Toward Metrics for Monitoring Time Reliability NIST Access to Assured and Accurate Time Workshop

Transcription

1 Toward Metrics for Monitoring Time Reliability NIST Access to Assured and Accurate Time Workshop Brock Beauchamp June 22, 2018 This work was performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under contract DE-AC52-07NA Lawrence Livermore National Security, LLC

2 Timing Requirements for the Electric Grid Application Advanced Time-of-Use Meters SCADA Disturbance Monitoring (NERC PRC-018-1) Protective Relays Digital Fault Recorder Phasor Measurement Unit (PMU) Wide Area Protection, Oscillation Damping Anti-Islanding Frequency Event Detection Traveling Wave Fault Location Minimum Reporting Interval, Accuracy (vs. UTC) 15, 30, 60 minutes s (reporting), 100 ms (accuracy) 2 ms 1 ms 50 µs 1 ms <1 µs target (26 µs overall limit = 1% TVE) <1 µs 100 ns References: NIST, Timing Challenges in the Smart Grid, NIST Special Publication , Jan. 2017; NASPI, Time Synchronization in the Electric Power System, NASPI-2017-TR-001, Mar

3 Reaction Time Requirements HV and EHV primary protection must detect faults within 1-2 cycles ( Hz) Research efforts may enable protection over longer time-windows Distributed Generation (Inverter-Based Resource Guidelines) Reaction time target of <500 ms for frequency step change Reaction time target of <16 ms for large voltage step change (<500 ms for small disturbance) Reaction time limits imply monitoring cannot always rely upon wide-area time data; Still opportunity for control actions over longer timeframes References: NERC, Preliminary Special Reliability Assessment Whitepaper: Extended loss of GPS Impact on Reliability, Aug. 2012; NERC, [Draft] BPS-Connected Inverter-Based Resource Performance Guideline, May

4 Availability vs. Assuredness Invalid time can be much worse than unavailable time GPS receiver locked to a satellite in test mode led to loss of two 500 kv lines [1] Power sources can be manually synchronized (compare to faulty AGC) Input availability and assuredness are ultimately inseparable A time source could be unavailable as an introit to its corruption Loss of the most-accurate timing input could be intolerable degradation Some applications may need monitoring even without provision of holdover Assured detection rather than assured output Probabilities of detection and false alarm are important metrics References: [1] A. Martin, Time Synchronization and the Power System, IEEE/NIST Timing Challenges in the Smart Grid Workshop, Oct

5 Timing Anomaly Taxonomy Anomalies Exhibited by Atomic Clocks [1] Frequency jump Variance increase Sinusoidal variations Other Common Timing Anomalies Frequency drift ( aging ) Linear (and higher-order) variation in aging rate Environmental variability (thermal/magnetic/vibrational/ ) Diurnal variability (sinusoidal) Benign Error Anomalies Unhandled system-level discontinuity e.g., Apr. 6, 2019 GPS week-number rollover, leap seconds, System-level fault e.g., GPS ground segment error on Jan. 26, 2016, time shifted by 13 µs Unhandled planned system outage e.g., ignored NANU User-level error e.g., improper use of GPS satellite in test mode Timing Anomalies Can Be Linear Monotonic Preventable Benign Non-Linear Non-Monotonic Unavoidable Intentional [1] L. Galleani and P. Tavella, Detection and identification of atomic clock anomalies, Metrologia, Vol. 45 (2008), S127-S133. 5

6 General Concepts for Monitoring Time Time deviations are unobservable from a single clock Monitoring of clock differences Clock dynamics versus model Ensemble dynamics versus joint model Includes clock covariance structure Plus other prior information: which time sources are jointly subject to disturbance? Which are under the user s control? At least two meaningful alert levels: Degraded: may indicate unavailable time source, higher-than-typical noise level, Anomalous: clear indication of detrimental timing anomaly Assuredness = Agreement with Model + System Health 6

