V1.2 · How a VPP operates: control, responsibility and settlement
The first lesson established the product: an authorised, measurable change at a defined time and boundary. This lesson explains how organisations and systems deliver that product together. We follow the information that travels upward, the instructions that travel downward and the evidence used afterwards. The central problem is reconciling several parties’ legitimate interests without letting a commercial instruction override the site’s operating obligations.
Read the concepts and system relationships in sequence before attempting the workshop. Key terms are explained in the context of their function. If a task is unclear, return to its section and explain the reasoning before calculating.
What should you be able to judge after this lesson?
- Assign owner, aggregator, network, market and technology-provider responsibilities separately.
- Explain the control hierarchy from commercial scheduling to local equipment protection.
- Describe capability, dispatch, verification, recovery and settlement as distinct stages.
- Evaluate a constrained instruction and define a traceable response to limitations or failure.
Put the responsibilities into one view
| Party | Responsibility | What this does not establish |
|---|---|---|
| Asset owner | The owner authorises asset use and approves protected site duties and reserves. | Ownership alone does not create market eligibility. |
| Aggregator | The aggregator commits services and requests dispatch within agreed rights. | A commercial request cannot override protection or approved network limits. |
| Network operator | The network party defines applicable connection conditions, updates and validity. | Network permission does not establish entitlement to a market payment. |
| Local control system | The controller validates, executes, limits or rejects requests under approved logic. | Successful execution alone does not establish settlement compliance. |
Commercial requests inside technical authority
How to read this figure: Capability and exceptions return from the site to the coordinator. Requests travel to local validation; equipment protection and approved limits remain enforceable.
1. Separate the organisations from the software they use
The owner holds the relevant equipment rights and operating obligations. It may be a household, business, landlord or a company whose critical process depends on the resource. The aggregator coordinates a portfolio and takes on the agreed service commitment. A software supplier provides technology under its own contract. These may be the same company in some offers, but the role and liability of each still need to be explicit.
The network operator sets or administers applicable connection and network conditions. A market or programme operator defines the service’s participation, measurement and settlement arrangements. A retailer or balance-responsible party may have separate responsibilities for the site’s electricity position. The exact arrangement varies with the jurisdiction and service; a generic platform architecture cannot allocate those legal rights.
Ask each party what it authorises, what it measures, what it can override and what failure it must remedy. For a NEM proposal, AEMO’s IRP fact sheet is one starting reference for the relevant registration activities; it also distinguishes registration from network and other requirements. [1] The Australian route is examined more fully in lesson three.
2. Use a control hierarchy rather than letting every party command everything
At the equipment level, protection and manufacturer limits prevent unsafe operation. A site controller or EMS coordinates the owner’s loads, generation and storage within approved operating priorities. A portfolio platform allocates a service across sites and manages the relevant commercial schedule. A network system such as utility DERMS may supply or enforce network-related constraints. These are functional roles; an actual project must identify the system implementing each one.
For a scheduled commercial event, the platform can request a valid setpoint while the site checks whether it remains permitted and achievable. For a fast locally triggered service, the authorised response may already be enabled in local equipment. Do not route a service requiring autonomous fast response through an assumed cloud round trip without verifying that the service and architecture permit it. AEMO’s FCAS guide distinguishes centrally controlled regulation from contingency purposes. [2]
The priority rule must resolve conflict. A commercial request cannot silently consume protected emergency reserve, defeat protection or exceed approved connection limits. Conversely, a site that restricts delivery must acknowledge the restriction to the responsible coordinator so that the external commitment can be managed. “Local priority” is not permission to conceal non-delivery.
3. Capability flows upward as a conditional statement
The site should report more than an online/offline flag. Useful information includes present power, SOC, available equipment, protected reserve, permitted import/export, response direction, duration and the period for which the estimate is valid. The measurement point and sign convention must accompany these values. A 0.5 MW number without those attributes is not a complete service capability.
Some connection limits are fixed; some projects may have approved time-varying operating envelopes. An envelope specifies the allowed operating region under stated conditions, not an instruction to use all of it. If a new limit arrives or the valid period expires, the site and coordinator need an agreed process to revise available capability and manage existing commitments.
Telemetry quality matters as much as the value itself. Include timestamps, quality flags, expected update rate and the rule for stale data. A value measured before a load trip or a vehicle departure may no longer represent current capability. Missing data should trigger an explicit confidence or operating response rather than being silently treated as continuing availability.
