=== dc2016-06-0009-pages-01.ppm ===
Republic of the Philippines
DEPARTMENT OF ENERGY

DEPARTMENT CIRCULAR NO, PC201—- 0@-9009
Fr

ADOPTING THE WHOLESALE ELECTRICITY SPOT MARKET (WESM) MARKET
MANUAL ON SYSTEM SECURITY AND RELIABILITY GUIDELINES AND ITS
FURTHER AMENDMENTS

WHEREAS, Sections 30 and 37(f) of the Electric Power Industry Reform Act (EPTRA)
provides that the DOE, jointly with the electric power industry participants, shall establish
the Wholesale Electricity Spot Market (WESM) and formulate the detailed rules governing
the operations thereof;

WHEREAS, on 28 June 2002, the DOF, with the endorsement of the electric power industry
participants, promulgated the WESM Rules through Department Circular No, DC2002-06-
003;

WHEREAS, any changes, amendments, and modifications to the WESM Rules including its
Market Manuals shall be undertaken in accordance with the provisions of Chapter 8 thereof;

WHEREAS, on 21 July 2015, the Rules Change Committee (RCC) received the System
Operator's proposed amendments to the Market Manual, particularly on the System
Security and Reliability Guidelines;

WHEREAS, the said proposal sought to clarify and align the pertinent provisions of the
System Security and Reliability Guidelines with the Philippine Grid Code and System
Operator's Ancillary Services Procurement Plan;

WHEREAS, on 05 August and 02 September 2015, the RCC during its 103 and 104% RCC
Meetings, respectively, discussed the said proposal, which thereafter approved its
publication in the WESM website to solicit comments from market participants and other
interested parties;

WHEREAS, on 03 February 2016, the RCC during, its 109% RCC Meeting deliberated on the
proposal giving due course to the comments received from market participants;

WHEREAS, on 03 March 2016, the RCC during its 111% RCC Special Meeting further
reviewed and finalized the proposal, which thereafter approved its endorsement to the PEM
Board;

WHEREAS, on 31 March 2016, after due evaluation and deliberation, the PEM Board during
its 115% PEM Board Meeting approved for endorsement to the DOE the above stated RCC
proposed amendments to the System Security and Reliability Guidelines;

WHEREAS, on 08 April 2016, the above stated amendments to the Market Manual on
System Security and Reliability Guidelines were submitted to the DOE for final approval, in
compliance with Chapter 8 of the WESM Rules;

~ Energy Center, Rizal Drive. Bonifacio Giobat City Taguig City Metro Manila, Philippines
Tes (Trunks) 840-1401 to 40: Fax 640-2067. 840-2236. 840-2067 (Domestic), 612-840-2173. 632-840-2236, 632 ees i
(international)

=== dc2016-06-0009-pages-02.ppm ===
WHEREAS, the DOE thoroughly reviewed the abovementioned PEM Board-approved

amendments to the Market Manual on “System Security and Reliability Guidelines,” and

deemed it consistent with the objectives of the WESM such as efficiency and transparency; |
and

WHEREAS, the DOE deemed it necessary to include additional section in the said Market
Manual concerning provisions on amendments, publication and effectivity for clarity and
consistency with the WESM Rules,

NOW THEREFORE, pursuant to its authority under the EPIRA and WESM Rules, the DOE
hereby adopts, issues, and promulgates the following Market Manual and its further
amendments:

Section 1. Amendments to the Market Manual. Pursuant to DOF Circular No, DC2015-07-
0013 entitled “Adopting Further Amendments to the WESM Rules (Procedure for Changes
to the WESM Rules and Market Manuals),” the Market Manual on “System Security and
Reliability Guidelines” presented as “Annex A” to this Circular is hereby approved and
adopted.

Section 2. Separability Clause. If for any reason, any section or provision of this Circular is
declared unconstitutional or invalid, such parts not affected shall remain valid and
subsisting.

Section 3. Effectivity. This Circular shall take effect upon its publication in at least two (2)
newspapers of general circulation and shall remain in effect until otherwise revoked.

