Factors underlying organizational resilience: The case of electric power restoration in New York City after 11 September 2001

Author's Accepted Manuscript

Factors Underlying Organizational Resilience: The Case of Electric Power Restoration in New York City after 11 September 2001 David Mendonça, William A. Wallace

www.elsevier.com/locate/ress

PII: DOI: Reference:

S0951-8320(15)00083-6 http://dx.doi.org/10.1016/j.ress.2015.03.017 RESS5265

To appear in:

Reliability Engineering and System Safety

Cite this article as: David Mendonça, William A. Wallace, Factors Underlying Organizational Resilience: The Case of Electric Power Restoration in New York City after 11 September 2001, Reliability Engineering and System Safety, http://dx. doi.org/10.1016/j.ress.2015.03.017 This is a PDF file of an unedited manuscript that has been accepted for publication. As a service to our customers we are providing this early version of the manuscript. The manuscript will undergo copyediting, typesetting, and review of the resulting galley proof before it is published in its final citable form. Please note that during the production process errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain.

Factors Underlying Organizational Resilience: The Case of Electric Power Restoration in New York City after 11 September 2001 David Mendonça*, William A. Wallace, Rensselaer Polytechnic Institute, 110 8th Street, Troy, NY 12180 [email protected], [email protected]

Abstract. The 2001 World Trade Center attack resulted in widespread and highly nonroutine failures to critical infrastructure systems. An immediate priority following the attack was the restoration of electric power in lower Manhattan. A study of the organization responsible for conducting this restoration is here presented in order to provide a productive critique of factors theorized by Woods (2006) to affect organizational resilience. Data sources include logs of the behavior of the electric power infrastructure and extensive interviews with personnel at various levels of the organization. The conclusions of the analysis are used to frame a refined set of factors that shape organizational resilience, and to provide observations on the processes that underlie how organizations achieve—or fail to achieve—the potential for resilience. Highlights: •

Provide a case-based critique of factors theorized to underlie organizational resilience.

•

Present an clarified and expanded set of factors.

•

Develop and discuss approaches to measuring these factors.

Keywords. resilience engineering; disaster response; organizational resilience

*

Corresponding author. Telephone: (518) 276-4222, Fax: (518) 276-8227, E-mail: [email protected]

1

1

Introduction

Considerable attention has been devoted to identifying opportunities for engineering organizational resilience both to minimize the impact of disruptions on normal operations, and perhaps to capitalize on the opportunities for learning lessons from organizational response to challenging, unforeseen circumstances. This work has included new technologies and new work practices, as well as new categories of workers (e.g., resilience engineers), particularly within organizations that operate in safety-critical environments. Yet large-scale studies of organizational resilience are relatively rare, perhaps owing partly to the unpredictable timing of events that test resilience, as well as to difficulties in gaining access to data from organizations as they respond to these events. The overarching objective of this study is to provide an empirically grounded critique and extension of the factors (articulated by Woods (2006)) which have been theorized to contribute to organizational resilience. Study data are associated with the restoration of electric power in the borough of Manhattan in New York City following the 11 September 2001 attacks. The approach is case study-based, driven by analysis of both subjective data (collected from individuals occupying operational to strategic roles) and objective data (collected from technological elements of the system, using both established and ad hoc instrumentation). The factors are critiqued by exploring alternative approaches for their measurement using these data, while also identifying opportunities for refining or otherwise emending them. A secondary objective of this work is to describe decision making processes in the cases in order to contribute to process-level theories of organizational resilience. The paper concludes with a refined set of resilience factors, observations on processes underlying resilient performance, and implications for Woods’ (2006) original framework. 2

The paper proceeds as follows. In Section 2, theoretical background on factors underlying resilience is presented within a more general framework of vulnerability to hazard. An overview of the effects of the 11 September attacks, along with a description of the research methodology, is given in Section 3, followed by a presentation and discussion of the results of three related case studies (Section 4). The paper concludes with an overall discussion and suggestions for future work (Section 5). 2

Vulnerability and Resilience

As framed by Smit et al. (2006), a system’s vulnerability to hazard may be understood as a function of two factors: exposure to hazard and an ability to cope with, adapt to, or otherwise withstand hazard. New technologies, ranging from sensor-based systems (Committee on Developing Mesoscale Meteorological Observational Capabilities to Meet Multiple Needs 2009, Schroeder & Weiss 2008) to predictive models (Lombardo 2012), seek to reduce uncertainty concerning risks associated with the first factor (Smith 2009). The second factor relates directly to the concepts of adaptive capacity and resilience (see (Lorenz 2010) for a discussion). Adaptive capacity (Hinkel 2011) may be described as “the ability or capacity of a system to modify or change its characteristics or behavior so as to cope better with existing or anticipated external stresses” (Adger et al 2004). Adaptive capacity “is difficult to gauge because of its latent nature, meaning that researchers often struggle to measure it until after its realization or mobilization within a system” (Engle 2011): that is, until it has been manifested as adaptive behavior (Buchanan & Bryman 2007, Engle 2011), whether manifested before event onset (anticipatory) or after it (reactive) (Smit et al 2000). Resilience may be viewed more broadly, as expressing not only the capacity to adapt, but also the morphology of adaptive behavior (see (Pendall et al 2010) for a recent review). As expressed 3

by Woods (2006), “resilience is concerned with monitoring the boundary conditions of the current model for competence (how strategies are matches to demands) and adjusting or expanding that model to better accommodate changing demands.” Among the aspects of resilience are an ability to resist disorder (Fiksel 2003), as well as an ability to retain control, to continue and to rebuild (Hollnagel & Woods 2006). Yet, as with adaptive capacity, resilience may be difficult to measure or otherwise assess before a system has been exposed to a hazard (i.e., before it has been manifested resilient performance) (Woods 2006). Central to both adaptive capacity and resilience perspectives is the notion of emergent behavior either in anticipation of hazard or in reaction to it (Erol et al 2010, Madni & Jackson 2009). As documented below, the emergent nature of resilient performance creates a number of challenges related to measurement and, to some extent, in the development of frameworks in which to situate explanations of why this emergent behavior succeeds or fails (Madni & Jackson 2009). Within a framework that is implicitly systems-oriented, Woods (Woods 2006) postulates a number of factors thought to affect organizational resilience: •

buffering capacity: the size or kinds of disruption that can be absorbed/adapted to by the system without a fundamental breakdown in its performance/structure;

•

flexibility/stiffness: the system’s ability to restructure itself in response to external changes/pressure;

•

margin: “how closely or how precariously” the system is operating relative to some performance boundary;

4

•

tolerance: how the system behaves in proximity to some boundary (i.e., whether the system “gracefully degrades” or “collapses” as stresses/pressures increase); and

•

cross-scale interactions: downward, how context leads to (local) problem solving; upward, how local adaptations can influence strategic goals/interactions.

