The concern about disruptions to the infrastructure due to deliberate attacks or natural events is drawing great interest across the country. Recent damage in the Gulf Coast region of the US has heightened this concern as many areas expect to be without grid power for months, perhaps more than a year.  There is also a growing understanding of the essential role that the energy infrastructure plays in other infrastructures, including cyber, communications, water, transportation, and waste removal.

The US military is particularly concerned because a major disruption of the energy infrastructure at a base could overwhelm its current backup generation resources and negatively affect its mission.  To a military base commander, the base’s mission is of paramount importance.  Simply put, it is the reason that a base exists.  Moreover, since military bases are part of an integrated team of bases across the world, the disruption of a single base’s mission could affect the missions of many other bases as the effects of the disruption propagate through the system.

Sandia National Laboratories is one of the nation’s largest laboratories whose primary focus is security, especially regarding defense applications.  In that role, a Sandia team has been conceptualizing how the effect of energy infrastructure disruptions can be mitigated. 

Hardening the grid is one approach to ensuring reliable power.  However, the grid is a highly complex system. Because of its construction, it may be difficult to harden to the extent required by many bases.  A recent study suggests that grid complexity is high enough that further improvement in reliability may not be possible (Fairley, P. “The unruly power grid: Advanced mathematical modeling suggests that big blackouts are inevitable,” IEEE Spectrum, August, 2004). The report’s assertions are based on the fundamental premise that complex systems cannot be made more reliable by incurring more complexity. Planned activities to harden the grid would result in additional grid complexity. 

What is more, even if grid-related operational accidents could be avoided, the very fact that much of the grid is above ground and accessible to the public makes it a likely target for vandals and terrorists that would be difficult to defend against (Committee on Science and Technology for Countering Terrorism, National Research Council, National Academy of Sciences, 2002).

The traditional method for dealing with grid interruptions involves the use of uninterruptible power supplies (UPS) and diesel backup generators.  While these devices have been successful in many applications over the past 50 years, they do have limitations and their reliability depends on the quality of maintenance support provided at each site.  Moreover, the manner in which they are typically deployed—a hardwire connection to a building—limits the flexibility in which the energy they generate can be intelligently redirected to various applications as needed in real time.

New concepts for using distributed generation technologies to provide high levels of energy surety for mission-critical power applications are being developed by a team of engineers at Sandia.  Dubbed “energy surety microgrids” this protocol uses a variety of distributed generators coupled with different types of onsite energy and fuel storage to develop high levels of energy surety for the intended applications. 

What is Energy Surety?
“Energy surety” is a term that the Sandia team derived from defense applications, subsequently applying it to energy systems.  It incorporates a variety of factors including safety, security, reliability, and sustainability.  Cost effectiveness is often added as
a fifth factor. 

In Table 1, the various terms are listed with an associated explanation. 

Within this construct, an energy system is said to have high levels of “surety” if it delivers the energy product to the end user while meeting all of the surety elements. 

This is a conceptual framework and therefore these elements are not yet completely quantified.  Some of the elements are more amenable to quantification than others (e.g., reliability can be defined in terms of percentage of energy availability, while sustainability is harder to measure).  However, work is progressing to quantify to the extent possible all of the elements so that “energy surety” can be measured.  Quantification is needed to be able to assess whether improvements are being affected with new technologies and applications.

Table 2 provides some examples of how each energy surety element might be improved.

Tatro et al provides a more complete description of the concept of energy surety and its implications regarding energy systems in the world (Tatro M., Covan, J., Robinette, R., Kuswa, G., Menicucci, D., Jones, S. Toward an Energy Surety Future, Sandia Report, SAND2005-6281, October 2005). The Sandia surety team is currently focusing much of its effort on energy reliability and security with a secondary consideration on the other three elements.  These two elements are of primary concern to military facilities operators and security teams.

Traditional Methods For Providing Secure and Reliable Power
The traditional approach to protecting buildings from grid interruptions is based on diesel backup generators and UPS.  That approach addresses only a few of the surety elements. 

For example, diesel generators, which are idle a great deal of the time, are often granted very limited operational permits because of the pollutant content of their effluent streams. 

