U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

27–176PDF 2018

RESILIENCY: THE ELECTRIC GRID’S ONLY HOPE 

HEARING 

BEFORE THE

COMMITTEE ON SCIENCE, SPACE, AND 

TECHNOLOGY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

OCTOBER 3, 2017 

Serial No. 115–29 

Printed for the use of the Committee on Science, Space, and Technology 

( 

Available via the World Wide Web: http://science.house.gov 
(II) 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY 

HON. LAMAR S. SMITH, Texas, Chair 

FRANK D. LUCAS, Oklahoma 

DANA ROHRABACHER, California 

MO BROOKS, Alabama 

RANDY HULTGREN, Illinois 

BILL POSEY, Florida 

THOMAS MASSIE, Kentucky 

JIM BRIDENSTINE, Oklahoma 

RANDY K. WEBER, Texas 

STEPHEN KNIGHT, California 

BRIAN BABIN, Texas 

BARBARA COMSTOCK, Virginia 

BARRY LOUDERMILK, Georgia 

RALPH LEE ABRAHAM, Louisiana 

DRAIN LAHOOD, Illinois 

DANIEL WEBSTER, Florida 

JIM BANKS, Indiana 

ANDY BIGGS, Arizona 

ROGER W. MARSHALL, Kansas 

NEAL P. DUNN, Florida 

CLAY HIGGINS, Louisiana 

RALPH NORMAN, South Carolina 

EDDIE BERNICE JOHNSON, Texas 

ZOE LOFGREN, California 

DANIEL LIPINSKI, Illinois 

SUZANNE BONAMICI, Oregon 

ALAN GRAYSON, Florida 

AMI BERA, California 

ELIZABETH H. ESTY, Connecticut 

MARC A. VEASEY, Texas 

DONALD S. BEYER, JR., Virginia 

JACKY ROSEN, Nevada 

JERRY MCNERNEY, California 

ED PERLMUTTER, Colorado 

PAUL TONKO, New York 

BILL FOSTER, Illinois 

MARK TAKANO, California 

COLLEEN HANABUSA, Hawaii 

CHARLIE CRIST, Florida 
(III) 

C O N T E N T S 

October 3, 2017 

Page 

Witness List ............................................................................................................. 2 

Hearing Charter ...................................................................................................... 3 

Opening Statements 

Statement by Representative Lamar S. Smith, Chairman, Committee on 

Science, Space, and Technology, U.S. House of Representatives ..................... 4 

Written Statement ............................................................................................ 6 

Statement by Representative Marc A. Veasey, Committee on Science, Space, 

and Technology, U.S. House of Representatives ............................................... 8 

Written Statement ............................................................................................ 10 

Witnesses: 

Dr. William Sanders, Department Head, Department of Electrical and Computer Engineering, University of Illinois 

Oral Statement ................................................................................................. 12 

Written Statement ............................................................................................ 15 

Mr. Carl Imhoff, Manager, Electricity Market Sector, Pacific Northwest National Laboratory 

Oral Statement ................................................................................................. 89 

Written Statement ............................................................................................ 91 

Dr. Gavin Dillingham, Program Director, Clean Energy Policy, Houston Advanced Research Center 

Oral Statement ................................................................................................. 114 

Written Statement ............................................................................................ 117 

Mr. Walt Baum, Executive Director, Texas Public Power Association 

Oral Statement ................................................................................................. 130 

Written Statement ............................................................................................ 133 

Discussion ................................................................................................................. 138

Appendix I: Answers to Post-Hearing Questions 

Mr. Carl Imhoff, Manager, Electricity Market Sector, Pacific Northwest National Laboratory .................................................................................................. 164 

Dr. Gavin Dillingham, Program Director, Clean Energy Policy, Houston Advanced Research Center ...................................................................................... 166 

Mr. Walt Baum, Executive Director, Texas Public Power Association ............... 168 

Appendix II: Additional Material for the Record 

Statement submitted by Representative Eddie Bernice Johnson, Ranking 

Member, Committee on Science, Space, and Technology, U.S. House of 

Representatives .................................................................................................... 170 

Documents submitted by Representative Marc A. Veasey, Committee on 

Science, Space, and Technology, U.S. House of Representatives ..................... 172 

(1) 

RESILIENCY: THE ELECTRIC GRID’S ONLY 

HOPE 

Tuesday, October 3, 2017 

HOUSE OF REPRESENTATIVES, 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY, 

Washington, D.C. 

The Committee met, pursuant to call, at 10:09 a.m., in Room 

2318 of the Rayburn House Office Building, Hon. Lamar Smith 

[Chairman of the Committee] presiding. 
2 

LAMAR S. SMITH, Texas 

CHAIRMAN 

Q:ongrcss of the tinitcd ~tatcs 

'lf\ousc or 'Rcprcscntatiocs COMMITIEE ON SCIENCE, SPACE, AND TECHNOLOGY 

2321 RAYBURN HOUSE OFFICE BUILDING 

WASHINGTON, DC 20515-6301 

12021 225-6371 

www.science.house.gov 

Full Committee 

EDDIE BERNICE JOHNSON, Texas 

RANKING MEMBER 

Resiliency: The Electric Grid's Only Hope 

Tuesday, October 3, 2017 

10:00 a.m. 

2318 Raybum House Office Building 

Witnesses 

Dt'. William Santi.ers, Department Head, Depmtment of Electrical and Computer Engineering, 

University of Illinois 

Mr. Carl Imhoff~ Manager, Electricity Market Sector, Pacific Northwest National Laboratory 

Dr. Gavin Dillingham, Program Director, Clean Energy Policy, Houston Advanced Research 

Center 

Mr. Walt Baum, Executive Director, Texas Public Power Association 
3 

U.S. HOUSE OF REPRESENTATIVES 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY 

HEARING CHARTER 

September 28, 2017 

TO: Members, Committee on Science, Space, and Technology 

FROM: Majority Staff, Committee on Science, Space, and Technology 

SUB.JECT: Full committee hearing: "Resiliency: The Electric Grid's Only Hope" 

The Committee on Science, Space, and Technology will hold a full committee hearing 

titled Resiliency: The Electric Grid's Only Hope on Tuesday, October 3, 2017, at 10:00 a.m. in 

Room 2318 of the Rayburn House Otlice Building. 

Hearing Purpose: 

The purpose of the hearing is to define resiliency, examine electric resiliency from both 

physical and cyber threats, and to study the effectiveness of private and government coordination 

on resiliency across the electricity delivery sectors. This hearing will specifically discuss the 

recommendations made by the National Academies of Sciences, Engineering, and Medicine's 

July 2017 consensus study report, "Enhancing the Resilience of the Nation's Electricity System." 

This hearing will also highlight the Department of Energy's lead agency status for critical 

infrastructure in the energy sector, and the impact of early-stage applied research on the 

development of resilient grid technology, infrastructure, and operational strategies. 

Witness List 

Dr. William Sanders, Department Head, Department of Electrical and Computer 

Engineering, University ofii/inois 

• Mr. Carl Imhoff, Manager, Electricity Market Sector, Pacific Northwest National 

Laboratory 

• Or. Gavin Uillingham, Program Director, Clean Energy Policy, Houston Advanced 

Research Center 

• Mr. Walt Baum, Executive Director, Texas Public Power Association 

Staff Contact 

For questions related to the hearing, please contact Jimmy Ward of the Majority Staff at 

202-225-0222. 
4 

Chairman SMITH. The Committee on Science, Space, and Technology will come to order. Without objection, the Chair is authorized to declare recesses of the Committee at any time. 

Welcome to today’s hearing entitled ‘‘Resiliency: The Electric 

Grid’s Only Hope.’’ 

I’ll recognize myself for an opening statement and then the 

Ranking Member. 

Good morning. Today, the Committee on Science, Space, and 

Technology will examine the ongoing effort by federal agencies, industry, and the Department of Energy’s National Labs to ensure 

that a resilient U.S. electric grid can deliver power to American 

homes, businesses, and essential services. This hearing specifically 

will consider the recommendations made by the National Academies of Sciences’ in their July 2017 report identifying ways to enhance the resiliency of our electricity system. 

This Committee has held hearings addressing physical and cyber 

threats to our power system, as well as technological solutions to 

stop or prevent damage from these attacks, but we often ignore the 

fact that damage to the power grid can and will continue to occur. 

We cannot predict when a cyberattack would threaten our power 

supply, and as we were reminded a few weeks ago with the impact 

of Hurricane Harvey, we don’t know when the next devastating 

natural disaster will occur. 

Instead of simply focusing on threats, we should prioritize improving the resiliency of our electric grid. The resiliency of the grid 

is the ability of system operators to prevent disruptions in power, 

limit the duration of a power disruption, and quickly repair potential damage. Resiliency is also increased by incorporating data analytics and anecdotal evidence to improve preparation for future disruptive events. Since it is not a question of ‘‘if’’ but a question of 

‘‘when’’ the power grid will face significant physical and cyber 

threats, resiliency should be a priority for our electricity system. 

Congress requested that NAS conduct a study on the resiliency 

of the Nation’s electric system. The final report was authored by 

a group of academics and industry partners with a knowledge base 

in electrical systems, engineering, and cybersecurity. The author of 

this report, Dr. William Sanders, will testify today on the NAS report and its recommendations. 

The report recommends government and industry collaboration 

and improved data-sharing as the primary strategy for improving 

the resilience of the Nation’s electrical system. The NAS report also 

stresses the importance of the Federal Government’s investment in 

the kind of long-term, early-stage applied research and technology 

development that is the mission of the DOE National Labs. 

DOE maintains research infrastructure at National Labs that is 

vital to better understanding and operating our electricity system. 

High performance computing systems can conduct complex modeling and simulations that predict potential electricity outages and 

plan responses to attacks. And information-sharing programs like 

the Department’s Cyber Risk Information Sharing Program facilitate industry communication on shared threats. By partnering with 

industry through the National Labs, DOE can provide critical 

knowledge and enable the deployment of new technology that improves grid resilience. 
5 

There are still challenges to improving resilience. The current 

federal programs to protect and preserve our electric grid are fragmented and complex. Within the Science Committee’s jurisdiction 

alone, programs to improve grid security and resiliency are funded 

at the Department of Homeland Security, FERC, the Department 

of Energy, and the National Institute of Standards and Technology. 

And incorporating utilities across the country, both large and 

small, adds even more complexity. Agencies will need to work together to simplify the information-sharing process for industry. 

Federal agencies, including DOE, must also prioritize the earlystage research that industry does not have the capacity to undertake. This will lead to the next-generation technology solutions. 

I thank our witnesses today for testifying about their valuable efforts in research, and giving their insights about operations of the 

electric grid. I look forward to a productive discussion about how 

federal agencies can work with industry to secure a resilient electric grid and what role Congress should play in providing direction 

and oversight to this complex process. 

[The prepared statement of Chairman Smith follows:] 
6 

For Immediate Release 

October 3, 2017 

Media Contacts: Thea McDonald, Brandon VerVelde 

{202) 225-6371 

Statement from Chairman Lamar Smith (R-Texas) 

Resiliency: The Electric Grid's Only Hope 

Chairman Smith: Good morning. Today, the Committee on Science, Space, and 

Technology will examine the ongoing effort by federal agencies, industry, and the 

Department of Energy's (DOE) national labs to ensure that a resilient U.S. electric grid 

can deliver power to American homes, businesses, and essential services. 

This hearing specifically will consider the recommendations made by the National 

Academies of Sciences' (N-A-S) in their July 2017 report identifying ways to enhance 

the resilience of our electricity system. 

This Committee has held hearings addressing physical and cyber threats to our power 

system, as well as technological solutions to stop or prevent damage from these 

attacks. 

But we often ignore the fact that damage to the power grid can and will continue to 

occur. We cannot predict when a cyberattack would threaten our power supply. And 

as we were rerninded last week with the impact of Hurricane Harvey, we don't know 

when the next devastating natural disaster will occur. 

Instead of simply focusing on threats, we should prioritize improving the resilience of 

our electric grid. The resiliency of the grid is the ability of systern operators to prevent 

disruptions in power, limit the duration of a power disruption, and quickly repair 

potential darnage. 

Resiliency is also increased by incorporating data analytics and anecdotal evidence 

to improve preparation for future disruptive events. 

Since it is not a question of "if" but a question of "when" the power grid will face 

significant physical and cyber threats, resiliency should be a priority for our electricity 

systern. 

Congress requested N-A-S conduct a study on the resiliency of the nation's electric 

systern. The final report was authored by a group of academics and industry partners 

with a knowledge base in electrical systems, engineering, and cybersecurity. 
7 

An author of this report, Dr. William Sanders, will testify today on the N-A-S report and its 

recommendations. 

The report recommends government and industry collaboration and improved data 

sharing as the primary strategy for improving the resilience of the nation's electrical 

system. TheN-A-S report also stresses the importance of the federal government's 

investment in the kind of long-term, early-stage applied research and technology 

development that is the mission of the DOE national labs. 

DOE maintains research infrastructure at national labs that is vital to better 

understanding and operating our electricity system. High performance computing 

systems can conduct complex modeling and simulations that predict potential 

electricity outages and plan responses to attacks. 

And information sharing programs -like the Department's Cyber Risk Information 

Sharing Program- facilitate industry communication on shared threats. By partnering 

with industry through the national labs, DOE can provide critical knowledge and 

enable the deployment of new technology that improves grid resilience. 

There are still challenges to improving resilience. The current federal programs to 

protect and preserve our electric grid are fragmented and complex. 

Within the Science Committee's jurisdiction alone, programs to improve grid security 

and resiliency are funded at the Department of Homeland Security, FERC, the 

Department of Energy, and the National Institute of Standards and Technology (NIST). 

And incorporating utilities across the country, both large and small, adds even more 

complexity. 

Agencies will need to work together to simplify the information sharing process for 

industry. Federal agencies, including DOE, must also prioritize the early-stage research 

that industry does not have the capacity to undertake, this will lead to the next 

generation technology solutions. 

I thank our witnesses today for testifying about their valuable efforts in research, and 

giving their insights about operations of the electric grid. 

I look forward to a productive discussion about how federal agencies can work with 

industry to secure a resilient electric grid and what role Congress should play in 

providing direction and oversight to this complex process. 

