Energy transition · Investigation

Seven seconds to black: how local responses become system consequences

Controls, protection and network coupling connect local disturbances to wider consequences. Three prescribed reconstructions and a documented wind-control interaction show why different mechanisms require different studies.

Sources: AEMO · NG ESO · Ofgem · NERCModel: uncalibrated screening≈ 15 min read

Key findings

1South Australia separated from the eastern grid 6.5 s after its wind farms cut 456 MW on their own protection settings, and collapsed within a second of separating.
2In Britain in 2019, 1,691 MW of losses followed one cleared lightning strike, against 1,000 MW of response held. In Texas in 2021, 1,112 MW of solar tripped on a routine fault.
3In our model, instruments matched to each time scale remove 72 % of the high-risk area of a 90 %-inverter Britain. What remains is visible only when plants are judged as a fleet, not one by one.

Scroll to begin the reconstruction ↓

Chapter 1 · The record

Seven seconds that blacked out South Australia

A forensic reconstruction of 28 September 2016, stage by stage, from the operator's final report

The storm took out three lines. Protection did its job

T+0.0 s28 Sep 2016 · stage 1 of 4

Scale of this stageL ≈ 150 km · τ ≈ 100 ms

1 m
converter

10 m
machine

100 m
power station

1 km
industrial site

10 km
city district

100 km
region

1000 km
synchronous area

On the afternoon of 28 Sep 2016, South Australia was drawing 1,826 MW of demand. By the operator's own accounting, about 77 % of it was met by wind and by imports over a single AC interconnector to Victoria.^[6]

Two tornadoes damage three 275 kV lines; faults cleared by protection as designed. Nothing in this first stage was abnormal. Each fault was cleared in about 100 ms, which is what transmission protection is designed to do.

77%

Share of South Australian demand met by wind and interconnector import before the first fault (derived from the report's pre-event balance).

The map on the right is a constructed screening view of the grid at that operating point. Its height, Ψ, combines mechanism indicators; crossing 1 is not proof that equipment trips. At this stage the model places the event at Ψ 0.39.

Sequence of events · South Australia black system, 28 Sep 2016

T+0.0 sSix 275 kV faults in 88 sreportTransmission towers collapse; line protection clears each fault—Ψ 0.39
T+0.4 sWind farms reduce 456 MWreport−456 MWΨ 0.33
T+6.9 sHeywood trips on loss of synchronismderived−420 MWΨ 2.07
T+7.3 sIsland frequency collapsesreport—Ψ 1.03

Source: AEMO 2017. Ψ is the model's vulnerability at each stage's time scale and extent. Losses are the report's; badges mark report, derived or estimated figures.

Operating point: (wind 883 MW + Heywood import 525 MW) / SA demand 1,826 MW, from the report's pre-event balance. Project EnergyConnect did not exist in 2016, so SA's only AC path to the NEM was Heywood.

Then the wind farms stepped back — by their own settings

T+0.4 s28 Sep 2016 · stage 2 of 4

Scale of this stageL ≈ 10 m · τ ≈ 300 ms↓ 4.2 decades from stage 1

1 m
converter

10 m
machine

100 m
power station

1 km
industrial site

10 km
city district

100 km
region

1000 km
synchronous area

The decisive failure was not in the steel. Nine wind farms reduce output by 456 MW over about 7 s after their fault ride-through counters reach preset limits. The wind was still blowing; the plants were operating exactly as their ride-through settings told them to.^[6]

456MW

Wind output withdrawn by converter protection settings, not by a lack of wind. Source: AEMO (2017).

Electrically, that shortfall had to come from somewhere. In a grid with few large spinning machines left in service, it came over the Heywood interconnector from Victoria. On the map this stage lands at Ψ 0.33, still below the trip boundary.

Note where it lands. The counter that withdrew the power sat inside each turbine's own controller and acted on that machine's terminal voltage alone, so the map places this stage at the scale of one machine, about 10 m, 4 orders of magnitude below the transmission faults that set it off. The next stage jumps back up to the interconnector, some 600 km across.

Sequence of events · South Australia black system, 28 Sep 2016

T+0.0 sSix 275 kV faults in 88 sreportTransmission towers collapse; line protection clears each fault—Ψ 0.39
T+0.4 sWind farms reduce 456 MWreportConverter ride-through controller counts repeated voltage dips and enters a protective reduction−456 MWΨ 0.33
T+6.9 sHeywood trips on loss of synchronismderived−420 MWΨ 2.07
T+7.3 sIsland frequency collapsesreport—Ψ 1.03

Source: AEMO 2017. Ψ is the model's vulnerability at each stage's time scale and extent. Losses are the report's; badges mark report, derived or estimated figures.