These factors are adapted and condensed in slightly modified form by Jackson and Ferris (2013) into capacity, flexibility, tolerance and cohesion (i.e., “the ability of a system to act as a unified whole in the face of a threat”), each of which is then further expressed in terms of principles for achieving resilience (one of which corresponds to Woods’ (2006) “margin” factor). Related factors are proposed elsewhere: for example, those presented in (Dinh et al 2012) include controllability, limitation of effect and minimization of failure, all of which relate closely to buffering capacity; flexibility; and the distinct factor of early detection. Woods’ (2006) factors have been explored through a qualitative study of teamwork in emergency response (Lundberg et al 2012). (It should be noted that factors shaping organizational resilience have also been viewed from other perspectives, such as those emphasizing safety culture (e.g., Lee et al 2013).) Related research emphasizes the importance of capturing system dynamics in order to understand and properly frame resilient performance (Pendall et al 2010). For example, in a discussion of “enterprise” (e.g., business) resilience by Erol et al., (2010), recovery time refers “the time taken for an enterprise to overcome disruption and return to its normal state,” while level of recovery refers to the extent to which the enterprise can provide an appropriate level of service or functionality. A number of theoretical and empirical issues have arisen in attempts to capture and analyze data for evaluating factors thought to underlie organizational resilience. First, exposure to profound stresses in organizations is, by definition, rare, thereby challenging efforts to establish 5

performance boundaries before exposure has occurred. The issue is further accentuated by the possibility that, post-event, the design of the affected system will evolve in unexpected ways. Put simply, the operating envelope of the organization may be in constant flux and, perhaps more importantly, its ultimate form may be impossible to determine until the performance has concluded. Second, despite ongoing advances in sensor and other technologies (Brooks 2003, Hohenemser et al 1985, Palm 1990, Renn 1992), data collected from contemporary systems continue to be difficult to situate within established or new theoretical frameworks (Fekete et al 2010, Turner 2010). For example, research on adaptive capacity in human ecology (Adger et al 2004) provides indices that tend to be aggregated, static, and derived from socioeconomic measures such as census data (e.g., Cutter et al 2008). A recent parallel line of theoretical research, however, strongly suggests that “adaptive capacity is context-specific and likely shaped by dynamic variables that are not easily generalizable and do not carry equal weight between contexts” (Engle 2011). A similar case may be made for organizational resilience. To help address these issues, the factors proposed by Woods (2006) regarding organizational resilience may be viewed as bridging a conceptual gap between larger frameworks of resilience (e.g., those at the community level) (e.g., Manyena 2014) and studies seeking to develop empirical indicants of resilience, particularly for organizations (e.g., Lee et al 2013). As has been echoed elsewhere, the availability of a theoretically salient conceptual layer facilitates the conceptual and discriminant validation of case-specific empirical indicants against a common set of concepts (Carmines & Zeller 1979).

6

A third and final issue arises from the degree to which one organization is linked to others via shared information, physical resources, personnel or other mechanisms. Recent work has begun to extend resilience engineering concepts and practices from studies of independent systems to studies of interdependent ones. In independent (or minimally dependent) organizations, organizational (and thus performance) boundaries are controlled by the organization itself. Indeed, as discussed by Leveson (2009), a recognized limitation of conclusions on high reliability organizations (HROs) (Roberts et al 1994) is that the organization has “nearly full knowledge of the technical aspects of operations” and that “the people in these organizations know almost everything technical about what they are doing” (LaPorte & Consolini 1991). In interdependent organizations, by contrast, resilience is the by-product of the efforts of multiple dependent organizations, with consequent uncertainties about human and technical aspects of organizational operations. A rich vein of research on interdependent critical infrastructure systems—in part motivated by the attacks of 11 September—has sought to conceptualize (Kröger 2008, Little 2002, Rinaldi et al 2001), measure (Francis & Bekera 2014, Johansson et al 2013, Pant et al 2014), model (Pendall et al 2010) and support (Gay & Sinha 2013, Kjølle et al 2012) the management of the links between systems such as electric power, water, wastewater, telecommunications and transportation, among others (for recent reviews, see (Ouyang 2014, Satumtira & Dueñas-Osorio 2010)). Critical infrastructures (CIs) are here viewed as mixed human-machine systems composed of a large number of interacting components exhibiting nonlinear relationships, thus limiting their ability to be described, controlled or predicted at a systems level. Recent work has emphasized the need for further progress in understanding and predicting adaptation and resilience in relation to hazards that face critical infrastructures (Vespignani 2009). To support 7

this work, a panoply of technological (Krishanamachari et al 2002, Marinescu & Marinescu 2008) and social (Vespignani 2009) sensors is now available, though—for reasons discussed previously—data produced by these technologies must be cast in relation to theoretically grounded constructs of organizational resilience. 3

Overview and Methodology

The 2001 World Trade Center (WTC) attack resulted in considerable loss of life as well as damage to the built environment of New York City (see Fig. 1) (National Institute of Standards and Technology 2005). Indeed, due to the location of the Twin Towers, their collapse produced massive disruptions to many infrastructure systems (O'Rourke et al 2003). Further examination of the patterns of disruption clearly shows that these infrastructures were highly interdependent, both by design and as a result of changes induced by the event (Mendonça & Wallace 2007). <>

This study concerns the restoration of the electric power distribution system in the weeks following the WTC attack. This work was undertaken by a private company, and included restoration of electric power, gas and steam services in the area immediately affected by the attacks (i.e., the island of Manhattan). Damage to this system was considerable, certainly beyond what had been experienced in prior events, and included the loss of 400 mega-watts (MW) of capacity from two substations which were destroyed following the collapse of World Trade Center building 7, and severe damage to five of the feeders that provided power to Manhattan’s distribution networks. Indeed, five of the eight total electric power distribution networks in Manhattan were left without power. In total, about 13,000 customers were left without power as

