System Operating Limits & IROLs

Foreword

Foreword

This professional reference is one of a series Energy Compliance, Inc. publishes for registered entities and the people who run their compliance programs.

I’ve spent more than thirty years on every side of the bulk electric system. I’ve operated control centers as a Reliability Coordinator, Transmission Operator, and Power System Operator. I’ve audited grid facilities and signed off on findings as a senior compliance auditor. I’ve worked enforcement matters from inside the regulator’s process. For the last several years I’ve advised registered entities directly through the firm I founded.

The entities that do reliability well share a common habit. They take the standards seriously without confusing them with reliability itself. They know that a NERC Reliability Standard is a floor, not a ceiling. They know that compliance is something an auditor evaluates, but reliability is something a system either delivers or doesn’t. They prepare for audits by building programs that survive real questions, not binders that look thick.

That’s the perspective these references try to share. Each one focuses on a single topic. A standard family, an operational function, a regulatory framework, or an emerging industry challenge. Each one walks through how the topic actually works.

These references are written for the compliance manager who wants to understand the system, not just memorize requirements. For the legal counsel who has to brief a board honestly. For the senior operator who’s been told that compliance and reliability are the same thing and suspects they aren’t. And for the new compliance hire who got handed a binder and told good luck.

These references aren’t marketing material disguised as content. They’re the result of three decades of doing this work and watching it succeed and fail. I’ve written them in the same voice I use in a control room or in front of a Regional Entity audit team. Direct, evidence-grounded, honest about what the standards do and do not require.

Energy Compliance exists because most of the consulting offered to registered entities today is structured for billable hours rather than for outcomes. Every engagement is led by one senior practitioner. We don’t bring five people to a meeting that needs one. We automate the work that should be automated. We apply senior judgment to the work that requires it. If that approach matches what you’re looking for in a compliance partner, the back of this reference has our contact information.

If not, the reference still belongs to you. Take what’s useful. Apply it well. And remember the only test that ultimately matters: when the system needs to perform, does it?

Rob Smith, Founder, Energy Compliance, Inc.

EC-WP-303 System Operating Limits and IROLs

Chapter 1

Definitions, Thresholds, and the Institutional Meaning of SOL and IROL Public enforcement filings show that exceedances, delayed mitigation, and incorrect limit calculations

have been deemed significant reliability risk events. There is no ambiguity in this standard in terms of who is responsible. The authority gradients that exist between Reliability Coordinators, Balancing

Authorities and Transmission Operators in other settings are also included in this standard to address potential delays or indecision in the event that any of the grid limits are approached or exceeded.

Reliability Policy and Planning (RPP-2): Volume II, Institutional Design for Supply and Demand (SOL) and Interchange Rate Orders and Regulations (IROL) Reliability policies establish the framework under which reliability risk is managed. The institutional design of the Supply and Demand (SOL) and Interchange Rate Orders and Regulations (IROL) constructs informs reliability risk management by shaping key activities such as determining the methodologies used to manage risk, communicating and monitoring such limits, and responding to exceedances and associated enforcement risk. This volume, therefore, aims at providing structural clarity as to the institutional design of what is arguably one of the key reliability management tools that can be implemented under the Section 215 framework.

The SOL/IROL architecture is both technical and institutional. In order to understand its composition, it is therefore necessary to focus on definitions, on the delimitation of competences, on the level of operational detail in procedural rules and on enforcement logic. This paper does so.

The terms System Operating Limit and Interconnection Reliability Operating Limit are defined in the NERC Glossary of Terms and Conditions and are incorporated by reference into several Reliability Standards. The definitions above establish the conceptual boundaries for secure operation of the Bulk Electric System. They are not advisory engineering targets, but rather enforceable reliability constructs that are embedded in the operational standards.

A System Operating Limit is the value of the system parameter required to satisfy the most limiting of the operating criteria specified for a given system configuration and reliability requirements. This definition allows for several potential limiting conditions. For example, the maximum thermal rating of any component, voltage stability, transient stability and system voltage criteria may be the limiting condition for different operating conditions. In general, a System Operating Limit is that value which is the most restrictive of the operating criteria imposed on the system for the designated system configuration.

An Interconnection Reliability Operating Limit (IROL) is a type of System Operating Limit (SOL). An IROL is a System Operating Limit that, if violated, may result in instability, uncontrolled separation, or Cascading within an Interconnection. Thus, while all IROLs are SOLs, not all SOLs are IROLs. The IROL designation is a characterization of the particular System Operating Limit for its higher reliability exposure within an interconnection.

The significance of the IROL (Immediate Reliability Limit) distinction has a strong institutional footing as explained within the IRO and TOP standards. It is known that that when IROL limits are exceeded the management of the breach (response and mitigation activities) will have defined timelines to return the power system within IROL. Missing these defined timeframes associated with breaching the IROL limits, however, opens the Transmission Operator (TO) and Reliability Coordinator (RC) to further compliance

exposures. These associated risk and compliance concerns, are largely driven by the knowledge of the cascading effects associated with any potential violations of the IROL limits.

The boundary between the SOL and IROL domains is established by approved methodologies, as defined by Planning Coordinators and Transmission Planners, to consider the impact of contingencies on system responses and to determine which operating limits are critical and, if violated, could lead to instability or cascading. This is a strictly analytical procedure, not a matter of discretion. The studies that form the basis for these determinations must be performed in accordance with the rules and procedures defined in the TPL standards and must be consistent with the NERC Reliability Standards.

