Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage

8/14/2019 Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage

http://slidepdf.com/reader/full/physical-vulnerability-of-electric-systems-to-natural-disasters-and-sabotage 1/66

Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage

June 1990

OTA-E-453

NTIS order #PB90-253287



Recommended Citation:

U.S. Congress, Office of Technology Assessment, Physical Vulnerability of Electric Systemto Natural Disasters and Sabotage, OTA-E-453 (Washington, DC: U.S. Government PrintingOffice, June 1990).

For sale by the Superintendent of DocumentsU.S. Government Printing Office, Washington, DC 20402-9325

(order form can be found in the back of this report)



Foreword

This assessment responds to requests by the Senate Committee on Governmental Affairsand the House Committee on Energy and Commerce to evaluate the potential for long-termelectric power outages following natural disasters and deliberate sabotage. This reportcomplements earlier OTA reports: Electric Power Wheeling and Dealing-Technological

Considerations for Increasing Competition; and New Electric Power Technologies—Problems and Prospects for the 1990s.

This country has enjoyed remarkably reliable electric service for the most part. Very fewblackouts have affected many people for more than a few hours. Nevertheless, much worseblackouts are possible which could cause enormous disruption and expense for society. It isthe intent of this report to analyze how such disasters could happen and how the risk could bereduced.

OTA examined the effects on an electric power system when various components aredamaged and how the system can be restored. Present efforts and potential options to reducevulnerability are described. Also, specific policy measures are analyzed and grouped

according to whether they are likely to be implemented and their costs.This report contains no information not readily available from other public sources that

would assist saboteurs in destroying electric power facilities and causing widespreadblackouts. An analysis of the vulnerability of specific equipment is included in a separateappendix that is under classification review by the Department of Energy. This appendix willbe made available only under appropriate safeguards by the Department of Energy.

OTA appreciates the generous assistance provided by our workshop participants as wellas other individuals who contributed to this report by providing information, advice, andsubstantive reviews of draft materials. To all of the above goes the gratitude of OTA and thepersonal thanks of the project staff.

. Ill



Edward BadolatoCMS, Inc.

Lex CurtisWestinghouse ABB

John EdwardsNew York State Energy Office

Electric System Vulnerability

Workshop Participants

October 18, 1989

Michehl GentNorth American Electric Reliability Council

A. Leonard GhilaniRTE Power Products

Henry Hyatt

Federal Emergency Management AgencyJames JacksonSouthern California Edison Co.

Frank KrollArizona Public Service Co.

Charles LaneU.S. Secret Service

Joseph Muckerman 11U.S. Department of Defense

Jeffrey PalermoCasazza, Schultz & Associates, Inc.

Bernard Pasternack American Electric Power Service Corp.

Stanley TrumbowerU.S. Department of Energy

Joseph WalterMaryland Public Service Commission

Emmet Willard

Private ConsultantJohn WilliamsU.S. Department of Energy

John WohlstetterContel Corp.

Frank YoungElectric Power Research Institute



Physical Vulnerability of Electric Power Systems to

Natural Disasters and Sabotage

OTA Project Staff

Lionel S. Johns, Assistant Director, OTA Energy, Materials, and International Security Division

Peter D. Blair, Energy and Materials Program Manager

Alan T. Crane, Project Director

Robin Roy, Analyst

Joanne M. Seder, Analyst

Administrative Staff

Linda Long Phyllis Brumfield

Contributors

Lillian ChapmanA. Jenifer Robison

Daniel Yoon

Contractors

Casazza, Schultz & Associates, Inc.



Acknowledgments

Glenn CoplanU.S. Department of Energy

Lex CurtisAsea Brown-Boveri

James DoddVirginia Power Co.

Gene Gomelnik North American Electric Reliability Council

Richard GutleberVirginia Power Co.

Roger Hamrick Virginia Power Co.

Eric HaskinsEdison Electric Institute

Steinar J. DaleOak Ridge National Laboratory

James S. GilbertsonFederal Emergency Management Agency

Michael HuntAsea Brown-Boveri

Robert MullenDepartment of Energy

David NeviusNorth American Electric Reliability Council

Hilton PeelVirginia Power Co.

Kyle PitsorNational Electrical Manufacturers Association

Charles RudasillVirgnia Power Co.

Charles WhiteNational Electrical Manufacturers Association

Additional Reviewers

Darriell JonesFederal Bureau of Investigation

Monte StraitFederal Bureau of Investigation

NOTE: OTA appreciates and is grateful for the valuable assistance and thoughtful critiques provided by the reviewers. The reviewers

do not, however, necessarily approve, disapprove, or endorse this report. OTA assum es full responsib ility for the report and

the accuracy of its contents.

vi



Contents

Page

Chapter 1: Introduction and Summary . . . . . . 1INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . 1SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Causes and Costs of Extended Outages . . . . 1Component Vulnerability and Impact

on System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Current Efforts To Reduce Vulnerability ..4Policy Options To Further Reduce

Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . 5

Chapter 2: Causes of Extended Outages . . . . . 9NATURAL HAZARDS . . . . . . . . . . . . . . . . . . . . 9

Earthquakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Hurricanes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Tornadoes and Thunderstorms . . . . . . . . . . . 12Geomagnetic Storms . . . . . . . . . . . . . . . . . . . . 13

SABOTAGE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Experience With Sabotage . . . . . . . . . . . . . . 14The Threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Chapter 3: Impacts of Blackouts . . . . . . . . . . . 19OVERVIEW OF COSTS OF

BLACKOUTS . . . . . . . . . . . . . . . . . . . . . . . . . 19Types of Costs. . . . . . . . . . . . . . . . . . . . . . . . . 19Hypothetical Outage Cost Estimates . . . . . 20Actual Outage Cost Estimates . . . . . . . . . . . 21

SECTORAL IMPACTS . . . . . . . . . . . . . . . . . . . 23Industrial . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Commercial . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Agriculture . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Residential . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Transportation . . . . . . . . . . . . . . . . . . . . . . . . . . 26Telecommunications . . . . . . . . . . . . . . . . . . . . 26Emergency Services . . . . . . . . . . . . . . . . . . . . 28Public Utilities and Services . . . . . . . . . . . . . 28

Chapter 4: System Impact of the Loss of Major Components . . . . . . . . . . . . . . . . . . . . . . 31SHORT-TERM BULK POWER SYSTEM

IMPACTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31The Importance of Any One Component:

Preparing for Normal Failure . . . . . . . . . . 31Impacts of Multiple Failures: Islands

and Cascading Outages . . . . . . . . . . . . . . . 33LONG-TERM BULK SYSTEM IMPACTS. 34

The Importance of Any Few Components:Large Reserves and Peak Capacity . . . . . 34

System Impact When No Outages Occur:Higher Costs and Lower Reliability . . . . 35

BULK SYSTEM RECOVERY FROM

OUTAGES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Page

SPECIFIC EXAMPLES OF ATTACKS . . . . 36Destruction of Any One Generator,

Transmission Circuit, or Transformer. . 36Destruction of One Major Multi-Circuit

Transmissions Substation or Multi-Unit

Powerplant . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Destruction of Two or Three MajorTransmission Substations . . . . . . . . . . . . . 37

Destruction of Four or More MajorTransmission Substations . . . . . . . . . . . . . 37

Chapter 5: Current Efforts ToReduce Energy System Vulnerability . . . . . 39CURRENT EFFORTS . . . . . . . . . . . . . . . . . . . . 39

Private Industry . . . . . . . . . . . . . . . . . . . . . . . . . 39Federal Government . . . . . . . . . . . . . . . . . . . . 40

States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43STATUS OF THE U.S. ELECTRICALEQUIPMENT MANUFACTURINGINDUSTRY . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Chapter 6: Options To ReduceVulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

PREVENTING DAMAGE TO THESYSTEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Harden Key Facilities . . . . . . . . . . . . . . . . . . . 48Surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Guards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Coordination With Law Enforcement

Agencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50LIMITING THE CONSEQUENCES . . . . . . . 51

Improve Emergency Planning andProcedures . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Modify the Physical System . . . . . . . . . . . . . 51I n c r e a s e sinning Reserves . . . . . . . . . . . . . 52

SPEEDING RECOVERY . . . . . . . . . . . . . . . . . 52Contingency Planning . . . . . . . . . . . . . . . . . . . 52Clarify Legal/Institutional Framework

for Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . 52Stockpile Critical Equipment . . . . . . . . . . . . 53Assure Adequate TransportationCapability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Monitor Domestic ManufacturingCapability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

GENERAL REDUCTION OFVULNERABILITY . . . . . . . . . . . . . . . . . . 55

Less Vulnerable Technologies . . . . . . . . . . . 55Decentralized Generation . . . . . . . . . . . . . . . . 56

Chapter 7: Congressional Policy Options . . . 59

PRESENT TRENDS . . . . . . . . . . . . . . . . . . . . . . 59



Page

Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . 60

LOW-COST GOVERNMENTINITIATIVES . . . . . . . . . . . . . . . . . . . . . . . . . . 60Specific Initiatives . . . . . . . . . . . . . . . . . . . . . . 60

Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . 61MODERATE AND MAJOR

INVESTMENTS TO REDUCE RISKS.. 62Specific Initiatives . . . . . . . . . . . . . . . . . . . . . . 62Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . 63

Boxes Box Page

A.The Armenian and San FranciscoEarthquakes’Effects on ElectricPower Systems . . . . . . . . . . . . . . . . . . . . . . . . 10

B. Hurricane Hugo’s Effect on South CarolinaElectric & Gas Co. . . . . . . . . . . . . . . . . . . . . 13

Box Page

C. New York City Blackout . . . . . . . . . . . . . . . . 22D. Transportation Impacts-Northeast and New

York City Blackouts . . . . . . . . . . . . . . . . . . 27E. The Organization of Electric Systems:

Utilities, Control Areas, Power Pools,

and Interconnections . . . . . . . . . . . . . . . . . . . 32

TablesTable Page

l. Cost of the New York CityBlackout—1977. . . . . . . . . . . . . . . . . . . . . . . . 3

2. Options To Reduce Vulnerability . . . . . . . . . . 73. Direct and Indirect Costs . . . . . . . . . . . . . . . . . 204. Comparison of Cost Estimates for

Power Outages . . . . . . . . . . . . . . . . . . . . . . . . 21

5. Cost of the New York CityBlackout—1977 . . . . . . . . . . . . . . . . . . . . . . 236. Options To Reduce Vulnerability . . . . . . . . . 487. Policy Package Components . . . . . . . . . . . . . . 60

. Id/l



Chapter 1

Introduction and Summary

INTRODUCTION

The reliability of U.S. electric power systems hasbeen so high that the rare occurrences of majorblackouts have been prominent national and eveninternational news items. The most notable inci-dents—in South Carolina after Hurricane Hugo, inSeattle after the 1989 cable fire, New York City in1977, or almost the entire Northeast in 1965—havedemonstrated that blackouts are very expensive andentail considerable disruption to society.

As damaging as these blackouts have been, muchworse events are possible. Under several differenttypes of circumstances, electric power systemscould be damaged well beyond the level of normaldesign criteria for maintaining reliability. Seismicexperts expect that several parts of the country couldexperience significantly larger earthquakes than theone that hit California in 1989. Hurricanes evenmore damaging than Hugo could move along theGulf of Mexico or up the Atlantic coast, maintainingtheir strength rather than losing it inland. Either type

of natural disaster could damage many electricpower system components, causing widespreadoutages over a long period of restoration andrecovery. Even more ominously, terrorists couldemulate acts of sabotage in several other countriesand destroy critical components, incapacitatinglarge segments of a transmission network formonths. Some of these components are vulnerable tosaboteurs with explosives or just high-power rifles.Not only would repairs cost many millions of dollars, but the economic and societal damage from

serious power shortages would be enormous.

Electric utilities normally plan for the possibilityof one, or occasionally two, independent failures of major equipment without their customers sufferingany significant outage. If the system can be betterprotected, or made sufficiently resilient to withstandgreater levels of damage, then the risk of a major,long-term blackout will be reduced. However, anysuch measures will cost money. Utilities are taking

some steps, but apparently, generally consider therisk to be too low to warrant large expenditures,which would ultimately be borne by their customers,or by stockholders if the State utility commission didnot approve inclusion of these costs in the rate base.

However, the consequences of a major, long-termblackout are so great that there is a clear national

interest involved. Steps that may not be worthwhilefor individual utilities could make sense from thenational perspective. The purpose of this report is toexplore the options for reducing vulnerability andplace them in context. It first reviews the threat fromboth natural disasters and sabotage to determinewhat damage might occur. However, an analysis of the probability of any of these threats materializingis beyond the-scope of this study. Chapter 3 reviewsthe impact of major blackouts that have occurred, inorder to help understand the costs of an even greaterone that might be experienced eventually. Chapter 4estimates the effect on the system when variouscritical components are damaged, and how thesystem can be restored. Chapters 5 and 6 describepresent and potential efforts to reduce vulnerability.Finally, chapter 7 suggests how Congress could act,depending on how seriously the problem is viewed.

SUMMARY

Causes and Costs of Extended OutagesA variety of events, both natural and manmade,

can cause power outages. Widespread outages orpower shortages lasting several months or more areunlikely unless significant components of the bulk power system—generation and transmission-aredamaged. The most probable causes of such damageare sabotage of multi-circuit transmission facilities,and very strong earthquakes or hurricanes.

The bulk power system is vulnerable to terrorist

attacks targeted on key facilities. Major metropoli-tan areas and even multi-state regions could losevirtually all power following simultaneous attackson three to eight sites, though partial service mightbe restored within a few hours. Most of these sitesare unmanned, and many are in isolated areas, withlittle resistance to attack. Powerplants can also bedisabled by terrorists willing to attack a manned site,or isolated from the transmission network by high-power rifle fire outside the site.

None of the attacks on electric power systems inthe United States has been large enough to causewidespread blackouts, but there are reasons forconcern that the situation may worsen. Small-scale,unsophisticated attacks on power systems have

– l -



2 q Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage

occurred here. Power systems in other countries,especially in Latin America and Europe, havesuffered much worse and more frequent damage.Latin American and African countries have suffered

outages of several weeks. Terrorist attacks in thiscountry have not been a major problem over the pastdecade, but that could change rapidly. Terroristscould select power systems as targets if they want tocause a large amount of economic disruption with arelatively small effort. Efficient selection of targetswould require more sophistication than has yet beenshown by terrorist groups in the United States, butthe required information and expertise are availablefrom public documents as well as from foreignterrorist groups. In addition, some foreign groups

might want to strike directly at the United States.

Hurricanes and earthquakes can also have adevastating effect on power systems, but the patternof destruction would be much different than after alarge-scale attack by saboteurs. Hurricanes affectdistribution systems much more than generation andtransmission. The relatively low lines are vulnerableto falling trees, flooding, and flying debris. Restora-tion may be a monumental task lasting several weeksor even months, but replacement parts are readily

available, and utilities are experienced in the type of tasks required. However, the lingering blackoutsfollowing Hurricane Hugo demonstrated that greateradvanced planning may be warranted. For instance,some types of transmission towers failed in the highwinds, suggesting that more resilient designs shouldbe used in vulnerable areas. Utilities along the Gulf and Atlantic coasts, areas vulnerable to hurricanes,should be studying the lessons learned from Hugo.

Earthquakes are quite capable of destroyinggeneration and transmission equipment as well asdistribution systems. However, where facilities havebeen constructed to withstand earthquakes, as inCalifornia, it is unlikely that more than a few keypieces of equipment would be damaged. The great-est concern is when an earthquake hits an area whereseismic disturbances have not been considered in thedesign of equipment. The central Mississippi valley,the southern Appalachians, and an area centeredaround Indiana have the highest potential for earth-quake damage. No plausible natural disaster should

damage the bulk power system so badly as to causewidespread power outages for more than a few daysif utilities have taken adequate precautions. Utilitiesnormally can restore power fairly quickly unlessmultiple circuits are interrupted.

However it might occur, a long-term blackout isextremely expensive. Direct impacts include lostproduction and sales by industrial and commercialfirms, safety (e.g., incapacitated traffic and air

system controls), damage to electronic equipmentand data, inconvenience, etc. Indirect costs includesecondary effects on firms unable to conduct busi-ness with blacked-out firms, public health (e.g.,inoperable sewage treatment plants), and looting.Table 1 summarizes the costs of the 1977 blackoutin New York City, which lasted for about 25 hours.Blackouts of a few hours or days have beenestimated to cost $1 to $5 per kilowatt-hour notdelivered, far greater than what the power wouldhave cost had it remained uninterrupted. Predicting

costs for any specific longer-term outage is veryuncertain because costs depend on many factorsincluding the customers affected, the timing andduration of the outage, and the degree of adaptationcustomers and utilities can achieve to mitigate theoutage.

Unless the damage is extremely severe, at leastpartial power could be restored in a matter of hours.Full restoration may take many months if a largenumber of key pieces of equipment have been

destroyed. In the interim, customers would be facedwith rolling blackouts, voltage reductions, or lowerreliability. An additional impact is that the cost of the power that is available will be high if some of themost economical generating stations are damaged orisolated from loads by transmission system damageand therefore idled.

Component Vulnerability and Impact

on System

Three factors determine the importance of anyindividual component—its susceptibility to dam-age; the effect on the power system of its loss; andthe difficulty of its replacement or repair. Thesefactors vary with particular circumstances. Forexample, generating stations can be destroyed bysaboteurs willing to enter the plant, but the presenceof utility employees performing their normal func-tions is a deterrent. However, if an insider isinvolved, sabotage becomes much easier. Similarly,the vulnerability of generating stations to earth-

quakes is low if they have been designed towithstand them and high otherwise.

Widespread, long-term blackouts could only becaused by damage to several circuits isolating



Chapter 1-Introduction and Summary q 3

Table l-Cost of the New York City Blackout—1977a

Impact areas Direct ($million) Indirect ($million) -

Businesses Food spoilage . . . . . . . . . . . . . . . .Wages lost . . . . . . . . . . . . . . . . . .

Securities industry . . . . . . . . . . . .Banking industry. . . . . . . . . . . . . .

Government (Non-public services)

Consolidated Edison

Insurance b

Public Health Services

Other public services

Restoration costs . . . . . . . . . . . . .Overtime payments . . . . . . . . . . .

Metropolitan TransportationAuthority (MTA) revenue:Losses . . . . . . . . . . . . . . . . . . .MTA overtime and

unearned wages . . . . . . . . . .

Westchester County Food spoilage . . . . . . . . . . . . . . . .Public services

equipment damage,overtime payments . . . . . . . . . .

Totals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

$1.05.0

15.013.0

10.02.0

2.6

6.5

0.25’

0.19

$55.54

Small businesses . . . . . . . . . . . . .Emergency aid

(private sector) . . . . . . . . . . . . .

Federal AssistancePrograms . . . . . . . . . . . . . . . . . .

New York StateAssistance Program . . . . . . . . .

New capital equipment(program andinstallation) . . . . . . . . . . . . . . . .

Federal crimeinsurance . . . . . . . . . . . . . . . . . .

Fire insurance . . . . . . . . . . . . . . . .Private property

insurance . . . . . . . . . . . . . . . . . .

Public hospitals-overtime, emergencyroom charges . . . . . . . . . . . . . .

MTA vandalism . . . . . . . . . . . . . . .MTA new capital

equipment required . . . . . . . . .Red Cross . . . . . . . . . . . . . . . . . . .Fire Department

overtime and damagedequipment . . . . . . . . . . . . . . . . .

Police Departmentovertime . . . . . . . . . . . . . . . . . . .

State Courtsovertime . . . . . . . . . . . . . . . . . . .

Prosecution andcorrection . . . . . . . . . . . . . . . . . .

$155.4

5.0

11.5

1.0

65.0

3.519.5

10.5

1.50.2

11.00.01

0.5

4.4

0.5

1.1

$290.16

aBased on aggregate data collected as of May 1,1978.

bOverlap with business losses might occur since some are recovered by insurance.

cLotting was included in this estimate but reported to be minimal.

Note: These data are derivative, and are neither comprehensive nor definitive.

SOURCE: Systems Control, Inc., Impact ofAssessrnent of the 1977 New York City Blackout (Washington, DC: US Department of Energy, July 1978), p. 3.

generating capacity from loads. No single failureshould have a significant effect on power flow tocustomers since most utilities maintain sufficient

generating and transmission reserves to accommo-date such failures. If more damage occurs, either togenerating stations or the transmission system con-necting them to loads, the system can separate intoislands. When these islands form, some have toomuch or too little generating capacity for their loadsand lose all power. Other islands with approximatebalance can maintain power, disconnected from the

remainder of the system. The pattern of break up isnot predictable, depending on the location of loads,which units are operating, the configuration of thetransmission system, and the nature of the initiating

event. Under extreme contingencies, substantialoutages will occur. Modern protective circuitryshould prevent the type of cascading failures acrossan entire system that occurred in the Northeastblackout of 1965, but there are many uncertaintiesover system behavior under untested conditions.

Power systems can be constructed to ride outalmost any earthquake or hurricane with onlyminimal damage to components that would requiremonths to replace. Most customers of an adequatelyprepared system will have their power restored

within a day or two, though extensive damage totransmission and distribution lines may mean someoutages for a few weeks. As noted above, however,a major earthquake east of the Rocky Mountains



4 qPhysical Vulnerability of Electric Systems to Natural Disasters and Sabotage

would cause major problems because few facilitiesare designed to withstand such an event.

Sabotage could cause the most devastating black-outs because many key facilities can be targeted.Substations present the greatest concern. The trans-mission lines themselves are even easier to disruptbecause they can be attacked anywhere along theline, but they are also much easier to repair.Generating stations are somewhat more difficultthan substations to attack because they are mannedand often guarded.

Substations are used at generating plants to raisethe low voltage of the generator to the level of thetransmission system, and near load centers to reduce

the voltage for the distribution network. The formerare partially protected by the routine activity atpowerplants, but few of the latter have any moredefense than a chain-link fence. In some cases, anattack can be carried out without entering thefacility.

The destruction of two or three well-selectedsubstations would cause a serious blackout. In manycases, most customers would be restored within 30minutes, but this damage would so reduce reliability

that some areas would be vulnerable to additionalblackouts for many months. Virtually any regionwould suffer major, extended blackouts if more thanthree key substations were destroyed. Some powerwould be restored quickly, but the region would besubject to rolling blackouts during peak demandperiods for many months. The impact would be lesssevere at night and other times when demand isnormally less than peak, because utilities then wouldhave a better balance of supply and demand. Thegreater the generating and transmission reservemargin, the less would be the impact on customers,because it is easier for utilities to find ways to getpower delivered despite the damage.

Current Efforts To Reduce Vulnerability

Utilities historically have expended great effortsto ensure reliability, but only over the past few yearshave they started to take seriously the possibility of massive, simultaneous damage on multiple facili-

ties. Awareness of the threat, however, has not yetled to the implementation of many measures tocounter it. Few if any utilities plan their system andits operation to accommodate multiple, major fail-ures, and key facilities are still unprotected.