4. Check an instruction at the point where it will change the grid
A battery response is not identical to the final PCC flow. Suppose a battery increases discharge while a factory load changes at the same time. The net connection flow includes both. For an export-positive convention, battery discharge minus other net site demand gives PCC export in the simple case. The local controller must assess the combined operating point, not just whether the battery setpoint fits its own MW rating.
Check total event energy as well as incremental service energy. If a battery is already discharging for the owner’s peak management, adding a VPP response consumes energy on top of that duty. The protected floor must still hold at the end, and any reserve already sold or retained for another purpose must be reconciled. Reactive-power and thermal limits may further restrict the active-power allowance.
When an instruction cannot be met, the agreed protocol must say whether to reject, limit, substitute or withdraw availability. Never accept a full request while silently delivering a smaller amount. Record the original request, accepted duty, limiting condition and acknowledgment so that both the operational and commercial parties understand the same outcome.
5. Plan failure behaviour, recovery and cybersecurity together
Communications can fail, clocks can drift and a controller can restart with stale state. Define which functions must remain local, how long remote authority remains valid and what the site does when that authority or information expires. The selected fallback must preserve the site’s approved constraints; setting battery power to zero is not universally safe if charging is needed to absorb other generation.
Access should be limited to the equipment and actions each role needs. Separate viewing data, changing an operating limit, enabling a service and issuing a dispatch. Use authenticated interfaces, maintainable credentials and attributable logs under the project’s security requirements. A successful integration is not a reason to give a commercial platform unrestricted access to protection settings.
Restoration should be controlled rather than abrupt. After a communication failure or site override, verify the state before resuming remote dispatch and determine whether previous commitments still apply. After energy delivery, schedule recharge or demand rebound so that reserve and customer obligations recover without violating connection limits.
6. Measurement proves delivery; command logs only prove part of the process
For a scheduled reduction, agree the reference against which the measured change is assessed. For other services, use the applicable direct measurement or service-specific verification method. The battery-terminal meter, site PCC meter and market settlement meter can describe different quantities. Map the measurement used for each claim before comparing them.
The event record should join the enabled or requested service, valid capability information, accepted settings, measured response, exceptions and recovery. Use a common time reference or documented offsets. A high reporting rate alone does not prove adequate instrument bandwidth or accuracy; the verification requirements must determine what recording is suitable.
Keep the difference between three statements visible: the device received a command; the electrical service was delivered; the delivery qualifies for payment. They require progressively broader evidence. This separation helps resolve disputes and stops a platform dashboard from being mistaken for an independently settled revenue record.
7. Contracts translate a technical response into a business obligation
A participation agreement should define the service scope, control permission, protected duties, availability commitment and how the owner can override or exit. It should also allocate responsibility for communications, qualification, metering, maintenance and failed delivery. These questions should be settled before the owner relies on projected receipts.
Payment terms need a transparent basis: fixed or variable amounts, the relevant currency and period, fees, performance adjustments and when cash is actually paid. Battery wear, recharge energy and lost site benefits can sit outside an aggregator’s headline estimate. State whether a figure is a contractual entitlement, an assumption or a scenario result.
Compatible services can share an asset, but a contract must not rely on physically incompatible promises. Reconcile emergency reserve, existing arbitrage, peak management and external response over the same time horizon. If one party has priority, record the operational and financial effect on the others rather than claiming every value stream at its independent maximum.
8. Commission the end-to-end service, not only the interface
Begin with a service definition, a responsibility matrix, an approved operating envelope and the agreed verification method. Then test representative valid and invalid requests at stated starting conditions. Include constrained SOC, changing site load, a limit update, stale data and communications failure where relevant to the service. Test actions need an authorised procedure and must preserve real customer obligations.
Verify both acceptance and refusal. A controller that follows a valid request but also accepts an export-violating request has not demonstrated the required constrained service. Confirm that a refusal reaches the coordinator and produces the agreed operational/commercial response. A graceful limitation is a successful test only when it matches the approved policy.
Finally rehearse the evidence and settlement handoff. Can the parties reconstruct what was requested, what was possible, what was delivered and why any payment adjustment applies? EMA’s overview describes the coordination of resources for energy, regulation and contingency purposes, but the individual project must supply this detailed operating and contractual chain. [3]
Workshop: form a decision from the given inputs
Attempt these tasks before opening the reference answers.
- Draw the upward capability information and downward control relationships, identifying where owner, network and equipment limits are enforced.
- Identify who requests dispatch, who authorises asset use and who enforces the limits.