8

a result of this damage (the term “customer” refers to an entire building or facility). The company’s gas and steam systems were also disrupted. An immediate priority for the city (and, in the case of the New York Stock Exchange, the nation) was to restore this power as quickly as possible. Data collection for the present study took place throughout spring 2002. Through discussions with the company, approximately ten cases were initially identified. Criteria for case study selection centered on those cases which were meaningful (particularly in terms of the number of customers affected, as well as the cost and complexity of operations) and non-routine (in relation to the company’s prior experience). This process, which occurred over approximately two weeks, led to a set of three case studies, discussed below. Participants were identified through consultations with company personnel as part of initial work on defining the candidate case studies. Participants were drawn from various levels of the company and had a diverse set of responsibilities in restoration activities. Qualitative and quantitative data were collected to support triangulation of observations (Jick 1979). Secondary sources such as internal reports from the company and articles in the popular press (Mendonça & Wallace 2007) provided contextual information on the company’s response, as well as a number of candidate case studies. Data regarding the timing, cues and substance of key decisions in each case were provided via the Critical Decision Method (CDM) (Flanagan 1954, Klein et al 1989). Additional CDM outputs included contextual information on the cases and on the company’s (and individuals’) related prior experience. Participants were asked to come prepared to discuss the incident, and to bring any necessary supplementary materials (e.g., maps, drawings). Consistent with CDM (Klein et al 1989), one interviewer asked the probe questions and a second took notes. Time available for conducting the interviews was extremely 9

short (on the order of 20 minutes for executive personnel, and approximately 40 minutes for operations personnel). Accordingly, application of the method centered on the development of the time line verification and decision point identification, and to some extent on the identification of cues, standard operating procedures and options. Data on participants’ background, prior experience, and views on the performance of each case were collected following each interview through a brief questionnaire (Miner et al 2001, Moorman & Miner 1998). Using logs of work performed, data were also collected on the performance of technological systems, particularly to identify the timing and location of restoration activities (later triangulated with CDM outputs). Subsequent discussions were held with appropriate individuals in the company to provide further validation of CDM and log data. 4

Results

Immediately after the attack on the World Trade Center, the company began planning the restoration of electric power to affected areas. While various options were considered, the company soon settled upon a combined strategy of (i) shutdown of networks providing power to at-risk areas, (ii) provision of spot power (through the dispatch of trailer-mounted, diesel-fired generators) and (iii) installation of temporary distribution cables linking “live” (i.e., undamaged and functioning) networks to “dead” (i.e., damaged and non-functioning) ones. The remainder of this sections presents data—organized as interrelated case studies—on each of these elements, followed by an interpretation of the data in relation to the resilience factors provided by Woods (Woods 2006).

10

4.1

Network Shutdown

At the time of the attacks, the electric power distribution system in Manhattan was actually a network of eight separate networks, thus providing a degree of stability and redundancy. The fire and possible collapse of World Trade Center building 7 (WTC7) led to a key decision point on 11 September: whether to undertake a controlled or catastrophic shutdown of the network within which the site was located. Status reports on the structural stability of WTC7 were furnished on an ongoing basis by the New York City Fire Department (NYFD), which concluded at approximately 15:30 that collapse was likely. NYFD protocols (communicated to the company) called for the substation (an system element that regulates voltage between high and low, and is thus critical for distribution of power to customers) to be de-energized. While the company wanted to de-energize the area around the WTC complex, it did not want to shut down the complete network. Indeed, depending on the direction of WTC7’s eventual collapse, the company reasoned that some transmission lines might survive. A catastrophic shutdown (i.e., one caused by the loss of network elements damaged by the collapse) might or might not have resulted in the number of outages that would have been caused by a controlled shutdown (i.e., one in which potentially affected networks would be completely de-energized). A controlled shutdown would produce fewer perturbations in the distribution network and would enable a more effective restoration of power in the longer term. The company then made a decision to shut down the network, a process concluded by approximately 16:50. Three networks were de-energized, and a fourth network was shut down due to the loss of power supply furnished by a substation at the site. The combined losses of distribution capacity, substation outage, and disruption of transmission to another substation put the company in so-called “universal” mode, in which the inherently 11

distributed structure of the organization itself was replaced with a single, unified structure. Network shutdown occurred around 16:30; transmission lines were taken out of service at about 16:50; and 7 World Trade Center collapsed at 17:20. The consequences of these activities contributed to the need to provide new electric service to the approximately 13,000 affected customers. In ratings provided by one respondent (another declined to respond), the degree of improvisation of the action was moderate (4/7), as was the applicability of the organization’s prior experience (5/7). The quality of the response was rated fairly highly (6/7). Discussion Part 1 In negotiating performance at the margin of the system, the company depended upon information from NYFD on the likelihood of collapse of WTC7 to determine how well the system would continue to function (i.e., to distribute electricity safely and reliably through the network). This information appears to have suggested that, with respect to buffering capacity, the system could not absorb this size and kind of disruption. Regarding system tolerance, with the increase in potential stress to the system created by the imminent collapse of WTC7, the company chose “graceful” degradation (i.e., de-energizing or shutting down four networks) rather than “collapse.” Regarding flexibility/stiffness, two main decision options were considered for shutting down the network. Cross-scale interactions do not appear to have been particularly relevant to this case. Post-hoc, the outcome was favorable: the collapse of WTC7 led to damage that was indeed considerable and might have produced undesirable levels of disturbance and compromised safety in the distribution system. Finally, brief mention was made by the respondents of a need to

12

protect elements of the system in order to preserve a degree of buffering capacity in case of a second attack. 4.2

Spot Generation

On 11 September, an ad hoc group of individuals began discussing logistical and other issues involved in procuring trailer-mounted, diesel-fired generators to deliver spot power to critical customers. By 12 September, efforts were underway to secure generators for public safety services, and to contact building managers and the financial firms housed in their building in order to coordinate hookups. The decision to open the Wall Street markets by 17 September, provided a clear impetus to these efforts, as approximately 40 firms would have to be up and running in order for the market to trade sufficiently. A basic screening procedure in the procurement of a generator was developed: what was available, could it be gotten on short notice, and what was its voltage? By late evening on 11 September, it was clear that the amount of time and effort required to secure, install and operate these generators would be considerable. As a result, the company decided to create a new organizational unit—the Generator Group— comprised of individuals from various parts of the organization and having primary responsibility for work in this area. The first generators arrived two to three days after the attack, with a approximately twenty arriving by days four to five. By the fourth day, the time from initial request of a generator to delivery was approximately 12 hours, barring complications. While the electric power infrastructure was relatively independent of other infrastructure systems, a number of instances of interdependence were nonetheless either observed or reported (Mendonça & Wallace 2007, Wallace et al 2003). Some complications regarding interdependencies were regarded as “planned-for” (e.g., wide-scale communications outages,