One of the key components of the IROL definition is cascading. Cascading refers to the uncontrollable, sequential loss of system elements as a result of some initiating event. In order to determine what constitutes an IROL, it is essential to understand how system stress propagates following a contingency. Determining what constitutes an IROL will be dynamic due to changing generation dispatch patterns, system topology, load flow patterns, and system configuration.

The operational monitoring of SOLs and IROLs depends on various tools and procedures implemented by the Transmission Operators and Reliability Coordinators. Realtime contingency analysis, state estimation, and limit monitoring applications are used to assess whether the system is approaching the predetermined limits. The standards assume that the limits have to be known, communicated and measurable by the parties involved in reliability operations.

These rules are enforced as a matter of principle as they are seen as highly system-relevant. The SOL/ IROL limit violation cases provided to us through the public enforcement proceedings impose a Violation Risk Factor to the violations of the limit calculations, the determination of the IROL conditions and the timely removal of the associated controls. It is not viewed as a purely planning activity. It is viewed as a real operational requirement in order to ensure system reliability.

The definitions of SOL and IROL are sometimes thought of purely as technical terms, but they are also regulatory terms, triggering certain regulatory responses. Ultimately, the definitions serve to establish boundaries for operations of the Bulk Electric System (BES) within which the System is considered reliable and secure. Breach of those boundaries may then trigger additional regulatory responses or enforcement.

This briefing paper provides definitions that should be referenced before proceeding. Limits are defined and their associated limit-defining tools, procedures and criteria will be the subject of later discussion. The definitions are straightforward, yet their effects potentially far-reaching.

End-of-Chapter Summary

The definition of System Operating Limits (SOLs) is a reliability criterion that represents the most restrictive reliability criterion for a particular system configuration. Interconnection Reliability Operating Limits (IROLS) are those SOLs whose violation may result in instability, uncontrolled separation or cascading. This definition has operational and enforcement implications regarding the monitoring of limits and timely corrective action, which are therefore addressed within Reliability Standards.

FROM THE FIELD

An SOL is a limit. An IROL is a line in the sand. Cross an SOL and you have a problem. Cross an IROL and you have a cascading event waiting to happen.

Every TOP knows what an SOL is. Fewer can articulate what an IROL is. Fewer still understand the analytical work behind establishing each — and how an IROL classification can change the entire enforcement profile of a real-time decision.

The threshold language reads simple. The application is not. The line between SOL and IROL has been litigated, and the result is precedent you should know.

Chapter 2

Methodology Development and Approval for SOLs and IROLs

The identification of System Operating Limits (SOLs) and Interconnection Reliability Operating Limits (IROLS) is carried out in accordance with documented procedures developed under the direction of the Planning Coordinator and the Transmission Planner. SOLs and IROLS are more than simple “rules of thumb” and are considered methodologies rather than informal engineering judgment. Therefore, they are enforceable through the review, approval and revision process mandated under the Reliability Standards. The FAC standards that cover Methodologies for developing and maintaining SOLs are used to develop the basis of the SOL Methodologies. The SOL Methodologies are used to develop the limit setting criteria for normal and contingency conditions. These are generally based on thermal, voltage and stability criteria in accordance with the planning standards applicable at the time. The enforceable expectation is that they are developed in a transparent and technically defensible manner. They should be sufficiently detailed to enable an assessment of the procedures and criteria used to derive and apply the limits. Planning Coordinators are responsible for implementation of a SOL Methodology in their Planning Coordinator Area. Transmission Planners perform analyses and provide studies as required to identify constraints. Input from Generator Owners and Transmission Owners, and agreement from other concerned parties, is required to ensure that existing plant capacity, dynamic models and protection settings are correctly accounted for in the analysis. Determination of which SOLs constitute IROLs is also a part of the methodology. The system response to the contingencies and any potential cascading effects should be analyzed. In addition, criteria for determining instability or uncontrolled separation should be provided. These criteria are based on the established stability assessment practices and contingency analysis results. The approval and communication of the methodological procedures related to voltage stability analysis and determination of the limits for dynamic stability constitute formalised activities to be carried out by the Planning Coordinator that communicates the SOL Methodology approved to each Transmission Operator

and Reliability Coordinator concerned with the operational coordination, with the purpose of ensuring operational synchronisation. At this stage, it should be taken into account that the real-time operators will make use of the approval criteria in order to determine, on an operational basis, the limits approved for dynamic stability that will guide their daily operating activities in order to carry them out in an optimal manner. Possible changes to the system configuration, generation mix or topology require an

