Survey of Real-World Grid Incidents–Opportunities, Arising Challenges and Lessons Learned for the Future Converter Dominated Power System

To reach the climate goals set by national and international institutions, a vast transition of the legacy power system is unavoidable. The necessary integration of distributed, renewable generation devices, which are often interfaced with power electronic converters, has a non-negligible influence on the characteristics of the power grid. This is particularly visible during abnormal grid conditions such as faults. For rotating machines, the fast-timescale reaction to these events is mainly determined by physical properties. However, power electronic devices lack this strong coupling and their behavior is generated by the control and automation system, making them a major field of interest during this transition. The present paper provides a survey of real-world incidents, as for example blackouts or oscillatory incidents, that are discussed with respect to the implications for future converter dominated power grids. For typical cascading outages it is shown, where the increasing penetration of distributed, renewable generation and smart grid technologies can be leveraged to increase the system resilience, e.g. by providing grid services through adequate control design or by enabling microgrid concepts. Further, real-world examples of newly emerging challenges driven by power electronic devices are presented. The mechanisms of control system interactions with the neighboring grid and its inherent complex dependency on various factors is illustrated. Lastly, resulting structural developments such as the changed resonance properties of low voltage grids and the increase of harmonic emissions are exemplified.


I. Introduction
P OWER grids worldwide are facing vast transitions from fossil fuels towards an increasing share of renewable energy.This rapid and profound change has a severe impact on all aspects of the power grid, which has been subject of research in the past years.The major challenges associated with this transformation are well described by the energy trilema [1]: Energy Security means the availability of energy and resilience towards disturbances; Energy Equity stands for the provision of affordable and reliable energy for commercial and domestic usage; and Environmental Sustainability describes the goal of minimizing environmental damage and impacts on the climate crisis.From a scientific and engineering perspective the challenges are represented by two main developments: the change towards renewable, distributed energy resources (DER) with their inherent intermittent nature as well as the use of power electronic devices to connect the DERs and modern loads to the power grid.The term dual high-penetration scenario is used in [2] to describe this trend, which is visible at all levels of the power grid.For example, to account for the new geographic locations of power generation the transmission grid is revised [3], [4], e.g. by using high voltage direct current (HVDC) transmission systems to integrate off-shore wind farms or large-scale photovoltaic (PV) plants [5].To cope with the intermittency of renewable generation, energy storage systems are introduced to the grid with the inherent challenge of optimal sizing and placement.Furthermore, the combination of different storage technologies (chemical, electrochemical, thermal, mechanical) to leverage the individual advantages with respect to response speed, energy density, efficiency and costs to satisfy the power and energy needs of the future power system is subject of current research.The progressing electrification of the mobility and heating sector, e.g.widespread use of heat pumps, as well as the integration of rooftop PV and battery energy storage systems (BESS) in residential areas leads to a vastly changed power flow and consumption pattern in low-voltage areas, that can cause serious congestion [6].Furthermore, this yields that former loads now act as socalled prosumers, meaning that they also inject power during certain times.This can be either due to overproduction, e.g.residential rooftop PV systems, or as grid services for example bi-directional charging of electric vehicles or recovery of braking energy in electric public transport [7].In order to orchestrate the large number of devices in the digitalized power grid of the future, it is necessary that they can safely and reliably exchange data.This increased reliance on communication brings inherent cyber security threats [8] as well as new issues concerning communication delays and interruptions that can influence the stability of such cyber-physical systems [9].A further prominent consequence from the large-scale deployment of inverter based resources (IBR) is the reduction of physically rotating masses.This reduces the available spinning reserve and physical grid inertia, leading do socalled low-inertia or weak grids [10], [11].Moreover, since power electronically interfaced DERs lack intrinsic grid services [12], cf.inertia, damping and short-circuit current, such desired behavior must be enforced by control and automation design, thus putting a new importance on this domain.This is reflected in recent developments in the field of grid service provision tailored to grids with high ratios of renewable generation, such as virtual inertia [13]- [16], fast frequency response (FFR) [17], [18] or voltage regulation [19].Moreover, the topology of the power grid is severely altered, the number and diversity of grid participants is vastly increased and well understood devices are being substituted.Thus, the question on how to operate 100% renewable grids is a current research topic [20]- [25].Such profound and fast-paced changes challenge the way we operate our power grids and consequently the aspect of Energy Security must be thoroughly discussed to maintain the current level of availability.Because the resilience of the power system is especially visible during abnormal grid situations, it is crucial to consider such events to improve the future power system.Two points of view can be considered: (i) which already known grid incident mechanisms will gain importance with respect to the described changes of the grid and (ii) which new mechanisms occur due to the high penetration of power electronically interfaced, renewable generation devices.This requires the interdisciplinary consideration of power systems as well as power electronics and their control.However, broad overviews of documented grid incidents that consider both perspectives are lacking in scientific literature.The driving mechanisms of blackouts in traditional power grids are considered in [26], [27].An overview of arising incidents through the high penetration of DERs is presented by [2] and [28].In [29], approaches for the modeling and stability analysis in power electronic dominated grids are discussed.The present paper contributes an integrated consideration of those aspects with regard to the lessons to learn, opportunities and challenges posed by the current transition of our power grid.For this purpose a survey of real-world grid incidents ranging from large-scale blackouts to power quality issues involving power electronics based devices in residential areas is presented.By means of these real-world incidents, it is illustrated: • What lessons can be learned from past large-scale incidents, which failure mechanisms will gain importance due to the current developments and how new devices and techniques can be leveraged to increase the overall power system resilience.• How the control of power electronic systems and their interaction with the neighboring grid is related to emerging incident mechanisms and by which events in the grid these are favored.• Which structural developments result from the high penetration of converter interfaced devices with respect to physical system inertia, the resonance properties of the grid, the influence of harmonic emissions and the complexity of such interactions.

II. Structure of the paper
The remainder of the present paper is structured as follows.
In Section III a brief overview of power system dynamics is given to illustrate the influence of network parameters with respect to power system incidents.In addition, emerging technologies and services are briefly discussed in terms of their capabilities and interaction timescales.Section IV first describes the mechanism of cascading blackouts, then discusses the resulting implications for future power systems in terms of key elements of such incidents and recent developments.Thereafter, in Section V real-world examples of emerging interaction mechanisms resulting from the high penetration of renewable energy systems in the electric grid are presented and discussed with respect to the frequency range, corresponding elements in the control system as well as initiating events.Next, in Section VI, structural developments emerging from the rising share of power electronically interfaced devices are illustrated, again by referring to realworld incidents and observations.The incidents presented throughout the paper are summarized in Section VII.Lastly, Section VIII concludes the paper.

III. Brief overview of power system dynamics, emerging technologies and services
In this section an overview of power system dynamics is given and terms that correspond to the resilience of power grids with respect to faults or large disturbances are introduced.Furthermore, the resulting requirements for emerging PCC bus Grid FIGURE 1. Generic power system for illustration of power system dynamics and definition of related terms (extended from [30]) technologies and devices are briefly illustrated and discussed in the light of the timescales of necessary grid services.

