Assessment of vulnerabilities in the transition to SF6-free coupled onshore and offshore power grids

Accepted version Central Office 21, rue d'Artois, 75008 Paris – France Web: www.cigre.org Paper Information Paper number 1373 Paper title Assessment of vulnerabilities in the transition to SF6-free coupled onshore and offshore power grids Study Committee SC B4 – DC systems and power electronics Preferential subject PS2: Technologies supporting the power grid for energy transition to carbon neutral energy production Authors Iver Bakken SPERSTAD, Matias VISTNES, Thomas TREIDER Affiliations SINTEF Energy Research Country Norway Email address [email protected] Summary The ongoing energy transition introduces new technologies and grid components to the power system. Offshore, a new grid is being developed with HVDC technology coupled to the existing onshore HVAC grid, while existing HVAC circuit breakers onshore are being replaced by new, SF6-free alternatives to comply with EU regulations. Throughout this transition, it is important to ensure the resilience of the power system. This can be achieved if TSOs, vendors, and other relevant actors are aware of and avoids the introduction of new vulnerabilities in the power system. To this end, this paper aims to identify and assess potential vulnerabilities in the future power system, focusing on new HVAC and HVDC switchgear and power converter technologies in the European power system. This is done by applying an existing qualitative framework and methodology for vulnerability assessment, in addition to in-depth interviews with representatives from eight companies within the European electric power industry. The study revealed no new or increased vulnerabilities specifically associated with the new technologies. However, the study has given new insights into relevant vulnerabilities associated with new technology in general and vulnerabilities that will be influenced by factors related to the ongoing transition of the power system, such as vendor availability and TSOs’ vendor and spares strategies. Based on these assessments, the following measures are recommended to ensure power system resilience: Close collaboration between vendors and TSOs in the design of new components; ensuring that multiple vendors can supply compatible technology; prioritizing spare components and vendor repair capacity over producing new components for grid expansion; standardization of components and training on procedures for maintenance etc.; supporting development of HVDC circuit breaker technology; design HVDC grids with high selectivity or limited extent of meshing. Keywords Circuit breaker, Converter, HVDC, Hybrid AC-DC grids, Reliability, Resilience, Vulnerability Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 2 1 Introduction The ongoing energy transition introduces at a large scale and rapid pace new technologies and grid components to the power system: Offshore, a new grid is being developed with HVDC technology (converters, cables, circuit breakers) coupled to HVAC technology. Onshore, the existing grid is being reinforced and existing HVAC circuit breakers are being replaced by new, SF6-free alternatives to comply with EU regulations [1]. Throughout this transition, it is important to maintain the resilience of the power system, which may be threatened by new vulnerabilities associated with, among other things, the new and unproven technologies. The objective of this paper is to identify and assess potential vulnerabilities in the future power system, focusing on new HVAC and HVDC switchgear and power converter technologies on the European power system. This is achieved by applying an existing qualitative framework and methodology for vulnerability assessment. One motivation is to identify vulnerabilities already in the design phase, before they can be revealed through potential future large-scale power supply interruptions. This broad qualitative study can moreover be used as a starting point for specifying more narrow quantitative analyses of vulnerability and resilience. The vulnerability assessment methodology used in this study has previously been applied to different power systems with different scale and scope with regards to geography, grid levels and issues of interest. One previous application that is particularly relevant for the present study focused on vulnerabilities associated with outages of HVDC interconnectors in the Nordic power system [2]. It considered interconnectors that existed at the time of the study (2018) and interconnectors that would be operational in the near future (2021). The present study updates and extends this study by increasing the time horizon to include the next few decades (to around 2050) and expanding the scope in terms of issues of interest: It considers not only HVDC interconnectors but also a partially meshed offshore HVDC grid with offshore substations and the switchgear involved. A survey on vulnerability and resilience with a similar scope but a different methodology has recently been carried out in the HVDC-Wise project [3]. However, the present study also includes a development of the existing onshore HVAC grid where existing SF6-based switchgear technology is being replaced by SF6-free alternatives. Since the study considers possible future power systems and not a concrete system that is currently existing, it is challenging to pinpoint specific vulnerabilities associated with specific components or parts of the system. We therefore aim to identify more general types of vulnerabilities associated with types of outage or failure events rather than the outages of specific components. The qualitative study leverages the access to industry experts through the consortia of two research projects dealing with switchgear technology and coupled onshore and offshore power grids. In this way the study contributes to making (anonymized) industry considerations and concerns available in a structured manner in the scientific literature. The methodology of the vulnerability assessment and the interview study is described in more detail in Section 2 together with the underlying framework for power system vulnerability. The findings are presented in Section 3 and mapped to the vulnerability framework to give a systematic overview of potential vulnerabilities. The paper is concluded in Section 1 with some remarks on the trade-offs the power transmission industries need to consider concerning the vulnerabilities of the future power system. Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 3 2 Methodology The vulnerability framework this work is based on includes 1) a conceptual framework for classifying and characterizing vulnerabilities, and 2) a methodology for vulnerability assessment. These are described in detail in [4] and summarized in Section 2.1. Different qualitative and quantitative methods can be employed for the individual steps of the general vulnerability assessment methodology. For the purpose of the present work, a purely qualitative approach was chosen, with an in-depth interview study as described in Section 2.2. 2.1 Vulnerability framework and assessment methodology There are many ways to define and understand the concepts of vulnerability and resilience in the context of power systems. Following [5], power system resilience is “the ability to limit the extent, severity, and duration of system degradation following an extreme event”. Following [4], we understand high vulnerability to imply low resilience, and vice versa. Vulnerability can furthermore be understood through Figure 1, which is based on the conceptual bow-tie model often used in risk analysis [4]. In the middle of the bow-tie is a contingency involving one or more power system failures. The vulnerability of the power system is determined by its susceptibility to threats that can cause a contingency and by its coping capacity, i.e. how capable the power system is to cope with contingencies after they occur and limit their consequences. The figure also illustrates barriers, that either can prevent a contingency from taking place or protect against its consequences. A vulnerability can be associated with a barrier that is either missing, weak or malfunctioning [4]. Resilience and vulnerability are most closely associated with events with critical consequences for the end-users of the power system due to large-scale and/or long-lasting power supply interruptions (blackouts). The vulnerability assessment methodology takes these potential critical consequences as a starting point and works its way from the right-hand side to the lefthand side of the bow-tie model in a step-wise manner. The six steps are listed on the right-hand side of Figure 1. Figure 1 – Bow tie model used in the power system vulnerability framework (top, based on [4]) and schematic progression of system state degradation for power supply interruption event with critical consequences (“resilience trapezoid”, below). Barriers related to coping capacity Critical contingency (power system failures) Causes Consequences Barriers related to susceptibility Interruption duration Interrupted power Impacted areas/ populations Economic consequences Social consequences Health/life Criticality Threats Generation/demand Operational/technical Natural hazards Human threats Meteorological Terrestrial Extra-terrestrial Intended/unintended Restoration (incl. component repair and replacement) Time (not to scale) Threat exposure, preventive measures Power supplied Corrective actions Identify critical consequences Identify critical contingencies potentially leading to critical consequences Identify threats that can cause the critical contingencies Identify vulnerabilities associated with the system's susceptibility and coping capacity Identify factors influencing the power system's coping capacity Identify existing and missing barriers against critical contingencies (measures to improve resilience) 1) 2) 3) 4) 5) 6) 1 2 34 5 6 Degraded system state Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 4 2.2 Interview study The six-step assessment methodology was used as a starting point in the in-depth interview study. The respondents included experts from in total 8 major actors in the European electricity industry, including 4 TSOs, 3 vendors of switchgear and power converters (technology providers and manufacturers), and 1 offshore grid EPCI (Engineering, Procurement, Construction and Installation) supplier. One to three persons from each company were present in the interviews, representing different perspectives, roles, domains and areas of expertise within the electric power engineering field. The interview guide used for the study started out with giving context to the study and trying to instil in the respondents a forward-looking mindset, stressing the importance of thinking beyond historical experiences and events. A semi-structured interview method was used, and the meeting structure was kept relatively open to avoid too narrow framing of the problem and to better leverage the expertise of the respondents. The respondents were interviewed during autumn 2024, and the raw notes from the interviews were kept confidentially with the authors and then aggregated and anonymized. These aggregated findings were presented to project partners and discussed in workshops in January 2025 to validate the results from the study. 