This document is an argument put before the Federal Energy Regulatory Commission (FERC). It states:
- the lifetime probability of a severe solar storm is about 1 in 2, and the chance of that storm resulting in a catastrophe is substantial, perhaps near 100 percent
- liability avoidance games are keeping FERC from creating standards that would protect Americans from this threat
UNITED STATES OF AMERICA
FEDERAL ENERGY REGULATORY COMMISSION
Docket No. RM15-11-000
Reliability Standard for Transmission System Planned Performance for Geomagnetic Disturbance Events
TESTIMONY OF THE FOUNDATION FOR RESILIENT SOCIETIES
By Thomas S. Popik, Chairman, for the March 1, 2016 Technical Conference
Submitted to FERC on February 23, 2016
My name is Thomas Popik, and I am chairman of the Foundation for Resilient Societies, a nonprofit group dedicated to the protection of critical infrastructure, including the North American electric grid. Since 2011 Resilient Societies has participated in the many meetings of the Geomagnetic Disturbance Task Force at the North American Electric Reliability Corporation (NERC), including giving presentations before the group on three occasions. We have expended thousands of hours of professional staff time in the NERC standard-setting process and in preparing docket comments for FERC. Our group includes well-known experts in critical infrastructure protection. We appreciate this opportunity to present on behalf of grid protection standards essential for the public interest.
Before getting into the technical substance of my remarks, I would like to disclose a personal concern. My wife and I have several children. Like many parents, we worry that some accident or other tragedy will befall them. As reassurance, I have here an actuarial life table published by the Social Security Administration. According to this table, there is a small chance that American children will die prematurely. On average, they should live into their seventies.
However, the Social Security table does not include the probability that millions of today’s young children will prematurely perish in a multiple-year blackout due to a severe solar storm—a risk confirmed by a 2010 report produced by the Oak Ridge National Laboratory. (Oak Ridge National Laboratory (2010), Electromagnetic Pulse: Effects on the U.S. Power Grid; Executive Summary. Retrieved from http://www.ferc.gov/industries/electric/indus-act/reliability/cybersecurity/ferc_executive_summary.pdf. ) The Oak Ridge report says the chance that a severe solar storm could cause a multiple-year blackout for 130 million Americans is about one percent per year, or about ten percent per decade. Other published research confirms this probability.
There are numerous ways that solar storms could cause wide-area, catastrophic blackouts. High voltage transformers in critical locations could melt down, catch fire, or explode. The voltage of the grid could collapse. Control devices called “relays” could malfunction. Generators could overheat and fail. Direct current transmission lines could trip off. And when the storm hits satellites in orbit, it could interrupt the Global Positioning System (GPS) timing signals vital for wireless networks increasingly used for grid substation control. GPS timing is also vital for synchrophasor operation—the very equipment that utilities propose to use to prevent transformer overheating and grid collapse during solar storms. Let us remember that a relatively small solar storm already caused a blackout for the entire province of Quebec in just 92 seconds in March 1989.
In its February 2012 report on solar storms, NERC promoted the dangerous idea that a severe solar storm will cause rapid grid collapse and therefore prevent transformer overheating and permanent damage. Supposedly, the grid could then be quickly restored.2 This wishful NERC thinking lacks scientific and factual basis. Solar storms do not necessarily hit the earth once and then cease—for example, the October 1989 storm had three peaks over five days. After the first collapse, electric utilities might restart the grid, using limited supplies of fuel for power restoration (the industry term is “blackstart”), only to experience another grid collapse. Recovery from an outage lasting more than three days would be very difficult—and perhaps impossible—because the commercial telecommunications system, upon which the grid depends, typically has only two or three days of fuel for backup generators.
