Solar Magnetic Storm Impact on Control Systems

Overview

The sun generates solar flare and coronal mass ejection (CME) events in an approximate 11-year cycle. The plasma clouds generated from these events have the potential to cause geomagnetic storms that can interfere with terrestrial communications and other electronic systems, posing a risk to critical infrastructure.

In a recent case, Earth-orbiting satellites detected the strongest magnetic storm in more than 4 years resulting from a solar flare and CME event.National Oceanic and Atmospheric Administration (NOAA), Space Weather Prediction Center, http://www.swpc.noaa.gov/sxi/index.html, last accessed March 1, 2011. Figure 1 illustrates the size of the CME shockwave edge in relation to the size of the sun at the point of the eruption.

     
Figure 1. X2-solar flare and coronal mass ejection at the time of the eruption. 

At 0156 UT on February 15, 2011, Active Region 11158 unleashed an X2-class eruption.James A. Marusek, “Solar Storm Threat Analysis,” http://www.breadandbutterscience.com/SSTA.pdf, last accessed February 16, 2011. X-flares are the largest type of X-ray flares, and this is the first such eruption of new Solar Cycle 24. The explosion that produced this flare also sent a solar tsunami rippling through the sun’s atmosphere and hurled a CME toward Earth. By the time the CME reached the Earth, the shockwave leading edge had expanded to approximately 40 million miles across. CME activity will continue to occur as this solar cycle progresses.

The purpose of this Advisory is to inform the industrial control systems (ICS) community of the possible impacts of solar magnetic storms on critical infrastructure control systems. This Advisory provides a high-level overview of the potential problems and offers some general mitigation strategies for consideration by the ICS community.

Forecasts

The National Oceanic and Atmospheric Administration (NOAA) provides daily weather forecasts regarding solar activity as well as space weather alerts and advisories for solar flare and CME events that could impact navigation, radio, electric power, and satellite operations.National Oceanic and Atmospheric Administration (NOAA), Space Weather Prediction Center, http://www.swpc.noaa.gov/SWN/index.html, last accessed March 1, 2011.

Solar Storm Background

Solar events associated with sunspot activity fall into three categories:

1. Solar flares involve a powerful burst of radiation (X-rays, extreme UV rays, gamma rays and radio frequency waves) that heats and increases the ionization of the upper atmosphere. Solar flares cause interference with satellite communications, radar, and shortwave radio. The radiation burst travels at the speed of light, reaching the Earth about 8 minutes after the eruption. Solar flares are categorized by relative size: B-class flares are roughly 10% the size of C-class flares; C-class flares are roughly 10% the size of X-class flares. Within the X-class, flares are categorized on a linear scale (e.g., X1, X2). The largest measured solar flare occurred on November 4, 2003, and was rated as X45.^[b],National Oceanic and Atmospheric Administration (NOAA), Space Weather Prediction Center, http://www.swpc.noaa.gov/SWN/index.html, last accessed March 1, 2011.
    
2. Solar proton events (SPE) follow the flares. They travel at sublight speeds, reaching the Earth about 1 hour after the eruption. A SPE involves high-energy cosmic rays (protons and ions) that can disorient satellites, damage spacecraft electronics, interfere with shortwave radio in the Earth’s polar regions, and deplete the atmosphere’s ozone layer.
    
3. CMEs involve large clouds of charged plasma with an embedded magnetic field whose leading edge can expand to nearly 40 million miles across by the time it reaches the Earth. CME shockwaves travel at various speeds, some at nearly 5 million miles per hour, reaching Earth in about 18 hours or more.

The ionosphere (the upper layer of the atmosphere, 85 to 600 kilometers above the Earth) is critical to radio signal propagation. Solar radiation creates the ionosphere by ionizing the upper layer of the atmosphere. Broadcast radio transmissions reflect off the ionosphere to reach the intended receiver.Carolyn Jo Shields, “The Effects of Radio Frequency (RF) Propagation within the Work Place,” Oakridge National Laboratory, August 2008.

When the magnetic field associated with a CME impacts the Earth’s magnetic field, the resulting geomagnetic storm can last several days, with storm effects continuing 1 to 2 days more. The CME’s electromagnetic energy disrupts the ionosphere’s reflectivity, adversely impacting broadcast radio signal transmissions. This can also affect global positioning system (GPS) satellite signals, interfering with the GPS timing reference used by navigation systems and many control systems.

