HC 1552 Developing Threats to Electronic Infrastructure

EIS 004

Written evidence from National Grid

Key Messages

· Severe Geomagnetic Disturbances (GMD) resulting in Geomagnetically Induced Currents (GIC) in high voltage transmission systems are a category of what is known as High Impact Low Frequency (HILF) events.

· Severe GMD events can be as a result of natural causes from solar activity and space weather or artificial causes such as High Altitude Electromagnetic Pulse (HEMP) from a nuclear detonation or other man made activity such as Intentional Electromagnetic Interference (IEMI).

· Space weather is the term for changes in the sun-earth environment analogous to the atmosphere and terrestrial weather. While the weather on earth is well understood, space weather forecasting is in its infancy.

· The effects of space weather on transmission systems has been known for some time and National Grid is a world leading transmission operator in understanding the effects and developing operational mitigation actions.

· HEMP is a more recent perceived risk raised particularly in the US and has resulted in the Shield Act legislation being progressed.

· HEMP effects are not well understood, there is almost no experience to estimate the effects but it is probable that they will be unforeseen, extreme and affect much more than transmission systems. For this reason mitigation policy for HEMP is extremely difficult to develop.

           

The extent of any threat posed to UK electronic infrastructure by electromagnetic pulse (EMP) events caused by space weather events, nuclear weapons detonated at high altitude or other EMP weapons

1. National Grid is fully aware of the threat of disturbance to the Electricity Transmission System from the effects of space weather and take this very seriously.

2. National Grid first realised the seriousness of the problem after the Solar Storm of March 1989, during which two transformers were damaged by overheating.

3. As a result of discussions with DECC at the Space Weather: Energy Partners Meeting on 21 September 2010, National Grid raised the level of its Worst Case Planning Scenario from a storm of size 500 nT/min to 5000 nT/min.

4. National Grid’s operating procedures propose to deal with the effects of severe Geomagnetic disturbance (GMD) by operational mitigation strategies, as outlined in National Grid BP1832. This includes daily monitoring of the space environment, principally using information provided by NOAA and NASA.

5. We also work with key partners to understand threats. This includes the British Geological Survey, Met Office, SUNBURST, EURISGIC, University of Manchester and NASA, and National Grid maintains regular contact with NERC (UK), NERC (US) and the Solar Shield project.

6. As a result of concern in the US, National Grid has considered the threat from a high altitude nuclear device and the corresponding electromagnetic pulse (HEMP). If such an event were to occur, significant damage could occur to both the Electricity and Gas Transmission Systems.

7. The United States Congress commissioned a report, Commission to Assess the Threat to the United States from EMP Attack, to assess the threat from EMP. It concluded that ‘It is not practical to try to protect the entire electrical power system or even all high-value components from an EMP event….Widespread collapse of the electrical power system in the area affected by EMP is virtually inevitable after a broad geographic EMP attack. [1] Also, ‘Industry is responsible for assuring system reliability, efficiency and cost effectiveness…. Government is responsible for protecting the society and its infrastructure, including the electric power system. [2]

8. HEMP produces a short lived (nanoseconds) E1 phase, an intermediate (milliseconds) E2 phase similar to a widespread lightning storm, and a longer lived (tens of seconds) E3 phase. All are capable of disrupting or damaging the Transmission Network over a distance encompassing the whole UK.

9. Supervisory Control and Data Acquisition Systems (SCADA) are susceptible to the E1 pulse. Control systems, Protection systems and System State Monitoring equipment can either malfunction or be irreparably damaged by the pulse. Combined with concomitant disruption to communication systems this could leave control engineers effectively blind and unable to act.

10. The E3 pulse is similar to a severe Geomagnetic Storm, except that the quasi-DC currents that flow are many times greater, of the order of 100s to 100s of Amps. This disruption would be an order of magnitude greater than National Grid has planned for.

