physical vulnerability of electric systems to natural ...ota.fas.org/reports/9034.pdf · physical...

Physical Vulnerability of Electric Systems toNatural Disasters and Sabotage

June 1990

OTA-E-453NTIS order #PB90-253287

Recommended Citation:

U.S. Congress, Office of Technology Assessment, Physical Vulnerability of Electric Systemto Natural Disasters and Sabotage, OTA-E-453 (Washington, DC: U.S. Government PrintingOffice, June 1990).

For sale by the Superintendent of DocumentsU.S. Government Printing Office, Washington, DC 20402-9325

(order form can be found in the back of this report)

Foreword

This assessment responds to requests by the Senate Committee on Governmental Affairsand the House Committee on Energy and Commerce to evaluate the potential for long-termelectric power outages following natural disasters and deliberate sabotage. This reportcomplements earlier OTA reports: Electric Power Wheeling and Dealing-TechnologicalConsiderations for Increasing Competition; and New Electric Power Technologies—Problems and Prospects for the 1990s.

This country has enjoyed remarkably reliable electric service for the most part. Very fewblackouts have affected many people for more than a few hours. Nevertheless, much worseblackouts are possible which could cause enormous disruption and expense for society. It isthe intent of this report to analyze how such disasters could happen and how the risk could bereduced.

OTA examined the effects on an electric power system when various components aredamaged and how the system can be restored. Present efforts and potential options to reducevulnerability are described. Also, specific policy measures are analyzed and groupedaccording to whether they are likely to be implemented and their costs.

This report contains no information not readily available from other public sources thatwould assist saboteurs in destroying electric power facilities and causing widespreadblackouts. An analysis of the vulnerability of specific equipment is included in a separateappendix that is under classification review by the Department of Energy. This appendix willbe made available only under appropriate safeguards by the Department of Energy.

OTA appreciates the generous assistance provided by our workshop participants as wellas other individuals who contributed to this report by providing information, advice, andsubstantive reviews of draft materials. To all of the above goes the gratitude of OTA and thepersonal thanks of the project staff.

. . .Ill

Edward BadolatoCMS, Inc.

Lex CurtisWestinghouse ABB

John EdwardsNew York State Energy Office

Electric System VulnerabilityWorkshop Participants

October 18, 1989

Michehl GentNorth American Electric Reliability Council

A. Leonard GhilaniRTE Power Products

Henry HyattFederal Emergency Management Agency

James JacksonSouthern California Edison Co.

Frank KrollArizona Public Service Co.

Charles LaneU.S. Secret Service

Joseph Muckerman 11U.S. Department of Defense

Jeffrey PalermoCasazza, Schultz & Associates, Inc.

Bernard PasternackAmerican Electric Power Service Corp.

Stanley TrumbowerU.S. Department of Energy

Joseph WalterMaryland Public Service Commission

Emmet WillardPrivate Consultant

John WilliamsU.S. Department of Energy

John WohlstetterContel Corp.

Frank YoungElectric Power Research Institute

Physical Vulnerability of Electric Power Systems toNatural Disasters and Sabotage

OTA Project Staff

Lionel S. Johns, Assistant Director, OTAEnergy, Materials, and International Security Division

Peter D. Blair, Energy and Materials Program Manager

Alan T. Crane, Project Director

Robin Roy, Analyst

Joanne M. Seder, Analyst

Administrative Staff

Linda Long Phyllis Brumfield

Contributors

Lillian ChapmanA. Jenifer Robison

Daniel Yoon

Contractors

Casazza, Schultz & Associates, Inc.

Acknowledgments

Glenn CoplanU.S. Department of Energy

Lex CurtisAsea Brown-Boveri

James DoddVirginia Power Co.

Gene GomelnikNorth American Electric Reliability Council

Richard GutleberVirginia Power Co.

Roger HamrickVirginia Power Co.

Eric HaskinsEdison Electric Institute

Steinar J. DaleOak Ridge National Laboratory

James S. GilbertsonFederal Emergency Management Agency

Michael HuntAsea Brown-Boveri

Robert MullenDepartment of Energy

David NeviusNorth American Electric Reliability Council

Hilton PeelVirginia Power Co.

Kyle PitsorNational Electrical Manufacturers Association

Charles RudasillVirgnia Power Co.

Charles WhiteNational Electrical Manufacturers Association

Additional Reviewers

Darriell JonesFederal Bureau of Investigation

Monte StraitFederal Bureau of Investigation

NOTE: OTA appreciates and is grateful for the valuable assistance and thoughtful critiques provided by the reviewers. The reviewersdo not, however, necessarily approve, disapprove, or endorse this report. OTA assumes full responsibility for the report andthe accuracy of its contents.

vi

Contents

PageChapter 1: Introduction and Summary . . . . . . 1

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . 1SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Causes and Costs of Extended Outages . . . . 1Component Vulnerability and Impact

on System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Current Efforts To Reduce Vulnerability ..4Policy Options To Further Reduce

Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . 5

Chapter 2: Causes of Extended Outages . . . . . 9NATURAL HAZARDS . . . . . . . . . . . . . . . . . . . . 9

Earthquakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Hurricanes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Tornadoes and Thunderstorms . . . . . . . . . . . 12Geomagnetic Storms . . . . . . . . . . . . . . . . . . . . 13

SABOTAGE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Experience With Sabotage . . . . . . . . . . . . . . 14The Threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Chapter 3: Impacts of Blackouts . . . . . . . . . . . 19OVERVIEW OF COSTS OF

BLACKOUTS . . . . . . . . . . . . . . . . . . . . . . . . . 19Types of Costs. . . . . . . . . . . . . . . . . . . . . . . . . 19Hypothetical Outage Cost Estimates . . . . . 20Actual Outage Cost Estimates . . . . . . . . . . . 21

SECTORAL IMPACTS . . . . . . . . . . . . . . . . . . . 23Industrial . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Commercial . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Agriculture . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Residential . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Transportation . . . . . . . . . . . . . . . . . . . . . . . . . . 26Telecommunications . . . . . . . . . . . . . . . . . . . . 26Emergency Services . . . . . . . . . . . . . . . . . . . . 28Public Utilities and Services . . . . . . . . . . . . . 28

Chapter 4: System Impact of the Loss ofMajor Components . . . . . . . . . . . . . . . . . . . . . . 31SHORT-TERM BULK POWER SYSTEM

IMPACTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31The Importance of Any One Component:

Preparing for Normal Failure . . . . . . . . . . 31Impacts of Multiple Failures: Islands

and Cascading Outages . . . . . . . . . . . . . . . 33LONG-TERM BULK SYSTEM IMPACTS. 34

The Importance of Any Few Components:Large Reserves and Peak Capacity . . . . . 34

System Impact When No Outages Occur:Higher Costs and Lower Reliability . . . . 35

BULK SYSTEM RECOVERY FROMOUTAGES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

PageSPECIFIC EXAMPLES OF ATTACKS . . . . 36

Destruction of Any One Generator,Transmission Circuit, or Transformer. . 36

Destruction of One Major Multi-CircuitTransmissions Substation or Multi-UnitPowerplant . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Destruction of Two or Three MajorTransmission Substations . . . . . . . . . . . . . 37

Destruction of Four or More MajorTransmission Substations . . . . . . . . . . . . . 37

Chapter 5: Current Efforts ToReduce Energy System Vulnerability . . . . . 39CURRENT EFFORTS . . . . . . . . . . . . . . . . . . . . 39

Private Industry . . . . . . . . . . . . . . . . . . . . . . . . . 39Federal Government . . . . . . . . . . . . . . . . . . . . 40States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

STATUS OF THE U.S. ELECTRICALEQUIPMENT MANUFACTURINGINDUSTRY . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Chapter 6: Options To ReduceVulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

PREVENTING DAMAGE TO THESYSTEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Harden Key Facilities . . . . . . . . . . . . . . . . . . . 48Surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Guards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Coordination With Law Enforcement

Agencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50LIMITING THE CONSEQUENCES . . . . . . . 51

Improve Emergency Planning andProcedures . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Modify the Physical System . . . . . . . . . . . . . 51I n c r e a s e sinning Reserves . . . . . . . . . . . . . 52

SPEEDING RECOVERY . . . . . . . . . . . . . . . . . 52Contingency Planning . . . . . . . . . . . . . . . . . . . 52Clarify Legal/Institutional Framework

for Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . 52Stockpile Critical Equipment . . . . . . . . . . . . 53Assure Adequate TransportationCapability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Monitor Domestic ManufacturingCapability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

GENERAL REDUCTION OFVULNERABILITY . . . . . . . . . . . . . . . . . . 55

Less Vulnerable Technologies . . . . . . . . . . . 55Decentralized Generation . . . . . . . . . . . . . . . . 56

Chapter 7: Congressional Policy Options . . . 59PRESENT TRENDS . . . . . . . . . . . . . . . . . . . . . . 59

PageAdvantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . 60

LOW-COST GOVERNMENTINITIATIVES . . . . . . . . . . . . . . . . . . . . . . . . . . 60Specific Initiatives . . . . . . . . . . . . . . . . . . . . . . 60Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . 61

MODERATE AND MAJORINVESTMENTS TO REDUCE RISKS.. 62Specific Initiatives . . . . . . . . . . . . . . . . . . . . . . 62Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . 63

BoxesBox PageA.The Armenian and San Francisco

Earthquakes’Effects on ElectricPower Systems . . . . . . . . . . . . . . . . . . . . . . . . 10

B. Hurricane Hugo’s Effect on South CarolinaElectric & Gas Co. . . . . . . . . . . . . . . . . . . . . 13

Box PageC. New York City Blackout . . . . . . . . . . . . . . . . 22D. Transportation Impacts-Northeast and New

York City Blackouts . . . . . . . . . . . . . . . . . . 27E. The Organization of Electric Systems:

Utilities, Control Areas, Power Pools,and Interconnections . . . . . . . . . . . . . . . . . . . 32

TablesTable Pagel. Cost of the New York City

Blackout—1977. . . . . . . . . . . . . . . . . . . . . . . . 32. Options To Reduce Vulnerability . . . . . . . . . . 73. Direct and Indirect Costs . . . . . . . . . . . . . . . . . 204. Comparison of Cost Estimates for

Power Outages . . . . . . . . . . . . . . . . . . . . . . . . 215. Cost of the New York City

Blackout—1977 . . . . . . . . . . . . . . . . . . . . . . 236. Options To Reduce Vulnerability . . . . . . . . . 487. Policy Package Components . . . . . . . . . . . . . . 60

. . .Id/l

Chapter 1

Introduction and Summary

INTRODUCTIONThe reliability of U.S. electric power systems has

been so high that the rare occurrences of majorblackouts have been prominent national and eveninternational news items. The most notable inci-dents—in South Carolina after Hurricane Hugo, inSeattle after the 1989 cable fire, New York City in1977, or almost the entire Northeast in 1965—havedemonstrated that blackouts are very expensive andentail considerable disruption to society.

As damaging as these blackouts have been, muchworse events are possible. Under several differenttypes of circumstances, electric power systemscould be damaged well beyond the level of normaldesign criteria for maintaining reliability. Seismicexperts expect that several parts of the country couldexperience significantly larger earthquakes than theone that hit California in 1989. Hurricanes evenmore damaging than Hugo could move along theGulf of Mexico or up the Atlantic coast, maintainingtheir strength rather than losing it inland. Either typeof natural disaster could damage many electricpower system components, causing widespreadoutages over a long period of restoration andrecovery. Even more ominously, terrorists couldemulate acts of sabotage in several other countriesand destroy critical components, incapacitatinglarge segments of a transmission network formonths. Some of these components are vulnerable tosaboteurs with explosives or just high-power rifles.Not only would repairs cost many millions ofdollars, but the economic and societal damage fromserious power shortages would be enormous.

Electric utilities normally plan for the possibilityof one, or occasionally two, independent failures ofmajor equipment without their customers sufferingany significant outage. If the system can be betterprotected, or made sufficiently resilient to withstandgreater levels of damage, then the risk of a major,long-term blackout will be reduced. However, anysuch measures will cost money. Utilities are takingsome steps, but apparently, generally consider therisk to be too low to warrant large expenditures,which would ultimately be borne by their customers,or by stockholders if the State utility commission didnot approve inclusion of these costs in the rate base.

However, the consequences of a major, long-termblackout are so great that there is a clear nationalinterest involved. Steps that may not be worthwhilefor individual utilities could make sense from thenational perspective. The purpose of this report is toexplore the options for reducing vulnerability andplace them in context. It first reviews the threat fromboth natural disasters and sabotage to determinewhat damage might occur. However, an analysis ofthe probability of any of these threats materializingis beyond the-scope of this study. Chapter 3 reviewsthe impact of major blackouts that have occurred, inorder to help understand the costs of an even greaterone that might be experienced eventually. Chapter 4estimates the effect on the system when variouscritical components are damaged, and how thesystem can be restored. Chapters 5 and 6 describepresent and potential efforts to reduce vulnerability.Finally, chapter 7 suggests how Congress could act,depending on how seriously the problem is viewed.

SUMMARY

Causes and Costs of Extended Outages

A variety of events, both natural and manmade,can cause power outages. Widespread outages orpower shortages lasting several months or more areunlikely unless significant components of the bulkpower system—generation and transmission-aredamaged. The most probable causes of such damageare sabotage of multi-circuit transmission facilities,and very strong earthquakes or hurricanes.

The bulk power system is vulnerable to terroristattacks targeted on key facilities. Major metropoli-tan areas and even multi-state regions could losevirtually all power following simultaneous attackson three to eight sites, though partial service mightbe restored within a few hours. Most of these sitesare unmanned, and many are in isolated areas, withlittle resistance to attack. Powerplants can also bedisabled by terrorists willing to attack a manned site,or isolated from the transmission network by high-power rifle fire outside the site.

None of the attacks on electric power systems inthe United States has been large enough to causewidespread blackouts, but there are reasons forconcern that the situation may worsen. Small-scale,unsophisticated attacks on power systems have

– l -

2 ● Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage

occurred here. Power systems in other countries,especially in Latin America and Europe, havesuffered much worse and more frequent damage.Latin American and African countries have sufferedoutages of several weeks. Terrorist attacks in thiscountry have not been a major problem over the pastdecade, but that could change rapidly. Terroristscould select power systems as targets if they want tocause a large amount of economic disruption with arelatively small effort. Efficient selection of targetswould require more sophistication than has yet beenshown by terrorist groups in the United States, butthe required information and expertise are availablefrom public documents as well as from foreignterrorist groups. In addition, some foreign groupsmight want to strike directly at the United States.

Hurricanes and earthquakes can also have adevastating effect on power systems, but the patternof destruction would be much different than after alarge-scale attack by saboteurs. Hurricanes affectdistribution systems much more than generation andtransmission. The relatively low lines are vulnerableto falling trees, flooding, and flying debris. Restora-tion may be a monumental task lasting several weeksor even months, but replacement parts are readilyavailable, and utilities are experienced in the type oftasks required. However, the lingering blackoutsfollowing Hurricane Hugo demonstrated that greateradvanced planning may be warranted. For instance,some types of transmission towers failed in the highwinds, suggesting that more resilient designs shouldbe used in vulnerable areas. Utilities along the Gulfand Atlantic coasts, areas vulnerable to hurricanes,should be studying the lessons learned from Hugo.

Earthquakes are quite capable of destroyinggeneration and transmission equipment as well asdistribution systems. However, where facilities havebeen constructed to withstand earthquakes, as inCalifornia, it is unlikely that more than a few keypieces of equipment would be damaged. The great-est concern is when an earthquake hits an area whereseismic disturbances have not been considered in thedesign of equipment. The central Mississippi valley,the southern Appalachians, and an area centeredaround Indiana have the highest potential for earth-quake damage. No plausible natural disaster shoulddamage the bulk power system so badly as to causewidespread power outages for more than a few daysif utilities have taken adequate precautions. Utilitiesnormally can restore power fairly quickly unlessmultiple circuits are interrupted.

However it might occur, a long-term blackout isextremely expensive. Direct impacts include lostproduction and sales by industrial and commercialfirms, safety (e.g., incapacitated traffic and airsystem controls), damage to electronic equipmentand data, inconvenience, etc. Indirect costs includesecondary effects on firms unable to conduct busi-ness with blacked-out firms, public health (e.g.,inoperable sewage treatment plants), and looting.Table 1 summarizes the costs of the 1977 blackoutin New York City, which lasted for about 25 hours.Blackouts of a few hours or days have beenestimated to cost $1 to $5 per kilowatt-hour notdelivered, far greater than what the power wouldhave cost had it remained uninterrupted. Predictingcosts for any specific longer-term outage is veryuncertain because costs depend on many factorsincluding the customers affected, the timing andduration of the outage, and the degree of adaptationcustomers and utilities can achieve to mitigate theoutage.

Unless the damage is extremely severe, at leastpartial power could be restored in a matter of hours.Full restoration may take many months if a largenumber of key pieces of equipment have beendestroyed. In the interim, customers would be facedwith rolling blackouts, voltage reductions, or lowerreliability. An additional impact is that the cost ofthe power that is available will be high if some of themost economical generating stations are damaged orisolated from loads by transmission system damageand therefore idled.

Component Vulnerability and Impacton System

Three factors determine the importance of anyindividual component—its susceptibility to dam-age; the effect on the power system of its loss; andthe difficulty of its replacement or repair. Thesefactors vary with particular circumstances. Forexample, generating stations can be destroyed bysaboteurs willing to enter the plant, but the presenceof utility employees performing their normal func-tions is a deterrent. However, if an insider isinvolved, sabotage becomes much easier. Similarly,the vulnerability of generating stations to earth-quakes is low if they have been designed towithstand them and high otherwise.

Widespread, long-term blackouts could only becaused by damage to several circuits isolating

Chapter 1-Introduction and Summary ● 3

Table l-Cost of the New York City Blackout—1977a

Impact areas Direct ($million) Indirect ($million) -

Businesses Food spoilage . . . . . . . . . . . . . . . .Wages lost . . . . . . . . . . . . . . . . . .Securities industry . . . . . . . . . . . .Banking industry. . . . . . . . . . . . . .

Government(Non-public services)

Consolidated Edison

Insurance b

Public Health Services

Other public services

Restoration costs . . . . . . . . . . . . .Overtime payments . . . . . . . . . . .

Metropolitan TransportationAuthority (MTA) revenue:Losses . . . . . . . . . . . . . . . . . . .MTA overtime and

unearned wages . . . . . . . . . .

Westchester County Food spoilage . . . . . . . . . . . . . . . .Public services

equipment damage,overtime payments . . . . . . . . . .

Totals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

$1.05.0

15.013.0

10.02.0

2.6

6.5

0.25’

0.19

$55.54

Small businesses . . . . . . . . . . . . .Emergency aid

(private sector) . . . . . . . . . . . . .

Federal AssistancePrograms . . . . . . . . . . . . . . . . . .

New York StateAssistance Program . . . . . . . . .

New capital equipment(program andinstallation) . . . . . . . . . . . . . . . .

Federal crimeinsurance . . . . . . . . . . . . . . . . . .

Fire insurance . . . . . . . . . . . . . . . .Private property

insurance . . . . . . . . . . . . . . . . . .

Public hospitals-overtime, emergencyroom charges . . . . . . . . . . . . . .

MTA vandalism . . . . . . . . . . . . . . .MTA new capital

equipment required . . . . . . . . .Red Cross . . . . . . . . . . . . . . . . . . .Fire Department

overtime and damagedequipment . . . . . . . . . . . . . . . . .

Police Departmentovertime . . . . . . . . . . . . . . . . . . .

State Courtsovertime . . . . . . . . . . . . . . . . . . .

Prosecution andcorrection . . . . . . . . . . . . . . . . . .

$155.4

5.0

11.5

1.0

65.0

3.519.5

10.5

1.50.2

11.00.01

0.5

4.4

0.5

1.1

$290.16aBased on aggregate data collected as of May 1,1978.bOverlap with business losses might occur since some are recovered by insurance.cLotting was included in this estimate but reported to be minimal.Note: These data are derivative, and are neither comprehensive nor definitive.SOURCE: Systems Control, Inc., Impact ofAssessrnent of the 1977 New York City Blackout (Washington, DC: US Department of Energy, July 1978), p. 3.

generating capacity from loads. No single failureshould have a significant effect on power flow tocustomers since most utilities maintain sufficientgenerating and transmission reserves to accommo-date such failures. If more damage occurs, either togenerating stations or the transmission system con-necting them to loads, the system can separate intoislands. When these islands form, some have toomuch or too little generating capacity for their loadsand lose all power. Other islands with approximatebalance can maintain power, disconnected from theremainder of the system. The pattern of break up isnot predictable, depending on the location of loads,which units are operating, the configuration of thetransmission system, and the nature of the initiating

event. Under extreme contingencies, substantialoutages will occur. Modern protective circuitryshould prevent the type of cascading failures acrossan entire system that occurred in the Northeastblackout of 1965, but there are many uncertaintiesover system behavior under untested conditions.

Power systems can be constructed to ride outalmost any earthquake or hurricane with onlyminimal damage to components that would requiremonths to replace. Most customers of an adequatelyprepared system will have their power restoredwithin a day or two, though extensive damage totransmission and distribution lines may mean someoutages for a few weeks. As noted above, however,a major earthquake east of the Rocky Mountains


would cause major problems because few facilitiesare designed to withstand such an event.

Sabotage could cause the most devastating black-outs because many key facilities can be targeted.Substations present the greatest concern. The trans-mission lines themselves are even easier to disruptbecause they can be attacked anywhere along theline, but they are also much easier to repair.Generating stations are somewhat more difficultthan substations to attack because they are mannedand often guarded.

Substations are used at generating plants to raisethe low voltage of the generator to the level of thetransmission system, and near load centers to reducethe voltage for the distribution network. The formerare partially protected by the routine activity atpowerplants, but few of the latter have any moredefense than a chain-link fence. In some cases, anattack can be carried out without entering thefacility.

The destruction of two or three well-selectedsubstations would cause a serious blackout. In manycases, most customers would be restored within 30minutes, but this damage would so reduce reliabilitythat some areas would be vulnerable to additionalblackouts for many months. Virtually any regionwould suffer major, extended blackouts if more thanthree key substations were destroyed. Some powerwould be restored quickly, but the region would besubject to rolling blackouts during peak demandperiods for many months. The impact would be lesssevere at night and other times when demand isnormally less than peak, because utilities then wouldhave a better balance of supply and demand. Thegreater the generating and transmission reservemargin, the less would be the impact on customers,because it is easier for utilities to find ways to getpower delivered despite the damage.

Current Efforts To Reduce Vulnerability

Utilities historically have expended great effortsto ensure reliability, but only over the past few yearshave they started to take seriously the possibility ofmassive, simultaneous damage on multiple facili-ties. Awareness of the threat, however, has not yetled to the implementation of many measures tocounter it. Few if any utilities plan their system andits operation to accommodate multiple, major fail-ures, and key facilities are still unprotected.

Most of the actions the industry has taken havebeen instigated by the North American ElectricReliability Council (NERC) and the Edison ElectricInstitute (EEI). NERC completed a major study ofvulnerability in 1988. Some of the recommendationshave been adopted, while others are still underreview. EEI has a large and active security committ-ee which facilitates information exchange on physi-cal protection of facilities.

The Federal Government’s role for the most parthas focused on national security issues—how tokeep facilities operating which are vital to the UnitedStates during times of crisis. There has been lessconcern over the damage to the civilian economythat a major power outage would cause. TheNational Security Council is the lead agency foremergency preparedness, with the Federal Emer-gency Management Agency serving as adviser. Bothof these agencies consider many vulnerabilities inaddition to energy. Energy concerns are included inthe new Policy Coordinating Committee on Emer-gency Preparedness and National Mobilization(PCC-EP/NM).

The Department of Energy (DOE) has primeresponsibility for energy emergencies. DOE’s Of-fice of Energy Emergencies (OEE) was created toensure that industry can supply adequate energy tosupport national security and the Nation’s economicand social well-being. Most of OEE’s activities havebeen directed at national security issues, but otherefforts have included information exchanges withState governments, disaster simulations, and contin-gency planning. OEE also operates the NationalDefense Executive Reserve Program, which recruitscivilian executives from the electric power industryamong others to provide information and assistancein case of national emergency. DOE also hasestablished a threat notification system to alertenergy industries to potential problems.

The Department of Defense administers the KeyAssets Protection Program. The Program’s purposeis to protect civilian industrial facilities essential fornational defense from sabotage during a crisis. TheProgram has identified electric power facilitiesrequired for vital military installations and defensemanufacturing areas and coordinated plans for theirprotection with the owners.

Two trends that may increase vulnerabilityshould be noted. First, the U.S. electrical equipmentmanufacturing industry has declined with the slow-

Chapter I---Introduction and Summary ● 5

down in utility growth. Many production facilitieshave closed and the skills of their work forces havebeen largely lost. In addition, imports of equipmenthave risen to about 20 to 25 percent of the totalmarket, and most U.S. production capability iscontrolled by foreign companies. The concern re-garding vulnerability is that in a major emergency,say if all the transformers at several substations aredestroyed, foreign companies may lack the incentiveU.S. companies would have in expediting therestoration of service. If a worldwide resurgence ofgrowth has filled their order books, will foreigncompanies accord adequate priority to U.S. emer-gency needs? There is no definitive answer to thisquestion. Some observers see no problem whileothers are quite concerned.

Second, power systems reserve margins aredropping as growth in demand exceeds construction.Reserve margins have been unusually high and stillare in some areas, so utilities find this trendeconomically beneficial. If a major disaster such asdiscussed in this report occurs, however, extrareserve margin would be extremely valuable inrestoring service to some customers. Utilities wouldhave additional options in finding ways to generateand transmit power. These options are disappearingas margins return to planned levels.

Policy Options To Further ReduceVulnerability

Measures to reduce vulnerability can be groupedaccording to whether they prevent damage to thesystem, limit the consequences of whatever damagedoes occur, or speed recovery. An obvious way toprevent damage is to improve physical security andearthquake resistance for key facilities. The mostproblematic sites can be fairly well-protectedagainst casual or unsophisticated attacks. The initialcost for walls around the transformers, crash-resistant fences, and surveillance systems would bea few percent of the replacement cost of the facility.Protection against a sophisticated attack would beextremely expensive, and probably not very effec-tive unless response forces are near.

However, even if key facilities are protected, thereis little that can be done to protect transmission linesagainst a saboteur with a high-power rifle. It is easyto destroy insulators on a transmission tower or theline itself, either of which will incapacitate the entireline. Such damage can be repaired quickly if

sufficient replacements are on hand, but the saboteurcan repeat it even more quickly in a different portionof the line or on other lines. Key transmission linescan thus be kept out of service (or at least keptunreliable) for long periods.

Protection of key facilities can also be enhancedby improved planning and coordination with the FBIto provide warning, and police or military forces toprovide rapid response. Utility employee trainingcan also be expanded to include greater awareness ofsuspicious activities and recognition of sabotage, sowarning can be given to other facilities. Thesesuggestions also have been made by NERC’sNational Electric Security Committee and have beenadopted by NERC’s Board of Trustees in October1988.

