Hilary Cheyne and David Mor
Dartmouth College Computer Science
March 14, 1999
Abstract
The power infrastructure is vital to the normal continuation of daily life for most Americans. Previous power outages have proven that the disruptions they cause may be massive, especially if they the outages are prolonged. It is therefore in our best interest to examine how the power industry is preparing itself for a possible Y2k caused outage, what the likelihood of such an outage is, and how the international community is reacting to the threat. Internally, power generation, transmission and distribution relies on many embedded systems and some automation, both of which are potentially susceptible to Y2k failures. A clear conclusion is difficult to reach since the power industry also heavily relies on the proper operation of the transportation industry (in providing coal, etc.) as well as the telecommunications industry.
Contents
We have come to depend on our nation's power infrastructure. Power outages such as the 1977 New York City blackout and, more recently, the 1998 Northeast Ice Storm have shown us just how much we take electricity for granted -- and just how difficult it is without it. Looting and lack of running water were serious problems that were faced by the New Yorkers and the Northeasterners. Is there a serious threat that a severe blackout will occur because of the Y2K bug?
To allow you, the reader, to make an educated assessment of the current situation, this paper will examine the relevant topics, starting with a brief explanation of our nations power grid and a look at some recent or famous power outages and the chaos they caused. The national power grid, which also encompasses much of Canada, is essentially a large structure much like the Internet, connecting smaller regional networks of power suppliers to allow sharing and make outages less likely. When outages do occur, they are often caused by several coinciding failures or errors which could not have been predicted. A discussion of one of the largest Y2k-sensitive aspects of the power infrastructure, embedded systems, and then a report on the general state of current industry Y2K readiness will follow. Finally, we will look at contingency planning in the power industry, as well as international reaction to the Y2K threat to power grids around the world.
A special point must be made: While we attempt to paint a picture of the current state of the threat of Y2K bugs degrading the power grid, a decision solely based on these facts would be a hurried one. The power grid is also affected strongly by the nation's transportation systems. Any damage to the telecommunications systems will also have strong adverse effects in the power infrastructure, as we rely on telecommunications in fixing and maintaining utility sites. Thus, these topics must also be examined to determine their effect on the power infrastructure and its Y2K readiness.
The Power Grid is an infrastructure which allows electricity generated at every power plant in the continental United States and parts of Canada to be used wherever it is needed. Traditionally, sections of the grid have been controlled by a single utility provider responsible for monitoring the activity levels in that section. This structure forces consumers to use only the provider in their region, but allows providers more control over their own section of grid. More recently, deregulation has allowed consumers to choose their own providers. While consumers profit from lower rates, the electric industry faces some difficult changes that could have negative effects.
The North American grid is split into three sections by region, as shown in Fig. 1 [17].
Fig. 1
In addition, each of these Interconnections is split into several smaller pools. As the term "interconnection" suggests, the pools form a network and are dependent on each other to keep the region of the grid functioning correctly. AC current runs within and between pools, so every plant in a given interconnection must have its clock synchronized to the millisecond with the others to keep the electricity flowing at 60 cycles/second [10]. In contrast, the electricity that flows between interconnections is in DC current [17].
Within this complex structure, what route does electricity take on its way from a collection of plants to the residential, commercial, and industrial buildings that use it? The North American Electric Reliability Council (NERC) outlines the flow [17], which we will summarize here. The plants, some located near areas of high demand, some located farther away, perhaps near a fuel source, each have a switchyard to increase the voltage of outgoing electricity. This increase allows the electricity to travel longer distances with less dissipation. A dense network of transmission substations receives the electricity and passes it on to distribution substations. Before it is distributed to consumers, the voltage of the electricity is decreased to appropriate levels. The network gets less dense as it gets closer to the destination, so that within a city that has several incoming power lines, an individual street will be served by a single line.
This flow of electricity is not automatic, however. There is also a complex control system in place to "a) balance demand and generation and b) to ensure flows and voltages stay within safe limits" [17]. Much of this balancing is done by software that collects real-time data and modifies the system accordingly.
The control centers insure the safety and stability of the electricity flow, but there are also some basic correction measures built into the transmission and distribution system. To prevent large groups of people from losing power when part of a line is damaged, areas served by single lines will sometimes be connected by "cross ties" [17]. These allow electricity to be re-routed to an area from a different source. "Relays" [17] are another corrective device. They detect faults and cause the area with the fault to be disconnected from the system.
The above description of transmission and distribution details how a local utility regulates the electricity going to its consumers. In the past, the utility company would have owned the plants that it used to generate the electricity, and the consumer would be forced to purchase only from the utility serving his own area. However, in the last few years, several states have adopted deregulation, allowing the consumer to choose where and how his power is generated. Under deregulation, suppliers buy power from plants in bulk and resell it. The local utility still manages the lines that this power travels on, but they no longer have a monopoly over their region [26]. Of course, the power that a consumer actually receives may not be from the plants that "supply" him, since electricity flows of its own will through the entire grid system, but the overall effect is the same. if many consumers, for example, are concerned with having "cleaner" power, plants using renewable energy will be in demand, and the percentage of electricity produced by these plants will go up, just as if the consumers were directly using the power from these plants themselves.
The effects of deregulation go beyond consumer demand, however. There is now competition between providers in some areas, and this could easily result in a reluctancy to share useful information such as peak usage times, information that, in an emergency, could be necessary.
Another effect that deregulation could have is that during localized outages, the supply and demand of power could be thrown off in another region. To continue with the above example, imagine that the "cleaner" plants are all located in one area, and the consumers of that energy all reside in a single other region. If the area with the plants has an outage, and that region also has smaller power demands than the region with all of the consumers, the outage could cause demand to suddenly outweigh supply, putting a strain on the grid and possibly causing more power losses. Although this example is simplified, and seems to rest on many independent factors, it is not entirely unrealistic.
A related problem has to do with flow. In order to calculate how much power they can safely send into their region of the grid, and thus how much they can sell, utilities need to know the capacity of the area's power lines and the amount of power that is already being transmitted over these lines by other companies. Under deregulation, this turns out to be exceedingly difficult, since one company cannot anticipate any other company's use in advance. Making estimates of this sort is also complex because the power flows through the grid in any way it wishes. Of course, this has always been the case, but since utilities had formerly completely controlled a region of their own, they could at least expect power flows to be similar to those they had seen in the past. Historical data will no longer be useful, however, since flows have changed significantly in deregulated areas. Static data or averages of data over a period of time can often give a false impression if the capacity fluctuates greatly, so these types are not useful either. Real-time data would certainly be helpful in preventing problems, but it does not aid in making business decisions and advance estimates about how much power to sell. Companies may therefore be forced to make estimates without adequate information. The danger lies in a company estimating too high. "Loading too much power onto a grid can cause current oscillations that lead to blackouts." [10] Obviously, control centers are in a difficult position as well, trying to keep all of the flows from these utility companies within safe limits while still satisfying demand.