Issued this 24 June 2016 at the DOE, Energy Center, Rizal Drive, Bonifacio Global City,
Taguig City, Metro Manila,

ZENAIDATY. MONSADA
Secretary

a Reptee of fe Pletpuews
Ne A DEPAATMENT OF Chnnay

ye Oe

DOE-ZYM-16003999
VC 0 AO a

hm

DCQLe - ~Adopting the WESM Market Manual on System Security and Reliability Guidelines and Its
Further Amendments

=== dc2016-06-0009-pages-03.ppm ===
Wholesale Electri
CF wholesale Market

WESM Market Manual

System Security and Reliability
Guidelines
Issue No. 1

Abstract This document prescribes general guidelines that must be followed by all WESM
Participants to maintain the security and reliability of the Luzon, Visayas and
Mindanao power systems -

Document identity WESM-SSRG-001

Issue No 01
Reason for issue Amendments
Approval Date

Publication Date
Effective Date
=== dc2016-06-0009-pages-04.ppm ===
Lp Wholesale Electricity
Spot Market

System Security and Reliability Guidelines

Document Change History

WESN-SSRG-0001
Effective Date

‘Reason for Amendment

Issue | Proponent _—ODate of
| No. | | Effectivity
so
| Subcommittee |

Document Approval

issue | RCC Resolution |

No. RCC Approval

No.

Reference Documents

Document ID

issue 0.1 — Month Date, Year

WESM Rules

PEM Board
PEM Board Approval |__ Resolution No.

Document Title

Philippine Grid Code

Price Determination Methodology

Public
=== dc2016-06-0009-pages-05.ppm ===
Wholesale Electrici
re Market ”

System Security and Reliability Guidelines WESN-SSRG-0001
Effective Date

Table of Contents

Issue 0.1 — Month Date, Year Public il
=== dc2016-06-0009-pages-06.ppm ===
Ee Wholesale Electricity

Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

SECTION 1 INTRODUCTION

Power system reliability is a major concern in the Philippine electricity industry. It
encompasses all aspects of providing reliable electric service to customers, which is a
daunting task. A reliable power system is one that accounts for few interruptions of
service to customers.

Power system reliability is generally considered to have two components: resource
adequacy and system security. Resource adequacy refers to having sufficient resources
in place in a timely manner to produce and deliver power on demand and to provide a
“buffer” (e.g., a reserve margin) to cover contingencies associated with unplanned
electricity demand increases and unplanned electricity supply reductions. In plain
language, adequacy implies that there are sufficient generation and transmission
resources available to meet projected needs plus reserves for contingencies. These
contingencies can affect both production (generation) and delivery (transmission and
distribution)

Security refers to the system's ability to react to and withstand disturbances. It implies
that the system will remain intact even after outages or other equipment failures occur. It
involves having sufficient equipment and procedures in place to avoid harm to customers
and to the electric system (generation, transmission and distribution) in case of
disturbances. Disturbances can include adverse weather, equipment failures, and other
events that could lead to an overload of the system or portions of the system. System
security typically addresses emergency operations that occur over short times (from
seconds to hours), often requiring activation and operation of autornatic protection
devices and generally involving intervention by the System Operator. Although System
Operator must be able to respond quickly to disturbances, there are limits to their ability
to intervene. Automatic protection devices are used where actions may be required
before operator intervention is possible (e.g., response to a lightning strike occurs
automatically within a few cycles). Effective system security requires a high degree of
coordination, communication, and control on a real-time basis

Unlike most products, electricity cannot be stored in large quantities in an economical
manner. As a result, electricity has to be produced and delivered on demand. The
operating capability of the generation, transmission, and distribution systems must be
sufficient to meet constantly changing customer demands at all times.

Another distinguishing characteristic of electricity supply systems ts the high degree of
interdependence between generation and transmission. As a result of this
interdependence, disturbances in generation may lead to transmission problems. For
example, a major generation unit outage can quickly lead to an overload condition on the
transmission system, which may result in transmission outages and loss of delivered
power. Similarly, disturbances in transmission may lead to generation problems. For
example, a transmission outage resulting from adverse weather or an overioad condition
may quickly lead to generation outages and loss of delivered power. Currently system
protection features are built in to limit the extent of disturbances and the possibility of

equipment damage.

Page 1 of 16
=== dc2016-06-0009-pages-07.ppm ===
Ete Wholesale Electricity
Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

These facets of electrical systems place a premium on rapid response operation to
maintain system reliability. Rapid response operation must occur within seconds or
minutes of changes in system conditions. These two unique characteristics also lead to
the following four reliability consequences that dominate nearly all aspects of power
system operation:

(a) Every action can affect all other activities on the grid Therefore. the activities
of all players must be coordinated,

(b) Cascading problems that increase in severity are extremely serious. Failure of
a single element of the system can, if not managed properly, cause the subsequent
rapid failure of many additional elements, disrupting the entire transmission system,