Measures to limit the consequences of damageinclude improved training of system operators torecognize and respond to major perturbations, im-proved control centers and other system modifica-tions, and increased spinning reserves. The intent ofthese steps is to isolate the damaged areas and keepas many customers as possible on-line. Rapid actioncan prevent the disruption from spreading as far asit otherwise might.

Measures to speed the recovery focus on thelarge transformers. The recovery period could begreatly reduced if more spares can be made availa-ble. One way would be to use those spares thatutilities normally consider necessary for their ownreliability but which are not actually in service at themoment. Legislation to relieve utilities of liabilityover potential blackouts in their own areas resultingfrom the absence of this equipment may be neces-sary. Alternatively, utilities could purchase sparesfor key equipment and store them in secure loca-tions, or a stockpile of at least the most commontransformers could be established.

A stockpile might entail initial costs of about $50to $100 million for the step-down transformers usedto lower voltage from the transmission system foruse on a distribution network. Step-up transformersat generating stations are less standardized thanstep-down transformers. They employ a greatervariety of voltages and different physical layouts forthe high current bus from the generator. There ismuch less likelihood of finding a suitable spare, anda stockpile would have to be sizable. A lessexpensive alternative would be to stockpile keymaterials (copper wire, core steel, and porcelain)


and, in an emergency, to use preexisting designsinstead of custom designing for the particularapplication. Under these conditions, manufacturingtime could be reduced from over 12 months to about6 months for four prototype units and two to threeper month thereafter. However, the product wouldlack the optimization and state-of-the-art improve-ments of a custom-designed unit. Suboptimal trans-formers, whether stockpiled or manufactured generi-cally, would be less efficient, resulting in signifi-cantly higher operating costs. Hence these expeditedtransformers might have to be replaced when betterones can be produced.

In addition to the measures intended to reduce thevulnerability of the existing system, the evolution ofthe electric power system can be guided towardinherently less vulnerable technologies and configu-rations. In particular, a system that emphasizesnumerous small generators close to loads is, overallless vulnerable to sabotage. However, the totalrelative costs of moving toward dispersed systemsare not clear, and substantial government incentivemight be necessary to expedite the trend towardsmaller units. Another step would be to improvestandardization of system components to makestockpiling, equipment sharing, and emergencymanufacturing easier. However, there are goodreasons for the diversity of components, and stan-dardization would result in some loss of efficiencyof the system. Greater use of underground cableswould also offer some advantages compared withoverhead lines, though if damage does occur,replacement of cables is much slower and morecostly.

These measures are listed in table 2. Somemeasures are already being addressed to somedegree by the industry and government. Poli-cymakers can accept this level of progress if presenttrends seem adequate for the level of threat. Alterna-tively, a more activist approach can be taken toenhance these steps and add others. Some of thesteps listed would be quite expensive, but otherswould have nominal costs. Considering the presentbudget constraints, funding new costly initiativeswill be justified only if the threat is seen as serious.Therefore table 2 notes whether the activity is beingaddressed under present trends, whether it can beimplemented at low cost, or whether it would berelatively expensive. Several items appear in twocategories, indicating differing levels of implemen-tation, or planning in one and implementation in

another. Utilities can be mandated to make theseinvestments without government financial assis-tance, but that will make implementation moredifficult unless they are assured of passing the costson to their customers.

The appropriate level of government interventionis a matter of value judgment and opinion. The levelof threat, both sabotage and natural disaster, cannotbe quantified, and the costs of a major outage arehighly dependent on the exact nature of the outage.If a worst case scenario is experienced, the costswould be much greater than all the measuresdiscussed here. If a very strong earthquake occursand suitable reinforcements avert major damage tothe power system, or if terrorism increases in thiscountry, then even very large investments will havebeen justified.

However, it is also impossible to quantify thedegree to which these measures would reducevulnerability. It is relatively easy to counter low-level threats, including almost all natural disasters,or prevent them from causing massive damage. It ismuch harder to counter any threat more serious thana small, unsophisticated terrorist group, though therecovery from the damage can be expedited. Further-more, even greatly increased resistance to sabotagemight just move the problem elsewhere. As notedabove, if saboteurs can’t destroy substations, theycan still cause blackouts by shooting power lines.Alternatively, they can turn to other parts of theinfrastructure, such as telecommunications or watersupplies. Thus, it is questionable how much protec-tion society would be buying.

It is possible to reduce vulnerability, but at a cost.Any of these measures can be justified if the threatis estimated to be sufficiently serious. Not takingany action is an implicit decision that no action isworthwhile. With the level of terrorism in thiscountry as low as it is, many people will be skepticalof the need for any action, especially major invest-ments such as increased reserve margins or stock-piles. However, terrorism could increase much fasterthan the measures to counter it could be imple-mented. If this seems plausible, then at leastplanning and other low-cost measures should bestarted earlier. If a rapid increase in terrorism seemsat all likely, then even expensive measures arereasonable insurance. There is no “correct’ answeras to which is the most appropriate approach.

Chapter l--lntroduction and Summary ● 7

Table 2—Options To Reduce Vulnerability

Moderate toPresent trends Low cost major investments

A. Preventing damageHarden key substations-protect critical equipment with walls, toughen

equipment to resist damage, etc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xSurveillance (remote monitoring) around key facilities (coupled with rapid-

response forces). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xMaintain guards at key substations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xImprove coordination with law enforcement agencies to provide threat

information and coordinate responses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . xB. Limiting consequencesImprove emergency planning and operator training. . . . . . . . . . . . . . . . . . . . x xModify the physical system; improve control centers, increased reserve

margin, etc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Increase spinning reserves. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xC. Speeding recoveryContingency planning for restoration of service. . . . . . . . . . . . . . . . . . . . . . . x xClarify legai/institutional framework for sharing reserve equipment. . . . . . . xStockpile critical equipment (transformers) or any specialized material. . . .Assure adequate transportation for heavy equipment. . . . . . . . . . . . . . . . . . x xMonitor domestic manufacturing capability. . . . . . . . . . . . . . . . . . . . . . . . . . . xD. General reduction of vulnerability xEmphasize less vulnerable technologies. . . . . . . . . . . . . . . . . . . . . . . . . . . .Encourage decentralized generating systems. . . . . . . . . . . . . . . . . . . . . . . . x xSOURCE: Office of Technology Assessment, 1990.

Chapter 2

Causes of Extended Outages

Virtually everyone in the United States has someexperience with power outages lasting at least a fewminutes. Blackouts that last for a day or more areheadline-making news, such as the 1989 stormdamage in Washington, D.C. that kept some peoplewithout power for several days. Hurricane Hugo,one of the most destructive storms to strike NorthAmerica this century, caused extensive damage toelectric utilities in its path and left many peoplewithout power for several weeks. Over the lastdecade, concerns have begun to be raised about thepossibility of extended blackouts due to intentionaldamage to electric power and other energy systems(e.g., sabotage). U.S. electric power systems havebeen targets of numerous isolated acts of sabotage.None has been serious enough to cause significantimpact, but there is increasing recognition that aconcerted effort by saboteurs could blackout majorregions of the country.

This chapter focuses on extended outages causedby natural disasters and sabotage and their resultingeffects on electric power systems. The impacts ofextended outages, including costs, are discussed inchapter 3.

NATURAL HAZARDSNatural hazards with the potential to cause

extended blackouts include earthquakes, hurricanes,tornadoes, and severe thunderstorms. Each affectsthe power system differently. In general, earth-quakes could damage all types of power systemequipment, and are the most likely to cause powerinterruptions lasting more than a few days. Hurri-canes primarily affect transmission and local distri-bution (T&D) systems, but the resultant floodingcould damage generating equipment. Tornadoes andsevere thunderstorms affect T&D lines directlythrough wind damage, and indirectly throughdowned trees, etc. Freak occurrences can causeparticularly high levels of damage. In October 1962,for example, the only hurricane in recorded historyto hit the west coast of the United States left parts ofOregon and Washington without power for up to 2weeks, primarily because of the time needed to cleardowned trees.

—

Earthquakes

An earthquake’s actual impact depends on thepopulation density and/or level of development inthe affected area, the type of soil or rock material, thestructural engineering, and advance warnings andpreparation. For both loss of life and propertydamage, the most damaging earthquake of thiscentury was Tangshan, China, in 1976 (Richter 7.8).Over 250,000 people died, and 20 square miles of thecity were flattened.l The 1988 Armenian earthquakeand the recent San Francisco Bay earthquake pro-vide painful reminders of a strong earthquake’scapacity to do damage and the importance of goodseismic design and construction and emergencypreparedness planning to mitigate the impacts (seebox A).

Earthquakes sometimes result in compound disas-ters, in which the major event triggers a secondaryevent, natural or from the failure of a manmadesystem. In urban areas, fires may originate in gaslines and spread to storage facilities for petroleumproducts, gases, and chemicals. These fires often area much more destructive agent than the tremorsthemselves because water mains and fire-fightingequipment are rendered useless. More than 80percent of the total damage in the 1906 SanFrancisco quake was due to fire.

Most of the United States has some risk of seismicdisturbance. The series of earthquakes that struckNew Madrid, Missouri were probably the mostsevere in North America. The tremors were felt as faraway as Boston. The first quake, which occurred inDecember 1811, may have been stronger than the1906 San Francisco earthquake; it was followed in1812 by hundreds of after-shocks.2 According to theAmerican Association of Engineers, it is very likelythat a destructive earthquake will occur in theEastern United States by the year 2010. The centralMississippi valley, the southern Appalachians, andan area centered around Indiana have the highest

IRob~ Muir Wood, Earthquakes and Volcanoes (New Yorkj NY: Weidenfeld c-% Nicolsom 1987).

~obert Rcdferq The Making cfa Continent (New York, NY: Times Books, 1983).

–9–


Box A—The Armenian and San Francisco Earthquakes’ Effects on Electric Power Systems

On December 7, 1988, Armenia was struck by a 6.9 magnitude earthquake-the most destructive to hit theregion in centuries. Hundreds of buildings, including hospitals, schools, apartments, and industrial facilities, weredestroyed. At least 30,000 people were killed and some 500,000 were either left homeless or jobless. Several largecities in the epicentral region sustained massive damage and high casualties. Leninakan, population 290,000, was80 percent destroyed and Kirovakan, population of 150,000 was also heavily damaged. The city closest to theepicenter, Spitak, was completely destroyed. 1

The high death toll was caused by the collapse of buildings, many of which were constructed of masonry andprecast concrete. Building materials-such as structural steel and wood, which are more flexible than concrete—arein short supply in Armenia. Steel-frame buildings and other steel structures, such as construction cranes, sustainedfar less damage than concrete structures. Also, the lack of emergency preparedness planning contributed to thecatastrophe. 2

In contrast, the October 17, 1989 San Francisco Bay Area earthquake did not result in the catastrophic loss oflife and property that was experienced in Armenia. The 7.1 magnitude earthquake was the strongest to hit the areasince 1907. The death toll is at least 66 people and approximately 3,000 injured. The quake caused an estimated$7 billion in damage in northern California.3 However, the growing California population, particularly in theearthquake-prone areas, could lead to a much greater loss of life and property in the future. Like Armenia, Californialies within a large seismically active area. Unlike Armenia, though, California has one of the most comprehensiveand up-to-date emergency preparedness plans in the United States and perhaps the world. For example, in June 1989,Pacific Gas & Electric (PG&E), the largest electricity supplier in the area, performed a company-wide earthquakeemergency exercise. This exercise proved invaluable in responding to the real thing 4 months later, according toPG&E.4 In addition, a great deal of attention is given to seismic considerations in structural design, engineering,and construction. These and other factors can mitigate the impacts of a major earthquake disaster.

Armenia 5-In Armenia, electricity was interrupted for 4 to 7 days in the epicentral area. Two substations wereseverely damaged or almost totally destroyed. A 220-kV facility in Leninakan sustained damage to capacitor racks,ceramics, and circuit breakers. The 110-kV facility near Nalband was almost totally destroyed. The under-reinforcedmasonry and precast concrete control house collapsed and struck nearby equipment as it fell. Transformers, circuitbreakers, and capacitor banks were severely damaged. Soviet authorities had to bring in a rail-mounted substationto restore power to the region.

The two-unit Armenian Nuclear Powerplant, located 75 kilometers south of the epicenter, continued to operateduring and after the earthquake. But, the plant was eventually closed because the units required substantialadditional seismic reinforcement to remain safe, and the price was considered prohibitive.

No damage to steel transmission towers throughout the region was reported. Wooden poles also survivedintact, except for a few cases where partially rotted poles snapped at their bases.

San Francisco—About 48 hours after the San Francisco earthquake, electricity had been restored to all but12,000 of the 1 million customers affected. About half were those in the Marina District of San Francisco, whichsustained heavy damage.6

The Moss Landing powerplant and high-voltage switchyards, located near the earthquake’s epicenter, wereheavily damaged. PG&E indicated that a 340-ton air preheater was knocked off its pedestal and the bottom droppedout of an 800,000-gallon raw water tank, creating a bog.7 Only one section of a 230-kV circuit near Moss Landingwas knocked down. However, substantial damage was reported to distribution lines, especially in the Santa Cruzarea. Damage to distribution lines in San Francisco was limited because most are located underground.8

l“Re~-wOrld tiSSOnS in Seismic Safety,” EPRI JournuZ, June 1989, p. 23.%id.3, ,Cwofia Governor Si@ Earthquake Relief Measures, ’ Washington Post, Nov. 7, 1989, p. A-14.4“pG&E Credits Mock Earthquake Drill in Responding Quickly to Real Thing,’ Electric Utility Week, Oct. 30, 1989, p. 3.5“Re~ World bssons in Seismic Safety, ” op. CiL, fOOhlOk 1.664pG&E credits Mock mu~e Drill in Responding Quickly to Real Thing,” Op. cit., footnote 4.7,,Cop@ Witi ~ma ~eti: How pG&E’S Gas and Power system F~d” The Energy Daily, vol. 17, No. 234, Dec. 12, 1989, p. 3.*“E~u~e Cuts off a Million PG&E Customers; Two-Thirds Back in Day,” Electric Utility Week, Oct. 23, 1989, p. 2.

Chapter 2-Causes of Extended Outages . 11

potential for earthquake damage.3 An earthquakesimilar to the New Madrid series would seriouslyaffect 12 million people in seven States.4

Impact on Electric Power Systems

More than any other natural hazard, major earth-quakes are capable of producing almost completesocial disruption in modern urban areas. Infrastruc-ture, both above and below ground, may be shat-tered, and quick repair of below-ground items isalmost impossible. Earthquakes can destroy alltypes of power system equipment, but the damagedrops off rapidly with distance from the epicenter.Most structural research has gone into multi-storybuildings, darns, nuclear powerplants, and storagetanks. 5

Except for structures located at points of earthslippage, foundations in reasonably firm soil willtend to move with the ground without damage orrelative displacement. Above grade, however, natu-ral modes of vibration of the structure may beexcited, amplifying the ground motion.6 Dependingon its age or size, a powerplant itself may survive amoderate-to-severe quake, but its stacks might not.

The only large generating plant damaged by the1989 San Francisco earthquake was the MossLanding facility, located about 20 miles south ofSanta Cruz, the earthquake’s epicenter. In addition,two 104-MW generating units at the Hunter’s Pointpowerplant in San Francisco were briefly shutdownmanually after the earthquake shed the load, butwere returned to service within 24 hours. The quakealso knocked out of service five small generatingplants, totaling 467 MW, near San Luis Obispo,some 230 miles south of San Francisco, but did notaffect the Diablo Canyon nuclear plant.7

The increase in transmission voltage over theyears has resulted in larger substation equipmentwhose size makes it more seismically vulnerable.The increased susceptibility to damage is caused bytwo principal factors: 1) a drop of the frequencies ofvibration into a lower and more severe region of thecharacteristic seismic frequency range, which pro-duces an amplification of the seismic forces in theequipment; and 2) the inherent structural deficien-cies—the brittle nature and low-energy dissipationproperties-of electrical insulating material such asporcelain. 8

In the 1971 San Fernando earthquake, failuresoccurred in many new extra-high-voltage (EHV)substations which had not previously been subjectedto a strong seismic event. Subsequent studies bymanufacturers and utilities resulted in modificationof some of the existing equipment and extensiverevision of the specifications for future substationequipment. The design criterion for seismic acceler-ation increased from 0.2 to 0.5 Gs in the mostseismically active areas. The 1972 standard in Japan,where earthquakes are frequent, was 0.3 GS.9 TheInstitute of Electrical and Electronic Engineers hasseismic qualification standards for power transform-ers, lightning arresters, circuit breakers, relays, etc. 10

During the 1989 San Francisco earthquake,PG&E experienced significant internal damage to a500-kV substation located near the Moss Landingpowerplant. Damage to circuit breakers and trans-formers at the substation isolated two 112-MW unitsthat were operating at the Moss Landing facility atthe time of the earthquake.ll

Performance of transmission lines, towers, andpoles under earthquake conditions generally hasbeen excellent. Steel towers move with the groundand the acceleration stresses are well within the

sc~~rdfiting Committ= on Ener~ of ~c fiblic Affairs Council, ~~~n Association of En@~ring Societies, Vu/nerabi/ity of EnergyDistribution Systems to an Earthquake in the Eastern United States--An Overview, December 1986.

W.S. Gmlogicd Survey, National Center for Earthquake Engheering Resem~.5Gflbert F. white and J. Eugene Haas, Assessment of Research on NaturaZ Hazards (Cambridge, MA: me MT Ras, 1975).6L.W. Long, “Analysis of Seismic Effects on Transmission Structures, ” paper presented at the IEEE PES Summer Meeting and EHV/UHV

Conference, Vancouver, BC, Canada, July 1973.7$~pG&E Credits Mock E~u&e Dfll in ReSpOn~g Quickly to Real Thing,” Electric Utility Week, oCt. 30, 1989, p. 3; “~w~e cuts ~

a Million PG&E Customers; Two-Thirds Back in Day,’ Electric Utility Week, Oct. 23, 1989, p. 2.8K.M. s~einer and L-D. Test, “A Review of Seismic Q~i@ion s~ndads for EIwtricd ~U@IM311t,” The Journal of Environmental Sciences,

May/June 1975.%bid.1%EE 323.1974, standards for safety-related ~Uipment.llccpG&E cr~its Mock E@@e Dfll in Responding Quic~y to Red Thing,” op. Cit., fOOtnOte 7.


margins required for wind resistance. Wood polesare inherently more flexible than steel towers, andthe flexibility reduces the seismic stress substan-tially. 12 However, earthquakes can cause transmis-sion outages when tower foundations are subject toearth slippage. Detailed soil analysis, adequatefooting design, and periodic inspection of existingfoundations are essential. In the 1971 San Fernandoearthquake, tower foundations failed that over theyears had their strength reduced by erosion oradjacent excavation for roads or buildings.13 Theonly major transmission line damage reported dur-ing the 1989 San Francisco earthquake was a sectionof 230-kV circuit between the Moss Landing power-plant and Watsonville. However, substantial distri-bution line damage was reported in areas close to theearthquake’s epicenter.14

Hurricanes

The losses caused by a landfall hurricane are afunction of the storm’s strength and path and thearea’s population and economic development. Hur-ricanes are accompanied by torrential rains, typi-cally 3 to 6 inches but more if the forward progressis slow. Winds can exceed the design of a totalstructure or its components and cladding, or causehazards from windborne debris. The winds alsoproduce disastrous sea surges and waves. A largeproportion of the damage to coastal areas is causedby the storm surge, an influx of high water accompa-nying the hurricane. Other hazards include floodingof streams induced by the heavy rainfall andaccelerated coastal erosion. Occasionally tornadoesaccompany a hurricane.l5

In the United States, most hurricane damageoccurs in a narrow zone along the coastlines of theAtlantic Ocean and Gulf of Mexico. The trend istoward fewer deaths due to improved storm warningand management. However, property loss is increas-ing because of greater coastal development.l6

Effects on Electric Power Systems

Hurricanes primarily affect T&D lines. Highwinds can damage or uproot T&D poles. Poles canalso fall when soils become water saturated byaccompanying torrential rains, as was the case in1982 when Hurricane Iwa struck the HawaiianIslands and in 1989 when Hurricane Hugo hit theCarolinas. Hurricane Hugo knocked out power tomore than 1 million customers in the Carolinas.Many people were left without power for severalweeks. High winds and flying debris downedtransmission towers and several hundred miles oftransmission lines, and falling trees knocked outthousands of distribution lines. Four utilities hardesthit by the September 22, 1989 storm have indicatedthat the cost of restoring service and cleanup mayexceed $170 million. Insurers are expected to pay forabout 10 percent of the cost.17 See box B for adiscussion of Hurricane Hugo’s effect on the largestsupplier of electricity in South Carolina.

Tornadoes and Thunderstorms

In the United States, tornadoes are most prevalentin a region known as “Tornado Alley’ that extendsfrom the western Texas Panhandle across Okla-homa, Kansas, southern Nebraska, and Iowa, buthave been known to occur in all States.18

Tornadoes kill hundreds of people and destroyproperty valued at billions of dollars every year. Thecombination of high winds and the sudden drop inair pressure causes heavy destruction of everythingin a tornado’s path. 19 Heavy rain and large hailstonesoften fall north of the tornado’s path. Tornadofamilies occur when up to six tornadoes are spawnedfrom the same thunderstorm.20

Severe thunderstorms can produce damaginglightning and high winds with the potential to causeextended blackouts. For example, the 1977 NewYork blackout began with a series of severe light-ning strokes. Also, in 1989, a severe thunderstorm

12~W, op. cit., footnote a“

lq~befi W. Atwood, Jr., ~d Kenne~ L. -g, comments on hng, Op. cit., fOOtIIOte 6.

14 C$pG&E cr~i~ M~k Ear@uake Drill in Responding Quickly to Real Thing,” op. cit., footnote 7, p. 3.ls~te ad HZXM, op. cit., footnote 5.16~ide

17c6D-ge E~tim~tes From Hurric,~e Hugo pegged at up to $170 Fvfillio~” ,Wecfric utility Week, NOV. 13, 1989, p. 5.18~~~mdo,” ~cGra~.HillEnqClopedia of science a& Technology, VO1. 18, 1987.

lg<’~~do,” Encyclopedia Americanu, vol. 26, 1986.

“’llxnado,” McGraw-Hill Encyclopedia of Science and Technology, vol. 18, 1987.

Chapter 2-Causes of Extended Outages ● 13

Box B—Hurricane Hugo’s Effect on South Carolina Electric & Gas CO.1

Hurricane Hugo was one of the most powerful hurricanes to strike North America in this century and the mostpowerful to strike the Carolinas. Property damages in North and South Carolina alone are estimated to be about $6.5billion.2 The hurricane caused extensive damage to electric utilities in its path. Hardest hit was South CarolinaElectric & Gas Co. (SCE&G), the largest supplier of electricity in South Carolina. Of SCE&G’S 430,000 customers,70 percent were blacked out during the storm. After 5 days, about 140,000, or 33 percent, were still without power.Full service was restored in less than 3 weeks.3

In Charleston and Summerville, transmission and distribution circuits were especially hard hit by high winds,flying debris, and falling trees. The distribution system in these two areas was almost completely leveled. Whilethere was damage to the transmission system, the delay in repair was primarily due to the extent of the damage tothe distribution system. No significant damage was reported to generating units or transmission substationequipment. However, a cooling tower at one 600-MW unit was destroyed. Temporary repairs were made and theunit was back in service in less than a week. Only one power transformer, a 115/230-kV unit, which served adistribution station, was damaged in the storm.

There was a lot of damage from trees that were broken and blown into the distribution and transmissionsystems. Before repairs could be made, roads, lines, and access had to be cleared. Since it had been over 30 yearssince a major hurricane had struck the area, there was an unusually large amount of debris from wooded areas. Thedebris, while often not damaging the system, still required crews to physically remove branches, etc. from thetransmission towers, distribution poles, and conductors.

Throughout the SCE&G system, two-thirds of the transmission circuits were out of service immediatelyfollowing the storm. About 300 towers, out of a total 24,000, were either toppled or broken. Contributing factorsin the damage to the transmission system were the number of wooden pole transmission towers in the 230-kV and115-kV systems and the amount of rain that preceded the storm. Soil conditions were especially poor in wet andlow-lying areas. Transmission towers in those areas fell because the footing had become too soft and weak fromthe rain. SCE&G and other coastal utilities are reevaluating the foundation requirements of towers near marshes,swamps, and river crossings.

As many as 3,600 workers labored to restore electric service at SCE&G, with 75 percent of them working onthe transmission and distribution systems. Over 90 percent of the workers were from neighboring utilities andprivate contractors. Line crews came from Alabama, Arkansas, Florida, Georgia, Mississippi, Louisiana, Maryland,Tennessee, Virginia, and Illinois. Many of the crews brought their own vehicles and specialized equipment. Thiswas done as part of mutual assistance agreements among utilities.

1 c~azza, Schultz& Associates, kc., “Vulnerability of Electric Power Systems to Sabotage and Natural Disasters,” contractor reportprepared for the Office of Technology Assessment, Nov. 24, 1989.

z Edward V. Badolato et al., Clemson University, The Strom Thurmond Institute of Government and Public Affairs, “HticmeHugo-Jxxsons Learned in Energy Emergency Preparedness, ” 1990, p. 1.

3 ~lem were sti~ customers ~thout s~ice, but fie problem w= ~th tie customers, not the u~ity. A&uIy homes and businesses weretoo severely damaged to have service restored.

—

blacked out portions of the Washington, DC area for rains, and lightning can wreak havoc on distributionseveral days, primarily because of the number ofdowned trees.


In general, property damage from tornadoes hasdeclined sharply due to improved prediction andincreased public awareness. Tornadoes are morelikely to cause damage to transmission and distribu-tion lines over a small geographic area than wipe outa substation or generating plant.

Thunderstorms are more widespread and conse-quently more disruptive. High winds, torrential

lines.

Geomagnetic Storms

Large fluctuations in the Earth’s magnetic fieldcaused by solar disturbances are called geomagneticstorms. The Sun continuously emits a stream ofprotons and electrons called the solar wind. Solardisturbances such as sunspots and solar flares creategusts in the solar wind, with a more intense streamof charged particles emitted. When the solar windhits the Earth’s magnetic field it produces electriccurrents in the atmosphere, altering the magnetic


field (as well as causing the aurora borealis). Bothsolar activity and geomagnetic storms ebb and flowin an 1 l-year cycle, although large storms may occurat any time. The peak of the current geomagneticstorm cycle, which is expected to be the most violentyet recorded, is anticipated to arrive in approxi-mately 1991.21


Fluctuations in the Earth’s magnetic field createelectric potentials (differences in voltages) on theEarth’s surface. The resulting electric potentialdifferences of 5 to 10 volts per mile fluctuate veryslowly and are typically aligned from east to west.Geomagnetically induced currents (GICs) flowwherever a power line connects areas of differentelectric potential. The magnitude of GIC depends onseveral factors including a power line’s location,length, and resistivity relative to the resistivity of theground. Areas with long east-west transmission linesand highly resistive geology typical of igneous rockformations are most likely to experience large GICs.