3 Results This section presents the findings, mapped to the vulnerability framework, to give a systematic overview of potential vulnerabilities. The findings for each of the six steps of the methodology are summarized in Table 1, and broadly categorized into 1) the aspects associated with the traditional onshore grid and 2) additional aspects due to the introduction of an offshore grid. For both categories, the main emphasis is on aspects related to switchgear and power converter technologies. The main findings are elaborated and discussed in the subsequent subsections. Table 1 – Summary of findings for each of the steps of the vulnerability assessment methodology. Step of analysis For onshore grid In addition for offshore grid 1. Identify critical consequences Loss of load supplied by a major (onshore) transmission substation Load shedding due to lost power infeed from offshore HVDC grid higher than dimensioning incident (e.g. 1.4 GW in Nordic synchronous area) 2. Identify critical contingencies, that can lead to critical consequences Busbar failures Multiple-outage contingencies due to circuit breakers failing to trip on command Outages while other components are being repaired/replaced Common cause failures in bipolar HVDC cable systems Software failures of HVDC converters Destruction of offshore platforms (converter stations) 3. Identify threats that can lead to critical contingencies Sabotage, terrorism, cyber threats Human errors (especially related to technology which operators have little experience on) High/low outside temperatures Ship collisions Shipping activity (anchors) Extreme waves Earthquakes 4. Identify vulnerabilities related to the susceptibility and the coping capacity of the power system Series defects for components from the same vendor or based on same technology Component repair and replacement being reliant on a single vendor Smaller number of compatible spare components Limited selectivity of HVDC protection systems Faster dynamics and more challenging (corrective) control Insufficient fault ride through and overload capabilities of converters Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 5 Reduced quality of preventive and corrective maintenance due to multiple switchgear technologies in the system Remoteness and lack of spare capacity of offshore substations 5. Identify vulnerabilityinfluencing factors Lack of standardization TSOs’ spare part strategy and vendor strategy Uncertain development of available vendors and their production capacity for SF6-free HVAC breakers Roll-out strategy for SF6-free switchgear Demand for expanding grid capacity (new grid components) Uncertain development of HVDC circuit breaker technology and available vendors Communication system for HVDC protection systems Weather offshore Repair personnel missing offshore experience 6. Identify existing and missing barriers – measures to improve resilience Close collaboration between TSOs and vendors in the design of new components Ensuring that multiple vendors will be available to supply similar technology/components Standardization of components and training on procedures for maintenance etc. Having more spares available (and prioritizing components as spares over components for grid expansion) Condition monitoring of individual components Utilize controllability of DC converters for corrective and restorative measures Remote control of offshore substations Supporting/ensuring development of DC circuit breaker technology High selectivity of protection systems HVDC grids / Limiting the extent of meshed DC grids 3.1 Critical consequences The vulnerability assessment methodology starts by identifying what the respondents consider a critical consequence. One type of event that most TSOs mentioned was the dimensioning incident (or dimensioning fault) for their synchronous system. This implies the loss of power injection to the system at the threshold that the system is expected to cope with before the frequency drop leads to large-scale under-frequency load shedding [2]. This extent of interruption of end-users power supply was considered a critical consequence. The loss of infeed thresholds for the dimensioning incident in the Nordic and the Continental Europe synchronous areas currently are at 1.4 GW and 3 GW, respectively. The non-TSO respondents, on the other hand, often suggested consequences for their own enterprise or the sub-systems they provide to the TSOs, instead of consequences to the endusers of the power systems. To ensure that the study maintained a power system (TSO) perspective, the dimensioning incident was nevertheless considered to define the critical consequence in the all the interviews. 3.2 Critical contingencies The types of critical contingencies that could constitute a dimensioning incident that were discussed in the interviews fall in two categories: 1) contingencies in the onshore HVAC power system that are “traditional” in the sense that they could occur in the existing power system and 2) new types of contingencies associated with the coupling with an offshore and predominantly HVDC-based power system. One example of the latter is the outage of an offshore grid feeding more than 1.4 GW offshore wind power production into the Nordic synchronous area. Figure 2 illustrates some simple cases of the couplings of offshore (HVDC) grid integrating offshore wind power into an onshore (HVAC) grid. Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 6 Figure 2 – Schematic illustration of possible couplings of onshore (AC) and offshore (DC) power system through different types of switchgear technologies. We first assume that the two offshore-onshore DC links are radially operated (possible for cases 2 and 3 of Figure 2) and feeding 2 GW wind power production each into the onshore grid. If they are monopole links, then any single cable or converter outage for the links would be a critical contingency for the Nordic synchronous area. If they are bipole links with metallic return, then a single HVDC cable or converter outage causes the unavailability of only 1 GW of the power capacity of the link. A critical contingency for such a bipole link would require a common-cause failure causing outage of both poles. This could result from failures on components on the AC-side or converter failure when only one converter is earthed, but these would be latent faults (manufacturer defect or design faults). If the two DC links in Figure 2 are operated as a meshed DC grid, the consequences in the AC grid of a failure in the DC grid will depend on the power capacity and the actual power flow of the DC links, and how fast the available power capacity of the DC grid is restored following a failure [6]. This in turn depends on the number, location and type of switchgear that is used in the DC grid and the AC grid. With fewer switchgear in the DC grid, the selectivity of the protection system for the DC grid will be reduced. With no selectivity (case 1 in Figure 2), a