Most of the actions the industry has taken havebeen instigated by the North American ElectricReliability Council (NERC) and the Edison ElectricInstitute (EEI). NERC completed a major study of

vulnerability in 1988. Some of the recommendationshave been adopted, while others are still underreview. EEI has a large and active security committ-ee which facilitates information exchange on physi-cal protection of facilities.

The Federal Government’s role for the most parthas focused on national security issues—how tokeep facilities operating which are vital to the UnitedStates during times of crisis. There has been lessconcern over the damage to the civilian economy

that a major power outage would cause. TheNational Security Council is the lead agency foremergency preparedness, with the Federal Emer-gency Management Agency serving as adviser. Bothof these agencies consider many vulnerabilities inaddition to energy. Energy concerns are included inthe new Policy Coordinating Committee on Emer-gency Preparedness and National Mobilization(PCC-EP/NM).

The Department of Energy (DOE) has primeresponsibility for energy emergencies. DOE’s Of-fice of Energy Emergencies (OEE) was created toensure that industry can supply adequate energy tosupport national security and the Nation’s economicand social well-being. Most of OEE’s activities havebeen directed at national security issues, but otherefforts have included information exchanges withState governments, disaster simulations, and contin-gency planning. OEE also operates the NationalDefense Executive Reserve Program, which recruitscivilian executives from the electric power industry

among others to provide information and assistancein case of national emergency. DOE also hasestablished a threat notification system to alertenergy industries to potential problems.

The Department of Defense administers the KeyAssets Protection Program. The Program’s purposeis to protect civilian industrial facilities essential fornational defense from sabotage during a crisis. TheProgram has identified electric power facilitiesrequired for vital military installations and defensemanufacturing areas and coordinated plans for theirprotection with the owners.

Two trends that may increase vulnerabilityshould be noted. First, the U.S. electrical equipmentmanufacturing industry has declined with the slow-



Chapter I---Introduction and Summary q 5

down in utility growth. Many production facilitieshave closed and the skills of their work forces havebeen largely lost. In addition, imports of equipmenthave risen to about 20 to 25 percent of the total

market, and most U.S. production capability iscontrolled by foreign companies. The concern re-garding vulnerability is that in a major emergency,say if all the transformers at several substations aredestroyed, foreign companies may lack the incentiveU.S. companies would have in expediting therestoration of service. If a worldwide resurgence of growth has filled their order books, will foreigncompanies accord adequate priority to U.S. emer-gency needs? There is no definitive answer to thisquestion. Some observers see no problem whileothers are quite concerned.

Second, power systems reserve margins aredropping as growth in demand exceeds construction.Reserve margins have been unusually high and stillare in some areas, so utilities find this trendeconomically beneficial. If a major disaster such asdiscussed in this report occurs, however, extrareserve margin would be extremely valuable inrestoring service to some customers. Utilities wouldhave additional options in finding ways to generate

and transmit power. These options are disappearingas margins return to planned levels.

Policy Options To Further Reduce

Vulnerability

Measures to reduce vulnerability can be groupedaccording to whether they prevent damage to thesystem, limit the consequences of whatever damagedoes occur, or speed recovery. An obvious way toprevent damage is to improve physical security and

earthquake resistance for key facilities. The mostproblematic sites can be fairly well-protectedagainst casual or unsophisticated attacks. The initialcost for walls around the transformers, crash-resistant fences, and surveillance systems would bea few percent of the replacement cost of the facility.Protection against a sophisticated attack would beextremely expensive, and probably not very effec-tive unless response forces are near.

However, even if key facilities are protected, there

is little that can be done to protect transmission linesagainst a saboteur with a high-power rifle. It is easyto destroy insulators on a transmission tower or theline itself, either of which will incapacitate the entireline. Such damage can be repaired quickly if

sufficient replacements are on hand, but the saboteurcan repeat it even more quickly in a different portionof the line or on other lines. Key transmission linescan thus be kept out of service (or at least kept

unreliable) for long periods.

Protection of key facilities can also be enhancedby improved planning and coordination with the FBIto provide warning, and police or military forces toprovide rapid response. Utility employee trainingcan also be expanded to include greater awareness of suspicious activities and recognition of sabotage, sowarning can be given to other facilities. Thesesuggestions also have been made by NERC’sNational Electric Security Committee and have been

adopted by NERC’s Board of Trustees in October1988.

Measures to limit the consequences of damageinclude improved training of system operators torecognize and respond to major perturbations, im-proved control centers and other system modifica-tions, and increased spinning reserves. The intent of these steps is to isolate the damaged areas and keepas many customers as possible on-line. Rapid actioncan prevent the disruption from spreading as far as

it otherwise might.Measures to speed the recovery focus on the

large transformers. The recovery period could begreatly reduced if more spares can be made availa-ble. One way would be to use those spares thatutilities normally consider necessary for their ownreliability but which are not actually in service at themoment. Legislation to relieve utilities of liabilityover potential blackouts in their own areas resultingfrom the absence of this equipment may be neces-sary. Alternatively, utilities could purchase spares

for key equipment and store them in secure loca-tions, or a stockpile of at least the most commontransformers could be established.

A stockpile might entail initial costs of about $50to $100 million for the step-down transformers usedto lower voltage from the transmission system foruse on a distribution network. Step-up transformersat generating stations are less standardized thanstep-down transformers. They employ a greatervariety of voltages and different physical layouts for

the high current bus from the generator. There ismuch less likelihood of finding a suitable spare, anda stockpile would have to be sizable. A lessexpensive alternative would be to stockpile keymaterials (copper wire, core steel, and porcelain)




and, in an emergency, to use preexisting designsinstead of custom designing for the particularapplication. Under these conditions, manufacturingtime could be reduced from over 12 months to about

6 months for four prototype units and two to threeper month thereafter. However, the product wouldlack the optimization and state-of-the-art improve-ments of a custom-designed unit. Suboptimal trans-formers, whether stockpiled or manufactured generi-cally, would be less efficient, resulting in signifi-cantly higher operating costs. Hence these expeditedtransformers might have to be replaced when betterones can be produced.

In addition to the measures intended to reduce the

vulnerability of the existing system, the evolution of the electric power system can be guided towardinherently less vulnerable technologies and configu-rations. In particular, a system that emphasizesnumerous small generators close to loads is, overallless vulnerable to sabotage. However, the totalrelative costs of moving toward dispersed systemsare not clear, and substantial government incentivemight be necessary to expedite the trend towardsmaller units. Another step would be to improvestandardization of system components to make

stockpiling, equipment sharing, and emergencymanufacturing easier. However, there are goodreasons for the diversity of components, and stan-dardization would result in some loss of efficiencyof the system. Greater use of underground cableswould also offer some advantages compared withoverhead lines, though if damage does occur,replacement of cables is much slower and morecostly.

These measures are listed in table 2. Some

measures are already being addressed to somedegree by the industry and government. Poli-cymakers can accept this level of progress if presenttrends seem adequate for the level of threat. Alterna-tively, a more activist approach can be taken toenhance these steps and add others. Some of thesteps listed would be quite expensive, but otherswould have nominal costs. Considering the presentbudget constraints, funding new costly initiativeswill be justified only if the threat is seen as serious.Therefore table 2 notes whether the activity is being

addressed under present trends, whether it can beimplemented at low cost, or whether it would berelatively expensive. Several items appear in twocategories, indicating differing levels of implemen-tation, or planning in one and implementation in

another. Utilities can be mandated to make theseinvestments without government financial assis-tance, but that will make implementation moredifficult unless they are assured of passing the costs

on to their customers.

The appropriate level of government interventionis a matter of value judgment and opinion. The levelof threat, both sabotage and natural disaster, cannotbe quantified, and the costs of a major outage arehighly dependent on the exact nature of the outage.If a worst case scenario is experienced, the costswould be much greater than all the measuresdiscussed here. If a very strong earthquake occursand suitable reinforcements avert major damage tothe power system, or if terrorism increases in thiscountry, then even very large investments will havebeen justified.

However, it is also impossible to quantify thedegree to which these measures would reducevulnerability. It is relatively easy to counter low-level threats, including almost all natural disasters,or prevent them from causing massive damage. It ismuch harder to counter any threat more serious than

a small, unsophisticated terrorist group, though therecovery from the damage can be expedited. Further-more, even greatly increased resistance to sabotagemight just move the problem elsewhere. As notedabove, if saboteurs can’t destroy substations, theycan still cause blackouts by shooting power lines.Alternatively, they can turn to other parts of theinfrastructure, such as telecommunications or watersupplies. Thus, it is questionable how much protec-tion society would be buying.

It is possible to reduce vulnerability, but at a cost.Any of these measures can be justified if the threatis estimated to be sufficiently serious. Not takingany action is an implicit decision that no action isworthwhile. With the level of terrorism in thiscountry as low as it is, many people will be skepticalof the need for any action, especially major invest-ments such as increased reserve margins or stock-piles. However, terrorism could increase much fasterthan the measures to counter it could be imple-mented. If this seems plausible, then at least

planning and other low-cost measures should bestarted earlier. If a rapid increase in terrorism seemsat all likely, then even expensive measures arereasonable insurance. There is no “correct’ answeras to which is the most appropriate approach.



Chapter l--lntroduction and Summary q 7

Table 2—Options To Reduce Vulnerability

Moderate to

Present trends Low cost major investments

A. Preventing damage

Harden key substations-protect critical equipment with walls, toughenequipment to resist damage, etc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

Surveillance (remote monitoring) around key facilities (coupled with rapid-response forces). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

Maintain guards at key substations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xImprove coordination with law enforcement agencies to provide threat

information and coordinate responses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . xB. Limiting consequences Improve emergency planning and operator training. . . . . . . . . . . . . . . . . . . . x xModify the physical system; improve control centers, increased reserve

margin, etc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Increase spinning reserves. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

C. Speeding recovery Contingency planning for restoration of service. . . . . . . . . . . . . . . . . . . . . . . x x

Clarify legai/institutional framework for sharing reserve equipment. . . . . . . xStockpile critical equipment (transformers) or any specialized material. . . .Assure adequate transportation for heavy equipment. . . . . . . . . . . . . . . . . . x xMonitor domestic manufacturing capability. . . . . . . . . . . . . . . . . . . . . . . . . . . x

D. General reduction of vulnerability xEmphasize less vulnerable technologies. . . . . . . . . . . . . . . . . . . . . . . . . . . .Encourage decentralized generating systems. . . . . . . . . . . . . . . . . . . . . . . . x x

SOURCE: Office of Technology Assessment, 1990.



Chapter 2

Causes of Extended Outages

Virtually everyone in the United States has someexperience with power outages lasting at least a few

minutes. Blackouts that last for a day or more areheadline-making news, such as the 1989 stormdamage in Washington, D.C. that kept some peoplewithout power for several days. Hurricane Hugo,one of the most destructive storms to strike NorthAmerica this century, caused extensive damage toelectric utilities in its path and left many peoplewithout power for several weeks. Over the lastdecade, concerns have begun to be raised about thepossibility of extended blackouts due to intentionaldamage to electric power and other energy systems

(e.g., sabotage). U.S. electric power systems havebeen targets of numerous isolated acts of sabotage.None has been serious enough to cause significantimpact, but there is increasing recognition that aconcerted effort by saboteurs could blackout majorregions of the country.

This chapter focuses on extended outages causedby natural disasters and sabotage and their resultingeffects on electric power systems. The impacts of extended outages, including costs, are discussed inchapter 3.

NATURAL HAZARDS

Natural hazards with the potential to causeextended blackouts include earthquakes, hurricanes,tornadoes, and severe thunderstorms. Each affectsthe power system differently. In general, earth-quakes could damage all types of power systemequipment, and are the most likely to cause powerinterruptions lasting more than a few days. Hurri-canes primarily affect transmission and local distri-

bution (T&D) systems, but the resultant floodingcould damage generating equipment. Tornadoes andsevere thunderstorms affect T&D lines directlythrough wind damage, and indirectly throughdowned trees, etc. Freak occurrences can causeparticularly high levels of damage. In October 1962,for example, the only hurricane in recorded historyto hit the west coast of the United States left parts of Oregon and Washington without power for up to 2weeks, primarily because of the time needed to cleardowned trees.

—

Earthquakes

An earthquake’s actual impact depends on thepopulation density and/or level of development inthe affected area, the type of soil or rock material, thestructural engineering, and advance warnings andpreparation. For both loss of life and propertydamage, the most damaging earthquake of thiscentury was Tangshan, China, in 1976 (Richter 7.8).Over 250,000 people died, and 20 square miles of thecity were flattened.

lThe 1988 Armenian earthquake

and the recent San Francisco Bay earthquake pro-

vide painful reminders of a strong earthquake’scapacity to do damage and the importance of goodseismic design and construction and emergencypreparedness planning to mitigate the impacts (seebox A).

Earthquakes sometimes result in compound disas-ters, in which the major event triggers a secondaryevent, natural or from the failure of a manmadesystem. In urban areas, fires may originate in gaslines and spread to storage facilities for petroleumproducts, gases, and chemicals. These fires often area much more destructive agent than the tremorsthemselves because water mains and fire-fightingequipment are rendered useless. More than 80

percent of the total damage in the 1906 SanFrancisco quake was due to fire.

Most of the United States has some risk of seismicdisturbance. The series of earthquakes that struck New Madrid, Missouri were probably the mostsevere in North America. The tremors were felt as faraway as Boston. The first quake, which occurred inDecember 1811, may have been stronger than the1906 San Francisco earthquake; it was followed in1812 by hundreds of after-shocks.

2According to the

American Association of Engineers, it is very likelythat a destructive earthquake will occur in theEastern United States by the year 2010. The centralMississippi valley, the southern Appalachians, andan area centered around Indiana have the highest

IRob~ Muir Wood, Earthquakes and Volcanoes (New Yorkj NY: Weidenfeld c-% Nicolsom 1987).

~obert Rcdferq The Making cfa Continent (New York, NY: Times Books, 1983).

–9–




Box A—The Armenian and San Francisco Earthquakes’ Effects on Electric Power Systems

On December 7, 1988, Armenia was struck by a 6.9 magnitude earthquake-the most destructive to hit theregion in centuries. Hundreds of buildings, including hospitals, schools, apartments, and industrial facilities, were

destroyed. At least 30,000 people were killed and some 500,000 were either left homeless or jobless. Several largecities in the epicentral region sustained massive damage and high casualties. Leninakan, population 290,000, was80 percent destroyed and Kirovakan, population of 150,000 was also heavily damaged. The city closest to theepicenter, Spitak, was completely destroyed.

1

The high death toll was caused by the collapse of buildings, many of which were constructed of masonry andprecast concrete. Building materials-such as structural steel and wood, which are more flexible than concrete—arein short supply in Armenia. Steel-frame buildings and other steel structures, such as construction cranes, sustainedfar less damage than concrete structures. Also, the lack of emergency preparedness planning contributed to thecatastrophe.

2

In contrast, the October 17, 1989 San Francisco Bay Area earthquake did not result in the catastrophic loss of life and property that was experienced in Armenia. The 7.1 magnitude earthquake was the strongest to hit the area

since 1907. The death toll is at least 66 people and approximately 3,000 injured. The quake caused an estimated$7 billion in damage in northern California.3 However, the growing California population, particularly in theearthquake-prone areas, could lead to a much greater loss of life and property in the future. Like Armenia, Californialies within a large seismically active area. Unlike Armenia, though, California has one of the most comprehensiveand up-to-date emergency preparedness plans in the United States and perhaps the world. For example, in June 1989,Pacific Gas & Electric (PG&E), the largest electricity supplier in the area, performed a company-wide earthquakeemergency exercise. This exercise proved invaluable in responding to the real thing 4 months later, according toPG&E.

4In addition, a great deal of attention is given to seismic considerations in structural design, engineering,

and construction. These and other factors can mitigate the impacts of a major earthquake disaster.

Armenia 5-In Armenia, electricity was interrupted for 4 to 7 days in the epicentral area. Two substations were

severely damaged or almost totally destroyed. A 220-kV facility in Leninakan sustained damage to capacitor racks,

ceramics, and circuit breakers. The 110-kV facility near Nalband was almost totally destroyed. The under-reinforcedmasonry and precast concrete control house collapsed and struck nearby equipment as it fell. Transformers, circuitbreakers, and capacitor banks were severely damaged. Soviet authorities had to bring in a rail-mounted substationto restore power to the region.

The two-unit Armenian Nuclear Powerplant, located 75 kilometers south of the epicenter, continued to operateduring and after the earthquake. But, the plant was eventually closed because the units required substantialadditional seismic reinforcement to remain safe, and the price was considered prohibitive.

No damage to steel transmission towers throughout the region was reported. Wooden poles also survivedintact, except for a few cases where partially rotted poles snapped at their bases.

San Francisco—About 48 hours after the San Francisco earthquake, electricity had been restored to all but12,000 of the 1 million customers affected. About half were those in the Marina District of San Francisco, which

sustained heavy damage.6

The Moss Landing powerplant and high-voltage switchyards, located near the earthquake’s epicenter, wereheavily damaged. PG&E indicated that a 340-ton air preheater was knocked off its pedestal and the bottom droppedout of an 800,000-gallon raw water tank, creating a bog.

7Only one section of a 230-kV circuit near Moss Landing

was knocked down. However, substantial damage was reported to distribution lines, especially in the Santa Cruzarea. Damage to distribution lines in San Francisco was limited because most are located underground.

8

l“Re~-wOrld t iSSOnS in Seismic Safety,” EPRI JournuZ, June 1989, p. 23.%id.3, ,Cwofia Governor Si@ Earthquake Relief Measures, ’

Washington Post, Nov. 7, 1989, p. A-14.

4“pG&E Cred i t s Mock Earthqu ake Drill in Respond ing Quickly to Real Thing,’ Electric Utility Week, Oct. 30, 1989, p. 3.

5“Re~ World bssons in Seismic Safety, ” op . CiL, fOOhlOk 1.664pG&E credits Mock mu~e Drill in Respond ing Qu ickly to RealThing,” Op. cit., footnote 4.

7,,Cop@ Wi t i ~m a ~et i : How pG&E’S Gas and Power system F~d” The Energy Daily, vol. 17, No. 234, Dec. 12, 1989, p. 3.

*“E~u~e Cuts off a Million PG&E Customers; Two-Thirds Back in Day,” Electric Utility Week, Oct. 23, 1989, p. 2.






margins required for wind resistance. Wood polesare inherently more flexible than steel towers, andthe flexibility reduces the seismic stress substan-tially.

12However, earthquakes can cause transmis-

sion outages when tower foundations are subject toearth slippage. Detailed soil analysis, adequatefooting design, and periodic inspection of existingfoundations are essential. In the 1971 San Fernandoearthquake, tower foundations failed that over theyears had their strength reduced by erosion oradjacent excavation for roads or buildings.

13The

only major transmission line damage reported dur-ing the 1989 San Francisco earthquake was a sectionof 230-kV circuit between the Moss Landing power-

plant and Watsonville. However, substantial distri-bution line damage was reported in areas close to theearthquake’s epicenter.

14

Hurricanes

The losses caused by a landfall hurricane are afunction of the storm’s strength and path and thearea’s population and economic development. Hur-ricanes are accompanied by torrential rains, typi-cally 3 to 6 inches but more if the forward progressis slow. Winds can exceed the design of a totalstructure or its components and cladding, or causehazards from windborne debris. The winds alsoproduce disastrous sea surges and waves. A largeproportion of the damage to coastal areas is causedby the storm surge, an influx of high water accompa-nying the hurricane. Other hazards include floodingof streams induced by the heavy rainfall andaccelerated coastal erosion. Occasionally tornadoesaccompany a hurricane.

l5

In the United States, most hurricane damageoccurs in a narrow zone along the coastlines of theAtlantic Ocean and Gulf of Mexico. The trend istoward fewer deaths due to improved storm warningand management. However, property loss is increas-ing because of greater coastal development.

l6

Effects on Electric Power Systems

Hurricanes primarily affect T&D lines. Highwinds can damage or uproot T&D poles. Poles can

also fall when soils become water saturated byaccompanying torrential rains, as was the case in1982 when Hurricane Iwa struck the HawaiianIslands and in 1989 when Hurricane Hugo hit theCarolinas. Hurricane Hugo knocked out power tomore than 1 million customers in the Carolinas.Many people were left without power for severalweeks. High winds and flying debris downedtransmission towers and several hundred miles of transmission lines, and falling trees knocked outthousands of distribution lines. Four utilities hardest

hit by the September 22, 1989 storm have indicatedthat the cost of restoring service and cleanup mayexceed $170 million. Insurers are expected to pay forabout 10 percent of the cost.

17See box B for a

discussion of Hurricane Hugo’s effect on the largestsupplier of electricity in South Carolina.

Tornadoes and Thunderstorms

In the United States, tornadoes are most prevalentin a region known as “Tornado Alley’ that extends

from the western Texas Panhandle across Okla-homa, Kansas, southern Nebraska, and Iowa, buthave been known to occur in all States.

18

Tornadoes kill hundreds of people and destroyproperty valued at billions of dollars every year. Thecombination of high winds and the sudden drop inair pressure causes heavy destruction of everythingin a tornado’s path.

19Heavy rain and large hailstones

often fall north of the tornado’s path. Tornadofamilies occur when up to six tornadoes are spawned

from the same thunderstorm.

20

Severe thunderstorms can produce damaginglightning and high winds with the potential to causeextended blackouts. For example, the 1977 NewYork blackout began with a series of severe light-ning strokes. Also, in 1989, a severe thunderstorm

12~W, op . cit., footn ote a “

l q~be f i W. Atwood, Jr., ~d Kenne~ L. -g , c ommen t s on hng , Op . cit., fOOtIIOte 6.

14 C$pG&E cr~i~ M~ k Ear@uake Drill in Respondin g Qu ickly to Real Thing,” op. cit., footnote 7, p. 3.

l s~ t e ad HZXM, op. cit., footnote 5.

16~ide

17c6D-ge E~tim~tes From Hurric,~e Hugo pegged a t up to $170 Fvf i l l io~” ,W ecfric ut i l i t y W eek , NOV. 13, 1989, p. 5.

18~~~mdo,” ~cGra~.HillEnqClopedia of science a& Technology, VO 1. 18, 1987.

lg<’~~do,” Encyclopedia Americanu, vol. 26, 1986.

“’llxnado,” McGraw-Hill Encyclopedia of Science and Technology, vol. 18, 1987.



Chapter 2-Causes of Extended Outages q 13

Box B—Hurricane Hugo’s Effect on South Carolina Electric & Gas C O .1

Hurricane Hugo was one of the most powerful hurricanes to strike North America in this century and the mostpowerful to strike the Carolinas. Property damages in North and South Carolina alone are estimated to be about $6.5

billion.