update to the SOL Methodology. The standards need to be rereviewed and validated from time to time. Using an outdated methodology does pose reliability and compliance risks. Public enforcement actions have recently been levied in relation to this type of matter, because the method has not been updated to take into account the changes to the system and the relevant stability criteria. Injury Analysis and Stability-Related Planning Studies The determination of SOL/IROL is a continuous process and interacts directly with the planning studies under the TPL criteria as established in the Contingency Analysis section. Conditions identified as stability-related through contingency analysis procedures are found in the contingency analysis results of the planning studies for seismic loads. Operations experience may later validate or alter assumptions in the analysis. The methodology is the binding factor between the longitudinal studies and the operations. What auditing evidence should be expected for each System Objectives Layer (SOL) for methodological evidence of compliance with the SOL Methodology? A description of the methodology with approval stamps and indicators of distribution, with the date of the last review. Verification of correspondence between the methodology and the modelling carried out in the system, and verification that the IROLs (Issues Raised for Analysis) established by the methodology can be related to the analytical results. The design of SOL/IROL is based on a disciplin approach to methods. The limits are not arbitrary numbers assigned to a line or an interface. These numbers result from more extensive analyses, taking into account reliability criteria, an approach that must be rigorously followed, with an added enforcement of the need to describe and validate the methods used to derive these figures. In this way the operational limits of the lines and interfaces can be based on sound technical bases as opposed to mere convention. As a matter of principle, methodology development underpins the entire SOL/IROL regime. Without an appropriate analytical framework for real-time monitoring, enforcement review would also lose any objective content. The standards therefore provide an adequate analytical framework for the determination of emissions/transfer limits and ensure transparency, comparability and accountability in the derivation of such limits.

End-of-Chapter Summary

SOL and IROL are determined according to the documented procedures that are maintained by Planning Coordinators and Transmission Planners within the FAC rules. The procedures identify the criteria that are used for the analysis of the system and for distinguishing between IROLs and other SOLs. The enforceable documentation of these procedures, together with procedures for verification of their validity, ensure that all operational limits are based on analyses that are both defensible and valid at that time.

FROM THE FIELD

SOL and IROL methodologies are documented procedures, approved by Planning Coordinators and Reliability Coordinators. Improvising the methodology is not an option.

Chapter 3

Real-Time Monitoring and Operational Responsibility

System Operating Limits (SOLs) and Interconnection Reliability Operating Limits (IROLS) which have been developed using approved methodologies, must be implemented in real-time system operations by the Transmission Operator and Reliability Coordinator functions to provide the basis for monitoring real-time operating conditions and implementing necessary corrective actions when near or at the SOL and IROL operating limits are approached. Transmission Operators are responsible for ensuring the reliability of their transmission system. This responsibility includes ensuring that the real time operation of the system remains within the bounds of the designated SOLs, and alerting SPP of any potential stability problems. The real time monitoring tools utilizing the state estimator and contingency analysis functions enable the Operator to obtain an understanding of the loadings on facilities, the condition of the voltage, and the stability margins of the system. The Operator must be aware of which transmission constraints apply to the current system configuration and the effect of contingencies on those constraints. These system operators have a view of the entire regional grid that covers multiple Transmission Operator territories. They are responsible for issuing orders as necessary to prevent or mitigate SOL and IROL violations. In the institutional design of this market, some types of limits violations can be contagious to more than one control area. In such situations, the Reliability Coordinator’s view of the grid as a whole is used to ensure that sufficient measures are taken to mitigate the risk of these violations on an interconnection-wide basis. IRO Limit (IROL) Exceedances have associated time constraints as outlined in the IRO standards. When an IROL is exceeded, the Transmission Operator is required to complete restoration activities within the time periods outlined in the table to below to mitigate the risk of threshold breach. In the event that restoration cannot be achieved within these timescales, further notifications may be required and steps may need to be escalated due to the increased cascading risk. Operational responsibility includes having a valid understanding of the operational situation. If limits are incorrectly described, not communicated or if the rules are inappropriately applied to real-time operational tools, the operator may allow a limit to be exceeded. Accordingly, there

must be coordination between the planning groups and the operational personnel to ensure that the real-time application tools are in synch with the current SOL and IROL values. Data integrity and timely updates of limits are important components of limit management. Reliability Coordinator and Transmission Operators Communication of operational conditions and any actions being taken is a key

responsibility. Transmission Operators must notify the Reliability Coordinator of any forecast or actual conditions in their system that are expected to approach or exceed relevant limits as defined in the Grid Operation Plan and the Network Operation Plan. The Reliability Coordinator may then issue direction to one or more Transmission Operators or one or more GEncos to reduce the risk of disruption to supply. Records of communications made pursuant to this requirement may form part of the compliance record to be presented in the event of an enforcement review. Reliability Standards begin with operational procedures that include defined mitigation actions such as redispatch, topology changes or load shedding. These standards do not mandate particular measures that would be used to restore normal operating conditions within the boundaries established in the procedures. The failure to appropriately respond to grid disturbances or failing to implement adequate mitigation measures as called for in procedures have been enforcement issues. Limit Management Challenges Arising in Interfaces within RTOs/ISOs and Across BA Function The interfaces between Balancing Authorities and transmission operations is another set of limits that may be involved in the process of limit management. Power redispatches directed at frequency or meeting interchange obligations can affect the transmission line limits and the stability limits associated with such transmission lines. Some function coordination is required to prevent involuntary violations of any of the limits in question. It is important to remember that the reliability standards divide the responsibility of meeting the reliability objective but still seek action among all involved parts to ensure the reliability is provided in an efficient manner. Violation Risk Factors for IROL-related Requirements are often high due to the potential for significant cascading effects in the event of an outage. During enforcement evaluations the regulator examines the extent of the exceedance and the adequacy of the mitigation measures in place. Exceedances of short duration may be scrutinized if they indicate a problem with either TSPs (transmission system protection) monitoring or restoration procedures. Real-time monitoring and operational responsibility are the active components of the SOL/ IROL regime, with methodology defining the boundaries and operations that sustain the required system conditions. The enforceable standards then relate the authority, communication and response obligations such that limit management is a continuous and integrated process.

