Over-level tripping × Cross-border cascading: The same coordination challenge behind two “protection failures”

Incident summary

• On 25 August 2026, a 10 kV feeder at the 110 kV Dongsheng Substation in Inner Mongolia tripped non-selectively. The substation is operated by Hohhot Togtoh Power Supply Company of Inner Mongolia Electric Power (Group) Co., Ltd.
• On 14 August 2026, a large-scale blackout affected the Central Asian Unified Power System, involving Kazakhstan, Uzbekistan, Tajikistan and Kyrgyzstan.

Note on sources: the factual account in this article is based on publicly released announcements and media reports; the mechanism analysis reflects engineering logic that is generally applicable across the industry. The final conclusions on both events remain subject to the official investigations.

Introduction: Eleven days, two events—tripping where it should not, and staying closed where it should have

On the afternoon of 14 August 2026, a large-scale blackout hit the Central Asian Unified Power System. Cities in Kazakhstan, Uzbekistan, Tajikistan and Kyrgyzstan were plunged into darkness, cutting supply to millions of residents.

At 15:08 on 25 August, the third-stage overcurrent protection operated on the 10 kV 962 Maliang Line at the 110 kV Dongsheng Substation in Inner Mongolia. The breaker made one automatic reclose attempt; the attempt was unsuccessful, and the line was taken out of service. On its face this is only a local fault on a distribution feeder, affecting the customers connected to that one line.

Two events, about 2,900 km apart and different in scale by roughly two to three orders of magnitude. Put them side by side and they point at the same fundamental question in relay protection: what, exactly, does “coordination” mean?

Textbooks teach you how to calculate settings, how to apply time-graded coordination, and how to verify sensitivity. Real events never follow the textbook. One of these events happened at an outdoor switch at the far end of a distribution network; the other, on a cross-border 500 kV backbone. They expose the same vulnerability in very different ways: a break in any single link of the coordination chain is magnified by the size of the grid, and the customer pays for it in outage time.

1. The Dongsheng event: how one switch setting turned a feeder fault into a non-selective trip

1.1 Timeline

• 25 August, 15:08 — The 10 kV 962 Maliang Line at the 110 kV Dongsheng Substation tripped when the third-stage overcurrent protection operated. One automatic reclose attempt failed and the line was taken out of service, leaving every customer on the feeder without supply.
• On-site investigation — The distribution live-line crew first pulled three sets of data: fault waveform records, protection operation records, and telecontrol channel status. All three were normal. The signalling circuit of the in-station automated switch was intact, the telecontrol channel was stable, and no damage was found on the automation equipment itself.
• The routine approach failed — With the usual channel-related causes ruled out, the crew worked with the equipment manufacturer to check the equipment records, protection settings, and configuration parameters in reverse order.
• Root cause identified — The outdoor intelligent circuit breaker on the line: its operating setting deviated from the parameters stated on the nameplate, and the setting actually applied in the field was too high, outside the coordinated range of the protection inside the substation.
• Remediation — Correct the settings; carry out a full coordination check along the entire feeder; re-verify the switch operating logic, signal transmission, and interlocking functions; return the line to service.

1.2 Mechanism: why a “high” setting produces a non-selective trip

This is the part of the story worth slowing down over. Many people explain a non-selective trip with a vague phrase—“the settings were not properly coordinated”—but the physical chain runs like this:

Protection coordination is a priority chain. It decides who operates first.

• Normal logic — A fault occurs on the 10 kV line; the line-side outdoor breaker, set to operate fastest, clears it; only the faulted feeder is disconnected; the substation protection never sees the current long enough to operate.
• After the outdoor breaker’s setting was raised — A fault occurs; the pickup and time delay of the outdoor breaker are too high, so it does not operate within its allotted time; the protection at the substation reaches its operating time first; the substation breaker trips; the whole feeder goes dead.

The cost of skipping a level of protection is not simply “tripping one level higher up”; it is an expansion—potentially by an order of magnitude—of the affected area. A line-side trip removes one feeder. An upstream trip at the substation can remove a busbar and every feeder supplied from it. In this event the outage was limited to the single line, but the coordination logic had already failed, and a worse outcome was only one step away.