They also depend on fossil fuel, which is currently a relatively abundant but diminishing low-cost fuel and whose source is located largely in politically volatile areas of the globe.  And even a diesel’s reliability can be compromised if it is not meticulously maintained. 

Willis and Scott have suggested that typical backup generators may have in the neighborhood of 80% probability of coming online and remaining there for a reasonable period  (Willis, L. and Scott, W. Distributed Power Generation, Planning and Evaluation, Marcel Dekker, Inc., NY, 2000).

Finally, fossil fuels are generally acknowledged as a non-sustainable source of energy.  The only positive energy surety feature of these systems is that they are generally proven technologies.

Each building that houses mission critical operations usually has a backup generator serving as backup power while the grid is the primary source.  In the event of a grid power failure, the backup generator isolates itself from the grid, starts up and begins to supply energy to that building.  Often these systems are coupled with a UPS that uses batteries and inverters to supply the load with energy while the backup generators come online.

Although this method of critical power production has been successfully used for well over half a century, there are a number of shortcomings from a surety perspective, especially in light of a worldwide increase in domestic and foreign terrorist activity.

The first problem relates to the duration of the planned outage.  In most applications, the backup generators are anticipated to be operational only for a limited period.  Until recently, grid failures were most often the result of natural causes—tornados, hurricanes, lightning, and wind. 

Other natural failures include human error, such as an accidental overload of a feeder causing a breaker to open.  These events have been well characterized over the years.

Most failures fall into a short-term category ranging from extremely brief to a few hours. Although longer outages are possible, they are relatively rare.

The advent of terrorism, however, has ushered in a new realm of consideration for power loss.  Instead of natural events and human error (both random occurrences with varying degrees of severity), terrorists are intelligent beings capable of planning and executing well-orchestrated strikes against the energy infrastructure with the potential of very long-term outages and related infrastructure impacts. The relationship between power loss and duration in this new realm is much less well defined and uncertain.

In terms of a terrorist attack, power loss of much greater duration is expected on a more frequent basis.  Moreover, since a terrorist strike is expected to be well planned, its impact is likely to affect much larger regions, perhaps as large as one or two of the grid interconnection regions in the US.  (There are three major grid interconnection regions in the United States, including the Eastern, Western, and Texas regions.)

The costs for traditional outages are reasonably well understood.  Typically a three-hour outage on an office building may cost up to a quarter of a million dollars and one on an industrial building a million dollars.  However, these are averages that vary widely depending on the type of application and activities involved within each one.

Traditional mission-critical protection schemes are usually not designed for these longer and more widespread power disruptions.  A number of problems ensue in trying to adapt the traditional systems to this new environment in which high levels of surety are desired.

First, extended operational permits would need to be secured, a difficult prospect in some jurisdictions because of environmental regulations.

Second, additional fuel would have to be stored onsite, posing additional safety and environmental impacts. 

Third, the systems would be solely dependent on a nondomestic and gradually diminishing fossil fuel source that is imported largely from politically unstable regions of the world. 

Fourth, because of the volatility of the fuel source, its cost effectiveness would constantly vary or—depending on world events—suddenly plunge.

Finally, this approach lacks sophistication and intelligence, thus limiting its flexibility and adaptability in the face of changing needs and conditions during an outage.  For example, in this protection scheme, if one backup generator fails, the building it supports is without power.

With this protection scheme, another generator cannot be ramped up and its power routed to the unenergized building.  Each building is its own island, and must cope with the situation in isolation from the others.

Thus, from an energy surety point of view, this traditional method of protecting mission-critical facilities is less than optimal.

Requisites to Engender High Levels of Energy Surety
Within the framework of the energy surety paradigm, a number of requisites have been identified for meeting the requirements of an energy system with high levels of surety.   

These requisites are listed below followed by a more detailed explanation of each one:

• Reducing the number of single points of failure
• Generation of the energy as close to the load as possible
• Running generators full time
• Using proven technologies
• Varying the generation mix
• Securing the fuel supply
• Including sufficient and appropriate on-site fuel/energy storage

As stated above, one of the energy surety failings of the grid is that it often provides an attacker with many vulnerable single points that can cause grid failure.  A single point of failure can be a substation transformer, a high-tension power line, or the generation facility.  The grid has many single points of failure that are vulnerable to attack because so much of the grid is configured on exposed overhead lines, and generation equipment is often in remote areas to minimize its impact on civil populations.

