Remedial Action Schemes (RAS)

RAS operate on a discrete arming/triggering architecture rather than continuous feedback control. The scheme is armed when pre-identified system conditions (e.g., high import levels on a critical corridor) are met. Once armed, it monitors for a specific triggering event—such as the loss of a transmission line—and executes the predetermined action within milliseconds. This binary logic ensures deterministic, fail-safe operation without the latency of closed-loop optimization.

RAS execute a range of discrete, high-impact control actions:

• Generation Rejection: Tripping remote hydro or thermal units to reduce power flow on overloaded corridors.
• Load Shedding: Disconnecting predetermined blocks of customer load to arrest frequency decline.
• Controlled Islanding: Opening tie-lines to separate a stressed area from the rest of the interconnection.
• Dynamic Braking: Inserting shunt resistors to dissipate accelerating energy during a transient swing.
• Reactive Power Insertion: Switching capacitor banks or modulating Static VAR Compensators to support voltage.

The entire RAS lifecycle—from fault detection to action execution—must complete within 50-100 milliseconds to be effective for transient stability. This includes:

• Relay detection time: 5-10 ms for fault recognition.
• Communication latency: 10-30 ms for fiber-optic teleprotection channels.
• Logic processing: 5-10 ms for arming condition verification.
• Breaker operation: 30-50 ms for physical interruption. Exceeding these windows renders the scheme ineffective, as the system will have already diverged into instability.

Unlike adaptive protection systems, traditional RAS are designed for a specific, pre-studied contingency. Each scheme addresses a single N-1 or N-2 event identified during offline planning studies. This narrow scope ensures high reliability but creates a combinatorial explosion of schemes in complex grids. A single balancing authority may operate dozens to hundreds of discrete RAS, each with unique arming conditions and action tables, making configuration management a critical operational challenge.

RAS rely on dedicated, high-reliability communication networks to transmit arming status, trigger signals, and breaker confirmation between remote substations. These typically use:

• IEEE C37.94 optical fiber interfaces for teleprotection.
• DNP3 or IEC 61850 GOOSE messaging for inter-substation signaling.
• Dual-redundant paths with automatic failover to ensure single communication failures do not disable the scheme. The communication architecture is often the single point of failure in RAS design and requires rigorous latency testing.

NERC reliability standards mandate rigorous testing protocols for RAS:

• Commissioning tests: End-to-end injection testing verifying the entire chain from sensor to breaker trip.
• Periodic functional tests: Typically every 5-7 years, involving staged outages to validate arming logic.
• Offline simulation replay: Using recorded disturbance data to validate scheme response in a virtual environment.
• Misoperation analysis: Post-event forensic review of any unintended operation, with mandatory reporting to reliability coordinators. A single RAS misoperation can cascade into wide-area instability, making validation a high-stakes engineering discipline.

A specific RAS action that rapidly trips one or more generating units following a transmission line outage to prevent transient instability. The sudden loss of a major corridor causes power to flow into remaining paths, potentially exceeding their stability limits. By instantly reducing generation in the sending area, the scheme balances the mechanical input power against the reduced electrical output capability. Typical implementations:

• Direct transfer trip via fiber-optic communication for sub-cycle operation
• Selective rejection based on unit size and proximity to the disturbance
• Coordination with turbine bypass systems to avoid boiler pressure excursions in thermal plants

The counterbalance to generator rejection, load shedding disconnects customer demand to arrest frequency decline or voltage collapse. In RAS applications, it is often underfrequency-based or undervoltage-based, with multiple stages of progressively deeper cuts. Critical design elements include:

• Percentage step sizes (e.g., 5%, 10%, 15%) to match the severity of the disturbance
• Relay time delays coordinated to avoid unnecessary shedding during transient dips
• Spinning reserve activation to restore frequency after the initial arrest
• Cold load pickup modeling to anticipate the inrush current when load is later restored

The last line of defense when a RAS cannot maintain system-wide synchronism. Controlled islanding intentionally separates the grid into stable, self-sustaining electrical islands to prevent a cascading blackout. Unlike uncontrolled separation, it uses out-of-step relaying and synchrophasor data to identify optimal split points where generation and load are closely matched. Implementation challenges:

• Real-time graph partitioning to find minimal cut sets with balanced power
• Synchronization of breakers across multiple substations within milliseconds
• Underfrequency load shedding within each island as a secondary defense layer

While standard planning uses N-1 criteria (single element failure), RAS are often designed for N-2 contingencies or beyond—simultaneous or sequential outages that exceed normal reliability standards. This analysis evaluates:

• Stuck breaker conditions where a primary fault is not cleared, causing backup protection to remove additional elements
• Common-mode failures such as a tower collapse affecting multiple circuits on the same right-of-way
• Hidden failure cascades where an initial disturbance causes a protection misoperation elsewhere The computational complexity grows exponentially, requiring importance sampling and Monte Carlo variance reduction techniques.

A fundamental RAS operational concept: the scheme must be armed when the system is vulnerable to the contingency it protects against, and disarmed when the triggering conditions are not present. Automatic arming logic uses real-time topology processing and state estimation to determine vulnerability. Critical requirements:

• Fail-safe design: a loss of communication or power supply must default to the armed state to avoid leaving the system unprotected
• Audible alarms and SCADA indications for operator awareness of arming status changes
• Periodic testing of the arming logic path without initiating actual corrective actions