A. Definitions and power system dynamics
To define and exemplify the dynamic behavior, we use a two node abstraction of a generic power grid as shown in Fig. 1.An often encountered term is that of a weak grid, which can be defined using the notion of the short-circuit ratio (SCR) [30] where S n is the generation capacity at the considered node and S SC the short circuit level of the remaining grid at the point of common coupling (PCC).It is, for example, a measure how much fault current can be supplied to avoid voltage collapse at the considered node.The SCR values for a grid to be considered weak differ in literature, however, some examples are provided in [30].In the light of current developments this principle has been extended to account for the interaction of close-by IBRs, such as wind-parks, cf.[31] for details.Moreover, the amount of kinetic energy E K in the grid is used to define the grid strength [17], [32], [33] where J i and ω i are the rotational inertia and speed of the ith generator, respectively.This measure can be used to obtain the grid inertia constant H g , by relating the stored kinetic energy at the synchronous speed ω sy to the MVA rating S g of the system which is often used in the related notion of low inertia grids [10], [11], [34].The equivalent of kinetic energy for IBRs is the energy stored in the DC-link capacitors, which is significantly smaller than the kinetic energy stored in rotating machines.
An important measure during severe grid incidents is the rate of change of frequency (ROCOF), which can be related to grid quantities using the swing equation abstraction for the power grid [35] 2 H g ω sy where D g is the damping coefficient, θ g denotes the electrical angle of the grid, P e the electrical power and P m the generation power.This notation can be extend to the so-called multi-machine equation when multiple nodes are considered, this is often used for small-signal stability analysis [36], [37] in power grids.Based on (4), the ROCOF can be calculated as [38] Now it is easy to see that the resulting ROCOF is proportional to a power imbalance between generation and consumption.Further, we see that larger inertia as well as appropriate damping leads to smaller ROCOF, this stresses the importance of these grid properties, especially during large power imbalance situations that arising during faults, e.g.loss of generation or sudden load changes.
To illustrate the influence of the grid angle, voltage difference and line parameters, we consider the power flow at the PCC for the minimal power grid model in Fig. 1.The following relation for the apparent power S [30], [39] is given where x * denotes the complex conjugate of x.We obtain the active power P and the reactive power Q, by using Eulers formula and Re{S} = P , (8) where δ denotes the angle difference θ 0 − θ g .The assumptions X ≫ R, i.e. inductive grid, and small angle deviation δ, s.t.sin(δ) ≈ δ and cos(δ) ≈ 1, yields with ∆V = V pcc − V g .From the equations derived above, the typical P/f , Q/V droop characteristics can be seen.Note, the assumptions of an inductive grid mainly hold for the higher voltage levels, but usually not for low voltage grids [39] which requires additional consideration.

B. Resulting requirements for emerging technologies
Emerging technologies in the future grid must not only provide the energy and power of the synchronous machines that they supersede, but also guarantee the grid services that are essential for the resilience of the power grid with respect to disturbances or faults.We can summarize the main contributions as: • Frequency support: provision of inertia and damping on the near-instantaneous timescale or fast frequency response (FFR) on the control power timescale [40].Dedicated devices, such as flywheels or synchronous condensers, can provide inertia and damping.FFR can be provided by IBR based energy storages that have no physical inertia but can provide fast control power by adequate control and automation [17].• Voltage support: provision of adequate reactive power.
The use of dedicated devices is possible, e.g.static synchronous compensators (STATCOM).Again, IBRs can contribute reactive power depending on the operation state and implemented control.• Fault current: provision of fault current is essential for the current grid protection schemes.Synchronous condensers can inherently provide large short circuit currents.For IBRs the ability to provide short circuit currents is much smaller due to the used semi-conductor switches when related to the rated power.As is not surprising, a combination of the arising technologies can provide the needed services.However, this does not answer the question of economically and technically optimal sizing, distribution and combination of such devices which is still subject to scientific and political discussion.Many case studies for the optimal integration of IBRs exist for various systems and countries, e.g.Germany [41], Chile [42], Colombia [20], Italy [43].When considering power electronically interfaced DERs the control design of the device plays a major role, which is reflected in the recent extension of the IEEE grid stability definitions, cf.[44] by the category of converter-driven stability.Further must be noted, that the ability of DERs to provide grid services depends on the implemented control approach, which can be divided in two main groups [45] • Grid following control (GFL): The main objective of IBRs that operate as GFL is to inject active power, thus they are operated as controlled current sources and they follow the grid phase angle with the use of phase-locked loop (PLL) systems [14].They can support the grid by adjusting their power output, which is referred to as grid-supporting control [39], [46].The latter approach is being deployed and improved in the sense of FFR.However, GFL cannot directly influence the frequency since they are locked on the grid angle and rely on a grid forming element to operate.• Grid forming control (GFM): GFM converters on the other hand are controlled as voltage sources with a local frequency directly depending on the grid state [46], if combined with a droop behavior such control leads to similar intrinsic grid services as synchronous generators [14], which is considered a crucial asset for the future power grid [13]- [15].An extensive review of different roadmaps and evolving grid codes for the GFM IBR integration is given in [47] and a best practice guide in [48].

C. Emerging grid service and respective timescale
When considering the influence and role of new devices and the respective grid services in the power grid with respect to grid incidents, the question of timescales naturally arises.Figure 2 gives an overview of typical timescales concerning reserve capacities in the typically form of primary, secondary and tertiary control power.The ROCOF that follows a power mismatch, cf.(5), is determined by the available inertia in the grid.The role of the fast acting primary response is to stop the frequency drop and stabilize it, such limiting the nadir frequency.Then, the secondary control, which reacts slower, takes over and returns the frequency towards its nominal value.These two functions are typically automated in modern power grids.Tertiary control power, which is not automated but dispatched, is then used to relieve the secondary control and continue the operation at nominal conditions.Since the physical inertia is reduced by current developments, the importance of inertia provision and quick acting frequency support, e.g.FFR, to limit the frequency nadir post-incident is underlined by this generic example.This development is already reflected by the operation of some real power grids.For example island grids with high penetration of renewable generation, which are prone to large ROCOF already leverage such FFR services to increase the operational resilience, e.g. the United Kingdom (UK), Ireland and Australia [17].Further, the possibility to provide dispatchable control power in the sense of tertiary control is widely considered in demand side management (DSM) research.It should be noted that the provision of such services from distributed devices, significantly increases the dependence on the corresponding control system of power electronically interfaced devices in the early stages of faults, since the response is no longer physically guaranteed.

IV. Lessons to learn from past large-scale incidents
This section considers past incidents with respect to the implications for the retrofit of the legacy power grid.Avoiding events like these by increasing the resilience of the future power system, which will contain a large share of power electronically interfaced DERs, is crucial with respect to the Energy Security goal of the energy trilema.The key question is how to leverage the inherent properties of power electronically interfaced DERs for this purpose.
For a structured presentation of grid incidents the following taxonomy is proposed, which is based on the general structure of faults in the context of cybernetic grids provided in [49].Further, the severity classification is based on the incident classification scale defined by the European Network of Transmission System Operators for Electricity (ENTSO-E) [50].This yields the following taxonomy: • Location and date: geographic region and year of the fault origin.• Originator of the fault: component or event that caused the initial fault.• Pre-fault operating state: system state shortly before the initial incident.-Power quality issues (PQ), e.g large harmonic contents or distortions • Consequences: duration of the incident, costs caused, amount of load shed, number of people affected.The above presented taxonomy aims to provide a qualitative overview of grid incidents.For a quantitative comparison of the severity of different blackout events, Veloza et al. [27] provide suitable measures.Remark: The categories originator of the fault and pre-fault operating state are closely related and cannot always be sharply separated.If the information was available, the first event that caused a significant disturbance in the grid was chosen as the originator of the fault.

Structure of cascading blackouts
The problem of cascading failure is predominant when examining past grid incidents, as is analyzed extensively in literature cf.[26], [27].Fig. 3 illustrates the mechanism of cascading outages.Prior to blackouts, the grid state is often subject to restrictions that are not critical in themselves but have serious consequences later on.Such restrictions are, for example, the unavailability of transmission or generation capacities due to maintenance work.From such an pre-fault operation state, an initial event or fault starts the incident.Such events trigger fast transients, for examples voltage sags or a large ROCOF.In the meantime, all affected devices need to cope with the disturbances, which constitutes the fasttimescale or transient response of the system.The detection of these disturbances initiates remedial actions that aim to provide an alternative operating point for the overall system in a slow-timescale reaction, e.g.redirect the power flow to other transmission lines, switch to alternative generation devices or shed interruptible loads.These disturbances can disable or even damage further power system equipment, such as generation devices or transmission systems.Consequently, they are unavailable to support the grid.Such additional outages cause new disturbances, which again trigger a transient response of the remaining devices.If this cycle cannot be broken before a new operating point is reached, these so called cascading events will eventually lead to voltage or frequency collapse and subsequently the blackout of the system.However, if the remedial actions are sufficient, the system continues to operate in a conditionally operative state until all faults are cleared.Using real-world incidents, the next sections consider developments relevant for the future grid with respect to following mechanisms of the described cascading outages: • A. Influence of pre-incident operation on cascading events • B. Influence of extreme weather on cascading events • C. Lack of control capabilities in the post-fault grid topology • D. Power flow and operation after the initial transients • E. Lack of situational awareness and system understanding • F. Reliance on communication and cyber security • G. Malfunction of devices and automation equipment All incidents presented throughout this paper are summarized in Table 1.

