Chapter 1

Introduction and Summary

INTRODUCTION

The reliability of U.S. electric power systems has been so high that the rare occurrences of major blackouts have been prominent national and even international news items. The most notable incidents in South Carolina after Hurricane Hugo, in Seattle after the 1989 cable fire, New York City in 1977, or almost the entire Northeast in 1965-have demonstrated that blackouts are very expensive and entail considerable disruption to society.

As damaging as these blackouts have been, much worse events are possible. Under several different types of circumstances, electric power systems could be damaged well beyond the level of normal design criteria for maintaining reliability. Seismic experts expect that several parts of the country could experience significantly larger earthquakes than the one that hit California in 1989. Hurricanes even more damaging than Hugo could move along the Gulf of Mexico or up the Atlantic coast, maintaining their strength rather than losing it inland. Either type of natural disaster could damage many electric power system components, causing widespread outages over a long period of restoration and recovery. Even more ominously, terrorists could emulate acts of sabotage in several other countries and destroy critical components, incapacitating large segments of a transmission network for months. Some of these components are vulnerable to saboteurs with explosives or just high-power rifles. Not only would repairs cost many millions of dollars, but the economic and societal damage from serious power shortages would be enormous.

Electric utilities normally plan for the possibility of one, or occasionally two, independent failures of major equipment without their customers suffering any significant outage. If the system can be better protected, or made sufficiently resilient to withstand greater levels of damage, then the risk of a major, long-term blackout will be reduced. However, any such measures will cost money. Utilities are taking some steps, but apparently, generally consider the risk to be too low to warrant large expenditures, which would ultimately be borne by their customers, or by stockholders if the State utility commission did not approve inclusion of these costs in the rate base.

However, the consequences of a major, long-term blackout are so great that there is a clear national interest involved. Steps that may not be worthwhile for individual utilities could make sense from the national perspective. The purpose of this report is to explore the options for reducing vulnerability and place them in context. It first reviews the threat from both natural disasters and sabotage to determine what damage might occur. However, an analysis of the probability of any of these threats materializing is beyond the scope of this study. Chapter 3 reviews the impact of major blackouts that have occurred, in order to help understand the costs of an even greater one that might be experienced eventually. Chapter 4 estimates the effect on the system when various critical components are damaged, and how the system can be restored. Chapters 5 and 6 describe present and potential efforts to reduce vulnerability. Finally, chapter 7 suggests how Congress could act, depending on how seriously the problem is viewed.

SUMMARY

Causes and Costs of Extended Outages

A variety of events, both natural and manmade, can cause power outages. Widespread outages or power shortages lasting several months or more are unlikely unless significant components of the bulk power system-generation and transmission-are damaged. The most probable causes of such damage are sabotage of multi-circuit transmission facilities, and very strong earthquakes or hurricanes.

The bulk power system is vulnerable to terrorist attacks targeted on key facilities. Major metropolitan areas and even multi-state regions could lose virtually all power following simultaneous attacks on three to eight sites, though partial service might be restored within a few hours. Most of these sites are unmanned, and many are in isolated areas, with little resistance to attack. Powerplants can also be disabled by terrorists willing to attack a manned site, or isolated from the transmission network by highpower rifle fire outside the site.

None of the attacks on electric power systems in the United States has been large enough to cause widespread blackouts, but there are reasons for concern that the situation may worsen. Small-scale, unsophisticated attacks on power systems have

occurred here. Power systems in other countries, especially in Latin America and Europe, have suffered much worse and more frequent damage. Latin American and African countries have suffered outages of several weeks. Terrorist attacks in this country have not been a major problem over the past decade, but that could change rapidly. Terrorists could select power systems as targets if they want to cause a large amount of economic disruption with a relatively small effort. Efficient selection of targets would require more sophistication than has yet been shown by terrorist groups in the United States, but the required information and expertise are available from public documents as well as from foreign terrorist groups. In addition, some foreign groups might want to strike directly at the United States.

