CYBER SECURITY CONSEQUENCE PRIORITIZED DESIGN VIA SIMULATION
Explore the source record for details and available documents.
Hahn, Andrew Stuart↗
SEARCH · Engineering Papers
Results for “consequences”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
BayoTech Risk and Modeling Support of NM Gas Site
The BayoTech hydrogen generation system has been evaluated in terms of safety considerations at the NM Gas site. The consequence of a leak in different components in the system was evaluated in terms of plume dispersion and overpressure. Additionally, the likelihood of a leak scenario for different hydrogen components was identified. The worst-case plume dispersion cases, full-bore leaks, resulted in relatively large plumes. However, these cases were noted to be far less likely than the partial break cases that were evaluated. The partial break cases resulted in nearly negligible plume lengths. Similarly, the overpressure analysis of the full-bore break scenarios resulted in much larger overpressures than the partial break cases (which resulted in negligible overpressure at the lot line). There were several cases evaluated in the analysis that represented leak scenarios from both hydrogen and natural gas sources. Generally, the natural gas leak scenarios resulted in a smaller horizontal impact than that of hydrogen leaks. The worst-case consequence from a hydrogen leak resulted from the compressors, storage pods, or dispensing system. To consider the safety features that may isolate the leak, the consequence was evaluated at different times after the leak event to show the reduction of pressure. After 2 seconds, the plume dispersion from this event is contained within the perimeter of the site. The worst-case consequences show that the plume may disperse to adjacent facilities and to the street. When considering both likelihood and consequence, the risk may be considered low because the maximum frequency of a full-bore leak from any component within the hydrogen compound is 8.2 E-5/yr. This means that a full-bore leak is expected to occur less than once every 10,000 years. The risk can be further reduced by implementing mitigative countermeasures, such as CMU walls along the sides of the equipment compound. This would reduce the overall consequence of the worst-case dispersion scenarios (horizontal impact of plume). In terms of siting and safety analysis, the NFPA 2 code was used to provide a high-level evaluation of the current site plan. The most limiting equipment in terms of set-back distance are the compressors/storage units because of the high-pressure hydrogen. The site layout was evaluated for an acceptable location for the compression/storage unit based on NFPA 2 set-back distances. It is important to note that the NFPA 2 set-back distances consider both likelihood and consequence. This is important because the worst-case results evaluated herein also represent the least likely leak scenario. Other site-specific considerations were evaluated, including the parking shade structure with photovoltaic cells and refueling vehicles. These issues were dispositioned and determined to not present a safety risk.
08 HYDROGEN↗
Modeling and Evaluation of Cyber-Attacks on Grid-Interactive Efficient Buildings
Grid-interactive efficient buildings (GEBs) are not only exposed to passive threats (e.g., physical faults) but also active threats such as cyber-attacks launched on the network-based control systems. The impact of cyber-attacks on GEB operation are not yet fully understood, especially as regards the performance of grid services. To quantify the consequences of cyber-attacks on GEBs, this paper proposes a modeling and simulation framework that includes different cyber-attack models and key performance indexes to quantify the performance of GEB operation under cyber-attacks. The framework is numerically demonstrated to model and evaluate cyber-attacks such as data intrusion attacks and Denial-of-Service attacks on a typical medium-sized office building that uses the BACnet/IP protocol for communication networks. Simulation results show that, while different types of attacks could compromise the building systems to different extents, attacks via the remote control of a chiller yield the most significant consequences on a building system’s operation, including both the building service and the grid service. It is also noted that a cyber-attack impacts the building systems during the attack period as well as the post-attack period, which suggests that both periods should be considered to fully evaluate the consequences of a cyber-attack.