GIC produced in a power system may eitherdamage equipment or merely take it out of serviceduring the course of the geomagnetic storm. Bothmay lead to system outages. When struck by GICs,EHV transformers may overheat, resulting in perman-ent damage or reduced life. Voltages in transform-ers may drop significantly, leading to unacceptableloadings on generators and transmission lines result-ing in their being taken out of service by protectiverelays. Harmonic distortions created in the trans-formers may cause misoperation of relays, too.Relays may operate when they shouldn’t, resultingin equipment being taken out of service unnecessar-ily; they may also fail to operate when needed,resulting in damage to the attached equipment.

A very strong geomagnetic storm on March 13,1989 damaged voltage control equipment in Que-bec, resulting in the collapse of nearly the entiresystem for a 9-hour blackout. The same stormtripped protective relays in several areas of theUnited States and damaged several large transforme-rs. One of these transformers, a step-up unit at theSalem Nuclear Plant in New Jersey, had to be

removed from service, forcing the plant to shutdownfor 6 weeks.

SABOTAGENo long-term blackouts have been caused in the

United States by sabotage. However, this observa-tion is less reassuring than it sounds. Electric powersystem components have been targets of numerousisolated acts of sabotage in this country. Severalincidents have resulted in multimillion-dollar repairbills. In several other countries, sabotage has led toextensive blackouts and considerable economicdamage in addition to the cost of repair.

Some terrorist groups hostile to the United Statesclearly have the capability of causing massivedamage-the loss of so many generating or trans-mission facilities that major metropolitan areas oreven multi-state regions suffer severe, long-term,power shortages. The absence of such attacks has asmuch to do with how terrorists view their opportuni-ties as with their ability. U.S. electric power systemsare only one target out of many ways of striking atAmerica, and not necessarily the most attractive.

This section briefly reviews the range of acts ofsabotage against electric power systems and thecapabilities of different types of saboteurs. How-ever, an analysis of the motivations and intentions ofterrorists is beyond the scope of this study. Severalreferenced studies have considered this subject. Thereader is also referred to a forthcoming OTA study“The Use of Technology To Counter Terrorism.’

Experience With Sabotage

United States

Over the past decade there were few notable actsof sabotage, and apparently none that were intendedto cause harm other than to the local utility. The mostcommon cause has been labor disputes. In July 1989,a tower on a 765-kV line owned by the KentuckyPower Co. was bombed, temporarily disabling theline. No arrests have been made. In 1987-88, powerline poles and substations were bombed or shot inthe Wyoming-Montana border area. Later in 1988,similar attacks were experienced in West Virginia.Such attacks had also occurred in 1985 in West

zl~sdisassion is ~~from: “A Storm From the S~” EPRIJournul, July/August 1989, pp. 14-21; V.D. Albertson, “GeomagneticDisturbanceCauses and Power System Effects,” ZEEE Power Engineering Review, July 1989, pp. 16-17; J.G. KappenmarL “Power System Susceptibility toGeomagnetic Disturbances: I%esent and Future Concerns,”IEEE PowerEngineering Review, July 1989, pp. 15-16; and D. Soulier, “The Hydro-QuebecSystem Blackout of March 31, 1989,” ZEEEPower Engineering Review, July 1989, pp. 17-18.


Virginia and Kentucky. All these attacks occurredduring coal mine strikes.

22 Two Florida substationswere heavily damaged by simultaneous dynamiteexplosions in 1981 in one of the most expensiveincidents. Damages totaled about $3 million, but nosignificant customer outages resulted. No arrestshave been made, but circumstantial evidence pointsto a contractor labor dispute.23

Incidents stemming from unknown motives in-clude the cutting of guy wires and subsequenttoppling of a tower on the 1,800-MW, 1,000-kV DCintertie in California in 1987. There was negligibleimpact on the power system, because the load on theline was light at the time and it was scheduled formaintenance the next day, so alternate power routeshad already been arranged. Damage was repaired inabout 4 days.24 No suspects have been announced.Wooden poles were also cut in Colorado in 1980,bringing down a 115-kV line. The damage wasrepeated later in the year. Total costs were about$200,000 each time.

Another incident demonstrates that saboteurs canmount a coordinated operation. In 1986, three500-kV lines from the Palo Verde Nuclear Generat-ing Station were grounded simultaneously over a30-mile stretch. It happened at a time when none ofthe nuclear reactors was operating, so no disruptionoccurred. Under different conditions, the reactorswould have shut down. No arrests have been made.25

In 1989, several environmental extremists werearrested in the act of cutting a tower on a line inArizona. The group, which reportedly had beeninspired by Edward Abbey’s The MonkeywrenchGang, had been infiltrated by the FBI. Two membersof this group have prepared a manual detailing howto attack equipment and facilities, including powerlines, deemed harmful to the environment.26

Since 1980, only Puerto Rico has experiencedextensive attacks that might be characterized asterrorist, as opposed to labor disputes or vandalism.In 1980-82, many bombings occurred at substationsand transmission towers. Some of these incidents

have been attributed to Macheteros, a separatistgroup. Several of the resultant outages lasted forseveral days.

The FBI and other agencies do not maintainstatistics on energy facility sabotage separately fromthose of other targets. The best available database isthat developed from public sources by a privateconsultant to the Department of Energy, whichrecords a total of 386 attacks on U.S. energy assetsfrom 1980 through 1989, an average of 39 per year.27

Electric power systems, mostly transmission linesand towers, were the target in a large fraction of these386. This database may understate the problembecause some utilities may not publicize attacks outof concern that more may be inspired.

Other Countries

Terrorist sabotage has been much more extensiveand violent in Europe and Latin America than in theUnited States. Attacks have been made by separa-tists, radical revolutionaries, and anti-technologyand anti-nuclear groups. A few examples willillustrate this:

France has experienced assassinations of energyofficials as well as bombings, arson, rocket attackson energy facilities, and grounding of transmissionlines. The saboteurs included anarchic, separatist,and political terrorists, and anti-nuclear extremists.

West Germany also is familiar with bombings andassassinations from the Baader-Meinhof group, RedArmy Faction, and other groups. In addition, therehas been an intensive campaign to destroy transmis-sion lines by cutting or bombing towers. In 1986alone, about 150 acts of such sabotage were committ-ed. Much of the violence has been by politicallymotivated or anti-nuclear extremists. Transmissionlines from nuclear reactors have been a major focus,and the nuclear industry itself has been a target.

Attacks on electric power systems have been mostsevere in El Salvador. The Farabundo Marti Na-tional Liberation Front (FMLN) has repeatedlybombed or fired on transmission towers, substations,

22Ro~-tK. M~m, com~~t t. the U.S. Dep~ent of Energy, testfiony athe~gs before the Senate committee on Governmental A.fftthS, Feb.7-8, 1989, pp. 246-247.

~Kenne~ c~dwell, -ger of Covmte sec~~ Services, Flori& Power& Light CO., perSOXMI comrnunicatiou Feb. 7, 1990.

~Elec~ic Utility Week, Aug. 10, 1987.~M~len, op. cit., footnote 22.26Dave Foreman and BN Haywood (~s.), E~O&$ense: A Field Guide to Afonkqwrenching, 2nd d. (’lbcson, AZ: Ned Ludd BOOkS, 1987).

Z7Ro~fi K. M~eq personal communication Feb. 7, 1990.


and hydroelectric powerplants. Up to 90 percent ofthe entire Nation has been blacked out by the FMLNduring some sabotage campaigns. The FMLN haseven produced a manual detailing how to attack anelectric power system. According to official sources,the FMLN has launched over 2,000 attacks onelectric systems since 1980. The Sendero Luminosa(Shining Path) revolutionary group has adopted asimilar strategy in Peru, frequently leaving Lima, aswell as a 600-mile stretch of the country, blacked outor under power rationing for 40 to 50 days.28

Countries where insurgents or hostile forces havetargeted electric power systems have found itworthwhile to take protective measures. Passivetechniques, such as concrete sheaths around trans-mission tower legs, make them more difficult totopple. Some countries, including South Korea,maintain army conscripts at key facilities. Becauseof the expense of adequately protecting distributedsystems, others simply repair the damage, and maydesign their systems to be easily repairable.

The Threat

Intentional damage to an electric power systemcan be caused by a wide variety of actors. Mostcommon are ordinary vandals, typically hunters whoshoot at transmission lines or the insulators attach-ing them to towers. Utilities are experienced withhandling vandalism, which is very unlikely to causemassive damage. Hence this report is not concernedwith vandalism except to the extent that remedialmeasures for more serious attacks might have anincidental value in reducing it.

The Single Saboteur

Most of the U.S. incidents noted above could havebeen caused by one person. The fact that most havebeen relatively minor suggests that either the sabo-teurs did not know how to cause greater damage orthey did not want to. In sabotage initiated over labordisputes, the perpetrators usually are trying to hurtthe utility or their suppliers, not to cause widespreadblackouts. The dispute would have to get extraordi-narily bitter before anyone would risk antagonizinga large part of the public. A personal grievance mightbe a more probable motivation for an individual totry to cause widespread damage. A utility employeewho felt misused might want to use his expertise toretaliate in a spectacular fashion. Alternatively, any

of the motivations of a group, discussed below,might apply to an individual who decides to takematters into his own hands.

The primary difficulty faced by a single saboteurintent on causing a devastating blackout would be toassemble all the necessary information and supplies.He would have to get the idea in the first place;research how electric power systems work and whatthe vulnerable points are; determine the layout of histarget system; physically locate the actual targets;plan the attack in considerable detail; procureexplosives; rehearse; and carry out the actual attack.If any of these steps were deficient, the attack wouldlose effectiveness.

It is unlikely, though not impossible, that anindependent individual will combine the motivation,expertise, contacts to procure explosives, tenacity,and nerve to disable as many as eight facilitiessimultaneously. This would require visiting all thesites over several days and would entail a significantrisk of detection. A more probable scenario for theindependent saboteur is a one-night series of assaultson as many facilities as he can reach. Such an attackcan still cause major problems for a utility, but farfewer than would more widespread damage. Theo-retically, the saboteur could continue his attacks, butonce utilities are alerted they can post guards to deteran immediate reoccurrence of the rampage.

Terrorist Groups

Organizations initiating terrorist attacks in othercountries include separatists, political radicals, andanti-technology and/or anti-nuclear extremists. Theonly significant separatist movement in the UnitedStates in the past 125 years has been in Puerto Rico,and none seems likely to develop. Nor do theanti-technology or anti-nuclear movements seemlikely to turn to large-scale, violent extremes, in partbecause people have peaceful ways to try to imple-ment their views.

This country has had more experience withpolitically oriented extremism, particularly in thesixties and seventies. The Weathermen and othergroups did bomb some transmission towers andmight well have wanted to cause more damage.Much of this violence was in reaction to the war inVietnam It should be noted that current trends, ifanything, indicate a lessening of terrorist attacks.


However, under some conditions, this threat mightreemerge, possibly by environmental extremists.Electric power systems probably are not the mostobvious targets but could become fashionable ifterrorists choose to inflict great inconvenience andeconomic cost on society instead of more dramaticacts such as assassinations or destruction of sym-bolic targets. The Evan Mecham Eco-TerroristInternational Conspiracy (EMETIC) targeted elec-tric system facilities in 1987 -89.29 Even extortion ona gigantic scale might be considered to raise fundsand shake confidence in existing institutions.

Foreign groups could also import violence. Amer-ican property and individuals abroad have been thetargets of attack in many countries. It is not clearwhy some of the groups hostile to the United Stateshave not carried their struggles here, and therefore itcannot be guaranteed that they won’t. Groups involatile areas such as the Middle East and CentralAmerica might want to hurt the United Statesdirectly. Separatists might want to pressure thiscountry to influence events in their country, even ifthey have no direct conflict with us. Drug cartels inColombia could hope to make our drug wars toocostly. Environmental extremists concerned overpotential global climate change might see the U.S.electric power system as symbolic of the refusal tocurb production of carbon dioxide. The logic doesnot have to be sound for an attack to be damaging.

A group is much more likely than an individual tobe able to mount a major assault on sufficientfacilities to cripple a power system. A groupcombines all its members’ skills and contacts andcan share tasks. In particular, international contactsamong terrorist groups multiply the expertise andresources available to any group. The knowledgegained by destroying substations and power lines inGermany and El Salvador is available in the UnitedStates. In fact several “how-to” sabotage manualsare available for sale here. Weapons and explosivesare also widely available here and abroad. If foreignterrorist groups wish to attack the United States, theycan probably find assistance herein obtaining target

information and in camouflaging their activities.30

However, a group is also much more likely to bedetected than an individual.

Military Attacks

Commandos with special training and essentiallyunlimited resources and support could mount a farstronger attack than could even the most sophisti-cated subnational terrorist group that has yetemerged. The Soviet Union is reported to have suchforces, called spetsnaz, available for operations inthe United States.31 The object would be to createhavoc and demoralization before overt hostilitiescommence. While this risk is diminishing, it has notdisappeared. Alternatively, a hostile country mighttake this approach if it were unable or unwilling todeclare war but wanted to take some military actionagainst the United States.

The ultimate attack would be an overt militaryoperation. The vulnerability of electric power sys-tems can have serious national security implications.For example, in World War II, Germany’s highlycentralized electric system was not attacked untillate in the war. German officials, surprised at thisomission, commented after the war that ‘‘The warwould have finished two years sooner if you (theAllies) had concentrated on the bombing of ourpowerplants earlier. . . “ When the Allies finallydid destroy Germany’s electric generating andsynthetic fuel facilities, the German economy wascrippled. 32 This experience will not be ignored inany future hostilities.

For defenses to be effective against militaryassault, either commando or overt, they would haveto be extraordinarily strong and expensive, wellbeyond anything that might be justified againstsubnational terrorists. Since even a limited terroristattack could have extremely serious consequences,this report focuses on responses to that threat.Actions necessary only to counter military threatsare beyond the scope of this report, but it notespotential benefits of a few of the counterterrorismsteps.

~~obert K. Mweq personal communication Apr. 2, 1990.~onah Alexander, “International Network of Terrorism,” Political Terrorism and Energy, Yonah Alexander and Charles K. Ebinger (eds.) (New

York, NY: Fraeger Publishers, 1982).31victor Suvorov, spETsN~, The Inside story of the Sotiet Special ForCes (New yor& NY” W.w. Norton & CO., 198’7) md M pm~ reprinkd

in the Hearings Record of the Semte Committee on Governmental Affairs, “Vulnerability of Telecommunications and Energy Resources to Terrori~”Feb. 7 and 8, 1989.

szFede~ Emergency Management Agency, ‘‘Dispersed, Decentralized and Renewable Energy Sources: Alternatives to National Vulnerability andWar,” December 1980.

Chapter 3

Impacts of Blackouts

The United States has had little experience withblackouts that last more than a few days. The onlymajor blackouts over the past 25 years have been the1965 Northeast blackout, the 1977 New York Cityblackout, the August 1988 downtown Seattle black-out, and the 1989 blackout in the Carolinas. Most ofwhat we know is anecdotal evidence, drawn primar-ily from the well-documented 1965 Northeast and1977 New York City blackouts. The lessons learnedfrom the recent Hurricane Hugo experience shouldprovide additional information on the impacts ofblackouts. This is particularly important in light ofthe technological changes that have occurred in thelast decade-especially the proliferation of comput-ers and automation in all sectors and the advances intelecommunications which require a reliable supplyof power.

This chapter provides an overview of costs andreviews the quantitative estimates for both actualand hypothetical outages. The remainder of thechapter discusses the impacts of blackouts on theindustrial, commercial, and residential sectors andon essential services and infrastructure.

OVERVIEW OF COSTS OFBLACKOUTS

Blackouts have impacts that are both direct (theinterruption of an activity, function, or service thatrequires electricity) and indirect (due to the inter-rupted activities or services). Examples of directimpacts include food spoilage, damage to electronicdata, and the inoperability of life-support systems inhospitals and homes. Indirect impacts include prop-erty losses resulting from arson and looting, over-time payments to police and fire personnel, andpotential increases in insurance rates. Direct andindirect impacts can be characterized by whetherthey are quantifiable in monetary terms (economicimpacts); relate to the interruption of leisure oroccupational activities (social impacts); or result inorganizational, procedural, and other changes inresponse to blackout conditions (organizationalimpacts).l

Direct impacts can be avoided if the end-user hasbackup systems, but these have often proved unrelia-ble. Indirect impacts may be partially mitigatedthrough contingency planning, improved communi-cations, customer education, social programs, andother planning approaches.2

Estimating the costs of electric power outages isdifficult and imprecise because the economic valueof electric reliability to different customers is notwell-understood. Only recently has much progressbeen made in developing economic values forreliability, including the development of analyticaltechniques for measuring or estimating the directand indirect costs of actual and hypothetical outages.

To estimate costs, utilities and public utilitycommissions (PUCs) rely on either hypothetical costanalysis or reconstruct the level of economic activitythat might have occurred had there been no blackout.Both of these methods have inherent uncertainties,and theoretical models have their own shortcomings.Also, indirect and social costs often cannot bequantified but only enumerated.3

Types of Costs

The kinds of costs considered in value of reliabil-ity estimations include both short-term outage andlong-term coping or adaptive response costs.

The true economic cost of any outage is theopportunity value of profit, earnings, leisure, etc.that would have been produced but for the loss.Therefore, one must ascertain what the lost opportu-nities were and how they would have been valued bythose who suffered the loss. The short-term outagecosts are incurred during and shortly afterward, andinclude product spoilage, lost sales, foregone lei-sure, and other opportunity costs. Long-term copingcosts are incurred when customers invest in equip-ment to mitigate the effects of a shortfall. Investmentin backup generators, for example, is clearly made tomitigate the impact of future outages. Historically,mitigation costs have been relatively insignificant in

Iwillim T. ~e~, Jae CO~ ~d Peter D. B~, ‘CCo~t of power ou~ges—~e 197’7 New York City Blackou~” paper presented at the ~~Industrial and Commercial Power System Technical Conference, Seattle, WA, May 14-17, 1979, pp. 65-66.

?Ibid.

31bid., p. 66.

–19–


Table 3—Direct and Indirect Costs

Direct cost components(costs to household,

Primary electricity user firm, institution, etc.) Indirect rests Remarks

Residential . . . . . . . . .

Industrial, commercial,agricultural firms. . .

. . . . . . . . a. Inconvenience, lost leisure,stress

b. Out-of-pocket costs—spoilage-property damage

c. Health and safetyand. . . . . . . . a. Opportunity costs of idle

resources—labor—land-capital—profits

b. Shutdown and restart costsc. Spoilage and damaged. Health and safety effects

Infrastructure and publicservice . . . . . . . . . . . . . . . . . . a. Opportunity cost of idle

resourcesb. Spoilage and damage

a. Costs on other householdsand firms

b. Cancellation of activitiesc. Looting/vandalism

a. Cost on other firms that aresupplied by impacted firms(multiplier effect)

b. Costs on consumers ifimpacted firm supplies a finalgood

c. Health and safety-relatedexternalities

a. Costs to public users ofimpacted services andinstitutions

b. Health and safety effectsc. Potential for social costs

stemming from Looting andvandalism

Indirect costs are a minimal, if notnegligible, fraction of total(direct and indirect) costs of acurtailment.

Indirect effects are likely to beminimal for most capacity-related interruptions, but can besignificant component of totalcosts for longer duration energyshortfalls.

Indirect costs constitute a majorportion of total costs ofcurtailment.

SOURCE: M. Munasinghe and A. Sanghvi, “Reliability of Electricity supply, Outage Costs and Value of Service: An Overview,” 7%e Energy Journal, vol. 9,19s8, p. 5.

most parts of the United States due to the highstandard of reliability.4

Short- and long-term costs may have both directand indirect elements (see table 3). Direct costs arethose suffered by the direct customer, such asspoilage or lost production. Indirect costs includethose realized by customers of an impacted firm;they may have to purchase higher cost substitutes,incur additional production costs, or have unrecov-ered costs. Indirect costs can be several times aslarge as direct costs because the loss of a single inputmay retard an entire production process. Othercomponents of indirect costs include the multipliereffect from lost wages and other factors of produc-tion 5 and potential social costs stemming fromlooting and vandalism. Social costs are difficult toquantify and have been generally neglected inestimations. For example, while losses resultingfrom looting and arson can be identified andassigned dollar values, the secondary or ripple

effects often cannot be enumerated. These secondaryeffects, such as a potential increase in insurancerates, represent long-term and far-reaching eco-nomic implications.6

Hypothetical Outage Cost Estimates

Numerous analyses have estimated the costs ofunserved electricity for various consumer sectors.Most of these are based on survey data fromparticular utility service areas. They vary substan-tially among classes of customers and amongcustomers within each class.

Table 4 shows some estimates of the costs ofpower outages. The more recent estimates, based onsurvey data, reflect the value of service reliability interms of the average dollar change in a consumer’smonthly bill that would offset a change in servicereliability. These estimates cannot be compareddirectly because of differing methodologies, as-

‘$Fr~ J. Alessio, Peter Lewinj and Steve G. PWSOIIS, “The Layman’s Guide to the Value of Service Reliability to Consurners,” in Criterion, Inc.,The Value of Service ReZiabiZity to Consumers (Palo Alto, CA: Electric Power Research Institute, EPIU-EA-4494, May 1986).

%id.

6Arun P. San@vi,” Economic Costa of Electricity Supply Interruptions: U.S. and Foreign Experience, “in Criterion, ~c., op. cit., footnote4, p. 8-45.

Chapter- 3-Impacts of Blackouts ● 21

sumptions, economic and demographic mixes, andother conditions.

In general, the consensus among utility analysts isthat system outage costs can be valued at somethingbetween $1 and $5 per kilowatt-hour (kWh) for thetypes of outages commonly experienced. However,they vary considerably by type of customer, thecondition of the outage, the length of the outage,etc.7

Actual Outage Cost Estimates

The costs of the 1977 New York City blackouthave been studied more extensively than otheroutages. (Box C provides a description of thesequence of events that led to the blackout.)

Table 5 summarizes the estimated costs of theblackout. Based on these figures, the direct cost ofunserved energy was $0.66/kWh and the indirectcost was $3.45/kWh. For the most part, the costs intable 5 are based on secondary data sources providedby numerous public and private organizations.Significant impacts include losses in securities andbanking, restoration costs, and capital equipment forCon Ed,8 and losses to the small business commu-nity. Levels of inconvenience appear to have beensubstantial. These figures should be considered aslower bounds for the total costs.9

Damages from looting and arson totaled around$155 million, or about 50 percent of the totaleconomic costs associated with the blackout. Thesocial impacts were sensitive to the unique circum-stances of the event and the socioeconomic condi-tions, including weather, time-of-day, duration,local income distribution and employment, politicalclimate, and availability of contingency plans.10

Economic impacts of the 4-day 1988 Seattleblackout were very sensitive to its timing andduration. For restaurants and stores, the timing of theblackout was particularly bad, covering a regulardowntown event—the First Thursday GalleryWalk-and the beginning of the Labor Day week-end. Department and clothing stores also missed outon last-minute school shopping. The Bon Marché `department store estimated its unrecoverable losses

Table 4—Comparison of Cost Estimates forPower Outagesl

Date Geographic scope Estimated cost

1971 . . . . .1971 . . . . .1971 . . . . .1973 . . . . .1976 . . . . .1976 . . . . .

1977 . . . . .

1978 . . . . .1983 2 . . . .

1983 3 . . . .

1986 4 . . . .

1986 5 . . . .

New York State $2.17 million/hra

New York City $2.5 million/hra

United States $0.60/kWh b

New York State $0.33/kWh c

United States $1IkwhdUnited States $2.68/kWh (industrial) $7.21/

kwh (commercial)Canada $15/kW (15-minute outage)

$91/kW (1 -hour outage)New York City $4.1 IlkwhPG&E service area $14.87 to reduce outages to a

minimume

-$26.41 to tolerate 1,400hours additional outages

PG&E service area $6.72/kWh (one 1-hr outage,summer afternoon)f

$2,126/kWh (eight 48-hroutages, summerafternoon)

PG&E service area $1.35/outage/year(momentary)g

$39/outage/year (12 hrs,winter morning)

PG&E service area $2.93/kWh (4hrs, winter morn-ing, 3.15 kWh unserved)h

$14.61/kWh (1 hr, winter even-ing. 0.75 kwh unserved)

aBased on wages paid.based on GNP/kWh ratio.CBaSad on GRpAWh ratio.dBas~ on cost-benefit analysis.presidential, based on market research data.fcommer~~, basect on survey data. Reflects total direct cost range Of$3951 5to$1,112,092.

gResiderrtial, based on customer survey data.presidential, &sed on contingent valuation data.SOURCES:1 Unj=s othe~se noted, the material in this table is from William T. Miles,Jane Corwin, and Peter D. Blair, “Cost of Power Outages-The 1977 NewYork City Blackout,” paper presented at the IEEE 1979 Annual Meeting,Seattle, WA, May 14-17, 1979, and sources cited therein.

2Andrew A. Goett, Daniel L. McFadden, and Chi-Keung WOO, C’EStir?latingHousehold Value of Electrical Sem”ce Reliability With Market ResearchData,” The Energy Journa/, vol. 9, 1988, p. 105.

Schi+eung M/eo and Kenneth Train, “The Cost Of Electric powerInterruptions to Commercial Firms,” The Energy Jourrra/, vol. 9, 1988, p.161.

4M~hael J. Deane, Raymond S. Hartman, and Chi-Keung Wo, “House-hold Preference for Interruptible Rate Options and the Revealed Value ofService Reliabil’~,” The Energy Journa/, vol. 9, 1988, p. 121.

5Michae[ J. Deane, Raymond S. Hartman, and Chi-Keung Wo, “House-holds’ Perceived Value of Service Reliability: An Anafysis of ContingentValuation Data,” The Energy Jouma/, vol. 9, 1988, p. 135.

at about $500,000. Restaurants in the area estimatedlost business at $10,000 to $45,000 for the 4 days.The costs at one hotel included lost revenues fromthe 75 percent of reserved guests who went to other

~ene H. Males, “Reface: Value of Reliability, the Undefined Issues, ‘‘ in Criteriom Inc., op. cit., footnote 4, p. viii.s~addition to Operafig revenue IOSSeS of $5.7 rniUion reflecting approximately 84,000 MWh of unserved energy, COn ~’S Steps to upgrade system

reliability will probably cost more than $65 million.%4.iles et al., op. cit., footnote 1, p. 66.~orbid.


