National grid operator Transpower has been referred to the electricity industry's Rulings Panel for its handling of a major power outage in the lower South Island last year.
The incident in March 2017 was caused when maintenance workers inadvertently shut the two main circuits supplying power from Clyde to Twizel.
At the time, the only other supply north was also shut due to maintenance on the circuits between Livingstone and Naseby.
The shutdown triggered four major emergency systems to prevent a nation-wide cascade failure.
Thousands of customers in the upper South Island were disconnected, as were some generators in the lower South Island. Load was also shed in the North Island as the high-voltage link between the two islands adjusted to the loss of generation.
Transpower, the Electricity Authority and the industry's Security and Reliability Council have reviewed the event during the past 21 months.
Key concerns were how routine maintenance could have triggered such an event, but also why Transpower procedures were not followed when restoring generation and synchronising and reconnecting the two "islanded" grids that had resulted in the South Island.
Acting on the advice of an independent investigator, the Electricity Authority has referred Transpower in its role as system operator to the Rulings Panel on 12 potential breaches of the industry code. The state-owned company also faces four potential breaches in its role as owner of the grid.
Potential penalties include a warning, public reprimand or a fine of up to $200,000.
"The alleged breaches are serious because they exposed connected generators to a high risk of asset damage," the Electricity Authority said today.
"In the circumstances of such a major system event, it is important for the Rulings Panel to consider the application of the relevant code provisions to confirm responsibility and, if necessary, make pecuniary penalty orders to achieve better outcomes in the future."
While the shutdown lasted little over an hour, a key issue was the fact that Transpower staff reconnected the two parts of the South Island grid while incorrectly using the Autosync system – installed to help align voltage and frequency before such synchronisation efforts. Operators believed it was working when in fact it had to be manually enabled.
Transpower noted in a report in July that reconnecting the two "islanded" networks when their frequencies were "significantly misaligned" risked "large instantaneous" forces being applied to all the connected generators.
"These forces attempt to immediately accelerate or decelerate the large heavy rotating mass of each connected generating unit. As a result, potential damage can be sustained by generating units."
No generator damage had been reported at that time, it said.
While the situation had been "very complex and fast-changing," Transpower identified a series of other weaknesses in its processes. They included: the initial failure to identify and isolate recently installed protection equipment at its Clyde switch yard; insufficient planning for the two outages in the area that day; poor communications with some participants during the emergency; and difficulty adapting its system software during such a major event.
It identified 13 remedial actions – many of which have been completed - including ensuring that engineers designing protection systems work with technicians to understand their on-going maintenance and testing requirements.
Another key action was a review of the company's Autosync tool, and improvements to its interface and the procedures for using it in order to assist operators when working under pressure.