Another problem with the grid is the large amount of transmission and distribution infrastructure required for delivering the energy from the power plant to the load. 

But the grid in the US has evolved such that nearly all of the electricity that is generated is in large-scale power plants, requiring the energy to be transmitted and distributed to the load.  Most grid failures can be traced to the transmission and distribution system.  By generating the energy near or at the load, a large source of failures can be eliminated (Pansini, A. Transmission and Line Reliability and Security, Fairmont Press, Inc., Lilburn, GA, 2004).

Onsite generators that have to be started during a grid outage are more prone to failure than those that are in constant usage.  Like the engine in an automobile, the most common failure occurrence is upon startup.  By running the generator full time, the need for startups is minimized and the chances of failure are reduced.

If generators are to be operated full time near the load, they must be dependable, resilient, durable, and relatively easy to repair.  Only those generators that can (1) operate over a long period of time and (2) be quickly repaired when failures occur will meet high surety requirements. 

Most important, their energy and operation and maintenance (O&M) performances must be fully characterized so that they can be properly configured for the application. 

Since generators each have different characteristics, some generators are more amenable to the application than others. 

For example, in an area of high solar resource, high conventional energy prices, and vulnerable energy supply lines, solar electric generators might be highly appropriate.  Solar generators have the advantage of converting an energy source (the sun) that is free.  On the other hand, a microturbine that burns diesel fuel may be applicable in a situation where the fuel supply is inexpensive, commonly available, and well-protected. 

The point is that a combination of generators and fuel sources are probably required to meet the surety requirements involving a secure fuel supply in any given application.

Assuming that generators are installed near the load, a safe and secure fuel supply is needed.  There are many considerations for fuel sources.  However, as noted above, the selection of the fuel supply is dictated by local conditions and surety needs.  For example, in an application where fuel supply interruption is of concern, a solar generator may be chosen to supply a majority of the energy needs because the fuel source, the sun, cannot be interrupted by human beings.

Fuel and energy storage is one of the most important considerations for a generation system that operates near the load.  Some generators, such as many renewable ones, operate intermittently.  Intermittent operation is often not a favorable feature of generators that are expected to provide power when and where it is needed.  In short, they do not mesh well with key surety requirements.

Energy storage technologies, such as batteries and super capacitors, can mitigate this shortfall by storing energy when the generator is operating and supplying this stored energy product at other times. 

In addition, fuel stored near the generator can be used to ensure that the generator continues to operate when the normal supply is interrupted.  For example, a diesel generator with an ample supply of nearby fuel is likely to continuously operate in a time of crisis, whereas the normal supply of fuel is cut off.

Energy Surety Microgrid Concept
In consideration of the requisites for an energy system with high levels of energy surety, a microgrid appears to meet the basic requirements. 

A microgrid is a concept that has recently been developed in the power engineering field and refers to a subset of the grid in which distributed generators supply power.  It is possible that the microgrid may interact with the larger grid and isolate itself from the grid and operate as an island.  This islanded operation may be triggered by a general grid failure, which would leave the microgrid to fend for itself in serving its loads (or it could isolate itself from an active grid for some other reason). 

The surety microgrid is designed to meet the essential factors noted previously.

In this configuration, buildings that are in close proximity can be electrically interconnected and a set of generators can be designed to supply energy to them on a full-time basis.  The area that encompasses the protected buildings and the generators is called an energy surety microgrid and can also be referred to as an energy surety zone. 

While the surety microgrid is interactive with the grid and its generators share power therewith, it can island itself and produce power to the buildings if the grid fails. 

In effect, the onsite generators are the primary sources of power for the buildings within the surety zone and the grid becomes the backup energy source.