There is one technical point here that is easy to miss. Setting errors and channel faults are two completely different kinds of problem. A channel fault—signals that do not get through—is a “visible” problem: remote monitoring can find it. A setting error is a problem you can stare at and still not see. The waveform records are normal, the messages are normal, the channel is healthy, and the device sits at the wrong threshold doing nothing. That is why a latent setting defect is harder to find than a channel fault: it does not raise an alarm—it simply does nothing.

1.3 Three questions: why was it not noticed earlier?

First: where do the settings come from? Outdoor intelligent breakers are numerous and widely scattered. Their settings are often preconfigured by the manufacturer to generic parameters, and no coordination check against the protection inside the substation is performed at commissioning. Factory defaults are not system-coordinated settings; this is the primary source of inverted settings.

Second: why did commissioning and acceptance not catch it? If commissioning included one mandatory step—“verification of setting coordination with the substation protection”—in which the line-side settings and the substation settings are placed in the same comparison table and their coordination time intervals checked, this would have been found before energisation. That it was not found means either the step was missing from the acceptance checklist or it was performed only on paper.

Third: why did it stay invisible during operation? Settings are scattered across manufacturers, maintenance crews and dispatch centres, with no unified system for circulating setting documents or for periodic re-testing. Once equipment is in service, “set once and never touch it again” is not unusual in distribution networks. Whether settings are re-verified after maintenance, upgrades or setting changes too often depends on the diligence of the crew rather than on a procedure.

All three questions point to the same conclusion. On the surface, the Dongsheng event was caused by an incorrect setting. At its core, it was caused by a gap in the management system for settings.

2. The blackout across four Central Asian countries: how emergency control schemes turned a 600 MW deficit into a cross-border outage

2.1 Timeline and how the official account evolved

• 14 August, 14:37 Kazakhstan time (UTC+5) — Two hydro units at the Toktogul hydroelectric power plant (HPP) in Kyrgyzstan tripped. KEGOC reported the generation loss as approximately 600 MW; the Ministry of Energy of Kazakhstan separately put the combined capacity of the two units at 625 MW.
• 14:37–14:38 — Three 500 kV lines operated by KEGOC—Agadyr–Ulken L-5300 and L-5320, and Aktogay–Taldykorgan L-5400—tripped.
• Cascade — Emergency control schemes then operated one after another. Initial consumer supply restrictions totalled approximately 2,810 MW; restrictions amounting to about 295 MW had been lifted by 14:47. Supply was lost in Almaty, Shymkent and other southern areas, and the southern zone of Kazakhstan was separated from the national system and from the Central Asian Unified Power System and began operating islanded.
• Spread — The separation of the southern zone was accompanied by outages in several countries. Kyrgyzstan logged a technological disturbance on its own system at 15:37 Kyrgyzstan time (UTC+6)—one hour ahead of Kazakhstan—and reported the unified system back to nominal frequency by 15:55.

The evolution of the official account is worth noting:

Discrepancies between sources remain, and the final conclusion is pending the official investigation. But one engineering detail none of the parties can avoid: the cascading operation of the emergency control schemes was a direct contributor to the spread of this outage.

2.2 Mechanism: when a safety valve becomes an amplifier

The design philosophy of emergency control schemes (known in China as safety automatic devices) can be summarised in one sentence: when something fails, protect the network as a whole and sacrifice the local part. They act as a safety valve for the grid—when they detect an overloaded transmission section, abnormal frequency, or risk of loss of synchronism, they shed load in a preset order to keep the backbone from collapsing.

That logic is sound, and it is effective for a single fault. But when faults accumulate and the settings of different sections are not coordinated as a whole, the safety valve turns into an amplifier.