Fu, Yanyang↗
Control of Risks Through the Use of Procedures: A Method for Evaluating the Change in Risk
This paper considers how procedures can be used to control risks faced by an organization and proposes a means of recognizing if a particular procedure reduces risk or contributes to the organization's exposure. The proposed method was developed out of the review of work documents and the governing procedures performed in the wake of the Columbia accident by NASA and the Space Shuttle prime contractor, United Space Alliance, LLC. A technique was needed to understand the rules, or procedural controls, in place at the time in the context of how important the role of each rule was. The proposed method assesses procedural risks, the residual risk associated with a hazard after a procedure's influence is accounted for, by considering each clause of a procedure as a unique procedural control that may be beneficial or harmful. For procedural risks with consequences severe enough to threaten the survival of the organization, the method measures the characteristics of each risk on a scale that is an alternative to the traditional consequence/likelihood couple. The dual benefits of the substitute scales are that they eliminate both the need to quantify a relationship between different consequence types and the need for the extensive history a probabilistic risk assessment would require. Control Value is used as an analog for the consequence, where the value of a rule is based on how well the control reduces the severity of the consequence when operating successfully. This value is composed of two parts: the inevitability of the consequence in the absence of the control, and the opportunity to intervene before the consequence is realized. High value controls will be ones where there is minimal need for intervention but maximum opportunity to actively prevent the outcome. Failure Likelihood is used as the substitute for the conventional likelihood of the outcome. For procedural controls, a failure is considered to be any non-malicious violation of the rule, whether intended or not. The model used for describing the Failure Likelihood considers how well a task was established by evaluating that task on five components. The components selected to define a well established task are: that it be defined, assigned to someone capable, that they be trained appropriately, that the actions be organized to enable proper completion and that some form of independent monitoring be performed. Validation of the method was based on the information provided by a group of experts in Space Shuttle ground processing when they were presented with 5 scenarios that identified a clause from a procedure. For each scenario, they recorded their perception of how important the associated rule was and how likely it was to fail. They then rated the components of Control Value and Failure Likelihood for all the scenarios. The order in which each reviewer ranked the scenarios Control Value and Failure Likelihood was compared to the order in which they ranked the scenarios for each of the associated components; inevitability and opportunity for Control Value and definition, assignment, training, organization and monitoring for Failure Likelihood. This order comparison showed how the components contributed to a relative relationship to the substitute risk element. With the relationship established for Space Shuttle ground processing, this method can be used to gauge if the introduction or removal of a particular rule will increase or decrease the .risk associated with the hazard it is intended to control.
Praino, Gregory T.↗
Engineering in Cyber Resilience with Cyber-Informed Engineering
Engineers have super powers to provide cybersecurity resilience with deterministic engineering solutions and to protect systems from the most catastrophic consequences that a cyber saboteur could cause. Come to this session to learn how to use engineering risk management skills to harden your engineered systems from cyberattacks. Objective 1 Identify what system functions could be digitally induced to cause undesired high-impact consequences. Objective 2 Analyze how loss or instability of digital controls in a subsystem could lead to high-impact consequences. Objective 3 Analyze how loss or instability in the digital connectivity between systems could lead to high-impact consequences. Objective 4 Identify engineering controls which could build resilience by eliminating digital loss or instability pathways or reduce the impact of digital loss or instability. This presentation will introduce Cyber-Informed Engineering, described below, and walk participants through specific engineering use cases to show how engineers can consider the potential for cyber sabotage in their existing system designs and enact deterministic engineering-based controls which eliminate pathways for attack or mitigate specific consequences. A wide variety of application use cases will be considered so that audience members can align the material with familiar engineering applications. CIE is an engineering approach that integrates cyber resilience into the conception, design, build, and operation of any physical system that has digital connectivity, sensors, monitoring, or control. CIE offers the opportunity to use engineering to eliminate or mitigate avenues for cyber attack—starting from the earliest stage of design and continuing throughout the system’s lifecycle. Today, engineers and industrial control system (ICS) technicians build engineered systems with specific goals for safety, reliability, and functionality. While systems engineering includes considerable safety and failure mode analysis, cybersecurity risks are often not specifically addressed—particularly the risks of intentional cyber compromise, exploitation, and misuse. Cyber-Informed Engineering pairs well with traditional cyber defenses and offers an extra designed-in protection to eliminate the most catastrophic consequences which can be realized by an adversary should traditional cyber defenses fail.