The only AC link to the rest of Australia let go

T+6.9 s28 Sep 2016 · stage 3 of 4

Scale of this stageL ≈ 600 km · τ ≈ 1.0 s↑ 4.8 decades from stage 2

1 m
converter

10 m
machine

100 m
power station

1 km
industrial site

10 km
city district

100 km
region

1000 km
synchronous area

Heywood flow reaches roughly 850–900 MW and the loss-of-synchronism protection separates SA. At T+6.9 s South Australia was electrically on its own.^[6]

Separation changes the arithmetic of survival. While connected, a disturbance in Adelaide is shared with every rotating machine in the eastern states. Once islanded, only the machines inside the island count.

Kinetic energy available to the South Australian island after separation, as a share of what it could draw on while connected (4.1 of 98.9 GW·s). Source: Stommel zonal network model.

The surface reflects it: the model now places this stage at Ψ 2.07, the highest point of the sequence.

Sequence of events · South Australia black system, 28 Sep 2016

T+0.0 sSix 275 kV faults in 88 sreportTransmission towers collapse; line protection clears each fault—Ψ 0.39
T+0.4 sWind farms reduce 456 MWreportConverter ride-through controller counts repeated voltage dips and enters a protective reduction−456 MWΨ 0.33
T+6.9 sHeywood trips on loss of synchronismderivedInterconnector import rises to ≈ 850–900 MW; SA swings out of step against Victoria−420 MWΨ 2.07
T+7.3 sIsland frequency collapsesreport—Ψ 1.03

Source: AEMO 2017. Ψ is the model's vulnerability at each stage's time scale and extent. Losses are the report's; badges mark report, derived or estimated figures.

Frequency fell faster than any protection could act

T+7.3 s28 Sep 2016 · stage 4 of 4

Scale of this stageL ≈ 400 km · τ ≈ 500 ms

1 m
converter

10 m
machine

100 m
power station

1 km
industrial site

10 km
city district

100 km
region

1000 km
synchronous area

With almost no stored energy to slow it, frequency in the island fell at roughly 6.25 Hz/s, according to the report. Under-frequency load shedding exists for exactly this moment, but it cannot act on a fall that steep. The state went black.^[6]

Our replay uses the report's losses and nothing else specific to the day. It reaches the collapse threshold 0.5 s after separation, with a peak rate of change of 5.03 Hz/s — lower than the reported figure. We show that gap rather than tune it away.

Island frequency fell through the collapse thresholdHz, seconds after the initiating fault

Source: Stommel model replay (one generic swing, droop and load-shedding model for every incident; island inertia from the zonal network) driven by losses from AEMO 2017. A reconstruction, not the recorded trace.

Did the model reproduce the record?

Observation	Report	Model	Verdict
Island RoCoF	≈ 6.25 Hz/sreport	5.03 Hz/s	80 % of report
Frequency collapse	Yes — black systemreport	Yes — 0.54 s after separation	Match
Converter ride-through action	Yes — 456 MW wind reductionreport	Flagged — 3 zone(s), SLG fault	Match

The six faults are collapsed into one sequence; per-farm counter settings and the exact Heywood swing are not modelled. UFLS is set to zero because the report finds it could not act at that RoCoF.

Chapter 2 · The mechanism

The grid did not run out of energy. It ran out of time

Why replacing spinning machines with power electronics removes the system's shock absorber

Fig. 2.1

For a century, spinning steel bought the grid its reaction time

South Australia is not an anomaly. In a conventional grid every turbine-generator spins in lockstep with system frequency. When a power station trips, the shortfall is met in the first instant by kinetic energy drawn from those rotating masses — no controller, no telemetry, no delay. The stock of that energy, normalised by system size, is the inertia constant H, measured in seconds.^[2]

RoCoF = f₀ · ΔP / (2 · H · S)

Swing equation, aggregated. f₀ nominal frequency, ΔP lost infeed, S system size.

The surface on the right is Great Britain with no inverter-based generation. Its constructed screening values sit below Ψ = 1; this does not demonstrate that protection would remain inactive for every possible disturbance.