Storage, including both energy and fuel, is an important component of the surety microgrid.  The amount of storage is designed for the expected needs of the application.  In a zone where there are abundant renewable (i.e., intermittent) generators and the energy reliability needs are high, significant energy storage devices are required.  Likewise, where there are ample fuel-supplied generators in the zone, ample supplies of fuel are needed.

An important consideration for the surety microgrid is to design the system for the optimal amount of storage, but no more.  Energy storage, especially when it involves batteries, is expensive and sometimes hazardous.  Fuel storage makes an attractive target for vandals and terrorists.

There are a number of advantages to this concept over the conventional approach:

• The level of energy reliability within the microgrid can be clearly specified by its mix of generators and storage.  While the grid typically offers a single energy product with set limits of surety levels, the surety microgrid can be configured to whatever level of surety is desired, including tailoring the system to enhance certain surety elements. For example, a surety zone could be designed for extreme reliability and a high level of security by selecting a cadre of generators that are well proven that can operate on a variety of local fuels.  Another important design consideration would be the inclusion of (and ample supply of) various storage (electric and fuel) technologies that could be sized to meet the operation times and load profiles to match or exceed the desired level of reliability.
• The generation is located near the load, thus reducing the number of single points of failure and eliminating the uncertain security of the grid’s transmission and distribution infrastructure that lies outside of the military base boundaries.
• Since the generators within the surety microgrid are operating full time, the startup uncertainty typical with stand-by generators is eliminated. 
• Fuel supplies for the generators can be tailored to the locality, thus insuring a more secure fuel supply.  For example, in an application in the southwest US, solar and natural gas generators might be included because of fuel and resource availability. 
• The loads and the generation can be managed intelligently.  For example, a computerized surety microgrid control system could be programmed to constantly assess the loads that are online, their relative priority to one another, and the fuel and energy resources that are available—and then make continual adjustments in the system to ensure that power is applied to the loads commensurate with their priority.  This would be especially important if one of the generators failed and the critical electric loads had to be shared seamlessly with the remaining generators that are online.

Onsite storage provides stability of operation and insurance that power will be available even when some generators are offline, which happens with intermittent (renewable energy) ones.  In addition to this function, storage also provides  stability of operation within the surety zone by responding to sudden load changes that occur faster than mechanical generators can respond.  

As can be seen, from a theoretical perspective the surety microgrid offers a number of energy surety improvements over the conventional approaches.

Technical Challenges to Realization Of Energy Surety Microgrids
Although the concept of the surety microgrid is fundamental, there are several technically challenging tasks needed to fully realize them.  These include the following:

• Develop surety requirements for facilities to protect, level of protection, and type of onsite generators
• Optimize the amount of fuel/energy store
• Properly control the surety microgrid (agent based)
• Model the microgrid’s effectiveness (consequence model)
• Ensure proper interconnection to the grid

One of the first tasks involved with the development of the surety microgrid is to develop the surety requirements.  These surety requirements effectively set the standard of performance that the surety microgrid must meet.  From these surety requirements, which may include as few as one up to as many as all of the surety elements, the specific generator set and storage type/size will be determined. 

Additionally, to the extent possible, specific performance metrics will be specified.

For example, the specifications may include concrete energy reliability levels as well as cost-effectiveness goals.

This task also involves selecting the facilities that are to be included in the energy surety microgrid.  The selection of facilities is somewhat dependent on their physical proximity to one another.  As noted above, grid failures often occur in the distribution system, which often has exposed overhead wiring.  Similarly, the microgrid is more secure and reliable if exposed wiring between facilities is minimized. 

Another important consideration is the configuration of the grid that serves the facilities that are to be included in the microgrid.  This is important because the surety microgrid will be islanded from the grid when it fails. 

Careful attention will be given to the exact parts of the grid that will be separated from the grid during the islanded operation within the limitations imposed by IEEE 1547.

Optimizing the amount of fuel and energy storage on the surety microgrid is a key objective.  As noted above, storage plays a key surety role on the microgrid.  An optimization strategy must be developed that accomplishes two objectives:   (1) determine the type of storage needed and (2) determine how much of each type is needed. 

For example, if a microgrid contains a large number of solar and wind generators, both intermittent generation sources, a large amount of energy storage might be required to insure that an adequate amount of energy can be produced during the times when these generators are not operating.

