IEEE-USA
       Building Careers and Shaping Public Policy

Response to Questions Posed
By the House Energy and Commerce Committee
Concerning the Northeast Blackout of August 2003

Prepared by

The Institute of Electrical and Electronics
Engineers - United States of America (IEEE-USA)

29 August 2003

IEEE-USA appreciates the opportunity to assist the House Energy and Commerce Committee in its investigation into the causes of the Northeast Blackout of August 2003. IEEE-USA is an organizational unit of The Institute of Electrical and Electronics Engineers, Inc., created in 1973 to advance the public good, while promoting the careers and public-policy interests of the more than 235,000 electrical, electronics, computer and software engineers who are U.S. members of the IEEE. IEEE's U.S. membership includes some of the most knowledgeable technical experts in the areas of electric generation, transmission, distribution and reliability. Based on preliminary analysis of publicly available information, IEEE-USA offers the following in response to the questions posed by Chairman Tauzin:

(1) What were the basic causes and contributing events that led to the August 14th blackout and its severity? Describe the following in your answer: (a) the location, character, and proximate cause of the initial disruption in the transmission and supply of electricity;

The exact sequence of events and their correlation is still being investigated. An important precursor to the event seems to have been the loss of First Energy's Eastlake generating station in Cleveland. However, loss of a single generator is a normal occurrence for which the electric system is designed for and the system is generally operated in such a manner such that this does not create further problems. After the loss of a generator, the system is redispatched or, if this is not possible, load is reduced to accommodate the new conditions in a manner such that reliability and security of the system are preserved. The initial loss of this generator seems to be related to the sequential loss of three heavily-loaded 345 kV transmission lines in Ohio, south of Cleveland.

Loss or disconnection of a generator has two effects on the system. First, the loss of a generator results in an imbalance between load and generation which is immediately compensated by other generators in the system, sometimes far away from the affected generator. This alters many flows in the network. Second, loss of a generator results in the reduced ability to maintain the voltage in the neighborhood of the generator. The loss of the ability to regulate system voltage can also be the triggering event of a cascading power failure.

If there is a loss of generation within an area and there is not enough internal generation, then the area transmission ties need to have enough capacity to transfer energy to supply the load and maintain acceptable system parameters. If the transmission ties do not have enough capacity, then the system reliability and security are at risk.

(1)(b) the "cascading" effect of the disruption through multiple utility systems and States.

A "cascade" can occur on a power system if the balance between load, generation and transmission system flows is disrupted when one or more elements of the electrical grid (generator or transmission line) fails or trips out of service. When an element trips, existing power flows are instantaneously redistributed onto other elements of the grid according to the laws of physics, irrespective of state boundaries or ownership of the transmission facilities. Since electrical control areas (which could be Independent System Operators (ISO's), Regional Transmission Organizations (RTO's), or utilities) are interconnected and operate as a single system, the outage of a facility on one control area routinely affects power flows on adjacent or remote areas.

According to generally accepted reliability criteria, the transmission grid is managed in such a manner that elements of the system should be able to absorb the changes in power flow resulting from the outage of any individual element. Engineers refer to this first outage as a single contingency. Changes resulting from an outage of a single element can cause subsequent problems in some cases if there are pre-existing equipment outages or if the initial event triggers some other failure on the system. Such subsequent events are described as multiple contingencies.

While assessment of multiple contingencies, sometimes called extreme contingencies, is a regular part of the planning and operation of the system, there are a nearly infinite number of combinations of multiple contingencies, making analysis of protection against all possible events impossible. (i.e. low probability "perfect storm" events are always within some realm of possibility.)

It is also understood by all that, after an event occurs, the system must be rapidly returned to a secure state such that the system will, once again, be able to sustain the outage of any further component. Timeliness of the ability to restore the system back to a secure state is a key factor in system operation.

The sequence of events referenced in response to question 1a appears to be related to the subsequent "cascade."

  • The initial line outage apparently overloaded other lines and generation redispatch options to relieve these overloads were either not timely or not available (this is surely being investigated at the moment).
  • About 26 minutes later a second major line outaged and tripped. Again, redispatch by the operator(s) to relieve any additional overloads was either not possible or not available.
  • Almost 15 minutes later two other major lines tripped as a result of overloads. At this point, the system flows had drastically changed as a result of the multiple contingencies.

These line failures, and other events, seem to have initiated a "separation" of the system. Many parts of the system separated successfully (New England and PJM, for example). However, New York and other portions of the system experienced both abnormal power flows and abnormal operating conditions. All generating plants and other facilities are designed to protect themselves in such situations by shutting themselves down immediately. These shutdowns left New York with insufficient power, causing the blackout there.

