Substation Operations (Operator Series I)

Foreword

Foreword

This professional reference is one of a series Energy Compliance, Inc. publishes for registered entities and the people who run their compliance programs.

I've spent more than thirty years on every side of the bulk electric system. I've operated control centers as a Reliability Coordinator, Transmission Operator, and Power System Operator. I've audited grid facilities and signed off on findings as a senior compliance auditor. I've worked enforcement matters from inside the regulator's process. For the last several years I've advised registered entities directly through the firm I founded.

The entities that do reliability well share a common habit. They take the standards seriously without confusing them with reliability itself. They know that a NERC Reliability Standard is a floor, not a ceiling. They know that compliance is something an auditor evaluates, but reliability is something a system either delivers or doesn't. They prepare for audits by building programs that survive real questions, not binders that look thick.

That's the perspective these references try to share. Each one focuses on a single topic: a standard family, an operational function, a regulatory framework, or an emerging industry challenge. Each one walks through how the topic actually works.

These references are written for the compliance manager who wants to understand the system, not just memorize requirements. For the legal counsel who has to brief a board honestly. For the senior operator who's been told that compliance and reliability are the same thing and suspects they aren't. And for the new compliance hire who got handed a binder and told good luck.

These references aren't marketing material disguised as content. They're the result of three decades of doing this work and watching it succeed and fail. I've written them in the same voice I use in a control room or in front of a Regional Entity audit team: direct, evidence-grounded, honest about what the standards do and do not require.

Energy Compliance exists because, in my experience, most of the consulting offered to registered entities today is structured for billable hours rather than for outcomes. Every engagement is overseen by a senior practitioner. We don't bring five people to a meeting that needs one. We automate the work that should be automated. We apply senior judgment to the work that requires it. If that approach matches what you're looking for in a compliance partner, the back of this reference has our contact information.

If not, the reference still belongs to you. Take what's useful. Apply it well. And remember the only test that ultimately matters: when the system needs to perform, does it?

Rob Smith

Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

Substations aren't passive. They are the control points where transmission decisions get carried out: voltage is transformed, faults are cleared, and protection schemes act. Many reliability events trace back to equipment, protection, or switching inside a substation fence. Programs that treat substations as static infrastructure miss where the action is.

This volume is written for the control room. It is not a switching manual and it does not teach procedures. It explains what each major piece of substation equipment does for system reliability, how it interacts with the equipment around it, and what the operator sees when it degrades or fails. The core points:

• Power transformers are among the most consequential equipment in the station. They age slowly and fail suddenly, and their ratings, cooling, and tap changers shape the system's operating envelope.
• Circuit breakers are how the system isolates faults. A breaker that doesn't operate correctly is the difference between a contained event and a propagating one.
• Bus configuration determines flexibility. A configuration that worked in 1985 may not match today's loading and contingency profile, and every maintenance outage changes it.
• Instrument transformers are the eyes and ears of protection. When CTs and PTs give bad data, protection and telemetry go wrong together, often invisibly.
• Protective relays and station dc decide whether a fault stays local. Both sit inside the NERC definition of a Protection System, and both carry maintenance and Misoperation obligations under PRC-005-6 and PRC-004-6.
• SCADA and telemetry are the only view the operator has. The August 14, 2003 blackout showed what happens when that view fails and nobody knows it has failed.
• Switching is the most common substation operation and one of the most consequential. Every switching step changes the topology that contingency analysis depends on.
• Maintenance is reliability work. Programs that defer it to control budget produce findings and accelerate equipment failure. In 2025, PRC-005 and FAC-008 were among the most frequently reported operations and planning noncompliance areas in NERC's annual report.

Chapter 1 frames the substation as a control node and maps where the NERC standards touch it. Chapters 2 through 9 take the equipment one class at a time. Chapters 10 and 11 put it back together: switching exposure, then the pathway from a single misoperation to a cascade, and the situational awareness that stops it.

Chapter 1

The Substation as an Operational Control Node

1.1 Why Operators Need Equipment Knowledge

The standards we are asked to meet cover situational awareness, disciplined switching, and an understanding of configuration risk. They aren't meant to turn every operator into an engineer. They are about awareness: how the SCADA picture relates to the equipment behind it, and how the decisions we make every day play out in that equipment.

This book covers substation equipment from the real-time operations point of view. It describes what each piece of equipment does for power system reliability, how it interacts with other system components, and what failure or misoperation does to reliability. It is not a procedure book. It is designed to give operators a working understanding of the equipment they direct.

Operating the Bulk Electric System (BES) takes sound judgment, and sound judgment takes a good understanding of BES infrastructure. Substations are the hubs of that infrastructure. The more an operator knows about substation components and their functions, the better that operator's situational awareness and the more disciplined the monitoring.

1.2 The Field View and the Control Room View

From the field, a substation is a collection of equipment inside a fence. From the control room, it is a node in the transmission grid where electrical connections, protection functions, and operating flexibility come together.

Nearly every transmission interface is, in the end, substation buswork and breakers. Voltage transformations happen in transformer banks located in substations and switchyards. Most of the reactive devices that move system voltage are in substations, and the relays that protect transmission lines sit at the line terminals in substations. Every change in switching configuration is a change in substation equipment, which is why understanding substation arrangements matters to transmission operations.

1.3 Topology, Exposure, and Lines of Authority

A substation's topology describes its structural redundancy. A radial or single-bus arrangement concentrates risk at a single breaker or bus. A ring bus adds redundancy. A breaker-and-a-half arrangement usually gives more operating flexibility and better fault isolation. Each structure shapes how the system behaves during failures and maintenance outages.

Operational awareness starts with understanding that the substation concentrates both connection and exposure. A bus fault can take out multiple transmission lines. A breaker failure can magnify a single event. A misoperation of a transformer differential relay can separate segments of the network carrying large amounts of load or generation. A fault inside a substation rarely stays with one piece of equipment.

A bus protection misoperation or a breaker failure can turn a modest fault into a much larger event. In that case the initial equipment fault is often less serious than what the protection and the station design do next. The lesson is to understand not only what a piece of apparatus was designed to do, but how it interacts with the apparatus around it.

Experienced operators look past the simple one-line picture. A substation affects post-contingency loading, load transfer capability, restoration sequences, and emergency limits. Knowing the bus arrangement, the normally open points, and the protection boundaries, and knowing how the monitoring system derives its alarms, lets the operator interpret alarms correctly and tie them to system behavior.

A substation is also an operational boundary between systems, and lines of authority can blur there. One person may be responsible for operating certain equipment and have no authority over the equipment next to it. Knowing who controls what, and how each piece interacts with the rest of the station and with neighboring stations, is essential to protecting the power system. It is what makes coordinated action possible during abnormal conditions.

1.4 A Node Controlled in Real Time

The substation is the link between generation, transmission, and distribution. It is one of the nodes the control room manages in real time, and the reliability of power delivery through it has to be actively managed. Understanding how equipment configuration affects normal and emergency states is the foundation of that management.

1.5 Where the Standards Touch the Substation

The standards that reach into the substation are spread across several families. The table below lists the ones this volume refers to, all in effect on October 26, 2026.