A. Influence of pre-incident operation on cascading events
The pre-incident state of the grid has a strong influence on the course of later events and significantly shapes the resilience of the power grid.Many of the real-world incidents presented throughout this paper show constraints in the pre-incident state.These constraints alone are not critical, but significantly contribute to the unfolding of cascading events in case of a grid fault.Noteworthy restrictions are: the lack of adequate system maintenance, unavailability of reserve capacities, N-x violations as well as the lack of situational awareness or monitoring tools.Further, unusual load flow situation can precede grid incidents as reported in I2 -Italy2017.Lessons and developments for the future power grid: The rising number of devices reduces the dependency on the individual contribution and thus maintenance is less critical.Moreover, the advances in information technology and increased wide areas monitoring systems (WAMS) allow for a better monitoring of the system health and detect unusual situations in early stages.An overview of such projects in Europe is given in [95].The integration of fastreacting power electronic devices can be used to increase the fast available reserve capacities.Moreover, it is important to consider that the widespread use of DERs has a large potential to cause new load flow configuration, which can cause unexpected problems.Incident overview: influence of pre-incident operation • Lack of system maintenance: I1 -USA2003 • Unavailability of reserve capacities: I2 -Italy2017, I3 -China2008 and I5 -Texas2021 • N-x violations: I4 -Canada2016, I7 -Swe-Den2003, I9 -India2012 and I11 -Turkey2015 • Lack of situational awareness and monitoring tools: I9 -India2012 and I12 -USA2019 • Unusual load flow configuration: I2 -Italy2017 I1 -USA2003 Northeastern USA, 2003 [26], [51], [52].Trip of several transmission lines due to tree contact (TN) and subsequent overload (NV).Normal operation prior to the initial event, but several monitoring systems, such as state estimation, were offline (LT) and the overall system was poorly maintained, e.g.insufficient vegetation management [52].Inadequate system understanding and the lack of situational awareness [51], [52] contributed to the cascade of events and subsequent blackout (BO).Approximately 50 million people were affected, 61.8 GW of electric load was disconnected.It took four days to one week to restore the grid for all consumers.
I2 -Italy2017 Southern Italy, 2017 [53].The combination of very low consumption, large voltage angle and an unusual load-flow configuration due to the unavailability of some generators (PG) as well as large power imports, caused an oscillatory event of the system voltage (VV).The incident was detected by several generators and the system operator.The amplitude of the oscillation (PQ) was roughly 10 kV with a frequency of 0.29 Hz.Remedial action was taken by reducing the load flow on some transmission lines to reduce the voltage angle.In addition, a shunt reactor was opened to create a discontinuity in the oscillatory loop.These actions were sufficient to mitigate the problem and no further consequences resulted.

B. Influence of extreme weather on cascading events
Extreme weather conditions have a harsh influence on all aspects of the power grid.As large amounts of the transmission system are above ground, they are prone to be damaged during events like severe thunderstorms.Further should be noted that redundancy can be futile for common-cause failures, as for example damage to geographically close transmission lines by extreme weather.The strong dependency on the transmission system stems from grid topologies with centralized generation units.Furthermore, extreme weather shows vast influence on demand and generation, cf.usage of heating ventilation and air conditioning systems strongly correlates with the weather.Moreover, unusually low or high temperatures cause problems for conventional steam-cycle generation plants, that often rely on cooling by natural waters [96].Another effect of extreme weather is that on market mechanisms: unexpected demand can cause high prices for the short-term purchase of supply capacities during extreme temperature periods.This effect is especially visible in case of competition for the same primary resource, e.g.gas or coal.
Lessons and developments for the future power grid: The effects of extreme weather must be carefully considered during planning of the future power grid since extreme weather will become more frequent [97], [98].The inherent distributed nature of renewable generation enables local load balancing as well as microgrid approaches, which can be leveraged to reduce the dependency on transmission systems.Moreover, accurate demand and generation forecasting as well as the reconsideration of necessary emergency supply in the light of changing climate will become a pressing issue.

Incident Name
Classification Key insights Sources I1 -USA2003 BO, TN, NV, LT Pre-incident system situation, e.g.maintenance, is crucial to prevent cascading outages [26], [51], [52] I2 -Italy2017 VV, PG Unusual load flow can give rise to unexpected phenomena, such as oscillations [53] I3 -China2008 BO, TN, SG, PG Extreme weather affects the cooling of steam-cycle based generation [54] I4 -Canada2016 BO, TN, SG, FD Geographically close transmission lines are prone to common-cause failures [55] I5 -Texas2021 PG Extreme weather affects demand and market mechanisms, e.g.price [56] I6 -Flensburg2019 BO, TN, SG, FD Grid services from DERs can help to sustain unintentional islands after separation [57] I7 -Swe-Den2003 BO, PG, LT, RR Unrelated, second events can cause a post-fault system to collapse [26], [58] I8 -Europe2021 TN, SG, FD Changed power flow is a major challenge during cascading events [59] I9 -India2012 BO, TN, NV, PG Lack of situational awareness can inhibit timely counter measures [60], [61] I10 -India2013 BO, TN, IL PMU measurements supports situational awareness during adverse grid states [60], [61] I11 -Turkey2015 BO, TN, FD, PG Lack of system understanding can lead to counterproductive remedial actions [62] I12 -USA2019 PG, LT Unreliable measurements can obstruct situational awareness and cause incidents [63], [64] I13 -Ukraine2015 BO, PG, LT Cyber security plays an increasing role for the future power grid [65], [66] I14 -Germany2022 LT Provision of grid services by DERs relies on safe and reliable communication [67] I15 -Italy2003 BO, TN, LT, SG Unresponsive automation equipment is an accelerator for cascading events [26], [27] I16 -Netherlands2015 BO, LT Human error can contribute to severe grid incidents [68] I17 -PV-Systems2018 PQ Bandwidth of control system interactions ranges over several magnitudes [69] I18 -China2017 PQ, VV Control design has an impedance shaping effect, which can cause interactions with the neighboring grid and lead to severe incidents [70] I19 -USA2009 TN, PQ, PG Grid faults cause fast transients that can trigger oscillatory incidents [71], [72] I20 -USA2011 PQ Switching events and grid faults cause fast transients that can trigger oscillatory events [73] I21 -Germany2017 PQ Update of the control system was sufficient to mitigate oscillatory problems [74] I22 -UK2019 BO, VV, LT, PG, FD Fast-timescale grid disturbances, here lightening strikes, can initiate unexpected control system responses that lead to large-scale blackouts [75], [76] I23 -China2012 PQ, PG Even small changes to the grid state can start and end oscillatory phenomena [77], [78] I24 -Germany2015C PQ Plants with many paralleled devices require detailed analysis to understand [79], [80] I25 -France-Spain2015 PQ, TN Highly detailed models or even physical replicas may be required for post-analysis [81] I26 -Australia2016 BO, TN, PG Lack of rotational inertia causes vastly different frequency response to grid faults, resulting in larger ROCOF that can drive cascading events [82], [83] I27 -China2018 PQ Weak grids are one of the contributing factors to oscillatory incidents [84] I28 -Netherlands2000 PQ High penetration of DERs can cause harmonic problems through device interaction [85]- [87] I29 -Germany2015A PQ, VV Significant harmonic emissions in low voltage areas stem from power electronic devices and single phase connection can cause considerable voltage imbalance [88]- [90] I30 -Germany2015B PQ Power electronic consumer devices shift the resonance frequency of low voltage grids to lower values, which are more likely to be excited by harmonic emission [91] I31 -Switzerland1995 PQ Incorporation of new devices can cause unexpected interactions via the transmission system, such incidents can be highly dependent on the loading situation [92] I32 -Germany2013 PQ, TN Small scale grids with few resistive loads have vastly different impedance properties [93] I33 -Germany2019 PQ Harmonic emissions can excite weakly damped resonances in the adjacent grid [94] VOLUME , 7 This article has been accepted for publication in IEEE Open Journal of Power Electronics.This is the author's version which has not been fully edited and content may change prior to final publication.This is stressed by the direct physical relation of renewable generation to weather parameters, e.g.wind-speed and solar irradiance.In the case of unexpected changes the production can drop near-instantaneously, this new dynamic is a further challenge for system operators.The speed must be matched by remedial actions, e.g.fast acting voltage support through STATCOMs or other flexibility [99] instead of slow manual redispatch.
In contrast to the impression that no lessons were learned from past events with extreme weather conditions, it must be noted that certain improvements were made, e.g.lightening strike protection of transmission system.However, it is not economically feasible to fortify the system against all weather influence, since, for example, all overhead lines would have to be replaced and thus a certain operational risk is tolerated.
The grid gradually degenerated due to the extreme weather conditions, falling into small islands (SG) which eventually collapsed (BO).Inadequate emergency communication and the lack of self-adaption ability are identified as driving factors [54].A total of 257 million people were affected and 6.2 TWh of load were disconnected.

