Policy Research Working Paper 8901 Lifelines: The Resilient Infrastructure Opportunity Background Paper Vulnerabilities of Networked Energy Infrastructure A Primer Amy Schweikert Lindsey Nield Erica Otto Magdalena Klemun Sanna Ojanpera Mark Deinert Climate Change Group Global Facility for Disaster Reduction and Recovery June 2019 Policy Research Working Paper 8901 Abstract Considerable work has been done to understand and infrastructure. Several recurrent themes emerge from across improve the resilience of individual infrastructure compo- different systems: (1) Electricity is essential for many lifeline nents. However, systems of components, or even systems infrastructure systems to function; (2) Electrical distribu- of systems, are far less well understood. Cascade effects, tion systems are particularly vulnerable to disruption from where the loss of one infrastructure affects others, is a major natural and manmade hazards; (3) Highly networked source of vulnerability which can lead to catastrophic dis- systems can be unstable even when their individual com- ruptions of essential services. Interdependencies can also ponents are functioning as intended; (4) Redundancy and lead to large-scale failures when even a single component network density can increase reliability but also increase is disrupted and results in ‘cascading’ failures within and the likelihood of cascade effects when failures do occur; (5) between networks. This is particularly true for power sys- Disruption of ports and roads can limit fuel supplies for tems, as many other lifeline infrastructure systems rely generators and replacement components. Based on these on electricity. In this study we review the literature and insights, this study offers suggestions for further research give a primer on the vulnerabilities of networked energy and policy actions. This paper is a product of the Global Facility for Disaster Reduction and Recovery, Climate Change Group. It is part of a larger effort by the World Bank to provide open access to its research and make a contribution to development policy discussions around the world. Policy Research Working Papers are also posted on the Web at http://www.worldbank.org/ prwp. The authors may be contacted at aschweikert@mines.edu. The Policy Research Working Paper Series disseminates the findings of work in progress to encourage the exchange of ideas about development issues. An objective of the series is to get the findings out quickly, even if the presentations are less than fully polished. The papers carry the names of the authors and should be cited accordingly. The findings, interpretations, and conclusions expressed in this paper are entirely those of the authors. They do not necessarily represent the views of the International Bank for Reconstruction and Development/World Bank and its affiliated organizations, or those of the Executive Directors of the World Bank or the governments they represent. Produced by the Research Support Team Vulnerabilities of Networked Energy Infrastructure: A Primer Amy Schweikert1,2, Lindsey Nield2, Erica Otto2, Magdalena Klemun3, Sanna Ojanpera4, Mark Deinert1,2 1 Payne Institute for Earth Resources, Golden, Colorado, USA 2 The Colorado School of Mines, Golden, Colorado, USA 3 Massachusetts Institute of Technology, Cambridge, Massachusetts, USA 4 Oxford University and The Alan Turing Institute, London, UK JEL classification: Q54, H54, O13 Keywords: Resilience; critical infrastructure; natural hazards Executive summary. Functional societies depend on the ability to move people, goods, and information, as well as to provide healthcare, food and access to clean water. Doing this consistently and reliably requires functional ‘lifeline infrastructures’ that encompass the internal communication, transportation and distribution networks of a country, as well as its energy supply systems. All of these are typically coupled to other infrastructures, such as financial markets and governmental institutions, which makes the resilience of lifeline infrastructures essential for a society’s ability to withstand shocks. The expanse and quality of lifeline infrastructure varies widely between countries and even the regions within them. Regardless of location, lifeline infrastructure typically constitutes a major societal investment and is correlated to economic and social well-being. Discussions and analyses of infrastructure often focus on the hardware (i.e., the roads, transmission lines, pipes, communication satellites, etc). However, it is actually the services that these systems provide that are of real value to society. This link between lifeline systems and services is critical even though it is often poorly defined. However, understanding this link is essential when discussing the design and maintenance of infrastructure to ensure resilience against hazard events that are both manmade and natural. Considerable work has been done to understand and improve the resilience of individual infrastructure components. However, systems of components, or even systems of systems, are far less well understood. Cascade effects, where the loss of one infrastructure affects others, is a major source of vulnerability is which can lead to catastrophic disruptions of essential services. It is obvious that this could occur when a large hazard event disables multiple infrastructure components simultaneously. However, interdependencies can also lead to large-scale failures when even a single component is disrupted and results in ‘cascading’ failures within and between networks. This is particularly true for power systems, as many other lifeline infrastructure systems rely on electricity. Highly networked systems can also have nonlinearities that render them subject to intrinsic instability even when all of their components are functioning correctly. In addition, highly networked systems are increasingly vulnerable to cyber attack. Increasing the resiliency of networked systems has lagged behind work on individual components in part because of the complexity of the problem. Additional work is needed to develop a complete theoretical framework for understanding the stability of networked systems. Even if this existed, key data on network structure and infrastructure interdependencies are often missing or difficult to access. In this study we give a primer on the vulnerabilities of networked energy infrastructure. The literature