End-of-Chapter Summary

Substations are operational control points where connectivity, protection, and operating flexibility intersect. Control room personnel who understand substation topology and how the equipment relates build a fuller awareness of their system and make better operating and maintenance decisions under normal and abnormal conditions.

From the Field

The configuration determines what the system can do.

Chapter 2

Power Transformers: Functional Behavior and Reliability Consequence

2.1 More Than a Voltage Converter

Power transformers are among the most valuable components in any substation. They step voltage up and down between the transmission and sub-transmission levels, connect bulk generation to the grid, and deliver load from one voltage level to another. A transformer is one of the most important reliability components on the system, and its loading, cooling, and protection responses can significantly affect overall stability.

2.2 Ratings, Ambient Conditions, and Loading Alarms

A transformer's capability is defined by its rating at the interface it serves. The nameplate gives a base capacity, but seasonal ratings, available cooling, and system operating conditions set the effective limit. FAC-008-5 recognizes this: a Transmission Owner's Facility Ratings methodology must identify how it considered manufacturer ratings, ambient conditions (particular, average, or varying in real time), and operating limitations, and its scope must include transformers.

So when a transformer alarms on overload, the load is what drives the alarm, but interpreting it takes more. The operator needs to know which cooling stages are in service and how long the transformer has been in that condition. The same megawatts mean different things on a cold night with full cooling and on a hot afternoon with a fan bank out.

2.3 Load Tap Changers Are Not Neutral

Load tap changers complicate the picture. The tap moves automatically to control voltage, but each step also changes the transformer's effective ratio and the reactive power it passes between voltage levels. Under stressed conditions, a set of voltage control actions can shift reactive flow and power flow enough to aggravate constraints on adjacent transmission. Moving a tap is not a benign or neutral action. It has system-wide implications.

2.4 Cooling Degradation as an Operational Signal

Cooling system degradation is an operational signal that should not be ignored. Losing cooling stages reduces loading capability and increases thermal stress. A transformer carrying sustained overload with degraded cooling is a transformer heading toward failure, and the alarms usually come first. Treat a cooling alarm as an early loading alarm, and the operating picture improves.

2.5 Protection and Failure Modes

Transformer protection detects internal faults and clears them as fast as possible. The usual schemes are differential relays, sudden pressure relays, and overcurrent relays, acting independently or together. PRC-005-6 covers Sudden Pressure Relaying maintenance (Table 5) alongside Protection Systems and Automatic Reclosing. When transformer protection operates, the system effect is severe. Losing a large autotransformer can affect two voltage levels at once, and transferring its load to neighboring facilities takes careful attention to loading and stability.

Most transformer failures come from internal faults, insulation breakdown, bushing failure, or through-fault stress from external faults. Bushing and internal failures can release energy violently enough to damage surrounding equipment in the station. They are rare, but their impact is always high. Operators gain the most when they know the failure modes and the alarms and conditions associated with each, because some of those conditions can persist for a long time before a major failure.

2.6 Energization, Inrush, and System Strength

Energizing and de-energizing a transformer is a reliability event in its own right. Inrush current can cause unwanted relay operations if the protection is not set for it or if system conditions are abnormal. Energizing a large transformer under weak system conditions can also stress voltage. Know the system strength before switching a large transformer in.

2.7 Transformers as Transfer Paths

Large transformers are transfer paths between voltage levels. Disconnecting one redistributes flow and can overload other facilities. Contingency analysis shows those effects and helps the operator choose a response, but a working knowledge of transformer behavior makes the results easier to read.

Large transformers also add complexity to restoration. Returning one to service after an outage can require voltage support, reactive control, and load management to avoid overvoltage and inrush-related misoperations. Those secondary problems can make a bad situation much worse.

End-of-Chapter Summary

Power transformers are high-impact reliability components. They affect stability through loading capability, cooling, protection action, and voltage regulation. Knowing their condition and what a failure does to the system sharpens judgment on overloads and protection trips.

From the Field

A transformer failure removes a transmission path. Ratings drive operating limits. A transformer rated conservatively in 1995 may have margin today; one rated aggressively then may not. Ratings have to stay current.

Chapter 3

Circuit Breakers: Fault Interruption and Operational Exposure

3.1 The Controllable Boundary

Circuit breakers are the mechanical and electrical isolation devices that define the boundaries of the transmission system in a controllable way. Nearly every switching action in a substation is a breaker operation. From the operating point of view, breakers are how faults are cleared and isolated and how configuration changes under normal and emergency conditions.

3.2 Interrupting the Fault

A transmission-class circuit breaker exists primarily to interrupt fault current. When protection detects a fault, it sends a trip command to one or more breakers to interrupt the fault and isolate the faulted section. If the breakers interrupt successfully, the rest of the system stays in service. If they don't, the fault's effects spread beyond the point of origin.

Modern breakers use different interrupting media. SF6 (sulfur hexafluoride) breakers interrupt in gas; vacuum breakers interrupt in a vacuum. The medium doesn't change the rule. A breaker must open when commanded to open and stay closed when it is supposed to stay closed. Reliability risk appears when a breaker breaks that rule in either direction.

3.3 Breaker Failure Protection

Breaker failure protection recognizes that a breaker did not interrupt and clears the fault by tripping every adjacent breaker that can feed it. That contains the fault, but at a cost. Lines and bus sections that had nothing wrong with them are taken out along with the faulted element. What the operator sees is a fault that was contained and an outage that is larger than the fault itself.

3.4 Misoperations and Unexplained Trips

Breaker operations can also introduce risk when a breaker trips without a valid fault and important transmission lines are lost suddenly and unnecessarily. Incorrect relay settings, wiring errors, and relay failures can all cause an inappropriate trip. Under PRC-004-6, the owner of the interrupting device has 120 calendar days to determine whether a Protection System component caused a Misoperation. For the operator, the lesson is narrower: a trip without evidence of a persistent fault is a reason to assess the disturbance carefully before restoring, not a reason to assume it was nothing.

3.5 Reclosing

Automatic reclosing is a bit more complicated. Its purpose is to restore a line quickly after a transient fault, such as a lightning strike, has tripped it. Reclosing is usually effective, but reclosing into a permanent fault can make a disturbance worse. Operators should weigh whether a reclose attempt makes sense at the time, particularly in bad weather or when the system is already weak.

3.6 Breakers Out of Service

Breakers out for maintenance reduce flexibility. A breaker out of service weakens the bus configuration around it. That matters most in ring bus and breaker-and-a-half arrangements, where losing one breaker reduces redundancy and raises the station's sensitivity to the next fault. Understanding that effect improves contingency awareness during outage coordination.

3.7 Auxiliary Systems and Health Indicators

Watch the breaker's auxiliary systems. Loss of control power, low SF6 pressure alarms, and hydraulic or pneumatic operating mechanism alarms can all signal that the breaker may not trip or close reliably. Operations doesn't maintain breakers, but a degraded breaker belongs in the operating risk assessment.

The NERC maintenance obligation reaches the breaker only partway. The Protection System definition runs through the trip coils of the circuit breakers, and PRC-005-6 Table 1-5 requires verifying that each trip coil can operate its breaker at least every six calendar years. The breaker mechanism beyond the trip coil is outside that definition, so its condition depends on the owner's own maintenance program.

