  When providing bulk power system services, a third-party aggregator could
inadvertently cause operational issues at the distribution level. We propose a
coordination architecture in which an aggregator and distribution operator
coordinate to avoid distribution network constraint violations, while
preserving private information. The aggregator controls thermostatic loads to
provide frequency regulation, while the distribution operator overrides the
aggregator's control actions when necessary to ensure safe network operation.
Using this architecture, we propose two control strategies, which differ in
terms of measurement and communication requirements, as well as model
complexity and scalability. The first uses an aggregate model and blocking
controller, while the second uses individual load models and a mode-count
controller. Both outperform a benchmark strategy in terms of tracking accuracy.
Furthermore, the second strategy performs better than the first, with only
0.10% average RMS error (compared to 0.70%). The second is also able to
maintain safe operation of the distribution network while overriding less than
1% of the aggregator's control actions (compared to approximately 15% by the
first strategy). However, the second strategy has significantly more
measurement, communication, and computational requirements, and therefore would
be more complex and expensive to implement than the first strategy.