I4 -Canada2016
Canada, 2016 [55].Multiple lightening strikes damaged parallel transmission lines (TN), showing the vulnerability to common-cause failures during extreme weather conditions.Due to scheduled maintenance on the transmission system (RR), light loading conditions were reported before the blackout.The transmission system failure resulted in system separation (SG), the formed island collapsed due to power imbalance and insufficient frequency regulation.The caused severe over-frequencies (5.7 Hz) (FD) forced an emergency shutdown of further equipment, leading to a blackout (BO).A total of 250 MW of load was blacked out for roughly 3 hours.

I5 -Texas2021
Texas, 2021 [56].Extreme cold weather caused high demand from electricity driven heating systems, as well as problems at various generation facilities (PG).Market mechanisms exacerbated the situation by causing high prices that eventually led to severe load shedding.Up to 16.5 GW of load was shut off, resulting in a total of 500 GWh of undelivered energy due to the supply shortage.

C. Lack of control capabilities in the post-fault grid topology
An often encountered problem in post-fault grid topologies is the formation and collapse of unintentional islands, for example due to grid separation caused by transmission line faults.The separation itself is not necessarily critical, but those islands often simply lack the control tools to sustain themselves and consequently collapse.This is driven by the limited number of devices that provide certain grid services, for example primary frequency regulation.Until recently, most DERs were designed for maximum yield and therefore behave like uncontrolled current sources from the perspective of the overlaying power grid.
Lessons and developments for the future power grid: From a topological point of view, these problems can be reduced by organizing the power grid into microgrids [39], [100]- [105], which are capable of intentional islanding and can sustain themselves for a defined amount of time.Alternatively, virtual power plants [106], [107] can be used to provide important grid services in such cases.This increases the time to locate and clear the initial fault and restore situational awareness, reducing the risk of cascading events.Moreover, an important development in this context is the transition from GFL towards GFM control strategies as detailed in [108] and the references therein.Devices that are controlled in such a manner are capable of sustaining and supporting the grid [109], while working in parallel mode during nominal grid operation.Moreover, it will be important that the expected large number of DERs contribute grid services, e.g.FFR and reactive power provision as well as robustness to grid faults and disturbances, e.g.fault ride through capabilities [57], [110].This development can increases the resilience of the grid with respect to control capabilities.
Incident overview: formation and collapse of island grids • Unintentional island due to transmission line fault: I6 -Flensburg2019 • Unintentional island due to extreme weather conditions: I3 -China2008 and I4 -Canada2016 I6 -Flensburg2019 Flensburg, Germany, 2019 [57].A transmission line failure (TN) due to a short circuit in an underground cable resulted in islanding of the local system (SG).The high power export before the event caused a large over-frequency (FD).The ROCOF of the event tripped the only generator capable of frequency regulation, which eventually led to the collapse of the islanded system (BO).The blackout lasted around 3 hours and affected 50 MW of local load and 50 MW of power export to Denmark.

D. Power flow and operation after the initial transients
From a slow-timescale perspective, the changed power flow is the dominant effect during cascading outages.A major problem is the overloading of parallel systems, e.g.transmission lines, which are required to provide alternative routes for the power flow.Related remedial actions, for example redispatch or load shedding, aim to provide a new operating point for the system without overload any of the remaining components.This is essential to avoid uncontrolled, cascading failures.In the case of sufficient remedial actions, the system remains in an operative state, see I8 -Europe2021.These grid states are highly vulnerable, because certain rules that normally apply, e.g.N-x redundancy or common load flow situation, are violated during the recovery time of the affected equipment.Unrelated, second events that lead to cascading events are highly unlikely, but not impossible as I7 -Swe-Den2003 shows.
Lessons and developments for the future power grid: The deployment of microgrid concepts and local balancing of loads using distributed generation can support the remedial actions by increasing the controlability of the power flow or self-sustaining capabilities until the initial fault is cleared.Increasing availability of devices that participate in demand side management [111] programs can be leveraged during such events to support the grid [112], [113] by providing reserve capacity.I7 -Swe-Den2003 Sweden-Denmark system, 2003 [26], [58].The initial event was the loss of a 1.2 GW nuclear power plant in southern Sweden due to problems with a steam valve (PG).This resulted in the need to import more power from the north, but the system remained within limits.A second, unrelated incident was the failure of substation equipment (LT) that led to cascading events and subsequent blackout (BO).This an example of an outage during conditional operation [58] after sufficient remedial action following a first incident.Several components were unavailable due to scheduled maintenance (RR) before the initial event, but the overall system was not stressed.The blackout affected a total of 6.55 GW of load and 4 million people.
I8 -Europe2021 Continental Europe Synchronous Area, 2021 [59].The initial event was a failure at a substation in Croatia, which was followed by system separation (SG) due to outages of several transmission system elements (TN) that were overloaded by the resulting change in power flow.
The separation resulted in a power imbalance of 6.3 GW and caused large frequency deviations (FD) with a nadir of 49.74 Hz and 50.6 Hz, respectively.The remedial actions of the transmission system operator (TSO), including generation reduction and shedding of interruptible loads, were sufficient to prevent a large-scale blackout.

E. Lack of situational awareness and system understanding
The lack of situational awareness is a key driver of cascading outages, since remedial actions can only be taken by automation systems or control room personal based on available information.Situational awareness encompasses multiple closely related facets: the reliability and availability of measurements, the timeliness of data and the provision of communication between different entities.Closely related to the topic of situational awareness is that of system understanding.A lack of system level understanding can hinder effective remedial actions or even lead to counterproductive ones, especially during grid faults when timely actions are essential.Moreover, impaired system level understanding or situational awareness can be seen as a reason why, in hindsight, it seems that not enough lessons were learned from past incidents, e.g. the influence of the current operating conditions, as for example N-x violations or unavailable reserve capacities, were not correctly judged due to the lack of information during abnormal operating conditions.
Lessons and developments for the future power grid: On the one hand, the task of achieving situational awareness as well as a system level understanding is further complicated by the rapidly growing number of DERs.Moreover, the faster dynamics of the future grid and the lack of experience in operation of such grids by grid operators is a major challenge.On the other hand, the distributed devices provide the possibility to collect measurement data without much additional effort, since the devices rely on local measurement data for their control.This can be exploited especially in poorly instrumented areas of the grid.However, since the designed behavior, e.g.provision of grid services, of power electronically interfaced devices depends on accurate and timely measurements, the provision is a key task in the future power system.As mentioned before, the situational awareness is vastly increased by the deployment of WAMS based on phasor measurement units (PMU), the effectiveness of such approaches is described in [60], cf.I10 -India2013.
The faster dynamics of the future grid due the use of IBRs is a challenge for current measurement systems as already recognized by system operators [114], [115].
Incident overview: lack of situational awareness and system understanding • Lack of available measurement data: I9 -India2012 • Increased situational awareness through PMU use: I10 -India2013 • Lack of reliable measurement data: I12 -USA2019 • Lack of system understanding: I1 -USA2003 and I11 -Turkey2015 I9 -India2012 Northern India, 2012 [60], [61].A major transmission line tripped due to overload (TN) caused by unexpectedly high demand.The lack of available measurements prevented timely load reduction, demonstrating the importance of real-time measurement of the grid condition.
Prior to the blackout (BO), transmission line redundancy was unavailable due to maintenance (NV).A total of 32 GW of generation capacity (PG) was separated from the grid.The outage affected 620 million people, 80% of the system was restored within 15 hours.