##II 
8 

Chairman SMITH. That concludes my opening statement, and the 

gentleman from Texas, Mr. Veasey, is recognized for his. 

Mr. VEASEY. Good morning, and thank you, Chairman Smith, for 

holding this very important and timely hearing today. I really appreciate that. I’d also like to thank the distinguished panelists for 

being here this morning. I’d also like to thank Dr. Dillingham in 

particular. It’s my understanding that your house was affected by 

the storm and hope that you and your family are doing okay now 

and recovering well. 

And also I’d like to—I look forward to this hearing and—because 

I want to hear your professional findings and your firsthand account of what storms like this can cause to communities across the 

country. I’m also interested in learning what we can do to improve 

their ability to restore power and other essential services as quickly as possible. 

Hurricanes Harvey, Irma, and Maria are very unfortunate examples of events that our world’s leading scientific institutions many 

times here in this committee have warned us would happen more 

often. It is difficult to attribute any single storm to one specific 

cause but there is a strong scientific consensus that human activity 

is responsible for conditions that may lead to more frequent and intense hurricanes, and the severity of these events may continue to 

get worse unless we do something to change our trajectory. This is 

a major reason that resilience is so important, and I am glad that 

we are elevating our examination of this topic today. 

With that said, I am very concerned again with how the Department of Energy may actually be using and redefining grid resiliency to accomplish a political agenda. Just last Friday, the Department of Energy submitted a proposed rule to FERC with the direct 

purpose of adjusting market rules to favor coal and nuclear plants 

because they may have several weeks of fuel on site. The Department asserted that this makes these plants more resilient than 

natural gas and renewables and therefore deserve extra compensation for this attribute. 

And I would imagine, Mr. Chairman, that there are probably 

some people that drill in Texas for natural gas that will probably 

be—will probably disagree with that. 

Now, to be clear I’m a very strong supporter of developing and 

incentivizing carbon capture methods and technologies. It will help 

us to—it will help us reasonably use the abundant fossil fuel resources our nation has at its disposal, including coal. I also support 

the development and deployment of next-gen nuclear technologies 

while doing what we can to safely extend the lifetime of our current fleet. 

But that doesn’t mean that we should unfairly favor coal and nuclear without a strong independently reviewed justification. The 

Department has leaned on its recently released report on the electric grid for its justification, but the lead author of that report, Alison Silverstein, pushed back against this mischaracterization of 

her work. According to the conversations she had with committee 

staff, the bulk of her work remained intact after she handed it to 

the Department. However, the final report’s specific recommendations supporting coal and nuclear plants due to their resiliency 

characteristics was not justified by any research that she or her 
9 

colleagues were aware of. In a piece she published in Utility Dive 

yesterday, Ms. Silverstein took issue with how DOE interpreted 

her technical work in the staff report. 

And, Mr. Chairman, I would like to enter this article in the 

record. 

Chairman SMITH. Without objection, so ordered. 

[The information appears in Appendix II] 

Mr. VEASEY. In it, she states the characteristics, metrics, benefits, and compensation for essential resilience and reliability services are not yet fully understood. Specifically, she concludes that, 

‘‘At this point we could not say that coal and nuclear have unique 

characteristics that provide such resiliency benefits that they 

should receive special treatment in the market.’’ 

This conclusion is also echoed by a thorough analysis released by 

the conservative R Street Institute on Sunday, which found that 

this proposal is neither technically nor procedurally sound. R 

Street summarized it as an arbitrary backdoor subsidy to coal and 

nuclear plants that risk undermining the electrical competition 

throughout the United States. 

And a story published in Energy and Environment News on Friday titled ‘‘Flooded Texas Coal Piles Dampen Reliability Arguments’’ is an example of why this proposed rule may not have been 

as rigorously developed as it should have been, never mind the fact 

that in addition to doing what we can to ensure the resiliency of 

the grid, the cost of unmitigated pollution from fossil fuels should 

also be incorporated into the cost. Propping up coal for one insufficiently justified reason without properly pricing a major cost of its 

development and use to our public health and the environment is 

not what I would call good policymaking. 

And before I conclude, Mr. Chairman, I would like to note that 

while the natural disasters are considerable threat to our grid infrastructure, there are a number of other concerns to keep in mind, 

too: cybersecurity, physical attacks, our aging infrastructure, geomagnetic disturbances, all of those present unique challenges to 

grid resiliency. And I look forward to hearing all of these topics discussed today. 

And finally, I would be remiss to not remind the majority of— 

the majority here on the panel that we are fast approaching the 

end of the year, and we have still not heard from Secretary Perry 

yet on this committee, and we need to hear from him. And I would 

think that with all the Texans that are on this committee that it 

would be like when he was with Randy Weber now in the State 

Legislature and he would feel fine coming on down here and talking to us. We’ve got east Texas, west Texas, the Houston area, Dallas-Fort Worth. We’re all represented and I’m sure that Rick, as we 

used to call him when I was in the Texas Legislature, that he 

would feel fine coming on down here and talking to us and testifying. 

So, Mr. Chairman, with that, I yield back my time. 

[The prepared statement of Mr. Veasey follows:] 
10 

OPENING STATEMENT 

Ranking Member Marc Veasey (D-TX) 

of the Subcommittee on Energy 

House Committee on Science, Space, and Technology 

Resiliency: The Electric Grid's OnZv Hope 

October, 3, 2016 

Good morning and thank you, Chairman Smith, for holding this impmiant and timely hearing 

today. 

I would also like to thank this distinguished panel of witnesses for being here this morning. I'd 

like to thank Dr. Dillingham in particular, whose home and family, I understand, were directly 

impacted by Hunicane Harvey. Dr. Dillingham, I hope that you and your family are well on the 

road to recovery at this point. I look forward to hearing both your professional findings and your 

first-hand accmmt of how storms like these can cause significant harm to communities across the 

country. 

I'm also interested in leaming what we can do to improve their ability to restore power and other 

essential services as quickly as possible. Hunicanes Harvey, lnna, and Maria are unfortunate 

examples of events that our world's leading scientific institutions have warned us would happen 

more often. If we are not able to sufficiently reduce the emissions that are the leading drivers of 

climate change, we are likely to see even more in the future. 

It is difficult to attribute any single storn1 to one specific cause, but there is a strong scientific 

consensus that human activity is responsible for conditions that lead to more frequent and intense 

hunicanes. The severity of these events will continue to get worse unless we change our 

trajectory. This is a major reason that resilience is so important, and I am glad that we are 

elevating our examination of this topic today. 

With that said, I am concerned with how the Department of Energy may actually be using and 

redefining grid resiliency to accomplish a political agenda. Just last Friday, DOE submitted a 

proposed rule to FERC with the direct purpose of adjusting market rules to favor coal and 

nuclear plants because they may have several weeks of fuel on site. The Department asserted that 

this makes these plants more resilient than natural gas and renewablcs, and therefore deserve 

extra compensation for this attribute. 

Now, to be clear, I am a very strong supporter of developing and incentivizing carbon capture 

methods and teclmologies. It will help us responsibly usc the abundant fossil fuel resources our 

nation has at its disposal, including coal. I also support the development and deployment of next 

generation nuclear technologies while doing what we can to safely extend tile lifetime of our 

cunenl fleet. But that doesn't mean that we should unfairly favor coal and nuclear without a 

strong, independently reviewed justification. 

The Department has leaned on its recently released report on the electric grid for its justification. 

But, the lead author of that repmi, Alison Silverstein, pushed back against this 

mischaracterization of her work. According to conversations she had with Committee staff, the 
11 

bulk of her work remained intact after she handed it to the Department. However, the final 

report's specific recommendation supporting coal and nuclear plants due to their resiliency 

characteristics was NOT justified by any research that she or her colleagues were aware of. In a 

piece she published in Utility Dive yesterday, Ms. Silverstein took issue with how DOE 

interpreted her technical work in the staff report. 

I would like to enter this article in the record. 

In it, she states, "The characteristics, metrics, benefits and compensation for essential resilience 

and reliability services are not yet fully understood." Specifically, she concludes that at this point 

we cannot say that coal and nuclear have unique characteristics that provide such significant 

resiliency benefits that they should receive special treatment in the market. This conclusion is 

also echoed by a thorough analysis released by the conservative R Street Institute on Sunday, 

which found that this proposal is "neither technically nor procedurally sound." R Street 

summarized it as "an arbitrary backdoor subsidy to coal and nuclear plants that risks 

undermining electrical competition throughout the United States." 

And a story published in Energy and Environment News on Friday titled "Flooded Texas coal 

piles dampen reliability arguments" is a prime example of why this proposed rule may not have 

been as rigorously developed as it should've been. Nevermind the fact that, in addition to doing 

what we can to ensure the resiliency of the grid, the cost of unmitigated pollution from fossil 

energy plants should also be incorporated into its costs. Propping up coal for one insufficiently 

justified reason without properly pricing a major cost of its development and usc to our public 

health and the environment is not what I would call good policymaking. 

Before I conclude, I would like to note that while natural disasters are a considerable threat to 

our grid infrastructure, there are a number of other concerns to keep in mind. In particular. 

cybersecurity, physical attacks, aging infrastructure, and geomagnetic disturbances also present 

unique challenges to grid resiliency. 

I look forward to the discussion on all of these topics today. 

Finally, I would be remiss to not remind my Majority colleagues that we are fast approaching the 

end of the year and we have still not had the Secretary of Energy testify before the Committeeor any DOE leadership for that matter. With all the Texans here, I imagine Secretary Perry would 

feel right at home. It's our responsibility to provide Congressional oversight for the valuable 

research activities at the Department and I hope we will have the Secretary come testify soon. 

Thank you, I yield back. 
12 

Chairman SMITH. That’s a good pitch, Mr. Veasey, and a good 

statement as well. Thank you. 

Let me introduce our witnesses. Our first witness today is Dr. 

William Sanders, Department Head of the Department of Electrical 

and Computer Engineering at the University of Illinois. Dr. Sanders received a bachelor’s degree in computer engineering, a master’s of science degree and a Ph.D. in computer science and engineering from the University of Michigan. 

Our next witness is Mr. Carl Imhoff, Manager of the Electricity 

Market Sector at Pacific Northwest National Laboratory. With over 

30 years of experience at PNNL, Mr. Imhoff has been involved with 

multiple electric power system organizations. He received a bachelor’s degree in industrial engineering from the University of Arkansas and a master’s degree in industrial engineering from Purdue University. 

The third witness is Dr. Gavin Dillingham, Program Director for 

Clean Energy Policy at Houston Advanced Research Center. Additionally, Dr. Dillingham is the Director of the U.S. Department of 

Energy Southwest Combined Heat and Power Technical Assistance 

Partnership. He received a Ph.D. in political science from Rice University. 

Our final witness today is Mr. Walt Baum, Executive Director of 

Texas Public Power Association. Previously, Mr. Baum was the Executive Vice President of the Association of Electric Companies of 

Texas. He received a bachelor’s degree in economics from Austin 

College with concentrations in political science, regulatory policy, 

and land-use economics. 

We welcome you all, look forward to your testimony today. And 

Dr. Sanders, if you will begin. 

TESTIMONY OF DR. WILLIAM SANDERS, 

DEPARTMENT HEAD, 

DEPARTMENT OF ELECTRICAL 

AND COMPUTER ENGINEERING, 

UNIVERSITY OF ILLINOIS 

Dr. SANDERS. Thank you, Chairman Smith. Chairman Smith, 

Ranking Member Veasey, and Members of the Committee, I am 

honored to appear before you today. My name is Bill Sanders, and 

I’m the head of the Department of Electrical and Computer Engineering at the University of Illinois at Urbana-Champaign. 

I was a member of the committee that wrote the National Academies of Science’s engineering and medicine consensus report entitled ‘‘Enhancing the Resiliency of the Nation’s Electricity System.’’ 

The subject of this hearing is resiliency. Resiliency is a fundamental and different concept from other abilities such as reliability 

or cybersecurity. In the context of electric power, a key insight 

about resiliency is that it attempts to avoid an event—in this case 

a long-term blackout—but understands and admits that avoidance 

may not be possible and thus works to respond as quickly as possible, preserving critical individual and societal services and over 

time strives for full recovery and enhanced robustness to further 

impairments. 
13 

The reference studies focuses largely on the Nation’s vulnerability to large-area, long-duration outages, those that span several 

service areas and last three days or longer. If found that much can 

be done to make these outages less likely, but they cannot be totally eliminated no matter how much money or effort is invested. 

To increase the resiliency of the grid, our report argues that the 

Nation must not only work to prevent and minimize the size of outages but must also develop strategies to cope with the outages 

when they happen, recover rapidly afterward, and incorporate lessons learned into future planning and response effort. 

The offered report also recognizes that at least for the next two 

decades most consumers will continue to depend on the functioning 

of a large-scale, interconnected, tightly organized, and hierarchical 

structured electric grid for resilient electricity service. 

In addition to many specific recommendations directed to particular organizations, the report makes seven overarching major 

recommendations. They’re documented in detail in the report, and 

I’ll just summarize them here. First, emergency preparedness exercises that include multisector coordination; implementing available 

grid resiliency technologies and best practices; supporting DOE research and grid resiliency; creating a stock pile of physical components, namely transformers, that enhance resiliency; developing a 

means for grid cyber resilience; continuous envisioning of possible 

impairments which could lead to large-scale grid failures; and ongoing efforts as needed to mandate strategies designed to increase 

the resiliency of the electricity system. In all of these efforts, the 

joint and collaborative involvement of government, industry, and 

academia is key to their success. 

A new concern to the resiliency of the power cyber portion of the 

grid and how that cyber portion could affect overall grid resiliency, 

the electric power system has become increasingly reliant on its 

cyber infrastructure, including computers, communication networks, control system electronics, smart meters and other distribution-side assets. A compromise of the power grid control system or 

other portions of the grid cyber infrastructure can have serious consequences ranging from a simple disruption to—of service with no 

damage to physical components to permanent damage of hardware 

that can have long-lasting effects. 

Over the last decade, much attention has been rightly placed on 

grid cybersecurity but much less has been placed on grid cyber resiliency. The sources of guidance on protection as a mechanism to 

achieve grid cybersecurity are numerous and documented in the report. It is now, however, becoming apparent that protection alone 

is not sufficient and can never be made perfect. 