(c) The need to be ready for the next contingency dominates the design and
operation of the bulk power system to a greater degree than do current conditions. It
is usually not the present flow through a line or transformer that limits allowable
power transfers, but rather the flow that would occur if another element fails, and

(d) Because electricity flows at the speed of light, maintaining reliability often

requires that actions be taken instantaneously (within fractions of a second), which

necessitates automatic computing, communication, and control actions.
Managing reliability raises important commercial and societal issues. Reliability rules can
favor some industry players and exclude others, and these rules affect all of society
because they affect electricity prices and availability. All users of the power system have
an interest in how reliable the system is, what the costs of reliability are, and how
decisions concerning reliability are made.
To Customers, the most important characteristics of a reliable power system are

(a) Widespread adverse effects on customer service are minimized;

(b) Outages are confined in extent:

(c) The system can be restored rapidly after an outage, and

(d) The cost to Customers is in accord with their reliability expectations and

willingness to pay

SECTION 2 DEFINITION OF TERMS

Adequacy. The ability of the power system to supply the aggregate electrical demand
and energy requirements of the Customers at all times, taking into account scheduled
and reasonably expected unscheduled outages of system elements

Page 2 of 16
=== dc2016-06-0009-pages-08.ppm ===
Wholesale Electricity
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001

Effective Date
Automatic Generation Control (AGC), The regulation of the power output of generating
units within a prescribed area in response to a change in system frequency, tie-line
loading, or the relation of these to each other, so as to maintain the system frequency or
the established interchange with other areas within the predetermined limits or both.

Automatic Load Dropping (ALD). The process of automatically and deliberately
removing pre-selected loads from a power system in response to an abnormal condition
in order to maintain the integrity of the system

Backup Reserve (also called cold standby reserve). Refers to a generating unit that has
fast start capability and can synchronize with the grid to provide its declared capacity for
a minimum period of eight (8) hours

Black Start. The process of recovery from total system blackout using a generating unit
with the capability to start and synchronize with the system without an external power
supply.

Cascading Outage. The uncontrolled successive loss of system elements triggered by
an incident at any location

Contingency. The unexpected failure or outage of a system component, such as a
generator, transmission line, power transformer, bus, circuit breaker, or other electrical
element. A contingency may also include multiple components, which are related by
situations leading to simultaneous component outages.

Contingency Reserve. The generating capacity that is intended to take care of the loss
of the largest synchronized generating unit or the power import from a single grid
interconnection, whichever is larger. Contingency reserve includes spinning reserve and
backup reserve.

©

Disturbance. An unplanned event that produces an abnormal system condition

Emergency. Any abnormal system condition that requires automatic or immediate
manual action to prevent or limit loss of transmission facilities or generation supply that
could adversely affect the reliability of the electric system.

Fault. An event occurring on an electric system such as a short circuit, a broken wire, or
an intermittent connection.

island Grid. A portion of a power system or several power systems that is electrically
separated from the interconnection due to the disconnection of transmission system
elements.

Load Following and Frequency Regulating (LFFR) Reserve. The amount of

generating capacity that provides for following the moment-to-moment variations in
demand or supply in a power system and for maintaining acceptable system frequency.

Page 3 of 15
=== dc2016-06-0009-pages-09.ppm ===
Wholesale Electricity
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

Manual Load Dropping (MLD). The process of manually and deliberately removing pre-
selected loads from a power system in response to an abnormal condition in order to
maintain the integrity of the system.

Multiple Outage Contingency. An event caused by the failure of two (2) or more
components of the grid including generating units, transmission lines, and transformers.

Normal State. The grid operating condition when the system frequency, voltage, and
transmission line and equipment loading are within their normal operating limits, the
operating margin is sufficient, and the grid configuration is such that any fault current can
be interrupted and the faulted equipment isolated from the grid.

Operating Margin. The margin of generation over the total demand plus losses that is
necessary for ensuring power quality and the security of the grid. Operating margin is the
sum of the load following and frequency regulating reserve and the contingency reserve.

Reliability. The performance of the elements of the bulk electric system that results in
electricity being delivered to Customers within accepted standards and in the amount
desired. Reliability may be measured by the frequency, duration, and magnitude of
adverse effects on the electric supply

Security. The ability of the electric system to withstand sudden disturbances such as
electric short circuits or unanticipated loss of system elements.

Single Outage (N-1) Contingency. An event caused by the failure of one component of
the grid including a generating unit, transmission line, or transformer.

Spinning Reserve (also called hot standby reserve). The component of contingency
reserve which is synchronized to the grid and ready to take on load.