The March 2011 disaster at Fukushima, Japan dramatically showed what happens when nuclear plants lack electric power for cooling. The industry standard for supplies of diesel fuel for backup power at nuclear plants is seven days. Significant earth impacts of the Carrington Events of 1859, recorded history’s most severe solar storm, occurred over eight days, from August 28 to September 4. (North American Electric Reliability Corporation (February 2012), Special Reliability Assessment: Interim Report; Effects from Geomagnetic Disturbances on the Bulk Power System. See page iv, "restoration times from system collapse due to voltage instability would be a matter of hours to days..." Retrieved from http://www.nerc.com/pa/Stand/Geomagnetic%20Disturbance%20Resources%20DL/2012_GMD_Report_112012.pdf 3 Green, James; Boardsen, Scott (2006), "Duration and extent of the great auroral storm of 1859," Advances in Space Research, Vol 38, Issue 2, p. 130-135. See Figure 3 for a display of timing and duration of the storm's impacts on earth. Retrieved from http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20050212156.pdf.)
In conclusion, the lifetime probability of a severe solar storm is about 1 in 2 and the chance of resulting catastrophe is substantial, perhaps near 100 percent. The likely outcomes include failure of multiple infrastructures critical to the basic function of modern society; widespread starvation and civil unrest; and hundreds, thousands, or even millions of deaths. We therefore estimate the probability that large numbers of today’s young children will prematurely die during their lifetime because of a severe solar storm is about fifty percent, absent any hardware protection of the electric grid.
It is fortunate that protecting the North American grid against solar storms would be inexpensive. “Neutral ground blocking devices” can protect transformers and other sensitive equipment from malfunction and burn-out. This government-tested protective equipment is commercially available and costs about $350,000 per installation, with a maximum of about 2,500 locations with high voltage transformers needing protection. The Oak Ridge National Laboratory has concluded that protecting the electric grid against solar storms would cost only 20 cents per ratepayer per year. Our estimate is slightly higher at 58 cents per ratepayer per year. (We calculated our estimate for annual protection cost by multiplying the cost per neutral blocking device installation of $350,000 by 2,500 extra high voltage transformer locations and then dividing by 150 million ratepayers. We then amortized $5.83 over ten years to reach an annual cost per ratepayer of 58 cents.)
So it was with good intent in May 2013 that the Commissioners of FERC ordered that the North American Electric Reliability Corporation (NERC) set a reliability standard to protect the American and Canadian public. However, after nearly three years of deliberations, the resulting NERC standard will not require electric utilities to install real protection. Instead, the standard will require electric utilities to perform paper studies to show that no protection is necessary.
How did we get here? FERC mandated that NERC set a so-called “Benchmark Geomagnetic Disturbance Event.” This benchmark would establish the maximum 1-in-100 year storm that electric utilities must protect against. But when the NERC Standard Drafting Team developed the benchmark event, they did not use data on storms impacting North America – but data from Scandinavia. Nor did they collect data on past storm effects on critical grid equipment such as high voltage transformers.
Surface weather causes wind, waves, and tides that we can feel and see, but we cannot directly perceive harmful currents that surge through high voltage transmission lines and burn out transformers at the ends. To make this unfamiliar situation easier to understand, please allow me to make an analogy. (Throughout our testimony, we refer to Geomagnetically Induced Currents (GIC) by the more accessible terms “harmful currents that surge” and “surge currents.” We likewise use the more understandable descriptor “solar storms” to refer to technical term of Geomagnetic Disturbance (GMD))
Suppose that the federal government ordered a standard be set for the height and strength of levees to protect against hurricane storm surges―such a standard might have saved New Orleans from Hurricane Katrina and New York from Hurricane Sandy. As a matter of both good science and common sense, the drafters of such a standard would collect past data on maximum wind speed during hurricanes, the height of past storm surges impacting levees, and which levees failed. The equivalent data for solar storms would be the strength of the magnetic fields in the atmosphere, the magnitude of harmful currents surging in transmission lines, and the current levels at which high voltage transformers exploded, caught fire, or otherwise failed.
However, the drafters of the NERC standard did not collect and use this relevant solar storm data for North America, even though it is available. Instead, the drafters of the NERC standard collected European data on magnetic fields during a 21-year period when no major storms occurred. Importantly, the drafters of the NERC standard did not use the maximum magnetic fields observed in Europe, but instead averaged the magnetic fields downward over time and distance. NERC’s standard drafters then used some complicated and dubious statistical methods to estimate the magnitude of a 1-in-100 year solar storm in North America.