I10 -India2013
Odisha, India 2013 [60], [61].Extreme weather conditions caused by a cyclone led to several outages in the transmission network (TN).The grid was in nominal operation before the first incident.Roughly 15 GW of load was shed (IL) and power outages (BO) in more than 3000 villages occurred, but the connection to the main grid was maintained due to adequate situational awareness [60] provided by newly installed PMUs.
I11 -Turkey2015 Turkey, 2015 [62].A transmission line failed due to overload (TN).The subsequent cascade of events caused severe under-frequencies (FD) due to the large power imbalance, which was accelerated by premature generator trips (PG).The transmission corridor was heavily loaded prior to the incident and several parallel transmission systems were unavailable due to maintenance (NV).Further, the remedial actions were partly counter productive due the lack of system understanding [62].The cascading events were followed by a total system blackout (BO).Within 6.5 hours, 80% of service was restored.
I12 -USA2019 USA, 2019 [63], [64].A fault in the control system of a steam turbine of a combined cycle power plant (PG) resulted in a 0.25 Hz oscillation (PQ) that lasted 18 minutes.This excited the natural frequency of the transmission system (Easter Interconnection) and therefore propagated across a large area.Situational awareness in the power plant was obstructed because the alarm system and control system relied on different measurements that did not coincide (LT).Severe consequences did not occur due to sufficient damping of the mode [63].

F. Reliance on communication and cyber security
When relying on distributed information and interconnected devices to operate critical infrastructure, the question of cyber security naturally arises.But not only targeted attacks pose a threat in this regard, since DERs are supposed to contribute ancillary services in the future power grid, the reliance on available communication poses new challenges with respect to reliability.
Lessons and developments for the future power grid: The emerging smart grid is complex cyber-physical system that consists of numerous devices that need to be orchestrated and communicate with each other [116].This brings inherent cyber security threats [8] ranging from the attack on single devices over obstructing situational awareness to leveraging involved humans to gain access into the system.Moreover, the close link between information technology and the physical system gives rise to new challenges as for example the influence of communication time delays on the stability of cyber-physical systems [9].Such effects are of special interest, since the DERs must provide fast timescale services to counteract the effects of reduced physical inertia.Incident overview: cyber security and information technology • Cyberattacks as a threat: I13 -Ukraine2015 • Reliance on communication: I14 -Germany2022 I13 -Ukraine2015 Ukraine, 2015 [65], [66].Cyberattacks on various power stations (PG) in Ukraine caused largescale outages (BO), and additionally hindered the grid restoration process (LT).This was the first publicly acknowledged cyberattack leading to a widespread blackout.Around 225 thousand customers were affected for several hours.

I14 -Germany2022
Germany, 2022 [67].Due to the outage of the satellite communication system (LT) the remote control and monitoring ability for roughly 5800 wind turbines with a total of 11 GW was lost (PG).The wind turbines continued to operate in the default autonomous mode and no further consequences occurred.

G. Malfunction of devices and automation equipment
The malfunction of devices and automation equipment in the face of adverse grid situations is a common driving factor during cascading events.Even if the systems are designed to behave a certain way, it is crucial that this behavior is robustly maintained under faulty conditions, for example the device trips must not occur prematurely or unexpectedly.Cascading events are driven by such successive equipment failures, which in turn cause new disturbances and further decrease the available resources.
Closely related to the malfunction of automation equipment is the contribution of human error, that can cause significant grid disturbances if undetected.
Lessons and developments for the future power grid: With the fast rising diversity and number of devices actively contributing to the power grid, the mechanism of malfunction or unexpected behavior is likely to gain importance and underscores the necessity of robust fault ride through capabilities [51] as well as extensive testing in suitable experimental environments [117], [118].However, concerning human error, which can never be ruled out, it can be expected that modern control room technology and improved situational awareness by additional measurements and information technology support can increase the system resilience.
Incident overview: malfunction of devices and equipment • Malfunction of devices: unresponsive automation equipment I15 -Italy2003 and premature trips of generators I11 -Turkey2015 • Contribution of human error: I16 -Netherlands2015 I15 -Italy2003 Northern Italy, 2003 [26], [27].The trip of a transmission line (TN) due to a tree flashover initiated a cascade of events, which was driven by unresponsive circuit breaker automation systems (LT) as well as inadequate redistribution of power flow.This resulted in a separation from the European grid (SG) and the subsequent collapse due to the large power imbalance.Before the incident, system operation was normal, but a large amount of power was imported.The nationwide blackout (BO) lasted for several hours.

I16 -Netherlands2015
The Netherlands, 2015 [68].Short circuit failure in a high-voltage substation due to equipment failure (LT) and human error.The fault occurred during normal operation while conducting a changeover in order to test previously maintained equipment.No problems were reported prior to the incident.About 1 million households were affected by the blackout (BO), and the fault lasted about 6 hours.

V. Arising incident mechanisms favored by large ratios of converter interfaced grid participants
This section discusses real-world incidents which are associated with high shares of power electronically interfaced DERs.All presented events are summarized in Table 1.Since the behavior of such devices is shaped by control and automation, the newly arising mechanisms are mainly rooted in interactions between the control system and the adjacent grid or neighboring devices.Power electronics have been long known as a source of oscillatory phenomena [119] and due to the large bandwidth of modern control systems for such devices, the corresponding oscillatory phenomena range over several orders of magnitude.In the following, the frequency bandwidth of such events is discussed with respect to the contributing parts of the control system.Afterwards, the impedance shaping effect of the control system is illustrated using a real-world example.Lastly, fast transients as initial events for such interactions are reviewed.In literature, it is common to classify oscillatory phenomena with respect to frequency.However, the terminology and corresponding definitions vary and overlap as summarized in the following • Sub-synchronous: 0 − f 0 [71], [77], also described as sub-harmonics [120].Here f 0 denotes the base frequency of the grid, commonly 50 Hz or 60 Hz.• Near-synchronous: 0 − 2 f 0 [121], also referred to as base frequency sideband oscillation [29].The term super-synchronous oscillation is used in [84] for resonances with frequencies larger than f 0 .• (Inter)harmonic: 2 f 0 − few kHz [121].As noted in several publications, the term harmonics is misleading [122], since the frequency of several phenomena are not integers of the fundamental frequency [120], the term interharmonics is more appropriate when referring to resonance-generated distortions of voltage and current.This is in accordance with IEC6000-2-2 [123], where interharmonics are defined as frequencies between the harmonics of the voltage and current, which can appear as discrete frequencies or as wideband spectra [120], [123].• Supraharmonics: 2 kHz − 150 kHz [124], [125], also referred to as high-frequency harmonics [126].Due to the significant overlap and redundancy of the definitions, the present paper uses the following frequency taxonomy: sub-synchronous 0−f 0 , interharmonics f 0 − few kHz and supraharmonics 2 kHz − 150 kHz.

A. Oscillatory interactions rooted in the control system
In the following, we consider the control system design of power electronically interfaced devices as a source of interaction with the grid.Changes to the control system often mitigated such problems [127], which underscores the importance of adequate behavior generation for converter systems.Several mappings to likely origins of oscillatory phenomena can be found in literature [29], [93], e.g.Fig. 4 shows a generic cascaded converter control system with the mapping to corresponding frequency ranges [29].
• Sub-synchronous oscillations: Since outer control loops such as alternating voltage control (AVC), direct voltage control (DVC) [29] or power control [128] are usually designed with a small bandwidth, they are prone to cause sub-synchronous oscillations.Real-world examples include wind turbines and adjacent series compensated transmission or HVDC systems [129].This phenomenon has been studied in detail, cf.[130] and the references therein.Such sub-synchronous oscillation can lead to torsional interactions and even mechanical damage if they excite a natural mode of the turbine.This type of incident is also well known for traditional generators, cf. the first documented occurrence at the Mohave generation station in the 1970s [131], and is well understood [132].However, such incidents are not limited to rotating generators and sub-synchronous oscillations can also occur with large-scale PV systems [69].Further, plan- ning studies for the integration of large-scale PV plants show that inadequate reactive power control strategies can cause sub-synchronous oscillations following grid disturbances [133].• Interharmonic oscillations: Interactions between the inner current control or the phase locked loop (PLL) and the grid impedance are prone to cause oscillations in the interharmonic and near-synchronous range [29], [121], [134], [135].Real-world examples often include interactions between neighboring systems, e.g.HVDCsystem and the AC grid, or between devices connected in parallel, as for example large-scale PV systems with many inverters or residential areas with a high penetration of power electronic devices such as rooftop PV systems and electric vehicle charging.• Supraharmonic oscillations: Frequency-coupling mechanism of the switching modulation [136] and the sampling process [137] can cause resonance phenomena in the supraharmonic range [29].For supraharmonics the location dependence is strongly increased [138], which makes predictions difficult.Further, the magnitude of the frequency contributions in the range between 4 kHz and 25 kHz is strongly dependent on the interaction between the devices involved, which is explained by the filter effect of the input impedance of the systems [88].
This classification according to frequency illustrates that the phenomena are not strictly related to the technology involved, but rather to the control strategy used as well as the grid topology.The measurements provided in I17 -PV-Systems2018 show that the interaction frequency ranges over a large bandwidth even for similar plant types.Additional losses and space requirements combined with the described large bandwidth of the oscillatory events are the main reasons why passive filters are usually not considered to resolve such problems [69], [93].Figure 5 gives an overview of the frequencies detected during the incidents described in the present paper and again illustrates the large bandwidth of oscillatory events.
Lessons and developments for the future power grid: Advanced measurement system using PMUs are adopted in various grid areas, e.g.Nordic Power Network, China, Swissgrid, Southern California, Manitoba [139], to detect unwanted low frequency oscillations and initiate appropriate counter measures.The extensive literature review in [140] discusses how the appropriate control of renewable resources, e.g.large PV plants or WTG, can be leveraged to provide grid services to dampen oscillations and how they can be used in wide area damping system.Concerning higher frequency oscillations several developments on the device level are of importance: (i) advanced converter topologies, e.g.(reduced switch count) multi-level converters [141], that have inherently improved properties; (ii) advanced control and modulation schemes that improve the power quality of power electronic devices [142].