13

leading to the use of Nextel phones), while others arose due to the temporary nature of the new power distribution network. The following three examples illustrate these points. Both the diesel generators and the fuel needed to run them were relatively easy to obtain. Generators were secured through a variety of means, including through contractors which normally supplied generators, as well as through contacts with generator manufacturers. Fuel would be conveyed in trucks over bridges and through tunnels from the state of New Jersey into the state of New York and then to lower Manhattan. The company began receiving notice of trucks hauling fuel that were stopped at the border: evidently, the drivers of some of these trucks were foreign nationals who were not permitted by inspection personnel to enter Manhattan. Thus, fuel supplies were stranded until the proper permissions (or other drivers) were secured— an activity that required communication and cooperation at the highest levels of the respective state governments. Similar issues arose with the generators themselves, particularly as access was restricted to certain areas of Manhattan. To alleviate these difficulties, alternatives such as dedicated security escorts for trucks or the use of barges or other supply ships were considered. Ultimately, the company undertook extensive inter-organizational coordination to enable trucks to reach Manhattan, and generators were held in staging areas within the access perimeter. Finally, interdependencies designed into the system during emergency restoration activities sometimes impeded a return to system normalcy. When it became possible to return a generatorpowered building to the wired network, not all customers were willing to have “their” generators disconnected from their buildings, wishing to retain them in guard against possible failures of the

14

network. Similarly, as other customers learned that some facilities had been provided with spot power, they too requested generators. In accomplishing its work, the Generator Group implemented procedures that included tracking the status of generator orders, installations and refueling, as well as decommissioning the generators. Each generator was assigned a unique identifier, and the time at which it was connected to a critical customer load was logged, as was the time that the customer was restored to the network. Tools included telephones, system maps and both paper- and computer-based databases. The databases were used to determine the status of work on each generator, as well as whether the generator was currently energized (i.e., whether it was providing power to the customer). <>

By examining the database used to log the status of generator installations, it is possible to describe three aspects of this component of the restoration (see Fig. 3): the number of generators deployed (i.e., the total number of generators in the field and operating beginning on 11 September); the cumulative number of generators added (i.e., aggregate total deployments to the field); and the cumulative number of generators restored (which reflects the cumulative number of customers who were restored back to the main—i.e., wired—network after having been powered by generators). Based on accounting records, a total of 135 portable generators were deployed, and 92 were placed into service. Thus, the data in Fig. 3 are incomplete. However, even allowing for some degree of error, a number of trends are suggested by the data. First, the number of units deployed rose steadily until 16 September, by which time there were approximately 40 generators deployed, with no prior customers on generators having been 15

restored to the network. Beginning on 17 September, generators continued to be deployed, but customers began to be restored to the network, reflecting a shift in load to the wired network, as discussed below. Two days later, cumulative restorations equaled deployments, thereby representing the moment at which the system began to decrease its reliance on generators ( a trend that continued for the remaining period of observation). As of 28 September, customers on nearly all generators for which sufficient data are available were restored to the network. On 29 September, the Generator Group was disbanded.

<>

This particular interview was conducted simultaneously with both respondents. In ratings provided by one respondent, the degree of improvisation in this case was low (2.7/7), as was the applicability of the organization’s prior experience (3.8/7). The quality of the response was rated fairly highly (6/7). The second respondent provided differing values for the first two dimensions (i.e., 5.7, 5.8) and an identical value for the third (i.e., 6/7).† Notes from the interview suggest strongly that both improvised and conventional approaches were used. For example, in discussing this response in relation to prior, related ones, one of the respondents emphasized the differences in scale, the nature of the events (a storm vs. a massive building collapse), and the degree of cooperation with other organizations. Some of the similarities included the actual procedures for procuring supplies (such as fuel and wiring) and the process of hooking up generators.

†

This interview could not be recorded. Remarks were unattributed and thus cannot be used to explain the discrepancy between some of the ratings. Both respondents had very similar professional backgrounds.

16

Discussion Part 2 The organization’s buffering capacity with respect to required generating capacity provided by trailer-mounted generators appears to have been essentially unlimited when assessed against the demand of so-called “critical” customers. Generators were readily available from nearby sources (such as the companies that manufacture them, as well as from other utilities). And while fuel was also available, for a brief time fuel delivery trucks were blocked from entering into Manhattan. Similarly, some generators had to be staged due to space restrictions in lower Manhattan. Generators were clearly seen by the company as a short-term solution to the power restoration problem, as they were costly to obtain, install and maintain. Data on the deployment of generators suggest that the buffering capacity provided by them was particularly useful for approximately the first eight days following the attack, after which time reliance on generators diminished. Later experiences with non-critical customers who wanted generator hookups suggest some of the difficulties that expansion of the generator program may have engendered. Flexibility/stiffness is suggested by the creation of a new organizational structure—the Generator Group—in order to manage generator procurement and use. The group was dissolved once the generators ceased to be a crucial part of the restoration plan. In other interviews (not discussed here), respondents stated that some existing organizational units improvised their roles, undertaking tasks that were within the capability of the organization but which were not in the usual range of activities for the units themselves. This phenomenon of role improvisation has been amply demonstrated in the response to many other events for individual emergency response personnel (e.g., Kreps & Bosworth 1993, Mendonça et al 2014, Webb 2004).