reviewed for this assessment shows that some highly networked systems, such as the electricity grids found in the United States and Western Europe, have been investigated for structure and reliability. The degree distributions for those systems fall within a consistent range and the systems have demonstrated their ability to reroute power when their components failed. However, these assessments might not apply directly to areas with sparse infrastructure or less developed grid network systems, such as those found in developing economic regions. System size and density have been shown in many studies to affect system stability. Grid infrastructure was found to be particularly susceptible to high winds, and damage to ports limiting for supply chains in isolated or island states. Several recurrent themes emerge from across different 2 systems: 1) Electricity is essential for many lifeline infrastructure systems to function; 2) Electrical distribution systems are particularly vulnerable to disruption from natural and manmade hazards; 3) Highly networked systems can be unstable even when their individual components are functioning as intended; 4) Redundancy and network density can increase reliability but also increase the likelihood of cascade effects when failures do occur; 5) Disruption of ports and roads can limit fuel supplies for generators and replacement components. Network connectivity is a key to understanding these aspects of a system, but data is lacking in many developing regions. A lack of appropriate independent redundancies is also consistently shown to limit network resiliency and interdependencies were found to increase the likelihood of cascade effects. Another theme that is consistent among the literature reviewed is that interdependencies within lifeline infrastructure are poorly quantified. Recommendations. In the above context, several areas emerge as deserving particular near- term attention to help guide the allocation of funds for lifeline infrastructure development: a) Develop data on the connectivity of lifeline infrastructure systems to determine key interdependencies and how these vary geographically or with other parameters such as per capita GDP or HDI; b) Use data on ports of entry and transportation infrastructure to identify regions where supply chain bottlenecks could impact lifeline infrastructure; c) Use high spatial and temporal resolution global historical data on wind velocities to determine where electricity grids would be particularly susceptible to damage; d) Develop a methodology to identify lifeline infrastructure systems that lack important redundancies. The above might, at first glance, appear difficult to achieve. However, if the focus is narrowed to electrical distribution and power system supply chains (essential for other lifeline infrastructure) data exist with which to move forward on these goals. Considerable data exists from agencies within the United States with which to construct initial databases to address the first three. This includes data on several island states whose infrastructure can be used as a proxy for that found in many developing regions. 3 INTRODUCTION Depending on the location, lifeline infrastructure must be able to withstand natural hazards including earthquakes, storms, volcanic eruptions, landslides, tsunamis, wildfires, droughts, floods, heat waves, as well deep freezes, snow and ice storms. Add to this list man-made hazards including sabotage, design faults, inadequate maintenance, faulty operation or simply exceeding the service life of a system or its components (Little 2002). System complexity can itself be a hazard because interdependencies can cause cascade failures while nonlinearities can be destabilizing to a system even when its individual components function correctly (Helbing 2013). Responses to infrastructure damage can be affected by the scale of a hazard, poor governance, conflict, stress in financial markets as well as the potential need to allocate resources to other causes. Cascade effects in highly coupled systems can also lead to disruptions that exceed the ability of institutions to response rapidly. Weather related disruptions are expected to grow with climate change, and system interdependencies with population and technological progression (World Economic Forum 2011; Helbing 2013). The increasingly complex nature and coupling of economic, geopolitical, environmental and technological systems complicates infrastructure analysis and is shown in Figure 1. Operation of lifeline infrastructure during hazard events, and its quick restoration after them, is important to the safety and quality of life for communities. This is particularly true for hazard responses that requires communication, evacuation, emergency health services and other lifeline infrastructure systems. Figure 1. The importance of infrastructure within a larger risk setting based on interdependencies and shocks. The figure shows the coupling of economic, geopolitical, environmental and technological risks. (Modified graphic from World Economic Forum, 2011). 4 The protection of lifeline infrastructure has generally focused on mitigating so called ‘first-order effects.’ Here systems, or their components, are designed for reliability and to resist the stresses caused by different hazards. However, as infrastructure systems become increasingly coupled and complex, hazard mitigation will also have to encompass secondary and higher order effects caused by interdependencies (World Economic Forum 2011; Helbing 2013). Secondary effects occur when a disruption in one infrastructure begins to impact another which would not otherwise have malfunctioned. In coupled systems this failure cascade can propagate causing ‘tertiary effects’ and so on. The extent of the resulting damage depends on many factors including the tightness with which infrastructures are coupled, the severity of the hazard event, and whether mitigating system properties or interventions or exist (Little 2002). Power systems are a particularly important component of lifeline infrastructure as electricity underpins many other systems, Fig. 2. Case studies have shown that electricity transmission is particularly vulnerable to natural hazards especially in isolated regions (Schweikert et al. 2018). Large grids have also been shown to susceptible to unexpected outages due to cascade effects, but small ones with little redundancy