2

The hurricane caused extensive damage to electric utilities in its path. Hardest hit was South CarolinaElectric & Gas Co. (SCE&G), the largest supplier of electricity in South Carolina. Of SCE&G’S 430,000 customers,70 percent were blacked out during the storm. After 5 days, about 140,000, or 33 percent, were still without power.Full service was restored in less than 3 weeks.

3

In Charleston and Summerville, transmission and distribution circuits were especially hard hit by high winds,flying debris, and falling trees. The distribution system in these two areas was almost completely leveled. Whilethere was damage to the transmission system, the delay in repair was primarily due to the extent of the damage tothe distribution system. No significant damage was reported to generating units or transmission substationequipment. However, a cooling tower at one 600-MW unit was destroyed. Temporary repairs were made and theunit was back in service in less than a week. Only one power transformer, a 115/230-kV unit, which served adistribution station, was damaged in the storm.

There was a lot of damage from trees that were broken and blown into the distribution and transmissionsystems. Before repairs could be made, roads, lines, and access had to be cleared. Since it had been over 30 yearssince a major hurricane had struck the area, there was an unusually large amount of debris from wooded areas. Thedebris, while often not damaging the system, still required crews to physically remove branches, etc. from thetransmission towers, distribution poles, and conductors.

Throughout the SCE&G system, two-thirds of the transmission circuits were out of service immediatelyfollowing the storm. About 300 towers, out of a total 24,000, were either toppled or broken. Contributing factorsin the damage to the transmission system were the number of wooden pole transmission towers in the 230-kV and115-kV systems and the amount of rain that preceded the storm. Soil conditions were especially poor in wet andlow-lying areas. Transmission towers in those areas fell because the footing had become too soft and weak fromthe rain. SCE&G and other coastal utilities are reevaluating the foundation requirements of towers near marshes,swamps, and river crossings.

As many as 3,600 workers labored to restore electric service at SCE&G, with 75 percent of them working onthe transmission and distribution systems. Over 90 percent of the workers were from neighboring utilities andprivate contractors. Line crews came from Alabama, Arkansas, Florida, Georgia, Mississippi, Louisiana, Maryland,Tennessee, Virginia, and Illinois. Many of the crews brought their own vehicles and specialized equipment. Thiswas done as part of mutual assistance agreements among utilities.

1 c~azza, Schultz& Associates, kc., “Vulnerability of Electric Power Systems to Sabotage and Natural Disasters,” contractor reportprepared for th e Office of Technology Assessment, Nov.24, 1989.

z Edward V. Badolato et al., Clemson University, The Strom Th urmond Institute of Government and Public Affairs, “HticmeHugo-Jxxsons Learned in Energy Emergency Preparedness, ” 1990, p. 1.

3 ~lem were sti~ customers ~thout s~ice, but f ie problem w= ~th tie customers, not the u~ity. A&uIy homes and bu sinesses were

too severely damaged to have service restored.

—

blacked out portions of the Washington, DC area for rains, and lightning can wreak havoc on distributionseveral days, primarily because of the number of downed trees.


In general, property damage from tornadoes hasdeclined sharply due to improved prediction andincreased public awareness. Tornadoes are morelikely to cause damage to transmission and distribu-

tion lines over a small geographic area than wipe outa substation or generating plant.

Thunderstorms are more widespread and conse-quently more disruptive. High winds, torrential

lines.

Geomagnetic Storms

Large fluctuations in the Earth’s magnetic fieldcaused by solar disturbances are called geomagneticstorms. The Sun continuously emits a stream of protons and electrons called the solar wind. Solardisturbances such as sunspots and solar flares create

gusts in the solar wind, with a more intense streamof charged particles emitted. When the solar windhits the Earth’s magnetic field it produces electriccurrents in the atmosphere, altering the magnetic




field (as well as causing the aurora borealis). Bothsolar activity and geomagnetic storms ebb and flowin an 1 l-year cycle, although large storms may occurat any time. The peak of the current geomagnetic

storm cycle, which is expected to be the most violentyet recorded, is anticipated to arrive in approxi-mately 1991.

21


Fluctuations in the Earth’s magnetic field createelectric potentials (differences in voltages) on theEarth’s surface. The resulting electric potentialdifferences of 5 to 10 volts per mile fluctuate veryslowly and are typically aligned from east to west.Geomagnetically induced currents (GICs) flowwherever a power line connects areas of differentelectric potential. The magnitude of GIC depends onseveral factors including a power line’s location,length, and resistivity relative to the resistivity of theground. Areas with long east-west transmission linesand highly resistive geology typical of igneous rock formations are most likely to experience large GICs.

GIC produced in a power system may eitherdamage equipment or merely take it out of service

during the course of the geomagnetic storm. Bothmay lead to system outages. When struck by GICs,EHV transformers may overheat, resulting in perman-ent damage or reduced life. Voltages in transform-ers may drop significantly, leading to unacceptableloadings on generators and transmission lines result-ing in their being taken out of service by protectiverelays. Harmonic distortions created in the trans-formers may cause misoperation of relays, too.Relays may operate when they shouldn’t, resultingin equipment being taken out of service unnecessar-ily; they may also fail to operate when needed,resulting in damage to the attached equipment.

A very strong geomagnetic storm on March 13,1989 damaged voltage control equipment in Que-bec, resulting in the collapse of nearly the entiresystem for a 9-hour blackout. The same stormtripped protective relays in several areas of theUnited States and damaged several large transforme-rs. One of these transformers, a step-up unit at theSalem Nuclear Plant in New Jersey, had to be

removed from service, forcing the plant to shutdownfor 6 weeks.

SABOTAGE

No long-term blackouts have been caused in theUnited States by sabotage. However, this observa-tion is less reassuring than it sounds. Electric powersystem components have been targets of numerousisolated acts of sabotage in this country. Severalincidents have resulted in multimillion-dollar repairbills. In several other countries, sabotage has led toextensive blackouts and considerable economicdamage in addition to the cost of repair.

Some terrorist groups hostile to the United States

clearly have the capability of causing massivedamage-the loss of so many generating or trans-mission facilities that major metropolitan areas oreven multi-state regions suffer severe, long-term,power shortages. The absence of such attacks has asmuch to do with how terrorists view their opportuni-ties as with their ability. U.S. electric power systemsare only one target out of many ways of striking atAmerica, and not necessarily the most attractive.

This section briefly reviews the range of acts of

sabotage against electric power systems and thecapabilities of different types of saboteurs. How-ever, an analysis of the motivations and intentions of terrorists is beyond the scope of this study. Severalreferenced studies have considered this subject. Thereader is also referred to a forthcoming OTA study“The Use of Technology To Counter Terrorism.’

Experience With Sabotage

United States

Over the past decade there were few notable actsof sabotage, and apparently none that were intendedto cause harm other than to the local utility. The mostcommon cause has been labor disputes. In July 1989,a tower on a 765-kV line owned by the KentuckyPower Co. was bombed, temporarily disabling theline. No arrests have been made. In 1987-88, powerline poles and substations were bombed or shot inthe Wyoming-Montana border area. Later in 1988,similar attacks were experienced in West Virginia.Such attacks had also occurred in 1985 in West

zl~sdisassion is ~~from: “A Storm From th e S~” EPRIJournul, July/August 1989, pp. 14-21; V.D. Albertson, “GeomagneticDisturbance

Causes and Power System Effects,” ZEEE Power Engineering Review, July 1989, pp . 16-17; J.G. KappenmarL “Power System Susceptibility toGeomagnetic Disturban ces: %esen t and Future Concerns,” IEEE PowerEngineering Review, July 1989, pp . 15-16; and D. Soulier, “The Hydro-QuebecSystem Blackout of M arch 31, 1989,” ZEEEPower Engineering Review, July 1989, pp. 17-18.



Chapter 2-Causes of Extended Outages q15

Virginia and Kentucky. All these attacks occurredduring coal mine strikes.

22Two Florida substations

were heavily damaged by simultaneous dynamiteexplosions in 1981 in one of the most expensiveincidents. Damages totaled about $3 million, but nosignificant customer outages resulted. No arrestshave been made, but circumstantial evidence pointsto a contractor labor dispute.

23

Incidents stemming from unknown motives in-clude the cutting of guy wires and subsequenttoppling of a tower on the 1,800-MW, 1,000-kV DCintertie in California in 1987. There was negligibleimpact on the power system, because the load on theline was light at the time and it was scheduled for

maintenance the next day, so alternate power routeshad already been arranged. Damage was repaired inabout 4 days.

24No suspects have been announced.

Wooden poles were also cut in Colorado in 1980,bringing down a 115-kV line. The damage wasrepeated later in the year. Total costs were about$200,000 each time.

Another incident demonstrates that saboteurs canmount a coordinated operation. In 1986, three500-kV lines from the Palo Verde Nuclear Generat-

ing Station were grounded simultaneously over a30-mile stretch. It happened at a time when none of the nuclear reactors was operating, so no disruptionoccurred. Under different conditions, the reactorswould have shut down. No arrests have been made.

25

In 1989, several environmental extremists werearrested in the act of cutting a tower on a line inArizona. The group, which reportedly had beeninspired by Edward Abbey’s The MonkeywrenchGang, had been infiltrated by the FBI. Two members

of this group have prepared a manual detailing howto attack equipment and facilities, including powerlines, deemed harmful to the environment.

26

Since 1980, only Puerto Rico has experiencedextensive attacks that might be characterized asterrorist, as opposed to labor disputes or vandalism.In 1980-82, many bombings occurred at substationsand transmission towers. Some of these incidents

have been attributed to Macheteros, a separatistgroup. Several of the resultant outages lasted forseveral days.

The FBI and other agencies do not maintainstatistics on energy facility sabotage separately fromthose of other targets. The best available database isthat developed from public sources by a privateconsultant to the Department of Energy, whichrecords a total of 386 attacks on U.S. energy assetsfrom 1980 through 1989, an average of 39 per year.

27

Electric power systems, mostly transmission linesand towers, were the target in a large fraction of these386. This database may understate the problembecause some utilities may not publicize attacks out

of concern that more may be inspired.

Other Countries

Terrorist sabotage has been much more extensiveand violent in Europe and Latin America than in theUnited States. Attacks have been made by separa-tists, radical revolutionaries, and anti-technologyand anti-nuclear groups. A few examples willillustrate this:

France has experienced assassinations of energy

officials as well as bombings, arson, rocket attackson energy facilities, and grounding of transmissionlines. The saboteurs included anarchic, separatist,and political terrorists, and anti-nuclear extremists.

West Germany also is familiar with bombings andassassinations from the Baader-Meinhof group, RedArmy Faction, and other groups. In addition, therehas been an intensive campaign to destroy transmis-sion lines by cutting or bombing towers. In 1986alone, about 150 acts of such sabotage were committ-

ed. Much of the violence has been by politicallymotivated or anti-nuclear extremists. Transmissionlines from nuclear reactors have been a major focus,and the nuclear industry itself has been a target.

Attacks on electric power systems have been mostsevere in El Salvador. The Farabundo Marti Na-tional Liberation Front (FMLN) has repeatedlybombed or fired on transmission towers, substations,

22Ro~-tK. M~m, com~~t t. th e U.S. Dep~en t of Energy, t e s t f iony a t h e ~ g s before the Senate committee on Governmental A.ff t thS , Feb.

7-8, 1989, pp. 246-247.

~Kenne~ c~dwe l l , -ger of Covmte sec~~ Services, Flori& Power& Light CO., p e r SOXMI comrnunicat iou Feb. 7, 1990.

~Elec~ic Utility Week, Aug. 10, 1987.

~M~ l e n , op . cit., footn ote 22.

26Dave Foreman an d BN Haywood (~s.), E~O&$ense: A Field Guide to Afonkqwr e nc h i ng , 2n d d . (’lbcson, AZ: Ned Ludd BOOkS, 1987).

Z7Ro~fi K. M~eq personal comm un ication Feb . 7, 1990.




and hydroelectric powerplants. Up to 90 percent of the entire Nation has been blacked out by the FMLNduring some sabotage campaigns. The FMLN haseven produced a manual detailing how to attack an

electric power system. According to official sources,the FMLN has launched over 2,000 attacks onelectric systems since 1980. The Sendero Luminosa(Shining Path) revolutionary group has adopted asimilar strategy in Peru, frequently leaving Lima, aswell as a 600-mile stretch of the country, blacked outor under power rationing for 40 to 50 days.

28

Countries where insurgents or hostile forces havetargeted electric power systems have found itworthwhile to take protective measures. Passive

techniques, such as concrete sheaths around trans-mission tower legs, make them more difficult totopple. Some countries, including South Korea,maintain army conscripts at key facilities. Becauseof the expense of adequately protecting distributedsystems, others simply repair the damage, and maydesign their systems to be easily repairable.

The Threat

Intentional damage to an electric power systemcan be caused by a wide variety of actors. Most

common are ordinary vandals, typically hunters whoshoot at transmission lines or the insulators attach-ing them to towers. Utilities are experienced withhandling vandalism, which is very unlikely to causemassive damage. Hence this report is not concernedwith vandalism except to the extent that remedialmeasures for more serious attacks might have anincidental value in reducing it.

The Single Saboteur

Most of the U.S. incidents noted above could havebeen caused by one person. The fact that most havebeen relatively minor suggests that either the sabo-teurs did not know how to cause greater damage orthey did not want to. In sabotage initiated over labordisputes, the perpetrators usually are trying to hurtthe utility or their suppliers, not to cause widespreadblackouts. The dispute would have to get extraordi-narily bitter before anyone would risk antagonizinga large part of the public. A personal grievance mightbe a more probable motivation for an individual totry to cause widespread damage. A utility employeewho felt misused might want to use his expertise toretaliate in a spectacular fashion. Alternatively, any

of the motivations of a group, discussed below,might apply to an individual who decides to takematters into his own hands.

The primary difficulty faced by a single saboteurintent on causing a devastating blackout would be toassemble all the necessary information and supplies.He would have to get the idea in the first place;research how electric power systems work and whatthe vulnerable points are; determine the layout of histarget system; physically locate the actual targets;plan the attack in considerable detail; procureexplosives; rehearse; and carry out the actual attack.If any of these steps were deficient, the attack wouldlose effectiveness.

It is unlikely, though not impossible, that anindependent individual will combine the motivation,expertise, contacts to procure explosives, tenacity,and nerve to disable as many as eight facilitiessimultaneously. This would require visiting all thesites over several days and would entail a significantrisk of detection. A more probable scenario for theindependent saboteur is a one-night series of assaultson as many facilities as he can reach. Such an attack can still cause major problems for a utility, but farfewer than would more widespread damage. Theo-

retically, the saboteur could continue his attacks, butonce utilities are alerted they can post guards to deteran immediate reoccurrence of the rampage.

Terrorist Groups

Organizations initiating terrorist attacks in othercountries include separatists, political radicals, andanti-technology and/or anti-nuclear extremists. Theonly significant separatist movement in the UnitedStates in the past 125 years has been in Puerto Rico,

and none seems likely to develop. Nor do theanti-technology or anti-nuclear movements seemlikely to turn to large-scale, violent extremes, in partbecause people have peaceful ways to try to imple-ment their views.

This country has had more experience withpolitically oriented extremism, particularly in thesixties and seventies. The Weathermen and othergroups did bomb some transmission towers andmight well have wanted to cause more damage.Much of this violence was in reaction to the war inVietnam It should be noted that current trends, if anything, indicate a lessening of terrorist attacks.



Chapter 2-Causes of Extended Outages q 17

However, under some conditions, this threat mightreemerge, possibly by environmental extremists.Electric power systems probably are not the mostobvious targets but could become fashionable if terrorists choose to inflict great inconvenience andeconomic cost on society instead of more dramaticacts such as assassinations or destruction of sym-bolic targets. The Evan Mecham Eco-TerroristInternational Conspiracy (EMETIC) targeted elec-tric system facilities in 1987 -89.

29Even extortion on

a gigantic scale might be considered to raise fundsand shake confidence in existing institutions.

Foreign groups could also import violence. Amer-ican property and individuals abroad have been the

targets of attack in many countries. It is not clearwhy some of the groups hostile to the United Stateshave not carried their struggles here, and therefore itcannot be guaranteed that they won’t. Groups involatile areas such as the Middle East and CentralAmerica might want to hurt the United Statesdirectly. Separatists might want to pressure thiscountry to influence events in their country, even if they have no direct conflict with us. Drug cartels inColombia could hope to make our drug wars toocostly. Environmental extremists concerned over

potential global climate change might see the U.S.electric power system as symbolic of the refusal tocurb production of carbon dioxide. The logic doesnot have to be sound for an attack to be damaging.

A group is much more likely than an individual tobe able to mount a major assault on sufficientfacilities to cripple a power system. A groupcombines all its members’ skills and contacts andcan share tasks. In particular, international contactsamong terrorist groups multiply the expertise and

resources available to any group. The knowledgegained by destroying substations and power lines inGermany and El Salvador is available in the UnitedStates. In fact several “how-to” sabotage manualsare available for sale here. Weapons and explosivesare also widely available here and abroad. If foreignterrorist groups wish to attack the United States, theycan probably find assistance herein obtaining target

information and in camouflaging their activities.30

However, a group is also much more likely to bedetected than an individual.

Military AttacksCommandos with special training and essentially

unlimited resources and support could mount a farstronger attack than could even the most sophisti-cated subnational terrorist group that has yetemerged. The Soviet Union is reported to have suchforces, called spetsnaz, available for operations inthe United States.

31The object would be to create

havoc and demoralization before overt hostilitiescommence. While this risk is diminishing, it has not

disappeared. Alternatively, a hostile country mighttake this approach if it were unable or unwilling todeclare war but wanted to take some military actionagainst the United States.

The ultimate attack would be an overt militaryoperation. The vulnerability of electric power sys-tems can have serious national security implications.For example, in World War II, Germany’s highlycentralized electric system was not attacked untillate in the war. German officials, surprised at thisomission, commented after the war that ‘‘The war

would have finished two years sooner if you (theAllies) had concentrated on the bombing of ourpowerplants earlier. . . “ When the Allies finallydid destroy Germany’s electric generating andsynthetic fuel facilities, the German economy wascrippled.

32This experience will not be ignored in

any future hostilities.

For defenses to be effective against militaryassault, either commando or overt, they would haveto be extraordinarily strong and expensive, well

beyond anything that might be justified againstsubnational terrorists. Since even a limited terroristattack could have extremely serious consequences,this report focuses on responses to that threat.Actions necessary only to counter military threatsare beyond the scope of this report, but it notespotential benefits of a few of the counterterrorismsteps.

~~obert K. Mweq personal communication Apr. 2, 1990.

~onah Alexand er, “International Netw ork of Terrorism,” Political Terrorism and Energy, Yonah Alexander an d Ch arles K.Ebinger (eds.) (New

York, NY: Fraeger Publishers, 1982).31vic tor Suvo rov , s p E T s N ~ , Th e I n s i de s t o r y of the Sotiet Special ForCes (New yor& N Y” W.w. Norton & CO., 198’7) md M pm~ reprinkd

in the Hearings Record of the Semte Committee on Governmental Affairs, “Vulnerability of Telecommun ications an d Energy Resources to error i~”Feb. 7 an d 8, 1989.

szFede~ Emergency Management Agency, ‘‘Dispersed, Decentralized and Renewable Energy Sources: Alternatives to National Vulnerability andWar,” December 1980.



Chapter 3

Impacts of Blackouts

The United States has had little experience withblackouts that last more than a few days. The only

major blackouts over the past 25 years have been the1965 Northeast blackout, the 1977 New York Cityblackout, the August 1988 downtown Seattle black-out, and the 1989 blackout in the Carolinas. Most of what we know is anecdotal evidence, drawn primar-ily from the well-documented 1965 Northeast and1977 New York City blackouts. The lessons learnedfrom the recent Hurricane Hugo experience shouldprovide additional information on the impacts of blackouts. This is particularly important in light of the technological changes that have occurred in the

last decade-especially the proliferation of comput-ers and automation in all sectors and the advances intelecommunications which require a reliable supplyof power.

This chapter provides an overview of costs andreviews the quantitative estimates for both actualand hypothetical outages. The remainder of thechapter discusses the impacts of blackouts on theindustrial, commercial, and residential sectors andon essential services and infrastructure.

OVERVIEW OF COSTS OFBLACKOUTS

Blackouts have impacts that are both direct (theinterruption of an activity, function, or service thatrequires electricity) and indirect (due to the inter-rupted activities or services). Examples of directimpacts include food spoilage, damage to electronicdata, and the inoperability of life-support systems inhospitals and homes. Indirect impacts include prop-erty losses resulting from arson and looting, over-

time payments to police and fire personnel, andpotential increases in insurance rates. Direct andindirect impacts can be characterized by whetherthey are quantifiable in monetary terms (economicimpacts); relate to the interruption of leisure oroccupational activities (social impacts); or result inorganizational, procedural, and other changes inresponse to blackout conditions (organizationalimpacts).

l

Direct impacts can be avoided if the end-user hasbackup systems, but these have often proved unrelia-ble. Indirect impacts may be partially mitigatedthrough contingency planning, improved communi-cations, customer education, social programs, andother planning approaches.

2

Estimating the costs of electric power outages isdifficult and imprecise because the economic valueof electric reliability to different customers is notwell-understood. Only recently has much progressbeen made in developing economic values forreliability, including the development of analyticaltechniques for measuring or estimating the direct

and indirect costs of actual and hypothetical outages.

To estimate costs, utilities and public utilitycommissions (PUCs) rely on either hypothetical costanalysis or reconstruct the level of economic activitythat might have occurred had there been no blackout.Both of these methods have inherent uncertainties,and theoretical models have their own shortcomings.Also, indirect and social costs often cannot bequantified but only enumerated.

3

Types of Costs

The kinds of costs considered in value of reliabil-ity estimations include both short-term outage andlong-term coping or adaptive response costs.

The true economic cost of any outage is theopportunity value of profit, earnings, leisure, etc.that would have been produced but for the loss.Therefore, one must ascertain what the lost opportu-nities were and how they would have been valued by

those who suffered the loss. The short-term outagecosts are incurred during and shortly afterward, andinclude product spoilage, lost sales, foregone lei-sure, and other opportunity costs. Long-term copingcosts are incurred when customers invest in equip-ment to mitigate the effects of a shortfall. Investmentin backup generators, for example, is clearly made tomitigate the impact of future outages. Historically,mitigation costs have been relatively insignificant in

Iw i l lim T. ~ e ~ , Ja e CO ~ ~d Peter D . B~ , ‘CCo~t of power ou~ges—~e 197’7 New York City Blackou~” paper presented at th e ~~

Industrial and Commercial Power System Technical Conference, Seattle, WA, May 14-17, 1979, pp. 65-66.

?Ibid.

31bid., p. 66.

–19–




Table 3—Direct and Indirect Costs

Direct cost components(costs to household,

Primary electricity user firm, institution, etc.) Indirect rests Remarks

Residential . . . . . . . . .

Industrial, commercial,agricultural firms. . .