As a geomagnetic storm impacts the Earth’s magnetic field, it generates potential differences across the surface because of variations in the Earth’s resistivity (see Appendix A).T. S. Molinski, W. E. Ferro, and B. L. Damsky, “Shielding grids from solar storms,” IEEE Spectrum, November 2000, pp. 5560. The electromagnetic field from a CME changes the potential difference in power distribution and transmission system ground-to-line voltages, producing geomagnetic-induced currents (GIC) that can damage the large wye-connected transformers used at power plants and substations. GICs of 1000 A are theoretically possible, though most large transformers are not tested for GICs in that range.A. Pulkkinen, R. Pirjola, and A. Viljanen, Statistics of extreme geomagnetically induced current events, Space Weather, 6, S07001, July 2008, pg. 9. Those transformers are typically critical power grid devices; they are expensive and have extended replacement lead times (often 1 to 2 years).

Effects on Critical Infrasctucture Control Systems

Radio Interference

Geomagnetic storms can interfere directly with GPS and radio communication because of the ionosphere disturbances. The interference can range from induced noise to complete signal loss. Geomagnetic storms can indirectly affect many other systems, including control systems that rely on GPS or radio technologies.Ron Behren, P. E., “Trouble in the Sky! Solar Activity May Cause Problems for Utilities,” The Hartford Steam Boiler Inspection and Insurance Company, http://www.hsb.com/thelocomotive/story/FullStory/ST-FS-SOLAR.html, last accessed February 16, 2011.

Control systems that employ the following technologies may experience partial or complete service outages of varying durations, depending on the intensity of the storm (and other factors).

Directly Affected Systems

• Distributed control systems relying on GPS Position Navigation and Timing (PNT) signals to sequence and control processes
  • Used in oil and gas, electrical, marine, aviation, water and wastewater, trains
• Shortwave frequency band wireless communications
• Emergency services hand-held wireless communications.

Indirectly Affected Systems

• Control systems components supporting wireless technologies (e.g., Wi-Fi, cellular) that rely on GPS timing signals
  • Remote terminal units (RTUs), programmable logic controllers (PLCs), intelligent electronic devices (IEDs), and other controllers
  • Portable instrumentation and test equipment.

Electrical Grid Interference

The continuing trend toward transmitting more electrical power over longer transmission lines, closer to maximum power limits, creates a directly proportional relationship between the intensity of a geomagnetic storm and electric grid impact. A geomagnetic storm can cause severe problems for electrical power systems during their peak hours of operation. This is especially true in certain regions of the northern United States and in coastal regions where igneous rock geology reduces the Earth’s conductivity in those areas (see Appendix B).P. R. Barnes, D. T. Rizy, B. W. McConnel, F. M. Tesche, E. R. Taylor, Jr., Electric Utility Industry Experience with Geomagnetic Disturbances, ORNL 6665, Oakridge National Laboratory, November 25,1991.

During a solar storm, the CME plasma cloud and its magnetic field collides with the Earth’s magnetic field, causing large transient magnetic disturbances. These disturbances, or geomagnetic storms, can affect the Earth’s magnetic field for as much as 2 days. The geomagnetic storms can induce voltage variations along the Earth’s surface, creating potential differences in voltage between grounding points that cause GICs to flow through transformers, power transmission lines, and grounding points. GICs can severely affect grounded wye-connected transformers and autotransformers because of cumulative overheating effects on winding insulation and induced harmonics (see Appendix C).

Regions of low conductivity, such as the regions of igneous rock geology that are common over large portions of North America, are more susceptible to geomagnetic storm affects. Power transmission systems built in those areas experience significantly larger GICs from geomagnetic disturbances. The Earth’s conductivity varies by as much as five orders of magnitude across North America (see Appendix A). The magnitude of GICs is also inversely proportional to the resistivity of the transmission system. The transmission lines become an effective short circuit between distribution system transformers for GICs flowing through the transformer ground connections.

A solar storm can affect the power grid simultaneously at many points, resulting in multi-point failures. Large transformers that support transmission lines are costly and can also have long lead times for delivery and commissioning, sometimes as long as 2 years (see Appendix B). The NOAA Space Weather Prediction Center provides several scales for geomagnetic and solar radiation storms, and radio blackouts. The following two links to the NOAA Space Weather Prediction Center should be a part of all electric utility weather situational awareness programs.