Effective inertia H

7.87 s

floor 2.4 s

System RoCoF

0.12 Hz/s

limit 0.5 Hz/s · ΔP 1.80 GW

Ψ max

0.71

Fig. 2.2

Inverters deliver energy, not inertia

Instantaneous inverter share82 %

0 %100 %

Wind, solar and batteries connect through power electronics. Unless they are explicitly controlled to do so, they hold no rotating energy for the grid. Most are also grid-following: they measure the network voltage and inject current in step with it, which assumes the voltage is stiff.^[3]

Each machine displaced therefore removes two things at once: inertia, which slows frequency change, and system strength, which holds voltage steady. Move the slider and watch the plateau buckle.

Effective inertia H

2.40 s

floor 2.4 s

System RoCoF

0.39 Hz/s

limit 0.5 Hz/s · ΔP 1.80 GW

Multi-infeed gSCR

0.43

critical 1.28 · weakest single node 0.64

Fig. 2.3

To see the risk, map it by place and by time

In 1963 Henry Stommel plotted ocean variability on two logarithmic axes, space and time, so that tides, eddies and climate signals could be read on one chart.^[1] We apply the same device to the grid.

Temporal response τ, 10⁻⁵ to 10⁷ s: from switching transients to seasonal adequacy.
Spatial extent L, 10⁰ to 10⁶ m: from a converter terminal to a continental synchronous area. Mechanism extents are assigned anchors; electrical distances are a separate network diagnostic.^[9]
Height Ψ: a constructed smooth aggregation of mechanism-screening indicators, not a solved energy ratio.

G(τ) = |C(i2π/τ I − A)⁻¹B|

Analytical companion in the console: specified power ports B and relative-frequency output C. G is in Hz/GW, not a failure probability.

Stability classes follow the IEEE/CIGRE taxonomy, including the converter-driven classes added in 2021.^[4] Here Great Britain sits at 60 % inverter share: one ridge has already broken through.

Ψ max

2.25

Map area Ψ > 1

4.1 %

Multi-infeed gSCR

0.94

critical 1.28 · weakest single node 1.19

Method. Each band is an anisotropic Gaussian whose amplitude comes from a physical sub-model (swing equation, GFL small-signal stability, nadir arrest, network eigenmodes, adequacy), combined by a smooth maximum. It is a screening map, not an electromagnetic-transient study.

Chapter 3 · The pattern

The same failure, on different clocks

Great Britain 2019 and West Texas 2021 failed at seconds and milliseconds — and the risk grows with every machine retired

Britain, 9 August 2019: a cleared lightning strike became a 1 GW-plus loss

T+0.2 s9 Aug 2019 · stage 3 of 6

Scale of this stageL ≈ 500 km · τ ≈ 500 ms↑ 0.6 decades from stage 2

1 m
converter

10 m
machine

100 m
power station

1 km
industrial site

10 km
city district

100 km
region

1000 km
synchronous area

Three years later the failure arrived in Britain, at a slower clock. Strike on the Eaton Socon–Wymondley circuit, cleared in under 0.1 s; voltage disturbance seen across the region. Hornsea 1 reduces from 799 MW to 62 MW (737 MW lost) within about 0.3 s.^[5]

Then the distribution network joined in. ≈ 150 MW lost on vector shift and ≈ 350 MW on RoCoF protection (ESO estimate of ≈ 500 MW). These relays exist to detect accidental islanding of small generators. On 9 August they read a national frequency event as a local one, and switched healthy plant off.

1,237MW

Generation lost in the first stages after a lightning strike that protection cleared normally. Source: NG ESO (2019).

The replay's rate of change of frequency peaks at 0.227 Hz/s, above the 0.125 Hz/s setting many of those relays used at the time — consistent with the trips the report describes.

System frequency, model reconstructionHz, seconds after the initiating fault

Source: Stommel model replay (one generic swing, droop and load-shedding model for every incident; island inertia from the zonal network) driven by losses from NG ESO 2019; Ofgem 2020. A reconstruction, not the recorded trace.

