Learning from the Big Blackouts

Normally night spreads from east to west with the rotation of the earth, but the evening of November 9, 1965, was different. Darkness also spread from north to south. Southern Ontario went dark first, much of New York State a few seconds later, then most of New England, and finally New York City. By 5:28 P.M., thirty million people were stumbling toward any light available. Subways stopped and furnaces chilled, and America briefly lost one-fifth of its electricity. What was the cause? Maybe a generator failure, maybe sabotage—for several awkward days no one knew.

America’s electric-power network is so vast that solar flares affect it and so convoluted that the start-up of one generator affects others thousands of miles away. It is perhaps our most complex technology. But the 1965 blackout—and others that have followed—taught that complexity does not equal sophistication.

In the twenty years since that catastrophe, power companies have been working with mixed success to prevent more outages. Transmission lines have greater capacity now, control centers are more computerized and hold tighter reins over power flows, utilities cooperate and share more information, generating stations have emergency power to restart generators thrown off the grid by electrical jolts, and operating procedures have been revamped. Still, major outages happen every year, benighting thousands and occasionally, as in New York in 1977, millions of people, but many in the industry are confident that another 1965-scale blackout is unlikely.

Smaller blackouts can be costly too, though, and some observers fear that the stability of the network is threatened by certain utilities’ financial problems and by economic pressure to move electricity long distances from power-rich areas to utilities dependent on oil-fired power plants. In parts of the country, such long-distance purchases of economy power are pushing transmission lines to the limits of safety by straining their capacity.

In 1965 the utility industry was about eighty years old. America’s first central power station had started supplying a small district of Manhattan in 1882. The idea didn’t catch on for several years because building owners could provide for themselves more cheaply by buying generators and putting them in basements. But the price of central service dropped by 1886, and the new electric streetcars were increasing daytime demand dramatically. The same advantages of reliability and savings that then led isolated users to join in a central system also persuaded utilities to link with one another once high-voltage alternating-current equipment was available.

Regional grids started forming: the Pacific states, the Southwest, the Southeast, and the Upper Midwest. The first big interconnection in New England came about in 1913 because the utility at Turners Falls, Massachusetts, had a surplus of cheap hydroelectric power to sell. Interconnections multiplied rapidly across the Northeast during World War I, when defense plants needed power in amounts that isolated utilities could not supply. In 1959 Ontario Hydro joined the Northeast Interconnection, which then changed its name to Canada-United States Eastern Interconnection and acquired the acronym CANUSE.

November 9, 1965, was—until the blackout—an ordinary day. From New York City on the southern end of CANUSE to Ontario in the north, the weather was clear and cool. As the sun dropped, lights went on. Power stations all over the Eastern Interconnected System—CANUSE and the other big systems it was connected to—opened water and fuel valves to meet the need.

One of these was the Sir Adam Beck No. 2 hydroelectric plant, set on the Canadian cliffs near Niagara Falls. Most of its output was going west and north to Toronto, across Lake Ontario. The Beck plant was working a bit harder than usual because the Lakeview power station near Toronto was having problems with its machinery. The load on Beck’s transmission lines reached the point at which an obscure relay, installed in 1951 and last adjusted in 1963, ordered a circuit breaker to disconnect one line. This started a chain of events that no one could have predicted exactly, because alternating current finds its own pathways through the multitude of combinations possible in a large power network, which is itself changing every minute. At 5:16 and eleven seconds, the system began to move with frightening speed.

When the Beck relay ordered the first westbound transmission line cut off, 375 million watts of power crowded onto the four other westbound lines. In less than three seconds they tripped out in turn, and at least 1.5 billion watts rushed into America across two other lines strung over the Niagara River. The surge of electricity tried to reenter Canada at the Massena, New York, interconnection, but that interconnection overloaded, and the surplus power turned south, down the backbone of the CANUSE transmission system.

