Management of extreme weather impacts on electricity grids: an international review

Extreme weather events, such as high winds, storms, flooding and temperature extremes, are a major cause of disruption to the supply of electricity to consumers. System operators (SOs) are responsible for ensuring stable real-time operation of large-scale power networks and will act to prevent adverse impacts of such events on consumer supply, contain the extent of supply interruptions that do occur, and restore supply to affected consumers in an efficient and timely manner. SOs will also generally be involved in some way in the long-term planning of the transmission network and generation capacity required to ensure future resilience. In this paper we review some of the strategies adopted by SOs across the globe in ensuring high levels of reliability and resilience to extreme weather, with reference to learning generated from specific recent events. In the face of the potential for both the frequency of such events and for their consequent impacts to increase in the future, we recommend that regulatory control of investment in networks is informed by quantified understanding of the climate-energy interface, including assessment of the potential frequency and impacts of future weather events and shared learning from events experienced by different operators. The statutory role of utilities should include robust assessment of future weather-related risks and appropriate investment in their asset resilience, as well as assisting in the preparedness of supporting agencies to mitigate the impacts of weather-related disturbances on energy consumers.


Background
System operators (SOs) are responsible for ensuring stable real-time operation of their power system, coordinating the supply of electricity with demand across a network, and keeping interruptions to supply to a minimum.The SO may be a function of a Transmission System Owner (TSO) undertaken in parallel with their maintenance of, and investment in, the transmission network of the relevant area, or-as in many modern deregulated markets-may be licensed separately from ownership of network assets.
Dependent on the exact regulation and incentives in place for their particular market, an SO's responsibility will include the need to protect the real-time supply of electricity against extreme weather events.This will include prediction of and preparation against oncoming events, real-time management of reserve generation and network flows to minimise impacts, and coordination of the restoration of supply following any experienced outages.
Extreme weather events, such as high winds, storms, flooding and temperature extremes, are a major cause of disruption to the supply of electricity to consumers (see section 2.3).The impacts of extreme weather events have the potential to become more significant in the future, due both to the potential for the frequency of such events to increase from climate change, and to the increasing reliance of end-use energy services on uninterrupted flow of electricity-in other words, similar levels of interruption have the potential to cause greater societal disruption in the future, such as due to the electrification of transport and heating or greater dependency on electricity for cooling.Power systems comprise generation, transmission and distribution networks and electrical loads used by consumers.The transmission networks carry high amounts of power over long distances and are therefore operated at high voltage in order to minimise losses due to heating.Distribution networks operate at lower voltages that require less electrical insulation, and typically carry power from the transmission network into consumers' premises.Outside of urban areas, the networks make use of overhead lines and outdoor substations.These are particularly vulnerable to weather-related outages.
The smaller size of distribution network assets, their radial configuration with, in general, single connections from substations through to each consumer, and the very high cumulative distances that they cover mean that faults on distribution networks are the predominant cause of interruptions to consumers' supply.However, they have quite localised impacts.
Transmission systems' design has a certain level of redundancy built in meaning that interruptions to consumers' supply tend to occur only if there are multiple faults.Transmission-originated interruptions, when they happen, have the potential to have a much bigger impact than those on the distribution network.One common cause of multiple equipment outages affecting both transmission and distribution is extreme weather.
The weather-related power outages experienced in Texas in February 2021 (and to a lesser extent in winter 2022 and summer 2023) have generated significant current interest in the subject of electricity system resilience to extreme weather (Busby et al 2021); in this paper we look to the international context to learn from a broader range of SO strategies against weather-related impacts.
In this paper, we examine in detail the specific question of how SOs around the world manage this risk, learning from the range of strategies used in different markets.As electrification of energy services increases, with ever-greater expectations from consumers around reliability of supply, SOs must in turn work to increase the resiliency of their networks against the impacts of weather events.With the impacts of climate change potentially increasing both the severity and frequency of extreme events, it is key for different operators to learn from each other's experiences, and here we evaluate both the theoretical nature of system resilience as well as deriving practical recommendations around preparedness for future extreme weather events.

Structure of paper
Through a selection of historical case studies, we first examine the range of impacts that extreme weather events can have on electricity systems (section 2), followed by an examination of the different timescales across which an SO can take mitigating actions to minimise the impact of those potential disruptions (section 3).We then look at the potential future issues likely to be faced by SOs (section 4) and conclude with regulatory and policy recommendations for future electricity system resilience (section 5).
The International Council on Large Electric Systems, CIGRE, founded in Paris in 1921, is repeatedly referred to throughout the paper.CIGRE is the primary global organisation for the exchange of technical knowledge and the state of the art between those involved in the production, transmission and distribution of energy, through a combination of publications, symposia and seminars.CIGRE also establishes working groups containing representatives of multiple national power systems to address current and future challenges, and many references are made here to publications released by those working groups as a source of practical, experience-led information on electricity system management (CIGRE 2021).

Overview of extreme weather events and impacts on electricity systems
While definitions vary, 'extreme' weather events are generally considered those that are both low-probability-i.e. that are expected to occur relatively infrequently in the relevant area-and high-impact.
What is considered a low-probability event will differ between climatic zones; for example, the wind conditions associated with a 1 in 50 year storm at a high latitude might be similar in nature to a seasonal typhoon seen at low latitudes, and a power system in the latter might-if not necessarily specifically engineered to tolerate higher windspeeds-have a more active and prepared response to such conditions under the expectation that it would be utilized relatively frequently.Similarly, what might be considered an extreme winter in some locations might be entirely normal operation in higher latitudes-a Canadian or Scandinavian SO will be prepared for typical annual conditions that would be viewed as an exceptional contingency elsewhere.