NERC’s statistical methods are similar to predicting the maximum strength of hurricanes for North America based on average wind speed readings during squalls in Europe. Their approach is illogical and unscientific.
Much data on solar storms within North America exists. The United States Geological Service (USGS) has operated a network of magnetic field meters for many decades. An industry research organization, the Electric Power Research Institute (EPRI), has collected data on harmful storm surge currents in transmission lines for 25 years. And because high voltage transformers cost $5-10 million to replace, electric utilities have records of transformer failures and can determine if these failures occurred during or shortly after solar storms.
Returning to my analogy, there is not a perfect correlation between wind speed and the resulting height of hurricane surges. Many factors come into play, including the topography of the local seabed. A similar situation exists for the relationship between magnetic fields and storm-induced currents in transmission lines; the U.S. Geological Service tells us that local ground conditions can cause variations by a factor of ten, or even a hundred.
Because, scientifically, local conditions matter greatly, do you think that the record of wind speed readings in Madrid, Spain should be used to set the safe height of hurricane levees for New Orleans, Louisiana—without analyzing local data during previous hurricanes, including the height of the storm surge upon levees? To set hurricane building codes, does it make sense to average downward high gusts of wind? No responsible standard-setting body or government authority would allow this.
Knowing that local conditions matter greatly, do you think that past readings of magnetic data from Europe should be used to set storm safety standards for transmission lines in North America—without considering American data from previous solar storms, including the surge amperage in transmission lines? To set grid safety standards, does it make sense to use average readings of magnetic fields in periods with no major storms rather than the highest readings during large storms? Again, no responsible standard-setting body or government authority would allow this―yet this is exactly what the NERC Standard Drafting Team has done.
Our organization, Resilient Societies, earlier located more than 100 solar storm current monitors operated by utilities in North America. We estimate there are roughly twice that many now deployed. Data from these and additional current monitors could be used to develop more accurate projections of current surges in transmission lines during solar storms. NERC has established procedures to collect data from its member utilities; however, when we requested that the NERC Board of Trustees require collection of solar storm data to enable scientifically valid models, findings, and standards, this request was denied.
Accurate projections of current surges during solar storms might mean that electric utilities would have to install real protective devices, not just conduct paper studies. Two utilities, Central Maine Power and PJM, conducted studies based on the draft NERC standard to determine how many of their transformers might need protection under NERC’s benchmark event. On the projection screen, you can see the results of these studies. For Central Maine Power, only one of their fourteen high voltage transformers might need protection. For PJM, only two out of approximately 560 high voltage transformers might need protection.
During the moderate level March 1989 solar storm, a transformer within the PJM network failed due to melted windings, but the PJM study shows the replacement transformer at the Salem 1 nuclear plant is completely exempt from needing protection. A second transformer at Salem 2 failed due to an even smaller solar storm on September 19, 1989, yet this location is exempt from needing protection, too. (United States Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation (June 19, 1990), Information Notice No. 90-42: Failure of Electrical Power Equipment Due to Solar Magnetic Disturbances. Retrieved from http://www.nrc.gov/reading-rm/doc-collections/gen-comm/info-notices/1990/in90042.html.) The experience with multiple failed transformers at the Salem nuclear plants is powerful evidence that the NERC benchmark event, with its prescription for non-protection, is just plain wrong.
When I said “transformers might need protection,” I chose my words carefully. Because even if utility studies show that high currents will impact transformers during solar storms, under the NERC standard, utilities can then conduct another round of analysis to show that their transformers can supposedly withstand the high currents.
You might ask if there have been tests of transformers under realistic conditions to see if they can withstand high currents generated during severe solar storms. For the purposes of the NERC standard, electric utilities tested only three transformer designs—out of thousands of unique designs used in the North American grid. And these tests did not subject the transformers to realistic storm conditions. Why? Because electric utilities would be reluctant to carry out such tests for fear of damaging their transformers.