3.8 Status Accuracy

Switching depends on breaker sequence and on confirmation of breaker status. Switching procedure is outside the scope of this book, but the importance of accurate breaker status in SCADA is not. Inaccurate status can mislead operators about the actual state of the system and lead to wrong switching decisions. Chapter 9 returns to this point.

3.9 Where Protection Decisions Are Executed

Breakers are where protection decisions are carried out. Breaker performance decides whether a fault stays local, and breaker failure modes decide how large the outage gets and how hard restoration will be. The breaker is the mechanical boundary between normal continuity and a fault that protection has isolated.

End-of-Chapter Summary

Circuit breakers isolate faults, execute switching, and define the boundaries inside a substation, and their failures and degraded states set how far an outage reaches.

From the Field

PRC-005-6 requires trip coil verification on a cadence, and PRC-005 was among the most frequently reported operations and planning noncompliance in NERC's 2025 annual report, with ineffective preventive controls as the leading cause.

Chapter 4

Bus Configurations and Operational Flexibility

4.1 Bus Design Is an Operating Factor

The design of substation buswork and its switches shapes how power flows, how faults are isolated, and what a maintenance outage does to reliability. Bus design is an operating factor, not just a drafting choice. It governs contingency exposure and how much switching flexibility the operator has.

The most common transmission-level arrangements are:

• Single bus
• Main and transfer bus
• Ring bus
• Breaker-and-a-half

Each one reflects a trade among cost, redundancy, and operating flexibility. None of those choices are made by the operator, but the operator lives with all of them.

4.2 Single Bus

A single bus concentrates risk. Every element connects to one electrical node, so a bus fault or a breaker failure can de-energize the whole station. Maintenance on one breaker can require taking out the line or transformer it serves. Low flexibility means high contingency sensitivity.

4.3 Main and Transfer Bus

A main-and-transfer arrangement adds a transfer bus and a transfer breaker. A line breaker can be taken out for maintenance while the transfer breaker carries the circuit, so service continues. Configuration errors or unintended transfers reduce redundancy until they are corrected or the transfer is reversed. When assessing contingency exposure, consider the buses as they actually stand, not as they normally stand.

4.4 Ring Bus

A ring bus adds redundancy. Breakers form a closed loop, and each element connects to the ring between two breakers. A fault on one element is cleared by its two breakers without interrupting the others, and any single breaker can be taken out for maintenance without removing an element. The exposure comes when the ring is open. With one breaker out, the ring becomes a string, and a second outage can split the station or leave elements radial. Opening several breakers in a small area can create radial exposure the system was not prepared for, or force flow through a single path.

4.5 Breaker-and-a-Half

A breaker-and-a-half arrangement offers a high degree of operating flexibility. Two circuits share three breakers between two main buses, so each circuit is fed through two breakers and the middle breaker is shared. Any single breaker can be taken out for maintenance without interrupting either circuit, and a fault on either main bus can be cleared without losing a circuit. Interpreting a fault correctly still requires knowing breaker status and protection coordination, because those define which isolation boundaries apply.

4.6 Maintenance Changes the Arrangement

During maintenance outages, the effective bus arrangement will usually differ from the normal one. A breaker-and-a-half station with one breaker out is less redundant than normal and more exposed to a second contingency. Outage coordination processes handle the approvals; IRO-017-1 requires each Reliability Coordinator to develop, implement, and maintain an outage coordination process for generation and Transmission outages in its area. Good practice goes further. Know when a bus is temporarily constrained and short of full contingency coverage, and raise monitoring and readiness to respond accordingly.

4.7 Bus Faults and Bus Protection

Because buses connect so much, bus faults are high-impact events. Bus protection clears a bus fault by tripping every breaker in the zone at once, so many breakers open together. A bus differential misoperation produces the same picture without a fault: multiple transmission lines tripped by a single protection operation. When several outages arrive in a short span, look for the common bus before concluding that several independent failures happened.

4.8 Configuration, Flow, and Voltage

Switching changes bus alignment, and that changes power flow in ways that are not always obvious. A line transfer changes impedance paths and can raise loading on other facilities. Contingency analysis tools reflect the new topology, but their results are more useful in the hands of an operator who understands the bus.

Bus configuration also affects voltage. Concentrating shunt reactors or capacitor banks on one bus section and then reconfiguring can weaken local voltage support. A voltage shift after a switching step is a clue that the new configuration has changed reactive flow.

Bus configuration is a structural reliability feature. It governs how faults are isolated and how the station is maintained and restored after a contingency.

End-of-Chapter Summary

Bus configuration affects voltage, flow, fault isolation, and contingency capacity. The working picture is the current alignment, the maintenance in progress, and the protection that applies.

From the Field

Single-bus configurations are simple and brittle. Multi-bus configurations are resilient and complex.

Chapter 5

Instrument Transformers: Measurement Integrity and Protection Dependence

5.1 The Measurement Point

Instrument transformers, current transformers (CTs) and potential or voltage transformers (PTs or VTs), are the measurement point between high-voltage apparatus and the protection, metering, and control systems. They work in the background and are easy to take for granted. Accurate measurement, though, is fundamental to reliable control.

CTs and PTs reduce primary current and voltage to secondary values proportional to the primary quantities and suitable for relays and meters. Relays use those values to detect faults, measure impedance, and decide whether trip conditions are met. NERC treats them accordingly: voltage and current sensing devices providing inputs to protective relays are part of the Protection System definition and fall under PRC-005-6 maintenance. If instrument transformer performance or application is wrong, protection reliability suffers.

5.2 Saturation Under Fault Current

High fault current can saturate a CT. A saturated CT distorts its secondary current, and in severe cases the relay does not see the true current and may operate late or lose selectivity. Relays can also misbehave under severe faults that are within design parameters. These cases are uncommon, but knowing the performance limits of the measurement chain helps explain relay behavior when they happen.

5.3 Polarity and Wiring Errors

Incorrect CT or VT polarity and wiring produce wrong differential current calculations. Differential protection on transformers and buses depends on correct CT wiring, and a wiring error can cause a differential element to misoperate. When a differential alarm or trip occurs, the operator cannot take reliable action until it is clear whether the cause is a measurement problem or an equipment failure that needs a measured response.

5.4 Loss of Voltage Signals

Losing PT signals affects both protection and situational awareness. Voltage-dependent relays, synchronism checks, and automatic control schemes all depend on the voltage input. SCADA uses the same signals to display voltage. If a PT fails or its fuse blows, the operator may see voltage disappear from the display or receive unusual alarms. The operator has to determine quickly whether voltage has actually collapsed or the measurement has simply stopped arriving.

5.5 Measurement Feeds the Operating Picture

Metering accuracy affects operational awareness. Real-time power flow, interface monitoring, and contingency analysis all need accurate inputs. Bad measurements can hide a developing overload or exaggerate system stress. Validate telemetry quality and clear errors quickly to keep the operating picture accurate.

Instrument transformer problems tend to show up in three ways: protection trips, unusual alarms, and unusual displayed values. A CT problem can trip healthy equipment. A PT problem can upset voltage regulation schemes. Unusual relay targets or telemetered values may point to an instrument fault the operator needs to know about.

5.6 Layers of Dependence

Protective relays depend on instrument transformers, and that dependence adds a layer to reliability. A relay that works correctly can still separate circuits unnecessarily if its inputs are wrong. Correct inputs let the relay discriminate quickly and trip selectively, which keeps the system stable.