are susceptible to disruption from line failures (Sebastian et al. 2017). Supply chain issues can also disrupt access to electricity after a hazard event by limiting generator fuel supplies as well as impacting essential parts and labor for rebuilding (Schweikert et al. 2018). Figure 2. Key interdependencies between critical infrastructure systems. The figure highlights the interdependence of many systems with electricity directly, or in a secondary manner. A failure in electricity delivery can affect hospitals, communication infrastructure and transportation (including signals, public and others). (Figure from Sebastian et al. 2017. An equivalent figure will be remade that avoids copyright issues). A troubling aspect of tightly coupled complex systems is that they can fail in unpredictable ways and similar chains of events will not always produce the same phenomena. Instead, ‘normal events’ can sometimes lead to major failures (Helbing 2013; Perrow, 1999). In particular, it is known that coupling in large dynamic systems can cause self-organized criticality where even minor perturbations can lead to unexpected fluctuations at all scales (Bak and Paczuski, 1995). Flash crashes that have occurred in financial markets are often given as an example of this 5 (Helbing 2013). The most famous of these occurred on 6 May 2010 when the Dow Jones Industrial Average dropped by 998.5 points in twenty minutes– the largest intraday point drop in history at that time – and then recovered 600 points. The cause of the sudden swing was attributed in part to a spoofing scheme by Navinder Sarao, a London based equity trader. Sarao is alleged to have manipulated the price of near-month E-mini S&P 500 futures contract by layering the sell side of the order book with large quantities of non-executable orders at non- marketable prices. Recent analysis suggest instead that the 2010 flash crash was instead a form of self-organized criticality driven by systemic structures that were vulnerable to feedback loops with automated trading systems (e.g. Aldrich, et al. 2016). Additionally, some speculate that because of these issues underlying the system, future crashes were inevitable, and in fact seen with rapid fluctuations that have occurred since. Findings after the event include that many of the mechanisms of the system are not well understood (Madhavan 2012). An extensive analysis can be found in Kirilenko et al. (2017). Self-organized criticality can also be particularly important in the study of failure in interdependent infrastructures. In systems such as these, large catastrophic events can occur as a consequence of the same dynamics that produce small ordinary events. Examples of this have been seen in power grids which operate with a dynamic a balance between production and load. If the balance is not quickly reestablished after disturbances (planned and otherwise) generator and load breakers will trip to keep from damaging components. This process can evolve to cause cascading outages that can last for varying degrees of time. Exactly this was seen in a 2009 blackout in Brazil that the Itaipu hydroelectric facility to shutdown (e.g. Carlotto and Grzybowski 2014). Analyses of grid blackouts from several countries show that the frequency of large events follows a power-law distribution (e.g. Dobson et al. 2007) which is consistent with self-organized criticality (Helbing 2013). If such situations are to be avoided in lifeline infrastructures, steps must be taken during the design phase, or mitigation procedures put in place to address a failure before it cascades out of control (Perrow 1999; Bak and Paczuski 1995). The study of resiliency has its roots in the study of ecological systems and their ability to ‘bounce back’ after a disturbance or at least maintain a certain level of function (e.g. May 1971) Although widely recognized as a serious concern, how to mitigate the risks posed by infrastructure interdependency and complexity remains a nascent area of research (Turner et al. 2003; Bocchini Paolo et al. 2014; Schweikert, Espinet, and Chinowsky 2018). With few exceptions, even quantifying the linkages between infrastructures, their interdependencies, or failure mechanisms, has rarely been done (World Economic Forum 2011; Helbing 2013; Little 2002). This paper, commissioned by the World Bank’s Global Facility for Disaster Reduction and Recovery division, provides a primer on the vulnerabilities of networked energy infrastructure. This work reviews literature related to these subjects and how they may vary geographically. The work is broken into a discussion of electricity transmission and supply chains with subsequent conclusions and recommendations for areas of near-term research to address ongoing work in this field. ELECTRICITY TRANSMISSION There are multiple components to understanding whether a power grid will be resilient to a 6 specific type of hazard event. These include the initiating event(s), the components contributing to system stability/instability, the ability to address or adapt to perturbations in the system, the lack of robust data sets to analyze the problem as well as the role that policy and organizational structure play in each of these layers. For example, initiating events could range from a tree falling on a power line to a targeted cyber attack on network stability. In both cases, the outcome of a blackout and power loss is caused by propagation through the system, but each event causes a unique stress on the system. Grid systems in the US, Europe and China have been studied extensively to see if their connectivity impacts their stability. This type of complex network approach is common when including the graph structure of systems in an analysis (Pagani and Aiello 2012). The results show that the grids investigated, all large, have inherent redundancy which makes rerouting power because of a line failure relatively easy (Pagani and Aiello 2012). However, redundant systems increase cost due to construction, maintenance and operation of additional infrastructure assets. Redundancies can also increase the likelihood of cascading failures. One response to this is to use ‘defensive islanding’ to isolate grid failures. This effectively creates sub-regions within a larger grid that can operate, or fail, independently of the larger system of which they are a part. The tradeoffs between highly integrated systems and ones that are