Yes, this is a direct quote from a reference article used by the NERC Standard Drafting Team―“for fear of damaging the transformer.” Based on these unrealistic tests, and excluding data on transformer failures during past solar storms, the NERC Standard Drafting Team set a “thermal assessment limit” of 15 amps. If predicted currents during a 1-in-100 year storm are less than 15 amps, transformers would have been assumed to be immune and therefore exempt from any analysis. But there was a problem—the standard with 15 amp thermal assessment limit failed to pass the NERC vote. The NERC Standard Drafting Team then changed the thermal assessment limit to a scientifically unsupported level of 75 amps―and the standard handily passed the next ballot. The “IEEE Guide for Establishing Power Transformer Capability while under Geomagnetic Disturbances,” published in September 2015, recommends a more prudent range of 15 to 75 amps for transformer thermal assessments—not a less stringent cut-off of 75 amps.
In September of 2012, Idaho National Lab (INL) conducted full scale testing to replicate the conditions utility users would experience on the electric grid during a solar storm. “These tests not only confirmed model predictions of power interruption and equipment damage, but they also revealed several other unexpected secondary effects that must also be taken into account,” said Scott McBride, the INL program manager. “Hearing a 150,000-pound transformer shaking and groaning while under heavy saturation during a simulated geomagnetic storm is a sobering experience,” McBride observed from the INL tests.
In early 2015, the U.S. Department of Energy commissioned the Los Alamos National Laboratory to conduct an independent examination of NERC’s statistical methods. The scientists at Los Alamos determined that NERC’s methods in standard-setting were wrong, resulting in a benchmark storm event too low by a factor of up to two. Individual biases in the NERC standard have a multiplicative effect. For example, a factor of two error in the benchmark storm event combined with a factor of five error in the transformer thermal assessment limit would result in a combined error of 10 times. In the summer of 2015, the Los Alamos scientists gave a presentation to the FERC Commissioners on the NERC’s defective statistical methods, a presentation much more detailed than what has been publicly released. Under its rules, FERC does not have to disclose what is communicated during private meetings, unless the Commissioners decide to rely on the information for a ruling. Due to this unfortunate legal technicality, if FERC decides to ignore the conclusions of Los Alamos National Laboratory, the public will not learn the details of why the Los Alamos physics model conflicts with the NERC model—a dangerously inappropriate outcome for a reliability standard process that Congress has mandated be open and transparent.
In October 2015, we made a Freedom of Information Act (FOIA) request (FOIA 2016-9) to FERC to obtain the Los Alamos briefing slides and other material supplied to Congress. As of the day this testimony was provided to FERC, over four months later, this FOIA request was still pending. The safety of individuals in our society demands the highest standards of transparency and accountability. We call on FERC and the Department of Energy to immediately release the entire set of full-color Los Alamos briefing slides to the public.
I have told you millions of people in North America could die because of a long-term blackout caused by a severe solar storm. And I have told you that our respected national labs—Oak Ridge, Idaho National Lab, and Los Alamos—are alerting us to this great peril.
By now I hope that the FERC Commissioners might be looking for explanations. Why would the NERC Standard Drafting Team not collect and use data from North America? Why would the NERC Standard Drafting Team use incorrect statistical and scientific methods, such as averaging down magnetic field readings from distant storms in Europe? Why would the benchmark in the NERC standard be set so low that nearly all utilities can meet it without installing protective devices?
One possible answer has to do with utilities’ fear of liability due to non-compliance with a standard that would show clear and widespread vulnerabilities. Strict standards imply a duty to act—and failure to act could be judged gross negligence.
Threatened with tremendous damage claims from solar storms and potential bankruptcy, electric utilities want liability protection. By having a reliability standard so low that most any utility can meet it—without actually doing anything other than paperwork—utilities get that liability protection. An implicit liability shield for utilities was written into the 2013 FERC order for solar storm protection, with the suggestion that the industry could set its own benchmark events. However, the legislative purpose of Section 215 of the Federal Power Act was to strengthen grid reliability, not to shield utilities from liability.
These liability avoidance games with standard-setting have gone on too long. We call upon FERC to remand the NERC standard for solar storm protection, requiring that NERC use relevant data from North America, and other geographies that have experienced major solar storms, and also mandate public disclosure of this data for independent scientific study. It is particularly important that FERC require use and public disclosure of the EPRI SUNBURST data on current surges during solar storms, as well as other industry data on current surges. With millions of lives at stake, the public interest demands nothing less.