• Electric Power—Electrical Utilities Information Site (Alerts and Advisories):
  http://www.swpc.noaa.gov/ElecPower/
   
• NOAA Space Weather Scales (NOAA Space Weather for Geomagnetic Storms Table): http://www.swpc.noaa.gov/NOAAscales/index.html#RadioBlackouts.

While the NOAA scales reflect the 3-hour average for changes in the magnetic field, GICs are a result of the rate of change in the magnetic field. That is analogous to a storm that causes damage not from the low atmospheric pressure, but from the wind created by the changing pressure. Magnetic field rate of change information is not currently readily available, though NASA is working on a new index that will include the rate of change.

Oil, Gas, and Other Pipeline Interference

Solar storms can affect pipe-to-soil voltages, leading to currents that disturb flow meter signals, which can result in false pipeline flow rate data. The induced currents can also increase pipeline corrosion rates. Insulating flanges meant to interrupt current flow create an additional point where electric potential can result in current flow to ground, increasing the risk for corrosion.^[b]

Mitigation

Electrical Grid

For electrical power systems, mitigations should start long before an actual solar storm occurs. Mitigation involves significant engineering and simulations regarding the fault protection design employed for protection of the step-up feeder transformers supplying transmission lines. Without a proper engineering review, making changes to the distribution system to potentially protect against the effects of solar storms can defeat or reduce the effectiveness of the original power system protection design. Adequate protection against these risks requires a holistic approach to the system design to avoid such undesired interactions. Reverse current and voltage effects must be analyzed and understood to ensure optimal overall fault protection in system design. In addition, asset owners and control system vendors must also consider methods for shielding the fault protection instrumentation and its communication media.

If an asset owner determines, based on engineering fault calculations, that the expected induced energy from a CME event may exceed system protection capabilities, the best mitigation option may be a controlled outage for the duration of the storm.

Other proposed mitigation methods (some patents exist) involve switching either a capacitor or resistor bank (or combination) into the ground leg of distribution transformers to reduce the maximum GIC. Such a system would also require a GIC sensor to trigger the switching and reset the ground leg circuit after the storm passes. The expense to develop and deploy such systems makes their actual deployment unlikely in the near term. In addition, the switching circuit impedes the intended ground leg safety function while it is active. NERC currently has a geomagnetic disturbance task force that is expected to recommend more active research in this area.

Other Control Systems

During solar storm events, operations personnel should monitor control system communications data to detect off-normal ranges or outages, because data communication may be affected.

Communication systems may experience temporary or extended outages. Communications using shielded physical layer media may not experience outages. The owner should continue to monitor surge protection and uninterruptible power supply (UPS) systems during this period. PLC, RTU, IED, and other controllers, if installed with effective voltage and current protection, will not be affected by cellular or wireless service interruptions.

Electronics installed in metal building facilities are likely to be adequately shielded from direct electromagnetic interaction. However, utilities should still audit line power protection devices to confirm proper operation. Owners can consider adding protection to electronic devices not shielded by metal packaging. If not essential to operation, owners can consider powering off equipment and disconnecting from the power sources during a storm-warning period.Government of Canada, “Geomagnetic Storms⎯Reducing the Threat to Critical Infrastructure in Canada,” http://www.solarstorms.org/CanadaPipelines.html, last accessed March 17, 2011.

Control system communication systems are not directly affected by GICs, but they rely on the electric grid for power. Many also rely on GPS timing signals. For those control systems, the engineering staff should use engineering judgment regarding the system’s resilience in the event of electric grid or GPS outages.

Based on engineering fault calculations, if the engineering staff determines that the potential-induced energy may exceed system design protection capabilities, a possible mitigation is a controlled outage.

Solar storm interference may impact rail supervisory control and data acquisition (SCADA) system dispatch operations and communication networks that employ wireless technologies, especially those dependent on GPS timing signals. Engineers and field maintenance personnel will need to coordinate efforts during the CME event, especially if the decision is made to run systems in manual mode.

As a long-term approach, owners and operators of industrial control systems that are reliant on GPS timing signals (i.e., cellular RTUs, IEDs) should consider including integrated backup timing systems to accommodate the temporary loss of GPS because of interference or actual failure.

Interference with GPS navigation and position information may also impact critical infrastructure in the oil and gas industries’ marine fleets, where exploration activities often require precise station keeping operations. Vessels may be equipped with bottom fix capability as a redundant functionality. However, when the ship control system does not include bottom fix capability, mitigation may require suspending operations until the solar storm subsides.