When an instrument transformer fails, restoring the affected element should include coordinating with protection personnel to confirm signal integrity before it goes back in service. Operators don't do the testing, but they need to understand the measurement chain to direct restoration.

Instrument transformers are among the most mundane and most critical components in a substation. They turn the high voltages and currents of the power system into quantities relays and monitoring devices can use. When they work properly, protection and situational awareness work properly. When they are misapplied or mistreated, both suffer together.

End-of-Chapter Summary

Instrument transformers are the primary measurement sources for protection, control, and monitoring in the substation. CT and PT accuracy and reliability directly affect relay operation and telemetry. Knowing the integrity and failure modes of the measurement source helps operators distinguish normal from abnormal system behavior and follow procedures when the unexpected happens.

Chapter 6

Protective Relays: Fault Detection, Selectivity, and Misoperation Risk

6.1 The Brains of the Protection System

Protective relays are the brains of the protection system. They take inputs from instrument transformers, apply logic, and send trip signals to circuit breakers to clear the fault. From the control room, the moment a relay operates is the dividing line between a contained disturbance and one that spreads.

6.2 Speed, Selectivity, and Coordination

Transmission protection rests on three principles. Speed limits equipment damage and supports stability. Selectivity means only the faulted section is removed. Coordination means backup protection operates in sequence if primary protection does not. Every relay scheme is built from those three.

The common transmission protection functions are:

• Distance protection measures impedance to locate faults on a transmission line.
• Differential protection compares the currents entering and leaving a protected zone, such as a transformer or a bus.
• Overcurrent protection responds to current above a set level.

Each function has defined operating characteristics and a defined zone of protection.

6.3 Reading Relay Operations

A relay operation is usually the first indication of a fault in the control room. Combining breaker trip indications, relay target information, and SCADA alarms lets the operator work out which relay operated and whether the fault was inside the protected equipment, outside it, or the product of a misoperation.

6.4 Misoperations

Misoperations are a significant source of reliability problems. NERC defines a Misoperation as the failure of a Composite Protection System to operate as intended for protection purposes, and the definition lists six categories: failure to trip and slow trip, each during a Fault and other than a Fault, and unnecessary trips, during a Fault on another Element and other than a Fault. Common causes are incorrect wiring, incorrect settings, protection communication problems, and system conditions the settings did not anticipate.

Operators don't own relay settings, and a Misoperation is not an operator failure. PRC-004-6 places the obligation on the Transmission Owner, Generator Owner, or Distribution Provider that owns the interrupting device or the Protection System: identify Misoperations within 120 calendar days, develop a Corrective Action Plan within 60 calendar days of first identifying a cause, and implement it. For the operator, the practical point is simpler. Relays are not infallible, and a measured assessment of an event starts from that fact.

6.5 Backup Protection and Larger Outages

Overlapping zones and backup schemes can widen the impact of a complex fault. If primary line protection fails to clear a fault, backup protection removes it, but from a larger part of the system. When several facilities trip together, suspect that backup protection took the extra circuits. That is coordination working as designed. The larger outage is the price of the design, not a separate fault.

6.6 Communication-Assisted Schemes

Communication-assisted schemes add complexity. Permissive and blocking signals exchanged between line terminals control when the relays trip. Losing the channel can change relay sensitivity or shift protection to backup elements. Communications systems necessary for correct operation of protective functions are part of the Protection System definition, and channel monitoring belongs in the operator's awareness of protection health.

6.7 Settings Age with the System

Relay settings come from coordination studies built on system impedance, fault levels, and contingency conditions. When the system changes through new generation, new lines, or a different dispatch pattern and the settings do not follow, outdated settings can cause unwanted operations. PRC-027-1 addresses this in two parts. Under R1, owners must have a process for developing new and revised Protection System settings for BES Elements so that Protection Systems operate in the intended sequence during Faults. Under R2, for each BES Element with the protection functions listed in Attachment A, they must perform a Protection System Coordination Study, or compare fault current against a baseline and study when it deviates by 15 percent or more, within intervals not to exceed six calendar years.

6.8 Design Philosophy

Protection is designed to remove faulted equipment quickly, even at the cost of taking healthy equipment out with it, because fast clearing is what keeps a fault from becoming a cascade. The consequence is that the control room will see trips it did not expect.

End-of-Chapter Summary

Speed, selectivity, and coordination set how well relays contain a disturbance.

From the Field

Protection is not just the engineer's problem: PRC-027-1 makes settings processes and coordination studies auditable, and PRC-004-6 attaches corrective action to Misoperations.

Chapter 7

Capacitor Banks, Reactors, and Voltage Control Dynamics

7.1 Substation Reactive Equipment

Reactive power devices in a substation exist for voltage control and stability. Shunt capacitor banks, shunt reactors, and series compensation affect voltage, reactive flow, and in some cases real power flow. Operators use them as voltage control and stability tools, but too often only reactively.

7.2 Shunt Capacitors

Shunt capacitor banks supply reactive power. Injecting vars raises voltage at the point of injection and reduces the reactive power the transmission system has to carry to that area, which improves voltage profiles under heavy load and frees transmission capacity. The effect depends heavily on location. Energizing a bank raises voltage most at its own bus and less with distance, and it changes reactive flows on neighboring paths. Tap changers, other capacitor controls, and generator voltage regulators nearby may respond, and the combined result can surprise an operator watching only one bus.

7.3 Shunt Reactors

Shunt reactors absorb reactive power. They are used at light load to prevent overvoltage. Long transmission lines generate reactive power through line charging, and at low load that charging pushes voltage up; reactors absorb it to hold voltage in range. The cause of high voltage at light load or after a contingency is sometimes misunderstood in the control room. Line charging, not generation, is often the source.

7.4 Switching Transients

Switching reactive devices causes voltage steps. Capacitor switching can produce an abrupt rise or drop in voltage with brief oscillation. Back-to-back capacitor switching produces high inrush currents that stress switching devices and, where protection is not coordinated for it, can trip protection.

7.5 Interacting Controls

Voltage control, transformer tap changing, and generator reactive capability are closely linked. With capacitors and reactors in the mix, generator automatic voltage regulators and load tap changers interact dynamically. When voltage moves, don't evaluate any one regulating device in isolation.

7.6 Reactive Margin and Voltage Stability

A reactive deficit brings the risk of voltage instability. Under stress, losing a major capacitor bank or a generator's reactive capability cuts voltage margin when it is needed most. At light load, excess reactive injection causes overvoltage and adds insulation stress. Knowing when reactive resources are limited is part of situational awareness. The 2003 blackout investigation made the point precisely: insufficient reactive power was an issue on August 14, but the Task Force found that inadequate management of reactive power and voltage, not the shortage itself, was a cause.

7.7 Protection of Reactive Equipment

Protection on reactive equipment is its own operating issue. Capacitor banks are protected by unbalance, overcurrent, and overvoltage relays, and reactor protection responds to abnormal current. An unexpected trip of reactive equipment changes voltage and flow patterns. FAC-008-5 includes series and shunt compensation devices in the equipment a Facility Ratings methodology must address.