End-of-Chapter Summary

Transmission Operators and Reliability Coordinators monitor SOLs and IROLs in real time and are responsible for the timely mitigation of any excursions above the limits. The operational standards include rules for authority levels, communication and time frames to provide enough control to prevent instability or cascading effects. The effective management of limits requires an understanding of system conditions and prompt corrective action within the context of the reliability rules.

FROM THE FIELD

Limits are static numbers. Conditions are dynamic. The operator's job is to recognize when the gap between limit and condition is closing faster than the operating procedure anticipated.

Chapter 4

IROL Exceedances, Mitigation Timelines, and Escalation Protocols

The institutional difference between a System Operating Limit (SOL) and an Interconnection Reliability Operating Limit (IROL) is seen most clearly during an exceedance. A violation of a SOL calls for some type of repair. Violations of IROLs, by contrast, trigger time-sensitive corrective actions mandated in the IRO and TOP reliability standards. These were designed to prevent a violation of the rules of escalation, and thus to prevent a local power imbalance from evolving into a regional instability or blackout. In the event that an IROL is exceeded, the relevant Transmission Operator must take action to bring the system back into the IROL. The time allowed to correct an exceeded IROL is not a discretion provided by BOCOT but is rather defined within the SOL Methodology. The time allowed to operate within the parameters of an exceeded IROL has been determined as part of the risk assessment in the SOL Methodology. The methodology must identify the basis for the derivation of this time period. If the grid cannot be restored within the established timeframe additional actions are required. Such actions would include informing the Reliability Coordinator (RC) that the situation has escalated into an emergency condition and possibly invoking defined emergency procedures. The RC has the authority to direct restorative measures including, but not limited to, redispatch, topology changes and load shedding. This procedural escalation tracks the hierarchy of authority as defined within the operational procedures. IROL exceedances and mitigation actions need to be documented. In practice many auditors will search for documentation of events such as in the case of message logs or by reviewing timelines, as well as confirmation that any required actions have been implemented and adequately documented. It is common that non-compliance is not considered to be diminished on account of any documentation being late in being written where the absence of the documentation itself constitutes exposure. Institutional practice in some places is to document the action being taken as well as to document the traceability of the event itself. The time to mitigate construct is analytically derived but operationally implemented. This metric must consider system

inertias, stability margins and contingency levels. A conservatively-determined timeframe may impose undue operational stress on the system, while a liberal determination of the metric may be exposing the interconnection to the potential of increased cascading risk. Enforcement focus will be to determine that the implemented timeframe is in line with the described procedure and the observed system characteristics. The purpose of these escalation protocols is to prevent the normalization of exceedance

conditions. An IROL exceedance is not managed as congestion management on the grid. It is a reliability event and must be addressed by following established protocols. The standards stress the need for expediency and coordination to prevent a situation developing gradually and destroying the stability of the system. TOs and RCs must have procedures in place to differentiate between an IROL event and normal operating limit management. IROL exceedances draw enforcement scrutiny when an entity fails to identify the exceedance in a timely manner, miscalculates the time available for mitigation, or does not take the actions required to return the system within limits. Under the IRO standards the Reliability Coordinator must act to prevent or mitigate the magnitude and duration of IROL exceedances, and inadequate analysis, late recognition, or failure to direct timely mitigation each create independent compliance exposure — whether or not an actual instability or Cascading event results. The interaction of IROL mitigation and market dispatch has introduced additional challenges. For instance, economics can be associated with reliability unit redispatch to address transmission constraints. However, it is not permissible for any RTO/ISO to consider economics when making a determination that meets reliability needs under these circumstances, since the standards make clear that reliability must always prevail over economics. Mitigation directives remain mandatory. IROL excess management is associated with a specific institutional design, which refers to the introduction of urgency, traceability and hierarchy in operations. Indeed, planning analysis may set operational boundaries, but operations are subject to unpredictable event sequences. And it is important that any excess is rapidly contained in order to avoid any possible instability cascade.

End-of-Chapter Summary

IROL exceedances trigger the mitigation times and escalation procedures as defined in the operational standards. The Transmission Operator shall act to restore standards within the timescales for mitigation as defined in the operational standards. The Reliability Coordinators will have directive authority to ensure co-ordinated action. The procedures and timescales are structured to reflect the increased cascading risk that is associated with IROL breaches and to ensure a disciplined documented response to serious breaches of operational standards.

FROM THE FIELD

An IROL exceedance triggers a 30-minute clock. The clock isn't symbolic. It's regulatory. The institutional difference between SOL and IROL becomes visible during an exceedance. SOL exceedances tolerate broader response windows. IROL exceedances do not.

Programs that haven't drilled IROL response procedures don't execute them at speed. The drill is the difference between a contained exceedance and an event.