17

The cross-scale interactions of the company involved boundary restructuring with respect to other organizations. For example, on at least one occasion materials intended for use in power restoration activities were diverted to other uses. Here, changes in context led to strategic-level interactions—as opposed to local problem solving—in which higher-level personnel interacted to solve problems which had materialized at lower levels in the organizational hierarchy. Finally, it should be noted that the company developed new relationships with some of the suppliers of the generators (a task undertaken by the Generator Group), again highlighting the importance of cross-organizational interactions, not merely those within the company itself, as relevant to resiliency. As with other rare but highly consequential events, margin and tolerance are difficult to evaluate for this case. In fact, a key observation from the case is that the magnitude of the restoration problem far exceeded that of previous experience. Indeed, while generators had been part of previous restorations, the company had never before needed this quantity in such a short time. Using the available data, it does appear that reliance on generators (as reflected in deployments) followed an inverted “U” pattern for approximately a ten-day period. The system behavior here, then, may be understood as reflecting a decreased reliance on generators as the company shifted to the medium-term strategy of connecting customers to temporary networks, as described in the next section. Other aspects of performance are suggested by Fig. 3, such as the duration of the generator effort (approximately 18 days), as well as the general shape of the curve representing generators restored to the system. 4.3

Restoration through Addition of Distribution Capacity

Provision of generators was a shorter-term solution to the power restoration problem. The medium-term solution was the use of temporary shunts: that is, cables with 13 kilovolt (kv) 18

capacity which were used to make connections between dead or de-energized networks (five in total) and live ones (three in total). In the longer-term, all customers would be returned to the permanent network, which was likely to differ structurally from the pre-event network. This task was handled by existing units in the organization (such as Distribution Engineering and Electric Operations). Procedures executed by these units included determining shunt routes through the city and coordinating pick-ups (i.e., the actual connecting of the shunts to the networks). Additional tasks included actual installation of shunts and ongoing coordination of sequencing of work to ensure continuity of services. A two-stage procedure was typically used for installation of shunts along the roadway. In the first stage, shunts would be strung at curbside across half the road way, then protected by encasing them in wooden boxes constructed on-site. At intersections, shunts were trenched under the roadway itself. Traffic continued to use the remaining half of the road way. In the second stage, a similar procedure was repeated on the other half of the roadway, again leaving a passage for vehicles or personnel. Other options were considered for traversing streets, including traversing some streets via poles. The shunting work zone was extensive and, in part due to response and recovery activities, could not be completely sealed off. Equipment and personnel from various organizations traversed the area, often in unplanned-for ways. For example, along Liberty Street, high traffic impeded work by causing stoppages, but also threatened to damage the shunts themselves due to weight of crossing vehicles. Crews’ proximity to the attack site created other complications. As noted by one of the respondents, “I mean there was tons of people coming in and out, while we were laying these shunts. I mean they’ll be blowing the horn a building possible danger of collapse, then all the sudden you got a wave of people running towards you to get out so now you’ve got 19

to get your people out of there too. This was constantly going on. Back and forth and all.” Company work crews themselves would also sometimes need to evacuate the work zone. Similarly, there were negotiations with the police department and other organizations about use of the roadway, with company crews sometimes needing to yield to other workers or vehicles. These interruptions and displacement sometimes precipitated communication with the company’s engineering department which was “constantly looking at it to see how we can pick up as many feeders as possible” given whatever changes had recently been made. Tools used for planning and executing shunt installation included maps of the system (many of which were updated often to reflect new conditions in the field), engineering drawings, databases, telephone and mathematical models of the electric power system. One of the databases was used to track the status of work in connecting the live network (called the feeder) to the dead one (called the destination). It specified the date and time when work was begun and completed, and included the total duration of the work along with the capacity of the shunt (i.e., 13kv). A summary of restoration efforts with respect to shunt connections is given in Figure 4. The figure shows the cumulative number of connections made (including a curve fit to the data), as well as the number of connections to three live networks (14M, 15M and 34M), and the total number of connections (these latter figures are expressed in kV equivalents). The number of connections per days to individual networks varies considerably. However, the path to restoration is very nearly linear, in contrast to the S-shaped path in Figure 3 (though it must be emphasized that shunt connections did not begin until five days after the attack).

<> 20

In ratings provided by one respondent, the degree of improvisation of the action was moderate (4/7), as was the applicability of the organization’s prior experience (3.5/7). The quality of the response was rated fairly highly (5.7/7). A similar rating was provided by the other respondent for the first and third measures (4/7 and 6.3/7, respectively), while the value for the second measure was higher (6.5/7). Both respondents had served with the company at least 15 years, and had been involved in more than ten actual emergency responses. As in the second case, remarks were not attributed, so it is not possible to gauge the source of the discrepancy for the second measure. As noted in the materials for this case, elements of plan following and improvisation were both found. Discussion Part 3 Manifested behaviors associated with shunt procurement and deployment suggest the nature of the organization’s buffering capacity for this event. Regarding procurement, the company’s inhouse supplies of feeder lines were not sufficient to undertake the entire operation in the time available, leading the company to secure the lines through outside vendors. It should be emphasized that the scope and impact of this event on the city’s electric power system were unprecedented. For the distribution system alone, for example, multiple supply and distribution facilities were significantly damaged. Regarding deployment, the shunting operation required ongoing monitoring and analysis of network-wide stability. This was accomplished through various means, including extensive communications with field personnel but also the use of sophisticated models of the distribution

21

system in order to ensure that the networks would continue to operate in a safe and effective manner. Operationally, a clear difference from past practice was that many shunts were lain in the street (requiring them to be boxed in at curbside and running through trenches at intersections), whereas the standard operating procedure from previous incidents involved routing them through manhole covers and below ground. This routing approach enabled the job to be accomplished more quickly, but also led to problems of coordination in the field due to conflicts with other organizations over shared use of the roadway. Flexibility/stiffness is reflected mainly in the fact that the distribution network itself was reconfigured, creating a temporary system based on three larger networks rather than eight smaller ones. In contrast to the generator situation, there was no major restructuring of organizational units. Based on the interview discussions, margin and tolerance were reflected in the operating status of the temporary shunting system (these data were not made available for analysis). For example, data from the field were compared to model predictions in order to confirm that system stability and safety were preserved. Another aspect of margin and tolerance is reflected in the organization’s performance in designing and building the temporary networks. The path to restoration—as measured by the number of feeder connections made per day—suggests a straight path to achieving sufficient capacity in the medium-term. Cross-scale interactions are evident in the interactions from strategic through operational units of the organization. As with many other disaster situations, there was short-circuiting of normal approval procedures, mainly to expedite work. Contextual factors (such as the physical condition 22

of the built environment) led to some local problem solving, but also to local adaptations that influenced middle-level interactions (here, with engineering operations), rather than strategiclevel ones. Finally, there were many examples of inter-organizational decision making, but also of negotiation, where goals conflicted across organizations (e.g., in determining how shared resources, such as the roadway network, were to be used). As an epilogue to these cases, the final network design (that is, the one which ultimately replaced the pre-attack design) was informed both by the company’s experience in responding to the attack, but also by longer-term planning efforts that preceded the attack. While many elements of the power distribution system were preserved, others were changed to meet actual and anticipated demands for power, as well as to contribute to system stability and safety. Changes included the addition of a 900 megawatt substation in Brooklyn, various upgrades to the transmission and distribution systems, and routine replacement and maintenance of various system elements. In a parallel to post-disaster changes in communities (Solnit 2009), “restoration” and “rebuilding” by the company are therefore better understood as “redesign” and “renewal.” Future work may consider this latter phase of resilient performance more closely, particularly how organizations make the transition from damaged to stopgap to redesigned systems. 5