As a last note, deregulation has not seemed to detrimentally affect the states where is has been adopted. In light of all of the potential problems, this seems somewhat surprising. Perhaps because it has been accepted slowly by a single state at a time, the utility organizations and control centers have had time to adjust to the changing flows.
There are several common threads that run through the history of power outages. Several power outages have had similar causes. If we can identify these common causes, we can examine whether they may play a role in the rollover into 2000. Similarly, examining the aftermath of such outages will allow us to be better prepared for a Y2K-related power outages(in the event one should occur).
Perhaps the most common cause of power failures in the world has been weather-related. There are many such weather-related events that can cause a power outage, ranging from tornadoes to mud slides. We shall examine three major weather events and how they caused a black out.
A thunderstorm that swept through New York City in mid June of 1977 caused the city's lights to go out for only the second time in the city's history. The power system was already under heavy stress due to drain from heavy use of air conditioners in the city. When several bolts hit several 345KV power lines, the city lost power for the next 25 hours [11]. The city's first outage, in 1965, was a night when strangers helped other strangers, dinners turned romantic, and lovers ensured that nine months later hospital maternity wards would be full [14, 27]. While in 1977 these were also true, some areas of the city were not as fortunate. Some would remember the night of June 13th, 1977 as the "night of terror" [25]. Poor neighborhoods experienced some of the worst looting in the nation's history [11]. The biggest single theft that occurred that night was reported as being looters driving fifty new vehicles out of Ace Pontiac [11]. The kindness that was noticed during the city's first blackout was also there, only in a twisted form. For example, a man assisted an elderly man get a stolen sofa on top of his car [11]. Stolen cars were put to double use, with rear bumpers being used to tear off the accordion gate off stores, and front bumpers being used to crash through the store across the street [11]. Surprisingly, other than the looting, there was no violence reported. A police officer explained, "It's hard to kill somebody when both your hands are full." [11]. A total of 3,777 people were arrested for looting that night [11].
An ice storm that began on January 2nd, 1998, quickly cut off power to many customers in the northeast United States and southeast Canada. Over 1.4 million customers were without power in the Montreal area alone.[39]. The ice storm also knocked out phone service to some spots, as well as radio transmission towers [39]. Water was entirely cut off for the entire Montreal area for one day and returned only intermittently afterwards since the water pumps rely on electricity to deliver water to customers [39]. In Maine, at least 275,000 Central Maine Power Company customers were still without power on January 9th [5]. Central Maine Power Company released a statement assessing their ability to restore power, "Repair crews' work was complicated not only by the continuing bad weather, which produces new calls for service restoration and fresh damage on just-repaired circuits, but by at least 80 poles broken by falling trees or vehicles skidding off icy roads" [5]. It took until January 23rd to restore power to all but 1,021 customers [6]. The long delays were partially due to heavy winds and the extent of the ice storm damage(to the high-voltage transmission lines, through substations and lower-voltage distribution lines, down through the final connection to the customer's home or business meter) [7].
Sometimes heavy winds can cause a power outage by apply so much tension on the power lines that they literally rip off from aging polls. One such storm on November 30, 1982 created 892 outages in the Los Angeles area [25]. As a matter of fact, the Los Angeles Dept. of Water and Power reports that they have had as many as 70,000 phone calls reporting trouble during one 24-hour long storm [25]. Dispatchers report that they can literally track the worst weather by the phone calls they receive [25].
The unpredictability of extreme weather hazards such as lightning strikes, ice storms, tornadoes, and damaging winds makes prevention a nearly impossible task. Many times power companies are aware that a storm is on the way, and all they can realistically do is brace for impact and hope for the best.
It is often difficult to categorize a power outage as a "system fault". Most of the time, unusual conditions contribute to the power outage as well, thus putting at least some of the blame on these conditions and not on the system. The Auckland, New Zealand outage is one such case, and though system fault may not have been the initial catalyst for the outage, the power outage did worsen because of the system. As a result, the power outage was not predicted. No one suggested or cared to admit that system would not be able to handle the stress caused by an unusually hot summer [32]. The aging underground transmission cables that are vital to feeding the city with electricity failed in succession, as one after the other they gave way under the high demand [32]. The city of 350,000 was shocked to find out that full service would not be restored for five to eight weeks [32]. Generators were flown in from Australia and Singapore, as rationing and selective distribution of generators to building with high-priority affected everyone in the city [32] Meanwhile the risk of fire became severe as backup generators were working extra-hard to keep up with the demand [32]. Commentators suggest that with data showing that the world is getting warmer, the worst-case scenario emergency plan may need to be remade to be slightly more pessimistic [32].
It is difficult to prevent "system fault" outages. Possibly the only way to be more confident that such a fault will not occur is to have different engineers review the current grid and its components and recommend upgrades and renovations as necessary. This is most likely unrealistically expensive. The question becomes: Will the alternative, a power outage caused by system fault, cost more to consumers in the long run?
Often times, engineers will assume proper operation of equipment. As several outages have shown, however, this is not always the case. A supposedly impossible power failure occurred in the Kansas City air traffic control center on December 18, 1997 [36]. The center was equipped with uninterruptible power supplies to assure that power to the center will never go out. A technician was performing maintenance on an uninterruptible power supply. He needed to route the power through half of a redundant system and then check the other half. Instead, he pulled a circuit board on the wrong half, and powered down the system that was on-line [36]. When the power was restored four minutes later, it was restored with a surge that further damaged four radar screens and a circuit board in the main computer [36]. The result of this series of events was an outage that began the relatively busy travel time of 9:00am, lasting for several hours [36]. Specifically, the system that displays radar information, the system that lets controllers and pilots talk by radio, and the special telephone lines that connect controllers in Kansas City with those in distant cities and enable controllers to "hand off" planes from one sector or center to another went down [36]. Without these vital surveillance and communications systems, the air traffic controllers had their work cut out for them. The center handles more than 5000 flights a day, accepting traffic from and passing it off to centers in Chicago, Minneapolis, Denver, Albuquerque, Fort Worth, Memphis, and Indianapolis [36]. Controllers are able to separate planes without use of radar by keeping track through the aid of radio beacons. However, this is only effective when the plans are at least 20 miles apart. This was not the case in Kansas City [36]. Howard L. Blankenship, a controller who is also an officer in the chapter of the National Air Traffic Controllers Association noted that non-radar control is now nearly impossible because "free flight", or direct flights from one point to another without using designated airways, is now often allowed [36]. He explained that this "free flight" saves fuel and time, and is perfectly safe when radar is in place [36]. One can imagine how disastrous outages in air traffic control centers can become, especially in lieu of "free flights".