Chapter 5

Facility Ratings, Contingency Analysis, and the Foundation of Limit Accuracy

System Operating Limits (SOLs) and Interconnection Relief Operating Limits (IROLs) are only as accurate as the facility ratings and assumptions that are used to develop them. The accuracy of the thermal ratings, voltage criteria and stability margins are based on FAC and TPL engineering determinations. If the underlying ratings and assumptions are inaccurate, obsolete or not grounded in FAC or TPL determinations, then the associated SOLs and IROLs will not reflect the true operating capability of the system and reliability and FAC exposure can result. Facility ratings represent the maximum allowed amount of current that can be supplied to the electrical apparatus under specific conditions. These ratings are determined by methods and procedures described in the FAC standards. The responsibility for establishing the ratings consistent with design criteria, assumed conditions and engineering practices of the apparatus, rests with the Transmission Owners and Generator Owners. These ratings are used by the Transmission Operators and Planning Coordinators in performing various calculations in determining operating limits. Facility ratings and their impact on SOL determination The relationship between facility ratings and SOL determination is direct. In the normal mode of operation, a thermal rating may be the limiting rating for a line. Under contingency conditions, the line may be limited by either voltage stability or transient stability criteria. The SOL Methodology is to determine, for a given system configuration, which criterion is limiting. Wrong ratings can alter this hierarchy and lead to either overly protective or inadequate limits. Contingency analysis is the dynamic part of the limit determination. Real-time Contingency Analysis (RTCA) tools dynamically evaluate the potential system response to a planned or forced removal of any transmission element. RTCA determines the extent to which such removal may cause overloads or instability. RTCA requires the knowledge of the real-time system topology, generation/demand schedule, and present parameter values. Inaccurate, missing or mismatched data with respect to the system state may degrade the accuracy of the calculated limits and therefore may not always demonstrate the true

degree of risk exposure to potential power system instability. The TPL standards impact how performance that could influence SOL determination is considered for each contingency category. The planning studies reveal system vulnerabilities and stability issues that in some cases are identified as

IROLs (Immediate Release or Limited Release) and require coordinated input and analysis from Planning Coordinators and Transmission Operators. Model accuracy under the MOD standards is very relevant to limit integrity issues. Dynamic models used for stability analysis need to be validated and maintained, because if the dynamic parameters used for these simulations are inaccurate, stability limited conditions may not be correctly identified and times to mitigate may not be correct. The MOD standards as a whole provide a framework for accountability throughout the modeling and rating processes with real-time monitoring and protection activities. Several enforcement actions have identified issues with the way that facilities are rated and the tools that are used when on site. These issues highlight the importance of limit management to asset data integrity. Examples include situations where the facility rating had not been updated since the last major modification to equipment or since a change to an operating environment, resulting in SOLs being exceeded which would not have occurred if the most current rating were being used. Management of SOL and IROL is recognized as a shared responsibility within the institutional framework extending from the control room to engineering, planning and asset management activities. Within the industry, this responsibility is shared among the Transmission Owners, Generator Owners, Planning Coordinators and Transmission Operators, as defined in the standard. The importance of communication pathways has been highlighted. Information needed for rating changes must be provided to relevant stakeholders in a timely fashion. Similarly, any changes affecting an organisation’s IROL designation should be made available in real time in order to maintain the integrity of communication pathways. Inadequate synchronisation of communication pathways can lead to latent reliability risk, regardless of the overall effectiveness of individual organisations in meeting their required monitoring tasks. Accurate SOLs and IROLs can only be achieved with a very disciplined process that integrates the steps of facility rating, contingency analysis, and model validation. Requirements built into the standard will help to achieve this integration. Limit management is a process that must be undertaken at a system wide level and cannot be treated as an operational task.

End-of-Chapter Summary

Reliability of the Small Outline Land (SOL) and Integrated Rate of change Reliability OutPut (IROL) determination significantly depends on the reliability of facility ratings, models and the Contingency Analysis process in accordance with the FAC, TPL and MOD standards. The operating limits’ reliability indicates a strong coordination between the functions of engineering, planning and operations. Incorrect basic input data negatively impacts the reliability and compliance within the bounds of SOL/IROL.

FROM THE FIELD

An SOL or IROL is only as accurate as the facility rating it's based on. Stale ratings produce stale limits, and the limits don't protect the system they're supposed to protect.

Chapter 6

Communication, Authority Gradients, and Directive Compliance

SOL/IROL relates to a hierarchy of operational authority in which a number of functions exist together and are linked: - The Transmission Operator has direct control of his own system; - The Reliability Coordinator has a synoptic view of the whole system and has directives to be able to prevent and to remove reliably threatening situations; - The Balancing Authority controls the generation-load and frequency balance. These interactions become most visible during limit stress conditions. When a SOL or IROL is projected to be reached or exceeded, communication is not discretionary. The standards require notification among affected parties. For Transmission Operators that do not have direct influence over their facilities, they must notify their Reliability Coordinator. In addition, Reliability Coordinators may issue Operating Reserves-Demand Response (ORDR) directives to one or more Transmission Operators or Balancing Authorities to take corrective actions. Such directives are enforceable under reliability rules. Directive compliance is an IRO standard obligation. In the event a Transmission Operator or Balancing Authority does not comply with a RC directive, the RC must be informed promptly by the non-compliant entity with the reason(s) and proposed alternative action. Non-compliance will not be permitted if it is alleged by the informed entity, or determined by the RC, to be required in order to prevent a danger to human life or to prevent damage to real property or to equipment, or to be in conflict with law or with the laws of a state or province. The authority gradient in the standards is to ensure that no fragmented response to a disturbance occurs. Typically SOL and IROL conditions have large amounts of transfer between different transmission systems and if each control center is left to respond to the effects of a disturbance as they occur, it is possible that the overloads or stability stress is simply transferred from one system to another rather than having any overall reliability benefit. This type of large-scale visibility and awareness of system activity is where the Reliability Coordinator can make a direct impact through coordinated redispatch and/or topology changes in an effort to maximize reliability. communication logs and directives

are frequently documented following an event. It is also common to review timestamped communication and voice recording logs and electronic messages during a compliance audit. Company regulations and procedures state that all directives will be clearly given, received, and implemented and adequately documented. Communication ambiguity can increase potential reliability and enforcement exposure. The Market Operation Section may overlap with the Directive Compliance Section. The