. . . . . . . . a. Inconvenience, lost leisure,stress

b. Out-of-pocket costs —spoilage-property damage

c. Health and safetyand. . . . . . . . a. Opportunity costs of idle

resources —labor —land-capital

—profitsb. Shutdown and restart costs

c. Spoilage and damaged. Health and safety effects

Infrastructure and publicservice . . . . . . . . . . . . . . . . . . a. Opportunity cost of idle

resourcesb. Spoilage and damage

a. Costs on other householdsand firms

b. Cancellation of activitiesc. Looting/vandalism

a. Cost on other firms that aresupplied by impacted firms(multiplier effect)

b. Costs on consumers ifimpacted firm supplies a finalgood

c. Health and safety-relatedexternalities

a. Costs to public users ofimpacted services andinstitutions

b. Health and safety effectsc. Potential for social costs

stemming from Looting andvandalism

Indirect costs are a minimal, if notnegligible, fraction of total(direct and indirect) costs of acurtailment.

Indirect effects are likely to beminimal for most capacity-related interruptions, but can besignificant component of totalcosts for longer duration energyshortfalls.

Indirect costs constitute a majorportion of total costs ofcurtailment.

SOURCE: M. Munasinghe and A. Sanghvi, “Reliability of Electricity supply, Outage Costs and Value of Service: An Overview,” 7%e Energy Journal, vol. 9,19s8, p. 5.

most parts of the United States due to the highstandard of reliability.

4

Short- and long-term costs may have both directand indirect elements (see table 3). Direct costs arethose suffered by the direct customer, such asspoilage or lost production. Indirect costs includethose realized by customers of an impacted firm;they may have to purchase higher cost substitutes,incur additional production costs, or have unrecov-ered costs. Indirect costs can be several times aslarge as direct costs because the loss of a single inputmay retard an entire production process. Othercomponents of indirect costs include the multipliereffect from lost wages and other factors of produc-tion

5and potential social costs stemming from

looting and vandalism. Social costs are difficult toquantify and have been generally neglected inestimations. For example, while losses resultingfrom looting and arson can be identified and

assigned dollar values, the secondary or ripple

effects often cannot be enumerated. These secondaryeffects, such as a potential increase in insurancerates, represent long-term and far-reaching eco-nomic implications.

6

Hypothetical Outage Cost Estimates

Numerous analyses have estimated the costs of unserved electricity for various consumer sectors.

Most of these are based on survey data fromparticular utility service areas. They vary substan-tially among classes of customers and amongcustomers within each class.

Table 4 shows some estimates of the costs of power outages. The more recent estimates, based onsurvey data, reflect the value of service reliability interms of the average dollar change in a consumer’smonthly bill that would offset a change in servicereliability. These estimates cannot be compared

directly because of differing methodologies, as-

‘$Fr~ J. Alessio, Peter Lewinj and Steve G. PWSOIIS, “The Layman’s Gu ide to th e Value of Service Reliability to Consurn ers,” in Criterion, Inc.,

Th e Value of Service ReZiabiZity to Consumers (Palo Alto, CA: Electric Power Research Institute, EPIU-EA-4494, May 1986).

%id.

6Arun P. San@vi,” Economic Costa of Electricity Supply Interruptions: U.S. and Foreign Experience, “in Criterion, ~c., op. cit., foot note4, p. 8-45.






Box C—New York City Blackout

On July 13, 1977, at approximately 9:41 p.m., New York City plunged into total darkness. The blackout wascaused by a series of lightning strokes compounded by improperly operating protective devices, inadequate

presentation of data to system dispatcher, and communication difficulties. These combined factors createdconditions that cascaded to the point of total collapse of the Consolidated Edison (Con Ed) system.

l

On this day, Con Ed was providing approximately 5,860 MW of electricity to its New York City customersover 345- and 138-kV transmission lines and cables. Approximately half of the electricity was being generated byplants located in Brooklyn, Manhattan, Queens, and Staten Island; the remaining load was supplied by Con Edgenerators outside the city, and purchased from utilities in upper New York State and Canada. Con Ed also waswheeling 240 MW to the Long Island Lighting Co. (LILCO) and approximately 200 MW of emergency power tothe Pennsylvania-Jersey-Maryland Pool.

At 8:37 p.m. lightning hit two 345-kV lines supplying 1,200 MW of electricity from the Indian Point No. 3and the Bowline and Roseton generating units to the City. The resulting short circuit caused the protective relays,located at the Millwood West and Buchanan South substations, to open the circuit breakers and disconnect the lines.

This interrupted the supply (870 MW) from Indian Point No. 3, which then shut down automatically. Isolating thegenerator at Indian Point No. 3 caused one of the 345-kV transmission lines between Pleasant Valley and MillwoodWest to increase load above its normal capacity rating (825 MW), although it remained within its long-termemergency rating (860 MW). This caused operators to reduce voltage by 8 percent. The Con Ed system operatorrequested all generators within the city to increase power production to replace the loss and relieve loading on the345-kV line. However, by 8:55 p.m. the in-city generation had increased (550 MW) only enough to compensatefor the two-thirds of the power lost.

Nineteen minutes later, another bolt of lightning hit with a devastating effect. This bolt hit one of the remaininglarge, heavily loaded 345-kV lines bringing power to the city. Normally, the strike should have caused relays totemporarily isolate the line for mere moments-just long enough to dissipate the lightning’s energy. However, onecircuit breaker failed to operate properly, causing other relays to isolate the line entirely. This loss of transmissioncapacity overloaded remaining lines, resulting in their isolation.

With the now inadequate supply of power, Con Ed had no choice but to shed load, blacking out parts of Westchester County. Simultaneously, LILCO’s spinning reserves automatically increased output. However, thecables connecting LILCO and Con Ed were overloaded as a result, and LILCO disconnected itself from Con Ed,eliminating a further source of power.

At 9:27 p.m., still another lightning bolt struck a power line. When this happened, the remaining Con Edgenerators could not maintain the load and were shut off automatically. At the same time, Public Service Electric& Gas Co. disconnected from the Con Ed system severing Con Ed’s remaining ties to the north. At approximately9:41 p.m. the 1977 New York City blackout began.

Full power was restored in about 25 hours. Many protective circuit breakers had to be individually examinedand reset. The city was powered up one section at a time, carefully balancing the added loads with supply, as

described in chapter 5.lsy~tm~ Con@oI, IIIc., ImpactAssess~nt cfthe 1977 New York City Blackout, prepared for he U.S. mptim~t of EIMXSY, J~Y 1978s

p. 13.

hotels, plus expenses for hiring additional security Another actual cost analysis was based on aguards.

llutility-imposed 25 percent curtailment during peak

hours for 25 consecutive days in Key West, Florida

One industry that profited from the Seattle black- in July-August 1978. The Key West system experi-

out had electrical generators for rent. One company enced a generating equipment breakdown that re-

received 50 to 60 phone calls for 2 generators; duced electric supply to 80 to 90 percent of peak another only had 3 available.

12 demand. Total electric shortage impact costs in Key

l lAddy Hatch “B~~inesses Assess~g ~sses From th e Blackou~” The Seattle Times, VO 1 . 111, No. 215, s=. C. p. 4. SePt. 7* 1988.

lzIbid.



Chapter 3-Impacts of Blackouts • 23

Table 5-Cost of the New York City Blackout—1977a

Impact areas Direct ($M) Indirect ($M)

Businesses Food spoilage . . . . . . . . . . . . . . . .Wages lost . . . . . . . . . . . . . . . . . .Securities industry . . . . . . . . . . . .Banking industry . . . . . . . . . . . . . .

Government (Non-public services)

Consolidated Edison Restoration costs . . . . . . . . . . . . .Overtime payments . . . . . . . . . . .

Insurance b

Public Health Services

Other public services Metropolitan TransportationAuthority (MTA) revenue:Losses . . . . . . . . . . . . . . . . . . . 2.6MTA overtime and

unearned wages . . . . . . . . . . 6.5

Westchester County Food spoilage . . . . . . . . . . . . . . . .Public services:

equipment damage,overtime payments . . . . . . . . . .

Totals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

$1.0 Small businesses . . . . . . . . . . . . .5.0 Emergency aid

15.0 (private sector) . . . . . . . . . . . . .13.0

Federal AssistancePrograms . . . . . . . . . . . . . . . . . .

New York StateAssistance Program . . . . . . . . .

10.0 New capital equipment2.0 (program and installation) . . . .

Federal crime insurance . . . . . . .Fire insurance . . . . . . . . . . . . . . . .Private property insurance . . . . . .Public hospitals-

overtime, emergencyroom charges . . . . . . . . . . . . . .

MTA vandalism . . . . . . . . . . . . . . .MTA new capital

equipment required . . . . . . . . .Red Cross . . . . . . . . . . . . . . . . . . .Fire Department

overtime and damagedequipment . . . . . . . . . . . . . . . . .

Police Departmentovertime . . . . . . . . . . . . . . . . . . .

State Courtsovertime . . . . . . . . . . . . . . . . . . .

Prosecution andcorrection . . . . . . . . . . . . . . . . . .

0.25C

0.19

$55.54

$155.4

5.0

11.5

1.0

65.03.5

19.510.5

1.5

0.2

11.00.01

0.5

4.4

0.5

1.1

$290.16

%aeed on aggregate data collected as of May 1,1978.~eriap with business losses might oeeur sines some are reeovered by insurance.%oting w= induckd in this estimate but reported to be minimal.

NOTE: These data are derivative, and are neither comprehensive nor definitive

SOURCE: Systems Control, Inc., /rnpactAssessrnent o~the 1977 New York City B/ackouf, prepared for the U.S. Department of Energy, July 1978, p. 3

West were $2.30 kWh average for all non-residential prised 60 percent of the loss to both commercial andusers. The breakdown is $2.00 to producers (e.g., industrial users. Unrecovered costs totaled 20 and 30

auto repair, stores, schools), $0.10 to employees percent for commercial and industrial users, respec-(wage loss), and $0.20 to consumers. The cost is tively. The inconvenience from postponing appli-approximately 50 times the then $0.05/kWh price of ance use comprised 36 percent of the cost toelectric power in Key West.

13residential users.

14

In addition, several empirical studies on user loss SECTORAL IMPACTSfrom power shortages were conducted. These studiesexamined two electric power shortages of several

Industrial

hours in San Diego, the Key West curtailment, and Many industrial processes are highly sensitive tonatural gas shortages in Alabama, Kentucky, Ohio, power disruptions. An interruption of less than 1and Tennessee. The findings concluded that the second can shut plant equipment down for several

extra cost to make up interrupted production com- hours. Outages can spoil raw materials, work-in-

1qJack Fau@tt AS~~t~,AwlYtiCalF ra~wOrkfOr Evaluating Energy and Capacity Shortages (Palo Alto, CA: Ek@ic power Raach ~titut%

EPRI-EA-1215, April 1980), vol. 2, pp. 1,5-1.7.

IAfinest M s ti + “Shortage Costs: Results of Emp iricalStudi=, “ in Criterion , Inc., op. cit., footnote 4, pp. 3-3, 3-11.




progress, and finished goods. Spoilage is a signifi-cant problem in chemical processes, steel manufac-ture, food products, and other industries.

15Black-

outs also pose opportunity costs from idle factors of

production. Human health and safety effects areanother major concern in industrial outages. Notonly are the workers exposed to possible injury orhealth hazard from the power interruption, theneighboring population also could be exposed to risk from hazardous spills or releases due to the loss of environmental or safety equipment.

l6

costs

Industrial-sector costs are more directly measura-ble in terms of equipment damage, loss of materials,cost of idle resources, and human health and safetyeffects. Lost output is the primary cost. One ap-proach is to take the classic economic factors of production—land, labor, capital, profit, and en-trepreneurship-and identify the value of the fore-gone opportunities for each of them for variousindustrial processes. Those opportunities can beevaluated using some measure of excess capacity of each of the factors of production. When all resources

are idle (have excess capacity), the opportunity costis estimated at the value of wages. When allresources are fully employed, the loss includes thevalue that would have been added in production.One may need to add the costs of spoilage and otherdamage, long-term adaptive costs, indirect costs,and consumer surplus if final demand is left un-served.

For example, in 1965 Dunlop Tire’s Buffalo plantlost 1,700 tires (worth $50,000) when power failed

during the critical curing process. The Tonawanda,New York Chevrolet plant had to junk 350 engineblocks because high-speed drills froze while boringpiston holes. Ford’s huge Mahwah, New Jerseyassembly plant had to wait for standby power whenOrange & Rockland Utilities, Inc. gave West Pointpriority because “the cadets need to study to-night. ‘ ‘17

Commercial

For many commercial customers, any outage of aduration of more than 1 or 2 seconds has a significant

cost due to computer problems, equipment jamming,or ruined product. For these firms a l-hour outage isnot substantially more costly than a 10-secondoutage.

With the increasing pervasiveness of computersand communications systems in all economic activ-ity-commercial sales, offices, industrial processcontrol, finance, communications, public workscontrol, government-their performance in a black-out affects all impact sectors. The major conse-quences include costs associated with the inability of the computer to perform critical functions, loss of data, and possible damage to the computer andperipheral equipment. Degradation of storage mediais a major concern if the room temperature strays toofar from the norm.

18Critical systems usually have

backup power sources, although most are notdesigned for an extended blackout, when the operat-ing environment becomes more of a concern.

An entirely new industry has grownup around theneed for backup systems and recovery services for

heavily computer-dependent activities. Computersecurity companies take over computer functions,such as payroll, inventory, and records maintenance,when disasters tempera.riiy or permanently disablecorporate computers.

19

costs

The commercial sector is the most difficult of thethree sectors to analyze and has been studied theleast. Its boundaries and components are ill-defined,and it incorporates a very wide variety of products

and services. In many areas, the commercial sectoris the most rapidly growing customer class, and thecosts of outages may average the highest.

20

Some utilities define the commercial sector aswhat is left over after accounting for residential andlarge industrial customers. Using this definition,large apartment buildings, small grocers, and moder-

I SM . M~inghe and A. Sanghvi, “Reliability of Electricity Supply, Outage Costs and Value of Service: An Overview,”The Energy Journal, vol.

9, 1988.

l~MOSbae~op, cit., fOOtnote

14.

IT~~~e Disaster ~t wmn’~” Time, NOV. 19, 1965, p. 36.

1 8 s y s t em5 Control, ‘C.* ‘‘Imp act Assessment of the 1977 New York City Blackou t’ prepared for th e U.S. Depar tmen t of Energy, July 1978, p. 46.

l~son Greer, ‘‘Weyerhaeuser Division Waits for Data Disasters,” Puget Sound Business Journal, vol. 9, No. 21, sec. 2, p. 5A, Oct. 3, 1988.

~Sanghvi, op. cit., footn ote 6, P . *-26.



Chapter 3-Impacts of Blackouts q 25

ate-sized manufacturing firms would all fall in thecommercial class. Another classification is based onSIC (Standards of Industrial Classification) codes.Still others are based on peak demand levels, a kWh

rule, or the voltage of service.21

For those parts of the commercial sector where theprincipal activity is production that can be made upafter an outage without substantial cost (e.g., laun-dries, drycleaners, bakeries, etc.), the idle resourcecost approach used in the industrial sector probablyis most appropriate. At the other extreme, largeapartment buildings can be viewed as a concentra-tion of households, and analyzed using one of theresidential-sector outage cost methods.

22

Between these two extremes are commercialestablishments that sell products and those thatprovide services. The potential for product damageand the ability to makeup lost production are criticalhere. Food stores and warehouses, for example, canhave significant spoilage costs. Similarly, fast-foodoutlets not only can have high spoilage costs, butalso service immediate demand and usually cannotmake up lost business.

23

Agriculture

An Ontario Hydro survey conducted between1976 and 1979 indicates there can be significanthazards to livestock and produce during a blackout.Sensitive processes include incubation, milking,pumping, heating, air-conditioning, and refrigera-tion. Of the larger-than-average farms included inthe survey, 26 percent had standby generation.About 60 percent had facilities to shut off a portionof their load in an emergency.

24In 1965, farmers

deprived of power for their milking

hooked them up to generators operatedmotors.

25

Residential

machines

by tractor

Never are Americans more aware of their depend-ence on electricity and the machines it drives thanduring a blackout. Without electricity, air-conditioning is off, and many people do not have

heat or hot water. In high-rise buildings, people mustuse stairwells. Senior citizens and the disabled are atan extreme disadvantage in outages. Consumers donot have lights, refrigerators and freezers, stoves and

microwave ovens, toasters, dishwashers, intercoms,televisions, clocks, home computers, elevators andescalators, doorbells, hair dryers, heated blankets,can openers, food processors, carving knives, tooth-brushes, razors, and garage door openers. With theadvent of high-tech electronics, most people havebattery-operated radios or TVs, but few keep enoughbatteries on hand to last more than a few hours.

If a blackout occurs during the winter, as did the1965 outage, those with yards or balconies can put

food outside. In the 1989 summer blackout inWashington, DC, PEPCO distributed dry ice. Forthose with fireplaces or barbecues, cooking is stillpossible; others must resort to cold food or restau-rants. Illness from food spoilage can be a significantproblem.

One of the more sociologically interesting im-pacts of the 1965 outage was the fact that withoutaccess to their normal forms of entertainment,people turned to each other; 9 months after theblackout, the birthrate increased from 50 to 200percent at New York hospitals.

26

costs

Electricity permits activities whose value varieswith time of day, week, or year. The short-termopportunity cost is the degree of disruption of thehousehold’s preferred consumption pattern. Someactivities, such as cleaning, can be deferred withoutsignificant loss (and in many cases might beconsidered an emotional benefit). Others can be

deferred or relocated (e.g., washing clothes, eatingdinner). Still others can only be relocated (e.g.,watching a particular TV program). At some timesof the day/year and/or for particular groups, therecan be health and safety implications (e.g., lack of heat/AC, elevators, life-support systems, hot water,and refrigeration). Costs also vary by householdincome, type of appliance stock, preferred leisureactivities, and other household characteristics.

211bid.

%id .

%id .

~~n Sko% “omario Hydro Surveys on Power System Reliability:S~ of Customer Viewpoints, “ in Criterion, Inc., op. cit., footnote 4.

~“l%e Disaster That Wasn’4° op. cit., footnote 17.

~“Blackou t FaUoug” Time, Au g. 19, 1966, p. 40.




In addition to deferring or relocating activities,households may experience out-of-pocket expensesfor mitigating responses such as using block or dry

ice to preserve food, firewood for heat or cooking,candles and batteries for lighting, batteries forradio/television, etc.

27

Two equivalent measures of loss are the dollaramount the household would accept as compensa-tion for the disrupted consumption pattern, and theamount the household would be willing to pay not tohave its preferred consumption pattern disrupted.

Transportation

A blackout affects virtually every mode of trans-portation (box D). Subways, elevators, and escala-tors stop running, and corridor and stairwell lightsusually are out. Street traffic becomes snarledwithout traffic lights. Gasoline pumps do not work,and the availability of taxis and buses declines overtime. Parking lot gates and toll booths will notoperate. Pedestrians are perhaps the least affected,although their danger increases without traffic sig-nals and after dark with the loss of street lighting.Trains can still function, but doing so can prove

hazardous without signal lights. Airports are pow-ered by auxiliary generators that enable aircraft toland and take off in an emergency. However,considerable delays can be expected. In high-densityareas where most people are dependent on publictransportation, economic and other impacts areincreased by the inability to get to work. Othertransportation effects result from the inability todeliver goods.

Telecommunications

There is a growing reliance on telecommunica-tions networks in all sectors of the U.S. economy.Businesses and government depend on reliablecommunications to perform routine tasks. Also,businesses are using their communications systemsand the information stored in them to achieve acompetitive advantage and to restructure their or-

ganizations on a regional or global basis. Thus, thefailure of a communications system can lead notonly to market losses but also to the failure of thebusiness itself.

28

The functioning of all crucial municipal publicservices, such as police, fire, etc., will also dependon telecommunications. A recent study by theNational Research Council noted that our publiccommunications networks are becoming increas-ingly vulnerable to widespread damage from naturaldisasters or malicious attacks.

29

Extended power outages can affect telecommuni-cations networks and lead to economic disruption.

The extent of the disruption will depend on whethertelecommunications networks, both public and pri-vate, have emergency backup power systems andhow reliable the backup systems are. Today, manynetworks have their own dedicated emergencybackup system. The importance of backup powersystems was evidenced during Hurricane Hugo andthe recent San Francisco earthquake. At the height of Hurricane Hugo, 39 central offices and 450 digitalloop carrier facilities were operating on backuppower. Southern Bell indicated that the facilities

could operate on battery power for about 8 to 10hours before gas or diesel generators take over.

30

With the commercial power turned off in SanFrancisco because of the risk of free, central officesoperated on diesel generators. These diesel genera-tors could operate for up to 7 days, according toPacBell. The earthquake did little damage to thenetwork.

31

In an emergency, commercial satellites could alsobe used to augment or restore a public network.

Currently, only the American Telephone & Tele-graph Co.’s interexchange carrier network is aug-mented by the Commercial Satellite Interconnectiv-ity program, which uses surviving C-band commer-cial satellite resources.

32

The impact of a disruption will depend on howcrucial communications equipment is to a particular

27S~ghvi, op. cit., footnote 6.

28U.S. congre~~, Offlce of Technology As~ssmen~ crit ical COnnectiOn~: co~nication for the Future, OTA-CIT-407 (wt@hlg tO~ ~: U.S.

Governmen t Prin ting Office, January 1990).29fqatio~ Rese~ch co~cil, Gro~”ng vulnerability of the public Switched Ne~orks: Imp[icationsfor National Secun”ty Emergency prepart?dneSS

(Washington, DC: National Academy Press, 1989).

30Telephony, “Survival of the Ne two rk” Oct. 23, 1989, p. 42, and “H ugo No Match f or So . Bell,” Sep t. 25, 1989, p. 3.

ql’’PacBe~ Ne~ork Smives Quake,’ Te/ephony, Oct. 23, 1989. p. 14.

s%id., p. 18.



Chapter 3-Impacts of Blackouts . 27

Box D—Transportation Impacts —Northeast and New York City Blackouts

The 1965 Northeast blackout occurred at 5:30 p.m.—a peak period for most modes of transportation-andlasted for up to 13 hours. The worst potential hazard was in the air, where at peak hours between 5:00 and 9:00 p.m.

some 200 planes from all over the world were headed to New York’s Kennedy Airport. Logan Airport in Boston,as well as numerous smaller airports, also were blacked out. Inbound flights lost visual contact as the ground lightswent out. Luckily, it was a clear night, and pilots could seethe other planes over the darkened cities. Planes boundfor New York were diverted as close as Newark and as far as Cleveland and Bermuda. Philadelphia received 40NY-bound airliners carrying some 4,500 passengers. Kennedy was shut down for 12 hours.