independent, or can be run that way, are worth deeper analysis (Blumsack 2018). A particularly relevant example is given by the recent hurricane events in Puerto Rico. The island was hit by Categories 4 and 5 Hurricanes, Maria and Irma respectively, in 2017, resulting in devastation of much of the island’s infrastructure, including the power grid. Figure 3 shows a map of the island including key generation facilities, and transmission infrastructure. Unlike the grids investigated by Pagani and Aiello (2012), the one in Puerto Rico was both sparse (many regions having only one power line to them) and isolated (i.e. no connections to the mainland, or other islands). As a result of the former, parts of the island were still without power a year after the hurricanes because of damaged transmission lines. Because of the latter, interruptions to fuel supply chains would have caused power outages after the storms even if the grid had not been interrupted. One of the biggest vulnerabilities in large power grids comes from the complex interactions between the physical infrastructure (generation stations, transmission lines) and the systems connected to it. This includes fluctuating demand, diverse generating sources including intermittent renewables, public policy and cost incentives and weather. 7 Figure 3. Transmission grid and other selected key infrastructure in Puerto Rico. Note the limited redundancy of power lines transection North/South on the island, specifically in areas with the majority of ports and generation facilities (South) to areas of greatest population (San Juan, surrounding northern areas). (Figure from Campbell, Clark, and Austin 2017). Load and generation fluctuations. Matching load with generation happens over a surprisingly diverse time scale. Electrons move throughout grid infrastructure at nearly the speed of light. However, the load that generation needs to meet has yearly, daily and sub-second fluctuations (as demand goes up and down). To handle these fluctuations, grid managers constantly have balance expected load with available generation. This typically requires ‘spinning reserve’, which is generation capacity that is up and running for balancing as needed, as well as ‘contingency reserve’, which is additional capacity that can be brought online to compensate for generation outages or large expected load fluctuations. Unfortunately, under-designed or stressed systems often lack these critical grid components, making outages more likely and increasing the inability to absorb shocks. The management of supply (generation) and demand (load) is then intimately related to the management of longer-term time scales in terms of infrastructure design and interconnection as well as policy and regulations governing the operation of the power grid (Blumsack 2018). Complicating matters, all power grids have a frequency at which they operate (in the United States, the power grid operates at 60 Hz). Generators producing electricity have to provide electricity at an output matched to the power grid frequency when brought online. A sudden loss of generation, or intermittent variability, can cause a frequency shift that can damage transformers and impact the normal functioning of a grid. Alternately, a sudden loss of load from an unexpected outage in the grid can have a cascading effect throughout other parts of the grid. In both cases, the reason for potential grid failure is because of a shift in the frequency of alternating current moving through grid components. When load increases unexpectedly, it 8 causes generators to spin more slowly, similar to an idling car engine that slows down when the lights are turned on. When load drops unexpectedly, the opposite occurs, and generators spin more quickly. If generator operators are not able to react quickly enough, it can cause frequency shifts that are large enough to cause transformers to fail. Unchecked, this can very quickly propagate through a grid system. Somewhat counter intuitively, redundancy can actually make cascading failures worse, Fig. 4. Figure 4. Cascading failures in redundant systems. The figure shows a generator and three loads which are connected through a redundant grid. When the circuit breakers in legs f-d and b-d are closed, loads 1-3 can receive power through multiple paths. If the circuit breaker on leg b-d is tripped, load 3 can still receive power through path f-d and loads 1 and 2 can receive power through a-b. However, if load 3 is suddenly lost because of a system failure, and if the circuit breaks fail to reactor correctly, the frequency shift this loss will cause will take out the entire grid system. The same would be true for a loss of loads 1-2, where the absence of circuit breakers limit their effect on the generator. Here, redundancy can make the collective system more prone to failure. The physical structure of a grid can also be an important consideration in defining resilience. Albert et al. (2004) perform a network analysis on the U.S. power grid focusing on mapping the topology of the network including the number of edges, degree distributions and critical nodes. Specifically, they model connectivity loss due to the removal of nodes within the grid using four methods. The “cascading” algorithm was computed with a single run where the node with the highest load is removed from the grid. Then, the global load is recomputed and the remaining node with the highest load is removed, and so on. Findings suggest that this method may result in connectivity loss above 60% with approximately 2% of the total nodes of the system removed and escalate to near total failure with a loss of about 8% of all nodes. This analysis is compared with three other algorithms: a load-based removal of nodes, a degree-based removal of nodes, and a random removal of nodes. Notably, the random removal of nodes results in minimal connectivity loss even at high levels of loss of the global nodes. This is attributed to the structural global redundancy of the grid structure. Both load-based and degree-based removal algorithms see some loss of connectivity, with a sharp increase happening at approximately 4% loss of all nodes. A perspective important to consider in modeling and understanding a power network is the definition of ‘resilience’ or ‘operation’ that is being used. For example, is a power grid considered resilient if there is limited interruption of power supply to