Box C—New York City Blackout

On July 13, 1977, at approximately 9:41 p.m., New York City plunged into total darkness. The blackout wascaused by a series of lightning strokes compounded by improperly operating protective devices, inadequatepresentation of data to system dispatcher, and communication difficulties. These combined factors createdconditions that cascaded to the point of total collapse of the Consolidated Edison (Con Ed) system.l

On this day, Con Ed was providing approximately 5,860 MW of electricity to its New York City customersover 345- and 138-kV transmission lines and cables. Approximately half of the electricity was being generated byplants located in Brooklyn, Manhattan, Queens, and Staten Island; the remaining load was supplied by Con Edgenerators outside the city, and purchased from utilities in upper New York State and Canada. Con Ed also waswheeling 240 MW to the Long Island Lighting Co. (LILCO) and approximately 200 MW of emergency power tothe Pennsylvania-Jersey-Maryland Pool.

At 8:37 p.m. lightning hit two 345-kV lines supplying 1,200 MW of electricity from the Indian Point No. 3and the Bowline and Roseton generating units to the City. The resulting short circuit caused the protective relays,located at the Millwood West and Buchanan South substations, to open the circuit breakers and disconnect the lines.This interrupted the supply (870 MW) from Indian Point No. 3, which then shut down automatically. Isolating thegenerator at Indian Point No. 3 caused one of the 345-kV transmission lines between Pleasant Valley and MillwoodWest to increase load above its normal capacity rating (825 MW), although it remained within its long-termemergency rating (860 MW). This caused operators to reduce voltage by 8 percent. The Con Ed system operatorrequested all generators within the city to increase power production to replace the loss and relieve loading on the345-kV line. However, by 8:55 p.m. the in-city generation had increased (550 MW) only enough to compensatefor the two-thirds of the power lost.

Nineteen minutes later, another bolt of lightning hit with a devastating effect. This bolt hit one of the remaininglarge, heavily loaded 345-kV lines bringing power to the city. Normally, the strike should have caused relays totemporarily isolate the line for mere moments-just long enough to dissipate the lightning’s energy. However, onecircuit breaker failed to operate properly, causing other relays to isolate the line entirely. This loss of transmissioncapacity overloaded remaining lines, resulting in their isolation.

With the now inadequate supply of power, Con Ed had no choice but to shed load, blacking out parts ofWestchester County. Simultaneously, LILCO’s spinning reserves automatically increased output. However, thecables connecting LILCO and Con Ed were overloaded as a result, and LILCO disconnected itself from Con Ed,eliminating a further source of power.

At 9:27 p.m., still another lightning bolt struck a power line. When this happened, the remaining Con Edgenerators could not maintain the load and were shut off automatically. At the same time, Public Service Electric& Gas Co. disconnected from the Con Ed system severing Con Ed’s remaining ties to the north. At approximately9:41 p.m. the 1977 New York City blackout began.

Full power was restored in about 25 hours. Many protective circuit breakers had to be individually examinedand reset. The city was powered up one section at a time, carefully balancing the added loads with supply, asdescribed in chapter 5.

lsy~tm~ Con@oI, IIIc., ImpactAssess~nt cfthe 1977 New York City Blackout, prepared for he U.S. mptim~t of EIMXSY, J~Y 1978sp. 13.

hotels, plus expenses for hiring additional security Another actual cost analysis was based on aguards. ll utility-imposed 25 percent curtailment during peak

hours for 25 consecutive days in Key West, FloridaOne industry that profited from the Seattle black- in July-August 1978. The Key West system experi-

out had electrical generators for rent. One company enced a generating equipment breakdown that re-received 50 to 60 phone calls for 2 generators; duced electric supply to 80 to 90 percent of peakanother only had 3 available.12 demand. Total electric shortage impact costs in Key

llAddy Hatch “B~~inesses Assess~g ~sses From the Blackou~” The Seattle Times, VO1. 111, No. 215, s=. C. p. 4. SePt. 7* 1988.lzIbid.

Chapter 3-Impacts of Blackouts • 23

Table 5-Cost of the New York City Blackout—1977a

Impact areas Direct ($M) Indirect ($M)

Businesses Food spoilage . . . . . . . . . . . . . . . .Wages lost . . . . . . . . . . . . . . . . . .Securities industry . . . . . . . . . . . .Banking industry . . . . . . . . . . . . . .

Government(Non-public services)

Consolidated Edison Restoration costs . . . . . . . . . . . . .Overtime payments . . . . . . . . . . .

Insurance b

Public Health Services

Other public services Metropolitan TransportationAuthority (MTA) revenue:Losses . . . . . . . . . . . . . . . . . . . 2.6MTA overtime and

unearned wages . . . . . . . . . . 6.5

Westchester County Food spoilage . . . . . . . . . . . . . . . .Public services:

equipment damage,overtime payments . . . . . . . . . .

Totals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

$1.0 Small businesses . . . . . . . . . . . . .5.0 Emergency aid

15.0 (private sector) . . . . . . . . . . . . .13.0

Federal AssistancePrograms . . . . . . . . . . . . . . . . . .

New York StateAssistance Program . . . . . . . . .

10.0 New capital equipment2.0 (program and installation) . . . .

Federal crime insurance . . . . . . .Fire insurance . . . . . . . . . . . . . . . .Private property insurance . . . . . .Public hospitals-

overtime, emergencyroom charges . . . . . . . . . . . . . .

MTA vandalism . . . . . . . . . . . . . . .MTA new capital

equipment required . . . . . . . . .Red Cross . . . . . . . . . . . . . . . . . . .Fire Department

overtime and damagedequipment . . . . . . . . . . . . . . . . .

Police Departmentovertime . . . . . . . . . . . . . . . . . . .

State Courtsovertime . . . . . . . . . . . . . . . . . . .

Prosecution andcorrection . . . . . . . . . . . . . . . . . .

0.25C

0.19

$55.54

$155.4

5.0

11.5

1.0

65.03.5

19.510.5

1.50.2

11.00.01

0.5

4.4

0.5

1.1

$290.16

%aeed on aggregate data collected as of May 1,1978.~eriap with business losses might oeeur sines some are reeovered by insurance.%oting w= induckd in this estimate but reported to be minimal.NOTE: These data are derivative, and are neither comprehensive nor definitiveSOURCE: Systems Control, Inc., /rnpactAssessrnent o~the 1977 New York City B/ackouf, prepared for the U.S. Department of Energy, July 1978, p. 3

West were $2.30 kWh average for all non-residential prised 60 percent of the loss to both commercial andusers. The breakdown is $2.00 to producers (e.g., industrial users. Unrecovered costs totaled 20 and 30auto repair, stores, schools), $0.10 to employees percent for commercial and industrial users, respec-(wage loss), and $0.20 to consumers. The cost is tively. The inconvenience from postponing appli-approximately 50 times the then $0.05/kWh price of ance use comprised 36 percent of the cost toelectric power in Key West.13 residential users.14

In addition, several empirical studies on user loss SECTORAL IMPACTSfrom power shortages were conducted. These studiesexamined two electric power shortages of several Industrial

hours in San Diego, the Key West curtailment, and Many industrial processes are highly sensitive tonatural gas shortages in Alabama, Kentucky, Ohio, power disruptions. An interruption of less than 1and Tennessee. The findings concluded that the second can shut plant equipment down for severalextra cost to make up interrupted production com- hours. Outages can spoil raw materials, work-in-

1qJack Fau@tt AS~~t~,AwlYtiCalF ra~wOrkfOr Evaluating Energy and Capacity Shortages (Palo Alto, CA: Ek@ic power Raach ~titut%

EPRI-EA-1215, April 1980), vol. 2, pp. 1,5-1.7.IAfinest Msti+ “Shortage Costs: Results of Empirical Studi=, “ in Criterion, Inc., op. cit., footnote 4, pp. 3-3, 3-11.


progress, and finished goods. Spoilage is a signifi-cant problem in chemical processes, steel manufac-ture, food products, and other industries.15 Black-outs also pose opportunity costs from idle factors ofproduction. Human health and safety effects areanother major concern in industrial outages. Notonly are the workers exposed to possible injury orhealth hazard from the power interruption, theneighboring population also could be exposed to riskfrom hazardous spills or releases due to the loss ofenvironmental or safety equipment. l6

costs

Industrial-sector costs are more directly measura-ble in terms of equipment damage, loss of materials,cost of idle resources, and human health and safetyeffects. Lost output is the primary cost. One ap-proach is to take the classic economic factors ofproduction—land, labor, capital, profit, and en-trepreneurship-and identify the value of the fore-gone opportunities for each of them for variousindustrial processes. Those opportunities can beevaluated using some measure of excess capacity ofeach of the factors of production. When all resourcesare idle (have excess capacity), the opportunity costis estimated at the value of wages. When allresources are fully employed, the loss includes thevalue that would have been added in production.One may need to add the costs of spoilage and otherdamage, long-term adaptive costs, indirect costs,and consumer surplus if final demand is left un-served.

For example, in 1965 Dunlop Tire’s Buffalo plantlost 1,700 tires (worth $50,000) when power failedduring the critical curing process. The Tonawanda,New York Chevrolet plant had to junk 350 engineblocks because high-speed drills froze while boringpiston holes. Ford’s huge Mahwah, New Jerseyassembly plant had to wait for standby power whenOrange & Rockland Utilities, Inc. gave West Pointpriority because “the cadets need to study to-night. ‘ ‘17

Commercial

For many commercial customers, any outage of aduration of more than 1 or 2 seconds has a significantcost due to computer problems, equipment jamming,or ruined product. For these firms a l-hour outage isnot substantially more costly than a 10-secondoutage.

With the increasing pervasiveness of computersand communications systems in all economic activ-ity-commercial sales, offices, industrial processcontrol, finance, communications, public workscontrol, government-their performance in a black-out affects all impact sectors. The major conse-quences include costs associated with the inability ofthe computer to perform critical functions, loss ofdata, and possible damage to the computer andperipheral equipment. Degradation of storage mediais a major concern if the room temperature strays toofar from the norm.18 Critical systems usually havebackup power sources, although most are notdesigned for an extended blackout, when the operat-ing environment becomes more of a concern.

An entirely new industry has grownup around theneed for backup systems and recovery services forheavily computer-dependent activities. Computersecurity companies take over computer functions,such as payroll, inventory, and records maintenance,when disasters tempera.riiy or permanently disablecorporate computers.19

costs

The commercial sector is the most difficult of thethree sectors to analyze and has been studied theleast. Its boundaries and components are ill-defined,and it incorporates a very wide variety of productsand services. In many areas, the commercial sectoris the most rapidly growing customer class, and thecosts of outages may average the highest.20

Some utilities define the commercial sector aswhat is left over after accounting for residential andlarge industrial customers. Using this definition,large apartment buildings, small grocers, and moder-

ISM. M~inghe and A. Sanghvi, “Reliability of Electricity Supply, Outage Costs and Value of Service: An Overview,” The Energy Journal, vol.9, 1988.

l~MOSbae~ op, cit., fOOtnote 14.IT~~~e Disaster ~t wmn’~” Time, NOV. 19, 1965, p. 36.18system5 Control, ‘C.* ‘‘Impact Assessment of the 1977 New York City Blackout’ prepared for the U.S. Department of Energy, July 1978, p. 46.

l~son Greer, ‘‘Weyerhaeuser Division Waits for Data Disasters,” Puget Sound Business Journal, vol. 9, No. 21, sec. 2, p. 5A, Oct. 3, 1988.~Sanghvi, op. cit., footnote 6, P. *-26.

Chapter 3-Impacts of Blackouts ● 25

ate-sized manufacturing firms would all fall in thecommercial class. Another classification is based onSIC (Standards of Industrial Classification) codes.Still others are based on peak demand levels, a kWhrule, or the voltage of service.21

For those parts of the commercial sector where theprincipal activity is production that can be made upafter an outage without substantial cost (e.g., laun-dries, drycleaners, bakeries, etc.), the idle resourcecost approach used in the industrial sector probablyis most appropriate. At the other extreme, largeapartment buildings can be viewed as a concentra-tion of households, and analyzed using one of theresidential-sector outage cost methods.22

Between these two extremes are commercialestablishments that sell products and those thatprovide services. The potential for product damageand the ability to makeup lost production are criticalhere. Food stores and warehouses, for example, canhave significant spoilage costs. Similarly, fast-foodoutlets not only can have high spoilage costs, butalso service immediate demand and usually cannotmake up lost business.23

Agriculture

An Ontario Hydro survey conducted between1976 and 1979 indicates there can be significanthazards to livestock and produce during a blackout.Sensitive processes include incubation, milking,pumping, heating, air-conditioning, and refrigera-tion. Of the larger-than-average farms included inthe survey, 26 percent had standby generation.About 60 percent had facilities to shut off a portionof their load in an emergency.24 In 1965, farmersdeprived of power for their milkinghooked them up to generators operatedmotors. 25

Residential

machinesby tractor

Never are Americans more aware of their depend-ence on electricity and the machines it drives thanduring a blackout. Without electricity, air-conditioning is off, and many people do not have

heat or hot water. In high-rise buildings, people mustuse stairwells. Senior citizens and the disabled are atan extreme disadvantage in outages. Consumers donot have lights, refrigerators and freezers, stoves andmicrowave ovens, toasters, dishwashers, intercoms,televisions, clocks, home computers, elevators andescalators, doorbells, hair dryers, heated blankets,can openers, food processors, carving knives, tooth-brushes, razors, and garage door openers. With theadvent of high-tech electronics, most people havebattery-operated radios or TVs, but few keep enoughbatteries on hand to last more than a few hours.

If a blackout occurs during the winter, as did the1965 outage, those with yards or balconies can putfood outside. In the 1989 summer blackout inWashington, DC, PEPCO distributed dry ice. Forthose with fireplaces or barbecues, cooking is stillpossible; others must resort to cold food or restau-rants. Illness from food spoilage can be a significantproblem.

One of the more sociologically interesting im-pacts of the 1965 outage was the fact that withoutaccess to their normal forms of entertainment,people turned to each other; 9 months after theblackout, the birthrate increased from 50 to 200percent at New York hospitals.26

costs

Electricity permits activities whose value varieswith time of day, week, or year. The short-termopportunity cost is the degree of disruption of thehousehold’s preferred consumption pattern. Someactivities, such as cleaning, can be deferred withoutsignificant loss (and in many cases might beconsidered an emotional benefit). Others can bedeferred or relocated (e.g., washing clothes, eatingdinner). Still others can only be relocated (e.g.,watching a particular TV program). At some timesof the day/year and/or for particular groups, therecan be health and safety implications (e.g., lack ofheat/AC, elevators, life-support systems, hot water,and refrigeration). Costs also vary by householdincome, type of appliance stock, preferred leisureactivities, and other household characteristics.

211bid.

%id.%id.~~n Sko% “omario Hydro Surveys on Power System Reliability: S~ of Customer Viewpoints, “ in Criterion, Inc., op. cit., footnote 4.

~“l%e Disaster That Wasn’4° op. cit., footnote 17.

~“Blackout FaUoug” Time, Aug. 19, 1966, p. 40.


In addition to deferring or relocating activities,households may experience out-of-pocket expensesfor mitigating responses such as using block or dryice to preserve food, firewood for heat or cooking,candles and batteries for lighting, batteries forradio/television, etc.27

Two equivalent measures of loss are the dollaramount the household would accept as compensa-tion for the disrupted consumption pattern, and theamount the household would be willing to pay not tohave its preferred consumption pattern disrupted.

Transportation

A blackout affects virtually every mode of trans-portation (box D). Subways, elevators, and escala-tors stop running, and corridor and stairwell lightsusually are out. Street traffic becomes snarledwithout traffic lights. Gasoline pumps do not work,and the availability of taxis and buses declines overtime. Parking lot gates and toll booths will notoperate. Pedestrians are perhaps the least affected,although their danger increases without traffic sig-nals and after dark with the loss of street lighting.Trains can still function, but doing so can provehazardous without signal lights. Airports are pow-ered by auxiliary generators that enable aircraft toland and take off in an emergency. However,considerable delays can be expected. In high-densityareas where most people are dependent on publictransportation, economic and other impacts areincreased by the inability to get to work. Othertransportation effects result from the inability todeliver goods.

Telecommunications

There is a growing reliance on telecommunica-tions networks in all sectors of the U.S. economy.Businesses and government depend on reliablecommunications to perform routine tasks. Also,businesses are using their communications systemsand the information stored in them to achieve acompetitive advantage and to restructure their or-

ganizations on a regional or global basis. Thus, thefailure of a communications system can lead notonly to market losses but also to the failure of thebusiness itself.28

The functioning of all crucial municipal publicservices, such as police, fire, etc., will also dependon telecommunications. A recent study by theNational Research Council noted that our publiccommunications networks are becoming increas-ingly vulnerable to widespread damage from naturaldisasters or malicious attacks.29

Extended power outages can affect telecommuni-cations networks and lead to economic disruption.The extent of the disruption will depend on whethertelecommunications networks, both public and pri-vate, have emergency backup power systems andhow reliable the backup systems are. Today, manynetworks have their own dedicated emergencybackup system. The importance of backup powersystems was evidenced during Hurricane Hugo andthe recent San Francisco earthquake. At the height ofHurricane Hugo, 39 central offices and 450 digitalloop carrier facilities were operating on backuppower. Southern Bell indicated that the facilitiescould operate on battery power for about 8 to 10hours before gas or diesel generators take over.30

With the commercial power turned off in SanFrancisco because of the risk of free, central officesoperated on diesel generators. These diesel genera-tors could operate for up to 7 days, according toPacBell. The earthquake did little damage to thenetwork.31

In an emergency, commercial satellites could alsobe used to augment or restore a public network.Currently, only the American Telephone & Tele-graph Co.’s interexchange carrier network is aug-mented by the Commercial Satellite Interconnectiv-ity program, which uses surviving C-band commer-cial satellite resources.32

The impact of a disruption will depend on howcrucial communications equipment is to a particular

27S~ghvi, op. cit., footnote 6.28U.S. congre~~, Offlce of Technology As~ssmen~ critical COnnectiOn~: co~nication for the Future, OTA-CIT-407 (wt@hlgtO~ ~: U.S.

Government Printing Office, January 1990).29fqatio~ Rese~ch co~cil, Gro~”ng vulnerability of the public Switched Ne~orks: Imp[icationsfor National Secun”ty Emergency prepart?dneSS

(Washington, DC: National Academy Press, 1989).30Telephony, “Survival of the Network” Oct. 23, 1989, p. 42, and “Hugo No Match for So. Bell,” Sept. 25, 1989, p. 3.ql’’PacBe~ Ne~ork Smives Quake,’ Te/ephony, Oct. 23, 1989. p. 14.

s%id., p. 18.

Chapter 3-Impacts of Blackouts . 27

Box D—Transportation Impacts—Northeast and New York City Blackouts

The 1965 Northeast blackout occurred at 5:30 p.m.—a peak period for most modes of transportation-andlasted for up to 13 hours. The worst potential hazard was in the air, where at peak hours between 5:00 and 9:00 p.m.some 200 planes from all over the world were headed to New York’s Kennedy Airport. Logan Airport in Boston,as well as numerous smaller airports, also were blacked out. Inbound flights lost visual contact as the ground lightswent out. Luckily, it was a clear night, and pilots could seethe other planes over the darkened cities. Planes boundfor New York were diverted as close as Newark and as far as Cleveland and Bermuda. Philadelphia received 40NY-bound airliners carrying some 4,500 passengers. Kennedy was shut down for 12 hours.1

In 1965,630 subway trains in transit ground to a halt, trapping 800,000 passengers. Under the East River, 350passengers had to slog to safety through mud, water, and rats. In the middle of the Williamsburg Bridge, 1,700passengers were suspended in two trains swaying in the wind. It took police 5 hours to help everyone across aprecarious 1 l-inch wide catwalk running 35 feet from the tracks to the bridge’s roadway. A total of 2,000 trappedpassengers preferred to wait it out, including 60 who spent 14 hours in a stalled train under the East River.2

Thousands of people were trapped in stalled elevators. In at least three skyscrapers, rescue workers had to breakthrough walls to get to elevator shafts and release 75 passengers. Elevator failure resulted in the only two deathsattributable to the 1965 blackout: one person fell down a flight of stairs and hit his head, and another died of a heartattack after climbing 10 flights of stairs.3

Traffic lights failed and main arteries snarled. At unlighted intersections, countless volunteers took over thejob of directing traffic. Hundreds of drivers ran out of gas as they waited for traffic to clear, only to find that servicestation pumps cannot work without electricity.4

In 1977, the New York airports were ordered closed at 9:57 p.m. on July 13, only minutes after the powerfailure. At Kennedy, 108 airline operations were scheduled between 9:00 p.m. and midnight July 13; 37 operatedbefore the airport was closed. LaGuardia had scheduled a shutdown at midnight July 13 for runway construction,and disruption was much less significant (39 of 60 scheduled operations). Newark Airport handled 32 divertedaircraft from Kennedy and LaGuardia. Auxiliary generators supplied emergency power to the terminals, in whichmore than 15,000 passengers remained through the night. At Kennedy International Airport, some power returnedat 3:30 a.m. on July 14, but the first authorized takeoff was not until 5:34 a.m. At both Kennedy and LaGuardia,parking lot gates and payment systems were out, and parking area employees computed fees manually. This resultedin severe traffic jams and long delays.5

The subway system fared a little better in 1977. The blackout occurred around 9:40 p.m., after most commuterswere home. Also, the storm activity and brownouts offered some warning. Dispatchers running the subway systemnoticed power surges on the line before the blackout and radioed motormen to go to the nearest station and remainthere.6 Thus, only seven trains in the entire system were in transit when the power went off. Emergency evacuationproblems were most severe for a train stuck on the Manhattan Bridge. Even buses could not run the next day,however, because of the unavailability of fuel from electric pumps. Moreover, Grand Central Terminal was forcedto close when drainage pumps lost power. Even after power was restored, flooded converters prevented electricallypowered trains from using the station during the morning rush-hour on July 15, thus delaying about 75,000 dailycommuters. 7

The train stations in New York City halted operations during the 1977 blackout. The main inter-urban trainline, AMTRAK, stopped service from the south in Newark. Going north, AMTRAK provided buses to New Haven,where trains from Boston turned around. Conrail trains serving Trenton, New Brunswick, and South Amboyexperienced delays up to several hours.8

After the 1977 blackout, the Metropolitan Transportation Authority initiated an$11 million program to installnew equipment to ensure against massive disruption of the transit system in the event of a future blackout.9

‘ “ Time, Nov. 19, 1965, p. 36.1 ,t~e Disaster ‘lht Wasn ‘~

2 Ibid.3 Ibid.4 Ibid.5 Systems Contiol, ~c., JmPa~tA~~e~s~nt of the 1977 New York City Blackout, prepared for DOE, J~y 1978, PP. 16, [email protected] Nan MCGOWW “me New York Bkickoutj” Environment, vol. 19, No. 6, August/September 1977, p. 48.7 systems Con@ol, Inc., op. cit., foo~ote 5.8 Ibid.9 bid.


industry/business. Medium- and large-size busi-nesses that use integrated information systems tolink operational processes—i.e., order entry, sched-uling, etc.—will experience economic damageshortly after a power failure. While many businessuse a number of interconnected networks, suppliedby a variety of sources (including local area net-works and private and public networks), mostprivate networks depend on public networks fortransmission and switching capabilities. The FederalGovernment, for example, uses a number of privatenetworks to communicate within a particular depart-ment or agency, but uses public networks tocommunicate outside.33

OTA has found that, in general, businesses havebeen slow to prepare for emergencies or adoptsecurity measures, often postponing action untilafter a problem has occurred. One major reason citedis cost. Moreover, the value of communicationsecurity has to be traded off not only against cost, butalso against system access and interoperability .34

Emergency Services

Emergency services include police and fire andtheir communications and transport, as well ashospitals. Power outages can also affect theseservices. All hospitals have emergency power sys-tems to support the most critical activities, such asoperating rooms, intensive-care units, emergencyservices, etc. Depending on the facility, auxiliarypower systems may not be able to support someother activities, including x-ray, air-conditioning,refrigeration, elevators, etc. Moreover, technicalproblems may arise with the auxiliary generators, asevidenced in the 1977 New York blackout. In someinstances, hospitals had difficulty bringing genera-tors on-line, and were faced with generators over-heating and inoperable transfer switches for con-necting loads to emergency circuits.

Fire-fighting and police communications could beseverely disrupted by the loss of power. Fire alarmsystems may be inoperable and fire-fighting maybehampered in those areas where some power isrequired for pumping water.

Moreover, the indirect impacts of a blackout, suchas looting and arson, can severely strain fire-fightingand police services. For example, during the NewYork City blackout, 70,680 calls were made to911,compared with the 17,700 made in a normal 24-hourperiod. Also, during the 1977 blackout, there were1,037 fires (primarily arson) with over 6 large-scalefrees, requiring 5 companies. More than 80 injurieswere reported due to the abnormal fire activity.Exhaustion was common due to the high heat andhumidity and the lack of food supplies and restareas.35

Public Utilities and Services

Public utilities include electric, water, gas, sew-age, garbage, and related services (e.g., public healthinspection).

Water supply systems generally rely on gravity tomove water from reservoirs through the mains andto maintain pressure throughout the system. Somepower may be required at pumping stations andreservoirs. Loss of pressure in mains hampersfree-fighting and hospitals, and may permit contami-nants to seep into the water supply. Typical systempressure will supply buildings up to five or sixstories tall. High-rise buildings use electric pumps toprovide adequate supply on upper stories, or haveroof tanks with 24- to 48-hour storage capacity. Ifelectric pumps in high-rise buildings do not work,residents would have to go without water or get itfrom neighbors below.36

Electricity is needed in treatment and pumping ofsewage. An outage at a treatment plant causes rawsewage to bypass the treatment process and flow intothe waterways. Lack of pumping station powerprevents sewage flow and ultimately causes abackup at the lowest points of input (usuallybasements in low-lying areas). During the 1977 NewYork City blackout, many of the sewage treatmentplants and pumping stations in Westchester Countyand New York City had standby power supplies, butonly for short durations. After the standby powerwas exhausted, untreated sewage flowed continu-

331bid., pp. 82-84.~Office of Tectiolo~ Assessment, op. cit., footnote 28, ch. 10.jssystems Con&ol, kc., op. cit., foomote 18.

361bid.

Chapter 3-Impacts of Blackouts ● 29

ously into the harbors. Signs were posted on allneighboring beaches prohibiting use.37

costs

Outage costs attributable to essential services andinfrastructure, including street and traffic lights,public transport, telecommunications, hospitals, air-ports, sewage and sanitation, fire and police protec-tion, etc., are difficult to measure. For many of theessential functions, backup emergency generationalready exists, although it maybe unreliable or onlydesigned to be operated for a few hours at a time. Forsome infrastructure services, the cost of installingstandby generation should provide a reasonableorder-of-magnitude estimate of outage costs. How-ever, the costs of public transportation and lightingoutages are more difficult to estimate.38

In a blackout, electric utilities have revenue lossesfrom unserved energy, expenses for equipment and

overtime personnel to restore power, plus any capitalinvestments needed to ensure that particular type ofblackout does not occur again.39

Consolidated Edison suffered more than bad pressin 1977. In addition to operating revenue losses from84,000 MWh of unserved energy, and the cost ofrestoring power, Con Ed had to make capital andother investments (e.g., operator training programs)to upgrade system reliability .40 Moreover, Con Edstock experienced increased trading on July 14, andclosed at its lowest value for some time. The stockhad a closing loss of 1.25 at the end of a week thathad begun with increasing values.41

Following the 1965 blackout, utilities across thecountry changed their operating procedures andmade capital investments in relays and circuitbreakers to ensure that no single failure would againresult in a cascading outage. (See ch. 4.)

