  Distributed Energy Resources (DERs) can provide balancing services to the
grid, but their power variations might cause voltage and current constraint
violations in the distribution network, compromising network safety. This could
be avoided by including network constraints within DER control formulations,
but the entities coordinating DERs (e.g., aggregators) may not have access to
network information, which typically is known only to the utility. Therefore,
it is challenging to develop network-safe DER control algorithms when the
aggregator is not the utility; it requires these entities to coordinate with
each other. In this paper, we develop an aggregator-utility coordination
framework that enables network-safe control of thermostatically-controlled
loads to provide frequency regulation. In our framework, the utility sends a
network-safe constraint set on the aggregator's command without directly
sharing any network information. We propose a constraint set construction
algorithm that guarantees satisfaction of a chance constraint on network
safety. Assuming monotonicity of the probability of network safety with respect
to the aggregator's command, we leverage the bisection method to find the
largest possible constraint set, providing maximum flexibility to the
aggregator. Simulations show that, compared to two benchmark algorithms, the
proposed approach provides a good balance between service quality and network
safety.