1

In 1965,630 subway trains in transit ground to a halt, trapping 800,000 passengers. Under the East River, 350passengers had to slog to safety through mud, water, and rats. In the middle of the Williamsburg Bridge, 1,700passengers were suspended in two trains swaying in the wind. It took police 5 hours to help everyone across aprecarious 1 l-inch wide catwalk running 35 feet from the tracks to the bridge’s roadway. A total of 2,000 trappedpassengers preferred to wait it out, including 60 who spent 14 hours in a stalled train under the East River.

2

Thousands of people were trapped in stalled elevators. In at least three skyscrapers, rescue workers had to break

through walls to get to elevator shafts and release 75 passengers. Elevator failure resulted in the only two deathsattributable to the 1965 blackout: one person fell down a flight of stairs and hit his head, and another died of a heartattack after climbing 10 flights of stairs.

3

Traffic lights failed and main arteries snarled. At unlighted intersections, countless volunteers took over the job of directing traffic. Hundreds of drivers ran out of gas as they waited for traffic to clear, only to find that servicestation pumps cannot work without electricity.

4

In 1977, the New York airports were ordered closed at 9:57 p.m. on July 13, only minutes after the powerfailure. At Kennedy, 108 airline operations were scheduled between 9:00 p.m. and midnight July 13; 37 operatedbefore the airport was closed. LaGuardia had scheduled a shutdown at midnight July 13 for runway construction,and disruption was much less significant (39 of 60 scheduled operations). Newark Airport handled 32 divertedaircraft from Kennedy and LaGuardia. Auxiliary generators supplied emergency power to the terminals, in which

more than 15,000 passengers remained through the night. At Kennedy International Airport, some power returnedat 3:30 a.m. on July 14, but the first authorized takeoff was not until 5:34 a.m. At both Kennedy and LaGuardia,parking lot gates and payment systems were out, and parking area employees computed fees manually. This resultedin severe traffic jams and long delays.

5

The subway system fared a little better in 1977. The blackout occurred around 9:40 p.m., after most commuterswere home. Also, the storm activity and brownouts offered some warning. Dispatchers running the subway systemnoticed power surges on the line before the blackout and radioed motormen to go to the nearest station and remainthere.

6Thus, only seven trains in the entire system were in transit when the power went off. Emergency evacuation

problems were most severe for a train stuck on the Manhattan Bridge. Even buses could not run the next day,however, because of the unavailability of fuel from electric pumps. Moreover, Grand Central Terminal was forcedto close when drainage pumps lost power. Even after power was restored, flooded converters prevented electricallypowered trains from using the station during the morning rush-hour on July 15, thus delaying about 75,000 dailycommuters. 7

The train stations in New York City halted operations during the 1977 blackout. The main inter-urban trainline, AMTRAK, stopped service from the south in Newark. Going north, AMTRAK provided buses to New Haven,where trains from Boston turned around. Conrail trains serving Trenton, New Brunswick, and South Amboyexperienced delays up to several hours.

8

After the 1977 blackout, the Metropolitan Transportation Authority initiated an$11 million program to installnew equipment to ensure against massive disruption of the transit system in the event of a future blackout.

9

‘ “ Time, Nov. 19, 1965, p. 36. ,t~e Disaster ‘lht Wasn ‘~2 Ibid.

3 Ibid.

4 Ibid.5 Systems Contiol , ~c., JmPa~tA~~e~s~nt of the 1977 New York City Blackout, prepared for DOE , J~y 1978, PP. 16, [email protected] Nan MCGOWW “m e New York Bkickout j” Environment, vol. 19, No. 6, August/September 1977, p. 48.7 sys tems Con@ol, Inc., op. cit., foo~ote 5.8

Ibid.9 bid.



28 q Physical Vulnerabilityof Electric Systems to Natural Disasters and Sabotage

industry/business. Medium- and large-size busi-nesses that use integrated information systems tolink operational processes—i.e., order entry, sched-uling, etc.—will experience economic damage

shortly after a power failure. While many businessuse a number of interconnected networks, suppliedby a variety of sources (including local area net-works and private and public networks), mostprivate networks depend on public networks fortransmission and switching capabilities. The FederalGovernment, for example, uses a number of privatenetworks to communicate within a particular depart-ment or agency, but uses public networks tocommunicate outside.

33

OTA has found that, in general, businesses havebeen slow to prepare for emergencies or adoptsecurity measures, often postponing action untilafter a problem has occurred. One major reason citedis cost. Moreover, the value of communicationsecurity has to be traded off not only against cost, butalso against system access and interoperability .

34

Emergency Services

Emergency services include police and fire and

their communications and transport, as well ashospitals. Power outages can also affect theseservices. All hospitals have emergency power sys-tems to support the most critical activities, such asoperating rooms, intensive-care units, emergencyservices, etc. Depending on the facility, auxiliarypower systems may not be able to support someother activities, including x-ray, air-conditioning,refrigeration, elevators, etc. Moreover, technicalproblems may arise with the auxiliary generators, asevidenced in the 1977 New York blackout. In someinstances, hospitals had difficulty bringing genera-tors on-line, and were faced with generators over-heating and inoperable transfer switches for con-necting loads to emergency circuits.

Fire-fighting and police communications could beseverely disrupted by the loss of power. Fire alarmsystems may be inoperable and fire-fighting maybehampered in those areas where some power isrequired for pumping water.

Moreover, the indirect impacts of a blackout, suchas looting and arson, can severely strain fire-fightingand police services. For example, during the NewYork City blackout, 70,680 calls were made to911,

compared with the 17,700 made in a normal 24-hourperiod. Also, during the 1977 blackout, there were1,037 fires (primarily arson) with over 6 large-scalefrees, requiring 5 companies. More than 80 injurieswere reported due to the abnormal fire activity.Exhaustion was common due to the high heat andhumidity and the lack of food supplies and restareas.

35

Public Utilities and Services

Public utilities include electric, water, gas, sew-age, garbage, and related services (e.g., public healthinspection).

Water supply systems generally rely on gravity tomove water from reservoirs through the mains andto maintain pressure throughout the system. Somepower may be required at pumping stations andreservoirs. Loss of pressure in mains hampersfree-fighting and hospitals, and may permit contami-

nants to seep into the water supply. Typical systempressure will supply buildings up to five or sixstories tall. High-rise buildings use electric pumps toprovide adequate supply on upper stories, or haveroof tanks with 24- to 48-hour storage capacity. If electric pumps in high-rise buildings do not work,residents would have to go without water or get itfrom neighbors below.

36

Electricity is needed in treatment and pumping of sewage. An outage at a treatment plant causes raw

sewage to bypass the treatment process and flow intothe waterways. Lack of pumping station powerprevents sewage flow and ultimately causes abackup at the lowest points of input (usuallybasements in low-lying areas). During the 1977 NewYork City blackout, many of the sewage treatmentplants and pumping stations in Westchester Countyand New York City had standby power supplies, butonly for short durations. After the standby powerwas exhausted, untreated sewage flowed continu-

331bid ., pp . 82-84.

~Office of Tectiolo~ Assessm ent, op . cit., footn ote 28, ch . 10.

js sys tems Con&ol, kc., op. cit., foomote 18.

361bid .





Chapter 4

System Impact of the Loss of Major Components

A sophisticated saboteur or major natural disastercan readily cause widespread power outages. The

time and effort needed for a system to recover couldrange from seconds to months, depending on whichcomponents are damaged, the system’s basic charac-teristics, and the availability of spare parts. Even if a power failure is avoided or lasts only seconds,costs may be high as less efficient reserve generatingcapacity replaces low cost units, and sensitiveconsumer equipment such as computers are disa-bled. This chapter addresses the resilience of currentbulk power systems to equipment outages, examin-ing both reliability and economic impacts.

U.S. utilities have been highly successful inmaintaining very high levels of bulk power system

l

reliability. Bulk power systems in the United Statesare designed and operated to be reliable and econom-ical in the face of normal events including occa-sional equipment failure. Utilities are also preparedto minimize the impact of some highly unlikelyevents such as multiple simultaneous equipmentfailures at a single site. However, sabotage or majornatural disaster can inflict damage well beyond what

utilities plan for. Because U.S. utilities have per-formed so reliably and have only rarely facedwidespread and multiple equipment failures, there isuncertainty about how bulk systems will actuallybehave in extreme circumstances.

One factor leading to reliability and resilience isthe highly interconnected network common tomodern power systems (see box E). Because of thevast size of most power systems, no individualpowerplant or transmission component is critical to

the operation of any power system. An electricsystem typically has many powerplants, in somecases several dozen. An individual powerplant, evena large multi-unit one, supplies only a small fractionof the total demand of most control areas. There aresome very small control areas in the Midwest, but

each powerplant provides only a small fraction of thetotal capacity in the interconnection.

Distribution systems are not designed to havesuch a high level of reliability as the bulk system. Infact, the great majority of outages that customersexperience result from distribution system prob-lems, not from the bulk system (around 80 percentby one estimate).

2However, unlike bulk system

failures, distribution-caused outages are localized,and utilities have considerable experience in re-sponding to them.

SHORT-TERM BULK POWERSYSTEM IMPACTS

The Importance of Any One Component:

Preparing for Normal Failure 3

Some of the thousands of components in anysystem occasionally fail or operate improperly, orare disabled by natural events such as lightningstrikes. Because these events are common andinevitable, utilities consider them to be normal. Most

bulk power systems in the United States are de-signed and operated to continue operation followingthe failure of any one device without interruptingcustomer service or overloading other equipment.

4

This is commonly referred to as the “n-1 operatingcriter ion. Some utilities prepare for two suchcontingencies (called the n-2 operating criterion).Systems west of the Rockies make some exceptionsto the n-1 criterion for certain major facilities. Inthose systems, some customers may be brieflyinterrupted following certain outages, but with nooverloading of other equipment leading to uncon-trolled or cascading outages.

Preparing for equipment failure involves twomain functions. These are: 1) holding sufficientgeneration and transmission capacity in reserve to

I B ~ ~w a ~ s t em i n c l ude t h e genem t i on a n d ~ansmis s io~ bu t not distribu tion (see U.S. Congress, ~lce of T~ h UO IOS Y ~s~sm~~ ‘Zecrn”c

Power Wheeling andDea/ing, OZ4-E-41O (Washingto~ DC: U.S. Government Printing Office, May 1989), ch4). This chapter focuses on bulk systems

since damage to them may be far more widespread and difficult to repair than distribution damage.

~.S. Department of Energy, “The National Electric Reliability Study: Executive Summary, “ DOE/EP-0003, April 1981, as cited in : Power System Reliability Evaluation, Institute of Electrical and Electronics Engineers, 1982, p. 42.

3SW OiIIX of Technology Assessment op. cit., footn ote 1.

dNof i~~~anE l~~cReliability Comcil , OVemiewofplanning andReliability Criteria of theRegionalReliabiliq Councils ofNERC @IKet~

NJ: April 1988).

Ssee ~lce of Technology Assessmen4 op. cit., footnote 1.

–31-




Box E—The Organization of Electric Systems:Utilities, Control Areas, Power Pools, and Interconnections

The electric power industry today is a diverse and heterogeneous amalgamation of investor and publicly owned

utilities, government agencies, cogenerators, and independent power producers.2

In most of the country, individualutilities are highly interconnected and operate under a variety of formal or informal coordination agreements. Thelevel of power transfers and coordination between utilities is determined largely by control areas, power poolingarrangements, and physical interconnections.

Control AreasResponsibility for the operation of the Nation’s generating facilities and transmission networks is divided

among more than 140 ‘‘control areas. In an operational sense, control areas are the smallest units of theinterconnected power system. A control area can consist of a single utility, or two or more utilities tied together bycontractual arrangements. The key characteristic is that all generating utilities within the control area operate andcontrol their combined resources to meet their loads as if they were one system. Control areas coordinatetransmission transactions among electric power systems through neighboring control areas. Control areas maintainfrequent communications about operating conditions, incremental costs, and transmission line loadings.

Power PoolsThere are two types of power pool arrangements-tight power pools, which include holding company power

pools; and loose power pools. Tight power pools are highly interconnected, centrally dispatched, and haveestablished arrangements for joint planning on a single-system basis. Four of these tight pools consist of utilityholding companies with operations in more than one State; the others are mostly multi-utility pools. Together, thetight power pools account for about a quarter of the industry’s total generating capacity. Arrangements amongutilities in loose power pools are quite varied and range from generalized agreements that coordinate generation andtransmission planning to accommodate overall needs to more structured arrangements for interchanges, sharedreserve capacity, and transmission services.

InterconnectionsNorth America’s interconnected utilities create four physically separate, synchronously operated transmission

networks: the Eastern Interconnection (or Seven Council Interconnection); the Texas Interconnection; the WesternSystems Coordinating Council (WSCC); and the Hydro Quebec System. DC and AC transmission interties betweenthe networks are limited in location and capacity, with the result that the transmission systems in the United Statesdo not forma single national grid, but rather form three huge, separate grids. However, even the smallest one, theTexas Interconnection, is very large with installed generating capacity of over 50,000 MW comprised of scores of generating units.

Is= U.S. co-s, ~W of Techno lo~ Assessmen6 Electric Power Wheeling and DeaZing, 0’IA-W410 (washingt% ~: U-s.Government Printing OffIce, May 1989, ch. 4.

2A t ~r~at, the Nation’s UW& industry kludes203 investor-owned operatin g compan ies; 1,988 ocal publicly owned systems; ~ rur~

electric cooperatives;59public joint-action agencies, and 6 Federal power agencies, In dditio~ there are several hund red cogenerationand small

power producers selling power to utilities.

respond immediately; and 2) designing circuit select “unit commitment plans” specifying whichbreakers and relays to protect and isolate equipmentin a controlled manner.

Reserve Generation and Transmission

Utilities keep enough generation, transmissionand substation capacity on-line and ready for opera-tion to replace any operating components that fail.Generating units must be warmed up and rotating in

synchronism with the 60 Hz of the power systembefore operating. Generating units which are syn-chronized and ready to serve additional demandimmediately are called spinning reserves. Utilities

units will be warmed up and cooled down to followthe cycle of loads over the course of a day, week orseason. Unit commitment schedules are chosenwhich minimize the total expected costs of operationand Spinning reserves required to maintain reliabil-ity and meet expected changes in demand.

Unlike generating units, transmission circuits andsubstations don’t require any warm-up time and are

instantly available as long as they are connected tothe system. The flow of power in a transmissionnetwork is dictated by the laws of physics. One of thekey laws is that power flows on all available paths



Chapter 4-System Impact of the Loss of Major Components .33

between a generator and a load. This is calledparallel path flow. After a generator or transmissioncircuit fails, the power flow on the remaining circuitsresponds immediately. To ensure that resulting

flows don’t exceed emergency ratings, “security-constrained dispatch’ techniques are used to ensuresufficient transmission reserves. Control center op-erators typicallyexamine a series of contingencycases to determine the most severe contingency andthe resulting transmission loadings. When they finda contingency would create unacceptably highloadings, the generation dispatch is adjusted toreduce the resulting flows to acceptable levels.

Circuit Breakers and Relay System Design

Relaying techniques and circuit breakers to iso-late and protect equipment are essential to main-taining reliable service. Circuit breakers are installedat each end of every circuit and transformer in thesystem to provide protection in the event of a shortcircuit. Under normal conditions the breakers per-form routine switching operations such as discon-necting and isolating equipment for maintenance orinspection, transferring loads among circuits anddisconnecting generators when not needed. When

relays sense a short circuit, they cause the circuitbreakers to operate, isolating the faulted component.Most breakers on the bulk power system operate inno more than five cycles (1/12 second in the U.S.60-Hz system), and three cycle (1/20 second)operation is common. Prompt isolation of faultedcomponents is critical to ensuring that the remainingequipment is not damaged and is able to continueoperation.

Increasingly, many power systems are using

elaborate relaying schemes for protection.

6

Theseinvolve coordinated operation of multiple circuitbreakers simultaneously in different locations ratherthan merely isolating individual failed components.For example, in the Pacific Intertie, which connectsthe Pacific Northwest with southern California, acomplex scheme is employed which isolates genera-tion in Oregon and transmission circuits in Arizonawhen certain circuits in California fail. This system,

which enables California to reliably import largeamounts of power, ensures that a transmissionfailure in California will not cause damaging imbal-ances in neighboring States.

Impacts of Multiple Failures: Islands and

Cascading Outages

While the failure of any single generating unit,transmission line or substation normally should notcause significant outages, simultaneous failure of more than one major component generally willresult in interruption of service.

7When abnormal,

multiple failures occur, a power system typicallyundergoes ‘‘system separation, ” in which portionsof the system disconnect from each other.

8Some of

these isolated portions, called “electrical islands,”may have an imbalance of supply and loads. Thoseislands have either more generation than load ormore load than generation, causing the systemfrequency to deviate from its normal value of 60 Hzand transmission voltages to exceed design limits. Inturn, protective relays would cause several genera-tors and transmission circuits to disconnect from the

island, resulting in a blackout. Other islands mayhave a balance of supply and demand, allowingcontinued operation even though disconnected fromthe rest of the system.

“Cascading outages” occur when the failure of one or more components causes the overloading andfailure of other equipment and breakup of the systeminto islands in an uncontrolled fashion. It is notpossible to accurately predict the way a system willbreak up after a major disturbance-there are too

many variable factors.

9

Utilities do analyze theirsystems and implement plans to help anticipate andcontrol the likely pattern of islands. Their analysesshow that the pattern of islands will vary dependingon the location of loads, which units are operating,how much each unit is generating, the configurationof the transmission network, and the specific sec-ond-by-second sequence of events causing thedisturbance. However, one can predict that cascad-

—

CNofi Americm Ehx&ic Reliabfiity co~cil, 19g7 Reliability Assessmen+The Future of Bulk Elecm”c System Reliability in North Amen”ca,

1987-1996 (Princeton NJ: October 1987).TThis ~sues tha t th e system is operated for n -l contingencies. A system operated for n-2 should b e expected to h ave s igni f lc tmt impacts o~Y w h ~

more than two major components fail.

8Wes~@ouse El~~~ COT. , Utiliq Suwey of Method~for Mini~”zing the Nu~er and Seven”fy of system Separations, EPRI EL-3437 (M O Al tO,

CA: Electric Power Research In stitu te, March 1984).

~b id .








longer, especially those that were completelyblacked out.

Restarting Generating Capacity

If an external source of power is available,restarting a unit is not a problem. However, if noexternal power sources can be used, the powerplantmust have “black start” capability. Black startcapability can be provided from a diesel or aself-starting gas turbine unit in the plant. It is alsopossible to provide black start capability from theinterconnections of a system. This is done bydisconnecting the interconnections from the load-serving circuits (to avoid overloading the lines)

while keeping the generator connected. The inter-connections can then be energized to import powerfrom the neighboring system to use in starting theunit.

Restoring Transmission

As generating units are restarted, portions of thetransmission system can be energized. The segmentsenergized must be carefully selected to avoidbuilding up excessive voltages due to the capacitive

effects of the high-voltage lines. This requires thatload be added as line segments are energized. Caremust be exercised not to overload the small amountof generation connected.

A power system is restored by successivelyrestarting generators, connecting transmission lines,and connecting load until significant islands of operating load and capacity are available. Then theseparate portions of the system are connected to eachother. In this way, the portions of the system that areoperable can be completely restored and returned toas near normal operation as feasible. Restoration of an outage should begin within minutes of an outage.The length of time to restore full service depends onthe design of the system, the severity of the blackout,and the components damaged.

SPECIFIC EXAMPLES

OF ATTACKS

To evaluate the impact of sabotage on electric

power systems, postulated attacks were developedand reviewed for their effect on six areas in theUnited States. The impact of these attacks isdescribed below, beginning with the simplest at-tacks that are most applicable nationwide. Most of

the attacks involve transmission circuits (whether atsubstations or along transmission lines).

The components attacked could be identified by

someone generally familiar with power systems,either using published transmission maps or fromdirect observation. Physically locating the targetswould involve modest effort and planning, sincethey are generally large and highly visible. Anyonefamiliar with power systems could readily identifythe particular transmission facilities that need to beattacked for effective disruption. However, it ispossible for unsophisticated saboteurs to mistakenlytarget small or relatively unimportant facilities.

These cases assume that the attack occurs at a loadlevel of about 80 percent of annual peak load. It isalso assumed that about 20 percent of the totalgenerating capacity is undergoing maintenance orforced outage. In all of the cases, the extent of theinitial interruption would not be affected by the timeof day or load level. That is because the amount of reserves which are warmed up and ready to operateis sufficient to handle only one (or in some casestwo) contingencies, as is standard utility practice.The near- and long-term impacts would be lessened,

however, if the attacks occurred during the spring orfall when system loads are lower. In most cases,rolling blackouts would be necessary only duringcertain hours, e.g., between 10 a.m. and 6 p.m. onweekdays, when loads are typically their highest.

Destruction of Any One Generator,

Transmission Circuit, or Transformer

As has been noted above, U.S. power systems areoperated to withstand the loss of any single piece of equipment without interrupting customer load.

Therefore, the destruction of any one of these wouldnot cause a blackout. The loss of any of these maysigntificantly increase a utility’s operating costs, if itmade replacement of low-cost baseload generatorswith high-cost peaking units necessary.

Destruction of One Major Multi-Circuit

Transmission Substation or Multi-Unit

Powerplant

As noted above, U.S. utilities generally plan for

the loss of an entire multi-circuit transmissioncorridor, substation, or multi-unit powerplant. Forsuch a loss, the system should not experiencecascading outages. However, customer interruptionsshould be expected. No case was found in which



Chapter 4-System Impact of the Loss of Major Components . 37

such an attack would seriously disrupt the bulk power system or affect more than a subarea of autility.

Immediately after the loss of a transmissionsubstation (or of the multi-circuit corridor supplyingit), the customers served directly and some otherswould be interrupted. Some more distant customersmight be affected by the operation of protectiverelays as a result of power transients. The moredistant customers interrupted would be restored inseveral minutes as the operators reconnected thecircuit breakers and adjusted generation output.Customers in the immediate area of the failedsubstation would experience a longer power outage,

lasting on the order of one day. Customers served bya distribution circuit powered directly from a de-stroyed substation might not return to service forseveral days or even weeks.

If a powerplant was taken out of service (whetherby attacking the generating units themselves, thegeneration substation, or the transmission circuitsleading from it to the network), the impacts would beless severe. While the outages could cover largeareas, service should be restored in several minutesas operators reconnected the circuit breakers andadjusted generation output. Costs of replacementpower could be high, particularly if the plant was alarge, low-cost baseload unit replaced by inefficientpeaking units.

Destruction of Two or Three Major

Transmission Substations

Inmost cases, the nearly simultaneous destructionof two or three transmission substations would causea serious blackout of a region or utility, although of

short duration where there is an approximate balanceof load and supply in the isolated areas. It is almostcertain that the transmission system would have toolittle capacity to continue operation after the secondloss, resulting in separation of the system and theinterruption of customer load in several areas. Mostcustomers would be restored within 30 minutes,

after undamaged interconnections were restored. Formost systems, there would be a sufficient balance of generation and load to restore all customers as soonas generation could be warmed up and brought

on-line.