Control of the surety microgrid is very important to ensure that the system can remain operational during a sustained attack from either nature or terrorists.  Essentially, a distributed control system rather than a traditional hierarchical system is needed to ensure that a single point of failure is not provided as a target.  Sandia researchers, along with others, have developed what are called Agent-Based Control schemes (Phillips, L.R.; Link, H.E.; Smith, R.B.; and Weiland, L.A. Agent-Based Control of Distributed Infrastructure Resources, Sandia Technical Report, 2005).

In these control schemes, intelligence is built into every generator.  This is called a control agent, and it has the capability of communicating with all the other generators as well as monitoring the collective loads on the microgrid.  If one of these agents fails, the others can collectively act to compensate for its loss. 

Moreover, the agent control system can monitor loads so that if some generators fail or are operating at reduced power, the loads in the surety microgrid can be intelligently modulated to the current and projected generation potential.  This is especially important if intermittent solar generators are on line.  In this case, the agent-based control system might look at weather reports that might indicate that cloudy conditions are on the horizon and may signal the agent for a standby generator to come online in anticipation of the solar system power reduction.

Another important task is the ability to accurately model the effectiveness of the new system relative to the surety requirements.  Sandia’s National Infrastructure Simulation and Analysis Center has developed models that can assess the consequence of infrastructure interruptions on mission critical operations. 

The model has been developed for large-scale application such as national or regional grid studies but has been modified for applications on military bases where an infrastructure interruption can affect the military mission. 

This model has been tested on a real military base, one that involves munitions transport to and from military vehicles.  The model proved to be accurate in assessing the impact of an energy infrastructure disruption upon the flow of munitions from their storage locations to the dock area and finally onto the vehicle.  It showed that even a short interruption would seriously affect the number of munitions that were backlogged on the dock, a very undesirable situation.

An enhanced and modified version of the consequence model will be used to assess how well a surety microgrid mitigates an infrastructure disruption.  The model will be used to estimate a baseline condition, which is the existing situation without a surety microgrid.  After the surety microgrid is designed, the model will be rerun for the same conditions as the baseline and the results compared to determine if the surety microgrid is potentially effective.  The final step will be quantification of the improved surety in terms of the base mission.

Since the surety microgrid will be grid interactive and only islanded when the grid has failed, it must be properly interconnected to the grid. 

Interconnection standards are being developed by the Institute of Electrical and Electronic Engineers (IEEE standard 1547.4, currently under development).

Generally, the islanding sequence involves the following steps:

• Detect grid loss
• Assess loads and shed if needed
• Prioritize loads
• Bring on idle/spare generation capacity
• Share power to loads
• Begin islanded operation
• Reconnect when the grid comes back

These tasks must take place within a 15-second (or less) window of time.  Online energy storage provides power stabilization during this islanding sequence.

Military Applications of The Microgrid
The military is interested in the surety microgrid concept because there is a growing awareness of the dependence of the military mission upon the energy infrastructure and the realization of the vulnerability of the infrastructure to attack by vandals, by terrorists, or by nature. 

This concern was verified in May 2003 when a fire disabled two feeders that served Fort Huachuca, located about 90 miles southeast of Tucson, AZ, just inside the US-Mexico border. The post was unprepared for the 16 hours of down-time that the interruption caused, and the military mission capability was threatened.  This incident was the galvanizing event that brought full awareness of the seriousness of the vulnerabilities many bases face, for if Mother Nature could create such a problem by chance encounter, a well-planned terrorist strike could produce much more devastating effects.

As a result of the Fort Huachuca incident and other considerations, the Department of Defense (DOD) has begun to study the critical infrastructure on bases.  Results of these studies, details of which are mostly classified, indicate that generally the energy infrastructure is not only one of the most fundamentally interrelated infrastructures among the most important ones, but is closely linked to a military facility’s operations.

Given the critical linkage of mission accomplishment to infrastructure service availability, several DOD agencies including the Defense Program Office—Mission Assurance (DPO-MA), Defense Threat Reduction Agency (DTRA), and NORTHCOM have performed vulnerability and risk assessments of these infrastructures at numerous military facilities. 