It is impossible to make a completely reliable system. The Kansas City air traffic control center outage is a great example of a very reliable system showing its fault. Perhaps the only way to try and prevent such outages is to perform more training for technicians and other vital personnel. Still, one cannot control every action these personnel may make, and so one cannot expect to eliminate outages caused by human error.
2.2.4 Other
Outages that fall in this category are often times preventable, but the circumstances surrounding them are bizarre, and thus the outages were not prevented.
Balloons were released in Los Angeles during the Olympic opening ceremonies in 1984 [25]. These were not ordinary balloons, however. They had metalized tails [25]. Dispatchers at the Los Angeles Dept. of Water and Power watched with disbelief as hundreds of these balloons floated into the air in an impressive, shining display [25]. Their fears came true: the balloons landed in power lines a few miles from the stadium, igniting some sparks and causing numerous power outages [25].
On October 24, 1997, San Francisco experienced a power outage that affected about 125,000 customers. Officials described this as the worst act of sabotage against a power system in at least a decade [12]. It began just as the city awoke, at 6:15am, and lasted until 9:45am [12]. Officials discovered that 39 power-control switches in a utility substation had been manually turned in a way that halted the flow of electricity [12]. To perform this, not only is knowledge of the system needed, but a key is also required to get into the substation [12]. Signs of forced entry were not found, and the intruder is thought to have had access to the site [12]. The investigation still continues.
As with the categories above, these outages are very difficult to prevent. It is not realistic to have all functions(such as the Olympics) report to the local utility companies to check for safety and hazards as a result of these functions. Furthermore, one cannot forecast an event such as the sabotaged utility substation in San Francisco. It therefore seems impossible to prevent all other power outages that did not fall into the weather, system fault, or human error categories.
In this section we would like to consider one of the major sources of concern surrounding Y2k readiness of the power infrastructure. This concern lies in embedded systems, which could cause severe and widespread problems in all sectors of the industry if they are not properly assessed and remediated. We hope to give an idea of the large scope and intricate nature of the problems related to embedded systems in preparation for discussing the industry's readiness.
We have encountered several definitions for embedded systems, and will be using that given by the UK Institution of Electrical Engineers (IEE): "They are devices used to control, monitor or assist the operation of equipment, machinery, or plant. ‘Embedded' reflects the fact that they are an integral part of the system" [16]. This definition is the most broad, encompassing devices as small as microprocessors and as large as general-purpose computers. Other definitions add a second criterion that the system's embeddedness relies on it being non-obvious to the user. These smaller, less obvious devices will be the focus of our discussion, since the effort to repair systems such as general purpose computers generally remains separate from that of embedded systems.
Embedded systems may contain several levels, as shown in Fig. 2 [16].
Fig. 2
A user receives the embedded system from a vendor and adds software as needed. But the vendor may have in turn received a part of the product from a sub-vendor and simply added a layer of functionality before passing it on to the user. This nested structure provides challenges in determining the final product's Y2K compliance.
Frautschi [14] estimates that in a typical non-nuclear power plant there are tens of thousands of these embedded systems that must be tested for Y2K compliance. Of these, about five hundred will be non-compliant and will have to be repaired or replaced and then tested. In addition, embedded systems are also found in many significant areas of transmission, distribution, and monitoring of electricity flows. Among these are automatic controls in control centers, which often use time clocks [17]. These automated controls collect and analyze real-time data to monitor flows and take corrective measures if problems occur. If date/time related malfunctions occur, these calculations, necessary to the safety of the transmission and distribution system, may be incorrect. This result could cause the automated controls to make incorrect decisions, with unpredictable consequences.
Many problems that can occur with any embedded systems become amplified in the context of electric utilities. One reason for this is that electric utilities are so necessary to everyday life that a malfunction related to Y2K can have disastrous consequences. The interdependence inherent in the structure of the power grid dictates that compliance is not jut a matter of individual plants or transmission systems testing their functionality, but is dependent on every section of the grid functioning with minimal disturbance.
The most basic problem for electric utilities involving embedded systems is the sheer number of systems involved. Each one of these systems must at least be located, and the vendor determined, a daunting task in itself. At this point it seems that a plant could contact these vendors for Y2K compliance statements, and significantly reduce the number that must be tested. However, there are several problems with this action. First, many of the vendors may not have documentation regarding their Y2K compliance [14], or their representatives may claim compliance when in fact probing more deeply reveals that only some of their products are compliant [9]. Another problem is that vendors that have documented Y2K compliance may not be correct in their assessments, and these errors may not be entirely their fault. Because of the nested structure of embedded systems, a vendor assessing its own product may be resting on incorrect assumptions about a sub-vendor's product's compliance, especially if the sub-vendor has no formal statement about Y2K compliance. In addition, the vendor may not know what the product is being used for in the context of the user's system. IEE uses the example of a Programmable Logic Controller (PLC), which users can customize with their own software and connect to one or more devices [16]. The vendor will likely not be able to supply compliance information for the product in such a configuration, since most embedded systems have a broad range of possible uses, all with potentially different Y2K consequences.
Back at the power plant, these vendor problems have interesting consequences. For example, even if a vendor pronounces that a certain system is compliant, and one such system that has been tested at the plant has indeed functioned correctly, the plant operators can not rest easy and eliminate all "identical" systems from consideration. Even systems made at the same vendor in the same way with successive serial numbers may differ in their compliance status [16, 18]. As IEE states, "Possibly, the two devices in question contain different versions of sub-assemblies, where some...have a Y2K problem and others did not" [16]. With all of these uncertainties, the safe route for utilities to take is to test every embedded system to be sure.