Reliability/Directive Orders that are issued to ensure reliability of the power system may affect the economic dispatch. Although the New Standard Vulnerability Rules mention that the reliability directives take precedence over the economic aspects, the changes in the economic dispatch due to generation redispatch for reliability reasons are not conditioned to the market-based agreements. Settlement Adjustments for out-of-market actions are provided through the Market Operation Section, but the reliability framework does not depend on market-based conditions. Authority gradients apply to emergency declarations as well. If system conditions deteriorate to the point they cannot be managed under the normal mitigation protocols, an entity might declare an emergency in accordance with their EOP procedures. Emergency declarations may require further coordination such as implementation of load shedding or interchange curtailments. The SOL/IROL structure interfaces with emergency activities if normal mitigation actions are escalating. Some recent public enforcement actions were sparked by the ROC’s determination that the ERCOT Reliability Manager (ERM) had to order immediate remedial actions, and that the ERCOT Transmission Entity (ETE) had to implement mitigation actions earlier than the later of the dates set forth in the ERCOT ROA or on the date instructed to do so by the ERM. Some of these actions have been associated with failures to comply with directives of the Reliability Coordinator or with tardiness in implementing mitigation actions. There have also been associated circumstances in which there has been a misunderstanding that a directive is discretionary rather than mandatory, or that actions specified in an RMA or mitigation order did not apply to the particular events in question. It bears repetition that the Authority Hierarchy is not advisory; it is binding. Communication and command of SOL/IROL in the transmission system is a matter of institutional design aiming to balance decentralization of operational control with centralization of reliability monitoring. The authority gradient, the communication routes to be used, and the rules for compliance with SOL/IROL are intended to secure reliable management of interconnection-wide risk during stressful conditions.

End-of-Chapter Summary

The management of SOL and IROL is largely dependent on the communication within the predefined authority gradients between Transmission Operators, Balancing Authorities and Reliability Coordinators. Command languages, Mandatory Notifications and Compliance processes for enforcing the ESD are some of the regulatory measures taken to coordinate remedial actions for SOL and IROL and to enforce the enforceable hierarchy in the operational standards.

FROM THE FIELD

The TOP and RC are accountable for SOL/IROL compliance in different ways. The TOP operates against the limits; the RC oversees their establishment and exceedance response.

Documentation discipline is what survives audit. The methodology, the limit, the exceedance, the response — all have to be evidenced contemporaneously.

Chapter 7

Enforcement Risk, Event Review, and Compliance Exposure

The SOL/IROL standard is operationally critical and enforcement-sensitive. Exceedances, delayed mitigation, inappropriate methods and noncompliance with directives have all been the subject of enforcement actions that are publicly disclosed. The institutional features of the standard ensure that the operational decisions regarding limits are subject to retrospective audit and evidence-based review and consideration of risk. This exposure could arise from a number of places: The entity failed to operate within one of the SOLs established in a prior action. The entity exceeded an IROL and failed to demonstrate that the facility operated within the limit within the time period required to avoid exposure due to excess releasing mass under the IROL provision in the IRO, TOP, or FAC regulations to protect reliability. An outdated or incomplete SOL Methodology was used. A calculation error resulted in a lower than expected FAC rating for an OHL. Different Requirements under the IRO, TOP, or FAC regulations are involved for each scenario but the underlying issue of reliability exposure is the same. Violations Risk Factors for IROLrelated Requirements that are not minor are typically assessed as high severity because of potential for significant cascading consequences. In the enforcement review the reliability impact of the violation (i.e. the reliability impact of the exceedance to the plant safety system) will impact the monetary penalty. All aspects of the duration of the exceedance and the operational conditions at the time of the exceedance in addition to the effectiveness of the corrective action taken will be considered. Even though no cascading consequences are observed, violations are not non-profenional and cannot be considered non-serious under the preventive regulations. The regulatory system does not require plant damage to occur in order to determine that a violation has been committed. Event review begins with a Disturbance Analysis performed in accordance with EOP procedures or through self-reporting. Events can be discovered during the post-event review of an incident and self-reports may be submitted in accordance with the procedures of the Compliance Monitoring and Enforcement Program. Information gathered during

the response to the event, including operator logs, contingency analysis outputs, messages and directives acknowledged, will be used to support the analysis of the event. 1.3.3 Methods errors may lead to latent exposure An error in the construction of the SOL Methodology may not be directly detected until the limit exceedance highlights an inconsistency in the analytical results. The audit of the operational incident may therefore have to cover both the incident itself and the underlying