11. Research to investigate options to harden the UK system, rather than relying on operational procedures as is appropriate for solar events, would be needed to mitigate this threat. But given the size of the undertaking, and the subsequent cost of procurement and installation, this is beyond the resources of any one commercial organization, or group of organizations, and would need to be pursued at national level.

The extent to which space weather is forecasted and the effectiveness of early warning systems that may be in place

12. According to the director of NOAA’s Space Weather Prediction Center ‘Space weather forecasting is still in its infancy. [1] An expert at the Met Office likened the current state of Space Weather forecasting to terrestrial weather forecasting techniques a hundred years ago. [2]

13. Space Weather forecasting requires information gathered by spacecraft and satellites: principally the two STEREO spacecraft, SOHO, GOES, and ACE.

14. ACE is particularly important as it sits at the L1 point, a million miles from Earth, and is able to detect the polarity of incoming Coronal Mass Ejections (CMEs). ACE was launched in 1997 for an operational mission of 3 years. It is now well beyond its original operational life, although it has fuel capacity to take it to 2024. Crucially, it is a single point of failure in our ability to forecast Space Weather.

15. CMEs can take from 18 hours to 3 days to reach Earth. Forecasting models are used to decide on their trajectory and timing. NASA issue forecasts of arrival time giving a six hour window. However these forecasts are frequently inaccurate, with the actual arrival being many hours early or over a day late.

16. Models for what happens once the CME starts to interact with the Earth’s magnetosphere are far less advanced. There are models that describe the interaction in high Polar regions. These models can predict fluctuations in the magnetic field at ground level with 50% accuracy. However, the models run ~300 times slower than real time, so are not useful for practical forecasting.

17. There are currently no models that can predict the effect of a CME at the latitudes occupied by the UK.

18. National Grid relies on rough estimates of the size of the CME impact issued by NOAA at the time the CME is ejected from the sun; the size and polarity of the magnetic field disturbance at the ACE spacecraft, with a lead time of 25-45 minutes; modelling of generic scenarios using the BGS/NG modelling tool.

The potential impact of such events for both civilian and military infrastructure

19. Geomagnetic disturbances from naturally occurring Solar Storms cause quasi-DC Geomagnetic currents to flow in long transmission lines, and to pass through neutral earthing connections in Supergrid transformers (SGTs). The size of these currents depends on the exact dynamics of the CME interaction with the magnetosphere, the position of the jet stream above the UK and the geological makeup of the rock beneath the surface of the UK.

20. Direct current, superimposed on top of the AC current that transformers are designed for, can cause the core of the transformer to saturate, and this in turn leads to flux leaking out using routes such as transformer bolts. This then leads to overheating and potentially catastrophic damage to the transformer.

21. Evidence for transformer damage comes from: the UK experience of 1989, when, anecdotally, two transformers overheated after being exposed to GIC of ~30 A; the failure of a transformer at Salem, USA during the same storm; and failures of six transformers in South Africa in the 12 months after the Halloween storm of 2003.

22. Based on the most severe event that National Grid plans for, a storm of 5000 nT/min, 10 times greater than the 1989 storm, National Grid expects that, without mitigation strategies, its worst case scenario is of the order of 9 transformer failures in England and Wales, the location of these transformers being at the edge of the network. This number of failures is within the capacity of National Grid’s spares policy (even before the recent review of that policy).

23. If all transformers at a node are damaged then, depending on the location of the node within the network, this could result in a local area being disconnected until replacement transformers could be installed. Replacing a transformer can take two or more months depending on the availability and location of spares. In this extreme event scenario National Grid estimates that the probability there would be a disconnection event is 62% for England and Wales, and 91% for GB as a whole.

24. The number of nodes expected to fail is 0.9 in England and Wales and 1.1 in Scotland. There are 4 locations in England and Wales where the failure is most likely to occur, and 3 in Scotland. None of these locations has a high population density.