7.8 Series Compensation

Series compensation is less common. It reduces effective line impedance and can increase transfer capability, which also changes flow patterns and stability margins. Its protection acts fast to protect the equipment, and how series compensation changes a line's dynamic response during faults is worth understanding operationally.

7.9 Voltage Is a System Quantity

Voltage control does not stop at the substation fence. Actions at one point on the grid change voltage elsewhere, which is why Reliability Coordinators and Transmission Operators spend so much time watching voltage across their whole footprint.

Reactive devices are often switched to improve conditions at the moment of switching. Switching procedure is outside the scope of this book, but a little thought shows that switching reactive devices changes contingency results. Putting capacitors in or taking them out changes the power flow solution, and with it the stability margin for certain contingencies.

In my view, capacitor banks and reactors belong at the center of voltage regulation, because their operation, their protection, and their interaction with other voltage controls define the electrical state of the grid. Voltage behavior is one of the key indicators of system state, and reactive devices are the main tools for managing it.

End-of-Chapter Summary

Capacitor banks, reactors, and other reactive devices set reactive flow and voltage levels, and switching them changes contingency results. Monitoring system voltage well depends on knowing how they behave.

Chapter 8

Station DC Systems and Control Power Integrity

8.1 The Low-Voltage System That Runs the High-Voltage One

Substation operation depends on more than high-voltage apparatus. Protection, breaker operation, and indication all run on low-voltage control power, usually from station batteries and their dc distribution. Station dc powers breaker trip and close circuits, relays, communications, and control. Degrade it and fault isolation, breaker operation, and indication all degrade with it.

Station dc systems are battery-backed so they keep supplying those loads when the station's ac supply is lost. That is the point of having them, and it is why losing dc has an immediate and serious effect on reliability. NERC includes station dc supply associated with protective functions, including station batteries, battery chargers, and non-battery-based dc supply, in the Protection System definition.

8.2 Battery Maintenance and Alarm Awareness

Battery testing and maintenance focus on capacity and cell condition. PRC-005-6 sets the minimum. For vented lead-acid batteries without monitoring, for example, Table 1-4(a) requires verifying station dc supply voltage and inspecting electrolyte level and unintentional grounds at least every four calendar months, with charger, connection, and cell checks every 18 calendar months. The owner must also verify that the battery can still perform as manufactured, either by comparing cell measurements against a baseline every 18 calendar months or by a capacity test of the whole bank every six calendar years.

Operators don't test batteries. Their contribution is awareness: low voltage, charger failure, and dc ground alarms each point to a dc system condition that calls for extra vigilance.

8.3 DC Grounds

A dc ground is a special operating condition. A ground on the dc system creates an extra current path and can interfere with a breaker's trip circuit. An uncleared dc ground can keep a breaker from tripping for a fault, or a second ground can cause an unintended operation. A dc ground alarm means protection reliability may be compromised.

8.4 Charger Failure

A charger failure is not an immediate problem while the batteries are fully charged. Over an extended period, though, the battery discharges and leaves the station more vulnerable to the next event. During extreme weather or high-contingency conditions, charger alarms belong in the operating risk assessment.

8.5 DC Voltage and Protection Performance

Many protection and control functions depend on dc. Transients and sustained changes in dc voltage can affect relay operation, alarms, and communications interfaces. If dc voltage falls below design levels, a breaker may not trip and backup protection has to clear the fault, widening the outage.

8.6 DC and Restoration

Control power availability drives many of the restoration problems that follow a disturbance. Without dc, a substation often cannot perform the switching and re-energization restoration requires until control power is restored.

8.7 DC and Visibility

Many station dc systems also feed monitoring and SCADA interfaces. Losing dc can take out telemetry, status indication, and remote control. The operator must be able to tell whether a loss of communication is a control power problem or whether the equipment has actually lost primary power.

Good practice is to design, operate, and maintain dc systems with adequate redundancy and with monitoring of their integrity. Duplicate battery banks, multiple chargers, and ground detection are common. Understanding the dc system also helps the operator assess station performance under abnormal conditions.

The control room usually sees little about dc circuits beyond alarms. Those circuits still carry the control signals to breakers, relays, and communications equipment, and fault isolation and restoration depend on them.

End-of-Chapter Summary

Station dc supplies protection, breaker control, alarm panels, and monitoring. Degradation of batteries, chargers, or dc system integrity can prevent correct fault clearing and obscure the true condition of the system. Awareness of station dc condition lets the operator judge risk and strengthens reliability when the system is faulted.

From the Field

Maintenance is reliability work. Asset management spans the equipment lifecycle, and programs that focus on individual asset failures miss the lifecycle pattern. A station battery is the clearest example: the four-month inspection is cheap, and the breaker that doesn't trip is not.

Chapter 9

SCADA, RTUs, and Telemetry Integrity

9.1 The Operator Sees an Image, Not the Substation

SCADA, remote terminal units (RTUs), intelligent electronic devices (IEDs), communication links, and the energy management system (EMS) are how the control room connects to substation equipment. They turn the physical state of the equipment into data the operator can see. Telemetry reliability and situational awareness are inseparable.

Operators do not see the substation. They see an image of it built from status points, analog values, alarms, and event indications. Breaker positions, line flows, transformer temperatures, voltages, and reactive flows are all measured and transmitted through measurement and communication systems. Wrong or missing values lead to wrong decisions.

9.2 From the Field Device to the Screen

RTUs and IEDs collect signals from instrument transformers, protective relays, and control circuits and send them to the control center over communication channels. Delays, communication failures, and configuration errors can mislead the operator about the real-time state of the system.

The August 14, 2003 blackout is the industry's standard example. Shortly after 14:14 EDT, the alarm and logging system in FirstEnergy's control room failed and was not restored until after the blackout. From about 12:15 EDT, MISO's state estimator was ineffective; the Task Force traced the first mismatch to an outage of Cinergy's Bloomington-Denois Creek 230-kV line that the model did not reflect. Separately, after the Stuart-Atlanta 345-kV line tripped at 14:02 EDT, MISO's state estimator did not have real-time data from that line incorporated into it. The U.S.-Canada Task Force named inadequate situational awareness at FirstEnergy as one of four groups of causes, including the lack of procedures to keep operators aware of the functional state of their critical monitoring tools. TOP-010-1(i) now requires each Transmission Operator and Balancing Authority to have an alarm process monitor that notifies System Operators when the Real-time monitoring alarm processor fails.

9.3 Telemetry Loss Is Not De-energization

A communication loss to a substation does not mean the station equipment has failed. The cause may be a communication channel outage, an RTU failure, a control power loss, or a combination. Distinguish a telemetry loss from a de-energization before acting. Cross-check analog values, breaker positions, and alarms to confirm whether the station is actually dead.

TOP-001-6 makes this a coordination obligation as well: Transmission Operators and Balancing Authorities must notify their Reliability Coordinator and known impacted interconnected entities of planned outages, and of unplanned outages of 30 minutes or more, of telemetering and control equipment, monitoring and assessment capabilities, and associated communication channels.

9.4 Scaling and Calibration

Analog telemetry such as line loading or transformer temperature depends on correct scaling and calibration. A wrong scaling factor produces wrong readings, and a miscalibrated point can mask a growing overload. Because data integrity depends so heavily on correct configuration, treat any value outside expectations with caution until it is confirmed.