Natural phenomena and power system impacts
Extreme weather events include the following phenomena and impacts: Winter conditions including extremely low temperatures, snowfall and icing.This may affect overhead power lines through ice accretion, as well as preventing response and remedial works.For example, in January and February 2008, a series of winter storms caused icing of transmission lines in southern China (an area unused to significant seasonal snowfall).The weight of the ice caused mechanical failures of lines and led to outages affecting 100 million people (Chen et al 2009).
Highs of temperature, which may reduce the ability of transformers to shed heat, and also leads to sagging in overhead lines from thermal expansion, increasing the potential for short circuits.Secondarily, high temperatures may also induce wildfires, which can cause tripping of transmission circuits and damage to network equipment.High-voltage lines may themselves be the triggers for wildfires.For example, in the 'Black Saturday' fires of February 2009 in Victoria, Australia, wildfires started by power lines are said to have caused 159 of the 173 recorded deaths (Fairley 2019).Similar cases of wildfires instigated by power lines have been seen in California, such as the Camp Fire in Butte Country in 2018 (US Dept of Commerce 2018), and network flows are actively managed to prevent further events causing significant disruption to consumers in the summer.
Flooding, where critical network infrastructure may be flooded or may have to be isolated in order to prevent damage to equipment.Flooding in the Highveld region of South Africa in December 2019 shut down multiple coal power stations (in part due to unusable wet coal supplies), resulting in significant load shedding over a period of months, exacerbating existing generating capacity issues (Fin24 2019).
High winds, causing damage to overhead cables and towers, and potentially to ground-based equipment due to airborne debris.For example, Cyclone Klaus affected large areas of France and Spain in 2009, with winds of up to 200 km h −1 (Liberato et al 2011), causing 233 separate power system disturbances in 2 days (30% of 2008's entire total), with the collapse of 25 high voltage towers.
Secondary, connected phenomena are dust/sandstorms, where high winds in areas abundant in fine-grained sediments (alluvial or desert regions) can be exacerbated by a high volume of airborne material causing additional damage and burying critical infrastructure.This is particularly an issue in the Arabian Peninsula and Central Asia; a prolonged dust storm in May 1993 in Northwest China affected power supply to 83 million people over 31 h (Pahlavanravi et al 2012).
Drought.Water shortages will affect the availability of hydroelectric generation, with systems highly reliant on hydroelectricity facing power rationing during extensive drought periods, such as seen in Brazil through 2021 (Reuters 2021).In addition, many forms of thermal power generation are dependent on water supplies for cooling, and may undergo forced outages during extensive droughts, such as experienced by nuclear generators in France during the 2003 heat waves (United Nations Environment Programme 2004).
Lightning.While lightning is generally a component of broader extreme weather events, it is worth noting separately as a common cause of electricity network faults.Electricity networks are designed to quickly identify fault currents associated with lightning strikes, safely isolate the affected equipment and put the equipment back into service when the lightning strike has ended.However, while the higher voltage networks that carry the most power are generally designed with a level of redundancy such that the outage of a single asset will not cause an interruption to consumers' supply (see section 3.1), these may still act as root causes of outages where other system components have been weakened.For example, the UK outages of August 9th 2019, while subject to complex causative factors, were initially triggered by a lightning strike on an overhead transmission line (MacIver et al 2021).
While outside the scope of this paper, so-called 'space weather'-in the form of geomagnetic disturbances due to solar activity-is a tangible and recurring threat in long-distance high-voltage grids which can lead to damaged or destroyed equipment and potential grid collapse.Notably, the geomagnetic storms of March 1989 led to disturbances across North America and Europe, with a blackout in the Hydro-Quebec power grid, and has since led to utilities implementing programs to reduce the risks associated with geomagnetically-induced currents (European Commission 2013).
Table 1 gives an overview of the different categories of weather-related event, with the corresponding potential impacts on an affected power system, alongside some other examples of outages caused by each.

Co-dependencies with other aspects of resilience
The coincidence of independent multiple low-probability low-impact events may combine to produce a high-impact event.If a power system is already in a less-resilient state due to non-weather-related circumstances-such as the presence of maintenance outages or unplanned unavailability of large thermal plant or interconnection-then what might normally be considered a low-impact weather event may be amplified in effect.Where the gas and electricity systems are coupled (such as through gas-fired generators or, in future, from bulk hydrogen production from electricity) the security of the electricity system may be impacted by, and affect, the security of the gas networks (O'Malley et al 2018).Almost all major electricity system disturbances that result in interruptions of supply to a large region or whole country, or the triggering of geographically dispersed automatic 'load shedding' to prevent a complete collapse, involve a rapid cascade of outages (Bell et al 2010, Noebels et al 2021).Extreme weather events may also have their impacts amplified by triggering a cascade of further adverse events.For example, in the Brazil and Paraguay blackout of November 2009, an initial short circuit fault on the transmission network (caused by high winds) triggered the disconnection of 14 GW of power output from the Itaipu Dam.This in turn caused further losses that left an equivalent of 24 GW of total Brazilian demand-around 40 million residents-without power, pending an average restoration time of around 4 h (Martins et al 2012).
A key additional consideration is the inter-relation between such events and the demand for electricity.In particular, high and low-temperature weather events will also significantly increase the demand for electricity due to increased load from heating/cooling systems.This in turn will mean that the networks may be operating close to their margins without considering additional direct impacts of weather conditions.Similarly, this will increase the potential impacts on end consumers of disruption to supply.