37fiid.

Msqhvi, op. cit., fOOmOte 6.

39fc~e D~& ~t Wm’t,” op. cit., footnote 17.40~es et al., op. cit., fOOtiOte 10

dlsystms Contro], IIIC., op. cit., footnote 18.

Chapter 4

System Impact of the Loss of Major Components

A sophisticated saboteur or major natural disastercan readily cause widespread power outages. Thetime and effort needed for a system to recover couldrange from seconds to months, depending on whichcomponents are damaged, the system’s basic charac-teristics, and the availability of spare parts. Even ifa power failure is avoided or lasts only seconds,costs may be high as less efficient reserve generatingcapacity replaces low cost units, and sensitiveconsumer equipment such as computers are disa-bled. This chapter addresses the resilience of currentbulk power systems to equipment outages, examin-ing both reliability and economic impacts.

U.S. utilities have been highly successful inmaintaining very high levels of bulk power system l

reliability. Bulk power systems in the United Statesare designed and operated to be reliable and econom-ical in the face of normal events including occa-sional equipment failure. Utilities are also preparedto minimize the impact of some highly unlikelyevents such as multiple simultaneous equipmentfailures at a single site. However, sabotage or majornatural disaster can inflict damage well beyond whatutilities plan for. Because U.S. utilities have per-formed so reliably and have only rarely facedwidespread and multiple equipment failures, there isuncertainty about how bulk systems will actuallybehave in extreme circumstances.

One factor leading to reliability and resilience isthe highly interconnected network common tomodern power systems (see box E). Because of thevast size of most power systems, no individualpowerplant or transmission component is critical tothe operation of any power system. An electricsystem typically has many powerplants, in somecases several dozen. An individual powerplant, evena large multi-unit one, supplies only a small fractionof the total demand of most control areas. There aresome very small control areas in the Midwest, but

each powerplant provides only a small fraction of thetotal capacity in the interconnection.

Distribution systems are not designed to havesuch a high level of reliability as the bulk system. Infact, the great majority of outages that customersexperience result from distribution system prob-lems, not from the bulk system (around 80 percentby one estimate).2 However, unlike bulk systemfailures, distribution-caused outages are localized,and utilities have considerable experience in re-sponding to them.

SHORT-TERM BULK POWERSYSTEM IMPACTS

The Importance of Any One Component:Preparing for Normal Failure3

Some of the thousands of components in anysystem occasionally fail or operate improperly, orare disabled by natural events such as lightningstrikes. Because these events are common andinevitable, utilities consider them to be normal. Mostbulk power systems in the United States are de-signed and operated to continue operation followingthe failure of any one device without interruptingcustomer service or overloading other equipment.4

This is commonly referred to as the “n-1 operatingcri ter ion. Some utilities prepare for two suchcontingencies (called the n-2 operating criterion).Systems west of the Rockies make some exceptionsto the n-1 criterion for certain major facilities. Inthose systems, some customers may be brieflyinterrupted following certain outages, but with nooverloading of other equipment leading to uncon-trolled or cascading outages.

Preparing for equipment failure involves twomain functions. These are: 1) holding sufficientgeneration and transmission capacity in reserve to

IB~ ~wa ~stem include the genemtion and ~ansmissio~ but not distribution (see U.S. Congress, ~lce of T~hUOIOSY ~s~sm~~ ‘Zecrn”cPower Wheeling andDea/ing, OZ4-E-41O (Washingto~ DC: U.S. Government Printing Office, May 1989), ch4). This chapter focuses on bulk systemssince damage to them may be far more widespread and difficult to repair than distribution damage.

~.S. Department of Energy, “The National Electric Reliability Study: Executive Summary, “ DOE/EP-0003, April 1981, as cited in: Power SystemReliability Evaluation, Institute of Electrical and Electronics Engineers, 1982, p. 42.

3SW OiIIX of Technology Assessment op. cit., footnote 1.dNofi~~~anEl~~c Reliability Comcil, OVemiewofplanning andReliability Criteria of theRegionalReliabiliq Councils ofNERC @IKet~

NJ: April 1988).Ssee ~lce of Technology Assessmen4 op. cit., footnote 1.

–31-


Box E—The Organization of Electric Systems:Utilities, Control Areas, Power Pools, and Interconnections

The electric power industry today is a diverse and heterogeneous amalgamation of investor and publicly ownedutilities, government agencies, cogenerators, and independent power producers.2 In most of the country, individualutilities are highly interconnected and operate under a variety of formal or informal coordination agreements. Thelevel of power transfers and coordination between utilities is determined largely by control areas, power poolingarrangements, and physical interconnections.Control Areas

Responsibility for the operation of the Nation’s generating facilities and transmission networks is dividedamong more than 140 ‘‘control areas. In an operational sense, control areas are the smallest units of theinterconnected power system. A control area can consist of a single utility, or two or more utilities tied together bycontractual arrangements. The key characteristic is that all generating utilities within the control area operate andcontrol their combined resources to meet their loads as if they were one system. Control areas coordinatetransmission transactions among electric power systems through neighboring control areas. Control areas maintainfrequent communications about operating conditions, incremental costs, and transmission line loadings.Power Pools

There are two types of power pool arrangements-tight power pools, which include holding company powerpools; and loose power pools. Tight power pools are highly interconnected, centrally dispatched, and haveestablished arrangements for joint planning on a single-system basis. Four of these tight pools consist of utilityholding companies with operations in more than one State; the others are mostly multi-utility pools. Together, thetight power pools account for about a quarter of the industry’s total generating capacity. Arrangements amongutilities in loose power pools are quite varied and range from generalized agreements that coordinate generation andtransmission planning to accommodate overall needs to more structured arrangements for interchanges, sharedreserve capacity, and transmission services.Interconnections

North America’s interconnected utilities create four physically separate, synchronously operated transmissionnetworks: the Eastern Interconnection (or Seven Council Interconnection); the Texas Interconnection; the WesternSystems Coordinating Council (WSCC); and the Hydro Quebec System. DC and AC transmission interties betweenthe networks are limited in location and capacity, with the result that the transmission systems in the United Statesdo not forma single national grid, but rather form three huge, separate grids. However, even the smallest one, theTexas Interconnection, is very large with installed generating capacity of over 50,000 MW comprised of scores ofgenerating units.

Is= U.S. co-s, ~W of Technolo~ Assessmen6 Electric Power Wheeling and DeaZing, 0’IA-W410 (washingt% ~: U-s.Government Printing OffIce, May 1989, ch. 4.

2At ~r~at, the Nation’s UW& industry kludes203 investor-owned operating companies; 1,988 Iocal publicly owned systems; ~ rur~electric cooperatives; 59public joint-action agencies, and 6 Federal power agencies, In additio~ there are several hundred cogenerationand smallpower producers selling power to utilities.

respond immediately; and 2) designing circuit select “unit commitment plans” specifying whichbreakers and relays to protect and isolate equipmentin a controlled manner.

Reserve Generation and Transmission

Utilities keep enough generation, transmissionand substation capacity on-line and ready for opera-tion to replace any operating components that fail.Generating units must be warmed up and rotating insynchronism with the 60 Hz of the power systembefore operating. Generating units which are syn-chronized and ready to serve additional demandimmediately are called spinning reserves. Utilities

units will be warmed up and cooled down to followthe cycle of loads over the course of a day, week orseason. Unit commitment schedules are chosenwhich minimize the total expected costs of operationand Spinning reserves required to maintain reliabil-ity and meet expected changes in demand.

Unlike generating units, transmission circuits andsubstations don’t require any warm-up time and areinstantly available as long as they are connected tothe system. The flow of power in a transmissionnetwork is dictated by the laws of physics. One of thekey laws is that power flows on all available paths

Chapter 4-System Impact of the Loss of Major Components .33

between a generator and a load. This is calledparallel path flow. After a generator or transmissioncircuit fails, the power flow on the remaining circuitsresponds immediately. To ensure that resultingflows don’t exceed emergency ratings, “security-constrained dispatch’ techniques are used to ensuresufficient transmission reserves. Control center op-erators typically examine a series of contingencycases to determine the most severe contingency andthe resulting transmission loadings. When they finda contingency would create unacceptably highloadings, the generation dispatch is adjusted toreduce the resulting flows to acceptable levels.

Circuit Breakers and Relay System Design

Relaying techniques and circuit breakers to iso-late and protect equipment are essential to main-taining reliable service. Circuit breakers are installedat each end of every circuit and transformer in thesystem to provide protection in the event of a shortcircuit. Under normal conditions the breakers per-form routine switching operations such as discon-necting and isolating equipment for maintenance orinspection, transferring loads among circuits anddisconnecting generators when not needed. Whenrelays sense a short circuit, they cause the circuitbreakers to operate, isolating the faulted component.Most breakers on the bulk power system operate inno more than five cycles (1/12 second in the U.S.60-Hz system), and three cycle (1/20 second)operation is common. Prompt isolation of faultedcomponents is critical to ensuring that the remainingequipment is not damaged and is able to continueoperation.

Increasingly, many power systems are usingelaborate relaying schemes for protection.6 Theseinvolve coordinated operation of multiple circuitbreakers simultaneously in different locations ratherthan merely isolating individual failed components.For example, in the Pacific Intertie, which connectsthe Pacific Northwest with southern California, acomplex scheme is employed which isolates genera-tion in Oregon and transmission circuits in Arizonawhen certain circuits in California fail. This system,

which enables California to reliably import largeamounts of power, ensures that a transmissionfailure in California will not cause damaging imbal-ances in neighboring States.

Impacts of Multiple Failures: Islands andCascading Outages

While the failure of any single generating unit,transmission line or substation normally should notcause significant outages, simultaneous failure ofmore than one major component generally willresult in interruption of service.7 When abnormal,multiple failures occur, a power system typicallyundergoes ‘‘system separation, ” in which portionsof the system disconnect from each other.8 Some ofthese isolated portions, called “electrical islands,”may have an imbalance of supply and loads. Thoseislands have either more generation than load ormore load than generation, causing the systemfrequency to deviate from its normal value of 60 Hzand transmission voltages to exceed design limits. Inturn, protective relays would cause several genera-tors and transmission circuits to disconnect from theisland, resulting in a blackout. Other islands mayhave a balance of supply and demand, allowingcontinued operation even though disconnected fromthe rest of the system.

“Cascading outages” occur when the failure ofone or more components causes the overloading andfailure of other equipment and breakup of the systeminto islands in an uncontrolled fashion. It is notpossible to accurately predict the way a system willbreak up after a major disturbance-there are toomany variable factors.9 Utilities do analyze theirsystems and implement plans to help anticipate andcontrol the likely pattern of islands. Their analysesshow that the pattern of islands will vary dependingon the location of loads, which units are operating,how much each unit is generating, the configurationof the transmission network, and the specific sec-ond-by-second sequence of events causing thedisturbance. However, one can predict that cascad-

—CNofi Americm Ehx&ic Reliabfiity co~cil, 19g7 Reliability Assessmen+The Future of Bulk Elecm”c System Reliability in North Amen”ca,

1987-1996 (Princeton NJ: October 1987).TThis ~sues that the system is operated for n-l contingencies. A system operated for n-2 should be expected to have signiflctmt impacts o~Y wh~

more than two major components fail.8Wes~@ouse El~~~ COT., Utiliq Suwey of Method~for Mini~”zing the Nu~er and Seven”fy of system Separations, EPRI EL-3437 (MO AltO,

CA: Electric Power Research Institute, March 1984).

~bid.


ing failures will extend over large areas, in somecases over a multistate region.

Preparing for Extreme Contingencies

Because uncontrolled, cascading outages can beso widespread and difficult to recover from, U.S.utilities have made special provisions to avoid themeven though the circumstances leading to them areviewed as highly unlikely. In addition to planningfor ‘normal” contingencies, U.S. utilities also planfor ‘extreme’ contingencies.10 The reliability crite-ria of each of the NERC regional reliability councilsspecify that bulk power systems shall be planned andoperated in a reamer to avoid uncontrolled, area-wide interruptions under certain extreme contingen-cies. Under extreme contingencies, substantial out-ages will occur, but should not extend across anentire system.

Typical extreme contingencies examined includethe loss of an entire multi-unit generating station,multi-circuit transmission substation, or loss of allcircuits on a common right-of-way. Thus, the failureof all units in a large multiple-unit plant would causeserious, although perhaps temporary, blackouts inmost systems. While customer interruptions wouldbe expected in the immediate area, cascadingfailures resulting from overloading of remainingequipment should not occur if the extreme contin-gency planning has been performed properly.

The types of equipment failure that a terroristattack or major natural disaster may cause are farmore severe than those considered by utilities asextreme contingencies. The extreme contingenciesplanned for by utilities today are limited to failuresat a single site. However, natural disaster or attackcould well affect two or more major sites. Thesimultaneous failure of any combination of two ormore large multi-unit powerplants, or multi-circuittransmission corridors or substations may well leadto cascading failures. While the extent of the impact(e.g., the characteristics of the electrical islands)can’t be accurately predicted, it can be very large.

LONG-TERM BULK SYSTEMIMPACTS

The Importance of Any Few Components:Large Reserves and Peak Capacity

Most of the time, U.S. utilities have large amountsof generating capacity in excess of demand. Any-thing less than the failure of much of this generationreserve should cause outages lasting no longer thanthe few hours required to start idle capacity andrestart the system. However, there may be a dailycycle of shortages or rotating outages during hoursof peak demand. The large surplus of generatingcapacity over demand results from two factors: 1)installing sufficient capacity to meet peak loads; and2) planned reserve margins in excess of peakdemand.

Power systems are designed to meet widelyfluctuating loads which reach their peak for only afew hours in any year. Peaks usually occur in the lateafternoons of hot summer days when air-conditioners add to normal loads, or on very coldwinter days when space heating is uncommonlyhigh. Because capacity is installed to meet the peakdemand, a large amount of capacity operates atpartial output or is idle except during those peakperiods. Off-peak-period loads may be as little asone-third of daily peak. On average, demandthroughout a year is around 60 percent of peakdemand. ll Thus, on average, the power plants in asystem operate at no more than around 60 percent ofcapacity.

Furthermore, even at peak periods, there isgenerally a large amount of reserve generatingcapacity. Most utilities plan to install generationreserve margins of 15 to 20 percent.12 Utilities installreserve capacity in order to accommodate bothplanned and unplanned needs such as scheduledmaintenance, unexpectedly high load growth andequipment outages. Because loads grew muchslower than anticipated during much of the 1970sand 1980s, many areas of the country now have farhigher reserves than planned, too, with over 35percent in some NERC regional reliability councils.

l~ofi~~canE]=~c Refiabili~comcfl, @ewiewofPlanning andReliabiliP Criteria of theRegionalReliabiliQ councils ofNERC (PrincetouNJ: Aprd 1988).

llu.s+ ~p~ment of Ener~,Eze~t~c Power SupP/y andDe~ndforthe contiguous United States ~98&1997, DOE/HE-W13, JZUI~ 1989, tiblesC1-C9.

12u.s. congress, Library of Congress, Congressional Research s-ice “Do We Really Need All Those Electric Plants?” August 1982.

Chapter 4-System Impact of the Loss of Major Components ● 35

As loads continue to grow, however, this excesscapacity gradually is being reduced. Other regions ofthe country, on the other hand, are beginning toexperience relatively small reserve margins.13

Transmission systems are planned to accommo-date both the geographical distribution of power-plants as well as the changing patterns of loads.Thus, the reserves of generation are necessarilyaccompanied by similar reserves of transmission.Transmission networks also link the many utilitiesin the Nation’s three interconnections (see box E).NERC reports that some transmission systems areheavily loaded by economy energy transfers bothwithin and among regions, and will continue to beduring the 1988-97 forecast period. These transfersare driven by fuel price differentials rather thanreliability requirements. For example, the PacificIntertie carries low-cost hydroelectricity from thePacific Northwest to displace expensive naturalgas-or oil-fired generation in California. However,on some occasions, large, long-distance transmis-sion lines carry power which is essential for reliabil-ity, not just for minimizing electricity costs.

Because there generally are large reserves oftransmission just as there are of generation, it wouldtake the destruction of the transmission capacityassociated with several powerplants to keep anysystem down for an extended period of time over awide area. However, at certain times such as extremepeak periods or when scheduled maintenance orunplanned outages have reduced actual reservemargins, failure of only a few key generation ortransmission components units could significantlydisrupt service.

System Impact When No Outages Occur:Higher Costs and Lower Reliability

Even if a blackout is brief or avoided altogether,the loss of damaged or destroyed base-load generat-ing units is very expensive for the duration of theoutage. Base-load units, fueled by uranium, coal, orhydropower, have the lowest operating costs of anyunits in a power system and are typically the largestunits. If they are damaged, the energy they wouldhave produced must be replaced by other more

expensive units such as inefficient peaking unitsusing natural gas or oil. In the case of a large nuclearunit replaced by natural gas-fired turbines, theadditional cost can be well over one-half milliondollars daily .14

The lost use of the transmission capacity neces-sary to deliver the power from a generating unit toconsumers is similarly costly. The capacity totransfer power while remaining within voltage andload flow limits on the system is a constraint oneconomic dispatch. When sufficient transmission isnot available to deliver power from the lowest costgenerators to loads, other generators must be oper-ated instead.

Any loss of generation and transmission capacityreduces the reliability of a system somewhat. Thedestruction of one or more major generating ortransmission components reduces a system’s re-serves, leading to fewer options and less resiliencefor any further component outages. The degree towhich reliability is reduced depends on the level ofinstalled reserve margins.

BULK SYSTEM RECOVERYFROM OUTAGES

There has been little experience with the types ofwidespread, carefully planned and executed acts ofaggression addressed in this report. However, theutility industry has a long history of responding tovarious kinds of emergencies, whether they arerelatively small, such as an outage of a transmissioncircuit or a generator unit, or more serious, due totornado damage, hurricanes or earthquakes. Mostutilities have some plans in place for restoringservice after a total shutdown. However, few havehad to test those plans recently—in the 1980s,Florida, Texas, South Carolina, and Californiaprovide the notable examples.

Restoring service involves starting generation orreclosing circuit breakers and adding load in smallincrements, slowly piecing the system back to-gether. For customers in small islands adjacent to anarea that remains interconnected, power may berestored in a few minutes. Isolated islands will take

13u,so D~~@~~nt Of Ener~,E/e~t~@oWer Supply andDe~ndforthe Contiguous lfnitedstates 19&1997, DOE/IIE-CU)13, J~~ 1989, tiblesC1-C9.

14~~ ~~~ate is b~ed on a 1,~~ tit ou~ge and me average operating costs of nucl~ tits and gas Wbines reported in U.S. lkp~entof Energy, Historical Plant Cost and Annual Production Expenses for Selected Electn”c Plants 1987, DOE/EIA-0455(87) (Washingto% DC: U.S.Government Printing Office, May 1989), figure 1. The costs are, respectively, 2.1 and 4.7 cents/kWh.


longer, especially those that were completelyblacked out.

Restarting Generating Capacity

If an external source of power is available,restarting a unit is not a problem. However, if noexternal power sources can be used, the powerplantmust have “black start” capability. Black startcapability can be provided from a diesel or aself-starting gas turbine unit in the plant. It is alsopossible to provide black start capability from theinterconnections of a system. This is done bydisconnecting the interconnections from the load-serving circuits (to avoid overloading the lines)while keeping the generator connected. The inter-connections can then be energized to import powerfrom the neighboring system to use in starting theunit.

Restoring Transmission

As generating units are restarted, portions of thetransmission system can be energized. The segmentsenergized must be carefully selected to avoidbuilding up excessive voltages due to the capacitiveeffects of the high-voltage lines. This requires thatload be added as line segments are energized. Caremust be exercised not to overload the small amountof generation connected.

A power system is restored by successivelyrestarting generators, connecting transmission lines,and connecting load until significant islands ofoperating load and capacity are available. Then theseparate portions of the system are connected to eachother. In this way, the portions of the system that areoperable can be completely restored and returned toas near normal operation as feasible. Restoration ofan outage should begin within minutes of an outage.The length of time to restore full service depends onthe design of the system, the severity of the blackout,and the components damaged.

SPECIFIC EXAMPLESOF ATTACKS

To evaluate the impact of sabotage on electricpower systems, postulated attacks were developedand reviewed for their effect on six areas in theUnited States. The impact of these attacks isdescribed below, beginning with the simplest at-tacks that are most applicable nationwide. Most of

the attacks involve transmission circuits (whether atsubstations or along transmission lines).

The components attacked could be identified bysomeone generally familiar with power systems,either using published transmission maps or fromdirect observation. Physically locating the targetswould involve modest effort and planning, sincethey are generally large and highly visible. Anyonefamiliar with power systems could readily identifythe particular transmission facilities that need to beattacked for effective disruption. However, it ispossible for unsophisticated saboteurs to mistakenlytarget small or relatively unimportant facilities.

These cases assume that the attack occurs at a loadlevel of about 80 percent of annual peak load. It isalso assumed that about 20 percent of the totalgenerating capacity is undergoing maintenance orforced outage. In all of the cases, the extent of theinitial interruption would not be affected by the timeof day or load level. That is because the amount ofreserves which are warmed up and ready to operateis sufficient to handle only one (or in some casestwo) contingencies, as is standard utility practice.The near- and long-term impacts would be lessened,however, if the attacks occurred during the spring orfall when system loads are lower. In most cases,rolling blackouts would be necessary only duringcertain hours, e.g., between 10 a.m. and 6 p.m. onweekdays, when loads are typically their highest.

Destruction of Any One Generator,Transmission Circuit, or Transformer

As has been noted above, U.S. power systems areoperated to withstand the loss of any single piece ofequipment without interrupting customer load.Therefore, the destruction of any one of these wouldnot cause a blackout. The loss of any of these maysigntificantly increase a utility’s operating costs, if itmade replacement of low-cost baseload generatorswith high-cost peaking units necessary.

Destruction of One Major Multi-CircuitTransmission Substation or Multi-Unit

Powerplant

As noted above, U.S. utilities generally plan forthe loss of an entire multi-circuit transmissioncorridor, substation, or multi-unit powerplant. Forsuch a loss, the system should not experiencecascading outages. However, customer interruptionsshould be expected. No case was found in which

Chapter 4-System Impact of the Loss of Major Components . 37

such an attack would seriously disrupt the bulkpower system or affect more than a subarea of autility.

Immediately after the loss of a transmissionsubstation (or of the multi-circuit corridor supplyingit), the customers served directly and some otherswould be interrupted. Some more distant customersmight be affected by the operation of protectiverelays as a result of power transients. The moredistant customers interrupted would be restored inseveral minutes as the operators reconnected thecircuit breakers and adjusted generation output.Customers in the immediate area of the failedsubstation would experience a longer power outage,lasting on the order of one day. Customers served bya distribution circuit powered directly from a de-stroyed substation might not return to service forseveral days or even weeks.

If a powerplant was taken out of service (whetherby attacking the generating units themselves, thegeneration substation, or the transmission circuitsleading from it to the network), the impacts would beless severe. While the outages could cover largeareas, service should be restored in several minutesas operators reconnected the circuit breakers andadjusted generation output. Costs of replacementpower could be high, particularly if the plant was alarge, low-cost baseload unit replaced by inefficientpeaking units.

Destruction of Two or Three MajorTransmission Substations

Inmost cases, the nearly simultaneous destructionof two or three transmission substations would causea serious blackout of a region or utility, although ofshort duration where there is an approximate balanceof load and supply in the isolated areas. It is almostcertain that the transmission system would have toolittle capacity to continue operation after the secondloss, resulting in separation of the system and theinterruption of customer load in several areas. Mostcustomers would be restored within 30 minutes,

after undamaged interconnections were restored. Formost systems, there would be a sufficient balance ofgeneration and load to restore all customers as soonas generation could be warmed up and broughton-line.

There are some areas of the country where failureof key substations could cause long-term disrup-tions. Two particularly vulnerable cities would beisolated by the loss of two or three substations,because of a serious shortage of generation. Rollingblackouts during high-load times (e.g., daytime)would occur for several weeks until temporaryrepairs were made.

Destruction of Four or More MajorTransmission Substations

The destruction of more than three transmissionsubstations would cause long-term blackouts inmany areas of the country. Only a few areas have agood enough geographic balance of load and genera-tion to survive this very severe test. For example,one city is served by a ring of nine evenly spacedtransmission substations. Nearly all the interconnec-tions serving this major metropolitan area would bedestroyed by attacking the seven largest and easiestto identify transmission substations. The other twoare smaller and of little importance during normalconditions. There is enough local generation in thiscase to restore service to most customers quickly,although it is considerably more expensive than theimported power. This case represents the best case ofa multiple-substation attack.

A final example is a city served by eighttransmission substations spread along a 250-mileline and located in five States. A knowledgeablesaboteur would be needed to identify and find theeight transmission substations. A highly organizedattack would also be required. However, the damagewould be enormous, blacking out a four-Stateregion, with severe degradation of both reliabilityand economy for months.

Chapter 5

Current Efforts To Reduce Energy Systems Vulnerability

Since the late 1970s national emergency prepar-edness initiatives have focused primarily on devel-oping programs within appropriate governmentagencies. The National Security Council (NSC) hasplayed a central role in directing this effort. About 20Federal departments/agencies are involved withemergency preparedness. The Department of Energy(DOE), through its Office of Energy Emergencies, isthe lead agency for energy-related issues. Otherinvolved agencies include the Departments of De-fense, Interior, and State, the Federal Bureau ofInvestigation, the Federal Emergency ManagementAgency, and the Nuclear Regulatory Commission.

In the early 1980s, the General Accounting Officecriticized Federal Government agencies for inade-quate energy emergency preparedness planning andcoordination. Since then, improvements have beenmade in developing comprehensive plans and pro-grams, streamlining coordination, and eliminatingduplication. However, because of the number ofFederal agencies involved in energy emergencyplanning, uncertainties about authority, responsibili-ties, and activities are bound to exist. These sameuncertainties may be magnified during a nationalemergency and thus hamper efforts to ensure ade-quate energy supplies and distribution to essentialfacilities.