Sequence of events · GB low-frequency demand disconnection, 9 Aug 2019

T+0.0 sLightning on a 400 kV linereportSingle-phase flashover, cleared by line protection—Ψ 0.34
T+0.1 sHornsea 1 de-loads 737 MWreportOffshore wind converter controls oscillate against a weak export network and protection de-loads the plant−737 MWΨ 0.33
T+0.2 sEmbedded generation drops ≈ 500 MWreportDistribution-connected generators disconnect on anti-islanding vector-shift and RoCoF relays−500 MWΨ 0.57
T+1.0 sLittle Barford steam turbine trips 244 MWreport−244 MWΨ 0.37
T+58 sLittle Barford gas turbine trips 210 MWreport−210 MWΨ 0.32
T+76 sLFDD at 48.8 Hzreport—Ψ 0.34

Source: NG ESO 2019; Ofgem 2020. Ψ is the model's vulnerability at each stage's time scale and extent. Losses are the report's; badges mark report, derived or estimated figures.

The losses outran the reserve, and a million customers were cut off

T+76 s9 Aug 2019 · stage 6 of 6

Scale of this stageL ≈ 800 km · τ ≈ 20 s↑ 2.9 decades from stage 5

1 m
converter

10 m
machine

100 m
power station

1 km
industrial site

10 km
city district

100 km
region

1000 km
synchronous area

The system operator was holding 1,000 MW of frequency response, sized for the largest single loss it expected. The losses that afternoon summed to 1,691 MW. Frequency reaches 48.8 Hz; LFDD disconnects ≈ 931 MW (≈ 1.1 million customers).^[5,16]

System frequency, model reconstructionHz, seconds after the initiating fault

The model's low point is 48.82 Hz, 0.02 Hz from the reported 48.8 Hz. That is close, but on the wrong side of the trigger: in the replay, demand disconnection never fires. The table records it as a miss.

Did the model reproduce the record?

Observation	Report	Model	Verdict
Frequency nadir	48.8 Hzreport	48.82 Hz	Match
LFDD triggered	Yes — 931 MWreport	No — nadir 0.02 Hz above the 48.8 Hz stage	Miss
RoCoF above 0.125 Hz/s relay setting	Yes — embedded tripsreport	0.227 Hz/s	Match

Embedded-generation losses are taken from the ESO estimate rather than predicted; the 2019 RoCoF relay setting (0.125 Hz/s) is compared with the model RoCoF. GT1b and later recovery actions are omitted.

West Texas, 9 May 2021: solar plants tripped on a fault they should have ridden through

T+0.1 s9 May 2021 · stage 2 of 4

Scale of this stageL ≈ 300 km · τ ≈ 20 ms↑ 2.2 decades from stage 1

1 m
converter

10 m
machine

100 m
power station

1 km
industrial site

10 km
city district

100 km
region

1000 km
synchronous area

In West Texas the clock was faster still. Fault on a generator step-up transformer, cleared normally. 1,112 MW of solar PV reduces output; causes include inverter phase-jump, AC overvoltage and PLL loss of synchronism.^[7]

1,112MW

Solar output lost after a single transformer fault, with no transmission damage. Source: NERC & Texas RE (2021).

The Texas interconnection was large enough to absorb it: the replay's frequency bottoms out at 59.75 Hz and no load is shed. But the assigned mechanism stage sits at the far left of the map. The report identifies several control and protection responses, not one measured PLL scale or a sustained SSCI diagnosis. The model's sequence-network screen flags grid-following plant in 4 zone(s) for this fault type.

Did the model reproduce the record?

Observation	Report	Model	Verdict
Grid-following inverters flagged / tripped	Yes — 1,112 MWreport	Flagged — 4 zone(s), DLG fault	Match
UFLS triggered	Noreport	No — nadir 0.45 Hz above the 59.3 Hz stage	Match

Reserve held is an estimate of ERCOT's responsive reserve; inverter-specific trip settings are not modelled — the check is whether the shared GFL sequence screen flags the Far-West zone for this fault type.

Fig. 3.4

At record inverter shares, the millisecond band is already over the line

A grid-following inverter tracks grid phase with a phase-locked loop (PLL). On a weak network — a low short-circuit ratio, SCR = S_sc/P_rated — the inverter's own current moves the voltage it is trying to follow. The control loops can then interact and lose stability within tens of milliseconds.^[10,3]

The 7-state inverter model behind this map loses small-signal stability below SCR ≈ 1.28. Neighbouring plants share the same network impedance, so their controls interact: the relevant strength is the multi-infeed generalised SCR, the smallest eigenvalue of the IBR-weighted reduced network admittance.^[17,18] At ERCOT's historic 74 % peak it is 0.61, against 0.74 for the weakest node taken alone.