APPENDIX A:  Earth Ground Resistivity

Figure 2. Earth ground resistivity based on underlying rock strata. Conductivity measurements from the Geomagnetic Laboratory of the Geological Survey of Canada in Ottawa with Extension to the United States Completed by Electric Power Research Institute-Sunburst Project. Units:  siemens per meter (regions in red are essentially nonconductive).^[f]

APPENDIX B:  Historical Impacts of Solar Storm Activity

August 2, 1972—GICs resulting from a solar storm caused a 230 kV transformer explosion at a hydro and power plant.S. Odenwald, “The 23rd Cycle: Learning to live with a stormy star,” Columbia University Press, New York, 2000.

December 19, 1980—A 735 kV transformer failed 8 days after the Great Red Aurora. A replacement 735 kV transformer also failed the next year after another geomagnetic storm.^[b]

March 13, 1989—GICs resulting from a solar storm overloaded transformers on a North American power system, causing the deactivation of reactive power compensators at various substations. Within 1½ minutes, the power system was in complete blackout due to the linked malfunction of more than 15 discrete protective system operations.^[b],J.G. Kappenman, L.J. Zanetti, and W.A. Radasky (1997) Geomagnetic storms can threaten electric power grid, American Geophysical Union: Earth in Space, Vol. 9, No. 7, March 1997, pp. 9−11.

In addition, GICs resulting from the solar storm destroyed a $12 million generator step-up transformer in another power system. The transformer was a critical component for electrical power distribution from the generating plant in that system. The 288.8/24 kV single-phase shell-form transformers were connected in a grounded-wye configuration. The damage to the transformers included damage to the low‑voltage windings, thermal degradation of the insulation of all three phases, and conductor melting.^[i] When the utility ordered a replacement, the supplier indicated the order would receive top priority but would still require nearly 2 years to fill.^[f] The utility obtained an interim spare unit that still required 6 weeks for installation before going online.

October 30, 2003—A power grid in Sweden experienced a 20 to 50-minute blackout due to a strong solar storm. The same storm damaged 15 transformers in South Africa, some beyond repair.^[b]

APPENDIX C:  Technical Analysis of Solar Storm Effects on Transformers

US Navy physicist, James A. Marusek, in his paper titled, “Solar Storm Threat Analysis,” reported the following analysis:

“Geomagnetic Induced Currents (GIC) can cause transformers to be driven into half-cycle saturation where the core of the transformer is magnetically saturated on alternate half cycles. A few amperes are needed to disrupt transformer operation. A GIC level-induced voltage of 1 to 2 volts per kilometer and 5 amperes in neutral of the high-voltage windings is sufficient to drive grounded wye-connected distribution transformers into saturation in a second or less.^[i] During geomagnetic storms, GIC currents as high as 184 amperes have been measured in the United States in the neutral leg of transformers.^[f] The largest GIC measured thus far was 270 amperes during a geomagnetic storm in Southern Sweden on April 6, 2000.

“If transformer half-cycle saturation is allowed to continue, stray flux can enter the transformer structural tank member and current windings. Localized hot spots can develop quickly inside the transformer’s tank as temperatures rise hundreds of degrees within a few minutes.^[k] Temperature spikes as high as 750°F have been measured. As transformers switch 60 times per second between saturated and unsaturated, the normal hum of a transformer becomes a raucous, cracking whine. Regions of opposed magnetism as big as a fist in the core steel plates crash about and vibrate 100-ton transformers, which are nearly the size of a small house. This punishment can go on for hours for the duration of the geomagnetic storm. GIC‑induced saturation can also cause excessive gas evolution within transformers. Besides outright failure, the evidence of distress is increased gas content in transformer oil, especially those gases generated by decomposition of cellulose, vibration of the transformer tank and core, and increased noise levels of the transformers (noise level increases of 80 dB have been observed).ⁱ GIC transformer damage is progressive in nature. Accumulated overheating damage results in shortening transformer winding insulation lifespan eventually leading to premature failure.

“In addition to problems in the transformer, half-cycle saturation causes the transformer to draw a large exciting current which has a fundamental frequency component that lags the supply voltage by 90 degrees and leads to the transformer becoming an unexpected inductive load on the system. This results in harmonic distortions and added loads due to reactive power or Volt-Ampere Reactive (VAR) demands. This results in both a reduction in the electrical system voltage and the overloading of long transmission tie-lines. In addition, harmonics can cause protective relays to operate improperly and shunt capacitor banks to overload. The conditions can lead to major power failures.”^[b]

• Other