methodological error. In any case it is always expected that the methods are sound and re-validated from time to time in order to prevent such alignment errors. Enforcement filings have also addressed issues of IROL misidentification. Failure to properly identify a level as an IROL when the criteria are met can reduce the time to mitigate the structure and increase the risk. Over-designation can also have the effect of reducing the focus on the core of the inventory. The standards depend on good analytical work and documentation to ensure the right classification. Commonly, mitigating measures submitted in response to a violation are intended to address changes to process, training, tools, and methods. While taking corrective action to reduce penalty exposure is an important step in the enforcement process, it is important to remember that a violation has already been found and cannot be reversed. The enforcement of emissions reporting regulations is designed to hold perpetrators accountable and to promote better practices going forward. By publishing the Notices of Penalty, it brings more visibility to compliance issues. Companies are able to look at examples of breaches, either anonymously or with company names redacted, to determine common areas where companies may be exposed to non compliance. Some of the trends identified include: Real-time monitoring not being provided in full; Communication protocols not being adequately addressed; Procedural documentation being at odds with the actual work being carried out. The enforcement dimension of the SOL/IROL framework is a key element of the operational seriousness of the limits. Limits and their associated operational range defines the boundaries of safe operation. The standards provide a basis for enforceable operating procedures to ensure operations are maintained within those boundaries and to impose an obligation on operators to take prompt corrective action when those limits are exceeded. The post-event evaluation should verify that these obligations are more than symbolic.

End-of-Chapter Summary

Release and Intervention Request (SOL and IROL) management activities which are subject to enforcement exposure under the IRO, TOP and FAC standards, include cases of SOL/IROL exceedance, delayed mitigation, inadequate methodology and non-compliance with directives. Such events will be subject to risk-based enforcement scrutiny based on evidence collected prior to and following the event, in order to ensure operational reliability accountability and maintain preventive discipline.

FROM THE FIELD

"An SOL is just a recommendation" — no. Operating beyond an SOL has compliance and reliability consequences.

"An IROL is the same thing as an SOL" — no. The IROL classification triggers different response timelines, different procedures, and different audit posture.

"We have a methodology, so we're compliant" — methodology is necessary; periodic review and validation are also required.

Chapter 8

Evolving System Conditions and the Future of Limit Management

The methods and systems for analyzing and responding to SOL and IROL conditions were developed during a time when power systems were composed of large amounts of synchronous generation and load growth was predictable and system topologies were stable. The power system environment is changing and the increasing number of inverter-based resources connected to the system, retirement of synchronous generation, the trend of loading large load centers and increased levels of interregional transfer are changing the characteristics of the system. The changes to the system environment will potentially have a profound effect on how limits are determined and how mitigation of the effects of those limits is exercised. Inverter-based resources operate under a new set of stability rules and regulations than their synchronous generator counterparts. Changes in system inertia, fault current behavior and voltage regulation impact both transient and steady-state stability margins. The SOL Methodology needs to consider and account for these differences when determining stability limiting conditions. The analytical tools and dynamic models are specific to current resource mix in order to remain relevant for the IROL determination and time to mitigate values. Large load centers such as data centers and electrification-driven industrial processes can switch between load point configurations very quickly and are capable of dramatically re-arranging and impacting the transmission loading. Interface limitations that were previously non-binding may now need to be considered. This change in load patterns must be accounted for in TPL planning studies and new results incorporated into operational grid limitations as necessary. This document focuses on transmission expansion and topology reconfiguration challenges arising in limit management under the SOL/IROL regime. New transmission connections may alleviate some constraints while giving rise to additional interfaces to be monitored. In contrast, not building new transmission connections may lead to needing to redispatch more variables in order to manage binding limits. The design of the SOL/IROL regime has to adapt to changing transmission topology in a way that does not prejudice methodological

robustness. Another level of complexity is introduced in regions with interregional transfers and market driven dispatch. Additionally, the historic light loading at interfaces within a region may be stressed as a result of increased interchange between balancing areas due to coordination among Reliability Coordinators. The authority gradients in the standards are still valid, but they are exercised in more complex operating conditions. Advances in monitoring technology, utilizing new state estimation

techniques and wide area measurement systems (WAMS) have significantly enhanced visibility to system operations and conditions. The accuracy of contingency analysis and identification of emerging limit violations can be enhanced through the utilization of these systems. However, advanced technology does not obviate the need for discipline in methods used for determining transmission limits. Accurate input data and validated models are still required. Increased variability due to extreme weather related to climate change A major cause of increased variability is climate change-related extreme weather events such as heat waves, cold spells, storms which may cause power outages. Transmission interface structures and equipment may not have been designed to accommodate such increases in temperature or loads associated with extreme weather. Utilities may wish to incorporate dynamic ratings or perform seasonal evaluations of their facility ratings, possibly with different ambient temperature values being used during different seasons. Incorporation into documented procedures and compliance to requirements that require traceability must be considered. As a consequence of the dynamic conditions of energy systems, changes can occur at any level and with varying speeds, requiring corresponding adjustments to the underlying systems. The corresponding institutional design of the SOL/IROL framework enables adaptable adjustment to these changing conditions. It is thereby possible to maintain and regularly revise the underlying methodologies. In addition, the operational standards for measurement and control that apply to all existing technologies remain unchanged for the entire spectrum of current energy systems. The SOL/IROL regime is only as durable as the planning insights, engineering models and operational procedures that comprise it. As the Bulk Electric System changes, it may be necessary to adjust analytical criteria related to stability and cascading risk. The standards provide a mechanism for those adjustments without a revision to the underlying authority structure. Limit management is still a fundamental reliability task. The changing nature of system conditions has made this task even more

challenging, but not less important. The SOL/IROL architecture is still an effective boundary that identifies the limits of normal operation, in an increasingly complex grid scenario.