An experiment, for example, conducted by the National Rural 

Electric Cooperative Association and N–Dimension in 2014 determined that a typical small utility is probed or attacked every 3 seconds around the clock. Given the relentless attacks and the challenges of prevention, successful cyber penetrations are inevitable 

and there is evidence of increases in the rate of penetration in the 

past year. Serious risks are posed by further integration of operational technology systems with utility business systems, despite 

the potential for significant value and increased efficiency. 
14 

Given that protection cannot be made perfect and the risk is 

growing, cyber resiliency, in addition to more classical cyber protection approaches, is critically important. While some work done 

under the cybersecurity nomenclature can be used to support resiliency, the majority of the work today has been focused on preventing the occurrence of successful attacks rather than detecting 

and responding to partially successful attacks that occur. 

As argued in the report and in our overarching recommendation 

number 5, further work is critically needed to define cyber resiliency architectures that protect against, detect, respond, and recover from cyber events that occur. So the title of this hearing, ‘‘Resiliency: The Electric Grid’s Only Hope’’ is apt. The threat to grid 

resiliency is multifaceted and real, and the time to act is now. 

Thank you for the opportunity to be with you here today. I would 

be happy to answer any questions you have. 

[The prepared statement of Dr. Sanders follows:] 
15 

TESTIMONY OF 

William H. Sanders 

Donald Biggar Willett Professor of Engineering 

Head, Department of Electrical and Computer Engineering 

University of Illinois at Urbana-Champaign 

Urbana, IL 

BEFORE THE 

United States House of Representatives 

Committee on Science, Space, & Technology 

HEARING ON 

Resiliency: The Electric Grid's Only Hope 

October 3, 2017 

Raybum House Office Building 

Washington, DC 

(Pmiions of this testimony were taken verbatim from the National Academics of Sciences, 

Engineering, and Medicine report "Enhancing the Resilience of the Nation's Electricity System, 

lSBN 978-0-309-46307-2 I DOl 10.17226/24836, available at http://nap.edu/24836 and the 

associated "Report in Brief') 
16 

Introduction 

Chainnan Smith, Vice-Chairperson Lucas, Ranking Member Johnson, members ofthe 

committee: I am honored to appear before you today to discuss the resiliency of the United States 

power grid. 

I am a Donald Biggar Willett Professor of Engineering and the Head of the Department 

of Electrical and Computer Engineering at the University of Illinois at Urbana-Champaign. Twas 

the founding director of the Infonnation Trust Institute at the University of Illinois, and served as 

director of the Coordinated Science Laboratory at lllinois. I am a professor in the Department of 

Electrical and Computer Engineering and in the Department of Computer Science.! am a fellow 

of the IEEE, the ACM, and the AAAS; a past chair of the IEEE Technical Committee on FaultTolerant Computing; and past vice-chair of the TFIP Working Group 10.4 on Dependable 

Computing. 

I am an expert on secure and dependable computing with a focus on critical 

infrastructures. I have published more than 270 technical papers in those areas. I was the 2016 

recipient of the IEEE Technical Field Award, Innovation in Societal Infrastructure, for 

"assessment-driven design of trustworthy cyber infrastructures for societal-scale systems." Since 

2005, I have led or co-led major government-funded centers (TCIP, TCIPG, and CREDC) that 

work to make the grid secure and resilient. T was also a member of the committee that wrote the 

National Academies of Sciences, Engineering, and Medicine consensus report entitled 

"Enhancing the Resilience of the Nation's Electricity System" that is the subject of this hearing. 

In short, my experiences provide me with a unique perspective to offer the Committee insight 

and recommendations conceming the impaim1ents to and approach for providing resiliency in 

the electric power grid. 

In my remarks today, I will: 

• Describe the concept ofresilieney. 

• Provide an overview of the report, why it is important, and the top recommendations 

from the report that should be implemented now and in the future. 

• Describe the importance of resiliency on the eybcr systems that control the grid 

and, because my personal expertise is cyber, 
17 

• Make specific recommendations to enhance the resiliency of the cyber portion of the 

power grid to cyberattacks and, in turn, the grid itself; while stressing that resiliency to 

other impainnents is also very important. 

Before doing so, I will provide a brief overview of the Trustworthy Cyber Infrastructure 

for the Power Grid (TCIPG) project which I led, and the Cyber-Resilient Energy Delivery 

Consortium (CREDC), which I currently co-lead. 

TCIP/TCIPG and CREDC 

l served as the Director and Principal Investigator (PI) of the DOE/DHS Tmstworthy 

Cyber Infrastructure for the Power Grid (TCIPG) Center and currently serve as the co-PI of the 

Cybcr-Resilient Energy Delivery Consortium (CREDC), which conducts research at the 

forefront of national efforts to make the U.S. power grid resilient. 

The Trustworthy Cyber Infrastructure for the Power Grid (TCIP (2005-20 1 0) and TCIPG 

(2009-20 15) projects, a partnership of four academic institutions, were conducted to meet the 

challenge of making the electricity grid resilient. The TCIP Project was funded p1imarily by the 

National Science Foundation, with additional support by the Department of Energy's Office of 

Electricity Delive1y and Energy Reliability, and by the Department of Homeland Security's 

Science and Technology Directorate, HSARP A, Cyber Security Division. The TCIPG project 

was fi.mdcd by the Department of Energy's Office of Electricity Delivery and Energy Reliability 

with partial support from the Department of Homeland Security's Science and Technology 

Directorate, HSARP A, Cyber Security Division. 

In these projects, we collaborated with national laboratories and the utility sector to 

protect the U.S. power grid by significantly improving the way the power grid infrastmcmre is 

designed, making it more secure, resilient, and safe. In both technology and impact, 

TCIP/TCIPG was a successful partnership of government, academia, and industry, creating 

multiple startup companies and transitioning multiple technologies to industry. The projects also 

had a significant positive impact on workforce education, delivering successful short courses, 

producing graduates, and providing the knowledge necessary to do interdisciplinary work of this 

type at other universities. 

CREDC (funded by the Department of Energy Office of Electricity Delivery and Energy 

Reliability with support from the Department of Homeland Security's Science and Technology 
18 

Directorate, HSARPA, Cyber Security Division) is a partnership of I 0 academic institutions and 

2 national labs that perfonns research and development in support of the Energy Sector Control 

Systems Working Group's Roadmap of resilient Energy Delivery Systems (EDS) that focuses on 

the cybersecurity of EDS. In doing so, CREDC addresses the cybersecurity of power grids, as 

well as oil and gas refinery and pipeline operations. To do this, CREDC develops projects with 

significant and measurable sector impact, involving industry partners (asset owners, equipment 

vendors, and technology providers) early and often, with activities that range from helping to 

identifY critical sector needs, to perfonning pilot deployment and technology adoption. 

Resiliency 

The subject of this hearing is "resiliency," which is a fundamental and different concept 

from other "-abilities," such as, for example, reliability or cybersecurity. The Random House 

Dictionary of the English Language defines resiliency as "the power or ability to return to the 

original fonn, position, etc. after being bent, compressed, or stretched ... [the] ability to recover 

from illness, depression, adversity, or the like ... [to] spring back, rebound." In the context of 

electric power, resiliency is not just about being able to lessen the likelihood that outages will 

occur, but also about managing and coping with outage events when they do occur. The goal is 

to lessen outage impacts, regrouping quickly and efficiently once an event ends, and in the 

process leaming to better deal with other events in the future. 

Flynn (2008) has outlined a four-stage framing of the concept of resilience: (l) preparing 

to make the system as robust as possible in the face of possible future stresses or attacks; (2) 

relying on resources to manage and ameliorate the consequences of an event once it has 

ocCUlTed; (3) recovering as quickly as possible once the event is over; and ( 4) remaining alert to 

insights and lessons that can be drawn (through all stages of the process) so that if and when 

another event occurs, a better job can be done on all stages. Our committee used that framing to 

organize our report. 

A key insight about the concept of resiliency is that it attempts, to the greatest extent 

possible, to avoid the large-scale event (in this case a long-term blackout), but understands and 

admits that it may not be totally possible to avoid it, and thus works to respond as quickly as 

possible to the event once it occurs, preserving "critical" individual and societal services during 

4 
19 

the period of degraded operation and, over time, strives for full recovery and enhanced 

robustness to further impairments that could result in additional large scale events. 

Because the power system is hierarchical, these same concepts apply at several different 

levels of the system, including across the high-voltage grid, the regional grid (some of which are 

operated by regional transmission organizations), local transmission and distribution systems 

(typically the domain of utilities), and the end-use level (on both the utility and customer side of 

the meter) and across the cyber and physical portions of the power grid. It is also clear that the 

resiliency of the power grid is critically dependent other interconnected infrastructures (e.g, oil 

and gas). 

National Academy Report Overview 

Jn its 2014 appropriations for the Department of Energy, Congress requested that the 

National Academies of Sciences, Engineering, and Medicine organize a study to identify 

technologies, policies, and organizational strategies to increase the resilience and reliability of 

the U.S. electricity system. The study focused largely on reducing the nation's vulnerability to 

large-area long-duration outages those that span several service areas or even states and last 

three days or longer. It found that much can be done to make both large and small outages less 

likely, but they cannot be totally eliminated no matter how much money or effort is invested. To 

increase the resilience of the grid, our report argues that the nation must not only work to prevent 

and minimize the size of outages, but must also develop strategies to cope with outages when 

they happen, recover rapidly afterward, and incorporate lessons learned into future planning and 

response eftorts. The report also recognizes that, at least over the next two decades, most 

customers will continue to depend on the functioning of the large-scale, interconnected, tightly 

organized, and hierarchically structured electric grid for resilient electric service. Recent and 

ongoing events, such as the hurricanes in the Southeast and wildfires in the West, make the 

consideration of grid resilience even more timely. 

The Chair of the study was M. Granger Morgan, Carnegie Mellon University, and the 

committee members were Dionysios Aliprantis, Purdue University; Anjan Bose, Washington 

State University; Terry Boston, PJM Interconnection (retired); Allison Clements, GoodGrid 

LLC; Jeffery Dagle, Pacific Northwest National Laboratory; Paul De Martini, Newport 

Consulting Group; Jeanne Fox, Columbia University; Elsa M. Garmire, Dartmouth College 
20 

(retired); Ronald E. Keys, United States Air Force (retired General); Mark F. McGranaghan, 

Electric Power Research Institute; Craig Miller, National Rural Electric Cooperative 

Association; Thomas J. Overbye, Texas A&M University; William H. Sanders, University 

Illinois at Urbana Champaign; Richard E. Schuler, Cornell University; Susan F. Tierney, 

Analysis Group; David G. Victor, University of California San Diego. 

The report notes that when major electricity outages do occur, economic costs can tally in 

the billions of dollars and lives can be lost. It argues that resilience is not just about lessening the 

likelihood that these outages will occur. It is also about limiting the scope and impact of outages 

when they do occur, restoring power rapidly aftetwards, and learning from these experiences to 

better deal with events in the future. 

Large outages have happened in the past as a result of hurricanes, ice storms, and a 

variety of other causes. Even larger outages, extending across many states for periods of many 

days, are possible in the future. Chapter 3 of the report discusses over a dozen events that could 

cause widespread outages of long duration. 

The central chapters of the report (Chapters 4, 5, & 6) arc organized around three critical 

clements of building a secure power system: 

I. Taking step to be better prepared, long before an outage occurs. 

2. Taking steps to minimize the individual and social cost of a large-scale long-tenn outage. 

3. Putting the system back together after an event and learning from the process so we are able 

to do a better job of making the system more resilient in the future. 

Report Recommendations 

In addition to many specific recommendations directed to particular organizations, the 

report makes seven overarching recommendations (see the report for a precise statement of each 

recommendation, and the report's recommendation on what organizations should be responsible 

for implementation): 

I. Conduct more emergency preparedness exercises that include multisector coordination. 

2. Rapidly implement resiliency-enhancing technical capabilities and operational strategies that 

are available today, and speed the adoption of new capabilities and strategies as they become 

available. 

6 
21 

3. Sustain and expand the areas of research, development, and demonstration that are now being 

undertaken by the Department of Energy's Office of Electricity Delivery and Energy 

Reliability and Office of Energy Efficiency and Renewable Energy, with respect to grid 

modernization and systems integration, with the explicit intention of improving the resiliency 

of the U.S. power grid. 

4. Through public and private means, substantially increase the nation's investment in the 

physical resources needed to ensure that critical electric infrastmcture is robust and that 

society is able to cope when the grid fails. 

5. Carry out a program of research, development, and demonstration activities to develop and 

deploy capabilities for the a) continuous collection of diverse ( cyber and physical) sensor 

data; b) fusion of sensor data with other intelligence infonnation to diagnose the cause of the 

impairment ( cyber or physical); c) visualization techniques needed to allow operators and 

engineers to maintain situation awareness; d) analytics (including machine learning, data 

mining, game theory, and other artificial intelligence-based techniques) to generate real-time 

recommendations for actions that should be taken in response to the diagnosed attacks, 

failures, or other impainnents; e) restoration of control system and power delivery 

functionality and cyber and physical operational data in response to the impainnent; and f) 

creation of post-event tools for detection, analysis, and restoration to complement event 

prevention tools. 

6. Establish and support a "visioning" process with the objective of systematically imagining 

and assessing plausible large-area long-duration grid disruptions that could have major 

economic, social, and other adverse consequences. 

7. Establish small System Resilience groups, infonned by the work of the Department of 

Energy/Department of Homeland Security "visioning" process, to assess and, as needed, to 

mandate strategies designed to increase the resilience of the U.S. bulk electricity system. 

The joint and collaborative involvement of government, industry, and academia in 

implementing these recommendations is key to their success. 
22 

Cyber Resiliency 

A relatively new concern, and the subject of my core expertise, is the resiliency of the 

cyber portion of the grid, and how it affects overall grid resiliency. The electric power system 

has become increasingly reliant on its cyber infrastructure, including computers, communication 

networks, other control system electronics, smart meters, and other distribution-side cybcr assets, 

in order to achieve its purpose of delivering electricity to the consumer. A compromise of the 

power grid control system or other pm1ions of the grid's cyber infrastructure can have serious 

consequences ranging ti·om a simple disruption of service with no damage to the physical 

components to pcnnanent damage to hardware that can have long-lasting effects on the 

performance of the system. Any consideration of improved power grid resiliency requires a 

consideration of improving the resiliency of the grid's cyber infrastructure. 