customers, regardless of the source? In the case of natural hazards, one approach utilized in many critical care facilities (such as hospitals) is the storage and maintenance of on-site diesel generation systems that can provide emergency backup power if an outage of the grid occurs (Karagiannis et al. 2017). Thus, 9 even if the power grid is taken offline - one definition of being ‘un-resilient’ - the supply of power to a facility is not interrupted because of the backup generators. Therefore, the definition of a 'resilient system' depends upon whether the supply (the power grid) or demand (availability of electricity) component of the system is being modeled. The perspective of which definition of resilience is being targeted also affects the policy and preparation of decision makers. A recent paper (Hines, Dobson, and Rezaei 2016) investigated the propagation of power transmission outages using influence graph modeling. A finding from this paper is that the propagation of outages (that is, the subsequent failure of a component due to the prior failure of another) does not follow proximal geographic or topological patterns one may expect when applying models such as contagions used for infectious diseases. The simulations presented are tested against a large historical outage in the United States and result in similar distributions. The findings of this method focus on quick identification of critical components that can be targeted for reduction of large, cascading blackout events. The approach most used in modeling failure propagation of power networks is graph theory and network analysis in conjunction with the ‘Swing equations’ or some other dynamical model. The identification of ‘nodes’ connected by ‘edges’ that can be directional and have different weights allows for the simulation of power transmission. The Swing equations can be used to model the effect of loads and generators on phase shifts when a system asset is perturbed. One significant challenge in modeling the power grid is the size of large, interconnected networks such as the United States: The Eastern Interconnect (one of three main grids operating in the USA) required approximately a month of simulation time on a 7 petaflop machine to model the addition or subtraction of generation (Personal Communication, NREL). Small grids, intrinsically requiring less components and interactions, are therefore easier to model and optimize. SUPPLY CHAINS AND CASCADE FAILURES Understanding the interdependencies of different infrastructures is a necessary component of designing resilient lifeline systems. This includes supply chains where the operation of one system is necessary for the operation of the another. In power systems this can be differentiated into three general categories: the supply of fuel to generation facilities, the supply of resources required for the operation of facilities (such as water used for cooling), and the supply of electricity to other critical infrastructure that rely on it for operation (such as hospitals). Because the latter two issues are addressed in an earlier white paper (Schweikert et al. 2018), this section focuses on the first category. The importance of supply chains to private organizations is well recognized. The development of ‘smarter energy supply chains’ breaks down the fuel supply chain for electricity production into five distinct processes: upstream, in-bound, out-bound, remote worker, and emergency supply chains (Harrington 2014.). The first four processes correspond to the actual extraction of fuel from a location. The fifth process focuses on supporting organizations when the supply chain is perturbed or interrupted by non-normal events, including natural hazard events. The extraction and transportation of fuel for electricity consumption is a known vulnerability in the reliability of the power grid system (Schweikert et al. 2018). As global energy consumption 10 shifts towards emerging economies, projected to account for more than 90% of net energy growth by 2035, understanding supply chain and critical points of failure become increasingly valuable (International Energy Agency 2013). The 2011 floods in Thailand provide an important case study for cascade effects from supply chain failures. Thailand experienced severe and prolonged flooding in 2011, especially in the Central region of the country including areas of the City of Bangkok and Ayutthaya Province. A large amount of the manufacturing in the country is centralized in these regions. Disruption from heavy rains to manufacturing facilities, workers’ homes, transportation and other infrastructure caused a sharp decline in production and exports. This included significant impacts to the automotive, electronics, and optical equipment industries, as well as many others. The automotive industry saw the sharpest impact with over 85% decline in production index in November 2011. Together, this decline in the fourth quarter of 2011 resulted in national GDP projection revisions of 2.6% down to 1.0%. The event highlighted the vulnerability of just-in- time supply chain networks. Supply chain risk management encompassing low-probability, high-risk events is a relatively nascent field. This may be due to fewer events occurring and less information with which to predict future events, particularly in an era of climate change. In many ways, redundancy in inventory and/or suppliers can act as shock absorbers and diversify risk from single suppliers but reduces the extreme efficiency and cost reductions from normal operating conditions. In Thailand, this included geographic clustering of industrial facilities, lean operations to enhance efficiency and economies-of-scale centralized production (Chongvilaivan 2012). The heavy impacts in a few regions resulted in closures and delays of production for technology organizations with global supply chains including Seagate, Microsemi, ON Semiconductor, Hutchinson Technology, Western Digital and more (Savitz 2011). Notably, these disruptions may be best characterized with complex systems methods including network analysis: Chongvilaivan (2012) states that this flooding event has made it “increasingly evident” that supply chain disruptions from natural hazards and other events can “endanger the just-in-time approach to procurement and production because any disruptions to a single node of production may lead to a breakdown of the entire production