Multi-infeed gSCR

0.61

critical 1.28 · weakest single node 0.74

Ψ max

4.84

Map area Ψ > 1

10.4 %

Fig. 3.5

Remove enough inertia, and a routine loss trips the relays meant to protect it

Between 0.1 and 2 seconds the governing physics is inertial. With less H, the same loss produces a steeper rate of change of frequency (RoCoF). Loss-of-mains relays on embedded generation, set on RoCoF or vector shift, then disconnect healthy plant and enlarge the original loss.

Inertia is also not evenly spread. A local island of a few kilometres sees only the machines inside it, so the crevasse deepens towards small L. Here a 2.7 GW double-circuit loss hits Great Britain at 82 % inverter share.

Effective inertia H

2.40 s

floor 2.4 s

System RoCoF

0.59 Hz/s

limit 0.5 Hz/s · ΔP 2.70 GW

Ψ max

6.56

Fig. 3.6

At continental scale, regions swing against each other

At continental scale, areas of the grid swing against each other through the transmission corridors that join them. We build a reduced zonal network for each grid, set each corridor's stiffness from its published or estimated capability, and solve the eigenvalue problem of the network Laplacian weighted by zonal inertia.^[9,2]

M · δ̈ + K_L · δ = 0 ⇒ ω² = eig(M⁻¹K_L)

M: zonal inertia; K_L: corridor-weighted Laplacian. The Fiedler vector shows where the grid would split.

Markers on the surface show each mode at its frequency and spatial extent. ERCOT's measured inter-area mode is about 0.7 Hz; the uncalibrated model places it at 0.73 Hz (see Act V). At 50 % inverter share the least-damped mode is a faster one, at 1.42 Hz with ζ 4.1 %, below the 5 % planning criterion.

Least-damped mode

1.42 Hz

ζ 4.1 %

Ψ max

1.40

Effective inertia H

3.76 s

floor 2.1 s

Fig. 3.7

Stress test: the 2019 loss, replayed on a 2030s grid

Run the Britain of 2019 forward to an 82 % inverter share and repeat a loss of the same order. A 1.8 GW infeed loss enters the map at the sub-cycle electromagnetic scale, and the wave travels up through control, inertial, nadir, governor and adequacy regimes. Wherever a band is already above Ψ = 1, the cascade picks up extra losses.

Cascade timeline · model run

10^-5–10^-3 sSub-cycle electromagnetic shockTransient absorbed by networkΨ 0.61
10^-3–10^-1 sGFL inverter phase-lock lossWeak grid (SCR 0.43): PLLs lose lock, IBR ride-through failsΨ 5.81
10^-1–10^0.3 sRoCoF / anti-islanding relays0.87 Hz/s exceeds 0.5 Hz/s: distributed generation disconnectsΨ 1.74
10^0.3–10¹ sFrequency nadir / UFLSNadir breaches UFLS at 48.8 Hz: 3.73 GW load shedΨ 1.39
10⁰–10¹ sInter-area oscillation1.10 Hz mode adequately damped (ζ 4.2%)Ψ 0.88
10¹–10^1.6 sPost-contingency voltage stepWorst N-1 voltage step 2.1% within 5%Ψ 0.41
10¹–10³ sGovernor & AGC restorationFrequency restored to nominalΨ 0.57
10⁴–10⁷ sContinental drift / adequacyDunkelflaute energy deficit uncoveredΨ 1.24

Loss 5.06 GWRoCoF 0.87 Hz/sNadir 48.65 HzShed 3.73 GW

This is a forward-looking stress test of an 82 % operating point, not a reconstruction of 9 August 2019, which happened at a much lower inverter share (see Chapter 3).

Chapter 4 · The remedy

Every risk has a clock, and every instrument must match it

What regulators can test in a sandbox before they rewrite the grid code

Fig. 4.1

Milliseconds: mandate grid-forming capability

Grid-forming BESS (H = 5 s)4.00 GW

0 GW8 GW

Grid-forming (GFM) inverters behave as a voltage source behind an impedance. They create a voltage reference rather than following one, and can supply synthetic inertia and system strength from the same battery.^[3]

Three instrument families exist: a mandate in connection codes,^[11,12] a procurement for stability services,^[13,14] and a connection-queue derogation that lets GFM assets connect first. Without the derogation the model assumes only 60 % of capacity is built in time.