As if testing everything were not daunting enough, there is still one problem lurking in these systems. Assuming that a plant has in fact located all of its non-compliant systems, and repaired or replaced them, the larger systems may still not work. Why? Each vendor will solve compliance problems in a unique way, and the replacement Y2K compatible system may not be compatible with others from other vendors. Much like software, individual systems may work properly in isolation, but may not in conjunction with other systems that communicate with or rely on them. Similarly, if the software or other hardware used by the plant fails, it could corrupt the corrected embedded systems [14].
Obviously, the problems with embedded systems are both difficult to solve and large in scope. But utilities must strive to solve compliance issues in embedded systems, because unremediated systems could in fact cause outages. While most of the failures of individual systems will likely be contained in small areas, and thus may cause only small or short-lived outages, the ubiquity and elusiveness of these systems could cause just the kind of unpredictable multiple failures that often result in larger outages. In addition, the potential for other unrelated unexpected failures to occur is greatest in the rollover to the new year, and the result of the combination of any such failures and the problems with embedded systems is impossible to predict. Hopefully the following example will serve to indicate the wide impact of any single embedded system to the functioning of our power system as a whole, and reinforce the notion that January 1, 2000, while certainly the date of highest priority, is not the only date of significant concern.
The Global Positioning System (GPS) faces a "Y2K" problem sooner than most anything else. Since its time is relative rather than absolute, it doesn't care about the new millennium at all. However, it does keep track of time in terms of weeks since January 6, 1980, and the number of seconds elapsed in the current week. It uses this information to calculate the current date and time. On August 22, 1999, the 1023rd week will end, and the week number will rollover to 0000. The Air Force has issued a statement that it is up to the user/GPS receiver to account for the 1023 elapsed weeks [33].
The impact to the utility industry lies in embedded systems. At the control centers, embedded systems are linked to the GPS system to synchronize their clocks with all of the clocks in the other control centers of their interconnection [16]. This synchronization is essential, since the interconnections run AC current, as we mentioned in the background section. If any one subsystem were to get out of phase, the entire interconnection could go down [14], and a failure of that scale could well affect the entire power grid.
Although the GPS problem is technically not a Y2K issue, it is illustrative of how integral embedded systems are and how much even one malfunction could affect the entire system.
The readiness section is based on the North American Electric Reliability Council's (NERC) report to the United States Department of Energy (DOE) [17]. It consists of a summary of some of the major points in their findings as of the fourth quarter of 1998. Because the NERC report is the official report of all North American utilities, we considered this as the only reliable source for accurate general readiness statistics.
According to NERC, "about 98% of the electricity supply and delivery organizations in North America have participated" in their Y2k reporting. Those reporting represent 92% of non-nuclear generating facilities, and 100% of nuclear generating facilities as reported through the Nuclear Energy Institute (NEI) process, which NERC uses in its assessment. These reporting organizations are responsible for production and distribution of approximately 96% of system peak load for North America.
NERC divides the Y2k process into three steps: Inventory, Assessment, and Remediation/Testing, and sets a date of May 31, 1999 for completion of these steps on all equipment mission-critical to providing reliable electricity. It is important to note that the organizations are not trying to become "Y2k compliant," which suggests correct functioning of every system using date-manipulation. Rather, they are striving for "Y2k readiness," meaning that all mission-critical systems using date manipulation should function properly. The target date for Y2k readiness is June 30, 1999. Presumably, the extra month allows for any unsuccessful last-minute remediation efforts to be corrected so the organization can indeed claim Y2k readiness. Although many organizations report target dates for readiness later than June 30, the report remains generally optimistic that this will not have a significant enough impact to affect the functioning of services on critical rollover dates. Based on follow-up interviews, NERC has determined that reporting criteria are not fully understood, and some organizations are reporting as if they are expected to be compliant by June 30. The remaining organizations which truly do not expect to be ready are those that are impeded by such things as routine maintenance shut-downs. NERC has accounted for these exceptions in their assessment that "any facilities or systems that will be completed after [June 30] are specifically known, are limited in number, and would not impact the ability to provide reliable electric service."
Their assessment is very optimistic, and we wonder if the organizations that are either not reporting or will not be ready could in fact cause problems beyond what NERC admits. NERC appears to derive its conclusions from the small number and MW output of these potentially non-ready organizations, but they do not seem to account for the possibility that failures are usually more complex than a single organization failing or not failing. Because the grid is a dense network, there is a great potential for several small and seemingly independent problems to contribute to a larger one, and the failure of a plant or distribution system, no matter how small, may have a significant impact if other unforeseen problems arise. It makes sense that such speculations are left out of the report, however, as NERC could not make any predictions about such failures, and would not want to arouse unnecessary alarm. Some specific statements do carry an undertone of concern, however. In speaking about one facility that will not be Y2k ready by June 30 because of routine maintenance, NERC states, "The unit is not necessary to meet lower than normal electricity demand through the initial transition to the Year 2000" (Italics added). This clearly calls into question the conclusion that reliable electric service will continue normally, and the issue is not further addressed in the report.
On a more uplifting note, we noticed in our browsing that most large utility companies are freely offering their Y2k readiness status, and they are largely either on or ahead of NERC's prescribed schedule. Many also mention the specific concerns that we raise and are well along in the process of remediating and testing solutions to these problems. The smaller providers may be more of a concern, but with the larger providers ready, the likelihood that needed power will continue to be available increases greatly.
The concern in non-nuclear generation facilities is automation. One potentially problematic system is the Digital Control System (DCS), which controls nearly all of a plant where it is installed. These systems can control everything from computations of optimal power flow, load, and fuel resources to fault detection. One such system we read about was constructed as a LAN, and was responsible for updating databases on terminal computers at regular intervals [15]. Obviously these calculations and updates are time and possibly date sensitive. Plants with this sort of system will need to rely on vendor-provided solutions, since the vendors are the only ones who understand the workings of the systems. Many plants concerned about meeting the June 30th deadline are relying on the DCS vendors for fixes, and these vendors may already be overtaxed.
It is worthwhile to note a few things about these DCSs. Although the Electric Power Research Institute (EPRI) has been encouraging generation facilities to switch to these systems for years, as of Feb. 2, 1999, only 30% had. The other 70% rely on older, analog control systems which can be as much as 40 years old. Of course the very recent digital systems are Y2k compliant, and the older analog systems should also continue functioning, as they have no date-dependent parts. The systems that are problematic are those which are digital and more than ten years old [13]. Because replacing these systems is so complex, it is unlikely that facilities that have not already done so will replace their systems to fix Y2k bugs, unless that is the only solution available. Although this problem impacts "only" as much as 30% of the generation industry, it is a large and difficult problem to solve for those unfortunate plants.