Stability. The ability of the dynamic components to return to a normal or stable operating
point after being subjected to some form of change or disturbance.

System Integrity Protection Scheme (SIPS). A protection system that is designed to
detect abnormal or predetermined system conditions, and take automatic corrective
actions

Voltage Collapse. An event that occurs when an electric system does not have
adequate reactive support to maintain voltage stability. Voltage collapse may result in
outage of system elements and may include interruption in service to Customers.

Voltage Control. The contro! of transmission voltages through adjustments in generator

reactive output and transformer taps and by switching capacitor and reactors on the
transmission and distribution systems

Page 4 of 15
=== dc2016-06-0009-pages-10.ppm ===
Whol i
OD svete"

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

SECTION 3 OBJECTIVE

Preservation of system reliability and security is the primary objective of these guidelines
and is the responsibility of the System Operator. This mandate is clearly vested under
Clause 3.8.2.1 (b) of the WESM Rules which stipulates that, during each trading interval.
the System Operator shall use its reasonable endeavors to maintain system security
consistent with the requirements of the Grid Code Minimization of customer service
interruptions and quick restoration of the power system to the normal state are
secondary objectives of these guidelines.

This document prescribes general guidelines that must be followed by all WESM
Participants to maintain the security and reliability of the Luzon, Visayas and Mindanao
power systems. These guidelines are based on existing practices and the Grid Code and
Distribution Code requirements and developed in accordance with Clause 6.6.1.1 of the
WESM Rules which states that the Systern Operator, in consultation with WESM
Participants and the Market Operator, shall develop and periodically update system
security and reliability guidelines, subject to approval of the PEM Board. These
guidelines provide supplementary provisions for the improvement of WESM operations in
ensuring the security and reliability of the grid. However, in case of conflict in the
achievement of the objectives of the Grid Code, the provisions of the Grid Code shall
prevail

SECTION 4 SCOPE ]

These guidelines apply to the following WESM Participants

(a) Market Operator:

(b) System Operator;

(c) Generation Companies,

(d) Ancillary Service Providers;

(e) Distribution Utilities,

(f) Suppliers,

(g) Bulk Consumers/End-users: and

(h) Other similar entities, authorized by the Energy Regulatory Commission
(ERC) to become members of the WESM

SECTIONS GUIDELINES

The power system shall be operated to achieve the highest practical degree of service
reliability. Appropriate remedial actions shall be taken promptly to eliminate any abnormal
conditions which jeopardize reliable operation.

Page 5 of 15
=== dc2016-06-0009-pages-11.ppm ===
rket

Ete Wholesale Electricity

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

5.1 Normal State Operation
The grid shall be operated so that it remains in the normal state, |.e.:

(a) The operating margin is sufficient

(b) The grid frequency is within the limits as set forth in the Grid Code

(c) Voltages at all connection points are within the limits of 0.95 and 1.05 of the
nominal value.

(d) The loading levels of all transmission lines and transformers are below the
limit as set forth in the Grid Code.

(e) The grid configuration is such that any potential fault current can be
interrupted and the faulted equipment can be isolated from the grid

(f) The static and dynamic stability of the power system is maintained

(g) The single outage contingency (N-1) criterion is met.

5.2 Alert State

The Grid shall be considered to be in the alert state when any one of the following
conditions exists:

(a) The voltages at the connection points are outside the limits of -5% and +5%
but within the limits of -10% and +10% of the nominal value:

(b) There is critical loading or imminent overioading of transmission lines or
substation equipment:

(c) A weather disturbance has entered the Philippine area of responsibility, which
may affect grid operations;

(d) Peace and order problems exist, which may pose a threat to grid operations;
(e) The operating margin is not sufficient to replenish the sudden loss of the
largest generating unit capacity synchronized to the grid; and

(f) The grid frequency is beyond the limits of 59.7 Hz and 60.3 Hz but within the
thresholds of 59.4 Hz and 60.6 Hz.