Over the last decade much attention has rightly been placed on grid cybersecurity, but 

much Jess has been placed on grid cyber resiliency. The sources of guidance on protection as a 

mechanism to achieve grid cyber security are numerous, and documented in the report. It is now, 

however, becoming apparent that protection alone is not sufficient, and can never be made 

perfect. Cybercriminals arc difficult to apprehend, and there are nearly 81 ,000 vulnerabilities in 

the NlST National Vulnerability Database making it challenging to use safe code (NVD, 2016). 

An experiment conducted by the National Rural Electric Cooperative Association and NDimension in April 2014 determined that a typical small utility is probed or attacked every 3 

seconds around the clock. Given the relentless attacks and the challenges of prevention, 

successful cyber penetrations arc inevitable, and there is evidence of increases in the rate of 

penetration in the past year. 

Fortunately, the successful attacks to date have largely been concentrated on utility 

business systems as opposed to monitoring and control systems (termed operational teclmology 

or OT systems), in part because there are fewer attack surfaces, fewer users with more limited 

privileges, greater use of encryption, and more usc of analog technology. However, there is a 

substantial and growing risk of a successful breach of operational technology systems, and the 

potential impacts of such a breach could be significant. These risks are growing partially 

because, as the grid is modernized, there is greater reliance on grid components with significant 

cyber controls. Serious risks are posed by further integration of operational technology systems 

with utility business systems, despite the potential for significant value and increased efficiency. 
23 

Given that protection cannot be made perfect, and the risk is growing, cyber resiliency, in 

addition to more classical cyber protection approaches, is critically important. Cyber resiliency 

aims to protect using established cybersecurity techniques, but acknowledges that such 

protections can never be perfect, and requires monitoring, detection, and response to provide 

continuous delivery of electrical service. While some work done under the cybersecurity 

nomenclature can support cyber resiliency (e.g. intrusion detection and response), the majority of 

the work to date has been focused on preventing the occurrence of successful attacks, rather than 

detecting and responding to partially successful attacks that occur. 

A cyber resiliency architecture should implement a strategy for mitigating cyberattacks 

and other impainnents by monitoring the system and dynamically responding to perceived 

impainnents to achieve resiliency goals. The resiliency goals for the cyber infrastructure require 

a clear understanding of the interaction between the cyber and physical portions of the power 

grid, and how impainnents on either (cyber or physical) side could impact the other side. By 

their nature, such goals are inherently system-specific, but should balance the desire to minimize 

the amount of time a system is compromised and maximize the services provided by the system. 

Often, instead of taking the system offline once an attack is detected, a cyber resiliency 

architecture attempts to heal the system while providing critical cyber and physical services. 

Based on the resiliency goals, cyber resiliency architectures typically employ sensors to monitor 

the state of the system on all levels of abstraction and detect abnormal behaviors. The data from 

multiple levels arc then fi.tsed to create higher-level views of the system. Those views aid in 

detecting attacks and other cyber and physical impainnents, and in identifying failure to deliver 

critical services. A response engine, often with human input, recommends the best course of 

action. The goal, after perhaps multiple responses, is complete recovery, i.e., restoring the cyber 

system to a fully operational state. 

Further work is critically needed to define cyber resiliency architectures that protect 

against, detect, respond, and recover from cyber attacks that occur. 

Achieving Cyber Resiliency 

In addition to overarching recommendation number 5, the report makes a specific 

recommendation regarding cyber resiliency. Specifically, it states that: 
24 

"The Department of Energy should embark upon a research, development and 

demonstration program that makes use of the diverse expe1tise of industry, academia, and 

national Jabs that results in a prototypical cyber-physical-social control system architecture for 

resilient electric power systems. The program would have the following components: I) A 

diverse set of sensors (spanning the physical, cyber, and social domains), 2) a method to fuse this 

sensor data together to provide situational awareness of known high quality, and 3) an ability to 

generate real-time command and control recommendations for adaptations that shonld be taken 

to maintain the resiliency of an electric power system." 

Physical Resilience is Equally Important 

Because my personal expertise lies in the area of infonnation, communication, and 

control technologies I have elaborated on cyber resilience. However, in closing I should stress 

that Chapter 3 of our report identifies and discusses over a dozen events such as hurricanes, 

earthquakes, tsunamis, icc stonns, terrorist attacks, and large solar stonns, that could cause wide 

physical damage to the power system that could result in large outages. Putting the system back 

together after one of these extreme events could require many days or even weeks. 

Summary 

The title of this hearing "Resiliency: The Electtic Grid's Only Hope" is apt. Unlike some, 

I don't believe "the sky is falling" or that we are on the brink of a major disaster. However, the 

threat to grid resiliency is real, and the time to act is now, so we don't reach that brink. To 

summarize the points that !made in this testimony: 

1) Grid resiliency is different than grid reliability, and requires a fundamentally new approach. 

2) Grid resiliency attempts, to the greatest extent possible, to avoid long-term blackouts, but 

understands and admits that it may not be totally possible to avoid them, and thus works to 

respond as quickly as possible to the event once it occurs, preserving "critical" services 

during the period of degraded operation and, over time, strives for full recovery and 

enhanced robustness. 

3) Efforts with appropriate funding must be put in place for: 

a) Emergency preparedness exercises that include multisector coordination, 

b) Implementing available technologies and best practices, 

10 
25 

c) Supporting DOE research in grid resiliency, 

d) Creating a stockpile of physical components that enhance resiliency, 

e) Developing means for cyber resilience, 

!) Continuous envisioning of possible impainncnts which could lead to large-scale grid 

failures, and 

g) Ongoing efforts to assess and, as needed, to mandate strategies designed to increase the 

resilience of the electricity system. 

4) The grid can only be resilient if its cyber infrastructure is resilient, so research and 

development are critically needed that provides assured mechanisms to ensure cyber 

resiliency. 

Thank you for the oppmtunity to be here with you today. I would be happy to answer any 

questions that you have. 

11 
26 

William H. Sanders Biography 

William H. Sanders is a Donald Biggar Willett Professor and the Head of 

the Department of Electrical and Computer Engineering (www.ece-illinois.cdu) at the University 

of illinois at Urbana-Champaign (illinois.edu). He is a professor in the Department of Electrical 

and Computer Engineering and in the Department of Computer Science. He is a fellow of the 

IEEE, the ACM, and the AAAS; a past chair of the IEEE Technical Committee on FaultTolerant Computing; and past vice-chair of the lflP Working Group l 0.4 on Dependable 

Computing. He was the founding director of the Information Trust Institute 

(www.iti.illinois.edu) at Illinois (2004-20 ll), and served as director of the Coordinated Science 

Laboratory (www.csl.illinois.edu) Illinois from 20!0 to 2014. 

Dr. Sanders's research interests include secure and dependable computing and security 

and depend8bility mctrics and evaluation, with a focus on critical infrastructures. He has 

published more than 270 technical papers in those areas. He served as the director and Pl of the 

DOE!DHS Trustworthy Cyber Infrastructure for the Power Grid (TC!PG) Center (tcipg.org). 

which did research at the forefront of national etforts to make the U.S. power grid smart and 

resilient. He was the 2016 recipient of the IEEE Technical Field Award, Innovation in Societal 

Infrastructure, for "assessment-driven design of trustworthy cybcr infrastructures for societalscale systems." 

12 
27 

WILLIAM H. SANDERS 

Department of Electrical and Computer Engineering, 

Coordinated Science Laboratory, and 

Information Trust Institute. 

University of Illinois at Urbana-Champaign (UIUC) 

306 North Wright Street 

Urbana, IL 61801-2918 

Office (217) 333-0345 

Cell (217) 390-1311 

whs@illinois.edu 

http:/ /ece.illinois.edu 

http:/ /tcipg.org 

http:/ /perform .illinois.ed u 

Citizenship: United States 

Degrees Field Institution 

Ph.D. Computer Science and University of Michigan 

Engineering 

M.S.E. Computer, Information University of Michigan 

and Control Engineering 

B.S. Computer Engineering University of Michigan 

Academic Positions Held 

Date Awarded 

1988 

1985 

1983 

Head, Department of Electrical and Computer Engineering, UIUC, 2014-Present. 

Interim Head, Department of Electrical and Computer Engineering, UIUC, 2013-2014. 

Executive officer for department with approximately 105 faculty members and 60 staff; responsible for 

administrative, budgetary, hiring, and tenure decisions, and for leading the faculty and staff in the 

development of research, teaching, and public service programs. Oversees administrative and research 

expenditures of about $70M per year. Oversees and participates in extensive advancement activities as 

head, including managing and increasing the Dept. endowment of approximately $72M. Leads aggressive 

faculty hiring campaign that has hired 27 new tenure-track, 5 teaching, and 2 research faculty since Jan. 

2014. 

Director, Coordinated Science laboratory, UIUC, 2010-2014. 

Acting Director, Coordinated Science laboratory, UIUC, 2008-2010. 

Head of laboratory; responsible for research program with over 100 faculty members and 350 technical 

staff members. During Sanders's term as director, CSL's annual research expenditures rose from $17M to 

over $40M. It is a premier, multidisciplinary research laboratory that focuses on information technology 

at the crossroads of computing, control, and communications. During Sanders's tenure as director, ft was 

composed of 3 institutes (the Advanced Digital Sciences Center, the Information Trust Institute, and the 

Parallel Computing Institute) and 7 national centers (Center for Exascale Simulation of Plasma-Coupled 
28 

William H. Sanders 9/12/2017 

Combustion; Center for People and Infrastructures; CompGEN; the Health Care Engineering Systems 

Center; the National Center for Professional & Research Ethics; SONIC Systems on Nanoscale Information 

fabriCs; and TCIPG, the Trustworthy Cyber Infrastructure for the Power Grid Center). 

Associate Director, Advanced Digital Sciences Center, UIUC, 2009-Present. 

Co-founded Center in 2009; is Illinois-based lead of the center, responsible (together with director) for its 

overall operatlon. ADSC is a bricks-and-mortar research laboratory in Singapore, with 14 participating 

Illinois faculty, 57 full-time technical staff members, and about $70M U.S. in research funding (over 7 

years) from the government of Singapore. 

Donald Biggar Willett Professor of Engineering, Department of Electrical and Computer Engineering, UIUC, 

2005-Present. 

This named professorship was given to Sanders in 2005 for his contributions in dependability/security 

evaluation, reliable and secure systems, and computer systems modeling and analysis. 

Director, Information Trust Institute, UIUC, 2004-2011. 

Was founding Director; established the Institute and grew it to include over 100 faculty from 28 

departments, bringing in over $80M of external research funding and creating or helping create the TCIP 

and TCIPG (Trustworthy Cyber Infrastructure for the Power Grid) Centers, the Boeing Trusted Software 

Center, the Illinois Cyber Security Scholars Program, the Illinois Center for a Smarter Electric Grid, the 

Center for Assured Critical Application & Infrastructure Security (CACAIS), the Assured Cloud Computing 

University Center of Excellence, and an NSA Science of Security Lab let. 

Professor, Information Trust Institute, UIUC, 2004-Present. 

Professor, Department of Electrical and Computer Engineering, UIUC, 1998-Present. 

Professor, Coordinated Science Laboratory, UIUC, 1998-Present. 

Associate Professor, Department of Electrical and Computer Engineering, UIUC, 1994-1998. 

Research Associate Professor1 Coordinated Science Laboratory, UIUC, 1994-1998. 

Faculty Affiliate, Department of Computer Science, UIUC, 1994-Present. 

Associate Professor, Dept. of Electrical and Comp. Engineering, University of Arizona, Tucson, AZ, 1994. 

Assistant Professor, Dept. of Elect. and Comp. Engineering, Univ. of Arizona, Tucson, AZ, 1988-1994. 

Other Professional Employment 

Research Associate, Communications and Distributed Systems Laboratory, Industrial Technology Institute, 

Ann Arbor, Michigan, 1984-1988. 

Teaching Assistant, Department of Electrical and Computer Science, University of Michigan, 8/83-12/83. 

Digital Design Engineer, Optec, Inc., Lowell, Ml, 1981-1983. 

Areas of Research 
29 

Dependability/Security Evaluation 

Architecting Reliable and Secure Systems 

Computer Systems Modeling and Analysis 

Consulting Activities 

SUNY Albany, 2014 

Sterne, Kessler, Goldstein, and Fox, 2010-2012 

WW Technology Group, 2006-2008 

General Dynamics, 2006 

Motorola Computer Group, 2000-2001 

Motorola University, 1998-2001 

lA Tech, Inc., 1998-Present 

AT&T Bell Labs, 1996 

Motorola Satellite Communications, 1993-2000 

US West Advanced Technologies, 1991-1993 

Bell Communications Research, 1990 

Industrial Technology Institute, 1989 

Professional Societies 

Fellow, Institute of Electrical and Electronics Engineers 

Fellow, Association for Computing Machinery 

Fellow, American Association for the Adv<:~ncement of Science 

Past Vice-Chair, IFIP Working Group 10.4 on Dependable Computing 

Eta Kappa Nu 

Sigma Xi 

Awards and Honors, General 

William H. Sanders 9/12/2017 

(See "Invited Talks and Seminars" for a list of keynote addresses presented; see "Service" for a Jist of advisory 

board memberships and distinguished professional service; see "Paper Awards" for scholarly paper awards.) 

IEEE Technical Field Award, Innovation in Societal Infrastructure, for "assessment-driven design of 

trustworthy cyber infrastructures for societal-scale systems:' 2016. 

Named on the University of Illinois's Fall2015 List of Teachers Ranked as Excellent by Their Students. 

Named on the University of Illinois's Fall2014list of Teachers Ranked as Excellent by Their Students. 

Named Fellow of the American Association of the Advancement of Science (AAAS) for the development of 

fundamental theory and practical techniques to ensure that societ<:~l-scale distributed computing systems 

are trustworthy, 2014. 

NASA Tech Brief Award for NTR no 42352: "A Perform ability-Oriented Software Rejuvenation Framework 

for Distributed Applications," 2006. 