These studies have identified specific vulnerabilities but have not been sufficiently robust to address how these vulnerabilities directly affect mission accomplishment.  Moreover, the studies have not identified corrective or mitigation strategies and approaches.  DOD agencies continue to struggle with this problem; DPO-MA recently highlighted this critical issue to Sandia representatives (Personal conversations between Nathan Annis [Defense Program Office for Mission Assurance] and Steve Rinaldi, Sandia National Labs, February 2005).

To the military commander, mission readiness is of paramount importance.  It is the reason for his or her existence, and failing to meet that mission could result in loss of military resources and lives, put military missions in jeopardy, and compromise the security of the United States. 

Many military commanders now realize that operational critical infrastructure is essential to successful mission execution and that energy is one of the key infrastructure areas. 

As a consequence, the concept of the energy surety microgrid is one of high importance.  Its development is a vital consideration for retrofitting current bases and for inclusion in the design of future ones.

The Surety Microgrid Development Program
A technical team has been assembled at Sandia to develop and apply the surety microgrid concept on a military base.  The program is funded in FY06 and will address all of the technical challenges noted above.  This is called the Phase 1 surety microgrid development activities. 

After completing Phase 1, additional funding is expected for Phase 2, which will focus on studying how the surety microgrid concept could be implemented on an actual military base. 

The funding will not be sufficient to actually build such a microgrid, but the study (coupled with the infrastructure modeling capability) will help the team to understand whether the basic concepts hold promise to meet the specific surety needs of a real military base. 

Phase 2 is expected to commence in October and be completed in the spring of 2007.  Funding for Phase 2 is reasonably assured if Phase 1 is successfully completed.

Surety Microgrids in the Civilian Communities
Surety microgrids concepts are currently being developed for military application because the threat to their infrastructure is clearly perceived and there is a commitment to develop some protective measures. Ultimately, the surety microgrid concept may be applied to civilian applications. 

In many ways military bases and civilian communities are similar.  They are both contained within limited areas and contain people who both live and work in those areas.  They both contain similar functions including residential, commercial, educational, and industrial activities.  From this view, it is easy to conceive how the surety microgrid concept can be migrated from the military to the civilian sector.

However, there are significant differences between the two that might make the migration difficult.  The most important of these include the military mission, the key reason for a military base’s existence. 

The civilian community has no equivalent to this mission and exists for a variety of economic and political reasons. 

Second, the military community is controlled by fiat through the base commander and related hierarchical administrative systems. 

The civilian community is governed by a democratic political system that involves many layers of control coupled with checks and balances at each level. 

Lastly, the military system is focused on mission readiness and can implement infrastructure changes that are deemed necessary whether or not they are cost-effective. 

In the civilian community, where governments often have very limited discretionary funds, energy projects of all types often must be cost-effective.

Summary
Energy security has been a concern to the United States for the past 30 years.  However, the recent rise of worldwide terrorism has given rise to a more broad-based concern that incorporates a variety of elements relating to energy.

Sandia National Laboratories researchers have recently developed a model to describe these elements and characterize them into a single descriptor called energy surety.  From this, the energy surety microgrid concept has evolved.  Its first application is for military bases.

Military commanders have become aware of how energy infrastructure interruptions can affect their mission readiness.  Assessments have indicated that much of the infrastructure is vulnerable to attack and difficult to protect.  As a consequence, there is keen interest in developing strategies and technologies to mitigate this risk.

The energy surety microgrid addresses the surety needs of military bases by using a combination of distributed generators and storage to provide power near the load. 

These surety microgrids go beyond energy savings. They address in a modular and flexible manner a base’s requirements for energy safety, security, reliability, sustainability and cost effectiveness. 

The first energy surety microgrid prototype design is expected to be developed by September, and the first application is expected shortly thereafter.  As this technology is being applied to military bases, civilian applications will be developed.

It is widely anticipated that the application of the surety microgrid will produce a much more robust energy system in military and civilian communities in the US and the world.

DAVID MENICUCCI is a research engineer with Sandia National Labs.

DE - July/August 2006