- Check the requested final power against PCS, PCC export and protected battery energy.
- Calculate the largest additional response that fits these simplified limits, then specify the rejection/limitation record.
- If communications fail or a request is limited, explain what must be recorded and what must be checked before resuming normal dispatch.
Concept answer · The aggregator requests; local and network duties remain explicit
Asset state and conditional capability travel from equipment through the site system to the coordinator. Approved network limits and owner duties constrain that capability. For a scheduled service, a request travels back to local validation and equipment execution; a locally triggered service uses its separately approved local logic. The supplier supplies a system but does not acquire every participant’s authority merely by integrating it.
Keep equipment protection intact, identify who updates each limit and make refusals visible upstream. The network and market/programme roles determine applicable conditions, while the owner and controller preserve site duties. Several roles may sit in one organisation without removing the need to name the responsible party.
The output from this step should be: A control-and-information map with accountable parties at each boundary.
Answer 1 · Commercial requests need owner authority and local validation
The aggregator requests the commercial response within its contractual rights. The owner authorises asset use and retains the stated reserve. The local control system checks and enforces the approved equipment, SOC and connection limits. The network operator remains responsible for its applicable network conditions, while the programme operator determines qualification and settlement rules.
Write these duties as explicit responsibilities, including who updates the envelope and who handles an override. Avoid using a product label as the responsible party: a platform supplier, asset owner and aggregator may have different contractual liabilities even when their systems are integrated.
The output from this step should be: Submit a responsibility matrix covering authorisation, limit updates, dispatch, safety override, measurement and settlement.
Answer 2 · The PCC export limit rejects the original request
Final battery discharge would be 0.1 + 0.5 = 0.6 MW, below the stated 1 MW PCS ceiling. Protected AC energy is 2 × 0.80 × (0.60−0.40) × 0.95 = 0.304 MWh. Total event discharge requires 0.6 × 0.5 = 0.3 MWh, which fits this simplified energy check with only 0.004 MWh remaining.
However, final PCC export is 0.6 − 0.3 = 0.3 MW, exceeding the 0.25 MW cap by 0.05 MW. Passing the PCS and energy checks cannot offset that violation. The small energy margin is also not a design reserve; uncertainty and unmodelled losses still require review.
The output from this step should be: Record the requested operating point, each binding constraint and the exact PCC exceedance.
Answer 3 · Limit the request transparently, then verify permission
The PCC permits battery discharge of at most 0.3 + 0.25 = 0.55 MW at the stated site load. Relative to current discharge of 0.1 MW, additional upward response is at most 0.45 MW. Total half-hour energy would then be 0.55 × 0.5 = 0.275 MWh, below the stated 0.304 MWh. Therefore 0.45 MW is the maximum additional response in this simplified constant-condition screen.
If the agreed policy permits limiting a request, acknowledge 0.45 MW rather than silently pretending to accept 0.5 MW. Retain the original request, envelope version, valid period, measured site state, limit reason and accepted setpoint. Obtain the relevant market and contract permissions before offering the service; the calculation does not create them. Reassess if the site load, SOC or envelope changes.
The output from this step should be: Submit a constrained-command example, its audit trail and an evidence request for outstanding qualification and contract issues.
Operational answer · Restore from verified state, with a visible exception record
Record the original request or enabled duty, timestamped capability and limits, accepted or refused output, reason and measured consequence. For a limitation, notify the coordinator of what can actually be delivered rather than acknowledging the full request. Preserve the relevant data for the agreed verification and dispute process.
On failure, apply the site-specific approved fallback; zero battery power is not universally safe. Before resuming, verify communications authority, meter freshness, SOC, equipment availability, network limits and whether the prior commitment is still valid. Schedule recovery energy and confirm reserve, rather than simply replaying the last command.
The output from this step should be: A failure/recovery record linked to the affected service commitment.
The key decision from this lesson
A VPP commitment is credible when the commercial request, owner authority, network envelope, local control and settlement evidence describe the same service. Integration is useful only when those responsibilities remain explicit.
Sources and scope
Reviewed 25 October 2026. Primary sources provide background; numbered references in the text identify the relevant documents below. Cases, calculations and action suggestions are original teaching derivations. They do not replace site specifications, network permissions or contract review.
[1] AEMO · Integrated Resource Providers in the NEM · 2024 fact sheet v2 ↗
[2] AEMO · Guide to Frequency Control Ancillary Services · September 2025 ↗