would cause major problems because few facilities are designed to withstand such an event.

Sabotage could cause the most devastating blackouts because many key facilities can be targeted. Substations present the greatest concern. The transmission lines themselves are even easier to disrupt because they can be attacked anywhere along the line, but they are also much easier to repair. Generating stations are somewhat inore difficult than substations to attack because they are manned and often guarded.

Substations are used at generating plants to raise the low voltage of the generator to the level of the transmission system, and near load centers to reduce the voltage for the distribution network. The former are partially protected by the routine activity at powerplants, but few of the latter have any more defense than a chain-link fence. In some cases, an attack can be carried out without entering the facility.

The destruction of two or three well-selected substations would cause a serious blackout. In many cases, most customers would be restored within 30 minutes, but this damage would so reduce reliability that some areas would be vulnerable to additional blackouts for many months. Virtually any region would suffer major, extended blackouts if more than three key substations were destroyed. Some power would be restored quickly, but the region would be subject to rolling blackouts during peak demand periods for many months. The impact would be less severe at night and other times when demand is normally less than peak, because utilities then would have a better balance of supply and demand. The greater the generating and transmission reserve margin, the less would be the impact on customers, because it is easier for utilities to find ways to get power delivered despite the damage.

Current Efforts To Reduce Vulnerability

Utilities historically have expended great efforts to ensure reliability, but only over the past few years have they started to take seriously the possibility of massive, simultaneous damage on multiple facilities. Awareness of the threat, however, has not yet led to the implementation of many measures to counter it. Few if any utilities plan their system and its operation to accommodate multiple, major failures, and key facilities are still unprotected.

Most of the actions the industry has taken have been instigated by the North American Electric Reliability Council (NERC) and the Edison Electric Institute (EEI). NERC completed a major study of vulnerability in 1988. Some of the recommendations have been adopted, while others are still under review. EEI has a large and active security committee which facilitates information exchange on physical protection of facilities.

The Federal Government's role for the most part has focused on national security issues-how to keep facilities operating which are vital to the United States during times of crisis. There has been less concern over the damage to the civilian economy that a major power outage would cause. The National Security Council is the lead agency for emergency preparedness, with the Federal Emergency Management Agency serving as adviser. Both of these agencies consider many vulnerabilities in addition to energy. Energy concerns are included in the new Policy Coordinating Committee on Emergency Preparedness and National Mobilization (PCC-EP/NM).

The Department of Energy (DOE) has prime responsibility for energy emergencies. DOE's Office of Energy Emergencies (OEE) was created to ensure that industry can supply adequate energy to support national security and the Nation's economic and social well-being. Most of OEE's activities have been directed at national security issues, but other efforts have included information exchanges with State governments, disaster simulations, and contingency planning. OEE also operates the National Defense Executive Reserve Program, which recruits civilian executives from the electric power industry among others to provide information and assistance in case of national emergency. DOE also has established a threat notification system to alert energy industries to potential problems.

The Department of Defense administers the Key Assets Protection Program. The Program's purpose is to protect civilian industrial facilities essential for national defense from sabotage during a crisis. The Program has identified electric power facilities required for vital military installations and defense manufacturing areas and coordinated plans for their protection with the owners.

Two trends that may increase vulnerability should be noted. First, the U.S. electrical equipment manufacturing industry has declined with the slow

Chapter 1 Introduction and Summary • 5

down in utility growth. Many production facilities have closed and the skills of their work forces have been largely lost. In addition, imports of equipment have risen to about 20 to 25 percent of the total market, and most U.S. production capability is controlled by foreign companies. The concern regarding vulnerability is that in a major emergency, say if all the transformers at several substations are destroyed, foreign companies may lack the incentive U.S. companies would have in expediting the restoration of service. If a worldwide resurgence of growth has filled their order books, will foreign companies accord adequate priority to U.S. emergency needs? There is no definitive answer to this question. Some observers see no problem while others are quite concerned.

Second, power systems' reserve margins are dropping as growth in demand exceeds construction. Reserve margins have been unusually high and still are in some areas, so utilities find this trend economically beneficial. If a major disaster such as discussed in this report occurs, however, extra reserve margin would be extremely valuable in restoring service to some customers. Utilities would have additional options in finding ways to generate and transmit power. These options are disappearing as margins return to planned levels.