42 ENGINEERING↗
Performing a multi-unit level-3 PSA with MACCS
MACCS (MELCOR Accident Consequence Code System), WinMACCS, and MelMACCS now facilitate a multi-unit consequence analysis. MACCS evaluates the consequences of an atmospheric release of radioactive gases and aerosols into the atmosphere and is most commonly used to perform probabilistic safety assessments (PSAs) and related consequence analyses for nuclear power plants (NPPs). WinMACCS is a user-friendly preprocessor for MACCS. MelMACCS extracts source-term information from a MELCOR plot file. The current development can combine an arbitrary number of source terms, representing simultaneous releases from a multi-unit facility, into a single consequence analysis. The development supports different release signatures, fission product inventories, and accident initiation times for each unit. The treatment is completely general except that the model is currently limited to collocated units. A major practical consideration for performing a multi-unit PSA is that a comprehensive treatment for more than two units may involve an intractable number of combinations of source terms. This paper proposes and evaluates an approach for reducing the number of calculations to be tractable, even for sites with eight or ten units. The approximation error introduced by the approach is acceptable and is considerably less than other errors and uncertainties inherent in a Level 3 PSA.
42 ENGINEERING↗
Development of Integrated Safety and Security Models for Comprehensive Reliability and Resiliency Evaluation
The security of the electric grid and supporting energy systems is crucial to national security. One of the complexities in analyzing the security of energy systems is the safety consequences that may result from accidents. For energy systems, the goal is to ensure that they operate as intended and that any consequences are mitigated or prevented. The integration of safety and security is paramount to protecting these systems from attacks and ensuring that large consequences are prevented. This report describes an integrated safety and security methodology to evaluate cybersecurity events that can lead to large consequences. This novel approach first describes how Systems-Theoretic Process Analysis (STPA) provides a digital causal analysis for Bayesian Networks (BNs). The use of STPA causal analysis provides a systematic approach to constructing BNs that adequately model cyber scenarios that result in consequences. When combined with the technical principles described in Risk-Informed Management of Enterprise Systems (RIMES), a comprehensive risk-informed cybersecurity analysis results that allows decision-makers to prioritize systems that most impact risk.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Procedural error monitoring and smart checklists
Human beings make and usually detect errors routinely. The same mental processes that allow humans to cope with novel problems can also lead to error. Bill Rouse has argued that errors are not inherently bad but their consequences may be. He proposes the development of error-tolerant systems that detect errors and take steps to prevent the consequences of the error from occurring. Research should be done on self and automatic detection of random and unanticipated errors. For self detection, displays should be developed that make the consequences of errors immediately apparent. For example, electronic map displays graphically show the consequences of horizontal flight plan entry errors. Vertical profile displays should be developed to make apparent vertical flight planning errors. Other concepts such as energy circles could also help the crew detect gross flight planning errors. For automatic detection, systems should be developed that can track pilot activity, infer pilot intent and inform the crew of potential errors before their consequences are realized. Systems that perform a reasonableness check on flight plan modifications by checking route length and magnitude of course changes are simple examples. Another example would be a system that checked the aircraft's planned altitude against a data base of world terrain elevations. Information is given in viewgraph form.
Palmer, Everett↗
Threat Landscape for BESS and IBR
The cyber risk landscape for BESS and IBR can be broken up by threats, vulnerabilities, and consequences for these systems. This presentation walks through the cyber risk landscape for BESS through the lens of consequence-informed awareness and mitigation for each risk factor. Threats with varying capabilities have been demonstrated in real-world events. Though threat actors can rarely be directly influenced by organizations, exposure of systems to adversaries can be limited (a known issue with IBR systems) to reduce likelihood of adversaries accessing systems with disruptive consequences. Common trends in disclosed IBR vulnerabilities include weak password generation or managements for various devices or services and web portal vulnerabilities that provide unauthorized access to data or capabilities or elevated user privileges. Understanding these common vulnerabilities and considering the consequences if these types of vulnerabilities were to occur can help mitigate risk. Consequences range from loss-of-view events that have no reliability impact to asset damage or grid stability impacts. Five case studies are briefly shared to highlight trends in real-world events affecting IBR.
14 - SOLAR ENERGY↗
Risk-Oriented PMU Placement Approach in Electric Power Systems
The objective of traditional PMU placement approaches is to use the minimal number of PMUs to cover system complete observability. Very few consider the probability and the consequence severity of observability loss. For example, following line trip, grid topology changes, which may results in observability loss and overloaded lines. As long as the overloaded lines are still observable, then we can take action in time to correct the system; and the consequence of the observability loss is not severe, although some parts of the system is not observable. Otherwise, if the overloaded lines become unobservable, then we lose the situation awareness of the system and the consequence of the observability loss is severe. To address the above points in PMU placement, this paper proposes a risk-oriented PMU placement approach. The proposed approach uses two indices, namely the probability of observability loss and its corresponding consequence of severity to design the optimal PMU placement strategy. We show that our proposed approach is able to capture the critical events while the traditional approaches fail to do so. Extensive simulation results carried out on the IEEE 39-bus and 118-bus systems demonstrate its effectiveness.