Incident overview: bandwidth of oscillatory interaction
• Sub-synchronous oscillations: -Wind turbines or farms: I22 -UK2019, I19 -USA2009, I20 -USA2011 and I23 -China2012 -STATCOM and adjacent grid: I27 -China2018 -Large-scale PV plants: I17 -PV-Systems2018 • Interharmonic oscillations: -Offshore wind farm: I32 -Germany2013 as well as I21 -Germany2017 -Railroad system: I31 -Switzerland1995 -STATCOM and adjacent grid: I27 -China2018 -HVDC connection: I25 -France-Spain2015, I33 -Germany2019 and I18 -China2017 -Residential electric vehicle charging and roof-top PV: I29 -Germany2015A -Large-scale PV plants: I17 -PV-Systems2018 as well as I16 -Netherlands2015 • Supraharmonic oscillations: -Residential electric vehicle charging and roof-top PV: I29 -Germany2015A -Large-scale PV plants: I17 -PV-Systems2018 I17 -PV-Systems2018 Various PV systems, 2018 [69].Field measurement data from large-scale PV systems (undisclosed locations) ranging from 100 kW to 10 MVA are presented.Rough topological information about the plants is provided, but no detailed models are presented.No information about the employed control strategy is available, but a contribu-tion from the automation/control system design is strongly suspected since the automated restart of the system resolved the problem.Prior to the events no obvious restrictions were reported, but some were preceded by utility switching.Two cases of low-order harmonic interactions between parallelconnected inverters are presented, which result in oscillations with 420 Hz (7 th harmonic) and 780 Hz (13 th harmonic), respectively (PQ).Further, a supraharmonic oscillation was reported at 2370 Hz (PQ).The last provided example is an interharmonic oscillation that caused a 20 Hz modulation of the grid RMS voltage (PQ).No fallout was reported as a consequence of the described events.

B. Impedance shaping effect of the control system
A common abstraction related to oscillatory incidents in power grids is that of parallel and series resonance [143]- [146] and parallel and series instabilities [29].As detailed in [29], the additional consideration of the control system of the power electronic devices adds the control output impedance, which distinguishes harmonic instabilities from harmonic resonances.The control system therefore has an impedance shaping effect which can be the root cause for interaction with other devices.Lessons and developments for the future power grid: The rising number of power electronic devices will increase the importance of this interaction mechanism.Due to the complex nature of such interaction, the of open source control software or models for converter system as proposed in [127] is highly important when combining system of different vendors in real-world scenarios.Further should be noted that the impedance shaping effect can also be leveraged in control design, e.g. to avoid harmonic interactions [147] or to improve harmonic power sharing [148].Incident overview: impedance shaping effect of the control system is given in I18 -China2017.I18 -China2017 China, 2017 [70].After the disconnection of several AC transmission lines a 1270 Hz resonance was detected between a HVDC-VSC and the AC-grid (PQ), the phase to neutral voltage of the oscillation reached 68.9 kV (base voltage 800 kV) (VV).A later analysis [70] identified the negative real part of the HVDC-VSC impedance at high frequencies as a main cause.The combination of a feedforward term and the control delay caused this behavior [70].Extensive simulation of the possible combinations of paralleled devices is required to rule out negative real part regions for all devices and operating states [70].The system remained functional during the incident and no fallout was reported.

C. Fast transients as initial events for oscillatory control system interaction
As discussed above, the rapidly growing ratio of DERs in the grid introduces new interaction mechanisms that can lead to new types of incidents.Uncommon grid states are of special interest when evaluating the robustness of designed desired behavior of such devices.As discussed with respect to cascading outages, fast timescale incidents can be associated with various grid events.They can cause oscillatory interactions between the grid and the control system of converter devices as shown in the following.If these interactions contribute or lead to cascading events, they can cause far-reaching grid disturbances or even blackouts.Examples for events that cause fast transients in the grid are faults and switching events.Both cause sudden changes in the grid topology and thus the grid impedance [149], leading to transients of the voltage and current.Consequently, both mechanisms are prone to provoke similar responses of the grid participants.
Lessons and developments for the future power grid: Due to the rising number of active participants in the future grid, the number of faults and switching events can be expected to increase, therefore this mechanisms should be closely monitored and studied to find suitable countermeasures.Furthermore, it is necessary to extensively test the used control and automation systems in close-to-reality scenarios, including uncommon or unlikely fault states to gain further insights.Note that for several of the incidents described in I17 -PV-Systems2018, no initial event could be found, indicating a complex dependence on a variety of factors.Incident Summary: fast transients as initial events • Faults as initial event: lightening strike in I22 -UK2019 and transmission line fault in I19 -USA2009 • Switching events as initial event: I20 -USA2011 and I21 -Germany2017 I19 -USA2009 Texas, USA 2009 [71], [72].During a transmission line fault (TN), the changed grid conditions caused a sub-synchronous control interaction between the series compensated transmission system and a wind farm (PQ).The authors of [71] suggest that more topologies, including N-1 or N-0 cases, should be included in simulation during planning in order to improve system understanding in the event of faults.Several wind turbines were damaged by the resulting over-currents (PG).
I20 -USA2011 USA, 2011 [73].Switching events during the commissioning of a series compensation system triggered a sub-synchronous oscillation with 9 − 13 Hz (PQ).It was caused by the interaction between a wind park and the adjacent transmission system.No fallout occurred.
I21 -Germany2017 Germany, around 2017 [74].Switching events in the onshore grid triggered sustained harmonic distortion of the currents in the frequency range of 1500 − 1800 Hz (PQ) in a HVDC system connecting an offshore wind farm.Measurements of the observed phenomena and of the behavior after the problem was solved are presented.The issue was resolved by a control system update and no further fallout resulted.

VOLUME , 13
This article has been accepted for publication in IEEE Open Journal of Power Electronics.This is the author's version which has not been fully edited and voltage dip (VV) [76], which triggered an unexpected oscillatory control system response (LT) in a large wind farm.This resulted in the loss of 737 MW of wind power generation (PG), a subsequent large ROCOF (FD), and ultimately a cascading blackout (BO).The system was not stressed prior to the incident.Roughly 1.1 million consumers were without power for 15-45 minutes, and significant disturbances in the rail network were reported.