Named Fellow of the Association for Computing Machinery for "Outstanding contributions to the 

evaluation and design of dependable systems and networks," January 2004. 
30 

William H. Sanders 9/12/2017 

Named on the University of Illinois's Fall2003 Incomplete List of Teachers Ranked as Excellent by Their 

Students. 

Named on the University of Illinois's Fall2002 Incomplete List of Teachers Ranked as Excellent by Their 

Students. 

Recipient of one of the 2002 Engineering Council Awards for Excellence in Advising, awarded to the top 

10% of engineering advisors. (Selection is based on nominations from engineering students.) 

Recipient of one of the 2000 Engineering Council Awards for Excellence in Advising, awarded to the top 

10% of engineering advisors. (Selection is based on nominations from engineering students.) 

Named Fellow of the IEEE, for "Contributions to tools and techniques for performance and dependability 

evaluation of computer systems and networks," January 2000. 

Made Director of University of Illinois Motorola Center for High-Availability System Validation, established 

by Motorola Inc. in December 1999 with funding of $1.1 million dollars for a 3-year period. 

Recipient of one of the 1998 Engineering Council Awards for Excellence in Advising, awarded to the top 

10% of engineering advisors. (Selection is based on nominations from engineering students.) 

Elected member of IFIP Working Group 10.4 on Dependable Computing, July 1992 (youngest member ever 

elected). 

Recipient of Faculty Award, Digital Equipment Corporation, Incentives for Excellence, 1989, 1990, 1991. 

Twelve faculty members are selected nationally each year to receive this award. An individual can receive 

this award for a maximum of three years. ($7S,OOO cash prize, $10S,OOO in equipment). 

Member: Sigma Xi and Eta Kappa Nu academic honor societies. 

Paper Awards 

Paper "A Quantitative Methodology for Security Monitor Deployment" won the Best Paper Award at the 

46th AnnuaiiEEE/IFIP International Conference on Dependable Systems and Networks, Toulouse, France, 

June 28-July 1, 2016. 

Paper "ARIMA-Based Modeling and Validation of Consumption Readings in Power Grids" won the CIPRNet 

Young CRITIS Award (CYCA) at the lOth International Conference on Critical Information Infrastructures 

Security (CRITIS 201S), Berlin, Germany, Oct. S-7, 201S. 

Paper "PCA-Based Method for Detecting Integrity Attacks on Advanced Metering Infrastructure" won the 

Best Paper Award at the 12th International Conference on Quantitative Evaluation of Systems (QEST), 

Madrid, Spain, Sept. 1-3, 201S. 

Paper "Enterprise Security Metrics with the ADVISE Meta Model Formalism" won a Best Paper award at 

SECURWARE 201S: The Ninth International Conference on Emerging Security Information, Systems and 

Technologies, Venice, Italy, Aug. 23-28, 201S. 

Paper "Modeling the Fault Tolerance Consequences of Deduplication" won the Best Paper award at the 

30th IEEE Symposium on Reliable Distributed Systems (SRDS 2011), Madrid, Spain, Oct. S-7, 2011. 
31 

William H. Sanders 9/12/2017 

Paper "Biackbox Prediction of the Impact of DVFS on End-to-End Performance of Multitier Systems" won 

the award as Best Student Paper at the Green Metrics 2009 Workshop, Seattle, Washington, June 15, 2009. 

Paper 11 0etecting and Exploiting Symmetry in Discrete-State Markov Models" selected as one of the best 

papers at the 12th Pacific Rim International Symposium on Dependable Computing (PRDC'06); expanded 

version published in IEEE Transactions on Reliability. 

Paper "Designing Dependable Storage Solutions for Shared Application Environments" selected as one of 

the best papers at the International Conference on Dependable Systems and Networks (DSN-2006); 

expanded version accepted for publication in IEEE Transactions on Dependable and Secure Computing. 

Paper "Barbarians in the Gate: An Experimental Validation of NIC-based Distributed Firewall Performance 

and Flood Tolerance" selected as one of the best papers at the International Conference on Dependable 

Systems and Networks (DSN-2006). 

Paper "Formal Specification and Verification of a Group Membership Protocol for an Intrusion-Tolerant 

Group Communication System" won the award as the Best Paper presented at the 2002 Pacific Rim 

International Symposium on Dependable Computing (PRDC 2002) Tsukuba, Japan, December 16-18, 2002. 

Papers "The Mobius Modeling Tool" and "Mobius: Framework and Atomic Models" named as being among 

the best papers at the 9th International Workshop on Petri Nets and Performance Models, and then 

selected for publication {as a single paper) in an upcoming special issue of IEEE Transactions an Software 

Engineering. 

Paper "On the Effectiveness of a Message-Driven Confidence-Driven Protocol for Guarded Software 

Upgrading" selected as one of the best papers at IEEE IPDS 2000 {expanded version published in 

Performance Evaluation), 1999. 

Paper "Measure-Adaptive State-Space Construction" selected as one of the best papers at IEEE IPDS 2000 

{expanded version published in Performance Evaluation), 1999. 

Paper "State-Space Support for Path-based Reward Variables" selected as one of the best papers at IEEE 

IPDS '98 (expanded version to be published in Performance Evaluation), 1998. 

Paper ''An Efficient Disk-based Tool for Solving Very Large Markov Models" selected as one of the best 

papers at the 9th International Conference on Modelling Techniques and Tools (expanded version published 

in Performance Evaluation), 1997. 

Paper '"On-the-Fly' Solution Techniques for Stochastic Petri Nets and Extensions" selected as one of the 

best papers at IEEE PNPM-7 (expanded version published in IEEE Transactions an Software Engineering), 

1997. 

Paper "Algorithms for the Generation of State-Level Representations of Stochastic Activity Networks with 

General Reward Structures" selected as one of the best papers at IEEE PNPM-6 {expanded version published 

in IEEE Transactions on Software Engineering), 1995. 

Instructional Activities 

Course Development 
32 

William H. Sanders 9/12/2017 

1. Developed ECE 577, Computer System and Network Evaluation, course on analytic methods for the 

evaluation of computer systems and networks, Univ. of Arizona, ECE Dept., taught 1989, 1990, 1991, 

1992, 1993, 1994. 

2. Substantially revised and updated ECE 578, Introduction to Computer Networks, 

undergraduate/beginning graduate course on computer networks and protocols, Univ. of Arizona, 

ECE Dept., taught 1988, 1989, 1990, 1991, 1992, 1993, 1994. 

3. Course Director for ECE 311, Microcomputer Laboratory, University of Illinois, ECE Dept., 1994-. 

4. Developed and taught ECE 497WHS, Analytic Techniques for Computer System and Network 

Evaluation, Univ. of Illinois, ECE Dept., Spring 199S, Fall1997. 

5. Substantially revised and taught ECE/CS 441, Computer System Analysis, with Ravi lyer, University of 

Illinois, ECE Dept., 1996. 

6. Developed 16-hour short course for Motorola University entitled "Validating High-Availability 

Systems," 1998. 

7. Developed 24-hour short course for Motorola University entitled "UitraSAN: Modeling, Analyzing, and 

Simulating High-Availability Systems," 1999. 

Short Courses 

"Network Protocollnteroperability and Performance/Dependability Evaluation," May 31-June 2, 1989 (with R. 

Martinez). 

"Performance/Dependability Evaluation of Internetwork Environments," May 15-17, 1990 (with R. Martinez). 

"Protocol Performance Evaluation," presented to a class at Ft. Huachuca, AZ, Aug. 1991. 

"Performability Modeling with Stochastic Activity Networks," for US West Advanced Technologies, Aug. 17-

19, 1992. 

"Performability Evaluation using Stochastic Activity Networks," for Motorola Satellite Communications, Jan. 

1994. 

"UitraSAN Training Seminar," for Motorola Satellite Communications, August 1998. 

"Validating High-Availability Systems," for Motorola University, October 1998, December 1998, July 1999, 

September 1999, February 2000, May 2000, June 2000, August 2000, Sept. 2000, October 2000, and March 

2001. 

"UitraSAN Training Seminar," for Motorola University, February 1999. 

"UitraSAN: Modeling, Analyzing, and Simulating High-Availability Systems," for Motorola University, 

November 1999, February 2000, May 2000, and Sept. 2000. 

"Validating High-Availability Systems," for SUN Microsystems, Nov. 2000. 

Short course at the Department of Information Engineering at the University of Pisa, Italy, April 2006. 
33 

William H. Sanders 9/12/2017 

"Mobius: Modeling, Analyzing, and Simulating Systems," at General Dynamics, Aug. 2006. 

"Quantitative Evaluation of Security Metrics" tutorial presented at 2010 International Conference on 

Quantitative Evaluation of SysTems (QEST). 

"Cyber-Security in the Electrical Power Grid," short course taught along with Himanshu Khurana and David 

Nicol at the 44th Hawai'i International Conference on System Sciences, Kauai, Hawaii, Jan. 4, 2011 

Undergraduate Advising 

1. Served as representative for Computer Engineering at University of Illinois ECE Undergraduate Advising 

Fair, October 199S. 

2. Served as computer engineering representative at Coordinated Science Laboratory Orientation, Fall1996. 

3. Served as computer engineering representative at Graduate School Opportunities Seminar, Fall1996. 

4. Served as computer engineering representative at ECE Advising Fair, Spring 1997. 

S. Served as judge at ECE Undergraduate Research Symposium, April1997. 

6. Served as computer engineering representative at ECE Advising Fair, Fall1998. 

7. Served as computer engineering representative at ECE Advising Fair, Spring 1999. 

Research, Creative, and Other Scholarly Activities 

Books Edited 

M. Dal Cin, C. Meadows, and W. H. Sanders (eds.), Dependable Computing for Critical Applications 6, val. 11 

of Dependable Computing and Fault-Tolerant Systems (ed. A. Avizienis, H. Kopetz and J. C. Laprie), Los 

Alamitos, CA: IEEE Computer Society Press, 1998. 

P. Kemper and W. H. Sanders (eds.), Computer Performance Evaluation: Modeling Techniques and Tools, 

Lecture Notes in Computer Science, No. 2794 (ed. G. Goos, J. Hartmanis, and J. van Leeuwen), Berlin, 

Germany: Springer-Verlag, 2003. 

G. Norman and W. Sanders (eds.), Proceedings afthe 11th International Conference on Quantitative 

Evaluation of Systems {QEST 2014}, Lecture Notes in Computer Science, val. 86S7, Springer, 2014. 

Chapters in Books 

W. H. Sanders and J. F. Meyer, "Performance Variable Driven Construction Methods for Stochastic Activity 

Networks," in Computer Performance and Reliability (ed. G. lazeolla, P. J. Courtois, and 0. J. Boxma), 

Amsterdam: North-Holland, 1988, pp. 383-398. 
34 

William H. Sanders 9/12/2017 

W. H. Sanders and J. F. Meyer, "A Unified Approach for Specifying Measures of Performance, Dependability, 

and Perform ability," in Dependable Computing for Critical Applications, val. 4 of Dependable Computing and 

Fault-Tolerant Systems (ed. A. Avizienis, H. Kopetz and J.-C. Laprie), Springer-Verlag, 1991, pp. 215-237. 

J.D. Diener and W. H. Sanders, "Empirical Comparison of Uniformization Methods for Continuous-Time 

Markov Chains," in Computations with Markov Chains, (ed. William J. Stewart), Boston: Kluwer Academic 

Publishers, 1995, pp. 547-570. 

R. German, A. P. A. van Moorsel, W. H. Sanders, and M.A. Qureshi, "Expected Impulse Rewards in Markov 

Regenerative Stochastic Petri Nets," Application and Theory of Petri Nets 1996, Proc. 17th Int. Con f., Osaka, 

Japan, June 24-28, 1996, pp. 172-191 (ed. J. Billington and W. Reisig), Lecture Notes in Computer Science, val. 

1091, Springer-Verlag, 1996. 

J. F. Meyer and W. H. Sanders, "Specification and Construction of Performability Models," in Performobility 

Modelling: Techniques and Tools, (ed. B. R. Haverkort, R. Marie, G. Rubino, and K. S. Trivedi), John Wiley & 

Sons, 2001, pp. 179-222. 

W. H. Sanders and J. F. Meyer, "Stochastic Activity Networks: Formal Definitions and Concepts," in Lectures on 

Formal Methods and Performance Analysis: First EEF/Euro Summer School on Trends in Computer Science, 

Berg en Dol, The Netherlands, July 3-7, 2000 (ed. E. Brinksma, H. Hermanns, and J.-P. Katoen), Lecture Notes in 

Computer Science no. 2090, Berlin: Springer, 2001, pp. 315-343. 

H. V. Ramasamy, M. Cukier, and W. H. Sanders, "Formal Specification and Verification of a Group Membership 

Protocol for an Intrusion-Tolerant Group Communication System," in Foundations of Intrusion Tolerant 

Systems (Jay Lala, ed.), pp. 251-260. los Alamitos, CA: IEEE Computer Society, 2003. (Reprint of the 

conference paper with the same name.) 

H. V. Ramasamy, P. Pandey, J. lyons, M. Cukier, and W. H. Sanders, "Quantifying the Cost of Providing 

Intrusion Tolerance in Group Communication Systems," in Foundations of Intrusion Tolerant Systems (Jay La Ia, 

ed.), pp. 241-250. Los Alamitos, CA: IEEE Computer Society, 2003. (Reprint of the conference paper with the 

same name.) 

W. H. Sanders, T. Courtney, D. Deavours, D. Daly, S. Derisavi, and V. Lam, "Multi-formalism and Multisolution-method Modeling Frameworks: The Mobius Approach," Proceedings of the Symposium on 

Performance Evaluation- Stories and Perspectives, Vienna, Austria, December 5-6, 2003, pp. 241-256. 

R. Cunningham, S. Cheung, M. Fang, U. Lindqvist, D. Nicol, R. Pawlowski, E. Robinson, W. Sanders, S. Singh, A. 

Valdes, B. Woodworth, and M. Zhivich, "Securing Current and Future Process Control Systems," chapter 8 in 

E. Goetz and Sujeet Shenoi (eds.), Critical Infrastructure Protection. New York: Springer, 2008, pp. 99-115. 

Articles in Journals 

W. H. Sanders and J. F. Meyer, "Reduced Base Model Construction Methods for Stochastic Activity Networks," 

in IEEE Journal on Selected Areas in Communications, Special Issue on Computer-Aided Modeling, Analysis, 

and Design of Communication Networks, vol. 9, no. 1, Jan. 1991, pp. 2S-36. 