Hurricanes and earthquakes can also have a devastating effect on power systems, but the pattern of destruction would be much different than after a large-scale attack by saboteurs. Hurricanes affect distribution systems much more than generation and transmission. The relatively low lines are vulnerable to falling trees, flooding, and flying debris. Restoration may be a monumental task lasting several weeks or even months, but replacement parts are readily available, and utilities are experienced in the type of tasks required. However, the lingering blackouts following Hurricane Hugo demonstrated that greater advanced planning may be warranted. For instance, some types of transmission towers failed in the high winds, suggesting that more resilient designs should be used in vulnerable areas. Utilities along the Gulf and Atlantic coasts, areas vulnerable to hurricanes, should be studying the lessons learned from Hugo.

Earthquakes are quite capable of destroying generation and transmission equipment as well as distribution systems. However, where facilities have been constructed to withstand earthquakes, as in California, it is unlikely that more than a few key pieces of equipment would be damaged. The greatest concern is when an earthquake hits an area where seismic disturbances have not been considered in the design of equipment. The central Mississippi valley, the southern Appalachians, and an area centered around Indiana have the highest potential for earthquake damage. No plausible natural disaster should damage the bulk power system so badly as to cause widespread power outages for more than a few days if utilities have taken adequate precautions. Utilities normally can restore power fairly quickly unless multiple circuits are interrupted.

However it might occur, a long-term blackout is extremely expensive. Direct impacts include lost production and sales by industrial and commercial firms, safety (e.g., incapacitated traffic and air system controls), damage to electronic equipment and data, inconvenience, etc. Indirect costs include secondary effects on firms unable to conduct business with blacked-out firms, public health (e.g., inoperable sewage treatment plants), and looting. Table 1 summarizes the costs of the 1977 blackout in New York City, which lasted for about 25 hours. Blackouts of a few hours or days have been estimated to cost $1 to $5 per kilowatt-hour not delivered, far greater than what the power would have cost had it remained uninterrupted. Predicting costs for any specific longer-term outage is very uncertain because costs depend on many factors including the customers affected, the timing and duration of the outage, and the degree of adaptation customers and utilities can achieve to mitigate the outage.

Unless the damage is extremely severe, at least partial power could be restored in a matter of hours. Full restoration may take many months if a large number of key pieces of equipment have been destroyed. In the interim, customers would be faced with rolling blackouts, voltage reductions, or lower reliability. An additional impact is that the cost of the power that is available will be high if some of the most economical generating stations are damaged or isolated from loads by transmission system damage and therefore idled.

Component Vulnerability and Impact
on System

Three factors determine the importance of any individual component-its susceptibility to damage; the effect on the power system of its loss; and the difficulty of its replacement or repair. These factors vary with particular circumstances. For example, generating stations can be destroyed by saboteurs willing to enter the plant, but the presence of utility employees performing their normal functions is a deterrent. However, if an insider is involved, sabotage becomes much easier. Similarly, the vulnerability of generating stations to earthquakes is low if they have been designed to withstand them and high otherwise.

Widespread, long-term blackouts could only be caused by damage to several circuits isolating

generating capacity from loads. No single failure should have a significant effect on power flow to customers since most utilities maintain sufficient generating and transmission reserves to accommodate such failures. If more damage occurs, either to generating stations or the transmission system connecting them to loads, the system can separate into islands. When these islands form, some have too much or too little generating capacity for their loads and lose all power. Other islands with approximate balance can maintain power, disconnected from the remainder of the system. The pattern of break up is not predictable, depending on the location of loads, which units are operating, the configuration of the transmission system, and the nature of the initiating

event. Under extreme contingencies, substantial outages will occur. Modern protective circuitry should prevent the type of cascading failures across an entire system that occurred in the Northeast blackout of 1965, but there are many uncertainties over system behavior under untested conditions.

Power systems can be constructed to ride out almost any earthquake or hurricane with only minimal damage to components that would require months to replace. Most customers of an adequately prepared system will have their power restored within a day or two, though extensive damage to transmission and distribution lines may mean some outages for a few weeks. As noted above, however, a major earthquake east of the Rocky Mountains

• 3