Policy Options To Further Reduce
Vulnerability

Measures to reduce vulnerability can be grouped according to whether they prevent damage to the system, limit the consequences of whatever damage does occur, or speed recovery. An obvious way to prevent damage is to improve physical security and earthquake resistance for key facilities. The most problematic sites can be fairly well-protected against casual or unsophisticated attacks. The initial cost for walls around the transformers, crashresistant fences, and surveillance systems would be a few percent of the replacement cost of the facility. Protection against a sophisticated attack would be extremely expensive, and probably not very effective unless response forces are near.

However, even if key facilities are protected, there is little that can be done to protect transmission lines against a saboteur with a high-power rifle. It is easy to destroy insulators on a transmission tower or the line itself, either of which will incapacitate the entire line. Such damage can be repaired quickly if

sufficient replacements are on hand, but the saboteur can repeat it even more quickly in a different portion of the line or on other lines. Key transmission lines can thus be kept out of service (or at least kept unreliable) for long periods.

Protection of key facilities can also be enhanced by improved planning and coordination with the FBI to provide warning, and police or military forces to provide rapid response. Utility employee training can also be expanded to include greater awareness of suspicious activities and recognition of sabotage, so warning can be given to other facilities. These suggestions also have been made by NERC's National Electric Security Committee and have been adopted by NERC's Board of Trustees in October 1988.

Measures to limit the consequences of damage include improved training of system operators to recognize and respond to major perturbations, improved control centers and other system modifications, and increased spinning reserves. The intent of these steps is to isolate the damaged areas and keep as many customers as possible on-line. Rapid action can prevent the disruption from spreading as far as it otherwise might.

Measures to speed the recovery focus on the large transformers. The recovery period could be greatly reduced if more spares can be made available. One way would be to use those spares that utilities normally consider necessary for their own reliability but which are not actually in service at the moment. Legislation to relieve utilities of liability over potential blackouts in their own areas resulting from the absence of this equipment may be necessary. Alternatively, utilities could purchase spares for key equipment and store them in secure locations, or a stockpile of at least the most common transformers could be established.

A stockpile might entail initial costs of about $50 to $100 million for the step-down transformers used to lower voltage from the transmission system for use on a distribution network. Step-up transformers at generating stations are less standardized than step-down transformers. They employ a greater variety of voltages and different physical layouts for the high current bus from the generator. There is much less likelihood of finding a suitable spare, and a stockpile would have to be sizable. A less expensive alternative would be to stockpile key materials (copper wire, core steel, and porcelain)

and, in an emergency, to use preexisting designs instead of custom designing for the particular application. Under these conditions, manufacturing time could be reduced from over 12 months to about 6 months for four prototype units and two to three per month thereafter. However, the product would lack the optimization and state-of-the-art improvements of a custom-designed unit. Suboptimal transformers, whether stockpiled or manufactured generically, would be less efficient, resulting in significantly higher operating costs. Hence these expedited transformers might have to be replaced when better ones can be produced.

In addition to the measures intended to reduce the vulnerability of the existing system, the evolution of the electric power system can be guided toward inherently less vulnerable technologies and configurations. In particular, a system that emphasizes numerous small generators close to loads is, overall less vulnerable to sabotage. However, the total relative costs of moving toward dispersed systems are not clear, and substantial government incentive might be necessary to expedite the trend toward smaller units. Another step would be to improve standardization of system components to make stockpiling, equipment sharing, and emergency manufacturing easier. However, there are good reasons for the diversity of components, and standardization would result in some loss of efficiency of the system. Greater use of underground cables would also offer some advantages compared with overhead lines, though if damage does occur, replacement of cables is much slower and more costly.

These measures are listed in table 2. Some measures are already being addressed to some degree by the industry and government. Policymakers can accept this level of progress if present trends seem adequate for the level of threat. Alternatively, a more activist approach can be taken to enhance these steps and add others. Some of the steps listed would be quite expensive, but others would have nominal costs. Considering the present budget constraints, funding new costly initiatives will be justified only if the threat is seen as serious. Therefore table 2 notes whether the activity is being addressed under present trends, whether it can be implemented at low cost, or whether it would be relatively expensive. Several items appear in two categories, indicating differing levels of implementation, or planning in one and implementation in

another. Utilities can be mandated to make these investments without government financial assistance, but that will make implementation more difficult unless they are assured of passing the costs on to their customers.

The appropriate level of government intervention is a matter of value judgment and opinion. The level of threat, both sabotage and natural disaster, cannot be quantified, and the costs of a major outage are highly dependent on the exact nature of the outage. If a worst case scenario is experienced, the costs would be much greater than all the measures discussed here. If a very strong earthquake occurs and suitable reinforcements avert major damage to the power system, or if terrorism increases in this country, then even very large investments will have been justified.

