7

Restoration of the Electric Power System After an Attack

Utilities have considerable experience with the problems of restoring electric service after massive disruptions caused by natural events such as ice storms or hurricanes, in which damage may be widespread. Such experience would be useful in restoring service after a terrorist attack, but the aftermath of an attack is likely to be quite different from a natural disaster. Terrorists can be expected to choose targets and inflict damage in order to impose maximum disruption and make speedy restoration difficult. Major substations and transmission lines are the most likely targets. Damage to key substations could be much greater and more extensive than that caused by most natural events,1 requiring replacement of many large transformers, circuit breakers, and other equipment. Depending on the availability of spares, restoration could take weeks, months, or even longer.

Moreover, even given advance planning and preparation such as stockpiling of equipment, terrorists might compound damage by mounting a staged attack on additional or replacement facilities. After an attack, law enforcement and intelligence agencies will want to carefully study the damage in order to determine what was done and who did it. Unless prior arrangements have been carefully worked out ahead of time, the conflict between rapid restoration of service and careful study of a crime scene could result in considerable chaos and seriously delay the restoration process. Utilities and their contractors might also have to deal with a much higher level of physical, chemical, and biological threats after a terrorist attack than would be expected to arise as a consequence of any natural disruption.

Simply blowing up or knocking down a transmission tower can cause problems, but typically repairs can be done quickly. Transmission lines are most vulnerable when there are long stretches of suspension towers interspersed with only a very few dead-end or stop-loss structures.2 In such cases the destruction of a few carefully chosen towers can result in a domino effect (cascading collapse) that can bring down many kilometers of line and towers.

In most cases, restoration after a cyber attack is likely to go more rapidly than after a well-planned and well-executed physical attack. However, if software has become widely infected with a pernicious virus, it may be necessary to reinstall large numbers of systems. If timed Trojan horses or worms have infected the system, there could be recurring problems. Some cyber attacks could also result in physical damage to important components in the power system. In most cases, however, this would likely be more limited than the damage caused by an all-out physical attack. Restoration could still be slow if key replacement equipment is not readily at hand.

PLANNING FOR THE AFTERMATH OF A TERRORIST ATTACK

As noted in previous chapters, to ensure continuity of service, utilities currently incorporate various degrees of contingency design into the design and operation of generating stations, substations, and transmission and distribution systems. The purpose of contingency design is to ensure that the loss of one or more components up to a defined design level should neither result in loss of service to customers nor lead to remaining in-service equipment exceeding designed operating specifications or ratings. Utilities have generally developed contingency designs based on the failure of single pieces of equipment or of a common support structure (such as a common transmission tower) rather than damage to multiple pieces of equipment at a given location or even the loss of multiple key facilities.

For example, a large urban area substation may be designed to operate under peak load conditions even with the loss of one or two of the power transformers supplying that particular station. However, in the face of a carefully designed terrorist attack, such N-1 or N-2 design criteria are not likely to be adequate to ensure continued operation.

___________________

1One possible exception could be a very large earthquake.

2Suspension towers are designed to support the cable vertically. They have little capability to withstand horizontal loads, which are usually balanced. If an adjoining tower comes down, however, the loads are unbalanced, and a line of towers may cascade down like a row of dominos.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 69
7 Restoration of the Electric Power System After an Attack Utilities have considerable experience with the problems cases the destruction of a few carefully chosen towers can of restoring electric service after massive disruptions caused result in a domino effect (cascading collapse) that can bring by natural events such as ice storms or hurricanes, in which down many kilometers of line and towers. damage may be widespread. Such experience would be In most cases, restoration after a cyber attack is likely to useful in restoring service after a terrorist attack, but the go more rapidly than after a well-planned and well-executed aftermath of an attack is likely to be quite different from a physical attack. However, if software has become widely natural disaster. Terrorists can be expected to choose targets infected with a pernicious virus, it may be necessary to and inflict damage in order to impose maximum disruption reinstall large numbers of systems. If timed Trojan horses and make speedy restoration difficult. Major substations and or worms have infected the system, there could be recurring transmission lines are the most likely targets. Damage to key problems. Some cyber attacks could also result in physical substations could be much greater and more extensive than damage to important components in the power system. In that caused by most natural events,1 requiring replacement of most cases, however, this would likely be more limited than many large transformers, circuit breakers, and other equip- the damage caused by an all-out physical attack. Restora- ment. Depending on the availability of spares, restoration tion could still be slow if key replacement equipment is not could take weeks, months, or even longer. readily at hand. Moreover, even given advance planning and preparation such as stockpiling of equipment, terrorists might com- PLANNING FOR THE AFTERMATH OF A TERRORIST pound damage by mounting a staged attack on additional or ATTACK replacement facilities. After an attack, law enforcement and intelligence agencies will want to carefully study the damage As noted in previous chapters, to ensure continuity of in order to determine what was done and who did it. Unless service, utilities currently incorporate various degrees of prior arrangements have been carefully worked out ahead of contingency design into the design and operation of generat- time, the conflict between rapid restoration of service and ing stations, substations, and transmission and distribution careful study of a crime scene could result in considerable systems. The purpose of contingency design is to ensure that chaos and seriously delay the restoration process. Utilities the loss of one or more components up to a defined design and their contractors might also have to deal with a much level should neither result in loss of service to customers nor higher level of physical, chemical, and biological threats lead to remaining in-service equipment exceeding designed after a terrorist attack than would be expected to arise as a operating specifications or ratings. Utilities have generally consequence of any natural disruption. developed contingency designs based on the failure of single Simply blowing up or knocking down a transmission pieces of equipment or of a common support structure (such tower can cause problems, but typically repairs can be done as a common transmission tower) rather than damage to quickly. Transmission lines are most vulnerable when there multiple pieces of equipment at a given location or even the are long stretches of suspension towers interspersed with loss of multiple key facilities. only a very few dead-end or stop-loss structures.2 In such For example, a large urban area substation may be designed to operate under peak load conditions even with 1One possible exception could be a very large earthquake. the loss of one or two of the power transformers supplying 2Suspension towers are designed to support the cable vertically. They that particular station. However, in the face of a carefully have little capability to withstand horizontal loads, which are usually bal- designed terrorist attack, such N-1 or N-2 design criteria anced. If an adjoining tower comes down, however, the loads are unbal- anced, and a line of towers may cascade down like a row of dominos. are not likely to be adequate to ensure continued operation. 69