7 Assuredness: More than RAIM RAIM+FDE (Receiver Autonomous Integrity Monitoring + Fault Detection & Exclusion) was an early attempt to secure civil GPS The 2001 Volpe NTSC report revealed its shortcomings [1] T-RAIM [2] inherited similar assumptions (and shortcomings) It is implicitly assumed that each measurement is equivalent in accuracy since SA [selective availability] is the dominant error effect, and equally distributed What about non-uniform and unanticipated common-mode errors? Assuredness must include system dynamics, not just current state. Assumptions needed for fault exclusion can impair detection. [1] Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System, J. A. Volpe National Transportation Systems Center, Aug [2] G. J. Geier, T. M. King, H. L. Kennedy, R. D. Thomas and B. R. McNamara, Prediction of the Time Accuracy and Integrity of GPS Timing, 1995 IEEE Intl. Frequency Control Symposium. 7

8 Accuracy Requirements Accuracy Requirements k-sigma? Or Not-to-Exceed? PMUs that conform to this IEEE standard are expected to produce a stream of accurate, synchronized phasor measurements Synchrophasor measurements shall be synchronized to UTC time with accuracy sufficient to meet the accuracy requirements of this standard a loss of time synchronization shall be asserted when loss of synchronization could cause the TVE to exceed the limit [1] Accuracy Without Independent Time-of-Day Small frequency steps large accumulated phase offsets A Rb clock can obtain a freq. offset after warmup [2] still likely to violate traveling wave fault locator requirements within hours Under not-to-exceed requirement, may need to focus on detection + early assertion of an error flag [1] IEEE Standard for Synchrophasors for Power Systems, IEEE Std. C , March 2006 (emphasis added). [2] NIST Introduction to Frequency Calibrations, n.d. 8

9 Stability: Wander + Jitter Even without considering syntonization, some applications impose stability requirements beyond calibration intervals ITU-T standards impose nanosecond-order jitter limits [1] 1 Accuracy Limit Reference Time- Scale (e.g., UTC) Time Accuracy Limit x 10-6 [1] ITU-T Recommendation G.823, The control of jitter and wander within digital networks which are based on the 2048 kbit/s hierarchy, Mar

10 What Should a Time Source Provide to Monitor? Clock reading Self-assessment of overall time quality e.g., the 4-bit time quality code of the IEEE Synchrophasor Standard Self-assessment of stability of constituent time sources Traceability information Relative weighting of constituents Digest codes, authentication certificates, zero-knowledge proofs Remote firmware attestation (e.g., by Trusted Platform Module) Other independently-verifiable information Ephemerides, network packet sequence numbers, environmental factors, etc. Reported length of a reference time interval Corrective actions Disciplining adjustments, T-RAIM-like exclusions, aging compensation, 10

11 Network-Scale Monitoring Wide-area time synchronization requirements (for, e.g., oscillation damping on the grid) also suggest opportunity for network-scale monitoring of time Many timing disturbances are local To benefit from network-scale monitoring, usually need: Differential measurement Sufficient similarity under normal operating conditions (common-view clock?) Network scale > disturbance scale Response period >> network latency Local precision timestamping (or minimum disturbance magnitude >> network delay variability) 11

12 Output Time Characteristics When is a phase step imposed on the output timing signal vs. a frequency adjustment? Is output estimated time quality reported? How? (confidence interval? order estimate?) What is done when input time sources disagree about leap seconds and other discontinuities? Are non-monotonic phase corrections allowed? Does the user get to select the degree to which a higherstability/accuracy time source is followed when possibly suspect? 12

13 Conclusions Timing requirements for the electric grid vary significantly Some reaction time limits may preclude use of wide-area timing data Still, opportunities exist for network-scale monitoring Assuredness = Agreement with Model + System Health This should include system dynamics; T-RAIM-like approach is inadequate Timing assurance may still entail detection of timing anomalies absent the ability to provision adequate holdover timing Invalid time can be much worse than unavailable time Accuracy requirements may be stated as not-to-exceed Metrics should include probabilities of detection and false alarm 13

14 Thank you for your time. Questions? Disclaimer This document was prepared as an account of work sponsored by an agency of the United States government. Neither the United States government nor Lawrence Livermore National Security, LLC, nor any of their employees makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States government or Lawrence Livermore National Security, LLC. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States government or Lawrence Livermore National Security, LLC, and shall not be used for advertising or product endorsement purposes.