observability, risk of observability loss, PMUs pl↗
Traces of nonequilibrium effects, initial condition, bulk dynamics, and elementary collisions in the charm observables
Heavy quarks produced in relativistic heavy-ion collisions are known to be sensitive probes of the hot and dense QCD matter they traverse. In this paper we study how their dynamics is affected by the nature of the bulk evolution of the QCD matter, the initial condition of the system, and the treatment of elementary interactions between heavy quarks and the surrounding medium. For the same initial condition and the same quark-gluon plasma (QGP) expansion scenario we discuss the consequences of the assumption of a local equilibrium by comparing the consequences for the nuclear modification factor $R_{AA}$ and the elliptic flows of charm quarks, scrutinizing the different components of the final distribution of charm quarks. For this purpose we employ the parton-hadron-string dynamics (PHSD) model, which is an off-shell microscopic transport approach, as well as the linearized-Boltzmann (LB) scheme obtained by coarse graining the PHSD bulk and assuming local equilibrium for the interactions of the charm quarks with the bulk. The $R_{AA}$ of charm quarks stemming from the later LB approach is also compared to a genuine fluid dynamics evolution initiated by the coarse grained PHSD, which allows us to further assess the consequences of reducing the full $\textit{n}$-body dynamics. We then proceed to a systematic comparison of PHSD (in its LB approximation) with MC@HQ, another transport model for heavy flavors which also relies on the LB approach. In particular, we investigate the consequences for the nuclear modification factor of charm quarks if we vary separately the initial heavy quark distribution function in matter, the expansion dynamics of the QGP, and the elementary interactions of heavy quarks of these models. We find that the results for both models vary significantly depending on the details of the calculation. However, both models achieve very similar predictions for key heavy quark observables for certain combinations of initial condition, bulk evolution, and interactions. In this work, we conclude that this ambiguity limits our ability to determine the different properties of the system based on the current set of observables.
73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
Constellation's best estimate alternate source term methodology overview
Safety analyses for a nuclear power plants need to consider postulated accidents that results in at risk of accidental release of radiation. The regulations require plant specific safety analysis reports to include an evaluation of the requirements of 10CFR50.67. Such a safety analysis report mandates limits such that calculated radiological consequences relative to certain dose locations do not exceed a total effective dose equivalent (TEDE) limits following a postulated release of radioactivity. Calculations are performed to estimate the radiological consequences, in terms of dose, to people and equipment to ensure the estimated doses are within the prescribed limits. Analysis should demonstrate, with reasonable assurance, that these prescribed limits are complied with. Conventional methodologies utilize conservative approaches to address lack of uncertainty quantification in the utilized approaches, methods, and/or inputs. These built-in excess conservatisms often result in compounding effects and hence overly conservative results in the estimated radiological consequences, which leads to inaccurate margin evaluation for operation and accident mitigation. Therefore, evaluating accurate dose consequences is needed for both operational and safety reasons. The research documented in this paper provides an overview of Constellation's Best Estimate Alternate Source Term (BEAST) Methodology. BEAST methodology relies upon the use of realistic yet bounding input distributions for key analysis parameters, which replaces use of conservative deterministic singular inputs that bound overall analysis domain. This approach enables evaluating a more accurate accident analysis response, while enabling a bounding licensing basis envelope via more accurate quantification of uncertainty in the application. Therefore, built-in margin for a given scenario is more accurately evaluated.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Development of Integrated Education, Training and Research Program with Interdisciplinary Applications
Plasma models have been formulated including realistic spatial profiles of both flow and radio frequency induced ponderomotive force. With these inclusions the picture of stability of various plasma and fluid instabilities, as expected, changed drastically with ground-breaking consequences. The inhomogeneous parallel flow and the radio frequency waves can actually shown to stabilize turbulence. This is different from the prevalent notion that both parallel flow shear and radio frequency waves are responsible for the excitation (destabilization) of plasma turbulence. This has several ground-breaking consequences:- (1) the stabilization by parallel flow clearly goes against the conventional notion of the origin of ionospheric oscillation which invokes parallel flow destabilization as the origin, (2) the stabilization by parallel flow opens us a new avenue for improved mode formation in fusion devices - which mostly rely on the perpendicular flow shear stabilization for improved mode formation but the perpendicular flow is damped in a tokamak - so the improved mode formed by the parallel flow can sustain longer and has more prospect for ignition, (3) the complete stabilization of the ITG mode (and consequent suppression of transport) not only explain many unknown phenomena in the space physics but it also raises a prospect for transport barrier formation by the RF waves but not by the RF induced flow (as most works suggest) which is never observed in a tokamak of that magnitude to create a barrier. These are indeed ground-breaking consequences.