OCR for page 69
70 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM Thus, utilities need to develop emergency response plans. Use of restoration panels; and Although it is not possible to cover all possible emergency Development of restoration policies, including scenarios, the planning and drill process is invaluable in islanding requirements and monitoring of voltages, building a capability in responding to actual events because frequencies, and phase angles. it provides a basic framework and foundation. The following should be considered as part of future contingency response In anticipation of catastrophic events leading to a system- development: wide blackout, utilities are required to develop plans that will enable their operators to break up the normally synchronized Evaluation of existing facilities based on their criti- grid into "isolated" islands that are self-supportive. Such cality and development of plans for recovery in the advanced planning can be valuable, but in the event of any event of the loss of all key equipment in several of specific outage, these plans will require real-time adjust- these facilities (e.g., the loss of entire substations ments based on existing conditions, such as availability of or loss for an extended period of one or several equipment, load conditions, reactive power supply/control key transmission lines). Such contingency analysis capability, availability of synchronizing equipment, and should be conducted to determine the impact of this governing control while maintaining voltages and frequency loss on other facilities. at acceptable operating levels. For new designs or upgrades, a planning/engineering Plans for the restoration of a transmission and distribution process that considers how to make facilities more system should consider two basic approaches. One is based robust in the face of possible attack, and development on the availability of power from other external providers of strategies to quickly restore or bypass such facili- through tie lines. A second, or "island," approach consid- ties if they sustain significant damage. ers restoration of the system from generation internal to its Sharing by utilities of ideas and designs that may service territory. The latter approach could be significantly improve performance. Organizations such as the strengthened with the greater deployment of various types Edison Electric Institute (EEI) and the Association of of distributed generation, including micro-grids. Today, Edison Illuminating Companies (AEIC) are excellent however, there are considerable regulatory impediments3 forums for such sharing. Benchmarking with other to the deployment of such systems, and distribution system utilities, especially those in countries that have had operators typically do not have plans to make use of such experience in addressing terrorist threats and attacks, resources in emergency situations. will provide valuable lessons and ideas. For example, With some important exceptions, many distribution the Infrastructure Security Initiative sponsored by the circuits serve both socially critical facilities such as police Electric Power Research Institute (EPRI) produced stations, schools, and filling stations, together with many Counterterrorism Measures and the Protection and less critical facilities. If the supply of power were to become Restoration of an Electric Grid (EPRI, 2005a), a seriously limited, it would be highly desirable to temporarily report that describes Israel Electric Corporation restrict service to just critical loads. Advanced distribution (IEC) programs and procedures for maintaining the automation (see Chapter 6) could make it possible to rapidly integrity of Israel's power transmission and distribu- and selectively supply service to a few such key facilities. tion system, as well as related restoration efforts. However, many systems still do not have distribution auto- However, there is a decided limit to how much special mation, and in the case of those that do, most have not been investment private utilities can be expected to make configured to facilitate such selective load shedding within a to protect against low-probability threats to every key single distribution feeder. In the absence of such capabilities, element of their system. reconfiguring distribution feeders to serve just a few loads would typically be a slow, labor-intensive operation (sending To prepare for the possible need to mount a restoration of line crews out to open or close breakers at customer service service, utilities should carefully address several important drops), as would be restoring service to dropped customers issues: along such feeders as power supplies once again became more plentiful. Black-start capability (that is, the ability to supply limited amounts of power to generators and other 3These impediments include informal difficulties that many distributed power-system equipment before they can be brought resources still experience when trying to connect to the utility system back online); (Alderfer et al., 2000), interconnection rules that currently require all Line/cable charging strategies and other means of distributed resources to disconnect from the grid the moment any problems voltage and reactive power control; arise (IEEE, 2003), and laws that grant legacy utilities exclusive service Need to disable or adjust certain protective systems, territories, making the installation of small micro-grids that serve several such as those for undervoltage, underfrequency, syn- customers difficult or impossible in much of the country (King, 2006; Morgan and Zerriffi, 2002). There is additional discussion of some of these chronization checks, and so on; issues in Chapter 9.

OCR for page 69
RESTORATION OF THE ELECTRIC POWER SYSTEM AFTER AN ATTACK 71 The use of emergency generators can also provide a quick transformers are no longer made in the United States, and and cost-effective response to restore critical loads. Many because of large demand across the developing world, lead utilities have in-house emergency mobile generation or times at factories are very long. Thus, the greatest vulner- access to mobile generators through contracts with vendors. ability in the event of terrorist physical attack on the power Utilities should make every effort to talk with critical cus- system will likely be securing needed replacements of high- tomers about the importance of procuring their own backup voltage transformers. generation to be able to respond to prolonged, unplanned EEI is currently spearheading the Spare Transformer outages to ensure that their critical services are available to Equipment Program (STEP) to catalog available spares the public in a timely manner following an attack. Utilities across the industry. Over 50 utilities participated in the should also evaluate the critical loads they serve to help negotiation of a binding contract, the Spare Transformer develop a prioritization plan for emergency generator dis- Sharing Agreement (EEI, 2006). Any investor-owned, patch. In addition, utilities should discuss this priority list government-owned, or rural electric cooperative utility in with local governmental officials to get their input on the the United States or Canada may participate in the program, overall emergency response plan. and currently 47 utilities, representing more than 60 percent When a month-long outage hit the central business district of the Federal Energy Regulatory Commission (FERC) juris- in the city of Auckland, New Zealand, in February 1998, dictional transmission systems, are members. The sharing significant demand reduction during the restoration phase agreement provides considerable flexibility for utilities to was achieved with rotating blackouts and through direct operate and utilize assets as they normally would during the communication with customers, who were asked to remove course of business, but binds utilities to share their commit- a portion of the lamps in florescent fixtures (load reduction ted transformers if an event that triggers the sharing obliga- from 40 to 15 MW); run air conditioners on fresh air only, tions should occur. A "triggering event" is defined as an act with reduced chiller banks and pre-cooling during off-peak of terrorism that destroys or disables one or more substations hours (load reduction from 70 to 30 MW); turn off office and results in a state of emergency as declared by the Presi- equipment when not in use (load reduction from 25 to 20 dent of the United States. The Spare Transformer Sharing MW); and employ various similar strategies (load reduction Agreement also provides that any participating utility may from 15 to 10 MW). The result was a reduction in these loads voluntarily transfer spare transformers to a participating by 50 percent (Walker, 1999). utility or to a nonparticipating utility regardless of whether Although time-of-use meters are still rare in the United a triggering event occurs. But each participating utility that States, as they become more widespread it might be possible, disposes of a spare transformer through "permitted transfer" with prior agreement of public utility commissions and with is obligated to obtain a replacement transformer as soon as proper customer notification, to limit load during restoration practical, but in no event later than 18 months after the spare by applying very high rates. transformer is disposed of. In committing spare transformers under this binding agreement, participating utilities agree to sell committed transformers to any other qualified partici- ENSURING ACCESS TO PHYSICAL EQUIPMENT FOR pating utility pursuant to a properly exercised "call right" RESTORATION and at a set purchase price. A commitment formula utilizing After any disruption that results in the physical destruc- "needed megavolt," "connected megavolt," and available tion of equipment, access to replacement parts is of critical spares in defined voltage classes will be utilized to deter- importance. Thus, for example, utilities that operate in mine necessary commitments for each participating utility. hurricane-prone regions routinely stock large supplies of The needs of each participating utility will be based on the distribution poles, distribution transformers, and similar impact of losing its five most critical substations within an equipment and have mutual support agreements with other equipment class. The basic obligations are to: utilities in the event that supplies run low. Utilities also rou- tinely provide support to each other by supplying line crews Obtain qualified number of spare transformers equal and other critical human resources in the event of such large to its commitment; emergencies. Replace spare transformers that are used in order to The situation after a major physical terrorist attack would continue to meet its commitment; be similar, but the equipment needs could be quite different. Report necessary information to calculate its Terrorists would most likely seek to destroy many large commitment; high-voltage transformers. These devices are hard to move. Maintain committed spare transformers in accor- Most are custom designs to meet specific needs. Because dance with good utility practices; and such devices are very expensive, and also very reliable Qualify for certification by an executive officer under normal operating conditions, most utilities have only that the participating utility is complying with its limited numbers of spares. With few exceptions, most such commitment.