Discussion

The results of the foregoing case studies suggest a number of revisions to the factors theorized by Woods (2006) to contribute to organizational resilience. Buffering capacity was particularly relevant to generator and shunt deployment. Immediate impacts of the attack were sufficient to provoke widespread disruptions in the provision of

23

electric power, thus stressing absorptive capacity. Adaptive capacity, on the other hand, was manifested over a longer time frame (hours to weeks), and involved considerable interaction with other organizations. To undertake the response discussed here, the company had access to plentiful material resources (as well as key personnel who had had experience with large-scale events). The cases (particularly for shunting) clearly suggest that a broadened view of buffering capacity will consider the effect of time frame in assessments of this factor, as well as the resources and procedures necessary to yield successful adaptations. Flexibility/stiffness is found in the company’s efforts at revising organizational structure in the case of generator deployment, in the ad hoc nature of some of the activities in which it engaged in all three cases, and in the assignment of personnel to those activities. At a strategic level for the generator case, challenges associated with designing the physical system clearly helped stimulate change in organizational structure (i.e., the creation of the generator group)—an observation that underscores the need to consider the interrelationship between technological and human elements when assessing organizational resilience. On the other hand, no such unit was created to enable the deployment of shunts. The interview data suggest that, for both cases, material resources were abundant (though securing them was sometimes difficult). A key difference, however, is in the amount of time available to undertake the work of each operation. Clearly, generators were intended as a short-term, stopgap measure—necessitating rapid utilization of resources. Shunts, on the other hand, were brought online relatively gradually. Operationally, the generator group addressed technical issues associated with securing and deploying generators and fuel. To some extent, the group also addressed issues of context (e.g., crossings of state borders) and local problem solving (e.g., coordinating hookups to customers’ buildings). Generators—unlike shunts—deliver power over a relatively short physical distance, 24

so that conflicts over space outside the building envelope may have been minimal. The coordination of hookups, while sometimes complicated by issues of being unable to reach building managers, nonetheless appear to have involved a small number of people. In contrast, shunt deployment involved extensive and ad hoc interaction with other organizations in the shared space of Manhattan’s roadways. From this perspective, flexibility for the shunt case was manifested more at the operational level, as opposed to the strategic level for the generator case. In all three cases, margin and tolerance have been discussed in relation to both technological and human elements of the organization. Yet in such an evolving and under-documented system, it is difficult—perhaps even impossible—to evaluate performance on this case against some theoretical optimum. Even post-event, such assessments are challenging, leading to the use of measures of relative performance or efficiency. Engineering estimates of anticipated system performance tend to be heavily informed by expert judgment rather than historical data (National Institute for Building Sciences 2001). Moreover, these tend to be estimates of recovery times of individual system components, and do not capture many of the inherent nonlinearities of systems such as the one discussed here. A further complication for this case in particular is that the path to restoration was almost certainly influenced by other organizations (e.g., time and effort were required to negotiate about the use of shared infrastructure systems). An examination of cross-scale interactions in the three cases provides a number of examples of strategic through operational interactions as they occurred within the company. More broadly, the cases also illuminate interactions that should enrich this factor. In the network shutdown and generator cases, company executives interacted with high-placed government officials; while in the shunting case, field personnel interacted with others outside the company itself. Thus, while within-company cross-scale interactions were certainly manifest, so were cross-organizational 25

ones. It should also be noted that the cases suggest how cross-scale interactions can relate to flexibility/stiffness. In the language of Woods (2006), whether downward or upward, failures to traverse the organizational hierarchy may be addressed through flexibility (as in the creation of the Generator Group) or stiffness (in the decision to cede considerable authority to crews in the field). As discussed previously, one objective of this work (in addition to providing an empirical critique of the factors proposed by Woods 2006) is to attempt to discover other, conceptually distinct, factors might underlie organizational resilience. In all three cases—and despite the company having primary responsibility for the electric power distribution system—multiple organizations were involved in the company’s response. These collaborations were both ad hoc (e.g., with equipment suppliers) and planned-for (e.g., with customers with whom the company had to coordinate generator hookups). Second, coordination across multiple infrastructure systems, each managed by their respective organizations, was undertaken in situations involving interdependent resources (such as shared use roadways). Third, at times there was considerable uncertainty about who controlled certain elements of a given system. This was evident in the difficulties with bringing fuel into Manhattan, the management of traffic in the field, and the evacuations of workers from Ground Zero. Finally, there was sometimes uncertainty about the human and technological elements that actually comprised the system. In the case of generator and fuel supplies, for example, some shipments were delayed due to disputes about control of elements of shared infrastructure systems. All of these observations point to the importance of a conceptually distinct factor—boundaryspanning capability—underlying organizational resilience. Boundary-spanning capability refers to an organization’s ability to communicate and make decisions with collaborators or 26

competitors outside the organization. This capability differs from margin and tolerance, since it refers to activities that cross the boundaries between organizations, rather than those which require operating beyond performance boundaries. It is related to cross-scale interactions, but implies these interactions may take place across—and not merely within—organizations. The factor bears upon buffering capacity and flexibility/stiffness, since an ability to span organizational boundaries may lead to changes in buffering capacity (as was the situation in the company’s interactions with equipment suppliers, probably yielding improvements in this factor) and in flexibility (as was the situation in the company’s interactions in the field regarding shared use of the roadway, probably yielding degradation in this factor). 6