There are some areas of the country where failureof key substations could cause long-term disrup-tions. Two particularly vulnerable cities would beisolated by the loss of two or three substations,because of a serious shortage of generation. Rollingblackouts during high-load times (e.g., daytime)would occur for several weeks until temporaryrepairs were made.

Destruction of Four or More Major

Transmission Substations

The destruction of more than three transmissionsubstations would cause long-term blackouts inmany areas of the country. Only a few areas have agood enough geographic balance of load and genera-tion to survive this very severe test. For example,one city is served by a ring of nine evenly spacedtransmission substations. Nearly all the interconnec-tions serving this major metropolitan area would be

destroyed by attacking the seven largest and easiestto identify transmission substations. The other twoare smaller and of little importance during normalconditions. There is enough local generation in thiscase to restore service to most customers quickly,although it is considerably more expensive than theimported power. This case represents the best case of a multiple-substation attack.

A final example is a city served by eighttransmission substations spread along a 250-mile

line and located in five States. A knowledgeablesaboteur would be needed to identify and find theeight transmission substations. A highly organizedattack would also be required. However, the damagewould be enormous, blacking out a four-Stateregion, with severe degradation of both reliabilityand economy for months.



Chapter 5

Current Efforts To Reduce Energy Systems Vulnerability

Since the late 1970s national emergency prepar-edness initiatives have focused primarily on devel-

oping programs within appropriate governmentagencies. The National Security Council (NSC) hasplayed a central role in directing this effort. About 20Federal departments/agencies are involved withemergency preparedness. The Department of Energy(DOE), through its Office of Energy Emergencies, isthe lead agency for energy-related issues. Otherinvolved agencies include the Departments of De-fense, Interior, and State, the Federal Bureau of Investigation, the Federal Emergency ManagementAgency, and the Nuclear Regulatory Commission.

In the early 1980s, the General Accounting Officecriticized Federal Government agencies for inade-quate energy emergency preparedness planning andcoordination. Since then, improvements have beenmade in developing comprehensive plans and pro-grams, streamlining coordination, and eliminatingduplication. However, because of the number of Federal agencies involved in energy emergencyplanning, uncertainties about authority, responsibili-ties, and activities are bound to exist. These sameuncertainties may be magnified during a nationalemergency and thus hamper efforts to ensure ade-quate energy supplies and distribution to essentialfacilities.

The Federal Government has limited authority orresponsibility to provide physical protection forenergy systems. Individual utilities are responsiblefor protecting their physical plants and ensuringreliability. Utilities routinely build redundancy andplan for inevitable but occasional equipment failurebut do not consider multi-site sabotage when design-ing the system. That is not to say that utilities are notconcerned about energy systems vulnerability. TheNorth American Electric Reliability Council(NERC) has been working quietly on vulnerabilityissues for several years. Recently, NERC developedrecommendations and guidelines to mitigate electricpower systems vulnerability. Utilities generallyfollow NERC guidelines on such matters. NERCoften acts as a clearinghouse for the electric utility

industry-developing and disseminating resourcematerials and information on vulnerability. It also

has encouraged member utilities to establish liaisonswith government agencies and other industry

groups. To a large extent, NERC facilitates commu-nication and coordination among its members-anactivity that would be essential during an emergencysituation.

State efforts in energy emergency preparednesspeaked in the early 1980s in response to the oildisruptions of the 1970s. Funding and staffing levelshave since declined. This decrease in funding andstaffing could affect the States’ ability to respond toan energy emergency. In addition, most of the

States’ plans and organizational structure weredeveloped in response to a particular crisis-an oilsupply disruption-and may not be relevant to othersituations. Plans need to be revised to reflect otherpotential disruptions, including natural disasters andsabotage.

Furthermore, interstate and intergovernmentalcommunication and coordination may be inade-quate. According to DOE, only 9 States havedeveloped routine communication systems with

surrounding States. Based on an energy emergencysimulation, a Federal interagency group concludedthat existing Federal and State crisis managementplans were not well-coordinated and may beat crosspurposes.

1

This chapter provides an overview of currentefforts and responsibilities of various institutions,including the utility industry, Federal agencies,States, and public utility commissions. Also, thecurrent status of the U.S. electrical equipmentmanufacturing industry is discussed.

CURRENT EFFORTS

Private Industry

Utilities

In the United States the physical protection of electric power facilities does not appear to be ahigh-priority item for utility management. Histori-cally, deliberate attacks on electric power facilities

have not resulted in power or financial lossessignificant enough to justify a major investment in

IRvoti of thelnteragency Group on Energy Vulnerabi l i ty , November 1986-November 1988, prepared for tie Sefior ~teragencY Group for Natio~Security Emergency Preparedness, January 1989.

–39-



40 q physical Vulnerability of Electric Systems to Natural Disasters and Sabotage

physical security. However, it is important to notethat the utility industry is concerned about vulnera-bility and has been working quietly on securityissues for some time.

Utilities recognize that communication is animportant part of any security plan. Under emer-gency conditions, including sabotage, the ability tocommunicate is even more critical. Thus, utilitiesplace a high priority on the restoration of communi-cation networks during emergencies.

Utilities also recognize the need for improvedcommunication with law enforcement officials andother utilities. Virtually all utilities with key facili-ties have established contact with the local FBI

office. The FBI can assist utilities in evaluatingthreats, inspecting facilities, and planning emer-gency responses. In addition, utilities have encour-aged additional information exchanges betweenoperating personnel and security managers to ensureadequate emergency preparedness.

North American Electric Reliability Council(NERC)

NERC and its nine regional councils were estab-

lished in the late 1960s to assist utilities in providingfor the reliability and adequacy of electric genera-tion, transmission, and distribution systems. Format-ion of the organizations was aided by Federallegislation following the Northeast blackout of 1965.

At NSC’s direction, DOE requested NERC toaddress electric power systems vulnerability issues.In 1987, NERC established the National ElectricSecurity Committee (NESC) to assess the degree of

vulnerability of U.S. electric power systems anddevelop a program to mitigate vulnerability tosabotage and terrorism. The Security Committeeestablished three working groups which dealt withphysical security enhancements, operating strate-gies, and design and restoration improvements. InJuly 1988, the NESC presented its report andrecommendations to the NERC Board of Trustees.The report with its recommendations was approvedin October 1988. Most of the recommendations havebeen implemented while a few are still under review.

NERC’s program includes a close-working rela-tionship with the Federal Bureau of Investigation.

Also, NERC has identilfied utilities where sparetransformers are located.

A small number of agencies have been briefed onthe NERC report and recommendations. Theseagencies include the National Security Council, theDepartment of Energy, the President’s ScienceAdviser, and the Federal Emergency ManagementAgency.

The NESC, having completed its mission, hasbeen disbanded and related activities assigned toNERC’s Engineering and Operating Committees orto the Regional councils or the utilities.

Edison Electric Institute (EEI)

EEI has established a security committee, whichconsists of 70 members who are responsible forphysical protection of utilities’ facilities. Accordingto EEI, more than half of the committee’s membersare ex-FBI agents or members of other law enforce-ment agencies. EEI’s security committee facilitatessecurity information exchange among its members,NERC, and government agencies.

Federal Government

National Security Council (NSC)The NSC is the lead agency for national security

emergency preparedness policy. In 1988, NSCdefined the government’s approach to emergencypreparedness. It grouped government agencies byparticular areas such as economics, energy, humanservices, law enforcement, telecommunications, andtransportation. One department/agency is the leadagency within each group and is responsible foridentifying responsibilities and operating proce-dures and coordinating activities with other groups.

For example, DOE is the lead agency for the energygroup. Also, NSC is the principal liaison withCongress and the Federal judiciary on nationalsecurity matters.

Federal Emergency Management Agency(FEMA)

FEMA serves as adviser to NSC on nationalsecurity emergency preparedness, which includesmobilization

2preparedness, civil defense, techno-

logical disasters, etc. FEMA also provides guidanceto other Federal agencies in developing and imple-menting emergency preparedness plans. More spe-



Chapter 5-Current Efforts To Reduce Energy Systems Vulnerability q 41

cifically, FEMA is responsible for developing plansfor the conversion of industrial capacity and supplyduring a national emergency. This effort involves

identifying industrial facilities that are essential tonational mobilization and developing mechanisms,including standby agreements, to allocate facilitieswhen production capacity is in short supply. Duringa national mobilization, FEMA would likewise beinvolved in coordinating and facilitating emergencysupply imports. In addition, FEMA authorizesgovernment agencies to establish National DefenseExecutive Reserve programs (discussed in a latersection) and provides guidance in this regard.

Recently, FEMA prepared a prototype nationalplan for graduated mobilization response (GMR)options. This process provides a framework formobilization planning in three incremental steps:planning and preparation, crisis management, andnational emergency/war. Eight Federal departmentsand three agencies were considered in the process.As a result of this effort, a Defense MobilizationOrder was issued in January 1990. The order definesGMR, provides policy guidance, and further estab-lishes a system for developing and implementing

mobilization actions that are responsive to a widerange of national security threats and warnings.FEMA expects that a final document, which willinstitutionalize the process, will be available in1990.

Another ongoing FEMA activity is the prepara-tion of Major Emergency Action papers. Thesepapers are intended to provide information todecisionmakers on response options, costs andbenefits, and the implementation process during a

wide spectrum of emergencies.

3

FEMA also published a Defense MobilizationOrder, which provides criteria and guidance forFederal departments/agencies to develop strategies,plans, and programs for the security of essentialfacilities and resources. Responsibility for protect-ing essential facilities rests with appropriate Federaldepartments/agencies. FEMA monitors complianceand reports its findings to the NSC.

FEMA’s disaster relief activities are the most

visible. The most recent examples are FEMA’s

efforts to assist South Carolina, Puerto Rico, and theVirgin Islands in the wake of Hurricane Hugo andvictims of the Loma Prieta earthquake.

Department of Energy (DOE)

DOE is the lead government agency for energyemergency preparedness. Its mission is to ensurethat adequate energy supplies are available tosupport the Nation’s infrastructure during a nationalemergency. In this regard, DOE’s Office of EnergyEmergencies (OEE), created in 1981 in response toExecutive order 11490, is responsible for dealingwith energy system vulnerability concerns.

OEE’s FY89 program budget totals about $6.2million, the bulk of which is used for staff salaries.The budget has remained essentially the same overthe past 5 years. OEE consists of 71 professional andsupport staff.

4

Vulnerability Program—Recently, the OEEdeveloped a Vulnerability Program whose purposeis to reduce the risks of energy system interruption.The Program consists of four phases: Phase Iincluded case studies to determine the nature of vulnerabilities in the electric power, petroleum, and

natural gas industries. This effort included consider-able input from industry, Federal, State, and localgovernments and is essentially completed. Theresults of the studies are classified. Phase IIestablishes an industry outreach program whichprovides information and solicits industry/ government joint cooperation. DOE cites the NERC/ DOE initiative, noted earlier, as an example of PhaseII activity. According to DOE, the first phase hasbeen completed and the second is progressing.

Phase 111 of the program includes additional casestudy exercises and other industry outreach efforts.DOE expects industry to respond to the concernsraised by these exercises. However, there appears tobe no provision for follow-up activities under thisphase. Phase IV will identify national securityvulnerabilities which cannot be addressed by therespective industries. This phase may include feder-ally funded programs to remedy energy systemvulnerability concerns. Other OEE efforts haveincluded updating the State emergency contracts

directory, reviewing legislation and contingency

qFeder~Emergency mMgemen t Agency, National Prep aredness D irectorate, Ofllee of Mobilization Preparedness, Mobilization pr~ared?less-fh

Ove rw” ew , March 1989.

qEdwti V. Bado~to, Depu& Assistant Secretary for Energy Emergencies, U.S. Department of Energy, e S t imOny at h earings before the SenateGovernmental Affairs Committee, Feb. 8, 1989, pp. 4,6.



42 q Physical Vulnerability of Electric Systems to Natural Disasters and sabotage

plans, and disseminating information to States via anelectronic mail system called DIALCOM. OEE hasalso conducted regional seminars and simulations toprovide assistance to State energy planners.

5An

overview of the results of the regional seminars isgiven in the “State Efforts” section.

DOE has established a threat notification systemto alert energy industries. Notification consists of amessage describing a threat that could lead toaggressive actions. For example, notification of

Iran’s reaction to the reflagging of Persian Gulf vessels was sent to NERC, the American PetroleumInstitute, the National Gas Association, the Inter-state Natural Gas Association of American, and the

National Coal Association. These organizations inturn notify their respective industry members.

Interagency Group on Energy Vulnerability/ Policy Coordinating Committee on Emergency

Preparedness and Mobilization Preparedness—Because of a growing concern about internationalterrorism, the NSC directed DOE to establish theInteragency Group on Energy Vulnerability (IGEV).It focused on national security issues relating to thevulnerability of U.S. energy systems. The Groupwas charged with developing initiatives to decrease

vulnerability and mitigate the impact on nationalsecurity of any disruptions.

6In late 1988, IGEV was

terminated and its concerns and functions mergedinto a new interagency group, the Policy Coordinat-ing Committee on Emergency Preparedness andMobilization Preparedness, Standing Committee onEnergy. Committee members include the Depart-ments of Energy, Defense, Justice, Interior, State,Transportation, and Treasury; the Central Intelli-gence Agency; the Federal Bureau of Investigation;the Federal Emergency Management Agency; Na-

tional Communications System; National SecurityCouncil; and the Nuclear Regulatory Commission.

National Defense Executive Reserve (NDER)Program

Authorized by Congress, the NDER is a collectionof civilian executives recruited from various indus-tries. When authorized by the President, the industryexecutives, called reservists, would provide infor-

mation and assistance in their areas of expertise toFederal authorities. Reservists would also helpcoordinate industry efforts in meeting nationalneeds. FEMA authorizes government agencies to

establish NDER units and provides overall policyguidance. The Office of Energy Emergencies withinDOE administers three NDER units: the EmergencyPetroleum and Gas Executive Reserve, the Emer-gency Electric Power Executive Reserve, and theEmergency Solid Fuels Executive Reserve.

DOE indicates that these industry executivescould provide invaluable assistance in assessingdamage, evaluating supply capability, and coordi-nating repair and restoration efforts. DOE plans to

have about 400 industry representatives involved inthe NDER program. The reserve staff for the ElectricPower unit is at 50 percent of the staffing goal andSolid Fuels is up to 80 percent, according to DOE.

7

Since its birth in 1964, the NDER program has notbeen without criticism. It has been administered byseveral government agencies, including the DefenseElectric Power Administration within the Depart-ment of the Interior, the Economic RegulatoryCommission, and finally the Office of EnergyEmergencies within DOE. Questions have been

raised about training and recruitment, and antitrustconcerns have been raised by petroleum industryofficials. Consequently, the petroleum executivereserve unit has not been fully developed. Over thelast few years, however, DOE has been aggressivelyrecruiting reservists and facilitating training ses-sions for new reservists.

The Federal Bureau of Investigation (FBI)

The FBI is responsible for counterterrorism pro-

grams in this country. Its authority extends todealing with terrorists attacks against energy facili-ties. The Bureau recently proposed a counterterroristprogram that would focus on the vulnerability of theNation’s infrastructure to sabotage. The programwas designed to place 70 additional agents in fieldoffices to identify key infrastructure facilities, de-velop contingency response plans, disseminate in-formation, and provide assistance to private indus-try. Funding for the $17 million program has not

sNatio~ Rese~h COuncil, Committee on State an d Federal Roles in Energy Emergency Preparedness, State and Federal Roles in Energy Emergency Preparedness, prepared for the U.S. Departmen t of Energy (Washington, DC: Natiomd Academy Press, January 1989), pp. 15-18; BadolatoTestimony, op . cit., footnote 4, p. 10.

‘XMar te r of tb e Interagency Group on Energy Vulnerability of the Senior Interagency Group for National e eu r i t y Emergency Preparedness.

~adolato Testimony, op. cit., footnote 4, p. 15.



Chapter S-Current Efforts To Reduce Energy Systems Vulnerability q 43

been approved. A second proposal, now underreview, will use existing resources within the Bureauto develop liaisons with private industry and dissem-inate threat information.

8Currently, the FBI main-

tains a liaison with the Department of Energy. Threatwarnings are disseminated to DOE, which in turnnotifies private industry.

Department of Defense (DoD)

DoD administers the Key Assets Protection Pro-gram (KAPP), whose purpose is to protect selectedcivilian industrial assets from sabotage during anational emergency. Selected industries are thosethat are deemed essential to national defense andinclude some industry-owned energy facilities. Keyassets are not owned or controlled by DoD. Theprogram identifies which electric power systemsprovide energy to vital military installations anddefense manufacturing areas. In addition, criticalnodes on each power system are identified in orderto facilitate defense planning.

As administrator of the KAPP, the Commander inChief, Forces Command, develops and maintains aclassified Key Assets List (KAL). Facilities that areincluded on the list must be nominated by DoD and

meet stringent criteria, which includes onsite inspec-tions and the approval of owners. DoD also solicitsnominations of infrastructure assets from otherFederal department and agencies. Responsibility forensuring the security of a facility rests with theowner/operator initially.

In the mid-1970s, the electric utility industryparticipated in the Defense Industrial FacilitiesProtection program (now KAPP). At DOE’s insis-tence, DoD discontinued the “utility list” in 1980.

The utility industry and DOE objected to DoD’sneed to conduct onsite physical security surveys,particularly by Defense agency personnel unfamiliarwith electric power systems, and the arbitrary natureof the selection process.

9The utility industry has not

rejoined KAPP. Since then, DoD, with an initialgrant from FEMA, is again attempting to identifyelectric utility critical nodes that support key defense

facilities. Once identified, DoD will not@ ownersand solicit their cooperation in improving reliabilityand/or security of the critical nodes. The identifiednodes will not be placed on the KAL.

States

States’ efforts to plan for energy emergencies varyconsiderably. This assessment is based on a 1988DOE survey of State energy emergency prepared-ness and information collected by DOE in 1985 and1986.

10According to DOE, most energy emergency

plans were developed under the Energy EmergencyConservation Act, which no longer exists.

DOE found that most States had established aformal authority to deal with energy emergenciesand developed plans that delineate responsibilitiesand provide guidance. DOE noted that almost all of the plans were developed in response to the 1979 oildisruption, and only three plans have been updatedsince 1983. Many of the plans focus on educating thepublic and on conservation programs. Fewer thanone-third address the social impacts of energysupply disruptions.

ll

While some authority and organizational system

is in place, staffing and funding levels have de-creased over the past few years. About one-third of the responding States have at most one full-timeprofessional staff person working on energy prepar-edness; 58 percent have two or fewer. Most Statesindicated that staff are not full time. The majority of respondents noted that the decline in funding hasreduced some States’ response capability .12 And, interms of intergovernmental coordination, some re-spondents expressed a need for more informationand communication between their States and DOE.

On a regional level, energy emergency planningand preparedness varies as well. In 1988, DOE’sOffice of Energy Emergencies conducted four re-gional seminars, which included a simulation of anenergy emergency. From these seminars, DOEfound that energy emergency planning was justgetting off the ground in the Southeastern States.

13

%1 McGratlL Federal Bureau of I.nvestigatiou personal communication% Dec. 11, 1989.

%J.S. congress, General Accounting Of fk e , Federal Electrical Emergency Preparedness Is Inadequate, EMD-81-50, May 12, 1981, p. 19.

IONat io~ R~e~h Counc~ op. cit., footn ote 5.l l lb id . , p . 24.

%bid . , pp. 23-24.

lsFOrp~O~S of h = =*, the Southeastern region includes: Texas, O l d a b oma , Arkansas, Lou i s - Mississippi, Alabama, Florida, Georg@so u t h &ob& North Carol - and Tennessee.





Chapter 5-Current Efforts To Reduce Energy Systems Vulnerability q 45

ranges from 50 to 80 percent, depending on theproduct line.

21

Furthermore, EHV circuit breakers are no longer

manufactured by American-owned companies, al-though they are produced domestically. GeneralElectric sells Hitachi-made circuit breakers andWestinghouse markets Mitsubishi-made models.Two foreign suppliers-Siemens of West Germanyand ABB—manufacture circuit breakers in U.S.factories.

22

The restructuring trends are influenced by thedeclining market for electrical power equipment andsubsequent profitability and the presence of foreign

manufacturers. The power transformer industry, forexample, has significant overcapacity because of thedecline in demand, according to the Department of Commerce. Moreover, nearly 40 percent of U.S.EHV transformer production capacity has beenremoved in the last 3 years. At the same time j foreign

manufacturers’ share of the U.S. power equipmentmarket has increased to about 20 percent and isexpected to continue to rise.

23Foreign-controlled

companies have been predicted to account for about60 to 75 percent of the market for all core electrical

equipment products (distribution transformers,switchgear, transmission, construction equipment,and power generation) by 1990.

24However, it is

important to note that a larger fraction of theseproducts will be manufactured domestically. Be-cause of the decline in the U.S. dollar, foreigncompanies have found serving U.S. markets veryexpensive and one solution to this situation is toestablish facilities in the United States.

25

In contrast, U.S. participation in foreign markets

is minimal. One reason is that electrical equipmenthas been excluded from GATT (General Agreementon Tariffs and Trade) jurisdiction, resulting inlimited U.S. access to foreign markets. This exclu-sion from GATT was influenced by the close

relationships among utilities, electrical equipmentmanufacturers and the government in Europeancountries. Most foreign utilities are State-owned orsubsidized. This government stakeholder positionhas made penetration of some European marketsdifficult. According to the National Electrical Manu-facturing Association (NEMA), between 1975-88,U.S. manufacturers of large power transformers andsteam turbine generators did not win a single orderfrom a European Community (EC) purchaser with adomestic production base for these products.

26

Recently, access to foreign markets has been thesubject of discussion and negotiations among theDepartment of Commerce, the U.S. Trade Represen-

tative, and the EC Commission, which will controltrade for its members, beginning in 1992. The EC, inlate 1988, issued a directive that covers procurementin three previously excluded sectors: energy, water,and transport. The directive, which is currentlyunder review by the European Parliament andCouncil of Ministers, proposes that utilities compet-itively procure purchases above a certain EC unitvalue (about $170,000 - U.S.). The utilities, how-ever, will have considerable latitude in choosing

tendering and procurement procedures, and will beallowed to exclude offers that have less than a 50percent “EC content,” which will be based oncontract value.

27

According to recent testimony by NEMA, theproposed directive provides no new right of accessfor non-EC suppliers. American electrical equip-ment manufacturers will continue to face closedutility markets in most EC member states, accordingto NEMA. On the other hand, U.S. markets are opento foreign suppliers.