OCR for page 69
72 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM In some cases, a utility participating in the Spare Trans- more rapid restoration of service than is now possible. EPRI former Sharing Agreement may need to acquire, or acquire describes the recovery transformer as: the right to, less than a whole transformer. Such utilities may choose to join with a small group of other utilities to acquire a new type of emergency spare high-voltage network trans- spare transformers. The utilities working on the development former that is lighter than existing transformers, smaller, of the sharing agreement recognized that a joint procurement easier to transport, and faster to install and energize during program might be helpful to some utilities and considered recovery from severe high-voltage transformer outages induced by equipment failure, weather, earthquakes, or ter- creating a special, not-for-profit entity for that purpose. One rorist acts. example of such a program is the nonprofit Pooled Inven- tory Management (PIM) program. Since 1980, this program After the terrorist attacks of September 2001, EPRI started has operated to acquire, store, and maintain long-lead-time the Infrastructure Security Initiative (EPRI 2005b), which spare parts for the nuclear industry. The PIM program has identified the need to determine the technical feasibility of agreed to pursue development of a PIM spare transformer developing and testing a new high-voltage network trans- equipment program. former that is easier to transport and install than existing Technical meetings to work out the actual design specifi- spares. The design was completed during Infrastructure cations and required commitments for participating utilities Security Initiative work efforts and included tradeoff studies will be held at least annually as part of this process. Also, the of capacity, impedance, and dielectric withstand strength, North American Electric Reliability Council has a listing of and voltage transformation ratios. These efforts resulted in the development of detailed specifications and electrical spare transformers that could be made available to a utility designs that covered a variety of North American network faced with a significant loss due to terrorist activity. transformer voltages and megavolt ampere (MVA) ratings. Participants in STEP recognized that FERC approval The work also identified all mechanical components and would be required for transfers of transformers under the field installation processes necessary to support the expedited sharing agreement. Under Section 203 of the Federal Power transport and installation of the transformer. . . . Compared Act of 2005, FERC must approve the sale or disposition of to existing transformers, this new type is characterized by jurisdictional assets in excess of $10 million. To expedite the following: the process of transfers, participants petitioned FERC and received pre-approval of the transfer of spare transformers Cost: about 20 percent lower from one utility to another in the event of a terrorist attack. In Weight: about 25 percent less its approval, FERC also determined that the sharing arrange- Size: about 25 percent smaller ment is prudent, which will support participants that seek to Efficiency: about 99.0 percent (vs. 99.8 percent) Operating temperature: about 155C (vs. 110C) recover the costs of participation through rate setting. FERC Installation time: about 48 hours (vs. weeks) believes that participation in STEP will increase transmission Design life: 35 years owners' emergency recovery capabilities by providing access to more spare transformers at lower cost. Participating utili- The time to install the transformer can be dramatically ties will also be seeking similar approval from their respec- reduced through specialized storage and preparation-for- tive state commissions to ensure that they are able to recover shipment techniques, specialized processing equipment and the costs of acquiring spare transfers under the program. techniques, rapid deployment and transit, trained installation As promising as STEP may be, it alone is not sufficient personnel, preparation of the installation site, and installation to address the vulnerabilities that the United States faces testing. Specifically, transformer condition should be careful- in the event of a large physical attack on the high-voltage ly maintained during storage so that there are no "condition substations of the power grid. There are not enough spares surprises" during installation. Oil monitoring systems will available to replace all those that might be lost in a terrorist detect moisture and harmful chemicals to verify transformer readiness for use and conduciveness of the storage condi- attack. Furthermore, because of their size and variations in tion to immediate energizing. Prior recovery transformer design, sufficient spares cannot be moved rapidly enough to work determined that careful management of relocation and provide needed recovery. With this in mind, EPRI (2006) has reassembly is critical to reducing the total recovery time. undertaken a project to build and test a compact "restoration For example, the use of draw lead or draw rod bushings (for transformer" that would be small enough to easily transport.4 higher current applications) will save many hours of installa- In order to reduce the size so that the device can fit into large tion time by eliminating the need to enter the transformer and cargo aircraft and move on trucks through underpasses, the reconnect primary current-carrying joints. Modularization of transformer would run hot (and thus waste more energy the cooling and oil expansion systems will reduce installation than a conventional transformer). That would make opera- time: single cooling and oil expansion modules allow for tion too expensive for routine use, but it would allow much module location at multiple storage sites and shipment and combination to serve various sizes of recovery transformers. (EPRI, 2006, p. 1) 4See also NRC (2002) and Stiegemeier and Girgis (2006).