chain”. A thorough examination of the implications of the impacts on upstream and downstream supply chain management, specific to the automotive industry, can be found in Heinecke (2013). Several important issues have been identified with the electricity and fuel supply chain (e.g. Harrington, 2014). First, the recognition that safety is a critical aspect for organizations and businesses when considering the operation of a supply chain. Second, the complex nature of operations due to required management of multiple stakeholders, parallel operations, and a variety of personnel and goods that interact at some point along a supply chain. The multiple actors within a supply chain also require consideration of accountability processes that are transparent and interlinked. A third area of recognized concern is the management of multiple data sources and the logistics required to manage safety, efficiency and productivity within a complex supply chain operation (Harrington, 2014). INFRASTRUCTURE INTERDEPENDENCIES. Given the importance of lifeline infrastructure interdependencies, considering the supply chain is only one aspect of 11 understanding the value of a reliable and resilient power grid system. This is a key area for future work specific to the context of natural hazards, unpredictable disruptions and the interdependencies with other planning considerations related to the power grid. While widely recognized as important, infrastructure interdependencies are poorly quantified, as are the cascade effects that that can result from them (World Economic Forum 2011; Helbing 2013; Little 2002). However, past hazard events can be informative about the scale of the potential problem. Comes and Van de Walle (2014) identify several key findings related to the impact of the Hurricane Sandy on individual infrastructure systems and the interconnected impacts they have on each other:  The electrical grid was found to be most vulnerable in the transmission and distribution components, with storm winds damaging overhead power lines and requiring substantial rebuilding efforts. Additional damages were seen to substations (flooding and storm surge);  The Subway transportation system within Metropolitan New York City was damaged due to flooding within the subway tunnels and damage and debris covering the tracks;  Damages to the transmission and distribution grid caused feedback effects to power plant infrastructure operation and grid stability;  Repairs to the electrical grid were hampered due to inaccessibility of sites caused by the closure of roads due to flooding and debris;  The Subway transportation system within Metropolitan New York City was seen to have a slower pace of recovery because of its dependence on the availability of commercial power to operate;  Oil and gas infrastructure saw damages due to storm surges and salt water intrusion, but the major impacts were from their interdependency on the power grid;  Power outages impacted the operation of oil and gas supply. Specifically, pipelines, oil terminals, storage tanks and filling stations were not fully operational. Delivery bottlenecks were identified as a key detrimental impact to the system, including a limited supply of backup generators and storage of gasoline fuel onsite;  Information and communication infrastructure were damaged due to flooding and saw slower recovery due to a lack of access to sites for repair. The operation of this infrastructure relies on power supply for operation, but in the case of Hurricane Sandy, mobile trailers and other backup supply options were deployed and limited the overall impact to system operation.  The transportation systems, including rail, roads, subway and other infrastructure were damaged due to direct impacts of the hurricane. This includes saltwater damage, debris, and flooding. The largest impacts of the recovery of the transportation system were seen because of interdependencies. The operation of the metropolitan transportation networks relies on commercial power, oil and gas supply, and functioning information and communication systems. This cascading failure effect included the extended restoration times because of limited road access to repair damages to the electric and these systems. An important finding from research on Hurricane Sandy has been that the immediate priorities, disruptions and consequences of lifeline systems failures can evolve as a hazard situation 12 unfolds. With Sandy, interdependencies between the power grid and other systems included immediate information and communication outages, disruption of oil and gas distribution, and shutdown of transportation systems. These consequences of the storm then evolved to include feedback effects such as a lack of fuel availability impacting the backup power system operability, shutdown of data and control centers that effected the power grid, etc. Prolonged restoration times for information and communication infrastructure, as well as damaged transmission and distribution infrastructure because of road blockages and damage then followed. Another example of how interconnected infrastructure can affect hazard response was evident during and after Typhoon Haiyan (Typhoon Haiyan struck The Philippines in 2013; see Schweikert et al. (2018) for more information). Specifically, it was found that the response efforts were delayed by damages and disruptions to the communications infrastructure, transportation systems and loss of power (Comes and de Walle 2014). These temporal aspects of impacts and recovery have subsequently been underscored as important considerations in the design of resilient infrastructure systems (Comes and de Walle 2014). Many of the above issues were also seen in Puerto Rico following the 2017 Hurricane season (see Schweikert et al. (2018) for more information). In a comprehensive recovery strategy (Rossello 2017), Governor Rossello proposed over $15 billion to rebuild the power grid to a more resilient standard. The suggested improvements would be designed to withstand similar Category 4 impacts (155 mph/250kph sustained winds) and would reduce ongoing maintenance costs. Additionally, the proposal included small, distributed systems that would ensure ongoing operation of key water, sanitation and health facilities if a disruption to the central grid was experienced. The latter is a key concern as the operation of health facilities months after the storm was