§.3 Emergency State
The grid shall be considered in the emergency state when

(a) Single outage contingency (N-1) criterion is not met. Imminent threat in
system security would exist should a credible n-1 contingency occur that would
result in the cascading outages of lines and equipment if not corrected
immediately:

(b) There is generation deficiency or operating margin is zero;

(c) Grid transmission voltage is outside the limits of -10% or +10% of the nominal
value:

(d) The loading levels of all transmission lines and substation equipment are
beyond the threshold as set by the Grd Code; and

(e) The grid frequency is beyond the limits of 59.4 Hz and 60.6 Hz

Page 6 of 15

=== dc2016-06-0009-pages-12.ppm ===
Wholesale E
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date:

5.4 Single Outage (N-1) Contingency Criterion

(a) The security and reliability of the grid shall be based on the single outage
contingency (N-1) criterion. This criterion specifies that the grid shall continue to
operate in the normal state following the loss of one generating unit, transmission
line, or transformer

(b) Credible single outage contingency (N-1) contingencies

The N-1 Criterion is related to one of the following contingencies:
(i) Loss of a single-circuit transmission line, except those radial circuits
which connect loads using a single line or cable;
(ii) Loss of one circuit of a double-circult transmission line;
(tii) Loss of submarine cable:
(iv) Loss of a single transformer, except those which connect loads using
a single radial transformer,
(v) Loss of a generating unit, whether grid-connected or embedded: and
(vi) Loss of compensating devices, i.e., capacitor / reactor / SVC

(c) In the event of a credible N-1 contingency, the system or any part thereof
shall be operated up to its operational thermal limit capacity, beyond which the
System Operator shall intercept to restore system stability

For the avoidance of doubt, manual corrective interventions shall not be imposed
to delimit the power transfer capabilities of equipment/transmission lines in
anticipation of a secondary outage (N-1-1). However, if a significant threat to
system security exists following the occurrence of a credible N-1 contingency the
System Operator may intervene and shall make the necessary manual corrective
actions as required, to protect the integrity of the grid.

(d) The power system shall be operated at all times in such a manner that
system instability, islanding, cascading outages, or voltage collapse will not occur
as a result of the most severe single contingency. A single contingency may
generally be assumed to mean the loss of a single system element; however. the
outage of multiple system elements should be treated as a single contingency if
caused by a single event of sufficiently high likelihood.

(6) Multiple contingency outages of a credible nature shall be examined, and the
system shall be operated to protect against system instability, islanding or
cascading outages for these contingencies.

(f) A planned activity notice or request for shutdown shall be issued by a grid
user to the System Operator for any planned activity such as a planned shutdown
or scheduled maintenance of its equipment at least seven (7) days prior to the
actual shutdown or maintenance. This is to allow the System Operator sufficient
time to evaluate if the planned outage can be accommodated by the power
system and to coordinate the outage with other affected grid users. The System

Page 7 of 16
=== dc2016-06-0009-pages-13.ppm ===
Wholesale Electricity
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

Operator shall notify the user of its approval or disapproval of the user's request
at least five (5) days before the actual work commences

5.5 Grid Operation Notices

The following notices shall be issued, without delay, by the System Operator to notify
all grid users of an existing alert state”

(a) Yellow alert when the contingency reserve is less than the capacity of the
largest synchronized generating unit or power import from a_ single
interconnection, whichever is higher,

(b) Red alert when the contingency reserve is zero or generation deficiency exists
or if there is critical loading or imminent overloading of transmission lines or
equipment;

For clarity, when the operating margin net of the regulating reserve capacity is less
than the capacity of the largest synchronized generating unit or power import from
a single interconnection, whichever is higher, the System Operator shall issue
yellow alert notice

Likewise, if the operating margin jess the regulating reserve capacity becomes
zero, the System Operator shail issue red alert notice

(c) Weather disturbance alert when a weather disturbance has entered the
Philippine area of responsibility

(d) Blue alert when a tropical disturbance is expected to make a landfall within
twenty-four (24) hours; and

(e) Security red alert when peace and order problem exist, which may affect the
grid operations

5.6 Voltage and Reactive Power Control

(a) The grid voltages shall be operated at safe levels to reduce the vulnerability
of the grid to transient instability, dynamic instability, and voltage instability
problems, Reactive reserve margins shall be adequate to maintain minimum
acceptable voltage limits under facility outage conditions

(b) The contro! of voltage shail be achieved by managing the reactive power
supply in the grid. These include the operation of the following equipment:

(i) Synchronous generating units:

(ii) Synchronous condensers:

(iii) Shunt capacitors:

(iv) Shunt reactors;

(v) Static var compensators (SVCs); and

(vi) On-load tap-changing transformers

Page 8 of 15
=== dc2016-06-0009-pages-14.ppm ===
Wholesale Electricity
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

(c) Operation of static and dynamic reactive devices shall be coordinated such
that static devices are switched in or out of service so that the maximum reactive
reserves are maintained on generators, synchronous condensers and other
dynamic reactive devices.