OCR for page 69
RESTORATION OF THE ELECTRIC POWER SYSTEM AFTER AN ATTACK 73 Because the terrorist threat that any single utility faces is While most of the focus on the impacts to utility infra- typically modest, even if the collective national risk is not, structure caused by terrorist activity has centered on the EPRI has had difficulty getting sufficient support from the facilities that are directly associated with the generation, electric power industry to move forward aggressively with transmission, and distribution of electricity, the loss of other this project. This is a classic case of "tragedy of the com- facilities should also be considered. Alternate reporting plans mons." Clearly, some sharing of the costs by all of society, for corporate headquarters, dispatch centers, control rooms, through support by the federal, state, and local governments, work locations, and service centers are essential compo- is needed. This issue is discussed further in Chapter 9. nents of a comprehensive emergency response and business continuity planning document. Perhaps the most significant results of an attack at one of these locations would be the ORGANIZING FOR RESTORATION loss of human capital and impaired ability to coordinate operational and business activities. Coordination of Essential Services The coordination of all essential services should be per- To ensure effective management, command, and control formed under a unified ICS structure spearheaded by local, of an emergency situation, it is imperative that an organized state, or federal officials. It is at the governmental level command structure be used. The Incident Command System that the overall response and restoration strategies must be (ICS)5 outlines effective management principles for control developed and communicated. The overall strategy would as well as the assignment of specific functions and respon- include prioritizing the needs of all agencies. The utility sibilities. This widely recognized organizational process is should consider the following issues when preparing for an also used by federal, state, and local emergency response and incident as well as during the response phase of an incident: governmental agencies. Advantages of using ICS include: Providing lodging for employees and outside Clear understanding of who is in charge, contractors; Defined roles and responsibilities for individuals, Providing clean water and nonperishable food, which Improved communications with responding agencies, may include the ability to procure and stage fresh- Greater sense of cooperation with outside stakehold- water tankers due to the potential contamination of ers, and freshwater supplies; Overall enhanced and efficient response to emer- Obtaining fuel to operate vehicles, equipment, and gency mitigation. generators; and Providing means for employees to communicate with Although each utility's process might vary slightly from their families after an attack and before the employ- the standard ICS structure in order to meet specific needs, ees are deployed or as they are being deployed. the core functional areas should remain intact. These func- tions include the incident commander and his or her staff for Crisis Communication oversight and overall control (command) in operations, plan- ning, logistics, and administration/finance. ICS is scalable Inability to communicate is a common shortfall identified and is equally effective for managing incidents that range by most companies during response to a large-scale natural from simple (routine) to complex (full scale). The incident disaster. Whether similar problems would arise after a ter- commander's staff should also include representation in the rorist attack would very much depend on the nature of the following areas: attack and whether other facilities were also attacked along with the power system. Of course, if power goes out across Legal matters; a large region, then communication can rapidly become a Communications and media relations; serious problem. Recent events have demonstrated that com- Environmental, health, and safety issues; munications can become problematic and utilities cannot Liaison with government agencies and other involved rely solely on telecommunication companies to solve their organizations; and communication problems. Partnering with local emergency Customer outreach. groups and state emergency management groups should be done to determine what systems they utilize and to what To fully integrate the use of ICS into the corporate culture, extent their systems could be used by the utilities during an first responders should utilize it for both small- and large- emergency. scale emergencies. Utilities should also investigate programs that may be available to complement their communications systems by working with their local telecommunication companies to 5 See, determine their involvement with the National Coordinating for example, http://www.training.fema.gov/EMIWeb/IS/ICS Resource/assets/reviewMaterials.pdf. Center for Telecommunications (NCC). The NCC's mission

OCR for page 69
74 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM is to assist in the initiation of national coordination, resto- from local governmental agencies and emergency respond- ration, and reconstitution of national security/emergency ers. The constant nurturing of these relationships pays huge preparedness telecommunications service or facilities in dividends for all parties involved as it results in an open envi- all conditions, crises, or emergencies. The telecommunica- ronment that fosters both communication and cooperation. tions industry and the government staff work together to To build this relationship, concerted communication efforts coordinate support for responding to national security and on a regular basis are important. emergency preparedness issues and to prevent and mitigate For large-scale incidents, utilities typically rely on assis- impacts on the national telecommunications infrastructure.6 tance from other utilities and qualified contractors to provide One example of federal support is the Government Emer- the necessary resources to respond to an event. In contrast gency Telecommunications Service (GETS) system. GETS to many natural events such as hurricanes, where the largest is a White House-directed emergency phone service provided human resource need is for line crews to restore distribution by the National Communications System (NCS) in the Infor- systems, in the aftermath of a terrorist event, human resource mation Analysis and Infrastructure Protection Division of the needs are more likely to be for substation engineers and tech- Department of Homeland Security (DHS). GETS provides nicians, high-voltage-line construction crews, and perhaps emergency access and priority processing in the local and also software security and restoration experts. long-distance segments of the public switched telephone Typically, when extra human resources are needed, utili- network (PSTN). It is intended to be used in an emergency ties first work with neighboring utilities and regional mutual or crisis situation when the PSTN is congested and the prob- assistance groups. Acceptance of pre-established rules and ability of completing a call over normal or other alternate guidelines minimizes delays in obtaining help. In addition to telecommunication means has significantly decreased. local mutual assistance groups, participation in more global Utilities need to look closely at their communication resource sharing networks through organizations such as infrastructure and evaluate all alternate communication the EEI and the American Gas Association is also valuable. techniques. During a significant crisis, traditional commu- Pre-sharing of specific information between utilities will nication systems, including cellular technology, may be shut provide those parties seeking help with a valuable resource down or become overloaded. The trunked 800-MHz radio is during an emergency. Specifically, EEI has established a the current trend within the country for utility communica- website to support mutual assistance activities and is devel- tions. The recommended standard for law enforcement, first oping a model mutual assistance agreement. For the most responders, and utility emergency communications is the part, mutual assistance programs are generally limited to Association of Public Communications Officers (APCO) 25 the sharing of labor and technical expertise. Recovery from Standard. Utilities should evaluate their own internal radio deliberate destruction of utility infrastructure requires not communications systems to determine that battery backup only labor and technical expertise, but also the replacement systems are in place or that generators can be made available of damaged critical infrastructure, such as transmission at all communication locations, including repeater sites, to power transformers. ensure that communication devices remain operative during To ease the transition for visiting workers, utilities incidents. Other options, such as satellite communications, should develop a comprehensive assimilation program. This need to be evaluated for potential backup communications involves making sure that all visitors are provided informa- in case normal communications channels become unavail- tion about the host utility's transmission and distribution able. Some utilities have even used temporary fixes such as system. The host utilities should provide clear-cut direction a hovering helicopter as a relay station for communication and guidance on its work rules and expectations in order to using internal radio channels. ensure that all personnel work safely, are aware of potential It should also be noted that dissimilar communication net- hazards, and abide by the host utility's environmental, health, works that do not allow emergency responders from different and safety guidelines. The host utilities should have this groups to communicate can yield disastrous results. Utilities information prepared in advance to minimize delays. should take the need for interoperability into account during Host utilities also need to make detailed plans on housing preparations for emergency response. and feeding visiting crews as well as providing them with knowledgeable field guides who are familiar not only with the geography of the area but also with specific work rules, Partnering for Mutual Assistance site-specific hazards, and the ability to address all of the The support of outside emergency and governmental visiting crews' concerns. agencies will be essential following an attack. One of the best investments an organization can make in emergency response Additional Special Considerations planning is the development of relationships with key leaders Two other factors are likely to complicate the restoration 6More work environment after a terrorist attack. First, law enforce- information about the NCC is available through its website at http://www.ncs.gov/ncc/. ment agencies will likely want to treat some facilities as a