The essence of a cascade is that the shedding itself becomes a new disturbance. Each load-shedding action redistributes power flow across the whole grid. If the next device is set for the worst-case conditions of its own section, without accounting for the flows that upstream shedding has shifted onto it, it can spread the fault to lines and sections that were previously healthy. A deficit of 600 MW is a small disturbance in terms of system capacity; yet through the chain “overload → shedding → flow transfer → renewed overload → renewed shedding”, it can end up cutting supply to millions of customers.

One more detail worth thinking about: the 600 MW shortfall itself was not fatal. What was fatal was the absence of system-level coordination between the transfer-capability margins along the path the deficit propagated and the device settings. If load shedding is coordinated in tiers and by section, on the principle of minimising the total load interrupted, many cascades can be stopped at the first stage.

2.3 Three follow-up questions

First: why can a small disturbance cascade through an interconnected grid? A cross-border interconnected grid exists so that its members share reserve capacity and support each other. But that also means a disturbance can travel indefinitely along the interconnections. In an islanded system, the trip of a single unit may cause nothing more than a frequency excursion; in an interconnected one, it becomes a surge of cross-border power flow—a test of the coordination margin of every section and every control device.

Second: how wide should the view be when tuning for cascades? Traditionally, emergency control schemes were set for “this plant, this substation, this line”. This event shows that, at the level of an integrated power system, they must be set at system level and at cross-border section level: Country A’s shedding strategy has to account for how it will change the sectional flows in Country B. However precisely individual settings are tuned, nothing is gained if coordination at the system level is missing.

Third: is chaotic incident reporting a minor matter? Early reports attributed the event to high-temperature load; the later technical account revised this to a hydro unit trip. For a cross-border coordinated response, that kind of flip-flop is a serious disruption: when dispatch centres in different countries run scenario studies based on these notices, any change in the input forces them to redo their plans from scratch. Information governance is not a public-relations issue—it is operational infrastructure for a coordinated response.

3. Two events, one question: why does the coordination chain keep breaking?

3.1 Different on the surface, the same underneath

Put the two side by side and one commonality appears: the boundary between selective operation and backup operation was breached.

• Dongsheng: the line switch (main protection) failed to operate, and the substation protection (backup) skipped a level—a loss of selectivity.
• Central Asia: after the first stage of shedding, the system did not stabilise and the cascade continued—the backup action went beyond the scope it was designed for.

The coordination time interval in a distribution network is typically 0.3–0.5 s, while the interlocking coordination in main and interconnected grids runs from milliseconds to seconds. The scales differ; the mathematics is the same. It all comes down to one rule: disconnect the smallest possible part of the network, at the right time, with the right device.

3.2 Two things the textbook did not tell you

First: a setting is not chosen “arbitrarily”—it is chosen by coordination. However precise an individual device’s settings are, they only mean something in relation to the devices on either side of it. Every number on a setting sheet must answer one question in the coordination chain: “Why am I 0.3 s faster than the device on the source side and 0.3 s slower than the device on the load side?” (Upstream here means the device nearer the source, which is set to operate more slowly.) The outdoor switch settings at Dongsheng were numbers that were correct in isolation and wrong in context.

Second: the larger the grid, the higher the invisible cost of coordination. Coordination within one substation is a handful of setting sheets. Coordination across a multi-regional interconnected grid is a multi-dimensional matrix: the flow limit of every section, the shedding steps of every control device, and the coordination of automatic generation control (AGC) and underfrequency load shedding (UFLS) across countries. If a single cell in that matrix is filled in wrong, the failure shows up on the day of the event as a cascade.

3.3 Looking ahead: new energy is making setting management harder

The task described at the start of this article is demanding, and it will get more so. As distributed photovoltaics, energy storage and electric vehicles are connected at scale:

• The basis for distribution protection settings is being rewritten. The fault-current contribution from distributed generation changes how fault current is distributed, invalidating the traditional single-source radial assumption; overcurrent settings may need to be supplemented with directional elements.
• The number of protection configurations is increasing. Every connection point is a new coordination node; the coordination chain grows from “one line with a few devices” into a network of dozens of nodes.
• Settings have to change more often. Changes in operating mode and the connection or disconnection of distributed generation both require settings to be re-verified; the static record book is being replaced by dynamic management.