Another concern related to automation, although less threatening, is the Continuous Emission Monitoring System (CEMS). Y2k related errors that have appeared in these systems have generally been related to data management, and are not critical to the system's functioning. In addition, fixing these systems is easier than in the case of DCSs, since there is generally more internal expertise for these systems, and thus, less reliance on the vendor alone for solutions.
Having investigated the potentially large impact of embedded systems, we were concerned about whether organizations would be relying too heavily on vendor reports. NERC states, however, that with the exception of DCS systems, "most power producers are committed to testing all mission-critical components and systems themselves."
It is important to note that NERC uses the NEI report for nuclear generation plants, and the NEI report covers Y2k status of all systems, not just the mission-critical ones. Even with this additional consideration, the level of readiness for nuclear plants is higher than that of non-nuclear, and their rate of improvement since quarter three is also impressive. There were no major problem areas for nuclear plants, and in particular, "no facility has found a Y2k problem that would have prevented safety systems from shutting down a plant."
Additionally, all plants are required to develop a contingency plan by the June 30th deadline.
There are two major issues facing the transmission control sector of electric utilities. The first is that most rely on Energy Management Systems (EMS) or Supervisory Control and Data Acquisition (SCADA). While the problems being found in testing are benign, NERC cautions that there are still risks, namely "loss of external data communications, [and] overload of alarm systems or data buffers if a burst of activity occurs during critical rollover periods." It is unclear how much of a threat these systems actually pose.
The other issue was one already mentioned in the "Embedded Systems" section, namely the GPS rollover to occur in August. NERC reports that "several organizations" have updated their systems to adapt successfully to the rollover. They do not state what solutions other organizations are applying, if any, or whether the upgrade is a necessary step in remediating these systems.
A large part of distribution systems is electromechanical equipment, which is not date-sensitive. In fact, distribution systems have the least amount of Y2k affected technology of any area of utilities. However, it is still significant to discuss their readiness because they are so essential to the end user. Because of their structure, a failure in one part of a distribution system could cause a large area to lose power, without access to an alternate supply.
Fortunately, relays, a key to keeping distribution systems running safely, have not shown any Y2k related problems in functioning when tested.
One problem that distribution systems do have is that they contain a large number of what NERC calls "microprocessor based components." We believe that this refers to what we have been calling "embedded systems," in which case the distribution systems have a potentially large problem. NERC's suggestion for dealing with these devices is sound: "It is recommended that if the failure of a digital device alone could result in customer outages, each individual device should be tested." This corresponds with the information available on the risks of embedded systems, and distribution facilities should certainly be aware of these risks before declaring Y2k readiness. As mentioned in the Embedded Systems section, any single device could cause minor problems, including small-scale outages, and it is these types that NERC seems to refer to. As we also mentioned, however, many independent problems with these systems could result in larger outages.
The industry is trying to take a "better safe than sorry" approach to the possibility of the Y2K-caused power outage. The North American Electrical Reliability Council (NERC) has identified six steps that are recommended for the power industry's Y2K contingency planning and preparation. These six steps are:
NERC has prepared a schedule that gives a general outline of goals to be achieved by set dates.
| December 31, 1998 | First draft of regional and operating entity contingency plans available to NERC/Regions for review |
| January 25-26, 1999 | NERC review of draft contingency plans |
| January 27, 1999 | Inter-industry contingency planning coordination meeting |
| April 8-9, 1999 | First industry-coordinated Y2K readiness drill(communications) |
| June 30, 1999 | Second draft of regional and operation entity contingency plans available to NERC/Regions for review |
| September 8-9, 1999 | Second industry-coordinated Y2K readiness drill |
Contingency planning is currently being coordinated at the Interconnection and interregional level by NERC [17]. The Regional Reliability Councils will coordinate the more local efforts [17]. Contingency planning not only involves planning for the New Year. NERC has assigned the rollover to 2000 the highest priority, but it has also provided contingency planning priority ratings for other dates that exhibit anomalies in computers. These are:
September 8, 1999 to September 9, 1999 – Exhibits a special value of 090999, which may be interpreted as a special operation code.
February 28, 2000 to March 1, 2000 – Exhibits potential problems in the rollover into and out of the leap year date.
April 8, 1999 to April 9, 1999 – Exhibits a special value of being the 99th day of 1999.
August 21, 1999 to August 22, 1999 – Exhibits a special date as the GPS satellite clocks expire.
NERC has asked the bulk of the electric industry to prepare a draft of their contingency plans by December 31, 1998 [17]. While the results of this request have not been processed yet, a mid-point review of the contingency plans in November 1998 has shown that this request is "being taken very seriously and progress has been substantial" [17]. The reader should keep in mind that without any hard numbers to back up these claims, the issue remains essentially unresolved. They are also initiated a study of how the electrical systems may behave during the New Year rollover to the year 2000 [17]. They have found that demand for electricity on New Year's Eves that fall on long weekends to be 40-50% of system peak demand. NERC plans to use the data from this study as a base case for Y2K studies [17].
There will be an industry wide drill on April 9, 1999. It will be used to determine Y2K readiness and where the industry stands. Five objectives have been identified for the April 9th drill by NERC [18]. According to NERC's Drill Development Guide, these objectives are:
Another drill will be held in September 1999 [17]. The details of these drills are currently sparse and for all intensive purposes unavailable.
PJM Interconnections L.L.C, a regional entity, has already completed a drill on December 15-16, 1998. It simulated the loss of voice communications, as well as the loss of voice and data communications with another company. They identified several issues that they will pursue further, including training technicians to know what screens specific data is located on, how they may report information in different ways, how they may change the frequency of reporting, among others [17].
Voice and data communications have been thrust into the forefront of contingency planning. They have proven to be most vital as the electric power systems have grown to be heavily dependent on communications equipment and networks for real-time control and monitoring [17]. Thus any drills or contingency plans must be prepared to consider that at least part of the communications system will be unavailable. Related to this communication issue are information management problems during the Y2K periods [17]. Currently a plan exists where a central reservoir of information regarding system conditions during Y2K will be available. It will allow electric power systems around the world to rapidly share and gather information.
