image: University of Vermont power-system expert Paul Hines has developed a new study showing why it would be hard for terrorists to bring down the US electric grid. view more
Credit: Courtesy Paul Hines, University of Vermont
Last March, the U.S. Congress heard testimony about a scientific study in the journal Safety Science. A military analyst worried that the paper presented a model of how an attack on a small, unimportant part of the U.S. power grid might, like dominoes, bring the whole grid down.
Members of Congress were, of course, concerned. Then, a similar paper came out in the journal Nature the next month that presented a model of how a cascade of failing interconnected networks led to a blackout that covered Italy in 2003.
These two papers are part of a growing reliance on a particular kind of mathematical model -- a so-called topological model -- for understanding complex systems, including the power grid.
And this has University of Vermont power-system expert Paul Hines concerned.
"Some modelers have gotten so fascinated with these abstract networks that they've ignored the physics of how things actually work -- like electricity infrastructure," Hines says, "and this can lead you grossly astray."
For example, the Safety Science paper came to the "highly counter-intuitive conclusion," Hines says, that the smallest, lowest-flow parts of the electrical system -- say a minor substation in a neighborhood -- were likely to be the most effective spots for a targeted attack to bring down the U.S. grid.
"That's a bunch of hooey," says Seth Blumsack, Hines's colleague at Penn State.
Hines and Blumsack's recent study, published in the journal Chaos on Sept. 28, found just the opposite. Drawing on real-world data from the Eastern U.S. power grid and accounting for the two most important laws of physics governing the flow of electricity, they show that "the most vulnerable locations are the ones that have most flow through them," Hines says. Think highly connected transformers and major power-generating stations. Score one point for common sense.
"If the government takes these topological models seriously," Hines says, "and changes their investment strategy to put walls around the substations that have the least amount of flow -- it would be a massive waste of resources."
Many topological models are, basically, graphs of connected links and nodes that represent the flows and paths within a system. When a node changes or fails, its nearest connected neighbor will often change or fail next. This abstraction has provided profound insights into many complex systems, like river networks, supply chains, and highway traffic. But electricity is strange and the US electric grid even stranger.
In August of 2003 a blackout started in Ohio and then spread to New York City. Cleveland went down and soon Toronto was affected. The blackout was able to jump over long distances.
"The way topological cascades typically occur -- is they're more like real dominoes," says Hines, an assistant professor in UVM's College of Engineering and Mathematical Sciences. "When you push a domino the only thing that can fall is the one next to it. Whereas in a power grid you might push one domino and the next one to fall might be a hundred miles away."
That's because, "when a transmission line fails -- instantly, at nearly the speed of light, everything changes. Everything that is connected will change just a little bit," Hines says, "But in ways that are hard to predict." This strangeness is compounded by the fact that the U.S. electric grid is more an intractable patchwork of history than a rational design.
Which is why he and Blumsack decided to "run a horse race," he says, between topological models and a physics-based one -- applied to the actual arrangement of the North American Eastern Interconnect, the largest portion of the U.S. electric grid.
Using real-world data from a 2005 North American Electric Reliability Corporation test case, they compared how vulnerable parts of the grid appeared in the differing models. The topological measures -- so-called "characteristic path lengths" and "connectivity loss" between nodes -- came up with dramatically different and less accurate results than a model that calculated blackout size driven by the two rules that most influence actual electric transmissions --Ohm's and Kirchhoff's laws.
In other words, the physics horse won. Or, as their paper concludes, "evaluating vulnerability in power networks using purely topological metrics can be misleading," and "results from physics-based models are more realistic and generally more useful for infrastructure risk assessment." Score one for gritty reality.
An important implication of Hines's work, funded by the National Science Foundation, is that electric grid is probably more secure that many people realize -- because it is so unpredictable. This, of course, makes it hard to improve its reliability (in another line of research, Hines has explored why the rate of blackouts in the United States hasn't improved in decades), but the up-side of this fact is that it would be hard for a terrorist to bring large parts of the grid down by attacking just one small part.
"Our system is quite robust to small things failing -- which is very good," he says, "Even hurricanes have trouble taking out power systems. Hurricanes do cause power system failures, but they don't often take out the whole system."
Blumsack agrees. "Our paper confirms that it would be possible for somebody who wanted to do something disruptive to the power grid to do so," he says. "A lot of the infrastructure is out in the open," which does create vulnerability to planned attack. "But if you wanted to black out half of the U.S., it will be much more difficult than some of these earlier models imply," he says.
"If you were a bad guy, there is no obvious thing to do to take out the power system," Hines says. "What we learned from doing the simulations is that if you take out the biggest substation, with the most flow, you get the biggest failure on average. But there were also a number of cases where, even if you took out the biggest one, you don't get much of a blackout."
"It takes an incredible amount of information," he says, "to really figure out how to make the grid fail."