9.5 Remote Control and Command Verification

Remote control through SCADA adds another dimension. Operating breakers and reactive devices remotely requires reliable communications and verification that the command took effect. Switching procedure is outside the scope of this book, but reliable status indication after a remote command is what prevents errors from an unexpected configuration.

9.6 Data Quality and Real-time Assessment

Contingency analysis runs on real-time or near-real-time SCADA data, so bad inputs make the results unreliable. Watch for large amounts of stale data, a state estimator that fails to converge, and repeated communication errors with particular substations. The state estimator computes a best-fit estimate of system conditions from redundant measurements; when its inputs degrade, so does everything built on it.

The standards address this directly. TOP-001-6 requires each Transmission Operator to ensure a Real-time Assessment is performed at least once every 30 minutes. TOP-010-1(i) requires Transmission Operators to implement an Operating Process or Operating Procedure covering criteria for evaluating Real-time data quality, provisions to indicate data quality to the System Operator, and actions to address data quality issues with the entities responsible for the data, along with a parallel process for the quality of analysis used in Real-time Assessments.

9.7 Cybersecurity Controls

Authentication, network segmentation, and monitoring are among the cybersecurity controls that protect SCADA from unauthorized access. They can create operating friction, and operators need to understand how the controls affect operations and why they generate the messages they do, so those messages are handled appropriately. Which substation cyber systems are in scope is decided by CIP-002-5.1a. Its impact criteria reach Transmission stations and substations: Transmission Facilities operated at 500 kV or higher meet a medium impact criterion, as do certain 200 kV to 499 kV stations with high aggregate weighted line values, and BES Cyber Systems at other Transmission stations and substations are low impact.

9.8 Redundancy Can Fail Too

Modern SCADA design relies on redundancy: multiple communication paths, redundant control center servers, and backup facilities, so situational awareness survives the failure of a single component. Redundant systems can still fail, and primary and backup paths can fail together. TOP-001-6 requires each Transmission Operator to have redundant and diversely routed data exchange infrastructure within its primary Control Center and to test that redundancy at least once every 90 calendar days, initiating action within two hours to restore it if a test fails.

9.9 Telemetry After the Event

Telemetry matters after the event too. Sequence-of-events records and disturbance logs show what happened and in what order. Poor-quality or missing data slows the investigation into cause and weakens the recommendations that follow.

SCADA and telemetry are the operator's window into the substation, and every alarm, trend, and displayed value depends on how those systems collect, transmit, and present information.

End-of-Chapter Summary

SCADA, RTUs, and telemetry networks give the control room its view of substation equipment. Data integrity, reliable communications, and correct configuration are essential to that view. Understanding the limits and failure modes of telemetry helps operators interpret alarms and make sounder reliability decisions.

From the Field

SCADA integration is what makes the substation visible to the control center. Without it, the operator is blind to what the substation is doing. Cybersecurity overlays substation automation. The OT/IT convergence is real, and CIP applies wherever CIP-002 categorization puts a BES Cyber System in scope.

Chapter 10

Switching Exposure and Configuration Risk

10.1 Every Switch Changes the System

Switching changes the electrical configuration of the system. The operation happens in the field or the substation, but the instruction comes from the control center. Every switching step can change interconnections, change flow paths, change protection zones, and create a high-exposure condition from a reliability standpoint.

Substation configuration controls how faults are isolated and how contingencies propagate. When breakers or disconnect switches change state, the effective bus configuration can drop temporarily to a less redundant condition. A breaker-and-a-half station under maintenance runs with reduced fault tolerance. A ring bus opened at two or more points can become radial. The operator has to recognize what each configuration change does to contingency results.

10.2 Configuration Errors and System Conditions

Configuration errors and mismatches between SCADA and actual switchgear position can extend outages. Sometimes the relays operate exactly as intended, and the problem is the system condition the switching step created. The reliability consequence was not the switching operation alone. It was the system condition into which the switch operated.

Verify breaker status. Configuration awareness suffers from telemetry discrepancies, stale data, and misidentified equipment. If the actual configuration does not match the assumed one, contingency sensitivity can be higher than the tools indicate. Disciplined operations cross-check every available source to confirm the topology.

10.3 Switching Moves Protection Boundaries

Switching also moves protection zones. Opening a bus tie or sectionalizing breaker changes a zone boundary. Energizing a transfer bus brings in a new set of protection interactions. Differential protection is particularly sensitive to abnormal configurations created by switching, and misoperations in those states are a known risk.

10.4 Switching Under Stress

Switching under stressed conditions adds complexity. Heavy load, voltage instability, and low reactive margin all make topology changes more consequential. Even routine maintenance switching can measurably change transfer capability. Understand the system conditions that raise the risk of a configuration change before making it.

10.5 Restoration Switching

After a disturbance, restoration is a sequence of switching operations to bring back load and normal configuration. Good practice is to restore in a planned sequence that avoids overloads and voltage excursions. Restoration procedures are outside the scope of this book, but the switching steps that make up the recovery path matter a great deal.

10.6 Switching Exposure and Human Performance

Formal communication protocols are one of the industry's main defenses against switching error. COM-002-4 requires each Balancing Authority, Reliability Coordinator, and Transmission Operator to have documented communications protocols for its operating personnel who issue and receive Operating Instructions. During an Emergency, an oral two-party, person-to-person Operating Instruction requires three-part communication. The receiver repeats the instruction, not necessarily verbatim, and the issuer confirms the repeat is correct, reissues the instruction if it is wrong, or takes an alternative action if no response comes. The protocols must also specify the nomenclature for Transmission interface Elements and Facilities. That matters, because the right instruction applied to the wrong piece of equipment is still a switching error.

10.7 Switching and the Model

From a reliability standpoint, switching is never innocuous. It changes the configuration on which every contingency analysis is based. Contingency tools model the system as configured at the time of the run, so their accuracy depends on a timely, accurate topology. It helps to know how different configurations affect availability. Knowing which alignments are less redundant or concentrate flow through fewer breakers is a reason to increase monitoring before and during switching.

Switching exposure does not mean avoiding configuration changes. Maintenance, reliability improvements, and restoration all require switching, often while the system is already in a reduced condition. Understanding the risk envelope of each configuration is what defines a sound operating objective.

Configuration awareness is the bridge between equipment knowledge and system-level judgment. It comes from knowing each substation's components and which ones the switching arrangement leaves in service.

End-of-Chapter Summary

Switching changes system topology, protection boundaries, and the starting points for contingency and restoration. Depending on system conditions and redundancy, a configuration change can increase or reduce exposure to the next fault. Managing switching risk takes accurate awareness of topology, measurement quality, and current loading.

From the Field

A switching error can de-energize loads, ground energized equipment, or start a cascading event. Three-part communication is not a formality. It is the last check before the error reaches the equipment.

Chapter 11

Misoperations, Cascading Pathways, and Situational Awareness

11.1 How Cascades Begin

A substation equipment failure is not necessarily catastrophic. Protection, breaker schemes, and redundancy are built in so faulted equipment can be isolated while the rest of the system keeps running. Cascading happens when the failed equipment's behavior, the system configuration at the time, the system loading, and the performance of protection combine badly.