Review of large-scale weather-related disturbances
To assess the role of extreme weather in terms of impact on the power system a review of large-scale power system blackouts and disturbances has been conducted.CIGRE has a strong track record of cataloguing and learning from extreme power system disturbances.There is a dedicated session at each CIGRE Paris Session, held every two years-the Large Disturbance Workshop-to review and analyse a number of large or interesting power system disturbances from recent history.In addition, a number of CIGRE working groups have sought to learn from catalogues of major events in published technical brochures (Bell et al 2010, Jacobs et al 2021).Combining data from an archive of presentations from large disturbance workshops since 2010 and the two technical brochures, we have developed a catalogue of 66 major system disturbances from across the globe spanning 1965-2021.These were then categorised based on the reported root cause of the events.In total 27 events (41%) had a clear link to weather or natural phenomena.This proportion increased when looking only at events documented since 2010 with 17 of the 30 events (57%) showing a clear link to weather or natural phenomena.These findings are in broad agreement with other studies, such as (Haes Alhelou et al 2019), which assessed 22 large power system disturbances between 2011 and 2018 and found that 7 of those (32%) could be attributed to weather or natural phenomena as an underlying cause.
Table 2 provides a breakdown of the 27 weather related disturbances in the catalogue of large power system disturbances derived from CIGRE sources, based on both geography and weather type.The majority of incidents (52%) are linked to extremely high wind weather events such as cyclones, hurricanes, tornadoes or storms.This is perhaps unsurprising given the widespread physical system damage that might be associated with such incidents.Relatedly, and in common with events linked to other extreme natural phenomena like earthquakes, these events were typically associated with long recovery times often taking days or weeks for all consumers to be reconnected.Earthquakes and lightning strikes were each found to be a primary cause of three of the catalogued events, extreme low temperatures were found to cause two while flooding was the cause of one event.High temperatures were also linked to four of the system disturbances, albeit only one of these events, leading to wildfires in Australia, could they be thought of as the primary cause.In the other three cases, high temperatures could be considered a secondary contribution, leading to high loading or conditions which increased the vulnerability of the system with other factors then causing the failure.
Focusing on the geographic extent of the events, we can see some patterns begin to emerge.Although events linked to extreme wind were present across the globe, certain regions are seen to be particularly vulnerable with three events linked to hurricanes affecting the USA and six events linked to cyclones affecting India in recent years.A majority of events catalogued in Australia (80%), Asia (59%) and North America (54%) had a clear link to extreme weather or natural phenomena.This contrasted with the events catalogued in South America and Europe in which weather was linked to around only 1 in 5 of the listed events.This could be a function of less exposure to extreme weather conditions or a higher propensity for power system failures not induced by extreme weather.This finding is again broadly aligned with other studies such as (Złotecka and Sroka 2019) which amassed a catalogue of 138 power system failures across the globe and reported similar findings with natural phenomena linked to between 24% and 74% of events registered in each continent.The reporting of disturbances is likely to be biased by the relative normality of such events and the extent to which different territories are represented within CIGRE; it is noted, for example, that the dataset lacks reporting on major disturbance events for African countries-but this should not be taken to mean that weather related power system issues are not an issue in the region.While the authors restricted analysis in this study to CIGRE reported events, other international reviews of event frequencies, including (Veloza andSantamaria 2016, Yuan et al 2019), give a different international coverage.