In other words: in distribution networks with high penetration of new energy, the Dongsheng style of setting inversion is bound to appear more often, and each occurrence will cost more to track down. If a standardised management system is not built now, it will be paid for later, in an event.

4. Recommendations for frontline operations and dispatch teams

4.1 One integrated ledger for settings (from the Dongsheng lessons)

1. Build a complete setting-comparison ledger. In-station protection, line-side intelligent switches and outdoor equipment should all be cross-referenced in one table, so that the coordination chain can be seen at a glance.
2. Make coordination verification mandatory before commissioning. Before energisation, verify the grading chain “line side operates first, substation provides backup”. Record the result, sign it off, and do not energise without it.
3. Re-test periodically after commissioning. Move to an annual or operating-cycle setting verification, carried out on site, to confirm that the settings of outdoor intelligent devices match the records—paying particular attention to whether the manufacturer’s presets have been put into service exactly as delivered.
4. Re-verify the settings after any maintenance, upgrade or setting change. Any work that touches a setting should trigger a review of the whole coordination chain; there is no room for a “fix it and forget it” approach.

4.2 Setting emergency control schemes at system level (from the Central Asia lessons)

1. Widen the scope of coordination. Move from “this plant, this substation, this line” to the section level and the regional level; design load shedding by section and grade it on the principle of minimising the total load interrupted.
2. Cover combined scenarios in simulation. Do not test single faults only; simulate N-1, N-2, and a generation deficit combined with an overloaded section. Cascades are exactly what single-scenario testing fails to cover.
3. Build a cross-entity coordination mechanism. For cross-border and inter-regional grids there must be one coordinated framework for control device settings, load-shedding steps and communication delays—achieving at the very least mutual visibility.

4.3 Discipline in incident reporting

1. Verify first, then publish. An initial notification can go out quickly, but the conclusion on cause must wait until the data have been checked. Better to be half an hour late with accurate information than to publish a wrong attribution.
2. Manage notification versions. Use a single point of external release, and make sure every correction carries a version number and a timestamp, so that flip-flopping updates do not disrupt the coordinated response.

4.4 Institutional level

1. Make coordination verification a system rather than a matter of individual diligence. Standardised, signed off and traceable—every setting should have a named person responsible for it.
2. Run cascade drills routinely. Build “failed reclosing + cascaded tripping + distributed generation contribution” into the emergency drill scenarios, so that the crew meets the worst case before the event does.

Conclusion: turn coordination into a system, not a slogan

The Dongsheng event and the blackout across four Central Asian countries look like two isolated grid events—one at the end of a distribution network, the other on a cross-border backbone; one affecting a single feeder, the other four countries. At their core they test the same thing: can protection coordination and emergency control logic cover every switch, every line and every section of the grid?

The lesson from engineering practice is that preventing non-selective trips and cascading outages requires no sophisticated theory. What it requires is:

• A setting ledger integrated end to end—in-station, line-side and outdoor equipment compared in the same table.
• Compliance verification institutionalised—verify before commissioning, re-test during operation, re-verify after any change.
• Emergency control schemes coordinated at system level—look at the whole network, not just this site.
• Incident reporting that is timely and accurate—verify first, then speak.

None of this is glamorous, and none of it makes the news. But day after day it decides one thing: when a fault occurs, will the grid cut off the smallest possible area and restore the largest possible supply—or let a minor fault grow into a major blackout?

With distributed photovoltaics, energy storage and electric vehicles being deployed at scale, the number of protection devices in distribution networks will multiply, and the complexity of setting management will only increase. Building the ledger now, putting the mechanisms in place, and running cascade scenarios in simulation are tasks that every frontline crew and dispatch centre should start on as soon as possible.

Equipment upgrades can wait; faults will not.

(The factual part of this article is based on publicly available announcements and media reports; the mechanism analysis and the recommendations reflect engineering logic in general use across the industry, and are offered for practitioners to discuss and use as reference. The final conclusions on both events remain subject to the official investigations by the countries concerned.)