Metric	No intervention	With instrument	Δ
Ψ max	10.33	3.68	-64 %
Area Ψ > 1	14.6 %	8.2 %	-44 %
System RoCoF	0.50 Hz/s	0.42 Hz/s	-17 %
Weakest SCR	0.26	0.70	+172 %
Adequacy band Ψ	1.42	1.42	—
Load shed	5.80 GW	2.43 GW	-58 %

Fig. 4.2

Seconds: buy fast response, and price it where inertia is scarce

Sub-second FFR auction volume2.00 GW

0 GW4 GW

Fast frequency response (FFR) injects power within a fraction of a second, shortening the time to arrest a frequency fall. Auctions already exist, such as GB Dynamic Containment and the EirGrid DS3 FFR service.^[15]

Locational synthetic-inertia pricing goes one step further: it pays more where the local inertia floor is lowest, which lifts the small-L end of the crevasse. Indicative revenue for synthetic inertia services is $40k–90k per MW·yr.

Metric	No intervention	With instrument	Δ
Ψ max	10.33	6.81	-34 %
Area Ψ > 1	14.6 %	12.2 %	-16 %
System RoCoF	0.50 Hz/s	0.48 Hz/s	-5 %
Weakest SCR	0.26	0.41	+59 %
Adequacy band Ψ	1.42	1.42	—
Load shed	5.80 GW	4.02 GW	-31 %

Fig. 4.3

Days: storage hours fix adequacy — and nothing faster

Long-duration storage48 h

0 h120 h

Above 10³ seconds the problem is energy, not dynamics: a multi-day low-wind period in winter. Long-duration energy storage (LDES) and a capacity mechanism that derates each technology for its firm contribution address this ridge.

Metric	No intervention	With instrument	Δ
Ψ max	10.33	10.33	—
Area Ψ > 1	14.6 %	13.6 %	-7 %
System RoCoF	0.50 Hz/s	0.50 Hz/s	—
Weakest SCR	0.26	0.26	—
Adequacy band Ψ	1.42	0.43	-70 %
Load shed	5.80 GW	5.80 GW	—

Note what does not change. The adequacy ridge flattens, but the peak of the map — the fast, weak-grid ridge — is untouched. An instrument works only in the regime it was designed for.

Fig. 4.4

A matched portfolio works — but plant-by-plant checks miss what is left

The decision matrix pairs each time-scale regime with the instruments that act within it. Deployed together — grid-forming storage and synchronous condensers, FFR with locational pricing, and LDES under a capacity mechanism — the portfolio removes 72% of the area above Ψ = 1.

What remains is the weak-grid ridge. Steered GFM lifts the weakest single node to SCR 1.80, but the interacting fleet's generalised SCR is still 0.84, below the 1.28 limit. Judged plant by plant, this 90 % inverter grid looks secure; judged as a system, it is not. System-strength obligations need to be set on the multi-infeed metric.^[17,14]

Regime	Instruments	Sandbox question
Fast dynamics τ < 0.1 s	Mandate grid-forming (GFM) inverters at weak nodes Synchronous condensers / stability pathfinders Priority connection-queue derogations for GFM assets	Can a grid-forming mandate be tested on a live weak node without a full Grid Code change?
Mid dynamics 0.1 s ≤ τ ≤ 2.0 s	Sub-second Fast Frequency Response (FFR) auctions Locational synthetic-inertia pricing (SIAS)	Does locational pricing for synthetic inertia procure faster, cheaper response than a uniform auction?
Governor / AGC regime 2 s < τ ≤ 10³ s	Outside the decision matrix: FCR / aFRR primary & secondary reserve markets	Out of scope here: covered by existing FCR / aFRR balancing markets.
Slow dynamics τ > 10³ s	Long-Duration Energy Storage (LDES) procurement Capacity mechanism design with firm-capacity derating	Which duration and derating rules give firm capacity across a multi-day wind drought?

Metric	No intervention	With instrument	Δ
Ψ max	10.33	2.17	-79 %
Area Ψ > 1	14.6 %	4.1 %	-72 %
System RoCoF	0.50 Hz/s	0.40 Hz/s	-21 %
Weakest SCR	0.26	0.84	+226 %
Adequacy band Ψ	1.42	0.43	-70 %
Load shed	5.80 GW	0.00 GW	-100 %

Chapter 5 · Methodology

What this model can and cannot show

Validation against published measurements, misses included

Fig. 5.1

How we did this

This investigation rests on a screening model, and its claims are only as good as its checks against the record.