Relays interpreted the power surge as a short circuit and started signaling circuit breakers to separate the system into islands. Shuddering under the impact of all these circuit breakers and the wildly fluctuating current, generators slowly fell out of the sixty-cycle-per-second, threephase lockstep that the alternating-current networks demanded. One island, which took in southeast New York State, New York City, and much of New England, was suddenly short of generation capacity, with a severe deficit in the northern end pulling great pulses of power from the south. The deficit grew as the electrical chaos forced generators off the network.

The last utility to go under, Consolidated Edison of New York City, had enough time to cut the ties to its CANUSE neighbors and go it alone—pushing just eight buttons would have done the job—but at its Energy Control Center on the West Side of Manhattan, controllers opted to hold the ties and try to help the staggering network. “Could you have expected the dispatcher to have understood everything that was happening?” asks William Balet, who investigated the blackout as a Con Ed employee in 1965. “I don’t think so.” On paper, Con Ed had more than enough spare horsepower in its forty-seven turbogenerators already turning to satisfy its own needs as well as the demand from the north.

But the generators could not respond quickly enough. Warning horns sounded in the pastel green control room, and hundreds of meters, graphs, and gauges —arrayed below a long, curving mural of the New York City skyline—told the maddening truth: the system frequency was dropping steadily. The lights of America’s most populous city went dead when automatic controls disconnected the last generators, whose turbine blades would have been damaged by operation at too slow speeds.

The blackout lasted under a minute in some less populated areas and over thirteen hours in parts of New York City. In the next two years, what had seemed so fast, fleeting, and chaotic would be dissected by dozens of commissions and utility task forces. Ontario Hydro made the first move in a few days when it raised the settings of the relays on the five westbound transmission lines connecting Beck to the Toronto area. Across the border, utilities placed more relays to automatically break the interconnections in the event of another surge from Ontario.

This would prevent an exact recurrence, but it soon became obvious that much broader reforms would be needed. Robert Iveson, who helped in the Federal Power Commission investigation, says, “There’s no question that our quality and our response time—and conditions across the country—were very bad. It was a real embarrassment to the industry and the utilities involved.”

Among the shortcomings of the utilities was the fact that many of the control centers were dependent on system power. As the network ripped apart, the centers were left with feeble power or none at all. Generating stations needed emergency power too, because of the many pumps and compressors that turbogenerators require. In the first two months following the blackout, Con Ed alone bought thirty-two thousand kilowatts of self-starting gas-turbine generators to ensure backup oower.

The blackout also proved for some utilities the wisdom of having main generators that, during a disturbance, could be disconnected from the grid without having to shut down completely. Under this scheme, controls quickly reduce generator output and route it to support the station’s auxiliary equipment. Without this feature, steam-driven generators must be totally shut down—and once down they may require eight hours to restart. Time is extremely valuable. If restoration takes too long, as in the more limited Consolidated Edison blackout of July 13,1977, the social fabric may unravel in the darkness. Looting during that long, hot night cost at least $150 million.

For several years after the 1965 accident there was argument—one part engineering, one part politics—about whether the ties between utilities should be weak or strong and whether it was wise to continue a pre-blackout plan to hook up the entire nation into one system beating with the same electrical pulse. One Midwestern utility executive told the press, “A national grid could simply mean a national blackout in a real emergency.” The school of thought favoring weak ties pointed to the fact that the blackout had stopped at the Maine border on the northeast, and at Pennsylvania and New Jersey on the south, because these areas were weakly connected to CANUSE. Their interties—connections between the utilities—opened when the surges began. The school of strong ties granted this but replied that protective equipment could break the interconnections when the surges got too large for the neighboring utilities to handle, and so stop the progress of a blackout. Until that point, they argued, strong ties would reduce the likelihood of any one utility collapsing.