failure on the DC side could be a critical contingency. With full selectivity (case 3 in Figure 2), a critical contingency could still occur in case DC breakers fail to trip on command or due to unwanted non-selective tripping of circuit breakers. Another type of potentially critical contingencies that is relatively new is those that are due to software failures. Advanced protection systems are needed to limit damage to equipment and increase the transmission capacity of the power system, but they may fail, and therefore those systems are doubled at critical points in the grid [7]. Furthermore, control systems for power electronics are increasing in use. A recent historical example of contingency involving software failures in such systems is the reversal of power flow in an HVDC link due to a converter control system error [8]. This kind of latent fault can cause rapid changes in power infeed of up to twice the value of the power capacity of the link by reversing the power exchange on the link from full import to full export. This type of event was not predicted in the previous vulnerability assessment of HVDC interconnectors [2]. 3.3 Vulnerabilities related to susceptibility Several of the relevant threats (see Table 1) are the same as in the past, but existing barriers to manage these threats for existing technologies may not be sufficient for new technologies. Some Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 7 TSOs had concerns about insufficient training and experience with new technologies, which may reduce the quality of preventive maintenance to avoid failures. Another concern was similar technologies all having the same design flaw that could lead to series defects. This is a vulnerability related to new technology in general and not specific to the technologies considered in this study. Although there is limited operational experience with the new technologies, there is currently no basis for expecting that they are more susceptible to threats and thus more likely to fail. 3.4 Vulnerabilities related to coping capacity The coping capacity of the power system depends on its level of redundancy and corrective measures (including the operation of protection systems) that limit the extent and severity of system degradation after failures. Coping capacity also depends on restorative actions to limit the duration of system degradation and restore system operation and power supply to end-users. In the current AC power system, there are typically no end-user consequences of individual failures of switchgear due to the level of redundancy and selectivity at both the substation level and power grid level. The same level of redundancy and selectivity is not expected in an offshore DC power grid due to high costs offshore and lack of available HVDC switchgear technology. Opinions differed among the respondents about when HVDC circuit breakers would be commercially available and a cost-efficient solution for offshore grids. Moreover, DC protection systems need to act faster than AC protection systems (9), leading to more stringent communication requirements, which is a factor that influences the vulnerability. The power system can be more vulnerable due to insufficient fault ride through requirements in the grid codes and overload capabilities of converters. Weak AC grid connections or a degraded system state following from a previous failure can make a system with converters vulnerable to undamped oscillations, converter blocking, or erroneously converter control. These conditions could be outside what the converters are designed to normally withstand. Simulation of converter stability done with minimal modelling of the surrounding grid may later turn out be insufficient to capture instabilities due to converters interacting with the grid. This was seen as a major concern in cases of converters from multiple vendors in close proximity. In general, faster dynamics of converters compared to synchronous machines and limited experience by human operators makes power system control and corrective measures more challenging. After the system has reached a degraded state, restorative measures such as repairing or replacing faulty components may be needed to restore system operation. Several vulnerabilities related to long repair times of switchgear were highlighted in the study, associated with 1) technician experience, 2) availability of spares on site, and 3) availability of spares on a national or European level. The first vulnerability was reflected by the concern some TSOs had with insufficient training and experience with managing and repairing different technologies. For HVAC circuit breakers, they currently have experience only with SF6-based technology, but during the transition to an SF6-free power system they will be required to have experience with one or two new technologies in addition. Lack of standardisation for new technologies could mean that TSOs become dependent on vendors for fault diagnosis and repair/replacement. Vendors on the other Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 8 hand state that there are strong similarities in operation and asset management between technologies. Another factor influencing the coping capacity was the experience that repair personnel had with working offshore. For offshore substations (platforms), the restoration time is typically longer because of the remote and usually unmanned locations. The restoration time moreover depends on weather and the extent of redundancy and spares there has been space and budget for at offshore platforms. The third factor that could influence the coping capacity related to repairing and replacing switchgear after failures was the availability of vendors and their priorities. For new technologies, there was uncertainty about how many vendors would be supplying compatible technologies in the future and concern about a “lock-in” effect where a TSO becomes too reliant on a single vendor. Another potential vulnerability is that the vendor(s) might lack the capacity to produce new components since they are only gradually increasing production