NERC defines Cascading as the uncontrolled successive loss of System Elements triggered by an incident at any location, resulting in widespread electric service interruption that cannot be restrained from sequentially spreading beyond an area predetermined by studies. Cascades typically begin with a small disturbance: a line fault, a breaker failure, a transformer trip, or a false relay operation. How large the final event becomes depends on how the system responds over the following seconds and minutes.

11.2 Misoperations as the Common Thread

Misoperations are a common thread in these scenarios. A relay that trips incorrectly, a breaker that fails to open, or a protection zone set wrong can remove more equipment than the fault required. On a lightly loaded system that may cause no problem. The same misoperation on a heavily stressed system can push flows outside stable bounds.

11.3 Situational Awareness Is the Defense

Situational awareness is the operator's primary defense against escalation. Recognizing patterns, such as the loss of every circuit on one bus or a bus voltage decline after loss of a reactive source, is key to quickly understanding how far a disturbance reaches. Knowing the system design and the protection boundaries lets the operator tell quickly whether the event is a single equipment failure or system-wide distress.

11.4 Sequential Overloads

Cascades often run through a series of overloads. When one heavily loaded line trips, the parallel paths pick up its flow and may trip in turn. Contingency analysis can indicate the likelihood, but practical knowledge of the components helps interpret the results. Knowing the specific effect of a transformer outage on voltage, or the chance that a breaker failure scheme will widen a line outage, leads to a more accurate assessment of an unusual line event.

11.5 Voltage Instability

Losing reactive reserves or running heavy transfers can push the system toward voltage instability, and a secondary voltage collapse can make a disturbance with a minor initial cause far worse. Watch for a steady voltage decline and weigh the remaining margin of the reactive sources still in service as they approach their limits.

11.6 Backup Protection and Relay Loadability

Protection coordination confines faults to specific sections of the system, and backup protection is set conservatively. If primary protection fails or clears slowly, backup protection may take a larger section. That can be seen in real time: successive trips that follow coordination timing rather than independent faults.

August 14, 2003 showed the other side of that design. The Task Force found that many key lines tripping between 16:05:57 and 16:10:38 EDT operated on zone 3 impedance relays, or zone 2 relays set to operate like zone 3s, responding to overloads rather than true faults. The Sammis-Star 345-kV line tripped at 16:05:57 with no fault on it, on a zone 3 relay that saw depressed voltage and high current as low apparent impedance. Today, PRC-023-6, Transmission Relay Loadability, states its purpose directly: protective relay settings shall not limit transmission loadability, shall not interfere with system operators' ability to take remedial action, and shall reliably detect all fault conditions.

11.7 Gaps in the Record

If changes in system state are not captured in real time by telemetry, the events that follow may not be recorded either, masking the cascade and obscuring the links between cause and effect. For short periods after a disturbance begins, while data is being restored, operators may have incomplete information and must work from what they know until the data returns. That is when disciplined communication with field personnel and neighboring control centers matters most, because it keeps response coordinated when field instrumentation is without power and nothing is coming over the wire.

11.8 The Window Before the Cascade

Visible signs of degradation often appear before a cascade: equipment conditions left unrepaired, heavy loading, and shrinking reactive reserves can each add to the potential for cascading trips. Knowing how the system's parts interact helps operators recognize when the system is approaching instability.

A cascade itself moves fast once it starts. On August 14, 2003, the Ohio phase developed over more than two hours, from the Eastlake 5 unit trip at 13:31 EDT through the alarm system failure after 14:14 and the first 345-kV line trips after 15:05. The Task Force found that the loss of Sammis-Star at 16:05:57 triggered many of the line trips that followed, and it describes a cascade as a dynamic phenomenon that cannot be stopped by human intervention once started. The operator's window is before the cascade, not during it.

Identifying the individual steps of a developing event helps the operator choose actions that limit the initial event's effects and coordinate with the Reliability Coordinator. Understanding the characteristics of individual substation components, such as breaker failure logic, bus protection behavior, and transformer overload effects, is one way to build that ability.

Substation components are the physical platform on which cascades play out, and their performance under fault and stress conditions shapes every disturbance.

End-of-Chapter Summary

Cascades usually result from a combination of equipment failure, protection operations, loading, and the substation's configuration at the time. Situational awareness grounded in an understanding of substation component behavior lets operators recognize a developing cascade early and manage abnormal substation conditions in a structured, reliability-centered way.

From the Field

"It's just equipment." It's equipment that determines the operating envelope, fault clearing, and system flexibility. "Maintenance can be deferred." Sometimes. Often the deferral compounds into failure. "The relays will sort it out." On August 14, 2003, they did exactly what they were set to do, and that was part of the problem.

Glossary

Glossary

The definitions below are quoted from the NERC Glossary of Terms as published on nerc.com on October 25, 2026, except entries marked (summarized), which paraphrase part of the Glossary text. Terms are those used in this volume. The Glossary is updated as standards change; refer to the current official version for the governing language.

Balancing Authority (BA). The responsible entity that integrates resource plans ahead of time, maintains Demand and resource balance within a Balancing Authority Area, and supports Interconnection frequency in real time.

Bulk Electric System (BES) (summarized). Unless modified by the lists shown below, all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher. This does not include facilities used in the local distribution of electric energy. (The Glossary definition continues with Inclusions I1 through I5 and Exclusions E1 through E4.)

Cascading. The uncontrolled successive loss of System Elements triggered by an incident at any location. Cascading results in widespread electric service interruption that cannot be restrained from sequentially spreading beyond an area predetermined by studies.

Composite Protection System. The total complement of Protection System(s) that function collectively to protect an Element. Backup protection provided by a different Element's Protection System(s) is excluded.

Contingency. The unexpected failure or outage of a system component, such as a generator, transmission line, circuit breaker, switch or other electrical element.

Element. Any electrical device with terminals that may be connected to other electrical devices such as a generator, transformer, circuit breaker, bus section, or transmission line. An Element may be comprised of one or more components.

Facility. A set of electrical equipment that operates as a single Bulk Electric System Element (e.g., a line, a generator, a shunt compensator, transformer, etc.)

Interconnection. A geographic area in which the operation of Bulk Power System components is synchronized such that the failure of one or more of such components may adversely affect the ability of the operators of other components within the system to maintain Reliable Operation of the Facilities within their control. When capitalized, any one of the four major electric system networks in North America: Eastern, Western, ERCOT and Quebec.

Interconnection Reliability Operating Limit (IROL). A System Operating Limit that, if violated, could lead to instability, uncontrolled separation, or Cascading outages that adversely impact the reliability of the Bulk Electric System.

Misoperation (summarized). The failure of a Composite Protection System to operate as intended for protection purposes. The Glossary lists six types: Failure to Trip and Slow Trip, each During Fault and Other Than Fault, and Unnecessary Trip, During Fault and Other Than Fault. A Composite Protection System operation that is caused by personnel during on-site maintenance, testing, inspection, construction, or commissioning activities is not a Misoperation.

Operating Instruction. A command by operating personnel responsible for the Real-time operation of the interconnected Bulk Electric System to change or preserve the state, status, output, or input of an Element of the Bulk Electric System or Facility of the Bulk Electric System. (A discussion of general information and of potential options or alternatives to resolve Bulk Electric System operating concerns is not a command and is not considered an Operating Instruction.)