There should also be backup generators on line as a precaution against Y2K problems [17]. These backup generators will be on line in case others go down. Interestingly enough, unusually low demand for electricity will also cause a problem because the system voltages and frequency will rise to abnormal levels, due to the extra output from the backup generators [17]. Thus, there exists a tradeoff between adding extra generators and harming the system due to too many generators. To avoid unusually low demand for electricity, customers may need to be informed of this, or in the very least be advised not to turn off equipment that would normally stay on throughout a weekend under normal circumstances [17].
Each utility company must review their restoration plans to ensure that these plans are Y2K compatible. Furthermore, these should be coordinated with other regional restoration plans.
Loss of external power and loss of distribution systems should be included in contingency planning.
Nuclear power supplies about 22% of the nation's electricity [38]. Six states (Connecticut, New Jersey, Maine, Vermont, South Carolina, and Illinois) rely on nuclear power for more than 50 percent of their electricity, while thirteen others rely on nuclear power for 25-50% of their electricity [38]. The table below, taken from full text of testimony from the Senate Banking, Housing and Urban Affairs Committee's hearing on Mandating Year-2000 Disclosures for Publicly-Traded Companies, outlines reliance on nuclear power by region for the United States.
| Region | Number of Nuclear Plants | Percent of Electricity Needs |
| New England | 7 | 40 |
| Middle Atlantic | 21 | 36 |
| Southeast | 37 | 25 |
| Midwest | 31 | 22 |
| Southwest | 7 | 15 |
| West Coast | 5 | 14 |
| United States | 108 | 22 |
Fig. 3 is a map of where these nuclear power plants are located [35].
Fig. 3
Clearly, it would be prudent to review what contingency plans have taken place in the nuclear power sector.
The Nuclear Regulatory Commission has also suggested implementing contingency plans for nuclear power plants. The worry with their proposal stems from their planning scenario. It falls somewhere between the best case and the worst-case scenarios [34]. The best case scenario is one where very little if any power and communications systems go down. The worst case scenario is one where the entire power grid collapses, and the communications systems in the US are greatly degraded. Critics of the plan worry that if the actual case turns out to be worse than the planning case that the electrical industry would suffer greatly. The planning case makes the following assumptions, copied verbatim from the U.S. Nuclear Regulatory Commission's document: Contingency Plan for the Year 2000 Issue in the Nuclear Industry.[34]
The NRC's contingency plan will be based on the Incident Response Plan that has already been in place for years [34]. The agency suggests that all technical teams will be completely staffed, and that it will enter Standby Mode on New Year's Eve [34]. Additionally, the international liaison team will be available, on Standby, and further augmented as part of the preparation [34].
During an emergency, the NRC Operations Center relies on three systems [34]. All of these are assumed to be under normal operation during any Y2K problem, with the milestone date for Y2K compliance of these systems being March 1999 [34]. The NRC is also devising contingency plans for each of these system, however each of these plans assumes that electric power, telecommunications, and building support systems will be available [34]. This claim by the NRC is strange, since the contingency plans are there to provide the electric power. This circular reasoning goes unexplained in the NRC's document noted above. The three systems are:
NRC explains, "the ETS system is designed to remain functional following a single fault or failure, barring a fire in the telephone cable room or some other common-mode failure" [34]. Furthermore, the system runs on the FTS2000 network, which is the largest private telephone network in the world. It is independent of the public switched network, and so should be more reliable. An alternate way of communications, by the use of a microwave link through the load dispatcher, is also available [34]. Still, if the ETS system is not Y2K compliant, communications will not be available. Since this system is so critical to the NRC, it is considering becoming a node on the special National Communication System's Y2K contingency network [34]. This network is in the design stage [34]. It's purpose will be to provide communications despite a major outage to the public switched network [34].
There is an emergency backup power system that is being placed in The Operations Center [34]. This system includes a dedicated emergency diesel generator and several uninterruptible power supplies [34]. The Dec. 18, 1997 failure at a radar control center in Kansas City Center shows us that even uninterruptible power supplies are not foolproof, since human error is beyond our control [36]. The technicians will undoubtedly be under heavy stress should their services be required in a Y2K nuclear power crisis. Such stress can impair judgment and perception. A fine example of this was the mistake made by the officers of the U.S.S Independence off the Persian Gulf when they accidentally shot down an Iranian passenger aircraft. While the officers were undoubtedly under heavier stress than the technicians would be under, the technicians would likely get little or no practice under stressful conditions. A dedicated heating, ventilation, and cooling system is also being installed [34].
Additionally the NRC has recommended that a back-up operations center be set up in the Region IV Incident Response Center [34]. Region IV was selected for several reasons, as explained on U.S. Nuclear Regulatory Commission's document: Contingency Plan for the Year 2000 Issue in the Nuclear Industry:
The NRC will also set up an Information Brokers response team [34]. This team will be in charge of disseminating to the nuclear power plants any Y2K related information that affects them [34]. They will also respond to any Y2K-related problem at nuclear power facilities [34]. The team will also evaluate Y2K rollover reports as they come in from other nations on the front end of the International Date Line, such as Japan and Korea, to see whether they can use this information in an effort to further shield the nation's nuclear power supply [34]. The use of any of this type of information needs to be carefully considered since it may be unwise to implement these suggestions without extensive evaluation [34].
It is a fact that we take for granted, "we live in a global age." We have ‘global economy', ‘global weather', and ‘global networks'. We must therefore consider what some of the other nations are doing about their own power grids, and how they may be preparing for the millennium bug. An MSNBC report from November 22, 1998 states, "the overall sense is that, if necessary, the safety shut down systems will function since most reactors predate widespread computerization. But other systems – handling security, radiation monitoring, and central power dispatching are all candidates for Y2K problems."
The Australian telecommunications giant Telstra has indicated that they are worried about the millennium turnover [19]. They noted that they might be affected by other industries' turnover problems, even if they are entirely Y2K compliant [19]. Issuing a warning to would-be shareholders in 1997 they remarked, "We need to get assurances from suppliers – including specialized networking concerns and other more general suppliers such as electricity and water companies – that they are taking the necessary steps to comply."[19]
On May 4th 1998, The Australian reported that United Energy disclosed that it was still at the planning stage in dealing with the Y2K problem [21]. Richard Humphry, the managing director of the Australian Stock Exchange, has warned that there could be several power shortages across the Australian national power grid [21]. He believes that United Energy is not the exception and that most utility companies in Australia find themselves behind schedule when dealing with the Y2K problem [21].