J. Couvillion, R. Freire, R. Johnson, W. D. Oballl, M.A. Qureshi, M. Rai, W. H. Sanders, and J.E. Tvedt, 

"Perform ability Modeling with UltroSAN," in IEEE Software, vol. 8, no. 5, Sept. 1991, pp. 69-80. 
35 

William H. Sanders 9/12/2017 

W. H. Sanders and L. M. Malhis, "Dependability Evaluation Using Composed SAN-Based Reward Models," in 

Journal of Parallel and Distributed Computing, Special issue on Petri Net Models of Parallel and Distributed 

Computers, vol. 15, no. 3, July 1992, pp. 238-254. 

W. H. Sanders, R. Martinez, Y. Alsafadi, and J. Nam, "Performance Evaluation of a Picture Archiving and 

Communication Network Using Stochastic Activity Networks," in IEEE Transactions on Medica/Imaging, vol. 

12, no. 1, Mar. 1993, pp. 19-29. 

K. Prodromides and W. H. Sanders, "Performability Evaluation of CSMA/CD and CSMA/DCR Protocols under 

Transient Fault Conditions," in IEEE Transactions on Reliability, val. 42, no. 1, Mar. 1993, pp. 116-127. 

B. P. Zeigler and W. H. Sanders, "Frameworks for Evaluating Discrete~Event Dynamic Systems," in Discrete 

Event Dynamic Systems: Theory and Applications, vol. 3, no. 2/3, July 1993, pp. 113-118 (guest editors' 

introduction). 

W. H. Sanders and R. S. Freire, "Efficient Simulation of Hierarchical Stochastic Activity Network Models," in 

Discrete Event Dynamic Systems: Theory and Applications, val. 3, no. 2/3, July 1993, pp. 271-300. 

W. H. Sanders, L.A. Kant, and A. S. Kudrimoti, "A Modular Method for Evaluating the Performance of Picture 

Archiving and Communication Systems," in Journal of Digital imaging, vol. 6, no. 3, Aug. 1993, pp. 172-193. 

W. D. Oballl and W. H. Sanders, "Importance Sampling Simulation in Ultra SAN," in Simulation, vol. 62, no. 2, 

Feb. 1994, pp. 98-111. 

A. P. A. van Moorsel and W. H. Sanders, "Adaptive Uniformization," in ORSA Communications in Statistics: 

Stochastic Models, vol. 10, no. 3, August 1994, pp. 619-648. 

M.A. Qureshi and W. H. Sanders, "Reward Model Solution Methods with Impulse and Rate Rewards: An 

Algorithm and Numerical Results," in Performance Evaluation, vol. 20, 1994, pp. 413-436. 

W. H. Sanders, W. D. Oballl, M.A. Qureshi, and F. K. Widjanarko, "The UltraSAN Modeling Environment," in 

Performance Evaluation, vol. 24, no. 1, Oct.-Nov. 1995, pp. 89-115. 

L. M. Mal his, W. H. Sanders, and R. D. Schlichting, "Numerical Performability Evaluation of a Group Multicast 

Protocol," in lEE Distributed Systems Engineering Journal, Special Issue on Performance Modelling of 

Distributed Systems (ed. Peter G. Harrison), vol. 3, no.1, March 1996, pp. 39-52. 

M.A. Qureshi and W. H. Sanders, "The Effect of Workload on the Performance and Availability of Voting 

Algorithms," in Microelectronics and Reliability, Special Issue on Performance Modeling and Reliability 

Analysis, June 1996, vol. 36, no. 6, pp. 757-774. 

M.A. Qureshi, W. H. Sanders, A. P. A. van Moorsel, and R. German, "Algorithms for the Generation of StateLevel Representations of Stochastic Activity Networks with General Reward Structures," in IEEE Transactions 

on Software Engineering, vol. 22, no. 9, September 1996, pp. 603-614. 

L. M. Mal his and W. H. Sanders, "An Efficient Two-Stage Iterative Method for the Steady-State Analysis of 

Markov Regenerative Stochastic Petri Net Models," in Performance Evaluation, vols. 27&28, 1996, pp. 583-

601. 
36 

William H. Sanders 9/12/2017 10 

L. Kant and W. H. Sanders, "Analysis of the Distribution of Consecutive Cell Losses in an ATM Switch Using 

Stochastic Activity Networks," in Special Issue of International Journal of Computer Systems Science & 

Engineering on ATM Switching, val. 12, no. 2, March 1997, pp. 117-129. 

A. P. A. van Moorsel and W. H. Sanders, "Transient Solution of Markov Models by Combining Adaptive & 

Standard Uniformization," in IEEE Transactions on Reliability, val. 46, no. 3, Sept. 1997, pp. 430-440. 

L. Kant and W. H. Sanders, "Performance Analysis of the Knockout Switch under Bursty Traffic Based on a 

Stochastic Activity Network Model," in Simulation: Special Issue on Performance Analysis of A TM Networks, 

val. 70, no. 1, Jan. 1998, pp. 19-33. 

D. D. Deavours and W. H. Sanders, "An Efficient Disk-based Tool lor Solving Large Markov Models," in 

Performance Evaluation, vol. 33, 1998, pp. 67-84. 

D. D. Deavours and W. H. Sanders, "'On-the-Fly' Solution Techniques for Stochastic Petri Nets and 

Extensions," in IEEE Transactions on Software Engineering, val. 24, no. 10, Oct. 1998, pp. 889-902. 

G. Chiola and W. H. Sanders, "Guest Editorial: Introduction to the Special Section on the 7th International 

Workshop on Petri Nets and Performance Models (PNPM'97)," IEEE Transactions on Software Engineering, 

val. 25, no. 2, Mar./ Apr. 1999, pp. 145-146. 

W. D. Oballl and W. H. Sanders, "State-Space Support for Path-based Reward Variables," Performance 

Evaluation, val. 35, 1999, pp. 233-251. 

C. Meadows and W. H. Sanders, "Guest Editorial: Introduction to the Special Section on the Sixth IFIP 

International Working Conference on Dependable Computing lor Critical Applications (DCCA-6)," IEEE 

Transactions on Software Engineering, val. 25, no. 5, Sept./Oct. 1999, pp. 601-602. 

Y. Ren, M. Cukier, and W. H. Sanders, "An Adaptive Algorithm for Tolerating Value Faults and Crash Failures," 

IEEE Transactions on Parallel and Distributed Systems, val. 12, no. 2, Feb. 2001, pp. 173-192. 

W. D. Oballl and W. H. Sanders, "Measure-Adaptive State-Space Construction," Performance Evaluation, 

Special Issue on IPOS 2000, val. 44, no. 1-4, Apr. 2001, pp. 237-258. 

A. T. Tai, K. S. Tso, L. Alkalai, S. N. Chau, and W. H. Sanders, "On the Effectiveness of a Message-Driven 

Confidence-Driven Protocol for Guarded Software Upgrading," Performance Evaluation, val. 44, no. 1-4, April 

2001, pp. 211-236. 

A. T. Tai, K. S. Tso, L. Alkalai, S. N. Chau, and W. H. Sanders, "Low-Cost Error Containment and Recovery for 

Onboard Software Upgrading and Beyond," IEEE Transactions on Computers, val. 51, no. 2, February 2002, pp. 

121-137. 

D. D. Deavours, G. Clark, T. Courtney, D. Daly, S. Derisavi, J. M. Doyle, W. H. Sanders, and P. G. Webster, "The 

Mobius Framework and Its Implementation," IEEE Transactions an Software Engineering, val. 28, no. 10, 

October 2002, pp. 956-969. 

Y. (J.) Ren, D. E. Bakken, T. Courtney, M. Cukier, D. A. Karr, P. Rubel, C. Sabnis, W. H. Sanders, R. E. Schantz, 

and M. Seri, "AQuA: An Adaptive Architecture that Provides Dependable Distributed Objects," IEEE 

Transactions on Computers, val. 52, no. 1, January 2003, pp. 31-50. 
37 

William H. Sanders 9/12/2017 11 

S. Derisavi, H. Hermanns, and W. H. Sanders, "Optimal State-Space Lumping in Markov Chains," Information 

Processing Letters, vol. 87, no. 6, September 30, 2003, pp. 309-315. 

S. Derisavi, P. Kemper, W. H. Sanders, and T. Courtney, "The Mobius State-level Abstract Functional 

Interface," Performance Evaluation, vol. 54, no. 2, October 2003, pp. 105-128. 

S. Krishnamurthy, W. H. Sanders, and M. Cukier, "An Adaptive Quality of Service Aware Middleware for 

Replicated Services," Transactions on Parallel and Distributed Systems, vol. 14, no. 11, Nov. 2003, pp. 1112-

1125. 

H. V. Ramasamy, M. Cukier, and W. H. Sanders, "Formal Verification of an Intrusion-Tolerant Group 

Membership Protocol," JEICE Transactions on Information and Systems special issue on Dependable 

Computing, vol. E86-D, no. 12, December 2003, pp. 2612-2622. 

D. M. Nicol, W. H. Sanders, and K. S. Trivedi, "Model-Based Evaluation: From Dependability to Security," IEEE 

Transactions on Dependable and Secure Computing, val. 1, no. 1, January-March 2004, pp. 48-65. 

A. T. Tai, W. H. Sanders, L Alkalai, S. N. Chau, and K. S. Tso, "Performability Analysis of Guarded-Operation 

Duration: A Translation Approach for Reward Model Solutions," Performance Evaluation, val. 56, no. 1-4, 

March 2004, pp. 249-276. 

S. Derisavi, P. Kemper, and W. H. Sanders, "Symbolic State-space Exploration and Numerical Analysis of Statesharing Composed Models," Linear Algebra and Its Applications (LAA), vol. 386, July 15, 2004, pp. 137-166. 

R. Chandra, R. M. Lefever, K. R. Joshi, M. Cukier, and W. H. Sanders, "A Global-State-Triggered Fault Injector 

for Distributed System Evaluation," IEEE Transactions on Parallel and Distributed Systems, vol. 15, no. 7, July 

2004, pp. 593-605. 

5. Singh, A. Agbaria, F. Stevens, T. Courtney, J. F. Meyer, W. H. Sanders, and P. Pal, "Validation of a Survivable 

Publish-Subscribe System," International Scientific Journal of "Computing," vol. 4, no. 2, 2005. 

P. Pal, P. Rubel, M. Atighetchi, F. Webber, W. H. Sanders, M. Seri, H. Ramasamy, J. Lyons, T. Courtney, A. 

Agbaria, M. Cukier, J. Gossett, and I. Keidar, "An Architecture for Adaptive Intrusion-Tolerant Applications," 

special issue of Software: Practice and Experience on Experiences with Auto-adaptive and Reconfigurable 

Systems, vol. 36, no. 11-12, September-October 2006, pp. 1331-1354. 

M. Griffith, T. Courtney, J. Peccoud, and W. H. Sanders, "Dynamic Partitioning for Hybrid Simulation of the 

Bistable HIV-1 Transactivation Network," Bioinformatics, vol. 22, no. 22, 2006, pp. 2782-2789. 

P. Kemper and W. H. Sanders, "Modelling Techniques and Tools for Computer Performance Evaluation," 

Performance Evaluation, vol. 63, no. 6, 2006, pp. 521-523. 

H. V. Ramasamy, A. Agbaria, and W. H. Sanders, "A Parsimonious Approach for Obtaining Resource-Efficient 

and Trustworthy Execution," featured article in IEEE Transactions on Dependable and Secure Computing, vol. 

4, no. 1, January-March 2007, pp.1-17. 

D. Daly, P. Buchholz, and W. H. Sanders, "A Preorder Relation for Markov Reward Processes," Statistics and 

Probability Letters, vol. 77, no. 11, 2007, pp. 1148-1157. 

W. D. Oballl, M.G. McQuinn, and W. H. Sanders, "Detecting and Exploiting Symmetry in Discrete-State 

Markov Models," IEEE Transactions on Reliability, vol. 56, no. 4, December 2007, pp. 643-654. 
38 

William H. Sanders 9/12/2017 12 

J. Peccoud, T. Courtney, W. H. Sanders, "Mobius: An Integrated Discrete-Event Modeling Environment," 

Bioinformatics, val. 23, no. 24, 2007, pp, 3412-3414. 

H. V. Ramasamy, P. Pandey, M. Cukier, and W. H. Sanders, "Experiences with Building an Intrusion-Tolerant 

Group Communication System," Software-Practice and Experience, vaL 38, no. 6, May 2008, pp. 639-666. 

D. M. Nicol, W. H. Sanders, S. Singh, and M. Seri, "Usable Global Network Access Policy for Process Control 

Systems," IEEE Security & Privacy, vaL 6, no. 6, November-December 2008, pp. 30-36. 

S. Gaonkar, K. Keefe, R. Lamprecht, E. Rozier, P. Kemper, and W. H. Sanders, "Performance and Dependability 

Modeling with Mobius," ACM SIGMETRICS Performance Evaluation Review, vaL 36, no. 4, March 2009, pp. 16-

21. 

W. Sanders, "Toward a Resilient Smart Grid," ieRoadmap News, quarter 1, 2010, p. 2. 

s. Chen, K. R. Joshi, M.A. Hiltunen, R. D. Schlichting, and W. H. Sanders, "Biackbox Prediction of the Impact of 

DVFS on End-to-End Performance of Multitier Systems," ACM SIGMETRICS Performance Evaluation Review 

(special issue with Proceedings of GreenMetrics 2009 Workshop, Seattle, Washington, June 15, 2009), vaL 37, 

no. 4, March 2010, pp. S9-63. (Received Best Student paper award at Green Metrics 2009.) 

S. Gaonkar, K. Keeton, A. Merchant, and W. H. Sanders, "Designing Dependable Storage Solutions for Shared 

Application Environments," IEEE Transactions on Dependable and Secure Computing, val. 7, no. 4, OctoberDecember 2010, pp. 366-380. 