OCR for page 69
RESTORATION OF THE ELECTRIC POWER SYSTEM AFTER AN ATTACK 75 crime scene. While this is necessary and understandable, it uncontrolled energy hazards (electrical, natural gas, steam, is also important that utility personnel be able to gain early and so on). Another option is to work with other energy access to inspect their equipment and begin the process of responders to train already-certified EPA Level A emergency planning for restoration, since any extended delay in restora- responders to work at utility sites. This approach can be tion will cause large costs and further contribute to terror- taken for their own protection, as well as for assisting in any ists' goals of causing social and economic disruption. Thus, utility-specific activities. prior understandings need to be developed between utilities Utility employees typically possess a strong sense of and law enforcement agencies to ensure that the objectives commitment and desire to help, especially in the face of of adequate investigation and rapid service restoration are extreme duress. However, it is important to remember that adequately balanced. It may be desirable to legally designate injuries and death to employees, co-workers, family, and some utility personnel as emergency responders.7 friends may occur as result of terrorist activity. Utilities may The need to provide adequate protection and security for need to develop or enhance employee assistance programs repair crews is another issue that may differentiate restora- that will help provide services, such as temporary shelter or tion after a terrorist attack from restoration after outages housing, grief counseling, and dependent care, to ensure that due to natural causes. Depending on the nature of the attack, employees' basic needs are met during a crisis. Additionally, responding utility personnel may need additional levels of business continuity plans that address high absentee levels personal protective equipment (PPE) in order to work in a are an important tool to ensure that critical business activi- contaminated environment. Utilities may need to increase ties are sustainable in the event of various possible extreme security initiatives to ensure the safety of their employees situations, including health emergencies. during the assessment and restoration phases. All employees and contractors should have valid IDs, and these should be TESTING FOR RESTORATION--DRILLS checked rigorously throughout the process. The utility may require assistance from federal and local law enforcement The first important step in ensuring readiness for any agencies to help expedite its employees' ability to report to unplanned event is preparation through the planning process. assigned work locations. Such assistance will likely be facili- The ability to identify "what-if" scenarios and then develop tated if the utility has already trained and worked through appropriate response plans is key to developing a compre- scenarios with such agencies. hensive emergency response plan. Once plans have been Utility employees are not experts in terrorist activities and developed, the next step is to test their effectiveness. The best should not underestimate potential dangers. For example, way to accomplish this objective is through the use of drills the initial attack might be designed to lure in emergency and exercises. A well-constructed drill will test the ability responders. Once emergency responders arrive at the scene, of personnel to respond to simulated real-life situations as a second more devastating attack might be launched. well as test their understanding of the overall plan. The drill While utility personnel might not be considered emer- will test the ability of personnel to understand their roles gency responders in the face of biological and chemical and responsibilities as well as test the overall effectiveness attacks, trained emergency responders from responsible of the plan in resolving the emergency situation. The cru- governmental agencies may encounter a situation where the cial elements for a successful exercise include establishing expertise of a utility employee might be required in order to clear objectives, providing realistic scenarios that simulate respond to a situation where hazardous chemicals are pres- real-life conditions, and establishing expected actions or ent. To accomplish this objective, a utility might consider outcomes. Perhaps the most valuable component of a drill is training certain employees in the use of U.S. Environmental an after-action review that allows modifications to the plan Protection Agency (EPA) PPE Level A. Level A PPE, which to be discussed and implemented. The drills should include consists of self-contained breathing apparatus and a totally representatives of agencies outside local, state, and federal. encapsulating chemical-protective suit, provides the highest level of respiratory, eye, mucous membrane, and skin protec- RESTORATION CONSIDERATIONS tion. These employees should only be counted on as a last resort during the initial phase of recovery from a biological Restoration of electric service after either a man-made or or chemical attack and only for the purpose of mitigating any a natural disaster is a crucial element in helping the affected community to recover. In the event of a terrorist attack that 7In causes significant damage to utility infrastructure, the utility 2006, Congress passed the Safe Port Act, which the President signed into Public Law 109-347. This law, which recognizes electric utilities as will need to quickly develop and/or modify plans that will "essential service providers" and instructs federal agencies to not impede enable restoration of service to customers. In some cases, their access to a damaged site or impede restoration except under excep- temporary restoration will precede initiation of a plan to tional circumstances, is a significant improvement. However, inasmuch as institute more permanent repairs. any terrorist event would be an "exceptional circumstance," designation of a When faced with a terrorist attack that damages utility few selected utility personnel as "first responders" would be a more certain way to ensure the needed access. infrastructure, the utility should be prepared to adhere to

OCR for page 69
76 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM the following steps before actually initiating any restoration independent islands should have automatic and activities: manual load-shedding capabilities in response to decreasing island frequencies. Accounting for all personnel. The first concern for -- Islands with excess generation result in increasing emergency responders will be for life and safety. frequencies and thus depend on turbine-generator Having a process in place to account for all personnel governors to stabilize frequencies. is essential in order to minimize the risk to emergency Synchronizing isolated islands responders. -- Islanded or isolated sections of the power system Site security. Law enforcement officials will want to should be interconnected with larger systems to immediately secure the scene to ensure that the area share generation reserve capacity and inertial is safe, conduct an investigation, and gather evidence. stability. Utilities should be prepared to work with emergency -- All regions should have synchronizing capability responders to ensure their safety and de-energize the within substations to interconnect systems. facility if necessary. Control of isolated islands Establishment of ICS and command post. Utilities --M anagement of independent islands requires should immediately implement an ICS organizational coordinated control of generation to maintain both structure and appoint an incident commander to frequency and voltage. coordinate with outside agencies. During the initial --The use of isochronous and/or advanced genera- stages of an incident, the incident commander will tion control should be reviewed by control areas. most likely be operating within a unified command --Methods should be developed to manage load, structure along with fire, police, and governmental generation, and spinning reserve. officials. Complete restoration Site assessment. Once a damaged site has been --In the event of a widespread power failure, res- released by law enforcement, utility personnel will be toration procedures should be specific to restora- able to make initial site assessments of hazards and tion using both external and internal generation damage and then develop the necessary strategies and supplies. Depending on the severity of damage to plans to remediate the site, identify PPE requirements particular aspects of the transmission system and/ for employees, and determine what equipment must or specific substations and generating stations, be isolated or bypassed, and what equipment can be islanding schemes may need to be developed or utilized for restoration purposes. revised to determine which would be the easiest Command and control. During an event that may and most effective to implement based on the result in severe damage and/or islanding of a system, specific damage incurred. it is imperative to establish command and control -- Specific hydroelectric and gas-turbine generators locally, such as through the use of a "mini" control should be designated as black-start capable. Pro- center that will serve as the hub during the restora- cedures should focus on restoring generation and tion process. "Mini" control centers not only can controlling transmission system voltages. help support operational restoration efforts but also can provide local visible presence to emergency SERVICE RESTORATION responders, government officials, and the public. Major substations normally can meet some of these Once the damage from a terrorist attack on the power sys- requirements, but if a substation has been attacked, tem have been assessed, the damaged locations made secure a mobile command center vehicle might be used for utility personnel to work, and replacement equipment instead. Many utilities have such vehicles. ordered, then service restoration can begin. It is important that all utilities have restoration plans that When developing restoration plans, a utility should con- can be undertaken after a blackout. Such plans must cover sider the time of year and resulting demands on its system, the entire footprint of the area served and must be reviewed including the amount of load served as well as the remain- periodically and revised as needed to reflect infrastructure ing capacity of in-service equipment. Other considerations additions and retirements within the bulk power system. should include: Even with multiple restoration plans, the utility will still have to evaluate the extent of the blackout and the severity of the Minimizing the effects of cascading outages damage to equipment to determine which plan(s) will result --Sections of a large power system can separate into in an orderly, quick, and safe restoration. The following three islands as a result of cascading outages. These major restoration scenarios should be considered:

OCR for page 69
RESTORATION OF THE ELECTRIC POWER SYSTEM AFTER AN ATTACK 77 System-wide blackout with minimal or no damage adequate black-start generation resources should be available to major generation, transmission, and distribution throughout an RTO/ISO footprint to expeditiously restore the infrastructure (similar to the August 2003 blackout); critical loads according to the restoration priority. System-wide blackout as a result of widespread As generation becomes available and the transmission damage to infrastructure or control systems that will system is energized, utility operators should focus on impact restoration and operation of the system; and synchronizing as much generation as possible to maintain Local blackout as a result of damage to a local utility system stability and voltage control. A small amount of load infrastructure or to control systems. may be picked up to control voltages; however, the major- ity of customers should not be restored until the system Restoration priorities should reflect the criticality of has sufficient generation real-power reserves to meet the system restoration infrastructure, public health and safety expected peak loads and reactive-power reserves to control considerations, and the sensitivity and criticality of customer transmission system voltages. Synchronizing with neighbor- loads. For example, system restoration infrastructure com- ing utilities is a priority because it allows reserve sharing and prising the power company command-and-control centers, provides increased system stability. communication sites, emergency off-site power to nuclear Because of restructuring of the marketplace in certain stations, auxiliary power to key substation and generating parts of the nation where deregulation has occurred, the station facilities, and key natural gas facilities should be local utility may no longer own the required generation restored first. Major facilities that impact public health and capability. To facilitate restoration efforts, utilities in both safety, such as key 911 and emergency operation centers, regulated and deregulated markets need to recognize the major hospitals, critical water treatment plants, major air- importance of black-start capability in relation to restoration ports, and urban load centers, are next. All other customer efforts. Considering internal investment or encouraging oth- loads can be restored after that. These restoration plans and ers to invest in black-start capability is vital. In deregulated priorities need to be flexible, given that the normal supplies markets, appropriate compensation mechanisms should be (substations, transmission lines, and others) for those facili- implemented to ensure incentives for providing black-start ties may have incurred significant damage and the restora- capability. To the extent possible, efforts should be made to tion priority thus possibly affected. For those circumstances, ensure that any new generation units are constructed with alternate means of supply that differ from the normal supply black-start capability. may need to be considered. After a blackout, operators must immediately request that all steam-based black-start units start up even if the transmission system is not yet ready for the generating unit Black-Start Equipment to interconnect. This will prevent boiler pressure from drop- After a system-wide blackout, most, if not all, of the gen- ping too far such that a longer period of time is required for eration will have been shut down, and so the first step in res- the unit to be ready to interconnect. toration is to identify essential black-start generation equip- Testing of black-start equipment must be done periodi- ment within the affected utility's service area. Black-start cally, and a requirement should be implemented to verify that units are generators capable of starting up independently, the designated units could respond within an agreed-upon without any connection to the bulk power system. These time. Generation restoration start-up times vary considerably units involve equipment such as black-start diesel-generators between hydroelectric units, combustion turbines, steam which can be started on battery power and run on previously units, and nuclear units. Utilities should evaluate these dif- stored fuel to supply the necessary power to operate the ferences and develop plans that consider these timing issues. auxiliary equipment, including the governor and excitation As the generation infrastructure ages, some existing controls for larger units. Hydro-generators and combustion black-start generating units are approaching retirement age. turbine-generators also can be used for black-start.8 Such retiring black-start generation should be appropriately This generation equipment is critical, since it will be replaced. needed to energize the transmission system from various system locations concurrently. Utilities must identify which Restoring Damaged Infrastructure generators are capable of providing this service and also if these are strategically located within the system to quickly When significant damage to utility infrastructure has provide the required restoration capacity. Furthermore, occurred, the restoration process may be complicated and lengthy. Utilities should be prepared for a prolonged recovery 8Utilities must consider the possibility that natural gas might not be period and extensive allocation of both human resources and available. Terrorists could take out gas transmission lines at the same time funding toward these efforts. In addition to the traditional they are attacking the electric system. Alternatively, many gas transmission means for restoration, such as through the use of generators compressor stations now operate on electricity; if these are in the blacked and mobile transformers, utilities may also need to examine out region, they will stop, severely limiting the amount of gas that can be delivered. other alternatives that will provide for the quickest possible