70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
Development of Integrated Education, Training and Research Program with Interdisciplinary Applications II
Plasma models have been formulated including realistic spatial profiles of both flow and radio frequency induced ponderomotive force. With these inclusions the picture of stability of various plasma and fluid instabilities, as expected, changed drastically with ground-breaking consequences. The inhomogeneous parallel flow and the radio frequency waves can actually shown to stabilize turbulence. This is different from the prevalent notion that both parallel flow shear and radio frequency waves are responsible for the excitation (destabilization) of plasma turbulence. This has several ground-breaking consequences:- (1) the stabilization by parallel flow clearly goes against the conventional notion of the origin of ionospheric oscillation which invokes parallel flow destabilization as the origin, (2) the stabilization by parallel flow opens us a new avenue for improved mode formation in fusion devices - which mostly rely on the perpendicular flow shear stabilization for improved mode formation but the perpendicular flow is damped in a tokamak - so the improved mode formed by the parallel flow can sustain longer and has more prospect for ignition, (3) the complete stabilization of the ITG mode (and consequent suppression of transport) not only explain many unknown phenomena in the space physics but it also raises a prospect for transport barrier formation by the RF waves but not by the RF induced flow (as most works suggest) which is never observed in a tokamak of that magnitude to create a barrier. These are indeed ground-breaking consequences.
70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
Climate Interventions Risk Framework White Paper
This work describes a structured, risk-based approach for analyzing questions related to the potential deployment of a climate intervention in any user-established future scenario, and further provides a structured means for considering what the potential consequences of such interventions may be. Because the climatological, technological, and geopolitical conditions are currently not believed to be supportive of climate intervention use, the framework establishes a three-pronged approach to frame key analytical questions predicated on future scenarios of interest to the user. These three pieces are: (1) Building a scenario. (2) Assessing the likelihood of that scenario based on assumptions about an actor and their motivations for deploying a climate intervention. (3) Analyzing the potential consequences of that climate intervention. Finally, results from this consequence analysis are compared against projected consequences of unabated climate change as a complete risk analysis of deploying a climate intervention.
54 ENVIRONMENTAL SCIENCES↗
The Essence of Cryptol: A Denotational Cryptol Interpreter in Coq for Foundational Assurances for Quantum Resistant Cryptosystems
Systems of the utmost consequence need a means to establish authenticity of software and data. Cryptosystems implement authentication, but can be vulnerable to cryptographic and implementation attacks. With the threat of quantum cryptographic attacks, “post-quantum” cryptosystems (PQCs) must be henceforth used in these systems. However, the new cryptography needs new ways to, rigorously and machine-checkably, prove systems free of vulnerabilities. We propose a retargetable capability to rapidly instantiate proven correct postquantum cryptosystems through novel proof-carrying synthesis and proof-automation technique, extending those proven successful on existing systems. This capability is crucial to meeting the cryptographic requirements for future high-consequence systems. Since specifications for high consequence cryptography are presently captured in a domain specific language known as Cryptol. While this can enable convenient fully automated reasoning about Cryptol specificaitons and implementations via the Software Analysis Workbench (SAW), Cryptol has expressivity gaps, so that cryptosystems with probabilistic programming features like Falcon cannot be fully expressed in the language. Moreover, SAW’s automation fails for programs and specificaitons with inductive and recursive structure, as in the Sphincs+ PQC. Finally, Cryptol and SAW together represent some 200,000 lines of unverified Haskell, so that the any guarantees about high consequence cryptography are presently contingent on a large, unverified, yet trusted computing base. The first step of the larger project of agile, assured crpytography is therefore to provide a formal, mechanized semantics for Cryptol, so that the specifications expressed by cryptographers in Cryptol can be reasoned about and compiled into performant implementations with a foundational, machine checkable certificate of correctness. This report describes our work on this first step, culminating in the design of a certified denotational interpreter, in Coq, for core Cryptol.