A June 1998 report to the Parliament states that the failure of power and telecommunications systems is one electron away [8]. The report found that the electricity grid was most vulnerable to the Y2K bug [8]. Dr. Cobb found that there are "choke points" in the Australian power grid [8]. These are points that must work for the rest of the system to function properly [8]. Specifically, an entire portion of the grid is controlled from a center in a northern Sydney suburb [8]. Any disruption to this control center has the potential to black out the entire State [8].
The Australian Financial Review reported on Dec. 4 that a Y2K spokesman for the Victorian Electricity Supply Industry said that remediation and testing would be complete by December 31 for the State's distribution, transmission, and generating companies [23].
Another article in the Australian Financial Review from January 13, 1999, reported that the Australia's electricity supply industry has missed the self-imposed December deadline for Y2K readiness [24]. The revised date for readiness is now being set at "midyear" [24].
The heads of Australia's Electricity Association of NWS (EANWS) say continuity and reliability of electricity supply will not be affected by the Y2K bug [2]. A Y2K program manager at EANWS says that the supply of electricity is "a low-tech process that does not rely on computers." [2] Regarding the vital coal supply that the power industry relies on, Mr. Michael Sinclair, executive manager of EANSW states, "all coal-fired power stations have on-site storage that can last for months, and coal is supplied by conveyor belts directly from coal fields." [2] He added, "For normal operations we depend on telecommunications companies. We're not expecting Telstra to fall over, but we have out own internal communications network and we are extending that to a VHF network as a third level of redundancy." [2] Perhaps most vital to the American readers, Mr. Sinclair added that comparisons between Australia and the US, which has thousands of utilities, were invalid because of the difference in scale [2]. Because the Australian system is not as complex as the U.S.'s power grid, the Australian problem is supposedly easier by several orders of magnitude.
Most recently, on February 9, 1999, Australian businesses have begun complaining that they are not receiving the needed information from Australia's electricity, water, and telecommunications suppliers [30]. Without this information contingency planning is made practically impossible to these companies. Graeme Inchley, chief executive of the government-backed Y2K industry task force said, "Everyone's waiting on everybody else" [30]
The London's Sunday Times February 15, 1998 issue reported that the British government is drawing up urgent plans to "prevent a millennium nightmare in which the start of 2000 is marked by power failures…"[27]. Since then, utility companies have begun to realize that they cannot be assured that they will be 100% compliant [20]. They have therefore decided to draw up a set of contingency plans [20].
On September 24, 1998, Computer Weekly reported that the British water industry is drawing up contingency plans in case of Y2K failures [22]. They worry, however, that the British power industry still has doubts about the power supply on which they rely on [22].
The National Audit Office (NAO) has completed a report about the status of various industries regarding Y2K readiness [29]. In it, the NAO claimed that Britain's utilities and their regulators did not ensure that vital power and water systems would not be disrupted over the 2000 rollover date [29]. They have concluded that, "Considerable progress has been made, but there is still work to be completed by the utility companies and their regulators to ensure there is no disruption to essential services over the millennium." [29]
London's Sunday Times ran a story on April 12, 1998 stating that western intelligence has warned of possible nuclear meltdown in the former Soviet bloc because of the Y2K bug [3]. There are 65 Soviet-made civilian nuclear power plants in the Soviet bloc countries [3]. Russia has 29 civilian nuclear reactors [3]. Eleven of these are models similar to the Chernobyl, Ukraine plant [3]. If one explodes, it releases 200 times as much radioactivity as the atomic bombs at Hiroshima and Nagasaki [3]. A March 2nd MSNBC report lays some of these fears to rest: "Soviet-era equipment in Ukraine's nuclear power plants is so obsolete that the so-called millennium bug is not a problem for its electricity grid, a nuclear official said Tuesday." [31] This is in direct contradiction to the latest official U.S. stance on nuclear safety in Russia -- a report released by the CIA that states, "there is a significant risk related to the nation's electrical grid, including its nuclear power plants, primarily because of a late start in addressing or even acknowledging the problem by the agencies responsible."[37]
In February 1999, Russia finally admitted that a problem DOES exist with Y2K bugs [1]. Alexander Krupnov, chairman of the Central Telecommunications Commission remarked that Russia is "in a critical situation in several areas." [1] Officials have said that Russia will face serious problems in its transportation industry, specifically its railroads [24]. Without railroads, coal and other crucial supplies will not be delivered to power utility stations. The power would therefore go out, even if the Russian power industry experiences no computer glitches because of the Y2K bug. Alexander Menshikov, deputy director at the Transport Ministry's computer center added, "according to some reports, transport in America will be stopped for three months because of the 2000 problem. We will not have such a big problem." [28]
The Canadian Electricity Association has released a report on Jan. 21, 1999 that claims that "Canadian electric utilities will be in an excellent position to maintain electricity service during critical Y2K transition periods." [4]
The electric utility industry faces several challenges with the year 2000 approaching, and it is difficult to determine what, if any, outages will occur, and on what scale. With the complex nature of the grid system and its construction as a densely connected network, many outages are caused not by a single failure but by a collection of generally unlikely events occurring simultaneously. The threat of such a "random" collection of failures occurring on critical Y2k-related dates is much higher than at other times, because there is already a high potential for at least some small failures to take place. Add in any unpredictable factors like strange consumer behavior or weather problems, and the likelihood rises.
In addition to the unpredictable, there is the potentially large threat posed by embedded systems in all areas of utility functioning. Although the readiness report by NERC indicates that most generation, transmission, and distribution systems are well on their way to being Y2k ready by June 30, some of these embedded systems may escape notice, or may be deemed ready by vendors when in fact they are not, given their underlying structure or the system they are placed in. Additionally, readiness may be impeded by automated systems which cannot be tested internally, only by vendors. NERC is confident, however, that any systems not ready will not be mission-critical in delivering a sufficient supply of power to consumers. Hopefully NERC's predictions will be accurate.
Of course, there is always the possibility of human-induced failures, whether they are caused by stressful conditions on technicians or a prevention act based on experiences for utility stations in the front of the International Date Line. The Nuclear Regulatory Commission has taken many adequate steps in ensuring that nuclear power plants will not suffer a health-threatening breakdown. This is important, since they are responsible about 20% of the nation's electric supply.
There is only one way to truly know whether the electrical utility industry is ready for Y2K. Wait and see.
[1] Associated Press. Russia Concedes Y2K is a Problem. http://www.msnbc.com/news/238057.asp, February 3, 1999.