Conclusions

The case studies presented here yield a rare look into the response of one organization to a sudden onset catastrophic event, providing the means for an empirical critique of the factors identified by Woods (2006) as likely to affect organizational resilience. The results suggest a number of case-specific approaches to measuring these factors, but perhaps more importantly identify some of the conceptual linkages between them. A final contribution of this work is identifying an additional factor—boundary-spanning capability—which may help explain how cross-organizational linkages (including those which span multiple organizational scales) may help determine organizational resilience. Lastly, it should be noted that, in the years since the occurrence of the 11 September attacks, data available for monitoring and managing organizational performance have only continued to grow in scale and scope. This growth has been accompanied by a similar expansion of data within the communities and institutions serviced by critical infrastructure systems. Moreover, the points of contact between these technical and social systems have broadened and deepened. While human27

to-human interaction for hazard mitigation continues (in the form of activities such as counseling and door-to-door warning of impending disasters), society has witnessed an explosive growth in technologies that mediate this interaction (such as automated warning systems that deliver information to smart phones) (Tyshchuk et al 2012). Emerging technologies go further, creating information flows between humans and other technologies (such as software that delivers nearly real-time information on electric power outages to residential customers) (Winkler et al 2011) and between technologies themselves (such as self-healing infrastructure systems (Amin 2001)). These points of contact therefore provide a natural ground of future inquiry into sources of resilience in organizations and, more broadly, communities, exposed to hazard. Future work may therefore be directed towards investigating and exploiting the vast wealth of emerging data at the intersection of these systems, both to drive further theorizing and to contribute to community capability for achieving resilience. Acknowledgments: This material is based upon work supported by the US National Science Foundation under Grant Nos. CMS-0139306 and CMS-0301661. 7

References

Adger, W., N. Brooks, G. Bentham, M. Agnew, S. Eriksen (2004). New Indicators of Vulnerability and Adaptive Capacity, Norwich. Amin, M. (2001). Toward Self-Healing Energy Infrastructure Systems. IEEE Computer Applications in Power, 14(1), 20-28. Brooks, N. (2003). Vulnerability, Risk and Adaptation: A Conceptual Framework. Buchanan, D.A., A. Bryman (2007). Contextualizing Methods Choice in Organizational Research. Organizational Research Methods, 10(3), 483-501.

28

Carmines, E.G., R.A. Zeller (1979). Reliability and Validity Assessment. Newbury Park, CA: Sage Publications. Committee on Developing Mesoscale Meteorological Observational Capabilities to Meet Multiple Needs, N.R.C. (2009). Observing Weather and Climate from the Ground Up: A Nationwide Network of Networks. Washington, DC: National Academies Press. Cutter, S.L., L. Barnes, M. Berry, C. Burton, E. Evans, E. Tate, J. Webb (2008). A Place-Based Model for Understanding Community Resilience to Natural Disasters. Global Environmental Change, 18(4), 598-606. Dinh, L.T.T., H. Pasman, X. Gao, M.S. Mannan (2012). Resilience Engineering of Industrial Processes: Principles and Contributing Factors. Journal of Loss Prevention in the Process Industries, 25(2), 233-41. Engle, N.L. (2011). Adaptive Capacity and Its Assessment. Global Environmental Change, 21(2), 647-56. Erol, O., D. Henry, B. Sauser, M. Mansouri (2010). Perspectives on Measuring Enterprise Resilience. IEEE Systems Conference: San Diego, CA, 5-8 April. Fekete, A., M. Damm, J. Birkmann (2010). Scales as a Challenge for Vulnerability Assessment. Natural Hazards, 55(3), 729-47. Fiksel, J. (2003). Designing Resilient, Sustainable Systems. Environmental Science and Technology, 37(5330–39. Flanagan, J.C. (1954). The Critical Incident Technique. Psychological Bulletin, 51(327-58. Francis, R., B. Bekera (2014). A Metric and Frameworks for Resilience Analysis of Engineered and Infrastructure Systems. Reliability Engineering & System Safety, 121(January), 90103.

29

Gay, L.F., S.K. Sinha (2013). Resilience of Civil Infrastructure Systems: Literature Review for Improved Asset Management. International Journal of Critical Infrastructures, 9(4), 330-50. Hinkel, J. (2011). Indicators of Vulnerability and Adaptive Capacity: Towards a Clarification of the Science–Policy Interface. Global Environmental Change, 21(1), 198-208. Hohenemser, C., R.E. Kasperson, R.W. Kates, eds. (1985). Perilous Progress: Managing the Hazards of Technology. Boulder, CO: Westview Press. Hollnagel, E., D. Woods (2006). Epilogue: Resilience. Engineering Precepts, in Resilience Engineering: Concepts and Precepts, Edited by E. Hollnagel, D. Woods, N. Leveson. Aldershot, UK: Ashagate, pp. Jackson, S., T.L.J. Ferris (2013). Resilience Principles for Engineered Systems. Systems Engineering, 16(2), 152-64. Jick, T.D. (1979). Mixing Qualitative and Quantitative Methods: Triangulation in Action. Administrative Science Quarterly, 24(Dec.), 602–59. Johansson, J., H. Hassel, E. Zio (2013). Reliability and Vulnerability Analyses of Critical Infrastructures: Comparing Two Approaches in the Context of Power Systems. Reliability Engineering & System Safety, 120(December), 27-38. Kjølle, G.H., I.B. Utne, O. Gjerde (2012). Risk Analysis of Critical Infrastructures Emphasizing Electricity Supply and Interdependencies. Reliability Engineering & System Safety, 105(September), 80-89. Klein, G., R. Calderwood, D. MacGregor (1989). Critical Decision Method for Eliciting Knowledge. IEEE Transactions on Systems, Man and Cybernetics, 19(462-72.

30

Kreps, G.A., S.L. Bosworth (1993). Disaster, Organizing and Role Enactment: A Structural Approach. American Journal of Sociology, 99(2), 428-63. Krishanamachari, B., D. Estrin, S. Wicker (2002). The Impact of Data Aggregation in Wireless Sensor Networks. Proceedings of International Workshop of Distributed Event Based Systems (DEBS): July. Kröger, W. (2008). Critical Infrastructures at Risk: A Need for a New Conceptual Approach and Extended Analytical Tools. Reliability Engineering & System Safety, 93(12), 1781-87. LaPorte, T.R., P.M. Consolini (1991). Working in Practice but Not in Theory: Theoretical Challenges of 'High-Reliability Organizations'. Journal of Public Administration Research and Theory: J-PART, 1(1), 19-48. Lee, A.V., J. Vargo, E. Seville (2013). Developing a Tool to Measure and Compare Organizations' Resilience. Natural Hazards Review, 14(1), 29-41. Leveson, N., N. Dulac, K. Marais, J. Carroll (2009). Moving Beyond Normal Accidents and High Reliability Organizations: A Systems Approach to Safety in Complex Systems. Organization Studies, 30(2-3), 227-49. Little, R. (2002). Controlling Cascading Failure: Understanding the Vulnerabilities of Interconnected Infrastructures. Journal of Urban Technology, 9(1), 109-23. Lombardo, F.T. (2012). Improved Extreme Wind Speed Estimation for Wind Engineering Applications. Journal of Wind Engineering and Industrial Aerodynamics, 104-106(27884. Lorenz, D.F. (2010). The Diversity of Resilience: Contributions from a Social Science Perspective. Natural Hazards, 67(1), 7-24.