Responsibilities of the SO
The exact regulated responsibilities of an SO will vary between jurisdictions, but broadly an SO is required to ensure stable operation of the system and maintain a specified level of system security.A system can be said to be stable if a new, steady operating condition can be reached after a disturbance.Security of a power system involves ensuring stable operation, and respect of defined limits for voltages and system frequency, were certain, defined 'secured events' or contingencies to occur (Bell et al 2010, Jeffrey et al 2018).For example, National Grid ESO-the SO for Great Britain-is required to plan and operate the national electricity transmission system (NETS) in accordance with the system security and quality of supply standard (SQSS) (National Grid ESO 2021a), which defines the criteria for the operation of a secure and reliable network.As the operation of any power system must strike an economic balance between the value of a reliable supply of power and the cost of providing redundancy of network assets and reserves of generation, such regulation will normally serve to define how that economic optimum should be assessed and realised.In the case of the SQSS, the contingencies to be protected against are explicitly defined along with operating limits for voltage and frequency, whereas in other jurisdictions this may be represented more simply as a target level of reliability for end consumers-such as Hong Kong, where the vertically-integrated utilities are incentivised to exceed an average service availability index of 99.995% (Government of Hong Kong 2017).
While the target levels for reliability and security will vary by jurisdiction, no system is intended to be 100% reliable against all possible contingencies.While having a highly dependable system is the norm, occasional localised loss of supply is expected to occur, and part of the SO's role is to contain such events to minimise the extent of loss of supply and prevent further disruption to the wider power system.
As mentioned in section 1.1, an SO will normally only have direct visibility and control over the transmission network, with local distribution network operators (DNOs) responsible for planning, maintenance and operation of the lower voltage local area networks.Distribution-level outages will, by their position in the power system, affect a relatively small geographical area, whereas any transmission-level outage that results in customer disconnections potentially impacts a substantial area.In the former case, consumers undergoing adverse impacts may simply be able to temporarily relocate to unaffected areas, whereas this may not be an option for transmission-scale events.This also has impacts on the duration of mitigating supplies (such as food, water and healthcare materials) that are available to support affected populations (Cox 2021), as well as having knock-on impacts on telecommunications systems being used to coordinate a response.For this reason, transmission-level disruptions have the potential to have a disproportionately greater total impact than might be expected purely on the basis of the number of consumers affected (Bukhsh et al 2016).
Figure 1 illustrates the two key characteristics an SO will be attempting to promote.First, the overall reliability of the system, which can be summarised as the probability that demand for electricity is met (Billinton and Allan 1996).Second, the resilience of the system, which can be defined as 'the ability of assets, networks and systems to anticipate, absorb, adapt to and/or rapidly recover from a disruptive event' (House of Lords 2015) or to 'be capable of preventing, containing and recovering from the adverse impact of disturbances' (Cox et al 2021).Resilience can be seen to encompass reliability but extends evaluation of a system's ability to meet demand for energy by also considering the restoration of any supplies that have been interrupted.In reducing the potential impact of extreme weather events, we can evaluate the actions of an SO in three key stages: the prevention of adverse outcomes from occurring in the first place; the containment of adverse outcomes that do occur to minimise their impact; and the recovery from adverse impacts following an extreme event.Each of these categories are treated in turn below.