We remind the FERC Commissioners that Section 215 of the Federal Power Act mandates standards be “in the public interest.” To counterbalance the NERC ballot body, who are mainly representatives of electric utilities, and the NERC Board of Trustees, who are elected mainly by representatives of electric utilities, the FERC Commissioners should stand for the public interest. “In the public interest,” a phrase recited in every FERC approval of NERC standards, should not be just a pro forma legal finding.
Resilient Societies has participated in the FERC approval process for a number of grid reliability standards to purportedly protect against so-called “high impact, low frequency” events—other examples being the NERC standards for physical security and cybersecurity. An April 2013 physical attack on the Metcalf substation in California nearly caused a blackout for Silicon Valley and San Francisco. A December 2015 cyberattack caused a blackout in Ukraine. But NERC’s dangerous and defective standards for high impact, low frequency events are ridden with loopholes and exemptions, providing little protection to the public. Dysfunction runs deep with NERC standard-setting.
As an excuse, there is a school of thought that weak grid reliability standards are better than none at all; reliability standards should be a “floor” for small and resource-constrained utilities. As part of this wishful thinking, it is claimed the larger utilities will go beyond requirements in a standard to responsibly protect the grid using “best practices.”
For solar storm protection, history shows expecting utilities to responsibly implement “best practices” is a fantasy, especially in this era when cost containment often trumps safety. The floor will be the ceiling, with no room for public safety in between. It’s been 27 years since the moderate March 1989 storm blacked out Quebec―and the North American grid is still not protected. If utilities were going to implement “best practices,” they could have already installed commercially-available and government-tested solutions. As of today, only one hardware protective device has been installed in all of the United States.
Weak reliability standards, such as this NERC solar storm standard, harm the public, utilities, and other stakeholders in significant ways:
- By providing the public a false assurance of safety
- By preventing cost recovery for utilities that wish to implement protection above the minimum required
- By undermining utility engineers who internally advocate for more prudent protection of expensive equipment and their utility ratepayers
- By harming vendors that have put their own capital at risk to develop and test protective equipment
- By causing damage to customer equipment, such as harmonic damage to motors during solar storms, and thereby raising rates for casualty insurance and business interruption coverage
- By giving false signals to the equity market on financial risks for investor-owned utilities and the true value of these enterprises
- By obscuring the need for other remedies, such as reform legislation by Congress
Already FERC has approved a Phase 1 NERC standard for utility operating procedures during solar storms. This transparently defective standard requires no mandatory monitoring of surge currents in transmission lines or at generating plants during storms. Nonetheless, the standard requires utilities to make real-time adjustments in generation and transmission line loading to counteract storm effects. In effect, FERC has legitimized “flying blind” for both transmission and generation operators during solar storms.
Other elements of our society are realizing the gross defects of the NERC-FERC standard-setting process. For example, grid reliability legislation pending in Congress gives greater authority to the Department of Energy to mitigate emergencies, but not to FERC. The recently released National Space Weather Strategy from the White House has zero reliance on NERC’s defective solar storm standards; instead, federal agencies will develop their own benchmarks for solar storm events. If NERC’s empty standards continue to be rubber-stamped, FERC risks discredit.
As I said at the outset of my testimony, the lives of millions within North America are at grave risk due to severe solar storms. There is an exceptionally strong case against this dangerous and defective NERC standard for solar storms. The FERC Commissioners have an excellent opportunity to show NERC and the electric utility industry that intentionally weak reliability standards are not in the public interest and will no longer be tolerated.
I ask, who here among us, given the irrefutable risk of solar storms and the cost-effective remedies available, does not wish to take decisive action before a catastrophic storm hits? I look forward to any questions you might have.
Effective GIC in transformers for variations in geoelectric field
From “2014 Maine GMD/EMP Impacts Assessment, A Report Developed for the Maine Public Utilities Commission," Central Maine Power Co., December 2014, page 26.
Transformers with the highest GICs
From “NERC GMD Reliability Standards,” Frank Koza, PJM, Chair of NERC GMD Standard Drafting Team, INL Space Weather Workshop, Idaho Falls, ID, April 8, 2015, page 19.