S. Gaonkar, K. Keeton, A. Merchant, and W. H. Sanders, "Designing Dependable Storage Solutions for Shared 

Application Environments," Computing Now, March 2010, online. http://www.computer.org/portal/web/ 

computingnow/0310/theme/tdsc. (Preprint of the IEEE Transactions on Dependable and Secure Computing 

paper.) 

S. Chen, K. R. Joshi, M.A. Hiltunen, R. D. Schlichting, and W. H. Sanders, "Using CPU Gradients for 

Performance-Aware Energy Conservation in Multitier Systems," Sustainable Computing: Informatics and 

Systems, vaL 1, no. 2, June 2011, pp. 113-133. 

S. Chen, K. R. Joshi, M.A. Hiltunen, R. D. Schlichting, and W. H. Sanders, "Using Link Gradients to Predict the 

Impact of Network Latency on Multitier Applications," IEEE/ACM Transactions on Networking, val. 19, no. 3, 

June 2011, pp. 8S5-868. 

K. R. Joshi, M.A. Hiltunen, W. H. Sanders, and R. D. Schlichting, "Probabilistic Model-Driven Recovery in 

Distributed Systems," IEEE Transactions on Dependable and Secure Computing, val. 8, no. 6, 

November/December 2011, pp. 913-928. 

R. B. Bobba, J. Dagle, E. Heine, H. Khurana, W. H. Sanders, P. Sauer, and T. Yardley, "Enhancing Grid 

Measurements: Wide Area Measurement Systems, NASPinet, and Security," IEEE Power & Energy Magazine, 

val. 10, no. 1, January-February 2012, pp. 67-73. 

s. Zonouz, K. M. Rogers, R. Berthier, R. B. Bobba, W. H. Sanders, and T. J. Overbye, "SCPSE: Security-Oriented 

Cyber-Physical State Estimation for Power Grid Critical Infrastructures," IEEE Transactions on Smart Grid, val. 

3, no. 4, December 2012, pp. 1790-1799. 
39 

William H. Sanders 9/12/2017 13 

S. Zonouz, C. M. Davis, K. R. Davis, R. Berthier, R. B. Bobba, and W. H. Sanders, "SOCCA: A Security-Oriented 

Cyber-Physical Contingency Analysis in Power Infrastructures," IEEE Transactions on Smart Grid, val. 5, no. 1, 

January 2014, pp. 3-13. 

S. A. Zonouz, H. Khurana, W. H. Sanders, and T. M. Yardley, "RRE: A Game-Theoretic Intrusion Response and 

Recovery Engine," IEEE Transactions on Parallel and Distributed Systems, val. 25, no. 2, Feb. 2014, pp. 395-

406. 

A. A. C;]rdenas, R. Berthier, R. B. Bobba, J. H. Huh, J. G. Jetcheva, D. Grochocki, and W. H. Sanders, "A 

Framework for Evaluating Intrusion Detection Architectures in Advanced Metering Infrastructures," IEEE 

Transactions on Smart Grid, val. 5, no. 2, Mar. 2014, pp. 906-915. 

W. H. Sanders, "Quantitative Security Metrics: Unattainable Holy Grail, or a Vital Breakthrough within Our 

Reach?" IEEE Security & Privacy, val. 12, no. 2, Mar.-Apr. 2014, pp. 67-69. 

A. Fawaz, R. Berthier, and W. H. Sanders, "A Response Cost Model for Advanced Metering Infrastructures," 

IEEE Transactions on Smart Grid, val. 7, no. 2, March 2016, pp. 543-553. 

Articles in Conference Proceedings 

J. F. Meyer, A. Movaghar, and W. H. Sanders, "Stochastic Activity Networks: Structure, Behavior, and 

Application," in Proc. Int. Conf on Timed Petri Nets, Torino, Italy, July 1985, pp. 106-115. 

W. H. Sanders and J. F. Meyer, "METASAN: A Performability Evaluation Tool Based on Stochastic Activity 

Networks," in Proc. IEEE-ACM Fall Joint Camp. Conf, Dallas, TX, Nov. 1986, pp. 807-816. 

W. H. Sanders and J. F. Meyer, "Performability Evaluation of Distributed Systems Using Stochastic Activity 

Networks," in Proc. Int. Workshop on Petri Nets and Performance Models, Madison, WI, Aug. 24-26, 1987, pp. 

111-120. 

J. F. Meyer, K. H. Muralidhar, and W. H. Sanders, "Perform ability of a Token Bus Network under Transient 

Fault Conditions," in Prac. 19th Int. Symposium an Fault-Tolerant Computing, Chicago, IL, June 1989, pp. 175-

182. 

W. H. Sanders and J. F. Meyer1 "Reduced Base Model Construction Methods for Stochastic Activity Networks/' 

in Prac. Third Int. Workshop an Petri Nets and Performance Models, Kyoto, Japan, Dec. 11-13, 1989, pp. 74-84. 

R. Martinez, W. H. Sanders, Y. Alsafadi, J. Nam, T. Ozeki, and K. Komatsu, "Performance Evaluation of a 

Structured PACS Using Stochastic Activity Networks," in Prac. Medica/Imaging IV, SPIE Conference on Medical 

Imaging, Newport Beach, CA, Feb. 4-9,1990, pp. 167-178. 

Y. Alsafadi, W. H. Sanders, and R. Martinez, "Evaluation of a Structured PACS with Combined Voice and Data 

Traffic," in Proc. Medical Imaging IV, SPIE Conference on Medical Imaging, Newport Beach, CA, Feb. 4-9, 1990, 

pp. 484-494. 

Y. Alsafadi, R. Martinez, and W. H. Sanders, "Definition and Evaluation of the Data Link Layer of PAC net," in 

Proc. Medical Imaging V, SPIE Conference on Medical Imaging, San Jose, CA, Feb. 23-Mar. 1, 1991, pp. 129-

140. 
40 

William H. Sanders 9/12/2017 14 

K. H. Prod rom ides and W. H. Sanders, "Performability Evaluation of CSMA/CD and CSMA/DCR Protocols under 

Transient Fault Conditions," in Proc. Tenth Symposium on Reliable Distributed Systems, Pisa, Italy, Sept. 30-

0ct. 2, 1991, pp. 166-176. 

J. Couvillion, R. Freire, R. Johnson, W. D. Obal II, M.A. Qureshi, M. Rai, W. H. Sanders, and J. E. Tvedt, 

"Performability Modeling with UltraSAN," in Proceedings of the 4th International Workshop on Petri Nets and 

Performance Models, Melbourne, Australia, Dec. 2-5, 1991, pp. 290-299. 

A. S. Kudrimoti and W. H. Sanders, "A Modular Method for Evaluating the Performance of Picture Archiving 

and Communication Systems," in Proc. Fifth IEEE Computer Based Medical Systems Symposium, Durham, NC, 

June 14-17,1992, pp. 44-53. 

W. D. Oballl and W. H. Sanders, "A Model Based Foundation for Evaluating Large Scale Telecommunication 

Systems," in Proc. 12th Annual IEEE Int. Phoenix Con f. on Computers and Communications, Phoenix, AZ, Mar. 

23-26, 1993, pp. 367-369. 

W. H. Sanders and W. D. Oballl, "Dependability Modeling Using Ultra SAN," in Proc. 23rd Int. Symposium on 

Fault-Tolerant Computing, Toulouse, France, June 22-24,1993, pp. 674-679. 

J. F. Meyer and W. H. Sanders, "Specification and Construction of Performability Models," Proc. Second Int. 

Workshop on Perform ability Modeling of Computer and Communication Systems, Mont. Saint-Michel, France, 

June 28-30, 1993. 

B. Shen, J. G. Williams, and W. H. Sanders, "Performability of Signal Validation Systems Using Stochastic 

Activity Networks," in Proc. Transactions of the American Nuclear Society, San Francisco, CA, Nov. 1993, val. 

68, pp. 147-148. 

W. D. Oballl and W. H. Sanders, "An Environment for Importance Sampling Based on Stochastic Activity 

Networks," in Proc. 13th Symp. on Reliable Distributed Systems, Dana Point, CA, Oct. 1994, pp. 64-73. 

M.A. Qureshi and W. H. Sanders, "The Effect of Workload on the Performance and Availability of Voting 

Algorithms," in Proc. International Workshop on Modeling, Analysis, and Simulation of Computer and 

Telecommunication Systems (MASCOTS '95), Durham, NC, Jan. 18-20, 1995, pp. 217-224. 

W. H. Sanders, W. D. Oballl, M.A. Qureshi} and F. K. Widjanarko, "UftraSAN Version 3: Architecture, Features, 

and Implementation," in Proc. AIAA Computing in Aerospace 10 Conference, San Antonio, TX, Mar. 28-30, 

1995, pp. 327-338. 

L. M. Mal his, S.C. West, L.A. Kant, and W. H. Sanders, "Modeling Recycle: A Case Study in the Industrial Use 

of Measurement and Modeling," in Proc. Int. Computer Performance and Dependability Symposium, Erlangen, 

Germany, Apr. 24-26, 1995, pp. 285-294. 

A. Kuratti and W. H. Sanders, "Performance Analysis of the RAID 5 Disk Array," in Proc. Int. Computer 

Performance and Dependability Symposium, Erlangen, Germany, Apr. 24-26, 1995, pp. 236-245. 

L.A. Kant and W. H. Sanders, "Loss Process Analysis of the Knockout Switch Using Stochastic Activity 

Networks," in Proc. Fourth Int. Conference on Computer Communications and Networks, Las Vegas, NV, Sept. 

20-23, 1995, pp. 344-349. 
41 

William H. Sanders 9/12/2017 15 

D. D. Deavours, W. D. Oballl, M.A. Qureshi, W. H. Sanders, and A. P. A. van Moorsel, "UitraSAN Version 3 

Overview," in Proc. Sixth Int. Workshop on Petri Nets and Performance Models, Durham, NC, Oct. 3-6, 1995, 

pp. 216-217. 

L. M. Mal his, W. H. Sanders, and R. D. Schlichting, "Numerical Evaluation of a Group Oriented Multicast 

Protocol Using Stochastic Activity Networks," in Proc. Sixth Int. Workshop on Petri Nets and Performance 

Models, Durham, NC, Oct. 3-6, 199S, pp. 63-72. 

M.A. Qureshi, W. H. Sanders, A. P. A. van Moorsel, and R. German, "Algorithms for the Generation of StateLevel Representations of Stochastic Activity Networks with General Reward Structures," in Proc. Sixth Int. 

Workshop on Petri Nets and Performance Models, Durham, NC, Oct. 3-6, 199S, pp. 180-190. 

A. P. A. van Moorsel, L.A. Kant, and W. H. Sanders, "Computation of the Asymptotic Bias and Variance for 

Simulation of Markov Reward Models," Proc. 29th Annual Simulation Symposium, New Orleans, LA, April8-11, 

1996, pp. 173-182. 

M.A. Qureshi and W. H. Sanders, "A New Methodology for Calculating Distributions of Reward Accumulated 

During a Finite Interval," in Proc. 26th Int. Symposium on Fault-Tolerant Computing, Sendai, Japan, June 25-

27, 1996, pp. 116-12S. 

W. D. Oballl, M.A. Qureshi, D. D. Deavours, and W. H. Sanders, "Overview of UltraSAN," Proc. IEEE Int. 

Performance and Dependability Symposium, Urbana, IL, Sept. 4-6, 1996. 

W. Richardson, M. L. Bailey, and W. H. Sanders, "Using ZPL to Develop a Parallel Chaos Router Simulator," 

Winter Simulation Conference, Coronado, CA, Dec. 8-11, 1996. 

D. D. Deavours and W. H. Sanders, '"On-the-fly' Solution Techniques for Stochastic Petri Nets and Extensions," 

Proceedings of 7th International Workshop on Petri Nets and Performance Models (PNPM) '97, Saint Malo, 

France, June 3-6, 1997, pp. 132-141. 

D. D. Deavours and W. H. Sanders, "A Efficient Disk-based Tool for Solving Very Large Markov Models," in 

Raymond Marie et al. (Eds.), Computer Performance Evaluation: Proceedings of the 9th International 

Conference on Modelling Techniques and Tools, St. Malo, France, June 3-6, 1997 (Lecture Notes in Computer 

Science, no. 1245), Berlin: Springer, 1997, pp. 58-71. 

H. Madeira and W. H. Sanders, "Model- and Experiment-based Evaluation Tools: Tool Demonstration 

Sessions," in Proceedings of the 27th International Symposium on Fault-Tolerant Computing, Seattle, WA, 

June 24-27, 1997, p. 270. 

H. S. Duggal, M. Cukier, and W. H. Sanders, "Probabilistic Verification of a Synchronous Round-based 

Consensus Protocol," Proceedings of the Sixteenth IEEE Symposium on Reliable Distributed Systems (SRDS-97), 

Durham, North Carolina, October 22-24, 1997, pp. 165-174. 

G. P. Kavanaugh and W. H. Sanders, "Performance Analysis ofTwo Time-Based Coordinated Checkpointing 

Protocols," Proceedings of the 1997 Pacific Rim International Symposium on Fault Tolerant Systems (PRFTS), 

Taipei, Taiwan, December 15-16, 1997, pp. 194-201. 

W. D. Oballl and W. H. Sanders, "State-Space Support for Path-based Reward Variables," Proceedings of the 

IEEE International Computer Performance and Dependability Symposium (IPDS '98), September 7-9, 1998, pp. 

228-237. 
42 

William H. Sanders 9/12/2017 16 

M. Cukier, J. Ren, C. Sabnis, D. Henke, J. Pistole, W. H. Sanders, D. E. Bakken, M. E. Berman, D. A. Karr, and R. 

E. Schantz, "AQuA: An Adaptive Architecture That Provides Dependable Distributed Objects," Proceedings of 

the 17th IEEE Symposium on Reliable Distributed Systems, October 20-23, 1998, Purdue University, West 

Lafayette, IN, USA, pp. 245-253. 

C. Sabnis, M. Cukier, J. Ren, P. Rubel, W. H. Sanders, D. E. Bakken, and D. A. Karr, "Proteus: A Flexible 

Infrastructure to Implement Adaptive Fault Tolerance in AQuA," in C. B. Weinstock and J. Rush by (Eds.), 

Dependable Computing for Critical Applications 7, val. 12 in series Dependable Computing and Fault-Tolerant 

Systems (A. Avizienis, H. Kopetz, and J. C. Laprie, Eds.), pp. 149-168. Los Alamitos, CA: IEEE Computer Society, 

1999. 