OCR for page 69
78 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM restoration while establishing the groundwork for permanent address the restoration of service to customers and restoration in the future. the associated load supplied by a particular distribu- The utility will need to implement and adapt any plans it tion substation. There are several options that utilities already has for bypassing damaged facilities and temporar- will need to consider in the development of their ily restoring customers to service. Many operational and plans. When looking at alternate supply options, support groups within the company will need to be part of utility engineers need to evaluate spare capacity at this temporary restoration process. Utility engineers will alternate supply locations to ensure that this equip- provide a significant role in the design of a temporary sys- ment is capable of picking up the load(s) from the tem as well as making necessary changes to the supervisory station that must be bypassed. control and data acquisition (SCADA)/modeling systems to Customer load normally capable of being supplied reflect the changes that will be made. Typically, temporary from alternate substation. Some utilities have radial restoration steps will not provide the same "normal" level of distribution systems capable of being supplied by contingency design that is built into permanent restoration. a minimum of two alternate sources. This can be Therefore, all systems used to monitor the system, equipment accomplished through the use of an auto-loop system ratings, load flow analysis programs, and alarm points may or an automatic transfer scenario. Ideally, in order to have to be modified to ensure that operators can effectively diversify the supply, the normal and alternate supplies monitor and operate the system in its temporary state. should be provided from two different source substa- Many industry utility vendors have recognized the threat tions in order to ensure continuity of service in the of significant damage to utility infrastructure and have event of the loss of an entire substation. introduced mechanisms for quick restoration. Utilities need Customer load normally supplied from the same sub- to consider the implementation of emergency restoration station. In these cases, utility engineers must identify systems that will provide them with the necessary tools to how to segment the load so that it can either be picked implement a quicker recovery from a terrorist attack. For up in its entirety by an alternate source or so that it example, the introduction of modular restoration structures is "cut up" into various portions that can be picked will enable utilities to quickly support transmission lines. up by different stations. For radial overhead systems, These structures require no special foundation, can be used at this may be as easy as performing field switching any voltage level, and can be adapted for myriad suspension to isolate and segment the load and restore service designs, angles, or tensions. The erection of transmission accordingly. It is more complex for an underground towers, installation of necessary hardware, and stringing network system. If multiple secondary networks are of conductors requires significant logistical support and affected by the loss of an entire distribution substa- resources. The use of helicopters and large cranes, as well tion, a sequence of carefully considered steps must as the expertise of the employees, is critical to the rebuilding be made in order to switch out feeders from a nearby of transmission towers. network and connect them to the distribution feeders Various operational methodologies could enable utilities whose normal supply has been destroyed. to restore service in a quick and efficient manner: Mobile generation. Another alternative is mobile generation, which can be used to supply load directly Bypassing at the transmission/switching station from the source or at the customer's premises. Mobile level. Utilities should examine all potential operat- generators can be important for responding to a sig- ing scenarios, including the worst-case scenario of nificant wide-scale power outage. bypassing the entire facility. In order to bypass a Distributed generation. Increased use of distributed particular station, temporary poles or towers could generation and renewable power alternatives can also be used. In some cases, this might involve the use of provide viable alternate supply sources. transmission lines at voltages lower than those they Mobile transformers and switchgear. If a utility can are normally rated for in order to match the voltage quickly reestablish a transmission supply and gain ratings of equipment at the stations normally sup- access to distribution feeder supply exit cables, the plied by the bypassed station. For example, consider use of mobile transformers and switchgear is a viable the loss of a substation receiving power at 345 kV, alternative. This option will also require additional where the voltage is reduced to 138 kV for distribu- space, not only to site this equipment but also to tion. If the transmission line supplying power to the ensure it does not interfere with the rebuilding of the damaged substation is still intact, it could still carry permanent station. power, but only at 138 kV. The power it could carry would be considerably reduced, but in an emergency COMMUNICATIONS WITH THE PUBLIC that would still be very useful. Bypassing at the distribution substation level. Tem- A critical yet often overlooked aspect of power system porary restoration plans should be developed to restoration is public communications. Timely communica-

OCR for page 69
RESTORATION OF THE ELECTRIC POWER SYSTEM AFTER AN ATTACK 79 tion of accurate information is essential to successful resolu- FINDINGS AND RECOMMENDATIONS tion of a crisis. During a crisis, however, engineers and opera- tors must focus on the technical aspects of the job at hand and Findings can find it difficult to make others aware of their plans and Finding 7.1 The main difference between a terrorist attack objectives during the restoration efforts. If communication is and a major natural disaster is that terrorists could selectively lacking, however, even well-developed restoration plans and target key equipment, especially large transformers. Instead restoration efforts can be perceived by the public as failures. of days to weeks, full restoration of electric power could take In general, the public is more receptive to being told bad months to years following a well-planned, well-executed news regarding a situation than to being kept uninformed or terrorist attack. misinformed. Some members of the public, for example, may have developed their own contingency plans, including plans Finding 7.2 The risk of terrorism to the nation's electric for self-evacuation or relocation, and must be able to make system as a whole is significant, but the probability of attack decisions based on accurate and timely information from faced by any individual utility is low. Therefore it is neither government agencies, emergency responders, and utilities realistic nor equitable to expect utilities or states to under- that provide critical services. Agencies, too, must be able to take all the needed equipment development and stockpiling adjust their plans based on information supplied by utilities. without federal assistance. This is particularly true for the It is therefore imperative that all utilities have a well- design, development, and manufacture and stockpiling of a thought-out crisis communication plan developed and carried set of high-voltage restoration transformers. While the utility out by people within the utility who have responsibility for industry, through the Edison Electric Institute, is working to communicating with government officials, news media, and build the Spare Transformer Equipment Program (STEP), the public. Crisis communication should: the number of spare transformers that might be available is much smaller than the number that a large terrorist attack Describe the channels to be used to communicate could destroy. information; Summarize clearly and concisely the incident and its Finding 7.3 Analysis of vulnerabilities and planning for impact on the utility infrastructure and its workforce; restoration of power after an attack are essential. Plans must Project with reasonable accuracy what can be cover a variety of attacks, be easily understood, and be spe- expected and when, ensuring that the information cific to the operating utility infrastructure. communicated is based on input from operations people and not on some notion of what the public Finding 7.4 Strong and streamlined working relationships wants to hear; and between utilities, federal and state governments, and law Provide regular updates with quantitative results and enforcement agencies are essential if utilities are to rapidly information on any unexpected changes. evaluate damaged equipment and implement plans for resto- ration of electric service to customers after a terrorist attack. Personnel assigned to the development of crisis com- munication plans should be well versed in other companies' Finding 7.5 Greater use of distribution automation and public communications success and failures. Case studies demand-side management, as well as greater deployment of specific incidents should be reviewed. Utility company of distributed generation and planning for the use of these personnel assigned to communications during a crisis should facilities in the event of contingencies, hold considerable be well trained in crisis management and public speaking. potential to reduce the vulnerability of the existing power In addition, it is important that communication flow is chan- system. Most of the needed technology already exists. Prog- neled through a central point to promote the dissemination of ress depends primarily on appropriate state regulatory and accurate information. The ICS structure addresses this issue legislative initiatives. through the appointment of a communicator who works very closely with the incident commander. Finding 7.6 All major incidents should be followed by a Depending on the extent of the damage to utility infra- lessons-learned review of the entire incident to ensure that structure, restoration of service could take weeks or months. all weaknesses and deficiencies are identified and addressed. Stakeholders are more likely to be understanding if they are kept informed and up to date. Credibility and trust are Finding 7.7 Policies to balance risk communication and difficult to gain and easy to lose. A utility will build trust privacy/nondissemination of information require further and credibility by openly communicating with emergency investigation and research. Among the basic questions are responders, governmental officials and agencies, community how much information to communicate, to whom, under leaders, customers, and the general public. what threat levels, when, and how. Issues include approaches for maintaining openness, and the mechanics of disseminat-