(d) Reactive resources shall be dispersed and located electrically so that they
can be applied effectively and quickly when contingencies occur. Sufficient
reactive resources that are available and operable shall be ensured by the
System Operator through its own facilities and by the procurement of reactive
power support services.

(e) As a last resort, especially during light load conditions, some transmission
lines may be switched off to reduce the charging MVars (capacitive reactive
power) in the system and to keep the voltages within allowable limits.
Transmission lines may be removed from service only after studies indicate that
system reliability will not be degraded below acceptable levels.

(f) Necessary corrective actions, including load reduction, shall be taken to
prevent voltage collapse when reactive resources are insufficient.

(g) All generating units with automatic voltage control equipment shall normally
be operated in voltage contro! mode. When a generator’s voltage regulator is out
of service, field excitation shall be maintained at a level sufficient to maintain
generator stability.

§.7 Frequency Control

(a) The grid frequency shall be controlled by the timely use of frequency
regulating reserve, contingency reserve, and demand control such as
automatic load dropping (ALD) and/or manual load dropping (MLD) during
emergency conditions.

(b) A generating unit providing regulating and/or contingency reserves may be
operated either in an automatic frequency-sensitive mode (also known as free-
governor mode) with primary response or in an automatic generation control
(AGC) mode with secondary response.

(c) A generating unit providing primary response for frequency regulation as an
ancillary service shall operate in an automatic frequency-sensitive mode (also
known as free-governor mode) for automatic response of the unit's power output
to changes in frequency. The speed-governing system of the generating unit shall
have a maximum response time of five (5) seconds.

(d) Secondary response shall be required from selected generating units
providing ancillary services for frequency regulation. Frequency control using the
secondary response of the generating units shall be accomplished through
automatic generation control (AGC) or manual adjustment of generation with
specific dispatch instructions from the System Operator. The maximum response

Page 9 of 15

=== dc2016-06-0009-pages-15.ppm ===
Wholesale Electricity
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date:

time for the change in the unit's power output shall be twenty-five (25) seconds
and which shall be sustainable for at least thirty (30) minutes

(e) The generation company or power plant shall not override the free-governor
mode or automatic generation control (AGC) mode of a generating unit which is
providing primary or secondary response

(f} Governors shall not be blocked and shall not be operated with excessive
deadbands. To provide an equitable and coordinated system response to
generation-load imbalances, governor droop shall be set at 5%.

(g) A generating unit providing contingency reserve as an ancillary service shall
be synchronized with the grid at the start of every trading interval to be able to
automatically respond to any sudden loss or significant reduction in generating
capacity

(h) In case the system frequency momentarily rises to 62.4 Hz or falls to 57.6 Hz,
all generating units shall remain in synchronism with the grid for at least five (5)
seconds to allow the System Operator to undertake measures to correct the
situation

5.8 System Reserve Requirements

(a) Sufficient system reserves shall be available at all times to maintain
acceptable system frequency, necessary to cope with any load variations
and errors in load forecasting and to replace generating capacity lost due to
forced outages of generation and transmission equipment. Adequate frequency
regulating reserve and contingency reserve shall be available to stabilize the
system and facilitate the restoration to the normal state following a multiple
outage contingency

(b) The operating margin of the grid is sufficient if the available generating
Capacity in excess of the sum of the system demand plus losses is greater than
the capacity of the highest synchronized generating unit within a specific period
of time to cover loss of a generating unit or the power import from a single circuit
interconnection whichever is higher

(c) The required system reserves for regulating and contingency shall be in
accordance with the latest ERC approved ancillary service procurement plan.

5.9 Demand Control
(a) If demand control due to generation deficiency needs to be implemented, the
System Operator shall issue a red alert warning by 1600H, a day ahead. The red
alert warning shall specify the amount, the period during which the demand
reduction will be required and the reason of the generation deficiency
(b) The System Operator shall issue demand control imminent warning when a
demand reduction is expected within the next thirty (30) minutes. The demand

Page 10 of 15
=== dc2016-06-0009-pages-16.ppm ===
CA Moteate Electricity
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date:

control imminent warning shall be effective for one (1) hour and shall be
automatically cancelled if it is not re-issued by the System Operator.

(c) During demand control, the implementation of rea! time dispatch shall cease
and the System Operator, in coordination with the Market Operator, shall declare
market intervention.

(d) The user shall provide the System Operator with the amount of demand
reduction actually achieved after the implementation of demand control.