28

Proponents for maintaining U.S. electrical equip-ment manufacturing capability suggest that eco-nomic-jobs for U.S. workers—and national secu-rity considerations are two of the most compelling

2 1 ~ e x e 1 33 w h M ~ ( ‘Cm n t Perspectives on the Electrical Equip ment ~dus~,” December 1987, reported in ElectricaZMurketing, “WhyForeigners Will Control U.S. Electrical EquipmentMarke t” vol. 13, No. 3, Feb. 5, 1988, p. 8.

“’The Rise of International Suppliers,’ EPRIJournal, vol. 13, No. 8, December 1988, p. 7.

23~les H , whi te , Natio~ El~ric~ ~n~ac~ers Association t e s t imony a t h e ~ g s before th e SeMte Commit t& on bvemmen~ Afffi , On

Vulnerab ility of Telecommun ications and Energy Resources to Terrorism, Feb. 7 and 8, 1989, p . 65.

~Drexe l B~~ Larnbefi op . Cit., fOOh lO te *1.~Ib id .

XBaWd H. Fti, presiden~ Natioti Electrical Manufacturers Association, t e S t imOny at h a gs before the House Committee on Foreign Affairs,Subcommittee on Europe and the Midd l e East and Subcommittee on International Economic Policy and Trade, Apr. 5, 1989, p. 2.

~Ibid. , pp . 4-5.

2sIbid., p. 5.




arguments. Others maintain that without an adequatenumber of companies in the industry, competitionwill erode and a sellers market will prevail. Stillothers believe that the transportation of foreign-

made equipment will take longer to reach the UnitedStates, which may be critical in a crisis. Somequestion whether standard American spares wouldbe readily available from foreign manufacturers andwonder whether foreign manufacturers will giveU.S. companies priority during a crisis. NEMAargues that an adequate domestic manufacturing

capacity is needed to support a surge in demand forequipment or respond to a crisis.

29

Others see no compelling reason for maintaining

U.S. capability. Foreign companies make qualityelectrical products and do it in a timely manner.Many feel that foreign suppliers are committed tomeeting U.S. needs. One utility executive noted thatthe global market is already part of the businessenvironment, and procurement policies can addressspare parts availability and other issues.

30

z~ t e , op. cit., footnote 23, P. 6.5.

~“The Rise of Intermtional Sup pliers,” op. cit., fooinote 22.



Chapter 6

Options To Reduce Vulnerability

The preceding chapters have established that U.S.electric power systems, while capable of absorbing

considerable damage without interrupting service,are vulnerable to attacks by saboteurs and, to a lesserextent, to massive natural disasters. Damage couldoccur that exceeds normal utility contingency plan-ning, resulting in widespread, severe power short-ages and rolling blackouts that would be extremelyexpensive and disruptive, and could continue formany months.

The risk that massive damage will occur is nothigh, but neither is it negligible. International

terrorist groups appear to have the capability of mounting a crippling assault, and at some point, theyor domestic extremists may see a motivation.Earthquakes and hurricanes more severe than haveyet been experienced in the United States areinevitable. Eventually one will cause unprecedenteddamage to an electric power system, although therandom nature of such disasters makes the resultingdisruption very uncertain.

Various measures can be taken to reduce vulnera-

bility disruption if damage does occur. The NorthAmerican Electric Reliability Council has recog-nized that threats exist, and some utilities have takenaction, as discussed in the previous chapter. How-ever, such actions are voluntary on the part of individual utilities. It can be easy to ignore low-risk events, even if they are of high consequence,especially when protective measures are costly.

Given the unpredictability of these types of disruptions and the uncertainty of their costs, it is not

possible for a cost/benefit analysis to determine howmuch protection is worthwhile. The desirability of further measures is a matter of judgment more thananalysis, as is the potential role of the government instimulating greater protection.

This chapter describes the measures that could beuseful in reducing the risk. This can be done by:

1.

2.

3.

preventing or minimizing damage to the sys-tem;

minimizing the consequences of any damagethat does occur; and

assuring that recovery can be accomplished asrapidly as possible.

In addition, the evolution of the electric powersystem can be guided toward inherently less vulner-

able technologies and patterns. Table 6 lists thespecific steps.

These measures are presented independently of how they would be implemented or who would payfor them. The following chapter discusses consistentpolicy packages of these measures that could beundertaken depending on the judgment of thedecisionmaker as to the severity of the problem. Thepackages address the issues of implementation.

PREVENTING DAMAGE TOTHE SYSTEM

While it is not possible to protect energy facilitiescompletely, it is possible to deter attacks and limitdamage. Measures to reduce vulnerability includeboth physical changes or additions to electric powerfacilities and institutional measures. Physicalchanges include constructing walls or berms aroundcritical facilities and adding monitoring devices todetect unauthorized entry. Some changes may beprohibitively expensive, while others may involveminimal expense.

The transmission network is the part of the powersystem of greatest concern because it is highlyvulnerable to attack, and the consequences can begreat. The lines themselves are essentially impossi-ble to protect because they extend over many

thousands of miles, often in sparsely populatedareas. However, lines can usually be repairedquickly with equipment and materials that utilitieskeep on hand.

Substations are the part of the transmissionsystem with the most serious combination of vulner-ability and potential consequences. Unguarded andunprotected substations in remote areas are asvulnerable as lines, but damaged equipment couldtake months to replace. The loss of even one key

substation could effectively isolate a substantial partof the regional generation capacity from the loadcenters, posing the risk of long-term power short-ages.

4 7 –




Table 6-Options To Reduce Vulnerability

A. Preventing damage 1. Harden key substations-protect critical equipment within

walls or below grade, separate key peices of equipment

such as transformers, toughen the equipment itself to resistdamage, etc.

2. Surveillance (remote monitoring) around key facilities (cou-pled with rapid-response forces).

3. Maintain guards at key substations.4. Improve coordination with law enforcement agencies to

provide threat information and coordinate responses.

B. Limiting consequences 1. Improve emergency planning and procedures for handling

power flow instability after major disasters and ensure thatoperators are trained to implement these contingency plans.

2. Modify the physical system-improve control centers andprotective devices, greater redundancy of key equipment,increased reserve margin, etc.

3. Increase spinning reserves.C. Speeding recovery

1.-

2.

3.

4.

5.

Contingency planning for restoration of service, includingidentification of potential spares and resolution of legaluncertainties.Clarify Iegal/institutional framework for sharing reserveequipment.Stockpile critical equipment (transformers) or any special-ized material (e.g., various types of copper wire) neededto manufacture this equipment.Assure availability of adequate transportation for a stockpileof very heavy equipment by maintaining database orrail/barge equipment and adapting Schnabel cars to fit alltransformers if necessary.Monitor domestic manufacturing capability to assure ade-quate repair and manufacture of key equipment in times ofemergency.

D. General reduction of vulnerability 1. Emphasize inherently less vulnerable technologies and

designs where practical, including pole-type transmissionlines, underground transmission cables, and standardizedequipment.

2. Move toward an inherently less vulnerable bulk powersystem (e.g., smaller generators near loads) as newfacilities are planned and constructed.


Harden Key Facilities

Most substations are enclosed with nothing moreformidable than a chain-link fence. Improved fencesand gates could delay an attack while guards aresummoned by perimeter monitoring systems. How-ever, no fence will delay experienced, dedicatedadversaries for more than a few seconds. Hence there

seems little purpose in constructing very expensiveperimeter barriers unless police or armed guards arestationed at or close to the site. Moderately rein-forced fences, perhaps anchored at the bottom and

incorporating rolls of barbed tape, would providesome protection against opportunistic saboteurs andvandals, especially if coupled with perimeter alarms.

Protective barriers-walls or berms-could bebuilt around the transformers to preclude damagefrom off-site rifle fire. Barriers might be particularlyvaluable in substations at generating plants. Unso-phisticated saboteurs might prefer to avoid ap-proaching generating stations too closely becausethey are manned and often guarded, but appropriate

walls would prevent easy attack from a distance.Walls would not stop a saboteur willing to climb thefence and attack from close range, but deterring lessaggressive attacks could still prevent the loss of abillion-dollar generating station. Barriers would alsolimit the damage that could be caused by one largebomb, forcing the saboteurs to plan a more elaborate,risky attack.

The cost of hardening a particular facility dependson the site characteristics and the type of protection

required. For example, a sheet metal wall (orbuilding) will hide equipment from view. That mighthelp against vandals, but it would provide noprotection against a saboteur with a high-power riflewho knows the equipment is inside and will simplyspray the wall with many bullets. A heavier wall,perhaps made of reinforced concrete that can stoprifle fire, would be considerably more expensive. If the surrounding terrain provides high-vantagepoints, the wall would have to be commensuratelyhigh. While no general rule is proposed, crash-resistant fences and a concrete wall would addperhaps $100,000 to $200,000,

1a few percent of the

multimillion-dollar facility cost. Some measures,such as walls, would make installation and mainte-nance of equipment more difficult. These costsshould be included when evaluating the desirabilityof adding protection.

IDtivti from ‘l”he U.S. Army Corps of Engineers, “Security Engineer@W@, ” August 1987, and Sandia National Laboratories, “AccessDelay,” Sand 87-1926,1989. App. A of the ACE manual l ists several vehicle barriers including ditches (about $4/foot), concrete-ffledposts ($50/foot),reinforced fences (abou t $40/foot), etc. For examp le, a 4-acre site wou ld h ave a fen ce of about 2,000 feet. Assumin g a ditch on 75 percent and filled

posts on the res~ the cost would be $31,000, plus a crash gate at $13,000. In addition, a fence designed to delay attackers on foot perhaps rolls of barbedtape attached to a stand ard chain -link fen ce, wou ld cost abou t $6/foot, or $12,000. Such a fence would be t i t t le dete~ence to a welkquipped adversary.

More formid able b arriers would cost over $20/foot. An 8-inch th ick concrete wall arou nd themnsformer would cost $13.50 per square foot. Athree-phase transformer might involve a three-sided wat l of about 25 feet per side plus an additional 75-foot straight wall to shield the opening whileallowing access incasethe transformer has to be removed. The wall migh t be 25 feet hig lL for a total of 3,750 square feet whichwoutd cost about $50,000.The grand total for th e examp le is $106,000.



Chapter 6-Options To Reduce Vulnerability q 49

Utilities in most parts of the country generallyhave not designed their facilities to be earthquake-resistant, except for nuclear powerplants, yet several

regions besides the west coast are vulnerable.Generating stations are particularly vulnerable toearthquakes unless adequately designed and con-structed. The central Mississippi valley, the southernAppalachians, and an area centered around Indianaare particularly vulnerable to major earthquakes butare much less prepared than California. Review andappropriate upgrading of existing facilities, andapplication of appropriate seismic standards to newconstruction, could avert a major loss of generatingcapacity.

Surveillance

Equipment can be installed at unmanned, keyfacilities to detect intruders. Intrusion detectionsystems include sensors, alarm communication sys-tems, and possibly video equipment to assess thecause of an alarm. Perimeter alarms and motiondetectors would alert utility headquarters or police/ military units which could instigate rapid, armedresponse. A rapid response could interrupt an attack

and that possibility might deter an attack by a groupsophisticated enough to recognize the problem. Tobe of greatest value, a detection system should becoupled with some sort of physical protection of themain substation components, to reduce the possibil-ity of off-site attack.

A wide variety of intrusion sensors have beendeveloped, ranging from buried pressure sensors toelectric field disturbance detectors to fence-motiondetectors. None is perfect. All sensors have some

probability of failing to detect an intrusion, depend-ing on such specific factors as the installationconditions, weather and geographic conditions. andsensitivity of the sensors. Sensors also may triggernuisance alarms-i.e., alarms caused by spuriousfactors such as animals, weather (e.g., wind or rain),background noise, or failure of the sensor itself.Intrusion detection systems may include a closed-circuit television system for remote assessment of the cause of alarms. A detection intrusion system ata substation with a 2,000-foot perimeter would coston the order of $125,000.2

At remote sites surveillance would be less usefulbecause the response would take too long. Saboteurscan cross almost any barrier, leave explosives todestroy critical substation components, and departwithin a few minutes. If several teams operatesimultaneously at different sites, a utility may knowa major attack is in progress but be helpless to doanything about it.

Even at remote sites, however, surveillance sys-tems still would serve two major purposes. Detect-ing and monitoring unauthorized entry would permitthe utility to investigate and presumably discoverand disarm timed explosives. Thus the potentialdamage that one or a few saboteurs can accomplishwould be limited to only one or two sites beforeutilities would have guards out. In addition, someforms of surveillance, such as remote TV cameras,may provide crucial evidence for an investigationeven if an attack is successful.

A related issue is employee training to recognizeand respond to sabotage threats. Reporting suspi-cious behavior near key facilities may uncover plansfor an attack. Alternatively, recognition that sabo-

tage and not natural causes has led to damage may

lead to the preservation of evidence.

Guards

Detection and delay will do little to stop a serioussaboteur if a human response is unavailable tointervene. A heavily armed response to an actualattack is most appropriate to police or military forces(see below), but private guards can deter someattacks.

Currently, armed guards are used at all nuclearpowerplants. As a matter of routine, nuclear plantlicensees must develop physical security plans,which include the training and use of guards. Awell-trained, armed, and dedicated onsite securityforce is one of the major elements of a nuclearpowerplant security system. Guards are also used atnon-nuclear powerplants to monitor employees andvisitors and vehicle traffic and for perimeter surveil-lance. The training and use of guards at powerplantsvary by utility. Guards generally are not used atsubstations.

? Ib i d . App. A of the ACE man ual lists p erimeter d etector costs rangin g from $20/foot for fence motion detectors to $40/foot for i n f rme d systems.For a 2,0(Dfoot perimeter this totals $40,000 to $80,000. A basic control panel would cost around $10,000, including the control unit, power supply,

andcommunication mod ule. AC(7I’V system costs aroun d $30/foot add ing an other $60,000 to the surveillancepackage. Personnel to monitor the systemwould ad d an operating cost.




The deterrent value of guards depends on theirnumbers, training, capabilities, and orders as well ason the capabilities and motivations of their potentialadversaries and the physical characteristics of thesite. Opportunistic saboteurs and vandals may bedeterred by even a single, unarmed guard. Ruthlessterrorists with the resources to mount a well-planned, violent attack essentially could ignore anyforce less than a well-trained and motivated group of armed guards. Barriers and surveillance equipmentcan greatly increase the effectiveness of guards.

Guards are employed in different situations for avariety of reasons: to prevent or detect intrusion,vandalism, and theft; to control people and vehicle

traffic; and to enforce rules, regulations, and poli-cies. Although, private security guards performsome functions similar to public law enforcementofficers, often wear uniforms and badges, andoccasionally carry weapons,

3their legal authority

differs in many significant respects from that of public officers. In general, private security guardshave no more formal authority than other civilians inthe United States. A private security guard has onlythat authority which his employer possesses: theemployer’s basic right to protect persons and prop-erty is transferred to the security officer.

4

Most guards are not armed and can do littledirectly to halt an attack in progress. Guards are ina much better position to detect suspicious behaviorand report it to management or authorities. Theability of local law enforcement to mobilize rapidlyin the event of an attack would be critical. In thissituation, communication among local law enforce-ment officials, contract security firms, and theFederal Bureau of Investigation is essential.

The typical training period for most securityguards is less than 2 working days. Many guards,including some who are armed, receive less than 2hours of training. Most guard personnel aren’tcognizant of their legal powers or authority. How-ever, this situation may be changing. Becausedemands on security guards and the potential forlegal liability have been increasing in recent years,

a growing number of companies and schools areproviding security training.

5The extent and cost of

training security personnel employed at electricutility facilities vary by company and by sitedepending on the degree of risk aversion acceptableto management.

6

A utility’s decision to use guards at a facilitywould have to address a number of issues: the kindof security coverage needed and costs; the effective-ness of guards in deterring different kinds of attacks;whether to employ in-house security personnel orcontract out for guard services on a temporary orpermanent basis.

Because many substations are located in remoteareas, a related question is how long would it take forcontract guards, if not stationed at the site, to arriveafter a warning has been received. The rate of deployment would depend on a number of factors,including the circumstances of the event, and thelocation and resources of the contract security firm.

A utility’s decision to employ guards as a securitymeasure also raises a number of institutional issues.One issue is whether the government should grantpolice powers to utility security personnel. Advan-

tages include increased authority and reduced liabil-ity risk. Potential disadvantages include abuse of authority (e.g., unnecessary arrests) and the legalimplications of such abuse.

7

Another issue is who should pay for the additionalsecurity. Normally, utility commissions allow utili-ties to recover security costs. Before additionalsecurity measures are taken, utilities and utilitycommissions will have to agree on what constitutesa valid need and is in the interest of the consumer.

Coordination With Law Enforcement

Agencies

Ongoing communication among utilities andFederal, State, and local law enforcement agencies,is essential to reducing vulnerability. Clear lines of communication provide two main benefits. First,they enable law enforcement agencies to warn a

3Jo~eph &waddy, Bwns ~temtio~ Sectity Servims, Inc., personal communication Jan. 23, 1990. According to *addyt less ~ 2P~mn t

of security work involves armed personnel.‘kXwles Schnabo l k+ Physical Security: Practices and Technology (Wobuq MA: Butterw orth Pub lish ers, 1983), p. 55.

%id.

bA~addy, op. cit.,footnote 3.

@Torrnan D. Bates, “Special Police Powers: Pros and Cons,” Securizy Management, Au gu st 1989, vol . 33, No. 8, p. 54.






Increasing competition in the electric power indus-try could further increase these loads.

8Unless

construction keeps pace with the increasing loads,the result will be smaller reserve margins. The

greater the reserve margin, the more opportunitiesutilities would have to bypass damaged facilities.Thus increasing efficiency of use of the transmissionsystem could conflict with reliability of service,especially under the kind of extraordinary condi-tions considered in this report.

Increase Spinning Reserves

When a major failure of generating or transmis-sion capacity occurs, utilities must have replacementcapacity available immediately. Since generators

take some time to warm up before they can startdelivering power, reserve capacity must be kepton-line. Usually this means several generators areoperated sufficiently below full load so that anyanticipated outage can be accommodated by anincrease in their power level. The usual reserve is atleast equivalent to the largest single unit or transmis-sion line in operation, in accordance with customaryplanning for the possible loss of any one piece of equipment.

If multiple facilities are sabotaged simultane-ously, the available spinning reserve is likely to beinadequate. Operators will not be able to findadequate replacements for the isolated generators,and many areas will lose power, at least until otherunits can be started which may require several hours.Under such conditions, increased spinning reservelevels could significantly reduce the disruption,depending on the patterns of damage and theremaining available capacity. Utilities are preparedto increase spinning reserves temporarily if they are

aware of a specific threat against them such assabotage or major storms. Maintaining higher levelsroutinely would protect against unexpected attacks.

If additional generating capacity is available,operating it as spinning reserve is not very expen-sive. The additional fuel and labor costs are modest.Some parts of the country currently have excesscapacity which may be used for spinning reserves,although load growth is slowly reducing that surplusto historically normal levels. During certain periods,

such as extreme peak hours or when multiple units

are undergoing maintenance, surplus capacity is notavailable for increased spinning reserves. Increasingsp inning reserves during those periods could requireexpensive new construction.

SPEEDING RECOVERY

Once the system has been stabilized, operators tryto restore power as quickly as possible. Even aftersevere damage, power to parts of the system usuallycan be restored within a few hours by isolating thedamage and resetting circuit breakers. Restoration tofull service and reliability depends on at leasttemporary repair of the damage. The measures hereare intended to eliminate constraints to both near-

and long-term recovery.The benefits of expedited restoration can be

extremely large, even if no power outages occur. Forexample, for each day that a large coal-generatingunit is idled, a utility must spend on the order of $1million for replacement power.

9

Contingency Planning

As in the two previous sections, advance planningand analysis is vital to minimizing problems. If

utilities have already analyzed the problems, theyshould be able to act more efficiently. For instance,few operators have ever had to blackstart a generatoror deal with an entire region of mismatched genera-tion and transmission capacity and loads. Planningcan also help with longer term problems such aswhere to get replacement transformers and how toget them to the site. NERC has started to inventorytransformers in order to facilitate emergency bor-rowing. Completion of this task, such that theoperators of all key facilities know where to look to

borrow critical equipment, could save precious timein an emergency.

Clarify the Legal/Institutional

Framework for Sharing

Utilities routinely loan equipment and crews tohelp restore another utility’s power after an emer-gency, when this can be done without jeopardizingtheir own operations. However, utilities normallymaintain spare large transformers only to the extent

that they are needed to permit maintenance and

8US. ConWe5s, Office of Technology Assessment, Electric Pow er Wheeling and Deali ng: Technological Considerations for Increasing

Competition, OTA-E-409 (Washington, DC: U.S. Government Printing Office, May 1989).

gsee ch . 4 for a discussion of the cost of disabled tits.




replace failures. If these spares are loaned, the owneris risking its own system reliability. From a nationalperspective, it is better to risk reliability in one areathan to keep another area blacked out, but utilitiescannot be expected to willingly sacrifice their ownreliability for the national interest. In addition totheir own economic interests, they may be con-cerned that they will be sued by their customers whosuffer blackouts because backup equipment has beenloaned out.

The Defense Production Act and other nationalemergency laws already permit the government torequisition equipment (with just compensation)needed in case of a threat to the national security, for

instance if a key defense facility is blacked out intime of war. There is no general power to intervenein a major economic emergency that has no nationalsecurity implications, but the legal situation thatwould pertain is complicated.

10State governments

can guarantee such transfers within their ownboundaries, and utilities can make their own volun-tary arrangements including indemnification. How-ever, a national policy establishing a mechanism todetermine priorities and protect economic interests

may be needed to expedite action and in cases wherethe equipment would be shipped across jurisdic-tions.

Stockpile Critical Equipment

Rapid restoration of a system damaged by the lossof several large transformers requires finding andinstalling at least temporary replacements. Manyutilities keep some spare transformers in case of equipment failure. At least one utility keeps spare

Generation Step Up (GSU) transformers for eachplant because of past problems with GSU reliabil-ity.

11However, these spares are typically kept at the

substation site, near the operating transformers,where a saboteur could readily destroy them alongwith the operating transformers. If a utility is unableto obtain spares, whether from its own system orfrom another utility, the only other option is to ordera replacement from a manufacturer. Custom-designed units may require a year or more to

manufacture.

A secure source of emergency transformers couldcut many months off replacement time. Such asource could be a stockpile of the most commonlyused types of transformers, available to any utility inan emergency, or it could be individual backup unitsfor each vital substation. In either case, the unitswould have to be stored in a secure location, perhapsat military installations.

Backups for each substation would effectivelysolve the problem of long-term blackouts, but at ahigh price. The effectiveness of a common stockpilein reducing vulnerability depends on several factorsrelating to the nature of the destruction, the physicalcharacteristics of the system, the availability of

spares from other sources, and the number and typeof spares in the stockpile.

The wide variety of transformers in use compli-cates the development of a stockpile. The majorcriteria are the input and output voltages and thepower level. There is also a wide choice of lesscrucial factors such as insulation level and tolerablerange of voltages.