25. Because of their design and heavier loading National Grid believes that Generator Transformers are at more risk than SGTs. National Grid is working with DECC and the Generator Operators to include generator transformers in its modelling and mitigation plans.

26. A secondary effect is the creation of harmonics in the saturated core of the transformer. These propagate out and can cause malfunction of protective relay equipment, switching out hardware needed for stabilisation of the network. It was this type of event that caused the blackout of the Hydro-Quebec system in 1989, and the blackout of Malmo, Sweden, in 2003.

27. The effect of E1 and E3 pulses from HEMP would be considerably more extreme. For these effects we have no practical experience to fall back on, [1] although the Commission to Assess the Threat to the United States from EMP Attack did conduct a number of experiments on E1 and its effect on SCADA. They concluded that ‘Large-scale load losses in excess of 10% are likely at EMP threat levels, [2] and that ‘widespread collapse of the electrical power system…..is virtually inevitable. [3]

28. Although National Grid recognizes the threat from other sources of deliberate EMP generation, given the localised nature of the effects we do not believe that the consequences would be severe. For instance, if a localised EMP pulse were able to penetrate the National Control Centre, the system is capable of being run from alternative locations without loss of load.

Ways of mitigating electromagnetic pulse events, either targeted or naturally occurring

29. For GMD caused by naturally occurring Space Weather events, National Grid has a set of operational strategies to mitigate the effects. These include routine daily monitoring of the space environment. In the event of a serious storm being likely National Grid would operate an all-in policy, where all available lines and all transformers would be brought into service (reducing load on individual units), power transfers between regions would be reduced, increased reactive power would be instructed to help stabilise voltage swings, and all generators would be instructed to generate. In addition, a simultaneous tap change on transformers could be instructed to lower system voltage, which reduces the risk to transformers.

30. In the event that the storm was so large (a superstorm) that it exceeded National Grid’s worst planned-for scenario, then, in conjunction with Government, National Grid would consider a controlled shut-down of the network. National Grid has a well developed Black Start Policy. Training exercises are regularly held on Black Start, and generating units are at all times scheduled for Black Start capability.

31. National Grid is developing in conjunction with BGS a tool for monitoring of GIC current flows based on real-time magnetometer data. This tool will also be able to be used as an analytical tool for assessing various possible scenarios.

32. National Grid has recently reviewed its spares policy and has increased the number of spare transformers that it holds.

33. As explained in the National Grid consultation document Operating the Electricity Transmission Network in 2020, managing the Transmission System with much higher penetration of intermittent generation will require greater resiliency and higher reserve requirements. The effect of this will be to harden the system and make it less susceptible to the effect of GMD.

34. National Grid is actively considering the introduction of series capacitance on the long lines connecting England and Scotland. These are capable of blocking the flow of GICs.

35. National Grid has considered the use of devices for providing permanent or switchable resistance to ground. It may be that the design characteristics of UK transformers make them unsuitable for such devices so further work is needed to assess the efficacy of such measures. At present National Grid is not planning to install these devices to counter the effects of GIC. In the event of HEMP, and an E3 pulse it is not clear that switchable devices would work, as the control mechanisms would be affected by the earlier E1 pulse.

36. With regard to HEMP, National Grid agrees with the Commission to Assess the Threat to the United States from EMP Attack that ‘it is not practical to try to protect the entire electrical power system or even all high-value components from an EMP event, [1] and that ‘the key to minimizing catastrophic impacts from loss of electrical power is rapid restoration. [2]

37. Rapid restoration of communication systems is vital. The recommendations of the US report suggest that in the US responsibility for this falls on the Department of Homeland Security.

38. Again, from the US report: ‘To better understand EMP-related system response and recovery issues, conduct in-depth research and development on system vulnerabilities. The objective is to identify cost effective and necessary modifications and additions in order to further achieve the overall system performance. Specifically there should be government-sponsored research and development of components and processes to identify and develop new consequential and cost effective approaches and activities. [3]

October 2011