Prevention and planning
Prevention of adverse outcomes to extreme weather events is conducted both through long-term planning of the system, and operational management of the system.
In the case of planning the transmission system, the role of the SO in some jurisdictions may be undertaken by TSOs; that is, they also have the responsibility for the design and investment in network equipment across their licence area.In other places an SO is established as a separate entity from the party owning the transmission network assets, i.e. the transmission owner (TO).
SOs who do not themselves own network assets will often have a role to play in the regulation of TOs' investment.For example, in the Great Britain system, National Grid ESO publishes a number of guiding analyses which inform the TOs' own investment plans as submitted to the regulator (Ofgem), helping to steer regulatory approval for TO spending within a price control period and ensuring that the individual TOs' plans are consistent with each other and the forecast plans of wider system stakeholders.These analyses include establishing future energy scenarios (FES) as a joint analytical background for the evolution of future generation and demand, and conducting a network options assessment (NOA) to recommend particular combinations of network investment (National Grid ESO 2021b).
In the context of extreme weather, such assessments may also include recommendations for strengthening and protecting particular transmission assets.For example, a review of flood defences undertaken following severe floods in the UK in summer 2007 recommended a £117m program of investment undertaken over the following 15 years to ensure resilience of transmission network infrastructure to a 1 in 200 year level (National Grid Electricity Transmission 2019).The specification of overhead lines, in particular, will include resilience against extremes of wind speed.Understanding the future probability of adverse events is key-the Dutch electricity transmission infrastructure, for example, is particularly prone through its situation in a low-lying delta, and is vulnerable to floods and heat waves, both likely to increase with climate change.However, as these events are well-known to have the potential to strongly impact the Netherlands in multiple ways, their electricity system is well-prepared and is one of the most reliable in Europe (Bollinger and Dijkema 2016).
Planning of assets may be considered as part of wider national infrastructure planning against contingencies.In the UK, for example, the National Risk Register (UK Government 2023) includes scenarios for storms, floods/droughts and high/low temperatures affecting power infrastructure.This can enable specific targeted funding programmes to be enacted against future events, including weaknesses that are identified through 'wargaming' such scenarios and identifying cross-sector issues (e.g. the interdependency between power and communications networks).This may further bolster spending and investment in resilience that is not clearly justified within the statutory remit of the SO alone.However, as such registers and plans are normally conducted at a governmental level, care must be taken to ensure that this respects the regulatory environment for the SO and is not used as a means to enact political interventions-for example, in determining the regional/spatial priority for system resilience.
In liberalised electricity markets, there are many actors with assets connected to the transmission and distribution networks-generators, end consumers and owners of storage facilities such as grid-connected batteries-as well as the different parties responsible for different sections of network and the system's operation.Any existing or new network asset (or generation/demand connecting to that network) will also be subject to standards and codes to ensure the combined power system performs to an expected level.Such codes, in particular 'grid codes' , will stipulate, for example, that generators should be capable of 'riding-through' certain network faults, i.e. to continue operating, to ensure that a fault on the system in one location does not itself trigger further faults, potentially leading to a cascade of fault conditions across the network.The SO will generally be responsible for ensuring other parties' compliance with these codes.
In some jurisdictions, a high likelihood of there being enough generation available to meet demand, i.e. of 'generation adequacy' , is ensured through the institution of a capacity market (Hawker et al 2017) whereas, in others, there is a reliance on scarcity pricing to incentivise the construction and availability of generation.Where a capacity market is used, it is important that the probabilistic assessment of an index such as 'loss of load expectation' takes appropriate account of weather-related impacts on both demand and generation.The experience of the Texas SO, ERCOT, following the supply shocks of 2021, illustrate that scarcity pricing alone may be insufficient, and a programme of resilience investment and capacity incentives is currently being deliberated by lawmakers (Texas Senate 2023).
Adequacy can also be achieved via the use of demand-side management (DSM)-that is, the ability of SOs to actively reduce the demand for energy during periods where generation adequacy may not be assured, or to improve security during periods of low adequacy.As adequacy normally relates to the extent to which total generation capacity within a system exceeds the maximum expected demand over a defined period (e.g. for a northern European country, the expected winter peak determined by peak electrical heating load), any measure which can time-shift demand away from the peak can contribute towards a reduction in the required level of generation capacity needed to achieve a given level of adequacy.However, consideration needs to be given to the composition of demand during peak periods (for example, peak heating demand may be difficult to time-shift if buildings are poorly insulated and have low thermal buffering) as well as the implications for total energy demand (i.e.where time-shifting of peak demand leads to increased total energy usage due to e.g.storage losses)-potentially aggravating events that cover an extended period.A further novel dimension, where DSM relies on shifting of demand via price signals to energy consumers, is the reliance on predictable human behaviour.For example, during an extreme weather event, it may not be reasonable to expect economically rational behaviour from consumers whose decisions may be dominated by the perceived risk of loss of supply rather than short-term energy prices.As DSM is a relatively novel feature of power system management, there is little evidence available to suggest the extent to which SOs may rely on disaggregated consumer response during extreme weather events, and assumptions around the implications for system adequacy should be appropriately conservative.
In operational timescales, the SO will be responsible for the procurement of reserve and response-that is, ensuring that at any given point in time there is sufficient 'back-up' generation capacity available to cover for unplanned losses of generator or interconnector capacity or changes in demand.This procurement may include 'spinning reserve' , i.e. 'headroom' on generation that is already operating and can quickly increase its output, 'standing reserve' that can be started quickly, and flexible demand that can be changed at short notice e.g. through delaying the end use of the energy for some period.Normally, contracts will have been struck in advance giving access to demand side flexibility.
Given a forecast of extreme weather, the system might be operated in a defensive manner.Reserve margins might be increased, or more expensive generation might be used than in the normal optimal economic condition in order that power flows on vulnerable lines can be reduced.If there is enough spare capacity elsewhere on the system, vulnerable assets might be switched out in order to reduce the probability and impact of a short-circuit fault, and key protection or control equipment might be temporarily removed in order to prevent damage.Temporary flood defences may also be utilised where permanent flood defences are not seen as cost-effective: in this case there is both the planning/investment decision on defences to invest in, combined with an operational decision on the prioritisation and utilisation of defences.Where icing of network assets might be a problem, power flows on key lines might be deliberately increased in order that the increased heating might melt the ice.
Requests for outages of network assets for maintenance or construction work to be done need to be approved by an SO that needs to be confident that the system, deprived of these assets, can still be operated in a secure manner.The management of the condition of assets, workforce planning and the planning of which outages can be taken simultaneously are activities undertaken well in advance through interaction between the network owner and the SO.Moreover, an outage will also have a defined 'emergency return to service' time defined for it, i.e. how long it would take to make the asset operable again.The recalling of a planned network outage is a step sometimes taken by an SO.However, in liberalised industries, an SO's influence over planned generation outages can only be exercised through market transactions to buy availability.Where an SO can see reserve margins, i.e. the excess of available sources of power over demand, being eroded below acceptable levels, in liberalised markets the SO can make an emergency appeal to the market for more generation.
In a worst case, the SO will need to disconnect demand to ensure that there can always be a balance between generation and demand.If a low margin condition is expected to persist for many hours or even days, the SO will implement rolling disconnections so that no one consumer is disconnected for more than a few hours.

Containment
One the main effects of operating a system in a secure manner is that a fault on any single element of the system should not-if all equipment, in particular protection and control devices, behaves as intended-cause an outage of any other item.The impact of a single, 'secured' event is therefore contained.SOs carry out a continuous process of monitoring of the system and 'security assessment' using computer models to ensure that this is so.However, there have been times, e.g. in the August 2003 North-Eastern US event, when the SO's 'energy management system' was out of service and the SO was unaware of the system's state and the potential for breaches of limits.Moreover, multiple outages can occur before the SO has had a chance to re-secure the system.This can be because of equipment error or during a storm when weather-related outages can occur with a frequency 3 orders of magnitude higher than during normal conditions (Morris et al 2016).
Following a loss of infeed event in which a source of power-a generator or an importing interconnector-suddenly becomes unavailable, the electrical load on the system might change but only by very little.There is therefore an imbalance between generation and demand.The impact of this imbalance is contained by energy being drawn automatically by the laws of physics from the spinning mass of the type of generation found at conventional power stations.This 'inertial response' is observed as the electrical frequency of the system falling and is complemented by controls at power sources at which 'frequency containment reserve' has been scheduled responding to automatically increase output to arrest the fall in frequency.This is important as conventional generating plant is typically designed only to be capable of operating within a certain frequency range.
Most large power systems are operated with automatic defence measures, predominant among which is 'under-frequency load shedding' (UFLS).This automatically disconnects portions of demand if and when successive thresholds of low system frequency are reached.(In the event in the UK in August 2019, the system's frequency fell low enough to trigger operation of the first stage of automatic load disconnection).Other defence measures are also in place in some countries, e.g. to deliberately trip generation in exporting areas in response to certain network faults, or to help with management of system voltages (Bell et al 2010).