The Federal Government has limited authority orresponsibility to provide physical protection forenergy systems. Individual utilities are responsiblefor protecting their physical plants and ensuringreliability. Utilities routinely build redundancy andplan for inevitable but occasional equipment failurebut do not consider multi-site sabotage when design-ing the system. That is not to say that utilities are notconcerned about energy systems vulnerability. TheNorth American Electric Reliability Council(NERC) has been working quietly on vulnerabilityissues for several years. Recently, NERC developedrecommendations and guidelines to mitigate electricpower systems vulnerability. Utilities generallyfollow NERC guidelines on such matters. NERCoften acts as a clearinghouse for the electric utilityindustry-developing and disseminating resourcematerials and information on vulnerability. It also

has encouraged member utilities to establish liaisonswith government agencies and other industrygroups. To a large extent, NERC facilitates commu-nication and coordination among its members-anactivity that would be essential during an emergencysituation.

State efforts in energy emergency preparednesspeaked in the early 1980s in response to the oildisruptions of the 1970s. Funding and staffing levelshave since declined. This decrease in funding andstaffing could affect the States’ ability to respond toan energy emergency. In addition, most of theStates’ plans and organizational structure weredeveloped in response to a particular crisis-an oilsupply disruption-and may not be relevant to othersituations. Plans need to be revised to reflect otherpotential disruptions, including natural disasters andsabotage.

Furthermore, interstate and intergovernmentalcommunication and coordination may be inade-quate. According to DOE, only 9 States havedeveloped routine communication systems withsurrounding States. Based on an energy emergencysimulation, a Federal interagency group concludedthat existing Federal and State crisis managementplans were not well-coordinated and may beat crosspurposes. 1

This chapter provides an overview of currentefforts and responsibilities of various institutions,including the utility industry, Federal agencies,States, and public utility commissions. Also, thecurrent status of the U.S. electrical equipmentmanufacturing industry is discussed.

CURRENT EFFORTS

Private Industry

Utilities

In the United States the physical protection ofelectric power facilities does not appear to be ahigh-priority item for utility management. Histori-cally, deliberate attacks on electric power facilitieshave not resulted in power or financial lossessignificant enough to justify a major investment in

IRvoti of thelnteragency Group on Energy Vulnerability, November 1986-November 1988, prepared for tie Sefior ~teragencY Group for Natio~Security Emergency Preparedness, January 1989.

–39-

40 ● physical Vulnerability of Electric Systems to Natural Disasters and Sabotage

physical security. However, it is important to notethat the utility industry is concerned about vulnera-bility and has been working quietly on securityissues for some time.

Utilities recognize that communication is animportant part of any security plan. Under emer-gency conditions, including sabotage, the ability tocommunicate is even more critical. Thus, utilitiesplace a high priority on the restoration of communi-cation networks during emergencies.

Utilities also recognize the need for improvedcommunication with law enforcement officials andother utilities. Virtually all utilities with key facili-ties have established contact with the local FBIoffice. The FBI can assist utilities in evaluatingthreats, inspecting facilities, and planning emer-gency responses. In addition, utilities have encour-aged additional information exchanges betweenoperating personnel and security managers to ensureadequate emergency preparedness.

North American Electric Reliability Council(NERC)

NERC and its nine regional councils were estab-lished in the late 1960s to assist utilities in providingfor the reliability and adequacy of electric genera-tion, transmission, and distribution systems. Format-ion of the organizations was aided by Federallegislation following the Northeast blackout of1965.

At NSC’s direction, DOE requested NERC toaddress electric power systems vulnerability issues.In 1987, NERC established the National ElectricSecurity Committee (NESC) to assess the degree ofvulnerability of U.S. electric power systems anddevelop a program to mitigate vulnerability tosabotage and terrorism. The Security Committeeestablished three working groups which dealt withphysical security enhancements, operating strate-gies, and design and restoration improvements. InJuly 1988, the NESC presented its report andrecommendations to the NERC Board of Trustees.The report with its recommendations was approvedin October 1988. Most of the recommendations havebeen implemented while a few are still under review.

NERC’s program includes a close-working rela-tionship with the Federal Bureau of Investigation.

Also, NERC has identilfied utilities where sparetransformers are located.

A small number of agencies have been briefed onthe NERC report and recommendations. Theseagencies include the National Security Council, theDepartment of Energy, the President’s ScienceAdviser, and the Federal Emergency ManagementAgency.

The NESC, having completed its mission, hasbeen disbanded and related activities assigned toNERC’s Engineering and Operating Committees orto the Regional councils or the utilities.

Edison Electric Institute (EEI)

EEI has established a security committee, whichconsists of 70 members who are responsible forphysical protection of utilities’ facilities. Accordingto EEI, more than half of the committee’s membersare ex-FBI agents or members of other law enforce-ment agencies. EEI’s security committee facilitatessecurity information exchange among its members,NERC, and government agencies.

Federal Government

National Security Council (NSC)

The NSC is the lead agency for national securityemergency preparedness policy. In 1988, NSCdefined the government’s approach to emergencypreparedness. It grouped government agencies byparticular areas such as economics, energy, humanservices, law enforcement, telecommunications, andtransportation. One department/agency is the leadagency within each group and is responsible foridentifying responsibilities and operating proce-dures and coordinating activities with other groups.For example, DOE is the lead agency for the energygroup. Also, NSC is the principal liaison withCongress and the Federal judiciary on nationalsecurity matters.

Federal Emergency Management Agency(FEMA)

FEMA serves as adviser to NSC on nationalsecurity emergency preparedness, which includesmobilization 2 preparedness, civil defense, techno-logical disasters, etc. FEMA also provides guidanceto other Federal agencies in developing and imple-menting emergency preparedness plans. More spe-

Chapter 5-Current Efforts To Reduce Energy Systems Vulnerability ● 41

cifically, FEMA is responsible for developing plansfor the conversion of industrial capacity and supplyduring a national emergency. This effort involvesidentifying industrial facilities that are essential tonational mobilization and developing mechanisms,including standby agreements, to allocate facilitieswhen production capacity is in short supply. Duringa national mobilization, FEMA would likewise beinvolved in coordinating and facilitating emergencysupply imports. In addition, FEMA authorizesgovernment agencies to establish National DefenseExecutive Reserve programs (discussed in a latersection) and provides guidance in this regard.

Recently, FEMA prepared a prototype nationalplan for graduated mobilization response (GMR)options. This process provides a framework formobilization planning in three incremental steps:planning and preparation, crisis management, andnational emergency/war. Eight Federal departmentsand three agencies were considered in the process.As a result of this effort, a Defense MobilizationOrder was issued in January 1990. The order definesGMR, provides policy guidance, and further estab-lishes a system for developing and implementingmobilization actions that are responsive to a widerange of national security threats and warnings.FEMA expects that a final document, which willinstitutionalize the process, will be available in1990.

Another ongoing FEMA activity is the prepara-tion of Major Emergency Action papers. Thesepapers are intended to provide information todecisionmakers on response options, costs andbenefits, and the implementation process during awide spectrum of emergencies.3

FEMA also published a Defense MobilizationOrder, which provides criteria and guidance forFederal departments/agencies to develop strategies,plans, and programs for the security of essentialfacilities and resources. Responsibility for protect-ing essential facilities rests with appropriate Federaldepartments/agencies. FEMA monitors complianceand reports its findings to the NSC.

FEMA’s disaster relief activities are the mostvisible. The most recent examples are FEMA’s

efforts to assist South Carolina, Puerto Rico, and theVirgin Islands in the wake of Hurricane Hugo andvictims of the Loma Prieta earthquake.

Department of Energy (DOE)

DOE is the lead government agency for energyemergency preparedness. Its mission is to ensurethat adequate energy supplies are available tosupport the Nation’s infrastructure during a nationalemergency. In this regard, DOE’s Office of EnergyEmergencies (OEE), created in 1981 in response toExecutive order 11490, is responsible for dealingwith energy system vulnerability concerns.

OEE’s FY89 program budget totals about $6.2million, the bulk of which is used for staff salaries.The budget has remained essentially the same overthe past 5 years. OEE consists of 71 professional andsupport staff.4

Vulnerability Program—Recently, the OEEdeveloped a Vulnerability Program whose purposeis to reduce the risks of energy system interruption.The Program consists of four phases: Phase Iincluded case studies to determine the nature ofvulnerabilities in the electric power, petroleum, andnatural gas industries. This effort included consider-able input from industry, Federal, State, and localgovernments and is essentially completed. Theresults of the studies are classified. Phase IIestablishes an industry outreach program whichprovides information and solicits industry/government joint cooperation. DOE cites the NERC/DOE initiative, noted earlier, as an example of PhaseII activity. According to DOE, the first phase hasbeen completed and the second is progressing.

Phase 111 of the program includes additional casestudy exercises and other industry outreach efforts.DOE expects industry to respond to the concernsraised by these exercises. However, there appears tobe no provision for follow-up activities under thisphase. Phase IV will identify national securityvulnerabilities which cannot be addressed by therespective industries. This phase may include feder-ally funded programs to remedy energy systemvulnerability concerns. Other OEE efforts haveincluded updating the State emergency contractsdirectory, reviewing legislation and contingency

qFeder~Emergency mMgement Agency, National Preparedness Directorate, Ofllee of Mobilization Preparedness, Mobilization pr~ared?less-fhOverw”ew, March 1989.

qEdwti V. Bado~to, Depu& Assistant Secretary for Energy Emergencies, U.S. Department of Energy, teStimOny at h earings before the SenateGovernmental Affairs Committee, Feb. 8, 1989, pp. 4,6.

42 ● Physical Vulnerability of Electric Systems to Natural Disasters and sabotage

plans, and disseminating information to States via anelectronic mail system called DIALCOM. OEE hasalso conducted regional seminars and simulations toprovide assistance to State energy planners.5 Anoverview of the results of the regional seminars isgiven in the “State Efforts” section.

DOE has established a threat notification systemto alert energy industries. Notification consists of amessage describing a threat that could lead toaggressive actions. For example, notification ofIran’s reaction to the reflagging of Persian Gulfvessels was sent to NERC, the American PetroleumInstitute, the National Gas Association, the Inter-state Natural Gas Association of American, and theNational Coal Association. These organizations inturn notify their respective industry members.

Interagency Group on Energy Vulnerability/Policy Coordinating Committee on EmergencyPreparedness and Mobilization Preparedness—Because of a growing concern about internationalterrorism, the NSC directed DOE to establish theInteragency Group on Energy Vulnerability (IGEV).It focused on national security issues relating to thevulnerability of U.S. energy systems. The Groupwas charged with developing initiatives to decreasevulnerability and mitigate the impact on nationalsecurity of any disruptions.6 In late 1988, IGEV wasterminated and its concerns and functions mergedinto a new interagency group, the Policy Coordinat-ing Committee on Emergency Preparedness andMobilization Preparedness, Standing Committee onEnergy. Committee members include the Depart-ments of Energy, Defense, Justice, Interior, State,Transportation, and Treasury; the Central Intelli-gence Agency; the Federal Bureau of Investigation;the Federal Emergency Management Agency; Na-tional Communications System; National SecurityCouncil; and the Nuclear Regulatory Commission.

National Defense Executive Reserve (NDER)Program

Authorized by Congress, the NDER is a collectionof civilian executives recruited from various indus-tries. When authorized by the President, the industryexecutives, called reservists, would provide infor-

mation and assistance in their areas of expertise toFederal authorities. Reservists would also helpcoordinate industry efforts in meeting nationalneeds. FEMA authorizes government agencies toestablish NDER units and provides overall policyguidance. The Office of Energy Emergencies withinDOE administers three NDER units: the EmergencyPetroleum and Gas Executive Reserve, the Emer-gency Electric Power Executive Reserve, and theEmergency Solid Fuels Executive Reserve.

DOE indicates that these industry executivescould provide invaluable assistance in assessingdamage, evaluating supply capability, and coordi-nating repair and restoration efforts. DOE plans tohave about 400 industry representatives involved inthe NDER program. The reserve staff for the ElectricPower unit is at 50 percent of the staffing goal andSolid Fuels is up to 80 percent, according to DOE.7

Since its birth in 1964, the NDER program has notbeen without criticism. It has been administered byseveral government agencies, including the DefenseElectric Power Administration within the Depart-ment of the Interior, the Economic RegulatoryCommission, and finally the Office of EnergyEmergencies within DOE. Questions have beenraised about training and recruitment, and antitrustconcerns have been raised by petroleum industryofficials. Consequently, the petroleum executivereserve unit has not been fully developed. Over thelast few years, however, DOE has been aggressivelyrecruiting reservists and facilitating training ses-sions for new reservists.

The Federal Bureau of Investigation (FBI)

The FBI is responsible for counterterrorism pro-grams in this country. Its authority extends todealing with terrorists attacks against energy facili-ties. The Bureau recently proposed a counterterroristprogram that would focus on the vulnerability of theNation’s infrastructure to sabotage. The programwas designed to place 70 additional agents in fieldoffices to identify key infrastructure facilities, de-velop contingency response plans, disseminate in-formation, and provide assistance to private indus-try. Funding for the $17 million program has not

sNatio~ Rese~h COuncil, Committee on State and Federal Roles in Energy Emergency Preparedness, State and Federal Roles in EnergyEmergency Preparedness, prepared for the U.S. Department of Energy (Washington, DC: Natiomd Academy Press, January 1989), pp. 15-18; BadolatoTestimony, op. cit., footnote 4, p. 10.

‘XMarter of tbe Interagency Group on Energy Vulnerability of the Senior Interagency Group for National Seeurity Emergency Preparedness.~adolato Testimony, op. cit., footnote 4, p. 15.

Chapter S-Current Efforts To Reduce Energy Systems Vulnerability ● 43

been approved. A second proposal, now underreview, will use existing resources within the Bureauto develop liaisons with private industry and dissem-inate threat information.8 Currently, the FBI main-tains a liaison with the Department of Energy. Threatwarnings are disseminated to DOE, which in turnnotifies private industry.

Department of Defense (DoD)

DoD administers the Key Assets Protection Pro-gram (KAPP), whose purpose is to protect selectedcivilian industrial assets from sabotage during anational emergency. Selected industries are thosethat are deemed essential to national defense andinclude some industry-owned energy facilities. Keyassets are not owned or controlled by DoD. Theprogram identifies which electric power systemsprovide energy to vital military installations anddefense manufacturing areas. In addition, criticalnodes on each power system are identified in orderto facilitate defense planning.

As administrator of the KAPP, the Commander inChief, Forces Command, develops and maintains aclassified Key Assets List (KAL). Facilities that areincluded on the list must be nominated by DoD andmeet stringent criteria, which includes onsite inspec-tions and the approval of owners. DoD also solicitsnominations of infrastructure assets from otherFederal department and agencies. Responsibility forensuring the security of a facility rests with theowner/operator initially.

In the mid-1970s, the electric utility industryparticipated in the Defense Industrial FacilitiesProtection program (now KAPP). At DOE’s insis-tence, DoD discontinued the “utility list” in 1980.The utility industry and DOE objected to DoD’sneed to conduct onsite physical security surveys,particularly by Defense agency personnel unfamiliarwith electric power systems, and the arbitrary natureof the selection process.9 The utility industry has notrejoined KAPP. Since then, DoD, with an initialgrant from FEMA, is again attempting to identifyelectric utility critical nodes that support key defense

facilities. Once identified, DoD will not@ ownersand solicit their cooperation in improving reliabilityand/or security of the critical nodes. The identifiednodes will not be placed on the KAL.

States

States’ efforts to plan for energy emergencies varyconsiderably. This assessment is based on a 1988DOE survey of State energy emergency prepared-ness and information collected by DOE in 1985 and1986.10 According to DOE, most energy emergencyplans were developed under the Energy EmergencyConservation Act, which no longer exists.

DOE found that most States had established aformal authority to deal with energy emergenciesand developed plans that delineate responsibilitiesand provide guidance. DOE noted that almost all ofthe plans were developed in response to the 1979 oildisruption, and only three plans have been updatedsince 1983. Many of the plans focus on educating thepublic and on conservation programs. Fewer thanone-third address the social impacts of energysupply disruptions.ll

While some authority and organizational systemis in place, staffing and funding levels have de-creased over the past few years. About one-third ofthe responding States have at most one full-timeprofessional staff person working on energy prepar-edness; 58 percent have two or fewer. Most Statesindicated that staff are not full time. The majority ofrespondents noted that the decline in funding hasreduced some States’ response capability .12 And, interms of intergovernmental coordination, some re-spondents expressed a need for more informationand communication between their States and DOE.

On a regional level, energy emergency planningand preparedness varies as well. In 1988, DOE’sOffice of Energy Emergencies conducted four re-gional seminars, which included a simulation of anenergy emergency. From these seminars, DOEfound that energy emergency planning was justgetting off the ground in the Southeastern States.13

%1 McGratlL Federal Bureau of I.nvestigatiou personal communication% Dec. 11, 1989.%J.S. congress, General Accounting Offke, Federal Electrical Emergency Preparedness Is Inadequate, EMD-81-50, May 12, 1981, p. 19.IONatio~ R~e~h Counc~ op. cit., footnote 5.

lllbid., p. 24.%bid., pp. 23-24.lsFOrp~O~S of h= =*, the Southeastern region includes: Texas, Oldaboma, Arkansas, Louis- Mississippi, Alabama, Florida, Georg@

south &ob& North Carol- and Tennessee.


The Southern States Energy Board is a central playerin this region, encouraging cooperation and coordi-nation among State and regional energy officials.The Western States14 had the best integrated emer-gency planning of all the regions, according to DOE.Emphasis is placed on interstate and regionalplanning, and many States conduct energy emer-gency exercises. Perhaps because of the danger ofearthquakes, California has one of most coordinatedand knowledgeable emergency planning offices inthe country. California has a large staff and onemember of the Energy Commission assigned toenergy emergency preparedness. The State’s plansare updated and tested regularly.15 It does not appearthat the inland Western States are as highly coordi-nated as the Pacific Coast States. The Northeast/Mid-Atlantic region16 is the most vulnerable t o

energy emergencies because of its dependence onfuels produced in other regions or countries. DOEdid not report on the status of emergency planning inthis region. And, in the Middle West region,17

responsibility for dealing with energy emergenciesis left to the industrial sector.18

Public Utility Commissions

Public utility commissions normally allow utili-ties to recover security costs. For example, securityfences and guards, and monitoring and surveillanceequipment are included in the overall cost ofoperating a nuclear power facility. Also, sparecomponents are typically held as an essential part ofthe operation and are included in the rate base.Utilities have expressed reluctance to employ addi-tional security measures. Among the arguments theyhave raised is a concern that utility commissionswould disallow any related expenditures. This con-cern is as yet untested. It is possible that utilitycommissions may find that no need exists foradditional security against very low-probabilityevents (e.g., concerted aggression against utilitysystems). If so, they would be unlikely to allow

utilities to charge for such expenditures. However, ifutility activities are in response to Federal emer-gency preparedness policy or guidelines, approval ofexpenditures is more likely.

STATUS OF THE U.S.ELECTRICAL EQUIPMENT

MANUFACTURING INDUSTRYThe heavy electrical equipment manufacturing

industry has been undergoing restructuring in recentyears, resulting largely from the drastic slowdown inelectric power capacity expansion and new equip-ment orders. Atone time, U.S. companies dominatedthe heavy electrical equipment manufacturing in-dustry. Today, there are only a handful of U.S.companies. Some companies have entered into jointventures, while others have exited the businessaltogether. Still others have negotiated mergers andbuyouts. For example, General Electric sold itsextra-high-voltage (EHV) transformer manufactur-ing technology to Westinghouse, which in turnformed a joint venture with ASEA Brown Boveri(ABB) in 1989.19 Recently ABB, itself a merger ofSwedish and Swiss companies, exercised its optionto buy out Westinghouse. Manufacturing facilitieswill remain in the United States.

Currently, Westinghouse and Cooper Power Sys-tems, a wholly owned subsidiary of Cooper Indus-tries, are the only domestic manufacturers of verylarge Generation Step Up transformers (GSUs).Transformers manufactured overseas by a number offoreign companies, including Siemens of WestGermany and Hitachi, are also sold here. TheWestinghouse ABB facility, located in Muncie,Indiana is operating at about 50 percent capacity andhas not been profitable in the last few years.However, the plant is active, with over two shiftscontinuing production at reduced throughput.20

Drexel Burnham Lambert estimated that capacityutilization in the U.S. electrical equipment industry

ldl~e Westernmgion includes: washingto~ orego~ California, Nevada, New Mexico, Neva&, Arizona, Colomdo, Wyotig, Montiuw and I*o.

~s]nside Energy/With Federal htldS, “DOE Working With States To Improve Responses to Energy Emergencies,” Oct. 30, 1989, p. 7.16~e Nofieas~d.A~atic region includes: vk~, West J@iI@ ml~d, Delawme, pennsylv~, New Jersey, New York COnnCCtiCU~

Massachusetts, Vermont, New Hampshire, Rhode Island, and Maine.17~e Middle West region includes: Nofi D~o@ Souti D~o@ Ne~as@ Ka~, Minneso@, IOWA Missofi, hfkhig~ WistXXls@ hldh~

Illinois, Ohio, and Kentucky.18~e s~om ~~ond ~ti~te, Regional Differences, Co~n concerns~ederal. State.lndusq Roles in Energy E~rgency Preparedness,

Regional Seminars Conference Repot Summer 1988, pp. 11-14.19M~ting tith Westinghouse transformer plant personnel, Muncie, IN, July 27, 1989.

-id.

Chapter 5-Current Efforts To Reduce Energy Systems Vulnerability ● 45

ranges from 50 to 80 percent, depending on theproduct line.21

Furthermore, EHV circuit breakers are no longermanufactured by American-owned companies, al-though they are produced domestically. GeneralElectric sells Hitachi-made circuit breakers andWestinghouse markets Mitsubishi-made models.Two foreign suppliers-Siemens of West Germanyand ABB—manufacture circuit breakers in U.S.factories. 22

The restructuring trends are influenced by thedeclining market for electrical power equipment andsubsequent profitability and the presence of foreignmanufacturers. The power transformer industry, forexample, has significant overcapacity because of thedecline in demand, according to the Department ofCommerce. Moreover, nearly 40 percent of U.S.EHV transformer production capacity has beenremoved in the last 3 years. At the same time j foreignmanufacturers’ share of the U.S. power equipmentmarket has increased to about 20 percent and isexpected to continue to rise.23 Foreign-controlledcompanies have been predicted to account for about60 to 75 percent of the market for all core electricalequipment products (distribution transformers,switchgear, transmission, construction equipment,and power generation) by 1990.24 However, it isimportant to note that a larger fraction of theseproducts will be manufactured domestically. Be-cause of the decline in the U.S. dollar, foreigncompanies have found serving U.S. markets veryexpensive and one solution to this situation is toestablish facilities in the United States.25

In contrast, U.S. participation in foreign marketsis minimal. One reason is that electrical equipmenthas been excluded from GATT (General Agreementon Tariffs and Trade) jurisdiction, resulting inlimited U.S. access to foreign markets. This exclu-sion from GATT was influenced by the close

relationships among utilities, electrical equipmentmanufacturers and the government in Europeancountries. Most foreign utilities are State-owned orsubsidized. This government stakeholder positionhas made penetration of some European marketsdifficult. According to the National Electrical Manu-facturing Association (NEMA), between 1975-88,U.S. manufacturers of large power transformers andsteam turbine generators did not win a single orderfrom a European Community (EC) purchaser with adomestic production base for these products.26

Recently, access to foreign markets has been thesubject of discussion and negotiations among theDepartment of Commerce, the U.S. Trade Represen-tative, and the EC Commission, which will controltrade for its members, beginning in 1992. The EC, inlate 1988, issued a directive that covers procurementin three previously excluded sectors: energy, water,and transport. The directive, which is currentlyunder review by the European Parliament andCouncil of Ministers, proposes that utilities compet-itively procure purchases above a certain EC unitvalue (about $170,000 - U.S.). The utilities, how-ever, will have considerable latitude in choosingtendering and procurement procedures, and will beallowed to exclude offers that have less than a 50percent “EC content,” which will be based oncontract value.27

According to recent testimony by NEMA, theproposed directive provides no new right of accessfor non-EC suppliers. American electrical equip-ment manufacturers will continue to face closedutility markets in most EC member states, accordingto NEMA. On the other hand, U.S. markets are opento foreign suppliers.28

Proponents for maintaining U.S. electrical equip-ment manufacturing capability suggest that eco-nomic-jobs for U.S. workers—and national secu-rity considerations are two of the most compelling

21~exe133whM~ ( ‘Cmnt Perspectives on the Electrical Equipment ~dus~,” December 1987, reported in ElectricaZMurketing, “WhyForeigners Will Control U.S. Electrical Equipment Market” vol. 13, No. 3, Feb. 5, 1988, p. 8.

“’The Rise of International Suppliers,’ EPRIJournal, vol. 13, No. 8, December 1988, p. 7.23~les H, white, Natio~ El~ric~ ~n~ac~ers Association testimony at he~gs before the SeMte Committ& on bvemmen~ Afffi, On

Vulnerability of Telecommunications and Energy Resources to Terrorism, Feb. 7 and 8, 1989, p. 65.~Drexel B~~ Larnbefi op. Cit., fOOhlOte *1.

~Ibid.XBaWd H. Fti, presiden~ Natioti Electrical Manufacturers Association, teStimOny at hags before the House Committee on Foreign Affairs,

Subcommittee on Europe and the Middle East and Subcommittee on International Economic Policy and Trade, Apr. 5, 1989, p. 2.~Ibid., pp. 4-5.

2sIbid., p. 5.


arguments. Others maintain that without an adequatenumber of companies in the industry, competitionwill erode and a sellers market will prevail. Stillothers believe that the transportation of foreign-made equipment will take longer to reach the UnitedStates, which may be critical in a crisis. Somequestion whether standard American spares wouldbe readily available from foreign manufacturers andwonder whether foreign manufacturers will giveU.S. companies priority during a crisis. NEMAargues that an adequate domestic manufacturing

capacity is needed to support a surge in demand forequipment or respond to a crisis.29

Others see no compelling reason for maintainingU.S. capability. Foreign companies make qualityelectrical products and do it in a timely manner.Many feel that foreign suppliers are committed tomeeting U.S. needs. One utility executive noted thatthe global market is already part of the businessenvironment, and procurement policies can addressspare parts availability and other issues.30

z~te, op. cit., footnote 23, P. 6.5.~“The Rise of Intermtional Suppliers,” op. cit., fooinote 22.

Chapter 6

Options To Reduce Vulnerability

The preceding chapters have established that U.S.electric power systems, while capable of absorbingconsiderable damage without interrupting service,are vulnerable to attacks by saboteurs and, to a lesserextent, to massive natural disasters. Damage couldoccur that exceeds normal utility contingency plan-ning, resulting in widespread, severe power short-ages and rolling blackouts that would be extremelyexpensive and disruptive, and could continue formany months.

The risk that massive damage will occur is nothigh, but neither is it negligible. Internationalterrorist groups appear to have the capability ofmounting a crippling assault, and at some point, theyor domestic extremists may see a motivation.Earthquakes and hurricanes more severe than haveyet been experienced in the United States areinevitable. Eventually one will cause unprecedenteddamage to an electric power system, although therandom nature of such disasters makes the resultingdisruption very uncertain.