End-of-Chapter Summary

Changes in resource composition, patterns of end-use, transmission system configuration, and weather are all contributing to significant changes to the operating conditions for determining SOLs and IROLs. The enforceable procedures are intended to account for these changes while at the same time preserving disciplined processes for determining, tracking, and managing Bulk Electric System reliability related bulk power system voltage limit conditions.

Glossary

Glossary

The terms identified below are taken from the NERC Glossary of Terms and are listed here in their original form as published. Only terms found in this volume are included.

Bulk Electric System (BES) - As defined by the NERC Reliability Standards.

Cascading: The uncontrolled successive loss of system elements as a result of an event in any location of the power system. The result is a large-scale loss of electric service that cannot be contained within predetermined boundary lines defined by reliability studies.

Interconnection - A geographic area in which Bulk Electric System (BES) components operate under synchronized conditions so that loss of one or more such components may impact the ability of other BES operators to maintain reliable generation, transmission, and/or distribution of electric power and proper functioning of associated facilities.

Interconnection Reliability Operating Limit (IROL) - A System Operating Limit that, if violated, could lead to instability, uncontrolled separation, or Cascading within an Interconnection.

Planning Coordinator (PC) – The entity responsible for coordinating the various transmission lines and services associated with a transmission project, resource plans and protection relays.

Reliability Coordinator (RC) - The entity designated by the transmission organization with grid-wide responsibility for ensuring reliable generation and transmission to meet projected peak loads and/or to mitigate power emergencies in real time. An RC has a view of the entire BES (Wide Area View), a complete set of Operating Tools, procedures and processes, and the authority to apply the procedures and tools both during the planning horizon (next day) and in real time to prevent potential emergencies or mitigate actual power emergencies.

System Operating Limit (SOL) The value (such as MW, MVar, Amperes, Frequency, or Volts) that satisfies the most limiting of the prescribed operating criteria for a specified system configuration to ensure operation within acceptable reliability criteria.

Time to Mitigate - Time period between the initial occurrence of an IROL exceedance and the time when the IROL exceedance shall be mitigated.

Transmission Operator (TOP) - The entity responsible for the reliability of its local transmission system, and that operates or directs the operations of the transmission facilities.

Transmission Planner (TP) - An entity that develops a long-term (usually one year or more in the future) reliability plan for the reliability of the interconnected bulk electric transmission systems within its portion of the Planning Coordinator’s Area.

The definitions above are taken verbatim from the NERC Glossary of Terms as it is currently published to the public. Users should consult the most recent version of the NERC Glossary of Terms for the official version of definitions, which may be revised and/or updated.

About the Author

About the Author

Rob Smith is a senior electric industry professional with over thirty years of experience across every major function of the North American Bulk Electric System. His work spans reliability coordination, transmission operations, regulatory compliance, and cybersecurity reliability.

Rob has worked directly in real-time grid operations as a Reliability Coordinator, Transmission Operator, and Power System Operator within RTO/ISO and utility control center environments. He has also held senior regulatory and oversight roles, including senior compliance auditor and subject matter expert for NERC Reliability Standards. In those roles he audited grid facilities for compliance with applicable standards, evaluated the adequacy of mitigation actions, supported the development of violation notifications and settlements as part of FERC-directed enforcement actions, and participated in risk based oversight of utility mitigation activities.

Rob founded Energy Compliance, Inc. to bring senior, regulator-side compliance authority to registered entities directly, without the layered staffing, billable-hour overhead, and generalist advice typical of larger consulting firms. Every Energy Compliance engagement is led by Rob personally.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers. We work across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

We do this work differently than larger consulting firms. Engagements are led by a single senior practitioner with regulator-side experience. We don’t staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Where automation can replace manual work, we build the automation. Where senior judgment is required, the senior is in the room.

Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

Services Provided

Our services are written to be clearly defensible. Operationally executable in real time. Audit-defensible at compliance review. Every deliverable is structured for the auditor’s question, not the consultant’s binder.

Energy Compliance services include, but are not limited to:

• NERC reliability and compliance advisory support
• Reliability governance and program assessments
• Registration and applicability analysis
• Operational and engineering reliability alignment
• Compliance program design and improvement
• Audit and enforcement support (non-advocacy)
• Mitigation planning and Self-Report development
• Training and executive briefings on reliability frameworks
• Regulator-perspective program reviews

Each engagement is scoped to the entity’s role, function, and bulk system impact.

ENERGY COMPLIANCE PROFESSIONAL REFERENCE

Rigorous Compliance. Defensible Programs. Energy Compliance, Inc. partners with registered entities on the institutional and technical questions that define strong reliability and cybersecurity programs, from classification through audit through enforcement response.

N ERC CO MP LIANC E S ENIO R ADV ISO RY Program support, interpretation, and audit Direct engagement on complex reliability preparation. questions.

I ND USTRY ENGAGEMENT AUD IT D EFENSE Standards development and working-group Notice of Penalty response and settlement participation. posture.

CONNECT WITH US Scan to visit

E N E RGY COMPL IAN CE , IN C. · EC-WP-303 · © 2026 · AL L RIGHTS RES E RV E D