Recovery
Once some load has been disconnected, the SO's priority is to reconnect it as quickly and safely as possible.If extreme weather has been a cause, this can be extremely challenging as physical damage to network assets may have been caused that can take considerable time to repair.This depends on having appropriate spares-for example, many TOs have temporary towers for overhead lines and stores of conductors-and on being able to get parts and repair teams to the appropriate location, something that may not be possible if unsafe conditions are persisting or access is blocked.Reconnection can then take many days-in the case of Storm Arwen in North England and North-East Scotland in 2021, up to 10 d without service (BBC News 2021).
A worst-case situation for an SO is the blackout of an entire system.'Black start'-the recovery from a total shutdown of the transmission network-is a challenging process as power is required for the generation of power.This is because power stations depend on electrical systems for control of plant and, in thermal power stations, operation of systems associated with the generation of heat and management of safety.Certain stations in a system will have black start facilities such as sufficient on-site diesel or open-cycle gas turbine generation to re-start on-site systems and then start up the main units, operating at low output just to supply 'house load' .These stations and other flexible sources of power such as hydro stations can be used to re-energise sections of network.Modest amounts of load can be connected to these electrical islands, more generation connected to it and then further load, taking each step one at a time and being careful that the electrical island is stable.Different neighbouring islands can then be re-connected to each other to enable pooling of generation resources and the re-establishment of secure operation (Bell et al 2010).Restoration of all demand in Italy following the collapse in 2003 took around 24 h.However, in the North-Eastern US event just a month before, the last demand customers were not reconnected until some days after the initial disturbance.
A key part of societal preparedness, given that it is impossible to guarantee that there will not be a regional or whole system blackout, is that essential services such as hospitals, water treatment works and transport and communications hubs can continue to function without supplies of power from the grid.This typically involves the installation of standby diesel generators and sufficient stocks of fuel or, for mobile phone masts, a sufficiently sized, fully charged battery, although quite what constitutes sufficient is subject to judgement.An especially significant load that requires its own supplies of power for critical safety systems is a nuclear power station.The Fukushima disaster was exacerbated, for example, by the unavailability of emergency cooling systems due to the flooding of backup diesel generators and batteries (Funabashi and Kitazawa 2012).
In the case of higher magnitude events, such as category 4 or 5 hurricanes, the failure of the power system may be due to almost total destruction of overhead lines across a broad area, in tandem with wider massive disruption of infrastructure.In the case of Puerto Rico (and other countries in the Greater and Lesser Antilles), hit by the category 5 Hurricane Maria in September 2017, the restoration of the power system was one component of a broader humanitarian crisis response.In such events, prioritisation of e.g.medical care and immediate disaster assistance may outweigh immediate attempts to restore power, and the use of limited local resources must be carefully dispatched towards management of complex and ongoing crises.However, some local recovery of power is necessary to enable e.g.communications systems and healthcare facilities to resume operation.It took around 6 months to achieve restoration of power to 95% of customers in Puerto Rico (Kwasinski et al 2019).In cases where local resources and finances may make timely restoration of services unachievable following significant weather events, resilience may be achieved through increased use of microgrids and localised storage, that may permit ad hoc restoration of services ahead of recovery of the wider power system.

Future issues
SOs must not only evaluate known risks that have occurred in the past, but also prepare for novel events that have not yet been experienced, as well as the potential for known events to increase in frequency or severity.In this section, we provide a brief overview of the key areas for future risk evolution that require assessment by SOs.

Adaptation to climate change
One likely impact of climate change is the potential for certain extreme weather events-dependent on location-to increase in frequency and extent.A statistical assessment of electrical network equipment failures across South Korea indicates a strong sensitivity to climate conditions (air temperature, humidity, rainfall and typhoon conditions) with the potential for ongoing climate change to increase the probability of these adverse impacts in a particularly climate-sensitive country (Jeong and Kim 2019).High temperature extremes are also likely to significantly increase as averages rise globally, with a particular impact on urban areas where heat islands exacerbate the effect (Wang et al 2021).
Climate change also means that past experience of power system management may be a poor guide to the future, both in terms of assessing the frequency and magnitude of events, and in adequately capturing the range of conditions against which the system must be resilient.Formal probabilistic assessments may not be adequately supported by statistical assessment of existing system performance.
In the case of UK flooding defence planning mentioned in section 3.2, the increase in flood risk projected out to 2050 under a high-emissions scenario was incorporated into the assessment, with the initial 1:200 year criterion extended to 1:1000 year to represent this potential increase in flood risk.This highlights the need for rigorous climate modelling to underpin any quantitative assessment of infrastructure investment, which is subject to a high degree of uncertainty.This also informs proactive measures taken to mitigate impending risk, such as shutting down vulnerable assets/circuits and warning potentially affected customers.Following the Queensland floods of 2010/11, for example, the transmission SO revised their defined flood risk levels and acknowledged that large customers have a part to play in business continuity planning and provision of backup supplies (Powerlink 2011).
An increase in global temperatures also increases the frequency and impact of wildfire events.The Australian bushfires of 2019/20 destroyed more than 5000 power distribution poles and cut-off entire power transmission corridors (Ratnam et al 2020).System planners in wildfire-prone areas must look to a future where seasonal disturbances are increasingly normal.Additionally, network faults can be the cause of wildfires, and mitigation of electricity network faults is a key element of wildfire prevention (Miller et al 2017).Other strategies involve replanting of fire-resistant species in proximity to transmission corridors (Chen et al 2019).
The Australian energy market operator (AEMO) is an example of a specific jurisdiction which has sought to project the impacts of climate on energy systems, identify and categorise specific climate-related vulnerabilities, and to plan for a climate-resilient network (AEMO 2020).This has highlighted the need to improve risk analysis, planning standards and operator flexibility in the face of climate risks, as well as to ensure that the current understanding of those risks is kept as up-to-date with international climate modelling as possible.This means that multiple agencies should be involved-in Italy, the SO (Terna) has instituted a new methodology for resilience planning of the grid in combination with RSE (an external research organization) and ARERA (the regulatory authority (Terna 2021).Most of the issues raised by climate change are consistent across different SOs-if regionally variant in their impacts-and so international collaboration is also key to improving resilience.