OCR for page 69
80 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM ing evolving information to the public in view of potential programs and offer training for key utility personnel to legal ramifications and the responsibility to limit information respond to both conventional security threats and potential available to terrorists. A key consideration is avoiding over- chemical/biological attacks on the electric infrastructure. The reactions by informing the public while providing the highest training should provide increased awareness of the possible level of protection to the nation. threats, through risk assessments, and provide specific train- ing for the use of protection equipment, detection and sensor equipment, and emergency decontamination procedures. Recommendations Existing drills and restoration procedures must be expanded Recommendation 7.1 The Department of Energy and the to address the potential for biological or chemical attacks Department of Homeland Security should fund the research, that would disrupt electric operations and infrastructures. development, manufacture, and deployment of stocks of compact, easily transported, high-voltage restoration trans- Recommendation 7.5 The Department of Homeland formers for use in temporary recovery following the loss of Security with the Department of Energy and the electric several to many regular transformers. reliability organization should work with utilities that have not yet done so to: Recommendation 7.2 Utilities and federal, state, and local governments, and law enforcement agencies should develop Establish a team reporting to top management that official memoranda of understanding (MOUs). These MOUs coordinates physical, cyber, and operations security should spell out each party's responsibilities before, dur- through comprehensive plans that clearly define what ing, and immediately following a deliberate destruction is expected of security personnel before, during, and of utility equipment that leads to a disruption of electric after a deliberate destructive act; identifies the tech- service; provide a clear understanding of who is in charge; nologies and strategies to be used to continuously and explain how decisions will be reached in dealing with monitor critical company facilities; and establishes potential tensions between crime scene investigation and an Incident Command System and designates an timely service restoration as well as unanticipated contingen- incident commander to work with outside agencies. cies. The MOUs should also help to ensure the appropriate Examine their internal radio communications sys- allocation of resources, and address concerns about potential tems to determine that battery backup systems and government seizure of utility supplies and equipment during portable generators are in place to ensure that all catastrophic events,9 which can seriously hinder prompt util- communication devices will remain operational ity restoration of electric service. during a crisis. Because traditional communication systems may become unavailable during a destruc- Recommendation 7.3 State and federal law or regulations tive attack on the electric system, options such as should be modified to: satellite communications should be evaluated (and periodically tested) for potential use as backup com- Recognize utilities as essential service providers so munication. In addition, the ERO could help ensure that relevant utility employees can be trained and that neighboring utilities and operators have compat- legally designated as first responders to deal with ible communications systems. attacks on the power system. Assess black-start capabilities in their systems under Provide utilities, when needed, with temporary the assumption that major physical disruption of the exemptions from laws that restrict their use of equip- transmission system can occur, develop appropriate ment, access to roads, materials, supplies, and other contingency plans, and test both the plans and the critical elements for restoration of electric service to equipment on a regular basis. essential loads, including those that have an impact Assess the potential for the cascading collapse of on public health and safety. long stretches of transmission line, and, where appro- Ensure that state regulatory agencies support prudent priate, include offsetting towers at various intervals efforts by utilities to commit and acquire the neces- or reinforcing or upgrading towers at more frequent sary resources for service restoration and provide intervals along the line. reasonable assurance for recovery of these costs. Recommendation 7.6 State legislatures should change Recommendation 7.4 The Department of Homeland Secu- utility law to explicitly allow micro-grids with distributed rity and the Edison Electric Institute should jointly develop generation. IEEE should revise its standards to include the appropriate use of islanded distributed generation and micro- grid resources for local islanding in emergency recovery 9For example, during Hurricane Katrina there were efforts by some operations. Utilities should reexamine and, if necessary, government entities to commandeer some utility communication systems and fuel supplies. revise their distribution automation plans and capabilities in

OCR for page 69
RESTORATION OF THE ELECTRIC POWER SYSTEM AFTER AN ATTACK 81 light of the possible need to selectively serve critical loads EPRI. 2006. "Recovery Transformer--A Prototype Factory Build during extended restoration efforts. Public utility commis- and Test Project." Available at http://www.epriweb.com/public/ 000000000001014534.pdf. sions should consider the potential emergency restoration IEEE (Institute of Electrical and Electronic Engineers). 2003. P-1547: benefits of distribution automation when they review utility IEEE Standard for Interconnecting Distributed Resources with Electric applications involving such investments. Power Systems. IEEE Standard 1547-2003. New York: IEEE. Approved June 12. King, D.E. 2006. "Electric Power Micro-grids: Opportunities and Chal- REFERENCES lenges for an Emerging Distributed Energy Architecture." Ph.D. Thesis, Department of Engineering and Public Policy, Carnegie Mellon Univer- Alderfer, R., T. Starrs, and M. Eldridge. 2000. Making Connections: Case sity, Pittsburgh, Pa. Studies of Interconnection Barriers and Their Impact on Distributed Morgan, M.G., and H. Zerriffi. 2002. "The Regulatory Environment for Power Projects. NREL Report NREL/SR-200-28053. Golden, Colo.: Small Independent Micro-Grid Companies." Electricity Journal 15(9): National Renewable Energy Laboratories. 5257. EEI (Edison Electric Institute). 2006. Section 203 Application and Petition NRC (National Research Council). 2002. Making the Nation Safer: The for Declaratory Order from the Federal Energy Regulatory Commission Role of Science and Technology in Countering Terrorism. Washington, Docket Nos. EC 06-140-000 and EL 06-86-000. Available at http://www. D.C.: The National Academies Press. eei.org/about_EEI/advocacy_activities/Federal_Energy_Regulatory_ Stiegemeier C., and R. Girgis. 2006. "Rapidly Deployable Recovery Trans- Commission/060718FamaFercSpareTransformers.pdf, accessed Oc- formers." IEEE Power and Energy Magazine 4(2): 3845. tober 2007. Walker, J. 1999. "Auckland Light Out from Failure to Recovery (Power EPRI (Electric Power Research Institute). 2005a. Counterterrorism Mea- System Disturbance)." Proceedings of the 21st International Telecom- sures and the Protection and Restoration of an Electric Grid. Infrastruc- munications Energy Conference. PI 3-1. Copenhagen, June 69. New ture Security Initiative. Palo Alto, Calif.: EPRI. October 30. York: IEEE. EPRI. 2005b. "Emergency Communications Phase 1 ISI Report. Infrastruc- ture Security Initiative." Palo Alto, Calif.: EPRI. September 30.