reduced: an estimated 72 of 107 clinics were operational and 33 of those were operating on generator power inciting higher costs and environmental impacts. The recovery efforts following the event were heavily hindered by the damage to roads and bridges throughout the island. Public transit (as of 3 months following the event) had not been restored, with lack of available power cited as the primary reason. The damage to transportation also caused impacts to the humanitarian response include delivery of medical care, food and water to impacted communities and is cited as a driver for future economic recovery and growth. A unified approach for quantifying the connectivity of lifeline infrastructures can be developed by modifying the approach of Klemun, Ojanpera and Schweikert (2018) for determining the linkages between progress on Sustainable Development Goals and energy technology interventions, Fig. 5. Here the connectivity of hazards events, lifeline infrastructures and societal impacts can be determined using an inverse network analysis. Case studies for hazard events constitute the input data for hazard, infrastructure damaged, and impact. 13 Figure 5. Method to determine connectivity of hazard events, lifeline infrastructures, and societal impacts. Figure illustrates how a network analysis approach can be used to inform the relationships between infrastructure, hazard impacts and the effect that disturbances can have on society. Traditional methods of analyzing risk focus on the left-hand box and the relationships shown by the blue lines (how a hazard damages an infrastructure asset). The impact that this damage to lifeline infrastructure and services has on specific assets in other lifeline infrastructure systems (grey lines) is an area of interdependency between lifeline systems. However, resilient infrastructure planning requires understanding how these interdependencies can cascade through a network and affect society during response and recovery operations. These relationships can be quantified to identify specific societal impacts (black lines). The short-term (beige) and longer-term (green) sector and society-wide impacts are shown to illustrate how the broader impacts can be traced backwards to identify the point of failure that is most important to a specific operation or society. Figure modified from Klemun, Ojanpera, and Schweikert (2018) FINDINGS This paper provides a primer on the vulnerabilities of networked energy infrastructure. In the literature reviewed, it is clear that this is an important field of research and valuable as a perspective from which to evaluate the resiliency of power grid infrastructure in the context of natural hazards. Several findings indicate important areas for future investigation: 1) The connectivity of lifeline infrastructures is poorly understood and needs to be quantified. A unified approach to doing this has been presented. 2) Connectivity of transmission grids as stand-alone entities is also an important area of research. A method for analyzing transmission networks has been done for large systems including the United States, China and Western Europe, among others (Pagani and Aiello 2012). The application of these methods to smaller grids or where multiple nodes or sections of the grid are perturbed (as is more likely in the context of a geographically- 14 large scale natural disaster) is also potential area for future modeling. Next, a deeper analysis of the tradeoffs between efficiency, connectedness, islanding and other grid structures, particularly in the broader context of resilient electricity provision during and after a natural hazard event, may provide useful insights into the planning process. 3) A finding across the literature reviewed on the impacts of natural hazards on the power system is that transmission networks are the most vulnerable component of the system (Schweikert et al. 2018). Several research areas specific to natural hazards and resiliency can be framed in this context. The deeper analysis of smaller systems, such as Puerto Rico or other geographically isolated regions, may provide valuable insights into the operation and topological considerations that increase or reduce resiliency. This could include different measures of intermittent generation technologies, redundant transmission networks, and others. A final consideration in this context is a multiple- criterion assessment of transmission reliability that includes a techno-economic analysis of performance during a hazard situation, the cost of redundant transmission lines and the consideration of above or below-ground transmission lines. CONCLUSIONS A functioning and reliable power system is important for the operation of many societal functions, including lifeline infrastructure systems. In hazard situations, damage to the electrical grid, or supply chains, can result in cascading failures throughout a society and impact response and recovery work. This was seen in the impacts of recent hurricanes in both Puerto Rico and the Northeastern United States (see: Schweikert et al. 2018 and Comes and Van de Walle 2014). This paper provides a primer on the vulnerabilities of networked energy infrastructure. Notably, much of the work reviewed shows that these types of systems, including the electricity grid, can exhibit non-linear and unpredictable behavior. Metrics including density of networked components, the redundancy and interconnectedness of sub-systems within the electricity grid – as well as linkages to other lifeline networks – are identified as providing insight into system behavior. However, these metrics are not particularly well understood or quantified, especially in smaller systems or those existing in developing economic regions. Future work in this area, aimed at enhancing decision making and investment for more resilient infrastructure, can focus on the following areas: a) Develop data on the connectivity of lifeline infrastructure systems to determine key interdependencies and how these vary geographically or with other parameters such as per capita GDP or HDI; b) Use data on ports of entry and transportation infrastructure to identify regions where supply chain bottlenecks could impact lifeline infrastructure; c) Use high spatial and temporal resolution global historical data on wind velocities to determine where electricity grids would be particularly susceptible to damage; d) Develop a methodology to identify lifeline infrastructure systems that lack important redundancies. 