Protection System. Protective relays which respond to electrical quantities; communications systems necessary for correct operation of protective functions; voltage and current sensing devices providing inputs to protective relays; station dc supply associated with protective functions (including station batteries, battery chargers, and non-battery-based dc supply); and control circuitry associated with protective functions through the trip coil(s) of the circuit breakers or other interrupting devices.

Real-time Assessment. An evaluation of system conditions using Real-time data to assess existing (pre-Contingency) and potential (post-Contingency) operating conditions. The assessment shall reflect applicable inputs including, but not limited to: load; generation output levels; known Protection System and Remedial Action Scheme status or degradation, functions, and limitations; Transmission outages; generator outages; Interchange; Facility Ratings; and identified phase angle and equipment limitations. (Real-time Assessment may be provided through internal systems or through third-party services.)

Reliability Coordinator (RC). The entity that is the highest level of authority who is responsible for the Reliable Operation of the Bulk Electric System, has the Wide Area view of the Bulk Electric System, and has the operating tools, processes and procedures, including the authority to prevent or mitigate emergency operating situations in both next-day analysis and real-time operations. The Reliability Coordinator has the purview that is broad enough to enable the calculation of Interconnection Reliability Operating Limits, which may be based on the operating parameters of transmission systems beyond any Transmission Operator's vision.

System Operating Limit (SOL). All Facility Ratings, System Voltage Limits, and stability limits, applicable to specified System configurations, used in Bulk Electric System operations for monitoring and assessing pre- and post-Contingency operating states.

Transmission Operator (TOP). The entity responsible for the reliability of its "local" transmission system, and that operates or directs the operations of the transmission Facilities.

How Energy Compliance Can Help

How Energy Compliance Can Help

Operations and engineering alignment

EC provides operational and engineering reliability alignment, training and executive briefings on reliability frameworks, and senior advisory on complex reliability questions, including how PRC-005, PRC-004, FAC-008, and TOP-010 land in your substations.

Audit defense and program reviews

A regulator-perspective program review tests whether your maintenance, Misoperation, and ratings records would survive real audit questions. EC also provides audit and enforcement support (non-advocacy), audit defense with Notice of Penalty response and settlement posture, NERC compliance program support, interpretation, and audit preparation, RSAW production, and data request strategy.

Program design and senior advisory

EC offers NERC reliability and compliance advisory support, reliability governance and program assessments, compliance program design and improvement, registration and applicability analysis, mitigation planning and Self-Report development, and industry engagement in standards development and working-group participation. Each engagement is scoped to the entity's role, function, and bulk system impact.

WattOps Compliance

PRC-005 intervals and Misoperation timelines are evidence problems before they are audit problems. WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). EC will run one standard at one facility through WattOps at no cost (CIP standards excluded).

RenewOps

For renewable and storage operators, this volume applies first at the collector substation and its SCADA. RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module.

Pick one substation your operators switch every week and ask them to walk its one-line from memory. If the answer worries you, call us.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education:

• MBA, Energy Management, University of Mary
• MSL, Compliance Law, Fordham Law University
• BAS, Energy Management, Bismarck State College
• BAS, Mechanical Engineering, Metallurgy minor, University of Florida
• BAS, Criminology, St. Petersburg College (State Law Enforcement Certification)
• AAS, Power Plant Technology, Bismarck State College
• AAS, Electrical Transmission System Technology, Bismarck State College

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm based in Bloomington, Minnesota, focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers. We work across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

We do this work differently than larger consulting firms. Engagements are overseen by a senior practitioner with regulator-side experience. We don't staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable in real time and audit-defensible at compliance review, structured for the auditor's question rather than the consultant's binder. Where automation can replace manual work, we build the automation. Where senior judgment is required, the senior is in the room.

Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

Learn more at energycomplianceinc.com.

Sources and Authorities

Sources and Authorities

• North American Electric Reliability Corporation, Glossary of Terms Used in NERC Reliability Standards (web version, retrieved October 25, 2026). https://www.nerc.com/glossary-of-terms
• North American Electric Reliability Corporation, Reliability Standard FAC-008-5, Facility Ratings (effective October 1, 2021), Requirements R3 and R6. https://www.nerc.com/globalassets/standards/reliability-standards/fac/fac-008-5.pdf
• North American Electric Reliability Corporation, Reliability Standard PRC-005-6, Protection System, Automatic Reclosing, and Sudden Pressure Relaying Maintenance (effective January 1, 2016), Tables 1-4(a), 1-5, and 5. https://www.nerc.com/globalassets/standards/reliability-standards/prc/prc-005-6.pdf
• North American Electric Reliability Corporation, Reliability Standard PRC-004-6, Protection System Misoperation Identification and Correction (effective April 1, 2021), Requirements R1, R5, and R6. https://www.nerc.com/globalassets/standards/reliability-standards/prc/prc-004-6.pdf
• North American Electric Reliability Corporation, Reliability Standard PRC-027-1, Coordination of Protection Systems for Performance During Faults (effective April 1, 2021), Requirements R1 and R2. https://www.nerc.com/globalassets/standards/reliability-standards/prc/prc-027-1.pdf
• North American Electric Reliability Corporation, Reliability Standard PRC-023-6, Transmission Relay Loadability (effective April 1, 2024), Purpose. https://www.nerc.com/globalassets/standards/reliability-standards/prc/prc-023-6.pdf
• North American Electric Reliability Corporation, Reliability Standard TOP-001-6, Transmission Operations (effective April 1, 2024), Requirements R9, R13, R20, and R21. https://www.nerc.com/globalassets/standards/reliability-standards/top/top-001-6.pdf
• North American Electric Reliability Corporation, Reliability Standard TOP-010-1(i), Real-time Reliability Monitoring and Analysis Capabilities (effective April 1, 2018), Requirements R1, R3, and R4. https://www.nerc.com/globalassets/standards/reliability-standards/top/top-010-1i.pdf
• North American Electric Reliability Corporation, Reliability Standard COM-002-4, Operating Personnel Communications Protocols (effective July 1, 2016), Requirements R1, R5, and R6. https://www.nerc.com/globalassets/standards/reliability-standards/com/com-002-4.pdf
• North American Electric Reliability Corporation, Reliability Standard IRO-017-1, Outage Coordination (effective April 1, 2017), Requirement R1. https://www.nerc.com/globalassets/standards/reliability-standards/iro/iro-017-1.pdf
• North American Electric Reliability Corporation, Reliability Standard CIP-002-5.1a, Cyber Security, BES Cyber System Categorization (effective December 27, 2016), Attachment 1, Criteria 2.4, 2.5, and 3.2. https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-002-5.1a.pdf
• North American Electric Reliability Corporation, ORCP and CMEP Annual Report (February 11, 2026), Chapter 5, Top 10 O&P Noncompliance Reported in 2025. https://www.nerc.com/globalassets/programs/enforcement/cmep-and-vegetation-reports/2025-orcp-and-cmep-annual-report.pdf
• U.S.-Canada Power System Outage Task Force, Final Report on the August 14, 2003 Blackout in the United States and Canada: Causes and Recommendations (April 2004). https://www.energy.gov/sites/prod/files/oeprod/DocumentsandMedia/BlackoutFinal-Web.pdf