Various measures can be taken to reduce vulnera-bility disruption if damage does occur. The NorthAmerican Electric Reliability Council has recog-nized that threats exist, and some utilities have takenaction, as discussed in the previous chapter. How-ever, such actions are voluntary on the part ofindividual utilities. It can be easy to ignore low-riskevents, even if they are of high consequence,especially when protective measures are costly.

Given the unpredictability of these types ofdisruptions and the uncertainty of their costs, it is notpossible for a cost/benefit analysis to determine howmuch protection is worthwhile. The desirability offurther measures is a matter of judgment more thananalysis, as is the potential role of the government instimulating greater protection.

This chapter describes the measures that could beuseful in reducing the risk. This can be done by:

1.

2.

3.

preventing or minimizing damage to the sys-tem;minimizing the consequences of any damagethat does occur; andassuring that recovery can be accomplished asrapidly as possible.

In addition, the evolution of the electric powersystem can be guided toward inherently less vulner-able technologies and patterns. Table 6 lists thespecific steps.

These measures are presented independently ofhow they would be implemented or who would payfor them. The following chapter discusses consistentpolicy packages of these measures that could beundertaken depending on the judgment of thedecisionmaker as to the severity of the problem. Thepackages address the issues of implementation.

PREVENTING DAMAGE TOTHE SYSTEM

While it is not possible to protect energy facilitiescompletely, it is possible to deter attacks and limitdamage. Measures to reduce vulnerability includeboth physical changes or additions to electric powerfacilities and institutional measures. Physicalchanges include constructing walls or berms aroundcritical facilities and adding monitoring devices todetect unauthorized entry. Some changes may beprohibitively expensive, while others may involveminimal expense.

The transmission network is the part of the powersystem of greatest concern because it is highlyvulnerable to attack, and the consequences can begreat. The lines themselves are essentially impossi-ble to protect because they extend over manythousands of miles, often in sparsely populatedareas. However, lines can usually be repairedquickly with equipment and materials that utilitieskeep on hand.

Substations are the part of the transmissionsystem with the most serious combination of vulner-ability and potential consequences. Unguarded andunprotected substations in remote areas are asvulnerable as lines, but damaged equipment couldtake months to replace. The loss of even one keysubstation could effectively isolate a substantial partof the regional generation capacity from the loadcenters, posing the risk of long-term power short-ages.

4 7 –


Table 6-Options To Reduce Vulnerability

A. Preventing damage1. Harden key substations-protect critical equipment within

walls or below grade, separate key peices of equipmentsuch as transformers, toughen the equipment itself to resistdamage, etc.

2. Surveillance (remote monitoring) around key facilities (cou-pled with rapid-response forces).

3. Maintain guards at key substations.4. Improve coordination with law enforcement agencies to

provide threat information and coordinate responses.B. Limiting consequences

1. Improve emergency planning and procedures for handlingpower flow instability after major disasters and ensure thatoperators are trained to implement these contingency plans.

2. Modify the physical system-improve control centers andprotective devices, greater redundancy of key equipment,increased reserve margin, etc.

3. Increase spinning reserves.C. Speeding recovery

1.-

2.

3.

4.

5.

Contingency planning for restoration of service, includingidentification of potential spares and resolution of legaluncertainties.Clarify Iegal/institutional framework for sharing reserveequipment.Stockpile critical equipment (transformers) or any special-ized material (e.g., various types of copper wire) neededto manufacture this equipment.Assure availability of adequate transportation for a stockpileof very heavy equipment by maintaining database orrail/barge equipment and adapting Schnabel cars to fit alltransformers if necessary.Monitor domestic manufacturing capability to assure ade-quate repair and manufacture of key equipment in times ofemergency.

D. General reduction of vulnerability1. Emphasize inherently less vulnerable technologies and

designs where practical, including pole-type transmissionlines, underground transmission cables, and standardizedequipment.

2. Move toward an inherently less vulnerable bulk powersystem (e.g., smaller generators near loads) as newfacilities are planned and constructed.

SOURCE: Office of Technology Assessment, 1990.

Harden Key Facilities

Most substations are enclosed with nothing moreformidable than a chain-link fence. Improved fencesand gates could delay an attack while guards aresummoned by perimeter monitoring systems. How-ever, no fence will delay experienced, dedicatedadversaries for more than a few seconds. Hence there

seems little purpose in constructing very expensiveperimeter barriers unless police or armed guards arestationed at or close to the site. Moderately rein-forced fences, perhaps anchored at the bottom andincorporating rolls of barbed tape, would providesome protection against opportunistic saboteurs andvandals, especially if coupled with perimeter alarms.

Protective barriers-walls or berms-could bebuilt around the transformers to preclude damagefrom off-site rifle fire. Barriers might be particularlyvaluable in substations at generating plants. Unso-phisticated saboteurs might prefer to avoid ap-proaching generating stations too closely becausethey are manned and often guarded, but appropriatewalls would prevent easy attack from a distance.Walls would not stop a saboteur willing to climb thefence and attack from close range, but deterring lessaggressive attacks could still prevent the loss of abillion-dollar generating station. Barriers would alsolimit the damage that could be caused by one largebomb, forcing the saboteurs to plan a more elaborate,risky attack.

The cost of hardening a particular facility dependson the site characteristics and the type of protectionrequired. For example, a sheet metal wall (orbuilding) will hide equipment from view. That mighthelp against vandals, but it would provide noprotection against a saboteur with a high-power riflewho knows the equipment is inside and will simplyspray the wall with many bullets. A heavier wall,perhaps made of reinforced concrete that can stoprifle fire, would be considerably more expensive. Ifthe surrounding terrain provides high-vantagepoints, the wall would have to be commensuratelyhigh. While no general rule is proposed, crash-resistant fences and a concrete wall would addperhaps $100,000 to $200,000,1 a few percent of themultimillion-dollar facility cost. Some measures,such as walls, would make installation and mainte-nance of equipment more difficult. These costsshould be included when evaluating the desirabilityof adding protection.

IDtivti from ‘l”he U.S. Army Corps of Engineers, “Security Engineer@ W@, ” August 1987, and Sandia National Laboratories, “AccessDelay,” Sand 87-1926,1989. App. A of the ACE manual lists several vehicle barriers including ditches (about $4/foot), concrete-ffledposts ($50/foot),reinforced fences (about $40/foot), etc. For example, a 4-acre site would have a fence of about 2,000 feet. Assuming a ditch on 75 percent and filledposts on the res~ the cost would be $31,000, plus a crash gate at $13,000. In addition, a fence designed to delay attackers on foot perhaps rolls of barbedtape attached to a standard chain-link fence, would cost about $6/foot, or $12,000. Such a fence would be tittle dete~ence to a welkquipped adversary.More formidable barriers would cost over $20/foot. An 8-inch thick concrete wall around the tmnsformer would cost $13.50 per square foot. Athree-phase transformer might involve a three-sided watl of about 25 feet per side plus an additional 75-foot straight wall to shield the opening whileallowing access incasethe transformer has to be removed. The wall might be 25 feet higlL for a total of 3,750 square feet whichwoutd cost about $50,000.The grand total for the example is $106,000.

Chapter 6-Options To Reduce Vulnerability ● 49

Utilities in most parts of the country generallyhave not designed their facilities to be earthquake-resistant, except for nuclear powerplants, yet severalregions besides the west coast are vulnerable.Generating stations are particularly vulnerable toearthquakes unless adequately designed and con-structed. The central Mississippi valley, the southernAppalachians, and an area centered around Indianaare particularly vulnerable to major earthquakes butare much less prepared than California. Review andappropriate upgrading of existing facilities, andapplication of appropriate seismic standards to newconstruction, could avert a major loss of generatingcapacity.

Surveillance

Equipment can be installed at unmanned, keyfacilities to detect intruders. Intrusion detectionsystems include sensors, alarm communication sys-tems, and possibly video equipment to assess thecause of an alarm. Perimeter alarms and motiondetectors would alert utility headquarters or police/military units which could instigate rapid, armedresponse. A rapid response could interrupt an attackand that possibility might deter an attack by a groupsophisticated enough to recognize the problem. Tobe of greatest value, a detection system should becoupled with some sort of physical protection of themain substation components, to reduce the possibil-ity of off-site attack.

A wide variety of intrusion sensors have beendeveloped, ranging from buried pressure sensors toelectric field disturbance detectors to fence-motiondetectors. None is perfect. All sensors have someprobability of failing to detect an intrusion, depend-ing on such specific factors as the installationconditions, weather and geographic conditions. andsensitivity of the sensors. Sensors also may triggernuisance alarms-i.e., alarms caused by spuriousfactors such as animals, weather (e.g., wind or rain),background noise, or failure of the sensor itself.Intrusion detection systems may include a closed-circuit television system for remote assessment ofthe cause of alarms. A detection intrusion system ata substation with a 2,000-foot perimeter would coston the order of $125,000.2

At remote sites surveillance would be less usefulbecause the response would take too long. Saboteurscan cross almost any barrier, leave explosives todestroy critical substation components, and departwithin a few minutes. If several teams operatesimultaneously at different sites, a utility may knowa major attack is in progress but be helpless to doanything about it.

Even at remote sites, however, surveillance sys-tems still would serve two major purposes. Detect-ing and monitoring unauthorized entry would permitthe utility to investigate and presumably discoverand disarm timed explosives. Thus the potentialdamage that one or a few saboteurs can accomplishwould be limited to only one or two sites beforeutilities would have guards out. In addition, someforms of surveillance, such as remote TV cameras,may provide crucial evidence for an investigationeven if an attack is successful.

A related issue is employee training to recognizeand respond to sabotage threats. Reporting suspi-cious behavior near key facilities may uncover plansfor an attack. Alternatively, recognition that sabo-tage and not natural causes has led to damage maylead to the preservation of evidence.

Guards

Detection and delay will do little to stop a serioussaboteur if a human response is unavailable tointervene. A heavily armed response to an actualattack is most appropriate to police or military forces(see below), but private guards can deter someattacks.

Currently, armed guards are used at all nuclearpowerplants. As a matter of routine, nuclear plantlicensees must develop physical security plans,which include the training and use of guards. Awell-trained, armed, and dedicated onsite securityforce is one of the major elements of a nuclearpowerplant security system. Guards are also used atnon-nuclear powerplants to monitor employees andvisitors and vehicle traffic and for perimeter surveil-lance. The training and use of guards at powerplantsvary by utility. Guards generally are not used atsubstations.

?Ibid. App. A of the ACE manual lists perimeter detector costs ranging from $20/foot for fence motion detectors to $40/foot for infrmed systems.For a 2,0(Dfoot perimeter this totals $40,000 to $80,000. A basic control panel would cost around $10,000, including the control unit, power supply,andcommunication module. AC(7I’V system costs around $30/foot adding another $60,000 to the surveillancepackage. Personnel to monitor the systemwould add an operating cost.


The deterrent value of guards depends on theirnumbers, training, capabilities, and orders as well ason the capabilities and motivations of their potentialadversaries and the physical characteristics of thesite. Opportunistic saboteurs and vandals may bedeterred by even a single, unarmed guard. Ruthlessterrorists with the resources to mount a well-planned, violent attack essentially could ignore anyforce less than a well-trained and motivated group ofarmed guards. Barriers and surveillance equipmentcan greatly increase the effectiveness of guards.

Guards are employed in different situations for avariety of reasons: to prevent or detect intrusion,vandalism, and theft; to control people and vehicletraffic; and to enforce rules, regulations, and poli-cies. Although, private security guards performsome functions similar to public law enforcementofficers, often wear uniforms and badges, andoccasionally carry weapons, 3 their legal authoritydiffers in many significant respects from that ofpublic officers. In general, private security guardshave no more formal authority than other civilians inthe United States. A private security guard has onlythat authority which his employer possesses: theemployer’s basic right to protect persons and prop-erty is transferred to the security officer.4

Most guards are not armed and can do littledirectly to halt an attack in progress. Guards are ina much better position to detect suspicious behaviorand report it to management or authorities. Theability of local law enforcement to mobilize rapidlyin the event of an attack would be critical. In thissituation, communication among local law enforce-ment officials, contract security firms, and theFederal Bureau of Investigation is essential.

The typical training period for most securityguards is less than 2 working days. Many guards,including some who are armed, receive less than 2hours of training. Most guard personnel aren’tcognizant of their legal powers or authority. How-ever, this situation may be changing. Becausedemands on security guards and the potential forlegal liability have been increasing in recent years,

a growing number of companies and schools areproviding security training.5 The extent and cost oftraining security personnel employed at electricutility facilities vary by company and by sitedepending on the degree of risk aversion acceptableto management.6

A utility’s decision to use guards at a facilitywould have to address a number of issues: the kindof security coverage needed and costs; the effective-ness of guards in deterring different kinds of attacks;whether to employ in-house security personnel orcontract out for guard services on a temporary orpermanent basis.

Because many substations are located in remoteareas, a related question is how long would it take forcontract guards, if not stationed at the site, to arriveafter a warning has been received. The rate ofdeployment would depend on a number of factors,including the circumstances of the event, and thelocation and resources of the contract security firm.

A utility’s decision to employ guards as a securitymeasure also raises a number of institutional issues.One issue is whether the government should grantpolice powers to utility security personnel. Advan-tages include increased authority and reduced liabil-ity risk. Potential disadvantages include abuse ofauthority (e.g., unnecessary arrests) and the legalimplications of such abuse.7

Another issue is who should pay for the additionalsecurity. Normally, utility commissions allow utili-ties to recover security costs. Before additionalsecurity measures are taken, utilities and utilitycommissions will have to agree on what constitutesa valid need and is in the interest of the consumer.

Coordination With Law EnforcementAgencies

Ongoing communication among utilities andFederal, State, and local law enforcement agencies,is essential to reducing vulnerability. Clear lines ofcommunication provide two main benefits. First,they enable law enforcement agencies to warn a

3Jo~eph &waddy, Bwns ~temtio~ Sectity Servims, Inc., personal communication Jan. 23, 1990. According to *addyt less ~ 2 P~mntof security work involves armed personnel.

‘kXwles Schnabolk+ Physical Security: Practices and Technology (Wobuq MA: Butterworth Publishers, 1983), p. 55.%id.bA~addy, op. cit., footnote 3.@Torrnan D. Bates, “Special Police Powers: Pros and Cons,” Securizy Management, August 1989, vol. 33, No. 8, p. 54.

Chapter 6-Options To Reduce Vulnerability .51

utility of a potential attack, should they learn of suchcircumstances. Second, they allow the utility and thelaw enforcement agencies to coordinate armedresponse plans when attacks occur or seem immi-nent. If utilities are forewarned that an attack islikely, they can take preventive measures such astemporarily increasing spinning reserves or station-ing guards at important facilities.

The North American Electric Reliability Council(NERC) has recommended that utilities establishcommunications with the local FBI office. Regularinformation exchanges with local law enforcementagencies should also be pursued. These are steps thatall utilities could employ at low cost. A utility’sdecision to establish a liaison with the FBI is purelyvoluntary, although most generally implementNERC’s recommendations. The Federal Govern-ment might consider requiring the FBI to maintaincommunications with utilities.

If an attack is detected, whether by guards orremote surveillance, very rapid, armed response maybe required to prevent damage. Such responses mustbe planned and tested beforehand. Considerablecoordination will be required to assure that theappropriate forces are available, know what isrequired, and will be alerted promptly. The forcescould be local or State police, or, as is already beingplanned for facilities vital to national security, U.S.military forces. If no response forces are available ina useful time-frame (a matter of very few minutes),increased hardening and permanent armed guardsare the only options for minimizing damage.

Under some conditions, it might be necessary totemporarily station armed guards, such as theNational Guard, at electric power facilities. Thesetroops could be deployed much faster and moreeffectively if contingency plans have been preparedand studied beforehand.

LIMITING THE CONSEQUENCES

Improve Emergency Planning andProcedures

The behavior of a transmission system followingsimultaneous destruction of several key facilitiescannot be predicted with complete accuracy. Itdepends on the circumstances on the system at thetime as well as on the pattern of destruction.Considerable contingency planning under a varietyof conditions is necessary to ensure that the bestresponses are identified. In cases where there issome warning, operators can revise the pattern ofgeneration and transmission so that more failurescan be accommodated. In addition, operators will berequired to make quick judgments after damageoccurs. Training in recognizing and responding tomultiple, simultaneous losses, which no utility hasyet experienced, will help operators control instabil-ities and keep as much power flowing as possible.The Pacific Gas & Electric Co. has credited its drillsand planning with minimizing disruption after the1989 Loma Prieta earthquake.

Modify the Physical System

Transmission networks are generally designedwith reserve capacity to accommodate equipmentfailure and maintenance requirements, and allow forunpredictable developments in loads and resources.One or two equipment failures should cause nosignificant problems for the customers. Transmis-sion networks could be designed to ride out virtuallyany conceivable attack, but that would requireprohibitively expensive redundancy of equipment,including spare lines in separate corridors. However,some upgrading would limit the extent of theblackout in case of the loss of several key facilities.Analysis of the bulk power system following postu-lated severe damage can identify potential con-straints to keeping at least some of the systemoperating. Some of the improvements that mightprove worthwhile are upgraded control centers,greater redundancy at certain substations, moreprotection devices and interconnections, upgradedlines, improved communications, etc. The Electric

If damage cannot be prevented, the next best thing Power Research Institute is developing highly so-

is to ensure that impacts on customers are as low as phisticated computer systems that could analyze and

possible. Utilities have already installed protectiverespond to abnormal fault conditions, thereby limit-

devices on the transmission networks such that it ising disruption.

unlikely that blackouts would cascade beyond the One counter trend should be noted. Loads ondirectly affected region. Other steps can be taken transmissions lines are increasing as utilities findthat would further reduce the extent of the impacts. opportunities for economic transfers of power.


Increasing competition in the electric power indus-try could further increase these loads.8 Unlessconstruction keeps pace with the increasing loads,the result will be smaller reserve margins. Thegreater the reserve margin, the more opportunitiesutilities would have to bypass damaged facilities.Thus increasing efficiency of use of the transmissionsystem could conflict with reliability of service,especially under the kind of extraordinary condi-tions considered in this report.

Increase Spinning Reserves

When a major failure of generating or transmis-sion capacity occurs, utilities must have replacementcapacity available immediately. Since generatorstake some time to warm up before they can startdelivering power, reserve capacity must be kepton-line. Usually this means several generators areoperated sufficiently below full load so that anyanticipated outage can be accommodated by anincrease in their power level. The usual reserve is atleast equivalent to the largest single unit or transmis-sion line in operation, in accordance with customaryplanning for the possible loss of any one piece ofequipment.

If multiple facilities are sabotaged simultane-ously, the available spinning reserve is likely to beinadequate. Operators will not be able to findadequate replacements for the isolated generators,and many areas will lose power, at least until otherunits can be started which may require several hours.Under such conditions, increased spinning reservelevels could significantly reduce the disruption,depending on the patterns of damage and theremaining available capacity. Utilities are preparedto increase spinning reserves temporarily if they areaware of a specific threat against them such assabotage or major storms. Maintaining higher levelsroutinely would protect against unexpected attacks.

If additional generating capacity is available,operating it as spinning reserve is not very expen-sive. The additional fuel and labor costs are modest.Some parts of the country currently have excesscapacity which may be used for spinning reserves,although load growth is slowly reducing that surplusto historically normal levels. During certain periods,such as extreme peak hours or when multiple units

are undergoing maintenance, surplus capacity is notavailable for increased spinning reserves. Increasingspinning reserves during those periods could requireexpensive new construction.

SPEEDING RECOVERYOnce the system has been stabilized, operators try

to restore power as quickly as possible. Even aftersevere damage, power to parts of the system usuallycan be restored within a few hours by isolating thedamage and resetting circuit breakers. Restoration tofull service and reliability depends on at leasttemporary repair of the damage. The measures hereare intended to eliminate constraints to both near-and long-term recovery.

The benefits of expedited restoration can beextremely large, even if no power outages occur. Forexample, for each day that a large coal-generatingunit is idled, a utility must spend on the order of $1million for replacement power.9

Contingency Planning

As in the two previous sections, advance planningand analysis is vital to minimizing problems. Ifutilities have already analyzed the problems, theyshould be able to act more efficiently. For instance,few operators have ever had to blackstart a generatoror deal with an entire region of mismatched genera-tion and transmission capacity and loads. Planningcan also help with longer term problems such aswhere to get replacement transformers and how toget them to the site. NERC has started to inventorytransformers in order to facilitate emergency bor-rowing. Completion of this task, such that theoperators of all key facilities know where to look toborrow critical equipment, could save precious timein an emergency.

Clarify the Legal/InstitutionalFramework for Sharing

Utilities routinely loan equipment and crews tohelp restore another utility’s power after an emer-gency, when this can be done without jeopardizingtheir own operations. However, utilities normallymaintain spare large transformers only to the extentthat they are needed to permit maintenance and

8US. ConWe5s, Office of Technology Assessment, Electric Power Wheeling and Dealing: Technological Considerations for IncreasingCompetition, OTA-E-409 (Washington, DC: U.S. Government Printing Office, May 1989).

gsee ch. 4 for a discussion of the cost of disabled tits.


replace failures. If these spares are loaned, the owneris risking its own system reliability. From a nationalperspective, it is better to risk reliability in one areathan to keep another area blacked out, but utilitiescannot be expected to willingly sacrifice their ownreliability for the national interest. In addition totheir own economic interests, they may be con-cerned that they will be sued by their customers whosuffer blackouts because backup equipment has beenloaned out.

The Defense Production Act and other nationalemergency laws already permit the government torequisition equipment (with just compensation)needed in case of a threat to the national security, forinstance if a key defense facility is blacked out intime of war. There is no general power to intervenein a major economic emergency that has no nationalsecurity implications, but the legal situation thatwould pertain is complicated.10 State governmentscan guarantee such transfers within their ownboundaries, and utilities can make their own volun-tary arrangements including indemnification. How-ever, a national policy establishing a mechanism todetermine priorities and protect economic interestsmay be needed to expedite action and in cases wherethe equipment would be shipped across jurisdic-tions.

Stockpile Critical Equipment

Rapid restoration of a system damaged by the lossof several large transformers requires finding andinstalling at least temporary replacements. Manyutilities keep some spare transformers in case ofequipment failure. At least one utility keeps spareGeneration Step Up (GSU) transformers for eachplant because of past problems with GSU reliabil-ity.11 However, these spares are typically kept at thesubstation site, near the operating transformers,where a saboteur could readily destroy them alongwith the operating transformers. If a utility is unableto obtain spares, whether from its own system orfrom another utility, the only other option is to ordera replacement from a manufacturer. Custom-designed units may require a year or more tomanufacture.

A secure source of emergency transformers couldcut many months off replacement time. Such asource could be a stockpile of the most commonlyused types of transformers, available to any utility inan emergency, or it could be individual backup unitsfor each vital substation. In either case, the unitswould have to be stored in a secure location, perhapsat military installations.

Backups for each substation would effectivelysolve the problem of long-term blackouts, but at ahigh price. The effectiveness of a common stockpilein reducing vulnerability depends on several factorsrelating to the nature of the destruction, the physicalcharacteristics of the system, the availability ofspares from other sources, and the number and typeof spares in the stockpile.

The wide variety of transformers in use compli-cates the development of a stockpile. The majorcriteria are the input and output voltages and thepower level. There is also a wide choice of lesscrucial factors such as insulation level and tolerablerange of voltages.

Because voltages on transmission and distributionsystems are standardized, there are only a fewcommon and important combinations of step-downvoltages. Six to eight key combinations of voltagescould be identified for developing model transmiss-ion transformers. While there are many othervoltage combinations and functions of transformers,those factors would not be the key consideration inan emergency.

GSU transformers present a more challengingstockpiling problem. Because generator output volt-ages are designed to maximize operating efficiencyand not according to standardized values, voltagesrange from 12 to 30 kV.12 A stockpile of GSUtransformers would have to make use of the abilityof generating units to produce a small range ofoutput voltages (±5 percent of nominal), althoughwith a slight loss of efficiency.13 Also, ABBtransformer engineers have suggested that it shouldbe possible to design transformers to work with avariety of input voltages, in which case most 345-kVtransformers could be backed up by two separatemodels and most 500-kV transformers by three to

lwokrt po~, con~sio~ Resewch Service, personal communication Feb. Q 1990.llBer~d p~termc~ American Electric Power, perscmid COmIINlrdCd.iOIlj October 1989.12u.s. CowsS, office of Technolo~ Assessment, op. cit., footnote 8, p. 91.13D,G. F~ and H.W.B=q (~s.), Sta~ardHandbookforE /ect~caZ Engineers @Jew York NY: McGmw-I-Iill, 1978), p. 7-34.

54 ● Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage— .

four common single-phase models.14 Assumingsimilar numbers for 230- and 765-kV units, astockpile of GSU transformers could be based on atotal of around one dozen models. Another variableis the physical configuration. The bus from thegenerator carries an extremely high current so thelosses can be high. Therefore, the substation andGSU are designed to minimize the distance thiscurrent has to travel, which may call for a custom-designed connector.

Power ratings, insulation levels, and impedancesfor both GSU and transmission transformers wouldhave to be selected based on a trade-off of costs andexpected application, and efficiencies would besuboptimal. Around 20 transformer models wouldcover most critical applications. However, a stock-pile would almost certainly require more than oneset (three single-phase or one three-phase transform-er) of transformers of each model. For example, ifsaboteurs disabled four or more sets of transformers,it is probable that at least two of the sets would havethe same voltage combinations and would be re-placed by the same model. The number of units ofeach model would have to be selected based on anassessment of the likelihood of serious sabotage.

Stockpiling raw materials for the manufacture oftransformers may be another way to reduce produc-tion time in case of an emergency. The customarypractice is to design the transformers frost and thenorder the materials because of the customized natureof the product and costs. Copper, for example, isspecial-ordered for each transformer (the copperwire is rectangular, not cylindrical, with particularwidth and height) and takes about 10 to 16 weeks onorder. Core steel, porcelain, load-tap-changers(LTCs) are similarly special-ordered. If existingdesigns and stockpiled materials are used, newtransformers can be produced in less than 6 months(in contrast to normal procurement of over 12months).

Additional spare transformers would be expen-sive. A set of extra-high-voltage transformers costson the order of $2 to $5 million. If all importantsubstations are to be backed by duplicate transform-ers, the capital cost could range up to many hundredsof millions of dollars, depending on the definition ofimportant. Common transformers would have to be

designed for use in a variety of applications, so theyare unlikely to fall at the low end of the cost range.This is particularly true for the GSUs, which wouldrequire a mechanism to accommodate a range ofinput voltages. Assuming a stockpile of 40 trans-former sets (two of each model), the capital costwould be on the order of $100 to $200 million.Building and maintaining s torage faci l i t ies wouldadd to the cost.