Incident replays against the official reports

South Australia black system28 Sep 2016	2 of 2 checks match	—
GB low-frequency demand disconnection9 Aug 2019	2 of 3 checks match	LFDD triggered
Odessa solar tripping9 May 2021	2 of 2 checks match	—

Ratio comparisons (e.g. island RoCoF) are reported in each chapter without a verdict. No incident-specific factor is used to make a check pass.

The network analysis uses one shared convention for every grid with no per-grid tuning factors. Its predictions are compared against published measurements:

Grid · observation	Measured	Model	Error
ERCOT · ERCOT dominant inter-area mode	0.69–0.70 Hz	0.73 Hz	+4 %
S. Australia · NEM 3.5 rad/s mode — QLD+VIC vs NSW+SA	0.50–0.56 Hz	0.42 Hz	-17 %
Nordic · Nordic 0.35 Hz inter-area mode	0.30–0.35 Hz	0.60 Hz	+71 %
ENTSO-E · East–West mode (Iberia vs Türkiye)	0.15 Hz	0.13 Hz	-11 %
ENTSO-E · North–South mode (Italy vs north)	0.29 Hz	0.45 Hz	+55 %
GB · Anglo-Scottish inter-area mode	0.50 Hz	0.72 Hz	+44 %
IEEE 39-Bus · G1 (NY equivalent) vs New England inter-area mode	0.60–0.65 Hz	0.70 Hz	+7 %

Error is against the nearest end of the measured range. One network convention for every grid, no per-grid tuning.

Physics extensions

Multi-infeed strength: interaction factors and a generalised SCR from the reduced network impedance; it drives the weak-grid band.^[18,17]
Grid-forming converters as an explicit virtual-synchronous-machine model, not a scalar inertia: stable in weak grids where the PLL fails, with its own limit in very strong grids.^[19]
Voltage: Q–V modal analysis and an N-1 screen of post-contingency voltage steps feed a new seconds-scale band.^[20]
Uncertainty: seeded assumed perturbations produce a model-conditional fraction above Ψ = 1 and a simulated load-shed distribution, not a calibrated probability of grid failure.

Known limits

Several corridor capabilities and zone splits are estimates; each is tagged with its source in the console.
Lumping each zone into one point is the likely cause of the large errors for GB, Nordic and North–South Europe.
Damping ratios are indicative; they depend on controller settings that are not public.
The generic inverter models cannot reproduce manufacturer-specific control behaviour.
The multi-infeed metric assumes identical converter controls; voltage screening has no tap changers, Q limits or motor stall (FIDVR).
Monte Carlo distributions are stated assumptions, not fitted to operator event statistics.
Band amplitudes for scenarios are indicative model inputs, not operator data.

Continue

For researchers: the full console

The academic dashboard behind this investigation: all seven grids, corridor outages and reinforcement, the incident replays with COMTRADE export, non-ideal physics, the regulatory sandbox and PMU ingestion.

Enter the console

Mechanism → evidence → next study

Four disturbances. Different questions.

A protection sequence, plant resonance, multiple inverter responses and series-compensated wind interaction do not establish one common cause.

Prescribed reconstruction

South Australia 2016

Repeated-fault ride-through and protection

1Storm faults
2Repeated voltage disturbances
3Wind control/protection response
4Interconnector separation

Local protection logic → interconnector and island. Mechanism extent is assigned, not a measured electrical radius.

The study question: Will the installed ride-through settings tolerate the relevant repeated-fault sequence?
Appropriate next studies: Repeated-fault protection/settings audit
Plant control and network dynamic studies
Minimum evidence: Installed controller counters, reset logic, protection settings and the actual fault sequence.
What this cannot establish: An inertia total or generic converter cannot predict the installed fleet’s trip sequence.

AEMO final investigation; existing frequency reconstruction remains model-conditional. Executive summary; wind-farm response and generation reduction sections. Qualitative mechanism corroborated; embedded numerical inputs await page-level audit.

AEMO Black System Final Report (2017)

Mature V3 · Conditional operating-region edition

An open solver is a check, not a certificate

Numerical verification. 4 frozen reduced configurations, independently reconstructed in SciPy. Maximum natural-frequency discrepancy: 8.72e-15; minimum mode-shape MAC: 1.00000000. This checks the implementation, not physical accuracy.