Increasing dependency on electricity
In the case of extremes of temperature, heating and cooling systems will place further electrical demand on a power system.Any inability of the system to meet these demands may exacerbate the public health impacts of such events.The European heat waves of 2003 led to excess mortality of around 70 000 people.Demand for energy from cooling surged at the same time as nuclear reactors in, for example, France had reduced access to cooling water due to higher river water temperatures and reduced water levels.An operational response at the time was for the French nuclear regulator to Grant temporary exemption from environmental safety limits for returned cooling water (United Nations Environment Programme 2004).
Similarly, as many energy services move from direct fossil fuel use (such as heating and transport) to electrification as a consequence of climate change mitigation, there is an implicit reduction in resilience that was previously provided by diversity of energy sources.A given loss of supply in a Net-Zero country in 2050 might be expected to have far greater societal impact than today.If such low-carbon futures are also dependent on demand-side flexibility for power system operation, it is valid to consider how dependable such sources of flexibility might be under circumstances of system stress-for example, if a SO is making substantial use of Vehicle-to-Grid (V2G) services to balance the system during the loss of generation or network assets, they may incorrectly assume that end consumers will be acting to alleviate grid constraints by allowing their vehicle batteries to discharge, as opposed to pre-empting further disturbances and seeking to charge their vehicle batteries to full.

Decentralization and complexity
In recent years, driven in part by the uptake of small-scale renewable sources of power, generation capacity, storage and other sources of flexibility are increasingly decentralised and located within distribution networks below the normal level of visibility of an SO.The increase in distributed energy resources (DER), much of which may be dependent on weather conditions, creates an inherently more complex power system both in terms of monitoring and control.The transition of DNOs to distribution SOs (DSOs), providing more active control of their local networks and incorporating potential flexibility services back to the SO, may provide an additional source of resilience to the broader energy system, but the overall increase in complexity makes the system state harder to predict, and choosing control actions in an adverse event becomes significantly more challenging (Bell and Gill 2018).
Greater integration of national systems and higher transfers of power between them also raise issues of coordination and the potential impact of disturbances.For example, the splitting of the synchronous European power system in 2006 occurred against a background of high and variable wind speeds, with significant power transfers between zones, but was triggered by independent and unrelated switching actions taken by the German SO, stimulating a cascade of outages due to excessive loads being applied to already congested transmission lines.The continent-wide system (which had initially been in balance overall) was split into 3 separate zones, with one zone suffering over-frequency and two under-frequency, affecting supply to 15 million households across Europe (van der Vleuten and Lagendijk 2010).
A significant proportion of overhead line assets around the world were designed and constructed between 35 and 55 years ago to design standards considered appropriate at the time (Hawes et al 2014).Historically, design standards were based on deterministic principles such as allowable stress and safety factors, with modern standards making some use of reliability principles.More recent design standards have moved towards weather-related (extreme wind and icing) loadings based on a probability of exceedance.However, this means that not only is there a large volume of ageing critical infrastructure, but that these older assets were never designed with extreme events in mind.

Recommendations
The authors in (Panteli and Mancarella 2015) identify a 'resilience trilemma' where solutions must make the system: • Stronger: more able to withstand more extreme events; • Bigger: having a greater range of options to reroute supply during asset outages; • Smarter: using advanced sensing, computing and control to improve containment and accelerate restoration.
The general improvement of resilience may be achieved without a clear view over the kinds of conditions that may adversely affect a power system; if any of the above is increased, then the resilience of the system to any event-foreseen or unforeseen-is improved.An event-agnostic view of system management can hence be taken in the knowledge that critical events are unpredictable and often unique in character.Phenomena which affect system stability may occur consecutively or simultaneously, and are often blurred, interactive and not clearly delimited.This can make it difficult to decide on appropriate preventive or corrective action (Bell et al 2010).In the case of extreme weather events, there is a greater surety in the nature of the causative phenomena; the failure modes are well-understood and have been experienced by SOs across the globe.For SOs to appropriately prepare for future contingencies there needs to be a framework which establishes the economic value of investment in resilience, based on an understanding of the likely frequency of future extreme weather events, including those which a particular SO may not have experienced themselves to date.Commonly used approaches to modelling of uncertainties by SOs include probability models, multiple-scenario evaluation, and robust optimisation.However, applying uncertainty methodologies to transmission system planning is commonly restricted by issues around data collection, model tractability and institutional/social issues (Kang et al 2020).