(2) What efforts have been taken to secure the supply, transmission and distribution of electricity since the blackouts of 1965 and 1977 in the Northeast, and why were these efforts apparently inadequate to prevent the blackout or otherwise minimize the area affected? What efforts have been taken in other parts of the country to prevent blackouts and how effective have these efforts been in preventing or minimizing blackouts?

After the major blackouts of 1965 and 1977 the North American Electric Reliability Council (NERC) was created. The main purpose of NERC was to ensure that every region had sufficient "reserves" (sufficient "extra generation" instantly available) to make sure the system could tolerate the loss of any single piece of equipment without disruption at any time, and in many cases to sustain the loss of more than one piece of equipment. It also adopted rules that diversified these reserves sufficiently throughout the system to make sure that no major transmission problems would occur. Furthermore, NERC also adopted emergency policies in case system separation did occur. It instituted automatic "load shedding" procedures so that if the system frequency went down too much (that is, if after a portion of the system had become separated from another it did not have enough generation) part of the load would automatically be disconnected in a last ditch attempt to save that part of the system.

Another aspect of changes that took place after the 1965 and 1977 blackouts was the evolution in planning and operating procedures of the utilities and subsequently RTOs. Some of the changes include regional planning between utilities and NERC regions, operator certification, introduction of SCADA (Supervisory Control And Data Acquisition) and EMS (Energy Management Services), digital control and protection systems, communications, and black start procedures. Another aspect of the changes were the adoption of planning and operating practices as adopted by the RTOs and system operators to deal with these situations.

Because we do not yet know the specific cause or causes of the event, we cannot comment on why the measures that are in place were inadequate to prevent the blackout or minimize the affected area. What we can say is that since 1965,with the implementation of the measures described above plus infrastructure additions to the electric system, we have more closely coupled the electric systems like the areas of New York and Ohio. This means an event in Ohio can be felt in New York and vice versa; which could also mean the increased risk of more widespread outages.

(3) What equipment, measures or procedures worked as intended on August 14th to prevent even greater disruption to the supply of electricity, to prevent greater damage to the generation and transmission system, and to bring generation back on line after the disruption?

The fact that system separation took place successfully in many regions of the system (New England, PJM, the rest of Michigan and the Midwest) is evidence that the blackout was contained. As stated previously, the affected area is part of the larger area, Eastern Interconnection, and as such, the entire interconnection, from Maine to New Mexico and from Manitoba to Florida was at risk. In addition (and more important) because most pieces of equipment protected themselves by disconnection (have notably most power plants), they suffered no permanent damage and were able to be brought back online within a day or two (some plants, particularly nuclear power plants, have very strict reconnection and repowering protocols). Unlike the 1977 and particularly the 1965 blackouts, there were "blackstart" procedures in place and people knew what to do to bring the system back up in an orderly fashion without panic. This does not mean that reconnection is simple: it is a very complex problem. But training of operators and others resulted in the ability to bring the system back online in a relatively smooth fashion.

(4) How can the nation's electrical system, including both transmission capacity and reliability, be improved to prevent a recurrence of the events of August 14th? Please identify what measures may need to be taken by all involved in the governmental and nongovernmental sectors.

The nations' electric power system should be planned, designed and operated to a level of reliability where the system is protected from reasonable foreseeable contingencies so as to prevent incidents such as cascading outages. Reliability of the nations' electrical system depends upon four essential elements, all of which involve both government and non-government sectors:

  1. An institutional framework for the industry consistent with the technical characteristics of the system. This includes (i) mandatory reliability standards; (ii) clear regulatory boundaries between the federal government and the states, who must work cooperatively with each other; (iii) regional planning process and criteria; (vi) design policies that limit failures (see below); (v) incentives for new technologies; (vi) Federal siting backstop authority; and (vii) procedures for demonstrating compliance.
  2. Adequate resources to meet existing and projected customer demand. This includes balanced and coordinated relationship of resources; i.e. type, size, capacity, and location.
  3. Coordinated and integrated operation of the transmission system and regional wholesale markets to promote reliable operation and market efficiencies. By its very nature, there has always been and there will continue to be a balance between economy and reliability. Mandatory reliability standards without market rules that are consistent with those standards will produce incomplete results. Incentives may still exist for market participants to engage in unreliable behavior. Coordination of system and market operation includes (i) economic incentives compatible with reliable operation (see below); (ii) facilitating timely re-dispatch across regions; (iii) clear operational authority; and (iv) regional oversight.
  4. Timely recovery and restoration when unforeseen events occur. This includes (i) Communication and technology (see below) (ii) Operator training, drills etc.; (iii) Utility emergency plans; and (iv) Utility/government cooperation, drawing on work already started on protection of critical infrastructure.