The investigators weighed in on the side of more and stronger connections, and the industry went ahead with the plan for a national power grid. After an unsuccessful try at a national linkup in the late sixties, using alternating current, East and West have been connected since 1976 in a method that has become increasingly popular as a stable way to connect large grids: high-voltage direct current. DC can connect two alternatingcurrent systems without any need to synchronize generators or timing. Furthermore, says John Dougherty, a vice-president of the Electric Power Research Institute: “DC can deliver the maximum power rating to a system in trouble and no more, no matter how bad the disturbance gets. It’s a limited but reliable source of power.”

A DC connection near Montreal now links New York utilities with the Quebec grid, which is rich in hydropower but very difficult to synchronize with. Without the DC ties, “Quebec simply can’t interconnect with the rest of the world,” says Fred Schweppe, a professor of electrical engineering at the Massachusetts Institute of Technology. With these and other additions, the New York State transmission system can transfer about three times as much power cross-state as it could in 1965.

William Balet is now director of the New York Power Pool, which the state’s seven big utilities set up after the blackout to coordinate generation and maintenance schedules. The pool operates a high-security command center near Albany to shepherd the state’s power supply. Every six seconds the pool computer polls signals on generators, transmission lines, and key intersections across New York—over twelve hundred measurements in all—processes the data, and makes it available to the system operator, who can then display the various reports on video screens.

Also common in modern control rooms is a “mimic board,” a huge electrical display built into the walls that shows in broad outline what the whole system is doing. Con Ed has an eighty-foot-long mimic board in its Manhattan control center. “The problem now is not too little information,” says Peter Zarakas, Con Edison’s vice-president of special projects; “it’s too much.” Ideally, a control-room layout gives the operator all necessary information without the operator “being too involved in all that’s going on,” says Zarakas.

“No human being can monitor all that information,” says Professor Schweppe. Similarly, when the network is rapidly collapsing, an operator should not be overwhelmed with hundreds of alarms. The ideal, not yet realized, is a computer program with enough reasoning power to digest all the alarms, examine the system, and give the operator a concise paragraph-length summary of the disturbance as it develops.

Because New York Power Pool members want to run only the most efficient combination of generators, the pool’s computer constantly sends orders out to the members’ computers for execution: close these breakers, start up this generator, or shut that one down for repair. The pool coordinates maintenance schedules to minimize the number of critical facilities out at any time.

This kind of cooperation has extended across the country, as a direct result of the 1965 blackout. “More than just technical changes, there’s been a structural change in the electric industry,” says Norton Savage, an engineer in the Department of Energy. All the utilities of the United States and southern Canada have coalesced into nine “reliability regions” to coordinate generation and transmission capacities—and their interconnections—far enough ahead to prevent more cascading blackouts. Steering this group is the North American Electric Reliability Council.

“Most important of all, perhaps,” says attorney Joseph Swidler, who was chairman of the Federal Power Commission in 1965, “are changes in management and in the control room. Traditionally, the rule was: never forsake load until the ship goes down. That’s gone by the boards now.” This “load shedding” is automatic, triggered when generators slow down and the 60-cycles-per-second frequency falls below a certain point for a certain time. It throws circuit breakers, cutting off big blocks of customers until the frequency comes back up. Within two years of the blackout, all major Northeastern utilities had installed such systems. Now, nationwide, it’s a “fait accompli, absolutely an industry standard,” says Robert Iveson.

Progress, certainly, but the New York City total blackout of July 13, 1977, provided one indication that more work remained. This cascading failure, which caused damages estimated at $300 million to $1 billion, was triggered by multiple lightning strikes on Consolidated Edison’s transmission system, which is crammed into narrow rights of way. It was aggravated by operator error and by the fact that an important interconnection to New Jersey was out of service at the time. At least four important reforms came from the 1977 failure. One is a thunderstorm watch, in which Con Ed reduces loads on the interties at the approach of lightning by increasing the output of its own generators. Second, the operators in the control center are trained more intensively. They learn how to handle emergencies before they happen, on a computer simulator. A third change arose out of difficulties in restoring New York City’s vexatious underground power supply, in which highvoltage buried cables are cooled by pressurized oil. In 1965 and again in 1977, cable oil pressure dropped during the blackouts, and emergency power was not available for the oil pumps. Now it is. A fourth change is a procedure to shed load when the power flow on the interties reaches the danger point. This makes it less likely that controllers will have to cut the interties in an emergency.