However, it is also impossible to quantify the degree to which these measures would reduce vulnerability. It is relatively easy to counter lowlevel threats, including almost all natural disasters, or prevent them from causing massive damage. It is much harder to counter any threat more serious than a small, unsophisticated terrorist group, though the recovery from the damage can be expedited. Furthermore, even greatly increased resistance to sabotage might just move the problem elsewhere. As noted above, if saboteurs can't destroy substations, they can still cause blackouts by shooting power lines. Alternatively, they can turn to other parts of the infrastructure, such as telecommunications or water supplies. Thus, it is questionable how much protection society would be buying.

It is possible to reduce vulnerability, but at a cost. Any of these measures can be justified if the threat is estimated to be sufficiently serious. Not taking any action is an implicit decision that no action is worthwhile. With the level of terrorism in this country as low as it is, many people will be skeptical of the need for any action, especially major investments such as increased reserve margins or stockpiles. However, terrorism could increase much faster than the measures to counter it could be implemented. If this seems plausible, then at least planning and other low-cost measures should be started earlier. If a rapid increase in terrorism seems at all likely, then even expensive measures are reasonable insurance. There is no "correct" answer as to which is the most appropriate approach.

Chapter 2

Causes of Extended Outages

Virtually everyone in the United States has some experience with power outages lasting at least a few minutes. Blackouts that last for a day or more are headline-making news, such as the 1989 storm damage in Washington, D.C. that kept some people without power for several days. Hurricane Hugo, one of the most destructive storms to strike North America this century, caused extensive damage to electric utilities in its path and left many people without power for several weeks. Over the last decade, concerns have begun to be raised about the possibility of extended blackouts due to intentional damage to electric power and other energy systems (e.g., sabotage). U.S. electric power systems have been targets of numerous isolated acts of sabotage. None has been serious enough to cause significant impact, but there is increasing recognition that a concerted effort by saboteurs could blackout major regions of the country.

This chapter focuses on extended outages caused by natural disasters and sabotage and their resulting effects on electric power systems. The impacts of extended outages, including costs, are discussed in chapter 3.

NATURAL HAZARDS

Natural hazards with the potential to cause extended blackouts include earthquakes, hurricanes, tornadoes, and severe thunderstorms. Each affects the power system differently. In general, earthquakes could damage all types of power system equipment, and are the most likely to cause power interruptions lasting more than a few days. Hurricanes primarily affect transmission and local distribution (T&D) systems, but the resultant flooding could damage generating equipment. Tornadoes and severe thunderstorms affect T&D lines directly through wind damage, and indirectly through downed trees, etc. Freak occurrences can cause particularly high levels of damage. In October 1962, for example, the only hurricane in recorded history to hit the west coast of the United States left parts of Oregon and Washington without power for up to 2 weeks, primarily because of the time needed to clear downed trees.

Earthquakes

An earthquake's actual impact depends on the population density and/or level of development in the affected area, the type of soil or rock material, the structural engineering, and advance warnings and preparation. For both loss of life and property damage, the most damaging earthquake of this century was Tangshan, China, in 1976 (Richter 7.8). Over 250,000 people died, and 20 square miles of the city were flattened.' The 1988 Armenian earthquake and the recent San Francisco Bay earthquake provide painful reminders of a strong earthquake's capacity to do damage and the importance of good seismic design and construction and emergency preparedness planning to mitigate the impacts (see box A).

Earthquakes sometimes result in compound disasters, in which the major event triggers a secondary event, natural or from the failure of a manmade system. In urban areas, fires may originate in gas lines and spread to storage facilities for petroleum products, gases, and chemicals. These fires often are a much more destructive agent than the tremors themselves because water mains and fire-fighting equipment are rendered useless. More than 80 percent of the total damage in the 1906 San Francisco quake was due to fire.

Most of the United States has some risk of seismic disturbance. The series of earthquakes that struck New Madrid, Missouri were probably the most severe in North America. The tremors were felt as far away as Boston. The first quake, which occurred in December 1811, may have been stronger than the 1906 San Francisco earthquake; it was followed in 1812 by hundreds of after-shocks.2 According to the American Association of Engineers, it is very likely that a destructive earthquake will occur in the Eastern United States by the year 2010. The central Mississippi valley, the southern Appalachians, and an area centered around Indiana have the highest