97 MATHEMATICS AND COMPUTING↗
Quantitative Risk Assessment for Fuel Cell Electric Bus Hydrogen Storage and Refueling Facility
It is necessary to understand the safety implications and risk mitigation options for fuel cell electric bus fleet deployment, especially for related facilities responsible for operations such as production, storage, compression, and dispensing of hydrogen for use by the buses. In this report, we present a quantitative risk assessment for a potential fuel cell electric bus fleet that was motivated by efforts to improve resilience at the Portland International Airport but can be applicable to a range of hydrogen case studies and use cases. We estimated risk for a facility that produces, stores, compresses, and dispenses hydrogen for the fleet of buses, with a focus on individual risk to people in terms of annual frequency of fatality. We considered the frequency of hydrogen leaks that could result in harmful physical outcomes like jet fires or explosions, and the consequences of those outcomes for people. We created customized fault trees to calculate the frequencies of different sizes of leaks and event sequence diagrams to calculate ignition probabilities for the various leak sizes. We also leveraged the HyRAM+ toolkit to use these inputs to calculate overall risk for the facility, which we separated into one section responsible for producing, storing, and compressing hydrogen, and one section responsible for dispensing the hydrogen to the buses. We found that the dispensing area seemed to have a higher risk than the production/storage/compression area of the facility, largely because of the inclusion of a component with a high leak frequency (the heat exchanger used to cool the hydrogen before entering the vehicle, to prevent overheating and expansion of hydrogen in the onboard tank). For the example production and refueling facility we evaluated and the data we used for the analysis, the leak frequency had a larger impact on the risk differences between the two sections on the facility, compared to the physical outcome consequence, which was slightly different due to the varying fuel conditions, but not substantially different. Actions can be taken to prevent these hazards (e.g., lowering leak frequencies in system components) or to mitigate the consequences if they do occur (e.g., installing barriers to protect people if ignition events occur). The choice of which actions to take depends not only on safety considerations but also on space, time, staffing, feasibility, and financial constraints. Therefore, the quantitative risk assessment approach can help understand relative risk contributions from different components, leak sizes, consequences, and human actions, to prioritize risk reduction strategies and balance these parameters. The outcomes of this report may be useful for a variety of stakeholders working in the hydrogen, transportation, vehicle, and aviation sector, including those responsible for aspects like facility design, operations, and regulations. There is not a single value of risk that determines whether a hypothetical system is “safe” or not. The insights about risk mitigations may be leveraged, and the quantitative risk assessment approach can be applied to other case studies to understand risk priorities and contributions specific to different FCEB and hydrogen facility uses.
08 HYDROGEN↗
Planning for Seattle at the Convergence of Resilience and Energy
Grid reliability metrics obscure important temporal, spatial, and categorical considerations for increasing energy resilience. Systemwide or feeder-level outage metrics do not identify which kinds of services are affected by outages, where, and for how long. These outage metrics indicate the impacts of outages but cannot measure the consequences to customers that could result from those outages. The consequences of power outages for surrounding community members are caused by disruptions to electricity-dependent critical services, rather than to electricity itself. Power outages can decrease a community's access to healthcare, fuel, safe indoor temperatures, and provisions like food and water. This project developed critical service access, a new consequence-focused resilience metric that quantifies the relative access to critical services provided to households by distribution infrastructure during normal conditions and major disruptions. We use a spatially granular grid analysis that facilitates targeted resilience interventions; dividing feeders into isolatable sections and combining those sections with the critical service access metric allows us to identify where energy improvements like solar-plus-storage microgrids could create the most benefits for community members by protecting access to food, fuel, health, shelter, and public safety services. We identify locations in a South Seattle study area that could be high priorities for resilience investment and summarize their potential neighborhood-scale resilience benefits. This analysis was complemented by direct feedback from study area residents collect through a survey and focus groups. Results can help utilities understand how and where long power outages can create real consequences for customers, set strategic targets based on that understanding, and measure the potential benefits of energy resilience upgrades for more informed decisions.
14 SOLAR ENERGY↗