Says Peter Zarakas of Con Ed, “The name of the game is not to jeopardize your neighbors, and the name of the game is not to burn up the ties.” The latter is not just a figure of speech. An overflow of electricity across a power line can make it so hot that it sags into trees or another circuit and shorts out in a spectacular arc of blue-white fire. An overheated transmission line in Pennsylvania was the initial cause of the nation’s second largest blackout, in June 1967. It shut off thirteen million people in four mid-Atlantic states.

“Twenty years have passed and the reliability of electric power systems has improved through increased coordination of utility planning, engineering, and operations,” says Michehl Gent, president of the North American Electric Reliability Council (NERC). And it is true that the total number of U.S. outages in 1983 was considerably less than in the two worst years, 1976 and 1981, when unusual problems plagued various systems. Generation now looks adequate for the next few years. Furthermore, several new technologies now being field-tested may help prevent blackouts: fuel-cell power plants clean enough for inner-city operation, which will reduce big cities’ dependence on imported power; methods to store electricity for quick response during peak demand; and thunderstorm-detection networks that give utilities enough warning to confine lightning damage.

These changes may not be enough, however. In its fourteenth report on power-system reliability, Gent’s organization concluded that transmission “systems themselves are more complex and are being heavily loaded a high percentage of the time to maximize economy-energy transfers. As a result, there is a greater vulnerability….”

The biggest importers of less expensive electricity from other regions are oil-dependent utilities in southern Florida, southern California, and on the Atlantic seaboard. Supplying that power are areas with a lot of coal, such as Montana, or a lot of dams, such as Canada. Engineers on the Western grid have had to use complicated protective schemes to allow them to burden the lines right up to the limits with these economy purchases. These schemes “have become complex and thus the chances for mis-operation have increased,” said the NERC report. Compounding the problem is the fact that alternating current will not necessarily take the shortest path from economy seller to purchaser; following the laws of physics across the ever-changing grid, it may take a sudden detour and overload power lines a thousand miles away. The industry would prefer to build transmission lines at a faster rate, but these are politically and financially draining. Says one industry observer who prefers anonymity, “In the last six or seven years, as a result of financial difficulties and foot-dragging by regulators, funds for a high degree of reliability aren’t there.”

Another threat to the system is terrorism. “The Northeast could be cut off for weeks at a time,” says Robert Kupperman, an executive at Georgetown University’s Center for International and Strategic Studies, “by attacks at four or five key nodes—I don’t want to go into details about those—with a team of twenty people well distributed.” Kupperman proposes a national stockpile of key electrical components that, being non-standardized, would otherwise take a long time to replace.

Can we be assured that another blackout on the scale of the one in 1965 will never happen again? “We don’t like the word ‘never,’ ” replies Julius Bleiweis, director of one of the regional electric reliability councils. “Murphy’s Law is always with us,” adds Robert Iveson.

The industry does seem sure that, because of protective relays on the interconnections, “there’s very little possibility of any disturbance spreading very widely,” as John Dougherty of EPRI says. The utilities also believe that they can quickly restore systems after a blackout. But never again will anyone be as confident as the Federal Power Commission was in 1964 when it pronounced the nation’s power grids resistant even to nuclear attack. We know now that unpredictable combinations of ordinary events—a wrong relay setting, a lightning bolt, an operator’s bewilderment—can be enough to summon the darkness.

James R. Chiles, a lawyer and writer, lives in Dallas. His article on the history of the ball bearing appeared in our Summer 1985 issue.