15 REFERENCES Albert, R., Albert, I., Nakarado, G. “Structural Vulnerability of the North American power grid”. Physical Review E. Vol. 69, 025103®. 2004. DOI: 10.1103/PhysRevE.69.025103. https://journals.aps.org/pre/pdf/10.1103/PhysRevE.69.025103 Aldrich, EM, JA Grundfest, G Laughlin. “The flash crash: A new deconstruction” SSRN Electronic Journal, 2016 Bak, P., and M. Paczuski. 1995. “Complexity, Contingency, and Criticality.” Proceedings of the National Academy of Sciences 92 (15): 6689–96. https://doi.org/10.1073/pnas.92.15.6689. Blumsack, Seth. 2018. “The Power Grid and Complexity Science.” presented at the Complex Systems Summer School, Sante Fe Institute, June. Bocchini Paolo, Frangopol Dan M., Ummenhofer Thomas, and Zinke Tim. 2014. “Resilience and Sustainability of Civil Infrastructure: Toward a Unified Approach.” Journal of Infrastructure Systems 20 (2): 04014004. https://doi.org/10.1061/(ASCE)IS.1943- 555X.0000177. Campbell, Richard J, Corrie E Clark, and D Andrew Austin. 2017. “Repair or Rebuild: Options for Electric Power in Puerto Rico.” Congressional Research Service. https://fas.org/sgp/crs/row/R45023.pdf. Carlotto, T., JMV Grzybowski. "Self-Organized Criticality And Cascading Failures In The Topological Model Of Power Grids: A Case Study". Proceeding Series of the Brazilian Society of Applied and Computational Mathematics, Vol. 2, N. 1, 2014 Chongvilaivan, A. “Thailand’s 2011 flooding: Its impacts on direct exports and global supply chain disruptions” ARTNeT Research Programme. Institute of Southeast Asian Studies. No. 34. April 2012. https://www.researchgate.net/publication/265083338_Thailand%27s_2011_flooding_Its_ impact_on_direct_exports_and_global_supply_chains Comes, Tina, and Bartel Van de Walle. 2014. “The Impact of Hurricane Sandy On.” In Proceedings of the 11th International ISCRAM Conference, 10. University Park, Pennsylvania, USA. http://idl.iscram.org/files/comes/2014/408_Comes+VanDeWalle2014.pdf. Dobson, I, BA Carreras, VE Lynch, DE Newman. "Complex Systems Analysis Of Series Of Blackouts: Cascading Failure, Critical Points, And Self-Organization". Chaos, 17, 026103, 2007 Harrington, Lisa. n.d. “Building the Smarter Energy Supply Chain.” Heinecke, Georg. “Resilient Automotive Production in Vulnerable Supply Networks. A Supply Chain Event Management System” Doctoral Thesis. Diss. -No. ETH 21551. ETH Zurich. 2013. https://doi.org/10.3929/ethz-a-010049348 Helbing, Dirk. 2013. “Globally Networked Risks and How to Respond.” Nature 497 (7447): 51– 59. https://doi.org/10.1038/nature12047. Hines, Paul D. H., Ian Dobson, and Pooya Rezaei. 2016. “Cascading Power Outages Propagate Locally in an Influence Graph That Is Not the Actual Grid Topology.” IEEE Transactions on Power Systems. https://ieeexplore.ieee.org/abstract/document/7501508. International Energy Agency. 2013. “WORLD ENERGY OUTLOOK 2013, FACTSHEET - How Will Global Energy Markets Evolve to 2035?” World Energy Outlook 2013. Paris, 16 France: International Energy Agency. https://www.iea.org/media/news/older/WEO2013_factsheets.pdf. Karagiannis, Georgios Marios, Stamatios Chondrogiannis, Elisabeth Krausmann, and Zehra Irem Turksezer. 2017. “Power Grid Recovery after Natural Hazard Impact.” Joint Research Center: European Union. Kirilenko, Andrei, Albert S. Kyle, Mehrdad Samadi, and Tugkan Tuzun. "The Flash Crash: High‐frequency trading in an electronic market." The Journal of Finance 72, no. 3 (2017): 967-998. Klemun, M., S. Ojanpera, and A. Schweikert. 2018. “The Impact of Technology Intervention on the Sustainable Development Goals.” Proceedings of the 2018 Complex Systems Summer School. The Sante Fe Institute. Little, Richard G. 2002. “Controlling Cascading Failure: Understanding the Vulnerabilities of Interconnected Infrastructures.” Journal of Urban Technology 9 (1): 109–23. https://doi.org/10.1080/106307302317379855. Madhavan, Ananth. “Exchange-Traded Funds, Market Structure and the Flash Crash” Financial Analysts Journal, Vol. 68, No. 4. CFA Institute. 2012. https://www.cfapubs.org/doi/pdf/10.2469/faj.v68.n4.6 May, Robert M. 1971. “Stability in Multispecies Community Models.” Mathematical Biosciences 12 (1): 59–79. https://doi.org/10.1016/0025-5564(71)90074-5. Pagani, Giuliano Andrea, and Marco Aiello. 2012. “The Power Grid as a Complex Network: A Survey.” ArXiv:1105.3338 [Physics], March. http://arxiv.org/abs/1105.3338. Perrow, Charles. 1999. “Organizing to Reduce the Vulnerabilities of Complexity.” Journal of Contingencies and Crisis Management 7 (3): 150–55. https://doi.org/10.1111/1468- 5973.00108. Rossello, R. 2017. “Build Back Better Puerto Rico - Request for Federal Assistance for Disaster Recovery.” Letter From The Governer. https://nlihc.org/sites/default/files/Build_Back_Better_PR_Request_94B.pdf. Savitz, Eric. “Thailand Floods Causing Tech Supply Chain Issues (Updated)”. Forbes. 12 October 2011. https://www.forbes.com/sites/ericsavitz/2011/10/12/thailand-floods- causing-tech-supply-chain-issues/#6c4545d2313e Schweikert, Amy, Xavier Espinet, and Paul Chinowsky. 2018. “The Triple Bottom Line: Bringing a Sustainability Framework to Prioritize Climate Change Investments for Infrastructure Planning.” Sustainability Science 13 (2): 377–91. https://doi.org/10.1007/s11625-017-0431-7. Schweikert, Amy, Lindsey Nield, Erica Otto, and Mark Deinert. 2018. “Resilience and Critical Power System Infrastructure: Lessons Learned from Natural Disasters about Vulnerabilities and Needed Research.” White Paper. World Bank. Sebastian, A., B. Kothuis, K. Lendering, and S.N. Jonkman. 2017. “Hurricane Harvey Report – A Fact-Finding Effort in the Direct Aftermath of Hurricane Harvey in the Greater Houston Region.” Delft University of Technology. https://repository.tudelft.nl/islandora/object/uuid:54c24519-c366-4f2f-a3b9- 0807db26f69c?collection=research. Turner, B. L., Roger E. Kasperson, Pamela A. Matson, James J. McCarthy, Robert W. Corell, Lindsey Christensen, Noelle Eckley, et al. 2003. “A Framework for Vulnerability Analysis in Sustainability Science.” Proceedings of the National Academy of Sciences 100 (14): 8074–79. https://doi.org/10.1073/pnas.1231335100. 17 World Economic Forum. 2011. Global Risks 2011: An Initiative of the Risk Response Network. Geneva: World Economic Forum. http://reports.weforum.org/wp- content/blogs.dir/1/mp/uploads/pages/files/global-risks-2011.pdf. 18