-012-2 for the purposes of this standard and is subject to all applicable requirements.

To propose an existing RAS (a RAS implemented prior to the effective date of PRC-012-2) be designated as limited impact by the reviewing RC, the RAS-entity must prepare and submit the appropriate Attachment 1 information that includes the technical justification (evaluations) documenting that the System can meet the performance requirements (specified in Requirement R4, Parts 4.1.4 and 4.1.5) resulting from a single RAS component malfunction or failure, respectively.

There is nothing that precludes a RAS-entity from working with the reviewing RC during the implementation period of PRC-012-2, in anticipation of the standard becoming enforceable. However, even if the reviewing RC determines the RAS qualifies as limited impact, the designation is not relevant until the standard becomes effective. Until then, the existing regional processes remain in effect as well as the existing RAS classifications or lack thereof.

An example of a scheme that could be recognized as a limited impact RAS is a load shedding or generation rejection scheme used to mitigate the overload of a BES transmission line. The inadvertent operation of such a scheme would cause the loss of either a certain amount of generation or load. The evaluation by the RAS-entity should demonstrate that the loss of this amount of generation or load, without the associated contingency for RAS operation actually occurring, is acceptable and not detrimental to the reliability of BES; e.g., in terms of frequency and voltage stability. The failure of that scheme to operate when intended could potentially lead to the overloading of a transmission line beyond its acceptable rating. The RAS-entity would need to demonstrate that this overload, while in excess of the applicable Facility Rating, is not detrimental to the BES outside the contained area (predetermined by studies) affected by the contingency.

Other examples of limited impact RAS include:
• A scheme used to protect BES equipment from damage caused by overvoltage through generation rejection or equipment tripping.
• A centrally-controlled undervoltage load shedding scheme used to protect a contained area (predetermined by studies) of the BES against voltage collapse.
• A scheme used to trip a generating unit following certain