(e) The user shall abide by the instruction of the System Operator with regard to
the restoration of demand. The restoration of demand shall be achieved as soon
as possible and the process of restoration shall begin within two (2) minutes after
the instruction is given by the System Operator

(f) The demand control shall include the following
(i) Automatic load dropping:
(ii) Manual load dropping.
(iii) Demand reduction on instruction by the System Operator, and
(iv) Voluntary demand management

5.10 Automatic Load Dropping (ALD) and Manual Load Dropping (MLD)

(a) Adequate load shedding facilities initiated automatically by frequency
conditions outside the normal operating frequency excursion band shall be
available and in service to restore the frequency to normal following the loss of
one (1) of more generating units or other significant contingency events. A load
shedding program shall be implemented to drop the necessary amount of load to
arrest frequency decay, minimize loss of load, and permit timely system
restoration

(b) The level of demand required for ALD shall be established by the System
Operator in order to limit the consequences of a major loss of generation in the
grid. Appropriate technical studies shall be conducted by the system Operator to
justify the targets and/or to refine them as necessary

(c) Loads that are subject to ALD shall be split into rotating discrete MW blocks.
The number of blocks and the under frequency setting for each block shall be
specified by the System Operator.

(d) If an ALD has taken place, the affected users shall not reconnect their feeders
without clearance from the System Operator. The System Operator shall issue
the instructions to reconnect once the frequency of the grid has recovered

(e) To ensure that a subsequent fall in frequency will be contained by the

operation of ALD. additional manual load dropping (MLD) shall be implemented
50 that the loads that were dropped by ALD can be reconnected

Page 11 of 15
=== dc2016-06-0009-pages-17.ppm ===
Wholesale Electricity
Spot Market

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date:

(f) MLD shall be conducted by distributors, as directed by the System Operator,
in response to an overall shortage of energy at a node or in a region specified in
the network market model, or other network conditions as determined by the
System Operator in accordance with the procedures established under the Grid
Code and Distribution Code.

(g) To prepare for a generation deficiency situation, a priority scheme for MLD
based on equitable load allocation shall be established by distributors in
consultation with the System Operator.

(h) Immediately following the issuance by the System Operator of an instruction
to implement MLD, distributors shall make arrangement that will enable it to
disconnect its scheduled Customers.

(i) MLD may also be initiated by the System Operator in response to any other
circumstances which it reasonably considers necessitate such action under the
Grid Code or Distribution Code or any other applicable regulatory instrument

(j) Customers affected by the MLD shall not be reconnected by distributors until
instructed by the System Operator to do so

5.11 System Restoration

(a) A coordinated system restoration plan shall be established, reviewed,
updated if necessary, and simulated to verify comprehensiveness and feasibility.

(b) Following a significant incident that makes it impossible to avoid island grid
operation, the grid shall separate into several self-sufficient island grids, which
shall be resynchronized to restore the grid to the normal state.

(c) If a part of the grid is not connected to the rest of the grid, but there is no
blackout in that part of the grid, the resynchronization of that part to the grid shall
be undertaken by the System Operator.

(d) Sufficient black start and fast start capacity shall be available at strategic
locations to facilitate the restoration of the grid to the normal state following a total
system blackout. At least two (2) black start plants shall be available at each
power restoration highway or sub-grid. Each black start generating unit shall be
tested to verify that it can be started and operated without being connected to the
system.

(e) Emergency drills shall be conducted at least once a year to familiarize all
personnel responsible for emergency and grid restoration activities with the
emergency and restoration procedures. The drills shall simulate realistic
emergency situations. A drill evaluation shall be performed and deficiencies in
procedures and responses shall be identified and corrected.

Page 12 of 15
=== dc2016-06-0009-pages-18.ppm ===
Wholesale Electricity
Spot Market

System Secunty and Reliability Guidelines WESN-SSRG-0001
Effective Date

§.12 Grid Protection Requirements

(a) Grid protection shall be designed, coordinated, tested and maintained to
achieve the desired level of speed, sensitivity, and selectivity in fault clearing and
to minimize the impact of faults on the grid.

(b) The grid shall have adequate and coordinated primary (Main 1 and Main 2)
and local and remote backup protection at all times to limit the magnitude of grid
disturbances when a fault or equipment failure occurs. Preferably, the Main 1 and
Main 2 protection should be of different types (e.g. distance relay for Main 1 and
current differential relay for Main 2) and use different teleprotection media (e.g.
power line carrier or optical fiber for Main 1 and microwave for Main 2)

(c) High-speed relays, high-speed circuit breakers and automatic reclosing shall
be used where studies indicate the application will enhance stability margins.
Single-pole tripping and reclosing may be appropriate on some lines.