The resolution of these problems in the future requires attention to three specific matters:

(a) Prevention.

  • Grid investment: Prevention requires that the system be strong to begin with. This may require additional lines to be built and/or additional generation in the appropriate locations. Whenever appropriate, new technology and innovation must be brought to bear in the improvement of system reliability. Strong planning processes with regional coordination are required.
  • Grid operation: It is essential that the system be operated in a manner that is consistent with reliability. The incentives to run the system reliably must be made compatible with the economic incentives of the generators and the consumers. In this context it is simply not possible to pretend that power system reliability and power system markets are separable or only loosely coupled. Operators must have sufficient authority over the system and adequate communication facilities and procedures to be able to deal with reliability concerns in a timely manner. Operator training is also critical.
  • Grid coordination: Consistency of operating rules and protocols for reliable operation must transcend state and utility boundaries. Because of this, it is important that NERC and FERC work together to promote the right kinds of rules and procedures for attaining and ensuring the reliability of the system. IEEE USA supports the passage of reliability legislation section of the House Energy Bill.

(b) Limitation of extent of failures.

In some sense, large-scale systems will always be at some risk of large-scale failures, no matter how many prevention measures are adopted. There must be recognition that in complex systems there are "threshold levels" that, once exceeded, the system behavior becomes extremely vulnerable to disruptions in a seemingly disproportionate manner. We must adopt policies that help to mitigate the impact of future failures. Some examples include the following:

  • As in the West, redesigning our large synchronous grids to break apart, under emergency conditions, into viable, survivable electrical sub- grids (or "islands") may have substantial benefits to the public. Such a design would permit the viable portions of the system to continue to serve customers, while only faulted or failed portions were "blacked out".
  • Emergency use of distributed generation resources, available not for bulk power generation but for reliability enhancement, might help to mitigate the impact of future outages.
  • The opportunity for customer loads to contribute to the enhancement of system reliability must be considered. The ability and the incentives for customers to reduce their maximum power use or to shift to essential loads only during emergencies should be explored.

(c) Recovery.

  • Protocols and procedures for recovery from failures must continue to be investigated and improved. Much new thinking and engineering design needs to devoted to this issue to minimize the impact of any future disruptions to the grid. For example, if designed to operate in an "islanded state", restoration of the existing grid might be expedited and facilitated. Restoration of service to each of the islands would be handled separately (and in parallel) by the island system operators. Only those portions of the system that had suffered physical damage would be delayed in restoring service. Return of the various functioning islands to connected, synchronized operation could then take place at a less "frantic" pace, because basic service would have already been restored to end use customers.

Conclusion

It is important, from a governmental perspective, to reduce the extent of regulatory uncertainty. Furthermore, the development of good and sensible rules that are "stress-tested" by independent experts and lead to reliable operation is a must. Incompatible rules between states or companies further compounds reliability problems.

Reliability will be protected by drawing on the fundamental technical knowledge that already exists. There is a great body of knowledge available through IEEE Power Engineering Society and other sources. Power system planning and operation is well understood. Technology exists to assure reliable operation of the system if the regulatory and institutional arrangements for the industry are structured in a way that encourages its cost effective deployment.

Involvement by technical experts in establishing policy structures for the industry is needed. Under either a regulated or deregulated environment, events have shown that the electric grid remains a complex system whose operation is not well understood by the general public or by many in policy-making positions. An effective framework for the industry must integrate the technology, business interests and public interest in a way that provides incentives for behavior that contribute to reliable operation.

IEEE-USA stands ready to marshal the expertise of our members to assist the committee and Congress in its efforts to better understand the underlying causes of the Northeast Blackout and the technical operations of our national electric power system, as well as to identify steps that would strengthen its operations and reliability.


| Top of Page | Policy Log | Public Policy Forum | IEEE-USA |


Last Update: 29 August 2003
Staff Contact: Bill Williams, bill.williams@ieee.org

Copyright 2003, The Institute of Electrical and Electronics Engineers, Inc.
Permission to copy IEEE-USA policy communications is granted for non-commercial uses with appropriate attribution, unless otherwise indicated.