The suboptimal characteristics of common trans-formers would also result in substantial indirectcosts. To match the voltage capability of a nonop-timized GSU, the generator would need to operate atother than its optimal voltage output, resulting inslightly degraded efficiency. Further, the trans-former’s generic characteristics could result insignificant efficiency losses, for example if it isoversized for the generator and as a result operatesat partial load. Assuming a combined efficiency lossof 1 percent, the cost at a 500-MW coal plant wouldbe on the order of $2 million during the year requiredto obtain a custom-ordered replacement transformer.Presumably, however, this cost would be much lessthan the cost of not having a stockpiled transformerwhen it is needed.

There would also be costs associated with trans-porting the transformer from storage to the damagedsite. Both the time required and the cost depend onthe location of the stockpile and the damaged site.Also, because a common stockpiled transformerwould not be perfectly matched to the specific siterequirements, it would probably be replaced by anew or repaired transformer, and returned to thestockpile, doubling transport costs. Overall how-ever, the cost of transport is a small fraction of thecapital cost of a transformer.15

A decision to establish a stockpile would have toaddress issues of how many units and of whatdesign, where to store them, under what conditionsto release the equipment, and how to transport it.Priorities for the use of stockpiled equipment shouldmore than one utility have a need may also needresolution.

Payment for the stockpile is another critical issue.Spares are typically held as an essential part of the

14~x ctis, Wmger of Tecbnic~ SUppOfi Westinghouse/ABB (now ABB), personal commticatio~ Jtiy 27, 1989.

ls~lton peel, Wmgm of operations, Virginia Electric Power CO., personal communication% JI@ 19, 1989.


operation of a system and are included in the ratebase. l6 Currently, neither utilities nor State utilitycommissions have found compelling reasons tostockpile critical components beyond normal spares.To develop a stockpile paid for by utilities and theircustomers, both the utility and the utility commis-sion must agree that the expenditures are a valid costof business in the interest of consumers.

Assure Adequate Transportation Capability

Moving large transformers is difficult under anycondition. Frequently, bridges have to be temporar-ily braced and overpasses removed. Under emer-gency conditions, transportation could be a seriousconstraint. The contingency planning discussedabove should identify the transportation problemsthat could slow delivery of transformers to keyfacilities (or removal from other facilities for use asreplacements). Utilities can move to eliminate asmany of these problems as possible. For instance, ifthe rail lines that brought in the transformers haveclosed, alternative routes could be developed.

If transformers are stockpiled and many arerequired at once, transportation equipment itselfmay be a constraint. Large transformers are movedon specialized rail cars called Schnabel Cars. Thereare only 13 in the country (plus 1 in Canada), andsome handle only one type of transformer or arelimited in capacity. A serious stockpiling effortshould be accompanied by a program to ensure thatsufficient Schnabel Cars will be available. Thismight involve the production and stockpiling of thecars, or just the conversion of all existing cars tohandle all transformers. If only single-phase trans-formers are stockpiled, conventional transportationequipment is probably adequate.

Monitor Domestic Manufacturing Capability

U.S. manufacturing capability of transmissionequipment, particularly the large transformers, hasdeclined and imports have risen. The use of importedequipment per se is not a problem if it is the leastexpensive, best quality equipment available. How-ever, some utilities are concerned that in an emer-gency, they will have less leverage with foreigncompanies to assure expedited manufacture ofcritically needed transformers, and that equipmentwill take longer to deliver from abroad. Repair ofdamaged transformers also would be delayed if they

had to be shipped abroad and back. At this time, it isnot possible to determine what would have to bedone to maintain the U.S. industry, or how greatwould be the value during emergencies. However,the situation would appear to warrant continuedattention and analysis by the Department of Energyand the Department of Commerce. National securityconcerns may dictate the maintenance of someminimum capability even if it is not justifiedeconomically under normal conditions. Alterna-tively, the incentive for stockpiling may increase ifsupply from abroad can’t be considered to be asexpeditious.

GENERAL REDUCTION OFVULNERABILITY

The measures discussed above could be imple-mented specifically to reduce the vulnerability ofexisting bulk power systems. Other measures havenot been listed because they would be far tooexpensive to retrofit. However, as the system grows,new construction is required that might emphasizedifferent approaches. Vulnerability to massive de-struction has never been a design parameter inelectric power systems (except for nuclear power-plants). Making it a parameter could guide theevolution of future systems toward inherently lessvulnerable technologies and configurations. Vulner-ability is not likely to be the key factor in most cases,but it could swing an otherwise close decision.

Less Vulnerable Technologies

Existing equipment has not been designed toresist sabotage. It is possible that alternative trans-mission towers, insulators, transformers, etc., couldbe more resistant than current practice. The ElectricPower Research Institute, equipment manufacturers,and DOE might be encouraged to study how to dothis. In some cases, alternative designs may beavailable now that would be less vulnerable eventhough that was not one of the design criteria.

For example, underground cables are less notice-able and less accessible than overhead lines. There-fore they are less likely to be targets of casualsaboteurs, and somewhat harder to attack for seriousterrorists. They also avoid drawing attention tosubstations. Underground cables should also bemore resistant to major natural disasters, since they

16~id,

54 ● Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage—

are not exposed to wind, flying objects, or collapsingtowers. However, underground cables are muchmore expensive to manufacture and install. Further-more, maintenance and repair, though needed lessfrequently, are more difficult and expensive. Ifcables were destroyed, whether by saboteurs orearthquakes, replacement would take considerablylonger than for overhead lines.

At present, underground cables usually are usedonly in heavily populated areas. In areas where landis very expensive, the narrower right-of-way neededby underground cables may more than makeup forthe difference in equipment and installation cost. Itis likely that there will be a growing trend towardunderground cables because of increasing opposi-tion to overhead lines, due in part to aesthetics(property values) and to increasing concern over thehealth effects of electric and magnetic fields associ-ated with transmission lines.17 Buried cables virtu-ally eliminate electric fields and reduce magneticfields. Reduced vulnerability could be an addedincentive.

There would also be some advantages in movingtoward greater standardization of key equipment, inparticular the large transformers. Some of thepotential benefits of standardization over the longterm are increased opportunities for sharing duringemergencies and some reduction in manufacturingtime and cost. It would not be practical to retrofitexisting facilities or change existing system volt-ages, but as new capacity is built, it could be guidedtoward a more limited family of voltages. However,some of the diversity found in our present system isa result of the diverse operating conditions thatutilities face and their special needs. Each trans-former carries a huge amount of power, and even atiny loss of efficiency is very expensive. Hencestandardization would impose serious additionaloperating costs if it sacrifices precise optimizationfor particular applications.

The transformers used in substations to reducevoltage from the transmission system to a distribu-tion system are already standardized to a large extentin that there area limited number of combinations ofvoltages. If a stockpile were to be established (as

discussed above), relatively few models would berequired to backup most substations.

GSUs are less standardized than step-down trans-formers. They usually are designed, engineered, andmanufactured to meet a utility’s particular needs. Itmay be possible to design GSUs with multiplelow-side voltage levels to fit a variety of generators,according to the National Electrical ManufacturersAssociation although that is not now done. Thesewould cost more than standard transformers andprobably result in less efficient generator andtransformer operation.

Decentralized Generation

Until fairly recently, generating stations weregrowing in size and remoteness from the load centersbecause of economies of scale and difficulties insiting in densely populated areas. However, whenlarge amounts of power are concentrated in a fewgenerating and transmission facilities, the disruptionthat is caused by a few failures can be very large.Small generating plants are individually no lessvulnerable than large plants (in fact they may bemore so because fewer employees are stationedthere), but the impact of their loss is less. Saboteurswould have to target more facilities to cause thesame disruption. For example, destruction of electricpower systems was never a major part of U.S.strategy in the Vietnam War, because most facilitieswere too small and scattered to be primary targets.18

If, in addition, smaller plants can be sited close toload centers, the shorter transmission lines providefewer opportunities for disruption.

To some degree, the trend toward larger plants hasbeen reversed. No very large (over 1,000 MW)plants, either nuclear or coal, have been ordered forover a decade. Many co-generation plants have beenconstructed that are directly at a load center. Smallerplants offer benefits such as shorter constructiontimes, better matches with uncertain load growth andgreater operating flexibility. Reduced vulnerabilitydoes not appear to have been a significant factor inthe choices that have been made to date.

It is not clear how far this new trend can continue.That may depend in part on how competition

IVU.S+ ConWess, C)KIW of Tec~olo~ Assessment Biological Efiects of Power Frequency Elecm”c and Magnetic Field-Bac&rOu~ paPerYOTA-BP-E-53 (Springi3eld, VA: National Technical Information Service, May 1989).

lsFedeM Emergency IVWagement Agency, “Dispersed, Decentralized and Renewable Energy Sources: Alternatives to National Vulnerability andWar,” December 1980, p. 28.

changes the institutional structure of the industry19

and on the relative costs of fuels (natural gas isparticularly suitable for small plants). Economies ofscale have not disappeared. They merely have beenoverwhelmed by other factors, some of which, suchas high inflation and construction stretchouts, wouldnot be expected to recur in the future.

A related issue is the use of transmission corridorsand substations for multiple circuits. Utilities oftentry to maximize the use of corridors because it iseconomical to do so and increasingly difficult toestablish new corridors. However, this concentrationincreases vulnerability. Utilities plan for commonfailures of adjacent facilities (e.g., a plane crashing

Chapter Uptions To Reduce Vulnerability ● 57—.

in the corridor could bring down all the lines) butsaboteurs could attack several multi-circuit corri-dors simultaneously with very great impact. The useof single-circuit corridors and substations, whereverpractical, would reduce the impact of each attackcommensurately.

Vulnerability considerations are not likely to bedominant if traditional approaches prove much moreeconomical. However, under some conditions, itmay be worthwhile to include vulnerability as afactor when siting and sizing new facilities. Furtherstudy of the relationship between decentralization,economics, and vulnerability may be warranted.

Chapter 7

Congressional Policy Options

All the measures discussed in the previous chapterwould reduce the vulnerability of the electric powersystem. Some are already being implemented by thepower industry, as utilities become more aware ofthe potential for major disasters. However, the levelof implementation of these steps could be increased,and other effective measures are available which theindustry is less likely to implement on its owninitiative.

Some steps, such as planning, analysis, and legalarrangements, need not cost much, but could signifi-cantly increase preparedness in case of disaster.Others, such as stockpiling, would require consider-able investment. The following analysis groups thespecific measures according to whether they arelikely to be implemented under present trends; or ifthey would require small expenditures; or whetherthey would be moderately to quite expensive. Thesegroups are shown in table 7. Some of the measuresare shown in more than one group, representingdiffering levels of implementation, or analysis in oneand implementation in another.

The desirability of further government involve-ment in a largely private enterprise is a matter ofopinion. There is a clear government role in handlingemergencies and protecting the public health andsafety (e.g., minimum standards for nuclear reactorsafety, and direct implementation of airport secu-rity). It is less clear how far the government shouldgo in preventing emergencies that have majorindirect but little direct impact on the public. If, inthe judgment of policymakers, the threat is greaterthan is being recognized by industry, and theconsequences have grave ramifications for thepublic, then policy action may be justified. How-ever, it should be noted that some of the initiativesdiscussed here will be controversial on ideologicalas well as practical grounds.

PRESENT TRENDS

Utilities are moving to reduce vulnerabilitythrough improved security and planning. The Na-tional Electric Security Committee of the NorthAmerican Electric Reliability Council (NERC) hasmade a series of recommendations intended toreduce the risk of major damage occurring and to

expedite restoration of service afterwards. TheEdison Electric Institute has a security committeethat coordinates information for physical protectionfor its member utilities. In addition, there are severalgovernment programs that analyze vulnerability andaddress weaknesses. These activities are describedin chapter 5.

Collectively, these steps are reducing vulnerabil-ity, and should lead to further improvements.However, the improvements are unlikely to be asgreat as could be realized if Congress takes a moreactivist role. Furthermore, the generating and trans-mission overcapacity of the last 15 years is diminish-ing. This overcapacity was expensive, but it had theunintended effect of providing reserves that wouldhave been highly beneficial if a major disaster hadoccurred. It is likely that the increase in vulnerabilitydue to decreasing reserve margins outweighs theimprovements in security underway. The advan-tages and disadvantages of leaving the decisions inthe industry’s hands follow.

Advantages

If decisionmakers see the threat of massivedestruction as quite low, the measures alreadyunderway may be adequate. The design and opera-tion of U.S. electric power systems are quiteadequate for all emergencies except the loss ofseveral key facilities at one time. Considerabledamage can be accommodated without greatlyaffecting customers. Only extraordinary disasterswould cause more than short-term, localized black-outs. The actions utilities are taking will furtherreduce the range of disasters that can have devastat-ing consequences. With the additional attentionbeing paid to earthquakes and hurricanes, prepara-tion for natural disasters may be sufficient to handleall but very unlikely events.

Under most plausible sabotage or natural disasterscenarios, the utilities themselves would be biglosers, from lost sales and damaged equipment.Therefore they also have incentive to achieve areasonable level of defense. Leaving the decision-making to the utilities on investments to protectagainst disasters minimizes the risk of a commit-ment to expensive measures that prove ineffective.

–59–


Table 7—Policy Package Components

ModeratePresent Low to majortrends cost investment

A. Preventing damage1. Harden key substations. . . . .2. Surveillance . . . . . . . . . . . . . .3. Guards . . . . . . . . . . . . . . . . . .4. Improve coordination . . . . . . . X

B. Limiting consequences1. Improve emergency plan/

procedure . . . . . . . . . . . . . . . . X2. Modify the physical system. .3. Spinning reserves . . . . . . . . .

C. Speeding recovery1. Contingency planning . . . . . . X2. Clarify legal framework . . . . . X3. Stockpile critical equipment. .4. Assure adequate

transportation . . . . . . . . . . . . . X5. Monitor domestic

manufacturing . . . . . . . . . . . . .D. General reduction of

vulnerability1. Less vulnerable

technologies. . . . . . . . . . . . . .2. Decentralized generation . . . X

SOURCE: Office of Technology Assessment, 1990.

x

xx

xx

x x

x

x

x

x

xx

Disadvantages

Terrorist attacks are largely unpredictable. Thelack of such attacks in recent years is no guaranteethat there won’t be an upsurge in the near future.Several international situations, including the Co-lombian drug wars, separatism in Puerto Rico,tensions in Central America and the Middle East,and even the shifting political climate in EasternEurope could lead to efforts to cause harm to theUnited States by surreptitious means. Electric powersystems could be a prime target for such attacks.

Even though some utilities are taking steps forprotection, it is unlikely that all will implement even. .minimal measures. Some managers are bound toignore low-risk, high-consequence events until theymaterialize, but by then it would be too late. Someareas could suffer extensive blackouts, at greateconomic and social cost, that might be averted or atleast minimized if the government assures that thenational interest is given due consideration.

LOW-COST GOVERNMENTINITIATIVES

Most of the measures in this package are alreadybeing addressed to some extent, and were includedin the preceding section. The purpose of this package

is to assure that these efforts are adequate, especiallythose that are voluntary for utilities. In addition,initiatives with potentially important long-term im-plications but which would not require large expend-itures of government or private funds are included.This group of options is intended for those whoconclude that electric power system vulnerability isa problem that requires greater attention, but doesnot justify major financial commitments.

Several of the steps discussed below suggest anapproximate budget level for implementation by theDepartment of Energy (DOE) or other agency. Thisstudy has not analyzed the effectiveness or effi-ciency of any of the government agencies men-tioned. Therefore it intends no suggestion as towhether the activity could be absorbed within theexisting budget by simply increasing efficiency, orif less important activities could be cut back, orwhether theincreased.

Planning for

overall budget would have to be

Specific Initiatives

Emergencies

Most utilities with vital facilities appear to haveestablished contact with the Federal Bureau ofInvestigation (FBI) to facilitate warnings that sabo-tage efforts are likely. DOE could perform a surveyto confirm this coordination (which in itself wouldencourage utilities to establish and maintain thesecontacts) and perhaps sponsor regular meetingsamong utilities with critical facilities and the appro-priate law enforcement agencies. This activitywould require perhaps $100,000 in DOE’s budgetfor the Office of Energy Emergencies (OEE).

DOE could also play an important role in coordi-nating utility emergency plans. Many of OEE’sactivities have been concerned with national secu-rity issues—assuring that vital military and indus-trial facilities will not be crippled by power short-ages during an international crisis. Less attention hasbeen paid to the economic damage that could beinflicted on the civilian economy. For instance, theDepartment of Defense (DoD) has a list of transmis-sion substations that are vital to militarily importantfacilities, but DOE has no equivalent list forfacilities vital to major civilian load centers. OEEcould expand its cooperation with NERC, individualutilities, and State and local governments to analyzea wide range of disasters. OEE could then help theutilities and local police (or other agencies) plan

Chapter 7-Congressional Policy Options ● 61

emergency responses. These same exercises couldinclude emergency planning to limit the conse-quences of damage and speed recovery (e.g., contin-gency planning for locating and transporting spares).All these activities could require OEE expendituresof several hundred thousand dollars annually, de-pending on how rapidly the analyses and planningexercises are to be completed and how often theywould have to be updated. The Federal EmergencyManagement Agency (FEMA) and other govern-ment agencies should also have a role in thisemergency planning.

Increased Spinning Reserves

Increasing spinning reserves beyond present lev-els would have to be either mandated or paid for bythe government. Additional equipment would haveto be kept operating, which incurs manpower, fuel,and maintenance costs. In some cases, low-cost unitswould have to be operated at less than full load tosupply spinning reserves because other unitscouldn’t be operated at the necessary levels. Con-struction of new generating equipment would alsobe required if the installed capacity was inadequateto support higher reserves, as is becoming true inmany parts of the country. Both the costs and thevalue of increased reserves are uncertain. Utilitieshave not yet determined the cost of spinning reserveas a separate, unbundled service to be purchasedunder competitive generation. A DOE study, possi-bly done in cooperation with NERC, could be ofvalue to determine the costs of increased spinningreserve and the value if widespread damage doesoccur.

Increased Sharing of Spares

Congress can consider legislation to encouragethe sharing of backup equipment, which utilitieswould otherwise consider necessary for their ownsystem. This legislation would establish a forum fordetermining priorities in a national emergency andrelieve lending utilities of liability for power outagesin their own territory stemming from the absence ofthis equipment. The purpose would be to improvethe chances that spare transformers and other keyequipment are available where most criticallyneeded. The first step would be to request a legalanalysis, perhaps from the Congressional ResearchService, to determine the applicability of existinglegislation to a situation of a major, long-term powercrisis that does not have great national securityimplications. It also could be beneficial to have DOE

analyze how to include such sharing of otherwiseunavailable equipment in the emergency planningdiscussed above.

Assuring Adequate Equipment Supply

The future of the electric equipment supplyindustry is of concern to both DOE and theDepartment of Commerce (DOC). A joint study ofboth its competitiveness and its role during emer-gencies would establish whether there is a govern-ment interest in maintaining particular capabilities.This study would not have to be very large. DOCalready has studied the competitiveness of theindustry. Utilities and the supply industry, both hereand abroad, should cooperate in determining howequipment would be handled during an emergency.

Analyze Vulnerability Implications ofFuture Growth

DOE could also consider how the long-termevolution of the industry could be guided towardreduced vulnerability. Analysis of different technol-ogies (e.g., underground cables) and configurations(e.g., small, dispersed generation) could determinethe relative vulnerability, costs, operability, etc. Inaddition, the study would consider how to get theindustry to give low-vulnerability options properconsideration. This would be a complex, demandingstudy with many different lines of analysis.

Advantages

This package of options would raise the visibilityamong utilities of the necessity of preparing formajor attacks. Advance emergency planning s h o u l dimprove the handling of a disaster and the recoveryafterwards, at least if the disaster conforms toanticipations. Few attacks would be deterred by thispackage, but the impact of some could be reduced.This package would also raise the priority given tosuch preparation by government agencies and pro-vide the analytical basis for further steps. Theseoptions should lead to a useful reduction in vulnera-bility without requiring much investment by eithergovernment or industry.

Disadvantages

There are no real disadvantages to this package.The main question is whether the modest gainsjustify the modest costs. It is impossible to quantifythe benefits of this package relative to present trends,but they are unlikely to be major, at least in regard

62 ● Physical Valnerability of Electric Systems to Natural Disasters and Sabotage

to terrorist attacks. There are too many differentways in which the system can be attacked toanticipate all of them. Advance planning by utilitieshas obvious value, but it would still be easy tooverwhelm these preparations with a large-scaleattack. Even routine vandalism, including shootingat transmission lines and substations, would not begreatly deterred. The studies proposed could beuseful, but unless the results are implemented, theywould provide no significant benefits.

MODERATE AND MAJORINVESTMENTS TO REDUCE

RISKSIf the initiatives discussed above are seen as

inadequate, the next step is to ask what could beaccomplished at higher cost. There are severaloptions outlined in the previous chapter that entailconsiderable cost but promise significant reductionin vulnerability, at least under some conditions.Utilities are not likely to undertake these measureson their own. The measures are intended to addresslow-probability, high-consequence events that utili-ties do not consider sufficiently probable to includein their reliability considerations. If policymakersfind that national interest considerations require thatthese investments be made, it is likely that thegovernment will have to at least share expenses orcoerce utilities. Sharing expenses will call forsignificant government expenditures at a time ofconsiderable budget difficulty. One possibilitywould be a kind of users fee: a small, temporary taxon power sales. For instance, a tax of 0.01 cent perkilowatt-hour (raising an 8 cent/kilowatt-hourcharge to 8.01 cents) would produce almost $300million per year while remaining virtually invisibleto all but the largest users. If imposed for a year ortwo, this tax would pay for most of the proposalsdiscussed here. This approach is already used bysome States to fired energy studies, for example.However, the fact that such a tax would not beobvious does not justify it if the need for governmentinvolvement is seen as very small.

Specific Initiatives

Protect Facilities

Protecting key facilities, particularly substations,would significantly reduce the risks of long-termdamage, especially from low-level threats (unso-phisticated saboteurs and vandals). The problem is

to determine which facilities are worth protecting,what measures to take, and how to pay for them.DOE presumably would identify the most importantfacilities if the analyses of the previous section areperformed. Depending on the decrease in vulnerabil-ity desired (i.e., how many areas are of concern, theacceptable duration of blackouts, and the level ofreliability required after a disaster) there could be asfew as 30 or as many as 150 facilities that wouldrequire protection to significantly limit the long-term disruption following a multi-site attack. Theexact protection measures-hardening, surveil-lance, guards—for each facility would depend on itsimportance, physical characteristics and location aswell as on the nature of the anticipated threat. BothDoD and DOE have extensive experience in protec-tion design though they may not have applied it tomany substations. These agencies could expand onDoD’s Key Assets Protection Program to includedesigns for physical protection. The utility ownershould also be involved in this exercise to ensure thatthe physical protection and its implementationwould not interfere with the operability of thefacility.

The cost of physical protection such as remotesurveillance equipment and walls around the trans-formers would be highly variable, but the one-timetotal might be on the order of several hundredthousand dollars for each substation. This is only afew percentage of the cost of the facility, but it is stillsignificant. Stationing a guard during off-hours(about 130 hours per week) would entail an annualcost that might be on the order of $50,000 to$100,000. It is likely that some utilities would bereluctant to make these changes voluntarily. Thebenefits (e.g., reduced threat of a major blackout)considered in arriving at the level of protectionspecified, accrue largely to the users of the power,not to the utility. Therefore it is likely that thegovernment would have to mandate these improve-ments or pay for at least part.

Make Power Systems More Resilient

The analysis that identified key facilities presum-ably would also suggest opportunities for modifica-tions (e.g., upgraded control centers, improvedcommunications) to the physical system that wouldhelp maintain reliability following major damage tothe system. However, getting these modificationsimplemented is likely to be difficult because noappropriate policy tools exist. Utilities build their

Chapter 7Congressional Policy Options ● 63

bulk power systems according to industry standardsfor reliability. Other than certain licensing proce-dures and interstate economic regulation, the Fed-eral Government has little direct influence on howtransmission systems are built and operated. TheFederal Government does not tell utilities when tobuild more lines, how to operate them, or how toassure reliability. Unlike upgraded physical protec-tion, which involves decisions on relatively few keyfacilities, system improvements are likely to entailmany small modifications. Voluntary cooperationon the part of utilities would be essential.

One way would be for DOE to establish a programto help utilities identify weak points that wouldhamper recovery from a widespread attack, and atleast share the costs of corrective action. Utilitieswould be particularly uninterested in extremelyexpensive physical modifications, such as increasedgenerating and transmission reserves. Utilities areconcerned with building new capacity to meetgrowing demand, but not to increase reserve marginsabove the levels they find prudent. Any estimate ofthe level of funding that would be required is highlyspeculative at this time because analyses showingwhat would be needed have not been conducted.

Stockpile Transformers

Stockpiling of transformers beyond the spareskept for customary reliability purposes is also oflittle interest to utilities, though there has been atleast one case of the lack of a spare keeping alow-operating cost, nuclear powerplant inoperablefor a considerable period. The total cost of establish-ing a stockpile would be large, perhaps $100 to $200million. Requiring utilities to backup each import-ant transformer would cost several times as much.However, the cost of either approach would be smallcompared to the benefits if several substations aredestroyed simultaneously. A transformer stockpilewould be needed only to counter terrorist threatssince natural disasters (or even casual attacks) arevery unlikely to damage more than one or twosubstations. The likelihood of a major assault isoutside the scope of this analysis. If policymakersand the industry are convinced that the threat is

sufficient, a government-industry cooperative ven-ture might be possible. In addition to establishing thestockpile, decisions must be made on where to locateit, how to maintain it, how to allocate the transform-ers in case of a major emergency, and how toexpedite their transport. Considerable advance plan-ning and analysis must be conducted before imple-mentation. DOE and FEMA might cooperate withthe industry on these studies.

Advantages

Collectively, these steps would greatly reduce thevulnerability of the U.S. electric system to the kindsof attacks (see ch. 2) that have been experienced inthe United States. The risk of major disruption fromsmall-scale terrorist attacks would be virtuallyeliminated. In addition, normal operation should bemore reliable because of greater reserve margins.

Disadvantages

Several of these steps could be very expensive(e.g., greater reserve margins, stockpiling). Appor-tioning these costs among utilities, rate-payers, andgovernment will be difficult unless a general kilo-watt-hour tax, as discussed above, is imposed.Furthermore, power systems would still be vulnera-ble to sophisticated saboteurs, including sophisti-cated terrorist groups as well as national comman-dos. These measures would make destruction moredifficult and perhaps reduce the damage, but theywon’t eliminate the greatest concerns. Furthermore,even greatly enhanced resistance to sabotage islikely to simply move the problem somewhere else.For instance, small groups deterred from attackingsubstations could simply shoot transmission linesout. While the impact of a single incident would bemuch less dramatic and lasting than that of blowingup several substations, it could be repeated fre-quently over a wide geographic area, achievingmuch of the same disruption. Alternatively, thesaboteurs could turn to telecommunications, watersupplies, or other infrastructure elements. Thus, it isquestionable how much protection would be pur-chased by these options for society as a whole.