Regulatory control of investment
Fundamentally, a regulator must be persuaded that any network investment that increases resilience is a good use of consumer money and represents overall value.Many regulators want this to include an economic assessment of both the probability and impact of extreme events (Bell et al 2010).Design standards for transmission assets should be adapted to allow for changes in these probabilities and impacts, such as by increasing the resilience of transmission towers to extreme winds (Hawes et al 2012).
It remains difficult to assess the probabilities of rare events.Doing so may depend on complex climate/weather models.While general weather trends driven by climate change are now well-established (Masson-Delmotte et al 2021) the precise patterns of extreme weather that lead to major power system disturbances are, as yet, less clearly understood.A dialogue between climate scientists and SOs is key.Climate-energy modeling is a relatively nascent area of research, but should be extended to understanding the implications of climate uncertainty on planning for future extreme events.In particular, if significant investment in infrastructure or generation assets is to be justified then a deep analytical understanding of the meteorological impacts on the energy sector is required.However, the current understanding of climate impacts on energy systems remains limited (Brayshaw 2021).

Learning from events
While individual SOs may not have experienced all the forms of extreme weather event that they may have to accommodate in the future, all extreme weather phenomena have been experienced by an SO in some part of the world.This means that shared learning has a strong role to play in informing preparedness, particularly for events that may become more frequent due to climate change.For example, an SO planning in the face of expected higher seasonal temperatures and heat-related effects might look to the experience of an SO in a climate region already subject to those extremes.
CIGRE has an objective to 'facilitate technical exchanges among those involved in the production, transmission, and distribution of electrical energy' , and organises conferences, seminars and working groups which allow representatives of SOs to share experiences in the management of their power systems.As mentioned in section 1, the 'Large-Scale Disturbance Workshop' held at the biennial CIGRE session gives SOs an opportunity to discuss the learning from significant outages that have occurred across the globe in preceding years.
While not weather-instigated, the Fukushima Disaster of 2011 led to many power system institutions, including multiple nuclear operators and SOs, reviewing their own flood risks and conducting horizon scanning for potential operational threats, including issues raised where extreme events prevent access for staff to their place of work.EDF, the French national nuclear operator and energy utility, instituted a nuclear quick action force (FARN) with the ability to intervene anywhere in France within 24 h of a major accident, with supplementary water and power supplies even in the event of disruption to transport infrastructure.In the UK, local and regional resilience partnerships (RRPs/LLPs) have existed since 2004 to provide multi-agency coordination in preparation for, and response to national emergencies.These were most recently utilized in order to provide services to remote communities cut off from power during Storm Arwen (Scottish Government 2021).Such organisational responses to known threats generate increased technical and societal resilience to power system interruptions that occur, which may of course be contemporaneous with wider disruptions caused by the same weather events.
There may, however, be an unwillingness among utilities and regulators to openly discuss events or near misses.This may expose utilities to legal risk.Dissemination of information on near misses-potentially disruptive events which did not result in an impact on consumers-exposes the whole sector and public authorities to reputational risk.The response to this should be two-fold: firstly, there should be an environment created where system actors are able to report on historical events without fear of repercussions, and secondly, the formal reporting of near misses should be mandated even where they did not result in an interruption to supply.

Statutory role of utilities
Resilience to extreme weather events must, in some manner, be delegated to network asset owners and operators.This can be achieved in several ways: by mandating specific requirements (such as protecting against specified contingencies), setting best practice guidelines, or by using market incentives.In the case of mandated requirements, then appropriate penalties for non-conformance need to be established that perhaps go beyond being purely financial (as the relative cost of fines compared to investment requirements may be seen as acceptable risk to the company involved) and could lead to revocation of licensed activities.However, it was noted in (Bell et al 2010) that risks of fines can lead industry actors to fail to report non-compliances with standards.An alternative approach would be to reward parties for demonstration of compliance.
If the regulatory framework requires that the SO and/or utilities protect against specified contingencies, then these must be identified through a process which both understands historical failures and is able to scan the horizon for future operational issues.In Great Britain, for example, following deregulation there was an extensive review of system security criteria in the early 1990s with open workshops and consultations, leading to a final decision by the regulator setting out mandatory requirements.This is similar to the adoption of security criteria as rules (as opposed to guidelines) by FERC following the 2003 outages in North America.
Electricity system resilience against extreme weather can be improved through a combination of measures addressing the specification of individual assets and the design and operation of the system comprising those assets in order to prevent interruptions to electricity supply or limit their extent, and preparation of suitable logistics to aid recovery from disturbances.Uncertainty in the nature of future events and recognition of the broad value of resilient systems to society suggest that it is better to over-engineer a system and make preparations that are not needed, than for the system to be under-specified and be left wanting.The challenge lies in establishing clear requirements for SOs and asset owners and conducting a robust cost-benefit analysis for investment in resilience within the context of high uncertainty in the frequency and severity of weather-related events.

Figure 1 .
Figure 1.Distinguishing between resilience and reliability, and the tasks undertaken by system actors in relation to each.

Table 1 .
Summary of extreme weather events.