capacity when the demand for new components is uncertain. This is influenced by regulations and politics translating into demand by new components for grid expansion projects and/or for replacing e.g. SF6-based switchgear. TSOs’ strategies for grid development and for phasing out SF6 are therefore vulnerability-influencing factors. There was also concern that vendors might prioritize producing new components for grid expansion over repairing faulty components. On the other hand, for components with old technology that is no longer being installed, the vulnerability is that a TSO’s spare inventory may be running low before the technology is entirely phased out. 3.5 Measures to improve resilience Strengthening or implementing barriers are measures to improve the resilience of the power system. The last step of the vulnerability assessment methodology is to identify existing and missing barriers against critical contingencies to reduce their likelihood and consequence. A preventive measure that will reduce the susceptibility to failures is to improve the monitoring and self-diagnostics systems of new components which may potentially have new failure mechanisms. Close collaboration between TSOs and vendors in the pre-design and design phases reduces the likelihood of design flaws and series defects. There is a need to manage relationships between these actors in a different way than in the past, and some steps in this direction have already been taken [10]. Sharing experiences after product release and providing good documentation on the function and failure of components will improve preventive maintenance by the TSOs and reduce the likelihood of failures. To improve the coping capacity shortly after the occurrence of contingencies, automated control systems based on new (wide area) monitoring are suggested. Resilient power system control should utilize automatic and remote control possibilities while also having backup solutions for local control. Converters and other resources in the system should have improved fault ride through capabilities instead of disconnecting when a fault is detected. Regulation is important to ensure that the resources do have adequate capabilities. HVDC converters bring power flow control capabilities that can be used to improve the coping capacity of the system during contingencies. Converters can also contribute synthetic inertia, fast frequency reserves, isolated operation and black-start capabilities from synchronous grid Paper number 1373 Study committee: SC B4 – DC systems and power electronics Preferential subject PS2 Accepted version [email protected] P a g e | 9 forming control mode. HVDC converters also have wide reactive power control capabilities compared to synchronous machines but on the other hand low overload capabilities. Designing the coupled offshore/onshore grid with switchgear mostly in onshore substations reduces the cost compared to offshore. Such a solution makes it more economically feasible to ensure selectivity and reduce the time to restore the operation of the DC grid after failures. This improves the short-term coping capacity but is also a measure to reduce repair time because it improves the availability of spares and personnel. The longer-term coping capacity related to availability and production capacity of vendors is also important to improve but requires measures to improve supply chain resilience that is outside the scope of this study. 4 Discussion and concluding remarks The transition to new switchgear technology and the development of an offshore power system has been initiated to reach the environmental goals of the TSOs and of society. In this transition there is a trade-off between 1) potentially introducing new vulnerabilities and increasing the risk of power supply interruptions and 2) being able to phase out SF6 free technology and phase in large-scale offshore wind production, and 3) cost considerations. In other words, to make the energy transition possible, TSOs and society need to decide which risks and costs they accept. The study revealed some interesting dilemmas where the TSOs also need to decide on the tradeoff between which vulnerabilities they will accept. On one hand, standardization, cooperation and experience sharing will facilitate the transition and reduce costs for everyone; on the other hand, the more one standardizes the design of the components and procedures, the more important it is to identify potential vulnerabilities inherent in the design. Another dilemma is related to the reliance on a single new technology or vendor providing this technology. Having several HVAC circuit breaker technologies during the transition to SF6free circuit breakers gives rise to vulnerabilities due to the need for training and experience with different technologies at the same time. On the other hand, having all components based on the same technology may lead to a situation where many HVAC circuit breakers fail because they have the same series defect. Unavailability of spare parts is another vulnerability that depends on the TSO’s strategy for which and how many vendors it uses to supply its components. A multi-vendor strategy (if possible) is less reliant on the availability and capacity of a single vendor, but might on the other hand end up with few available spares that are compatible for a given component outage. For HVDC converters, there is a trade-off between potentially introducing vulnerabilities in converter design and control with a single vendor that may result in series defects, and introducing vulnerabilities due to converter interactions by developing multi-vendor HVDC systems. In addition, the availability of the DC grid is also dependent on the reliability of the DC circuit breakers. If the reliability of DC breakers is too low, adding them to the system might reduce rather than increase the reliability or resilience of the system. Limiting the extent of meshed DC grids reduces the requirements on selectivity and switchgear reliability to uphold the resilience of the system. A less meshed offshore grid can thus reduce the vulnerability with