Because voltages on transmission and distributionsystems are standardized, there are only a fewcommon and important combinations of step-downvoltages. Six to eight key combinations of voltagescould be identified for developing model transmiss-ion transformers. While there are many othervoltage combinations and functions of transformers,those factors would not be the key consideration inan emergency.

GSU transformers present a more challengingstockpiling problem. Because generator output volt-ages are designed to maximize operating efficiency

and not according to standardized values, voltagesrange from 12 to 30 kV.

12A stockpile of GSU

transformers would have to make use of the abilityof generating units to produce a small range of output voltages (±5 percent of nominal), althoughwith a slight loss of efficiency.

13Also, ABB

transformer engineers have suggested that it shouldbe possible to design transformers to work with avariety of input voltages, in which case most 345-kVtransformers could be backed up by two separate

models and most 500-kV transformers by three to

lwokrt po~, con~sio~ Resewch Service, personal communication Feb. Q 1990.

llBer~d p~termc~ American Electric Power, perscmid COmIINlrdCd.iOIlj October 1989.

12u.s. CowsS, office of Technolo~ Assessment, op. cit., footnote 8,p. 91.13D,G. F~ and H.W.B=q (~s.), Sta~ardHandbookforE /ect~caZ Eng ine e r s @J ew York NY: McGmw-I-Ii l l , 1978), p. 7-34.



54 q Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage — .

four common single-phase models.14

Assumingsimilar numbers for 230- and 765-kV units, astockpile of GSU transformers could be based on atotal of around one dozen models. Another variable

is the physical configuration. The bus from thegenerator carries an extremely high current so thelosses can be high. Therefore, the substation andGSU are designed to minimize the distance thiscurrent has to travel, which may call for a custom-designed connector.

Power ratings, insulation levels, and impedancesfor both GSU and transmission transformers wouldhave to be selected based on a trade-off of costs andexpected application, and efficiencies would be

suboptimal. Around 20 transformer models wouldcover most critical applications. However, a stock-pile would almost certainly require more than oneset (three single-phase or one three-phase transform-er) of transformers of each model. For example, if saboteurs disabled four or more sets of transformers,it is probable that at least two of the sets would havethe same voltage combinations and would be re-placed by the same model. The number of units of each model would have to be selected based on anassessment of the likelihood of serious sabotage.

Stockpiling raw materials for the manufacture of transformers may be another way to reduce produc-tion time in case of an emergency. The customarypractice is to design the transformers frost and thenorder the materials because of the customized natureof the product and costs. Copper, for example, isspecial-ordered for each transformer (the copperwire is rectangular, not cylindrical, with particularwidth and height) and takes about 10 to 16 weeks onorder. Core steel, porcelain, load-tap-changers(LTCs) are similarly special-ordered. If existingdesigns and stockpiled materials are used, newtransformers can be produced in less than 6 months(in contrast to normal procurement of over 12months).

Additional spare transformers would be expen-sive. A set of extra-high-voltage transformers costson the order of $2 to $5 million. If all importantsubstations are to be backed by duplicate transform-ers, the capital cost could range up to many hundredsof millions of dollars, depending on the definition of

important. Common transformers would have to be

designed for use in a variety of applications, so theyare unlikely to fall at the low end of the cost range.This is particularly true for the GSUs, which wouldrequire a mechanism to accommodate a range of

input voltages. Assuming a stockpile of 40 trans-former sets (two of each model), the capital costwould be on the order of $100 to $200 million.Building and maintainingstorage facil i t ies wouldadd to the cost.

The suboptimal characteristics of common trans-formers would also result in substantial indirectcosts. To match the voltage capability of a nonop-timized GSU, the generator would need to operate atother than its optimal voltage output, resulting in

slightly degraded efficiency. Further, the trans-former’s generic characteristics could result insignificant efficiency losses, for example if it isoversized for the generator and as a result operatesat partial load. Assuming a combined efficiency lossof 1 percent, the cost at a 500-MW coal plant wouldbe on the order of $2 million during the year requiredto obtain a custom-ordered replacement transformer.Presumably, however, this cost would be much lessthan the cost of not having a stockpiled transformerwhen it is needed.

There would also be costs associated with trans-porting the transformer from storage to the damagedsite. Both the time required and the cost depend onthe location of the stockpile and the damaged site.Also, because a common stockpiled transformerwould not be perfectly matched to the specific siterequirements, it would probably be replaced by anew or repaired transformer, and returned to thestockpile, doubling transport costs. Overall how-ever, the cost of transport is a small fraction of the

capital cost of a transformer.15

A decision to establish a stockpile would have toaddress issues of how many units and of whatdesign, where to store them, under what conditionsto release the equipment, and how to transport it.Priorities for the use of stockpiled equipment shouldmore than one utility have a need may also needresolution.

Payment for the stockpile is another critical issue.

Spares are typically held as an essential part of the

14~x ctis, Wmger of Tecbnic~ SUppOfi Westinghouse/ABB (now ABB), personal commticatio~ Jtiy 27, 1989.

ls~lton peel, Wmgm of operations, Virginia Electric Power CO., personal communication% JI@ 19, 1989.




operation of a system and are included in the ratebase.

l6Currently, neither utilities nor State utility

commissions have found compelling reasons tostockpile critical components beyond normal spares.

To develop a stockpile paid for by utilities and theircustomers, both the utility and the utility commis-sion must agree that the expenditures are a valid costof business in the interest of consumers.

Assure Adequate Transportation Capability

Moving large transformers is difficult under anycondition. Frequently, bridges have to be temporar-ily braced and overpasses removed. Under emer-gency conditions, transportation could be a serious

constraint. The contingency planning discussedabove should identify the transportation problemsthat could slow delivery of transformers to keyfacilities (or removal from other facilities for use asreplacements). Utilities can move to eliminate asmany of these problems as possible. For instance, if the rail lines that brought in the transformers haveclosed, alternative routes could be developed.

If transformers are stockpiled and many arerequired at once, transportation equipment itself may be a constraint. Large transformers are movedon specialized rail cars called Schnabel Cars. Thereare only 13 in the country (plus 1 in Canada), andsome handle only one type of transformer or arelimited in capacity. A serious stockpiling effortshould be accompanied by a program to ensure thatsufficient Schnabel Cars will be available. Thismight involve the production and stockpiling of thecars, or just the conversion of all existing cars tohandle all transformers. If only single-phase trans-formers are stockpiled, conventional transportationequipment is probably adequate.

Monitor Domestic Manufacturing Capability

U.S. manufacturing capability of transmissionequipment, particularly the large transformers, hasdeclined and imports have risen. The use of importedequipment per se is not a problem if it is the leastexpensive, best quality equipment available. How-ever, some utilities are concerned that in an emer-gency, they will have less leverage with foreigncompanies to assure expedited manufacture of

critically needed transformers, and that equipmentwill take longer to deliver from abroad. Repair of damaged transformers also would be delayed if they

had to be shipped abroad and back. At this time, it isnot possible to determine what would have to bedone to maintain the U.S. industry, or how greatwould be the value during emergencies. However,

the situation would appear to warrant continuedattention and analysis by the Department of Energyand the Department of Commerce. National securityconcerns may dictate the maintenance of someminimum capability even if it is not justifiedeconomically under normal conditions. Alterna-tively, the incentive for stockpiling may increase if supply from abroad can’t be considered to be asexpeditious.

GENERAL REDUCTION OFVULNERABILITY

The measures discussed above could be imple-mented specifically to reduce the vulnerability of existing bulk power systems. Other measures havenot been listed because they would be far tooexpensive to retrofit. However, as the system grows,new construction is required that might emphasizedifferent approaches. Vulnerability to massive de-struction has never been a design parameter in

electric power systems (except for nuclear power-plants). Making it a parameter could guide theevolution of future systems toward inherently lessvulnerable technologies and configurations. Vulner-ability is not likely to be the key factor in most cases,but it could swing an otherwise close decision.

Less Vulnerable Technologies

Existing equipment has not been designed toresist sabotage. It is possible that alternative trans-mission towers, insulators, transformers, etc., could

be more resistant than current practice. The ElectricPower Research Institute, equipment manufacturers,and DOE might be encouraged to study how to dothis. In some cases, alternative designs may beavailable now that would be less vulnerable eventhough that was not one of the design criteria.

For example, underground cables are less notice-able and less accessible than overhead lines. There-fore they are less likely to be targets of casualsaboteurs, and somewhat harder to attack for serious

terrorists. They also avoid drawing attention tosubstations. Underground cables should also bemore resistant to major natural disasters, since they

16~id,



54 q Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage —

are not exposed to wind, flying objects, or collapsingtowers. However, underground cables are muchmore expensive to manufacture and install. Further-

more, maintenance and repair, though needed lessfrequently, are more difficult and expensive. If cables were destroyed, whether by saboteurs orearthquakes, replacement would take considerablylonger than for overhead lines.

At present, underground cables usually are usedonly in heavily populated areas. In areas where landis very expensive, the narrower right-of-way neededby underground cables may more than makeup forthe difference in equipment and installation cost. Itis likely that there will be a growing trend towardunderground cables because of increasing opposi-tion to overhead lines, due in part to aesthetics(property values) and to increasing concern over thehealth effects of electric and magnetic fields associ-ated with transmission lines.

17Buried cables virtu-

ally eliminate electric fields and reduce magneticfields. Reduced vulnerability could be an addedincentive.

There would also be some advantages in movingtoward greater standardization of key equipment, in

particular the large transformers. Some of thepotential benefits of standardization over the longterm are increased opportunities for sharing duringemergencies and some reduction in manufacturingtime and cost. It would not be practical to retrofitexisting facilities or change existing system volt-ages, but as new capacity is built, it could be guidedtoward a more limited family of voltages. However,some of the diversity found in our present system isa result of the diverse operating conditions thatutilities face and their special needs. Each trans-former carries a huge amount of power, and even atiny loss of efficiency is very expensive. Hencestandardization would impose serious additionaloperating costs if it sacrifices precise optimizationfor particular applications.

The transformers used in substations to reducevoltage from the transmission system to a distribu-tion system are already standardized to a large extentin that there area limited number of combinations of voltages. If a stockpile were to be established (as

discussed above), relatively few models would berequired to backup most substations.

GSUs are less standardized than step-down trans-

formers. They usually are designed, engineered, andmanufactured to meet a utility’s particular needs. Itmay be possible to design GSUs with multiplelow-side voltage levels to fit a variety of generators,according to the National Electrical ManufacturersAssociation although that is not now done. Thesewould cost more than standard transformers andprobably result in less efficient generator andtransformer operation.

Decentralized Generation

Until fairly recently, generating stations weregrowing in size and remoteness from the load centersbecause of economies of scale and difficulties insiting in densely populated areas. However, whenlarge amounts of power are concentrated in a fewgenerating and transmission facilities, the disruptionthat is caused by a few failures can be very large.Small generating plants are individually no lessvulnerable than large plants (in fact they may bemore so because fewer employees are stationed

there), but the impact of their loss is less. Saboteurswould have to target more facilities to cause thesame disruption. For example, destruction of electricpower systems was never a major part of U.S.strategy in the Vietnam War, because most facilitieswere too small and scattered to be primary targets.

18

If, in addition, smaller plants can be sited close toload centers, the shorter transmission lines providefewer opportunities for disruption.

To some degree, the trend toward larger plants hasbeen reversed. No very large (over 1,000 MW)plants, either nuclear or coal, have been ordered forover a decade. Many co-generation plants have beenconstructed that are directly at a load center. Smallerplants offer benefits such as shorter constructiontimes, better matches with uncertain load growth andgreater operating flexibility. Reduced vulnerabilitydoes not appear to have been a significant factor inthe choices that have been made to date.

It is not clear how far this new trend can continue.That may depend in part on how competition

IVU.S+ ConWess, C)KIW of Tec~olo~ Assessment Biological Efiects of Power Frequency Elecm”c and Magnetic Field-Bac&rOu~ paPerYOTA-BP-E-53 (Springi3e ld , VA: National Technical Information Service, May 1989).

lsFedeM Emergency IVWagement Agency, “Dispersed, Decentralized and Renewable Energy Sources: Alternatives to National Vulnerability andWar,” December 1980, p. 28.








Table 7—Policy Package Components

ModeratePresent Low to majortrends cost investment

A. Preventing damage 1. Harden key substations. . . . .2. Surveillance . . . . . . . . . . . . . .3. Guards . . . . . . . . . . . . . . . . . .4. Improve coordination . . . . . . . X

B. Limiting consequences 1. Improve emergency plan/

procedure . . . . . . . . . . . . . . . . X2. Modify the physical system. .3. Spinning reserves . . . . . . . . .

C. Speeding recovery 1. Contingency planning . . . . . . X2. Clarify legal framework . . . . . X3. Stockpile critical equipment. .4. Assure adequate

transportation . . . . . . . . . . . . . X5. Monitor domestic

manufacturing . . . . . . . . . . . . .

D. General reduction of vulnerability 1. Less vulnerable

technologies. . . . . . . . . . . . . .2. Decentralized generation . . . X


x

xx

xx

x x

x

x

x

x

xx

Disadvantages

Terrorist attacks are largely unpredictable. Thelack of such attacks in recent years is no guaranteethat there won’t be an upsurge in the near future.Several international situations, including the Co-lombian drug wars, separatism in Puerto Rico,tensions in Central America and the Middle East,and even the shifting political climate in EasternEurope could lead to efforts to cause harm to theUnited States by surreptitious means. Electric powersystems could be a prime target for such attacks.

Even though some utilities are taking steps forprotection, it is unlikely that all will implement even. .

minimal measures. Some managers are bound toignore low-risk, high-consequence events until theymaterialize, but by then it would be too late. Someareas could suffer extensive blackouts, at greateconomic and social cost, that might be averted or atleast minimized if the government assures that thenational interest is given due consideration.

LOW-COST GOVERNMENT

INITIATIVESMost of the measures in this package are already

being addressed to some extent, and were includedin the preceding section. The purpose of this package

is to assure that these efforts are adequate, especiallythose that are voluntary for utilities. In addition,initiatives with potentially important long-term im-plications but which would not require large expend-

itures of government or private funds are included.This group of options is intended for those whoconclude that electric power system vulnerability isa problem that requires greater attention, but doesnot justify major financial commitments.

Several of the steps discussed below suggest anapproximate budget level for implementation by theDepartment of Energy (DOE) or other agency. Thisstudy has not analyzed the effectiveness or effi-ciency of any of the government agencies men-

tioned. Therefore it intends no suggestion as towhether the activity could be absorbed within theexisting budget by simply increasing efficiency, orif less important activities could be cut back, orwhether theincreased.

Planning for

overall budget would have to be

Specific Initiatives

Emergencies

Most utilities with vital facilities appear to have

established contact with the Federal Bureau of Investigation (FBI) to facilitate warnings that sabo-tage efforts are likely. DOE could perform a surveyto confirm this coordination (which in itself wouldencourage utilities to establish and maintain thesecontacts) and perhaps sponsor regular meetingsamong utilities with critical facilities and the appro-priate law enforcement agencies. This activitywould require perhaps $100,000 in DOE’s budgetfor the Office of Energy Emergencies (OEE).

DOE could also play an importantrole in

coordi-nating utility emergency plans. Many of OEE’sactivities have been concerned with national secu-rity issues—assuring that vital military and indus-trial facilities will not be crippled by power short-ages during an international crisis. Less attention hasbeen paid to the economic damage that could beinflicted on the civilian economy. For instance, theDepartment of Defense (DoD) has a list of transmis-sion substations that are vital to militarily importantfacilities, but DOE has no equivalent list for

facilities vital to major civilian load centers. OEEcould expand its cooperation with NERC, individualutilities, and State and local governments to analyzea wide range of disasters. OEE could then help theutilities and local police (or other agencies) plan



Chapter 7-Congressional Policy Options q 61

emergency responses. These same exercises couldinclude emergency planning to limit the conse-quences of damage and speed recovery (e.g., contin-gency planning for locating and transporting spares).All these activities could require OEE expendituresof several hundred thousand dollars annually, de-pending on how rapidly the analyses and planningexercises are to be completed and how often theywould have to be updated. The Federal EmergencyManagement Agency (FEMA) and other govern-ment agencies should also have a role in thisemergency planning.

Increased Spinning Reserves

Increasing spinning reserves beyond present lev-els would have to be either mandated or paid for bythe government. Additional equipment would haveto be kept operating, which incurs manpower, fuel,and maintenance costs. In some cases, low-cost unitswould have to be operated at less than full load tosupply spinning reserves because other unitscouldn’t be operated at the necessary levels. Con-struction of new generating equipment would alsobe required if the installed capacity was inadequateto support higher reserves, as is becoming true in

many parts of the country. Both the costs and thevalue of increased reserves are uncertain. Utilitieshave not yet determined the cost of spinning reserveas a separate, unbundled service to be purchasedunder competitive generation. A DOE study, possi-bly done in cooperation with NERC, could be of value to determine the costs of increased spinningreserve and the value if widespread damage doesoccur.

Increased Sharing of Spares

Congress can consider legislation to encouragethe sharing of backup equipment, which utilitieswould otherwise consider necessary for their ownsystem. This legislation would establish a forum fordetermining priorities in a national emergency andrelieve lending utilities of liability for power outagesn their own territory stemming from the absence of

this equipment. The purpose would be to improvethe chances that spare transformers and other keyequipment are available where most criticallyneeded. The first step would be to request a legalanalysis, perhaps from the Congressional ResearchService, to determine the applicability of existingegislation to a situation of a major, long-term power

crisis that does not have great national securitymplications. It also could be beneficial to have DOE

analyze how to include such sharing of otherwiseunavailable equipment in the emergency planningdiscussed above.

Assuring Adequate Equipment Supply

The future of the electric equipment supplyindustry is of concern to both DOE and theDepartment of Commerce (DOC). A joint study of both its competitiveness and its role during emer-gencies would establish whether there is a govern-ment interest in maintaining particular capabilities.This study would not have to be very large. DOCalready has studied the competitiveness of theindustry. Utilities and the supply industry, both here

and abroad, should cooperate in determining howequipment would be handled during an emergency.

Analyze Vulnerability Implications of Future Growth

DOE could also consider how the long-termevolution of the industry could be guided towardreduced vulnerability. Analysis of different technol-ogies (e.g., underground cables) and configurations(e.g., small, dispersed generation) could determinethe relative vulnerability, costs, operability, etc. In

addition, the study would consider how to get theindustry to give low-vulnerability options properconsideration. This would be a complex, demandingstudy with many different lines of analysis.

Advantages

This package of options would raise the visibilityamong utilities of the necessity of preparing formajor attacks. Advance emergency plannings h o u l dimprove the handling of a disaster and the recovery

afterwards, at least if the disaster conforms toanticipations. Few attacks would be deterred by thispackage, but the impact of some could be reduced.This package would also raise the priority given tosuch preparation by government agencies and pro-vide the analytical basis for further steps. Theseoptions should lead to a useful reduction in vulnera-bility without requiring much investment by eithergovernment or industry.

Disadvantages

There are no real disadvantages to this package.The main question is whether the modest gains

justify the modest costs. It is impossible to quantifythe benefits of this package relative to present trends,but they are unlikely to be major, at least in regard



62 q Physical Valnerability of Electric Systems to Natural Disasters and Sabotage

to terrorist attacks. There are too many differentways in which the system can be attacked toanticipate all of them. Advance planning by utilitieshas obvious value, but it would still be easy to

overwhelm these preparations with a large-scaleattack. Even routine vandalism, including shootingat transmission lines and substations, would not begreatly deterred. The studies proposed could beuseful, but unless the results are implemented, theywould provide no significant benefits.

MODERATE AND MAJOR

INVESTMENTS TO REDUCE

RISKS

If the initiatives discussed above are seen asinadequate, the next step is to ask what could beaccomplished at higher cost. There are severaloptions outlined in the previous chapter that entailconsiderable cost but promise significant reductionin vulnerability, at least under some conditions.Utilities are not likely to undertake these measureson their own. The measures are intended to addresslow-probability, high-consequence events that utili-ties do not consider sufficiently probable to includein their reliability considerations. If policymakersfind that national interest considerations require thatthese investments be made, it is likely that thegovernment will have to at least share expenses orcoerce utilities. Sharing expenses will call forsignificant government expenditures at a time of considerable budget difficulty. One possibilitywould be a kind of users fee: a small, temporary taxon power sales. For instance, a tax of 0.01 cent perkilowatt-hour (raising an 8 cent/kilowatt-hourcharge to 8.01 cents) would produce almost $300

million per year while remaining virtually invisibleto all but the largest users. If imposed for a year ortwo, this tax would pay for most of the proposalsdiscussed here. This approach is already used bysome States to fired energy studies, for example.However, the fact that such a tax would not beobvious does not justify it if the need for governmentinvolvement is seen as very small.

Specific Initiatives

Protect Facilities

Protecting key facilities, particularly substations,would significantly reduce the risks of long-termdamage, especially from low-level threats (unso-phisticated saboteurs and vandals). The problem is

to determine which facilities are worth protecting,what measures to take, and how to pay for them.DOE presumably would identify the most importantfacilities if the analyses of the previous section are

performed. Depending on the decrease in vulnerabil-ity desired (i.e., how many areas are of concern, theacceptable duration of blackouts, and the level of reliability required after a disaster) there could be asfew as 30 or as many as 150 facilities that wouldrequire protection to significantly limit the long-term disruption following a multi-site attack. Theexact protection measures-hardening, surveil-lance, guards—for each facility would depend on itsimportance, physical characteristics and location aswell as on the nature of the anticipated threat. Both

DoD and DOE have extensive experience in protec-tion design though they may not have applied it tomany substations. These agencies could expand onDoD’s Key Assets Protection Program to includedesigns for physical protection. The utility ownershould also be involved in this exercise to ensure thatthe physical protection and its implementationwould not interfere with the operability of thefacility.

The cost of physical protection such as remote

surveillance equipment and walls around the trans-formers would be highly variable, but the one-timetotal might be on the order of several hundredthousand dollars for each substation. This is only afew percentage of the cost of the facility, but it is stillsignificant. Stationing a guard during off-hours(about 130 hours per week) would entail an annualcost that might be on the order of $50,000 to$100,000. It is likely that some utilities would bereluctant to make these changes voluntarily. Thebenefits (e.g., reduced threat of a major blackout)

considered in arriving at the level of protectionspecified, accrue largely to the users of the power,not to the utility. Therefore it is likely that thegovernment would have to mandate these improve-ments or pay for at least part.

Make Power Systems More Resilient

The analysis that identified key facilities presum-ably would also suggest opportunities for modifica-tions (e.g., upgraded control centers, improved

communications) to the physical system that wouldhelp maintain reliability following major damage tothe system. However, getting these modificationsimplemented is likely to be difficult because noappropriate policy tools exist. Utilities build their



Date post:	30-May-2018
Category:	Documents
Upload:	chris-nash
View:	215 times
Download:	0 times