ANDES 2.0.0 RMS run. Full IEEE39 deck: 10 machines, 160 retained linear states, bus-14 balanced fault cleared after 100 ms. Time-step comparison: 0.000131 Hz maximum rotor-frequency difference. Its controllers and dispatch differ from the reduced model.

0/20 matched stress gates completed. No RMS/EMT parity, field-trip prediction or 70% acceptance probability is established. Incident transcriptions, prior-art review, funding, permissions and final author approval remain outstanding.

Unresolved reference findings: ANDES reports 6 positive-real eigenvalues, parameter corrections and ill-conditioning warnings. Eight seconds of successful integration is not stable long-term recovery. Lossless verification passed; nominal-resistance IEEE39 response is withheld for indefinite symmetrized stiffness.

Analytical companion: explicit +P/−P machine-pair ports and relative-frequency output, G in Hz/GW. The Gaussian Ψ stays a constructed screen; Ψ = 1 is not a proven relay boundary. Electrical pair lengths use one equivalent-400 kV-circuit convention.

V3 · Rolf Bastiaanssen, Bax & Company. The operating-region explorer separates physical inertia, equivalent virtual support and GFL strength; conditional screens are not certified dispatch. SSCI 2009 is source-led, not a new simulated replay. No submission or public DOI deposit has been made.

Integrated manuscript Supplementary information Presubmission enquiry Source and evidence

References

[1]Stommel, H. (1963). Varieties of oceanographic experience. Science, 139(3555), 572–576.
[2]Kundur, P. (1994). Power System Stability and Control. McGraw-Hill.
[3]Milano, F., Dörfler, F., Hug, G., Hill, D. J., & Verbič, G. (2018). Foundations and challenges of low-inertia systems. Proc. 20th Power Systems Computation Conference (PSCC).
[4]Hatziargyriou, N. et al. (2021). Definition and classification of power system stability — revisited & extended. IEEE Trans. Power Systems, 36(4), 3271–3281.
[5]National Grid ESO (2019). Technical report on the events of 9 August 2019.
[6]AEMO (2017). Black System South Australia 28 September 2016 — Final report.
[7]NERC & Texas RE (2021). Odessa Disturbance — Texas events: May 9, 2021 and June 26, 2021.
[8]ENTSO-E (2021). Continental Europe synchronous area separation on 8 January 2021 — Final report.
[9]Dörfler, F., & Bullo, F. (2013). Kron reduction of graphs with applications to electrical networks. IEEE Trans. Circuits and Systems I, 60(1), 150–163.
[10]Wang, X., & Blaabjerg, F. (2019). Harmonic stability in power electronic-based power systems: concept, modeling, and analysis. IEEE Trans. Smart Grid, 10(3), 2858–2870.
[11]Commission Regulation (EU) 2016/631 establishing a network code on requirements for grid connection of generators (RfG).
[12]National Grid ESO (2022). GC0137: Minimum specification required for provision of GB grid forming capability.
[13]National Grid ESO (2020–2022). Stability Pathfinder, Phases 1–3.
[14]AEMC (2021). Efficient management of system strength on the power system — Rule determination.
[15]EirGrid & SONI. DS3 Programme: System Services and the ±1 Hz/s RoCoF standard.
[16]Ofgem. Energy Regulation Sandbox (Innovation Link).
[17]Dong, W., Xin, H., Wu, D., & Huang, L. (2019). Small signal stability analysis of multi-infeed power electronic systems based on grid strength assessment. IEEE Trans. Power Systems, 34(2), 1393–1403.
[18]CIGRE WG B4.41 (2008). Systems with multiple DC infeed. Technical Brochure 364.
[19]Rosso, R., Wang, X., Liserre, M., Lu, X., & Engelken, S. (2021). Grid-forming converters: control approaches, grid-synchronization, and future trends — a review. IEEE Open J. Industry Applications, 2, 93–109.
[20]Gao, B., Morison, G. K., & Kundur, P. (1992). Voltage stability evaluation using modal analysis. IEEE Trans. Power Systems, 7(4), 1529–1542.

Incident figures are taken from the cited operator reports and tagged report, derived or estimated; they were transcribed for this model and should be checked against the reports before citation. Model results are uncalibrated screening values. Every model number in the text is computed live by the same physics that draws the surface.