(d) Circuit breaker fail protection shall be designed to initiate the tripping of all the
necessary electrically adjacent circuit breakers and to interrupt the fault current
within the next fifty (50) milliseconds, in the event that the primary protection
system fails to interrupt the fault current within the prescribed fault clearance
time

(e) Protection system applications, settings. and coordination shall be reviewed
periodically and whenever major changes in generating resources transmission,
load or operating conditions are anticipated

(f) The operation of the complete protection system shall be tested under
conditions as close to actual operating conditions as possible, including actual
circult breaker operation where feasible.

(g) Relays that have misoperated or are suspected of improper operation shall be
promptly removed from service until repaired or correct operation is verified

(h) The fault clearance time for a fault on the grid shall not be longer than
(i) 85 ms for 500 kV;
(ii) 100 ms for 230 kV and 138 kV; and
(ili) 120 ms for voltages less than 138 kV.

(i) Following a credible N-1 contingency where the Rules for a minimum grid
performance are compromised, a temporary security measure such as the
system integrity protection scheme (SIPS) shall be employed to avoid
subsistence and spreading of the disturbance

The temporary employment of SIPS shall be coordinated with the concerned
users and shall only be applied specific to parts of the system determined to be
exposed to a high degree of likelihood for a secondary contingency (N-1-1) or a
subsequent multiple contingency (N-x) such that the risk of cascaded blackout is
avoided.

Page 13 of 15

=== dc2016-06-0009-pages-19.ppm ===
Wholesale Electri
Spot Market ary

System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date:

Information on all available SIPS shall be provided to the Grid Management
Committee and at the same time, it shall be coordinated with the concerned
users.

(j) The installation and use of transient recorders, event recorders and other
recording devices should be encouraged as an aid in analyzing performance
during system disturbances.

5.13 Telecommunications Requirements

(a) For a high degree of service reliability under normal and emergency
operation, it is essential that adequate and reliable communication facilities be
provided within a grid and between grids. When possible, these facilities shall be
redundant and diversely routed

(b) At least one (1) main communication channel with an alternate backup
channel shall be provided between the national contro! center and the regional
control centers, between the national / regional control center and the area
control centers, between the control centers and the power plants, and between
the control centers and the substations

(c) Separate telecommunication channels shall be provided for SCADA,
automatic generation control (AGC), protective relaying, special protection
systems, voice and data where appropriate.

(d) All telecommunications channels shall be tested regularly or monitored on
line.

(e) Communication facilities shall be provided with an automatic standby

emergency power supply adequate to supply requirements for a prolonged
interruption

SECTION 6 RESPONSIBILITIES

The System Operator shall:

(a)'Make the necessary manual interventions upon existence of an imminent
threat in system security or a credible N-1 contingency to restore back, without
delay, the grid operating condition to normal state:

(b) Initiate, upon the existence of a credible N-1 contingency, any or a
combination of manual corrective interventions as follows:

(i) Switch off, or re-route, energy delivery from a Generation Company;
(ii) Call equipment into service:

(ili) Take transmission line or equipment out of service:

(iv) Commence operation of generating units or maintain, increase or
reduce active or reactive power output of the same;

Page 14 of 15
=== dc2016-06-0009-pages-20.ppm ===
Cucleaie Electricity
Spot Market
System Security and Reliability Guidelines WESM-SSRG-0001
Effective Date

(v) Increase, reduce output of generating units or shut down or otherwise
vary operation of the same; and shed or restore load;

(c) Notify the user of its approval or disapproval of the planned activity notice
(PAN) request at least five (5) days before the actual work commences:

(d) Constrain-on / constrain-off or make use of MRUs whenever all available
ancillary reserves are depleted or exhausted;

(e) Implement demand control as a last resort in order to ensure the stability
and security of the grid:

(f} Propose a uniform required deadband applicable to all generators; and

(g) Issue necessary alert notices upon existence of qualifying threat

i SECTION 7 AMENDMENTS, PUBLICATION AND EFFECTIVITY

7.1 Amendments

Any amendments to this Manual shall be approved by the PEM Board, following the
procedures for changes to the Market Manual set out in the WESM Rules and in the relevant
Market Manual.

7.2 Publication and Effectivity
This Market Manual, as it may be amended from time to time, shall be published in the
market information website maintained by the Market Operator

This Market Manual or any amendments thereto shall become effective upon approval of the
DOE in accordance with the WESM Rules Clause 8.6.4. The date of effectivity shall be
indicated in this document. of

e

Page 15 of 15