D. Complexity and sensitivity of oscillatory incidents
Many of the presented incidents describe manifold influencing factors that lead to the observed phenomena.These influences include the number of paralleled devices, especially in clustered generation facilities such as large-scale PV systems or wind farms.During an oscillatory event, small changes to the grid impedance can suffice to end the event, such as the trip of wind turbines due to persisting harmonic currents, cf.I23 -China2012.The mentioned complexity is supported by the analysis of I25 -France-Spain2015, where it is noteworthy that physical replicas of the control systems were necessary to recreate the incident during post-analysis, since all software models provided by the manufactures did not show the observed behavior [81].This again stresses the importance of the control system for the behavior generation of power electronically interfaced devices.The complexity of such phenomena, that includes exact knowledge of the behavior of neighboring systems, is a reason why it is difficult to learn from past incidents in the sense of preventing them in new applications.However, progress can be seen in faster remedial actions and available mitigation strategies that can be adapted from similar incidents after the problem occurred during commissioning or under certain operational conditions.
Lessons and developments for the future power grid: The large number of IBRs and the faster system dynamics in the future power grid will likely increase the complexity of interaction mechanisms.This shows the necessity to research solutions to cope with this development, such as for example microgrid or cellular approaches.Furthermore, this development demonstrates the need for extensive system level testing in close-to-reality laboratory environments to foresee and understand arising interaction mechanism [118].Moreover, it is troubling from an engineering point of view, that often no initiating event can be identified, cf.I17 -PV-Systems2018.I23 -China2012 Northern China, 2012 [77], [78].A subsynchronous oscillation (6)(7)(8) occurred between a wind farm and a series compensated transmission system (PQ).Such phenomena are highly dependent on loading/damping situation that shapes the grid impedance [77].Further influences include the number of wind turbines connected in parallel as well as the control system used and its parameters [78].The oscillation caused large harmonic currents that tripped several wind turbines (PG), after which the event ceased.
I24 -Germany2015C Germany, around 2015 [79], [80].During low-voltage ride through (LVRT) testing of largescale PV systems, the change in grid impedance caused stability problems with standard tuning of the inverter control systems (PG).The many paralleled inverters in largescale PV power plants must be considered and studied in detail [80] to understand these interactions.In addition, the transition from traditional current-controlled sources to adaptive control or voltage source control is recommended [80].Besides power quality issues no further fallout was reported.
I25 -France-Spain2015 NELFE VSC-HVDC link between France and Spain, 2015 [81].Through harmonic interaction of the HVDC-system and the adjacent AC-grid an oscillation event (PQ) with a frequency of 1700 Hz was triggered [81].A complex dependency of multiple factors including the AC network configuration, shunt impedance as well as the grid strength (shot circuit ratio) is described.The incident led to a trip of the HVDC-link (TN).

VI. Structural developments resulting from high penetration of converter technology
In the previous sections, we discussed the lessons learned from large-scale incidents in legacy grids as well as the newly arising mechanisms of control system interaction with the grid.In the following, we focus on real-world incidents that show the structural developments resulting from high ratios of power electronically interfaced devices, cf.Table 1 for a summary of the presented events.First the reduction of physical system inertia is discussed, then observations from the lower voltage level are presented.This is followed by incidents illustrating the changed resonance properties of modern grids as well as examples for the complex dependency and sensitivity to various factors of oscillatory events.

A. Reduction of physical system inertia and grid strength
One of the most severe structural consequence of the high penetration of renewable generation devices is the reduction of system inertia.This results from the lack of spinning masses, as for PV or fuel cell systems, or from the inaccessibility of the inertia due to the power electronic interface, e.g.hidden inertia [150] of wind turbines.As a result, the frequency response of the power grid in terms of ROCOF and nadir [150] following grid disturbances changes significantly, which can lead to grid incidents and even blackouts.Lessons and developments for the future power grid: To counteract this development and achieve interoperability with the legacy grid, the inherent grid services of conventional generation units can be emulated using the control design of power electronic devices, c.f. virtual/synthetic inertia [34], [151]- [153].These changes in the system behavior must be monitored closely, since large power imports/exports prior to separation events have already led to large RO-COF in legacy grids, as shown in I6 -Flensburg2019, I8 -Europe2021, I11 -Turkey2015 and I22 -UK2019.Closely related are so called weak grid conditions, as characterized by the effective short-circuit ratio [84], which can contributed to oscillatory interactions.This development has been recognized by grid operators and the potential of GFM devices to provide inertia is expected to be leveraged, as indicated by the roadmaps for different grids, e.g.Kauai (Hawaii) [154], Puerto Rico [154], UK [24] and Europe [155].Furthermore, the use of dedicated devices to provide grid services such as synchronous condensers, STATCOMs, flywheels or BESS is being considered by relevant authorities.Incident overview: reduced physical inertia and grid strength • Consequences of reduced inertia: I26 -Australia2016 • Contribution of weak grid conditions: I27 -China2018 and I25 -France-Spain2015 I26 -Australia2016 Southern Australia, 2016 [82], [83].
A severe storm disabled several transmission lines (TN).About 52% of wind generation (PG) was lost within minutes due to unforeseen behavior of the wind turbine control systems.Prior to the incident, the system operated with a large share of renewable generation and only few synchronous machines [82].The reduced system inertia caused an unexpected frequency response that contributed to the outage.This is the first reported large-scale blackout (BO) in a grid with high penetration of renewable generation.Seven million people were affected and the financial loss was approximately 367 million Australian dollars.
I27 -China2018 Southern China, 2018 [84].The interaction between STATCOMs and a weak AC/DC grid caused sub-and super-synchronous oscillations (PQ) with 2.5 Hz and 97.5 Hz, respectively.According to [84], the main influence of the observed phenomena is the weak grid condition characterized by the effective short-circuit ratio (ESCR) [84], further contributions are the grid topology as well as the converter control strategy and parametrization.The incident resulted in the saturation of the STATCOM output as well as a reactive power imbalance.

B. Consequences for residential low voltage grids
The growing share of decentralized generation on the lower voltage level, e.g.roof-top PV systems, as well as the widespread use of modern power electronic consumer devices, for example electric vehicle charging, pose new challenges.In the legacy grid the lower voltage level could be considered as a mere statistical load, but this assumption is rapidly losing its validity.Single phase connected devices, which are common for small roof-top PV or low-power electric vehicle charging, can lead to significant voltage imbalance as reported in I29 -Germany2015A.Furthermore, modern power electronic devices exhibit non-negligible harmonic emissions which can interact with others through the transmission network.Further, the widespread use of power electronic devices has consequences for the resonance properties of residential low voltage grids as reported in I30 -Germany2015B.
Lessons and developments for the future power grid: When planning new generation facilities, transmission systems or residential areas, it becomes increasingly important to consider possible interactions [133].However, this task is difficult due to the fast rising number of DERs, especially on the lower voltage levels.It is further complicated by the vast diversity of devices and manufacturers.This stresses the importance of generating robust behavior of the individual devices with respect to rapidly changing conditions.Furthermore, the need to reconsider the current testing procedures concerning the harmonic emissions of power electronic devices, that is mentioned in [89], [90], is supported by the observations in I28 -Netherlands2000.System operators tackle these developments with advanced low voltage substation that can provide grid service, cf.[156].Such approaches enable the inevitable transition of the low voltage level from mere statistical, passive loads to real-time, controllable grid assets.Incident overview: consequences for low voltage grids • Voltage imbalance: I29 -Germany2015A • Harmonic emission: I29 -Germany2015A and I28 -Netherlands2000 • Change of resonance properties: I30 -Germany2015B I28 -Netherlands2000 The Netherlands, around 2000 [85]- [87].High PV penetration in a grid area caused a harmonic content that was greater than allowed (PQ), even though the individual inverters and devices complied with the grid code.
I29 -Germany2015A Germany, around 2015 [88]- [90].The provided field study shows that electric vehicle charging as well as PV systems can cause significant voltage imbalance in case of single phase connection (VV).Further, the harmonic emission of the devices cannot be neglected (PQ).In [89], [90] the current practice of evaluating the harmonic emission of devices when connected to a purely sinusoidal grid is criticized, since voltage waveform distortions can be propagated and amplified through the control system, causing large harmonic currents.The problem of voltage imbalance due to single phase devices is considered a regulatory issue, since the even distribution has to be handled by local authorities.I30 -Germany2015B Germany, around 2015 [91].Large amounts of power electronic equipment in a newly build residential area are the likely cause for the unexpected low resonance frequency (PQ) of the low voltage grid at about 500 Hz [91].The need for continuous monitoring of the harmonic frequencies is emphasized by the authors of [91].Considering the expected developments in residential low voltage grids, these problems should no longer remain unaddressed since such resonances can be easily excited by the emitted harmonics of neighboring power electronic devices [91], [157].