31

Lundberg, J., E. Törnqvist, S. Nadjm–Tehrani (2012). Resilience in Sensemaking and Control of Emergency Response. International Journal of Emergency Management, 8(2), 99-122. Madni, A.M., S. Jackson (2009). Towards a Conceptual Framework for Resilience Engineering. IEEE Systems Journal, 3(2), 181-91. Manyena, S.B. (2014). Disaster Resilience: A Question of ‘Multiple Faces’ and ‘Multiple Spaces’? International Journal of Disaster Risk Reduction, 8(June), 1-9. Marinescu, D.C., G.M. Marinescu (2008). Self-Organizing Sensor Networks. 2008 3rd Int. Symp. Wirel. Pervasive Comput., 288--92. Mendonça, D., W.A. Wallace (2007). Impacts of the 2001 World Trade Center Attack on New York City Critical Infrastructures. Journal of Infrastructure Systems, 12(4), 260-70. Mendonça, D., G. Webb, C. Butts, J.D. Brooks (2014). Cognitive Correlates of Improvised Behavior in Disaster Response: The Cases of the Murrah Building and the World Trade Center. Journal of Crisis and Contingency Management, 22(3), 185-95. Miner, A.S., P. Bassoff, C. Moorman (2001). Organizational Improvisation and Learning: A Field Study. Administrative Science Quaterly, 46(2), 304-37. Moorman, C., A.S. Miner (1998). Organizational Improvisation and Organizational Memory. Academy of Management Review, 23(4), 698-723. National Institute for Building Sciences (2001). Earthquake Loss Estimation Methodology Hazus99 Sr2, Technical Manuals 1-3, National Institute for Building Sciences, Washington, DC. National Institute of Standards and Technology (2005). Federal Building and Fire Safety Investigation of the World Trade Center Disaster, Washington, DC.

32

O'Rourke, T.D., A.J. Lembo, L.K. Nozick (2003). Lessons Learned from the World Trade Center Disaster About Critical Utility Systems, in Beyond September 11th: An Account of PostDisaster Research, Edited by J.L. Monday. Boulder, CO: Natural Hazards Research and Applications Information Center, pp. 269-90. Ouyang, M. (2014). Review on Modeling and Simulation of Interdependent Critical Infrastructure Systems. Reliability Engineering & System Safety, 121(January), 43-60. Palm, R.I. (1990). Natural Hazards: An Integrative Framework for Research and Planning: Johns Hopkins University Press. Pant, R., K. Barker, C.W. Zobel (2014). Static and Dynamic Metrics of Economic Resilience for Interdependent Infrastructure and Industry Sectors. Reliability Engineering & System Safety, 125(May), 92-102. Pendall, R., K.a. Foster, M. Cowell (2010). Resilience and Regions: Building Understanding of the Metaphor. Cambridge Journal of Regions, Economy and Society, 3(1), 71-84. Renn, O. (1992). Social Theories of Risk: Praeger. Rinaldi, S.M., J.P. Peerenboom, T.K. Kelly (2001). Identifying, Understanding, and Analyzing Critical Infrastructure Interdependencies. IEEE Control Systems Magazine, 21(6), 11-25. Roberts, K.H., S.K. Stout, J.J. Halpern (1994). Decision Dynamics in Two High Reliability Military Organizations. Management Science, 40(5), 614-24. Satumtira, G., L. Dueñas-Osorio (2010). Synthesis of Modeling and Simulation Methods on Critical Infrastructure Interdependencies Research, in Sustainable and Resilient Critical Infrastructure Systems, Edited by K. Gopalakrishnan, S. Peeta. Berlin: Springer Berlin Heidelberg, pp. 1-51.

33

Schroeder, J.L., C.C. Weiss (2008). Integrating Research and Education through Measurement and Analysis. Bulletin of the American Meteorological Society, 89(6), 793-98. Smit, B., I. Burton, R.J. Klein, J. Wandel (2000). An Anatomy of Adaptation to Climate Change and Variability. Climatic Change, 45(1), 223-51. Smit, B., J. Wandel (2006). Adaptation, Adaptive Capacity and Vulnerability. Global Environmental Change, 16(3), 282-92. Smith, K. (2009). Environmental Hazards: Assessing Risk and Reducing Disaster: Routledge. Solnit, R. (2009). A Paradise Built in Hell: The Extraordinary Communities That Arise in Disaster. New York: Viking. Turner, B.L. (2010). Vulnerability and Resilience: Coalescing or Paralleling Approaches for Sustainability Science? Global Environmental Change, 20(4), 570-76. Tyshchuk, Y., C. Hui, M. Grabowski, W.A. Wallace Social Media and Warning Response Impacts in Extreme Events. 45th Hawaii International Conference on Systems Science, Maui, HI Vespignani, A. (2009). Predicting the Behavior of Techno-Social Systems. Science, 325(5939), 425-28. Wallace, W.A., D. Mendonça, E. Lee, J. Mitchell, J. Chow (2003). Managing Disruptions to Critical Infrastructure Interdependencies in the Context of the 2001 World Trade Center Attack, in Beyond September 11th: An Account of Post-Disaster Research, Edited by J.L. Monday. Boulder, CO: Natural Hazards Research and Applications Information Center, pp. 165-98. Webb, G.R. (2004). Role Improvising During Crisis Situations. International Journal of Emergency Management, 2(1-2), 47-61.

34

Winkler, J., L. Dueñas-Osorio, R. Stein, D. Subramanian (2011). Interface Network Models for Complex Urban Infrastructure Systems. ASCE Journal of Infrastructure Systems, 17(4), 138-50. Woods, D. (2006). Essential Characteristics of Resilience, in Resilience Engineering: Concepts and Precepts, Edited by E. Hollnagel, D. Woods, N. Leveson. Aldershot, UK: Ashagate, pp. 21-34.

35

<>

Fig. 2. Trailer-mounted generator

Fig. 3. Generators Added, Restored or Deployed (11–27 September 2001)

Fig. 4. Shunt deployments (16 Sept–1 Oct 2001)