[2] Stan Beer. Sydney's Lights Won't Be Bugged. Australian Financial Review (February 4, 1999). http://www.afr.com.au/content/990204/inform/inform6.html, February 4, 1999
[3] Matthew Campbell. Nuclear Fears on Millennium Bug in Russia. London Sunday Times, http://www.Sunday-times.co.uk/news/pages/sti/98/04/12/stifgnnws01002.html?1733620, April 12, 1998.
[4] Canada NewsWire. Canadian Electricity Association - Release of Electric Utility Y2K Report, http://www.newswire.ca/releases/January1999/21/c7352.html, January 21, 1999
[5] Central Maine Power Company. Ice Storm Black Out Now Over 275,000 Customers, http://www.cmpco.com/news/older_releases/980109.html, January 9, 1998.
[6] Central Maine Power Company. Outage Count Falls to 1,021, http://www.cmpco.com/news/older_releases/980123c.html,January 23, 1998.
[7] Central Maine Power Compnay. Power-outage Q&A, http://www.cmpco.com/news/older_releases/980113g.html,January 13, 1998.
[8] Dr. Adam Cobb. Thinking about the Unthinkable: Australian Vulnerabilities to High-Tech Risks. http://www.aph.gov.au/library/pubs/rp/1997-98/98rp18.htm, February 20, 1999
[9] David Collins. Embedded Industrial Control Systems and the Year 2000 Problem. Technical Report TR 97/11, Dept. Of Computer Science, Keele University, May 1997. Available at http://www.compinfo.co.uk/Y2k/scada.htm.
[10] Peter Coy. Who's Watching the Power Grid? Business Week, 86+, June 17, 1996.
[11] Michael Daly. 1977 Blackout in New York City. New York, v.26:156-7, April 19, 1993.
[12] Timothy Egan. Blackout in San Francisco; Sabotage Is Seen. New York Times, A7, October 25, 1997.
[13] Robert Frank. The Instrumentation and Control Center, http://www.epri.com/gg/centers/icc/index.html, February 2, 1999.
[14] Mark Frautschi. Embedded Systems and the Year 2000 problem. Feb 17, 1999 draft. Available at http://www.tmn.com/~frautsch/Y2k2.html.
[15] GE Harris. Products and Services: Distributed Control Architecture. http://www.hdap.com/products/engman/dpa.html, October 5, 1998.
[16] Institution of Electrical Engineers. Millennium Problems in Embedded Systems. Available at http://www.iee.org.uk/2000risk.
[17] North American Electric Reliability Council. Preparing the Electic Power Systems of North America for Transition to the Year 2000. ftp://ftp.nerc.com/pub/sys/all_updl/docs/Y2k/secondfinalreporttodoe.pdf, February 14, 1999.
[18] North American Electric Reliability Council. Drill Development Guide. ftp://www.nerc.com/pub/sys/all_updl/docs/y2k/planning-a-drill-4-9-99-final.pdf, February 22, 1999.
[19] Gary North. Summary of Article Appearing on Australia's Financial Review (Oct. 14, 1998 issue). http://www.garynorth.com/Y2k/detail_.cfm/605, February 21, 1999.
[20] Gary North. Summary of Article Appearing on Computer Weekly News (March 5, 1998 issue). http://www.garynorth.com/Y2k/detail_.cfm/1220, February 21, 1999.
[21] Gary North. Summary of Article Appearing on The Australian (May 4th, 1998 issue), http://www.garynorth.com/Y2k/detail_.cfm/1638, February 21, 1999.
[22] Gary North. Summary of Article Appearing on Computer Weekly (September 24, 1998 issue), http://www.garynorth.com/Y2k/detail_.cfm/2678,February 21, 1999
[23] Gary North. Summary of Article Appearing on Australian Financial Review(December 4, 1998 issue), http://www.garynorth.com/Y2k/detail_.cfm/3240,February 21, 1999
[24] Gary North. Summary of Article Appearing on Australian Financial Review(January 13, 1999 issue), http://www.garynorth.com/Y2k/detail_.cfm/3522,February 21, 1999
[25] Michael Parfit. Coping With Blackout: What Happens When the Lights Go Out? Smithsonian, vol.17(11):38-49, February 1987
[26] William Phillips. Power to the People. Popular Science, 252: 62-65, April 1998.
[27] Michael Prescott and Andrew Grice. Ministers in Crisis Talks on 2000 Timebomb. London Sunday Times, http://www.sunday-times.co.uk/news/pages/sti/98/02/15/stinwenws03020.html?1733620,February 15, 1998
[28] Reuters. Y2K to Derail Russian Transportation. http://www.msnbc.com/235895.asp, January 27, 1999.
[29] Reuters. Report: U.K. Utilities are Set to Fail. http://www.msnbc.com/241870.asp, February 17, 1999.
[30] Reuters. Australian Utilities Coy on Y2Kl. http://www.msnbc.com/239819.asp, February 9, 1999.
[31] Reuters. Official: Ukrainian Nuclear Plants are So Obsolete they're Safe from the Bug. http://www.msnbc.com/news/245953.asp, March 2, 1999.
[32] William Sweet. The Auckland Outage. IEEE Spectrum, 35(4):72, April, 1998.
[33] TrueTime. Year 2000/GPS week Rollover Problem. Available at http://www.truetime.com/DOCS/TthomeFRM.html.
[34] U.S. Nuclear Regulatory Commision. Contingency Plan for the Year 2000 Issue in the Nuclear Industry. http://www.nrc.gov/NRC/COMMISSION/COMS/com1998-036/Y2kcplan.html, February 20, 1999.
[35] U.S. Nuclear Regulatory Commission. Nuclear Plant Information Books Database. http://www.nrc.gov/AEOD/pib/disclaimer.html, February 20, 1999.
[36] Matthew L. Wald. System Blackout Disrupts Flights Around the Country. New York Times, A1+, December 19, 1997.
[37] Robert Windrem. CIA Assesses Russia Y2K Risks. http://www.msnbc.com/news/243895.asp, February 24, 1999.
[38] Dr. Edward Yardeni. Hearing on Mandating Year-2000 Disclosures for Publicly-Traded Companies. http://www.senate.gov/~banking/97_11hrg/110497/witness/yardeni.htm#chapter2, February 20, 1999.
[39] Monteal Ice Storm '98 Reporting Site. Frequently Asked Questions. http://info-4-you.com/faq.html,February 20, 1999.
[I added all this blank space so that browsers following links to the references will display the reference at the top of the window.]
Last modified April 4, 1999.