C. Change of resonance characteristics in emerging grid types
Closely related to the changes in the low voltage grid are the developments in other grid types, as for example offshore grids of wind farms.The absence of resistive loads in such systems reduces damping and favors oscillatory events [93].Load dependencies have also been reported in other grid forms, e.g. the supply network for electronic locomotives [92].The underlying impedance shaping mechanism is described in the previous section.Unexpected resonances at low frequencies must be taken seriously, since they are more likely to be excited by harmonic emissions of adjacent systems.
Lessons and developments for the future power grid: To avoid the unwanted excitation of resonances, the harmonic emission of the individual grid participants must be closely monitored and suppressed if necessary.Especially the possible amplification of harmonics present in the grid by the control system of power electronic converters must be studied in depth [29], [158].For the mitigation of such issues the authors of [94] claim the first practical application of active damping in large-scale offshore wind power transmission systems, cf.I33 -Germany2019.Using passive filters was infeasible due to high costs and space requirements.Incident overview: change of resonance characteristics and consequences • Resonance properties of emerging grid types: off-shore grid in I32 -Germany2013 and rail way transmission system in I31 -Switzerland1995 • Harmonic emission exiting resonances in neighboring grid: I33 -Germany2019 I31 -Switzerland1995 Swiss Railway, 1995 [92].Inverter based electric locomotives interacted via the supply network, causing large harmonic currents (PQ) that subsequently triggered the emergency systems of the locomotives.This in an early example of unexpected, load dependent interaction of converters via the transmission system.
I32 -Germany2013 Germany, 2013 [93].The different characteristics of underground cables compared to overhead lines in terms of capacity per length caused the low resonance frequency of a offshore microgrid of a wind farm [93].This frequency dependent impedance of a the microgrid caused different harmonic resonance phenomena (PQ), which led to the outage of a HVDC system (TN).

I33 -Germany2019
Germany, around 2019 [94].Weakly damped resonances at 250 Hz and 350 Hz were identified as the source of harmonic currents and voltage distortions (PQ) that exceeded the expected range in an offshore wind farm.This caused problems during commissioning of the HVDC system connecting the offshore wind farm to the main grid.

VII. Outlook and summary of the presented incidents
The incidents presented in this paper are summarized in Table 1 along with the severity classifications and the key insights.Furthermore, Figure 6 gives an qualitative comparison of the number of times each severity classifications category was identified for legacy grid incidents and grid incidents with large penetration of renewable generation.Note, that due to the relative small number of large grid outages and the considered categories, this figure must be carefully interpreted.However, it can be seen that power quality and related oscillatory incidents are playing a major role in IBR dominated power grids and can be expected to gain importance with a further rising penetration ratio.As some of the presented incident reports show, there are various methods for mitigating such problems.However, their complex dependence on a multitude of influencing factors that lead to the occurrence of these phenomena make it difficult to predict which of the methods are suitable or necessary in the planning phase of new projects.This is illustrated by the fact that many of these incidents occur during commissioning or under unusual operating conditions, but were mitigated after careful consideration of the phenomena.Moreover, the necessity to use transmission systems, such as HVDC links, to economically connect areas with large yields of wind or solar partly counteract the positive effect of decentralized generation with respect to a decreasing reliance on transmission systems.However, the active transmission systems offer the possibility to control and optimize the power flow, which is an important feature for the future power grid considering the uncertainties the massive transport capacities extensions hold for the grid operation.Furthermore, the transition towards GFM control allows for an increased amount of devices that provide control abilities for the system.This increases the system resilience during normal operation as well as in case of system separation.Further, this is an important source of ancillary services as well as flexibility for the grid due to the fast dynamics of such devices.Moreover, the effect of unexpected behavior of new devices, e.g.large windfarms or PV plants, can be deduced from the relatively large number of incidents that include problems with power generation devices.This shows the necessity of power systems, power electronics and control engineering to closely work together to better understand the device and system level impact of the respective sides.Due to the fast pace of the energy transition as well as the complexity of the future energy system, new problems and interaction mechanisms are likely to arise.Therefore it is essential for next generation IBR devices to be adaptable after commissioning to react to arising challenges.

VIII. Conclusion
The present paper gives a survey of real-world grid incidents ranging from large-scale blackouts, to observations of power quality issues in modern residential areas and oscillatory phenomena arising from high shares of power electronically interfaced devices.All described incidents are summarized and classified according to the introduced taxonomy.By analyzing the cascading events of large scale blackouts, it is shown how the incorporation of power electronically interfaced DERs with the inherent degree of freedom in control design, smart-grid technology such as PMUs, and new topology approaches, e.g.microgrids, can be leveraged in terms of power system resilience.Further, it is illustrated that the reliable provision of the designed desired behavior as well as grid-supportive services is essential to avoid cascading events and which mechanisms will gain importance for the future power grid.It is evident from the presented real-world examples, that the downside must also be considered: the rising share of DERs introduces new incident mechanisms, for example the interaction of the control system with the adjacent grid.These oscillatory phenomena range over a large bandwidth from a few Hertz to several thousand Hertz.Unavoidable fasttransient events in the grid, like faults or utility switching, can trigger these incidents.The underlying mechanisms are highly sensitive to a variety of factors, including the number of and the geographic location of the devices, the transmission system connecting them as well as the control system used including auxiliary systems, e.g. the measurement or grid synchronization system.These manifold dependencies make such phenomena hard to predict when planning realworld applications.Further, structural consequences of the changes to the grid topology and characteristics are illustrated using real-world observations.They include the reduced physical inertia that leads to a different frequency behavior of the system.Further changes concern the resonance properties in low voltage and offshore grids as well as higher harmonic and supraharmonic emissions caused by the large number of power electronic devices.
In summary, the developments in the power grid offer vast opportunities that can be leveraged to maintain or even increase the system resilience.However, new challenges arise which lie in the reliance on adequate provision of, formerly physically guaranteed, grid services such as damping or inertia by adequate control of power electronically interfaced DERs or the integration of further devices dedicated to certain ancillary services.Moreover the rapidly rising number and diversity of devices inevitably leads to new and unexpected interactions as well as changes to the well understood structure and topology of the legacy power grid.Therefore, for a reliable and robust future power grid, adapted approaches in control, automation and operation of the grid must be found to handle this increasing complexity.
• Severity: is assessed using categories based on the incident classification scale of ENTSO-E [50]: -Blackout (BO) -Incidents on load (IL) -Incidents causing frequency degradation (FD) -Incidents on transmission network elements (TN) -Incidents on power generating facilities (PG) -N-x violation (NV), meaning reduced redundancy -Separation from the grid (SG) -Violation of voltage standards (VV) -Reduction of reserve capacity (RR) -Loss of tools and facilities (LT) Incident overview: power flow and post-transient operation • Changed power flow leading to overload: I8 -Europe2021 and I11 -Turkey2015 • Successful remedial actions and conditional operation: I8 -Europe2021 • Unrelated second incident leading to a blackout: I7 -Swe-Den2003

VOLUME , 9
This article has been accepted for publication in IEEE Open Journal of Power Electronics.This is the author's version which has not been fully edited and content may change prior to final publication.Citation information: DOI 10.1109/OJPEL.2023.3343167This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/ This article has been accepted for publication in IEEE Open Journal of Power Electronics.This is the author's version which has not been fully edited and content may change prior to final publication.Citation information: DOI 10.1109/OJPEL.2023.3343167This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/

I17FIGURE 5 .
FIGURE 5. Incident classification according to frequency content may change prior to final publication.Citation information: DOI 10.1109/OJPEL.2023.3343167This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/ Incident overview: complexity and sensitivity of oscillatory incidents • Influence of number of paralleled devices: PV inverters in I24 -Germany2015C, Wind turbines in I23 -China2012 • Sensitivity of oscillatory incidents: trip of DERs in I23 -China2012 • Complexity of dependence: I25 -France-Spain2015 This article has been accepted for publication in IEEE Open Journal of Power Electronics.This is the author's version which has not been fully edited and content may change prior to final publication.Citation information: DOI 10.1109/OJPEL.2023.3343167This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/

FIGURE 6 .
FIGURE 6. Analysis of the presented legacy grid incidents (blue) and IBR related incidents (orange).Each dot on the axes represents the occurrence of the respective severity category in an incident.
This article has been accepted for publication in IEEE Open Journal of Power Electronics.This is the author's version which has not been fully edited and content may change prior to final publication.Citation information: DOI 10.1109/OJPEL.2023.3343167This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/This article has been accepted for publication in IEEE Open Journal of Power Electronics.This is the author's version which has not been fully edited and content may change prior to final publication.Citation information: DOI 10.1109/OJPEL.2023.3343167This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/

•
[29]ching frequency sideband: frequencies > fs 2[29], were f s denotes the switching frequency of the power electronic device.