D. Daly, D. D. Deavours, J. M. Doyle, A. J. Stillman, P. G. Webster, and W. H. Sanders, "Mobius: An Extensible 

Framework for Performance and Dependability Modeling," Tool Descriptions from the Multi-Workshop on 

Formal Methods in Performance Evaluation and Applications, Zaragoza, Spain, Sept. 6-10, 1999. 

D. D. Deavours and W. H. Sanders, "An Efficient Well-Specified Check," Proceedings of PNPM'99: 8th 

International Workshop on Petri Nets and Performance Models, Zaragoza, Spain, Sept. 8-10, 1999, pp. 124· 

133. 

W. H. Sanders, "Integrated Frameworks for Multi-Level and Multi-Formalism Modeling," Proceedings of 

PNPM'99: 8th International Workshop on Petri Nets and Performance Models, Zaragoza, Spain, Sept. 8-10, 

1999, pp. 2-9. 

M. Cukier, R. Chandra, D. Henke, J. Pistole, and W. H. Sanders, "Fault Injection Based on a Partial View of the 

Global State of a Distributed System," Proceedings of the 18th IEEE Symposium on Reliable Distributed 

Systems (SRDS), Lausanne, Switzerland, October 19-22, 1999, pp. 168-177. 

A. T. Tai, K. S. Tso, L. Alkalai, S. N. Chau, and W. H. Sanders, "On-Board Guarded Software Upgrading for Space 

Missions," Proceedings of the 18th Digital Avionics Systems Conference, St. Louis, MO, October 24-29, 1999, 

pp. 7.B.4-1.i.St. Lou 

J. Ren, M. Cukier, P. Rubel, W. H. Sanders, D. E. Bakken, and D. A. Karr, "Building Dependable Distributed 

Applications Using AQuA," Proceedings of the 4th IEEE International Symposium on High-Assurance Systems 

Engineering {HASE '99}, Washington, D.C., November 17-19, 1999, pp. 189-196. 

D. Daly, D. D. Deavours, J. M. Doyle, P. G. Webster, and W. H. Sanders, "Mobius: An Extensible Tool for 

Performance and Dependability Modeling," Computer Performance Evaluation: Modelling Techniques and 

Tools: Proceedings of the 11th International Conference, TOOLS 2000, Schaumburg, IL, March 27-31,2000. In 

B. R. Haverkort, H. C. Bohnenkamp, and C. U. Smith (Eds.), Lecture Notes in Computer Science No. 1786, pp. 

332-336. Berlin: Springer, 2000. 

A. T. Tai, K. S. Tso, L. Alkalai, S. N. Chau, and W. H. Sanders, "On the Effectiveness of a Message-Driven 

Confidence-Driven Protocol for Guarded Software Upgrading," Proceedings of the 4th IEEE International 

Computer Performance and Dependability Symposium {IPDS 2000), Chicago, IL, March 27-29, 2000, pp. 59-68. 

W. D. Oballl and W. H. Sanders, "Measure-Adaptive State-Space Construction," Proceedings of the 4th IEEE 

International Computer Performance and Dependability Symposium (IPDS 2000), Chicago, IL, March 27-29, 

2000, pp. 25-34. 
43 

William H. Sanders 9/12/2017 17 

A. T. Tai, K. S. Tso, L. Alkalai, S. N. Chau, and W. H. Sanders, "On Low-Cost Error Containment and Recovery 

Methods for Guarded Software Upgrading," Proceedings of ICDCS 2000: The 20th International Conference on 

Distributed Computing Systems, Taipei, Taiwan, Republic of China, Aprill0-13, 2000, pp. 548-555. 

R. Chandra, R. M. Lefever, M. Cukier, and W. H. Sanders, "Loki: A State-Driven Fault Injector for Distributed 

Systems," Proceedings of the International Conference on Dependable Systems and Networks (DSN-2000}, 

New York, NY, June 25-28, 2000, pp. 237-242. 

R. Chandra, M. Cukier, R. M. Lefever, and W. H. Sanders, "Dynamic Node Management and Measure 

Estimation in a State-Driven Fault Injector," Proceedings of the 19th IEEE Symposium on Reliable Distributed 

Systems {SRDS 2000}, Nurnberg, Germany, October 16-18, 2000, pp. 248-257. 

D. Daly and W. H. Sanders, "A Connection Formalism for the Solution of Large and Stiff Models," Proceedings 

of the 34th Annual Simulation Symposium, Seattle, WA, April 22-26, 2001, pp. 258-265. 

S. Krishnamurthy, W. H. Sanders, and M. Cukier, "A Dynamic Replica Selection Algorithm for Tolerating Timing 

Faults," Proceedings of the International Conference on Dependable Systems and Networks {DSN 2001), 

Giiteborg, Sweden, July 1-4, 2001, pp. 107-116. 

A. T. Tai, K. S. Tso, L. Alkalai, S. N. Chau, and W. H. Sanders, "Synergistic Coordination Between Software and 

Hardware Fault Tolerance Techniques," Proceedings of the International Conference on Dependable Systems 

and Networks {DSN-2001}, Giiteborg, Sweden, July 1-4, 2001, pp. 369-378. 

M. Cukier, J. Lyons, P. Pandey, H. V. Ramasamy, W. H. Sanders, P. Pal, F. Webber, R. Schantz, J. Loyall, R. 

Watro, M. Atighetchi, and J. Gossett, "Intrusion Tolerance Approaches in ITUA," Fast Abstract in Supplement 

of the International Conference on Dependable Systems and Networks {DSN-2001}, Giiteborg, Sweden, July 1-

4, 2001, pp. B-64 to B-65. 

M. Seri, T. Courtney, M. Cukier, and W. H. Sanders, "An Overview of the AQuA Gateway," 1st Workshop on 

The ACE ORB (TAO), St. Louis, MO, August 5-6, 2001. (Presented but not published in a proceedings.) 

G. Clark, T. Courtney, D. Daly, D. Deavours, S. Derisavi, J. M. Doyle, W. H. Sanders, and P. Webster, "The 

Mobius Modeling Tool," Proceedings of the 9th International Workshop on Petri Nets and Performance 

Models, Aachen, Germany, September 11-14,2001, pp. 241-250. 

D. D. Deavours and W. H. Sanders, "Mobius: Framework and Atomic Models," Proceedings of the 9th 

International Workshop an Petri Nets and Performance Models, Aachen, Germany, September 11-14, 2001, 

pp. 251-260. 

D. D. Deavours and W. H. Sanders, "The Mobius Execution Policy," Proceedings of the 9th International 

Workshop on Petri Nets and Performance Models, Aachen, Germany, September 11-14, 2001, pp. 135-144. 

P. Pal, F. Webber, R. Schantz, J. Loyall, R. Watro, W. Sanders, M. Cukier, and J. Gossett, "Survival by DefenseEnabling," Proceedings of the New Security Paradigms Workshop 2001, Cloudcroft, New Mexico, September 

11-13, 2001, pp. 71-78. 

G. Clark and W. H. Sanders, "Implementing a Stochastic Process Algebra within the Mobius Modeling 

Framework," Process Algebra and Probabilistic Methods: Performance Modelling and Verification: 

Proceedings of the Joint International Workshop, PAPM-PROBMIV 2001, Aachen, Germany, September 12-14, 

2001, Lecture Notes in Computer Science no. 2165, Berlin: Springer, 2001, pp. 200-215. 
44 

William H. Sanders 9/12/2017 18 

A. T. Tai and W. H. Sanders, "Product-in-Process Performability Modeling for Guarded Software Upgrading," 

Proceedings of the 5th International Workshop on Perform ability Modeling of Computer and Communication 

Systems, Erlangen, Germany, Sept. 15-16,2001, in the Arbeitsberichte des Institutes fUr lnformatik FriedrichAiexander-Universitiit Erlangen Nurnberg, val. 34, no. 13, September 2001, pp. 121-125. 

A. T. Tai, K. S. Tso, W. H. Sanders, L Alkalai, and S. N. Chau, "Low-Cost Flexible Software Fault Tolerance for 

Distributed Computing," Proceedings of the 12th International Symposium on Software Reliability Engineering 

(/SSRE 2001}, Hong Kong, November 27-30, 2001, pp. 148-157. 

5. Krishnamurthy, W. H. Sanders, and M. Cukier, "Performance Evaluation of a Probabilistic Replica Selection 

Algorithm," Proceedings of the 7th IEEE International Workshop on Object-oriented Real-time Dependable 

Systems (WORDS 2002), San Diego, California, January 7-9, 2002, pp. 119-127. 

5. Derisavi, P. Kemper, W. H. Sanders, and T. Courtney, "The Mobius State-level Abstract Functional 

Interface," Computer Performance Evaluation: Modelling Techniques and Tools: Proceedings of the 12th 

International Conference, TOOLS 2002, London, UK, April14-17, 2002, Lecture Nates in Computer Science val. 

2324 (T. field, P. G. Harrison, J. Bradley, and U. Harder, eds.), Berlin: Springer, pp. 31-50. 

W. H. Sanders, C. Polychronopoulos, T. Huang, T. Courtney, D. Daly, D. Deavours, and S. Derisavi, "Overview: 

An Integrated Framework for Performance Engineering and Resource-Aware Compilation," NSF Next 

Generation Systems Program Workshop, Ft. Lauderdale, FL, April15, 2002. (Presented but not published in a 

proceedings.) 

W. H. Sanders, C. Polychronopoulos, T. Huang, T. Courtney, D. Daly, D. Deavours, and S. Derisavi, "Overview: 

An Integrated Framework for Performance Engineering and Resource-Aware Compilation," Proceedings of the 

International Parallel and Distributed Processing Symposium (/POPS '02}, Fort Lauderdale, Florida, April15-19, 

2002, pp.173-180. 

S. Krishnamurthy, W. H. Sanders, and M. Cukier, "Performance Evaluation of a QoS-Aware Framework for 

Providing Tunable Consistency and Timeliness," Proceedings of the 2002 lOth IEEE International Workshop on 

Quality of Service (IWQoS 2002}, Miami Beach, Florida, May 15-17,2002, pp. 214-223. 

S. Krishnamurthy, W. H. Sanders, and M. Cukier, "An Adaptive Framework for Tunable Consistency and 

Timeliness Using Replication," Proceedings of the International Conference on Dependable Systems and 

Networks (OSN-2002), Washington, D.C., June 23-26, 2002, pp. 17-26. 

H. V. Ramasamy, P. Pandey, J. Lyons, M. Cukier, and W. H. Sanders, "Quantifying the Cost of Providing 

Intrusion Tolerance in Group Communication Systems," Proceedings of the International Conference on 

Dependable Systems and Networks (OSN-2002}, Washington, DC, June 23-26, 2002, pp. 229-238. 

A. T. Tai, W. H. Sanders, L Alkalai, S. N. Chau, and K. S. Tso, "Performability Analysis of Guarded-Operation 

Duration: A Successive Model-Translation Approach," Proceedings of the International Conference on 

Dependable Systems and Networks (DSN-2002}, Washington, DC, June 23-26, 2002, pp. 561-570. 

T. Courtney, J. Lyons, H. V. Ramasamy, W. H. Sanders, M. Seri, M. Atighetchi, P. Rubel, C. Jones, F. Webber, P. 

Pal, R. Watro, M. Cukier, and J. Gossett, "Providing Intrusion Tolerance with ITUA," Supplemental Volume of 

the 2002 International Conference on Dependable Systems & Networks (DSN-2002}, Washington, DC, June 23-

26, 2002, pp. C-5-1 to C-5-3. 

M. Seri, T. Courtney, M. Cukier, V. Gupta, S. Krishnamurthy, J. Lyons, H. V. Ramasamy, J. Ren, and W. H. 

Sanders, "A Configurable CORBA Gateway for Providing Adaptable System Properties," Supplemental Volume 
45 

William H. Sanders 9/12/2017 19 

of the 2002 International Conference on Dependable Systems & Networks (DSN-2002), Washington, DC, June 

23-26, 2002, pp. G-26 to G-30. 

W. H. Sanders, M. Cukier, F. Webber, P. Pal, and R. Watro, "Probabilistic Validation of Intrusion Tolerance," 

Fast Abstract in the Supplemental Volume of the 2002 International Conference on Dependable Systems & 

Networks (DSN-2002), Washington, DC, June 23-26, 2002, pp. B-78 to B-79. 

D. Daly, G. Kar, and W. H. Sanders, "Modeling of Service-Level Agreements for Composed Services," in 

Management Technologies forE-Commerce and E-Business Applications: Proceedings of the 13th IFIP/IEEE 

International Workshop on Distributed Systems: Operations and Management (DSOM 2002), Montreal, 

Canada, October 21-23, 2002, Lecture Notes in Computer Science, val. 2506, pp. 4-15. 

K. R. Joshi, M. Cukier, and W. H. Sanders, "Experimental Evaluation of the Unavailability Induced by a Group 

Membership Protocol," Dependable Computing EDCC-4: Proceedings of the 4th European Dependable 

Computing Conference, Toulouse, Fra nee, October 23-25, 2002, Lecture Notes in Computer Science val. 2485, 

pp. 140-158. 

H. V. Ramasamy, M. Cukier, and W. H. Sanders, "Formal Specification and Verification of a Group Membership 

Protocol for an Intrusion-Tolerant Group Communication System," Proceedings of the 2002 Pacific Rim 

International Symposium on Dependable Computing (PRDC 2002), Tsukuba, Japan, Dec. 16-18, 2002, pp. 9-18. 

(Selected as the winner of the Best Paper Award at the conference.) 

Y. (J.) Ren, P. Rubel, M. Seri, M. Cukier, W. H. Sanders, and T. Courtney, "Passive Replication Schemes in 

AQuA," Proceedings of the 2002 Pacific Rim International Symposium on Dependable Computing (PRDC 2002), 

Tsukuba, Japan, Dec. 16-18, 2002, pp. 125-130. 

S. Singh, M. Cukier, and W. H. Sanders, "Probabilistic Validation of an Intrusion-Tolerant Replication System," 

Proceedings of the 2003 International Conference on Dependable Systems and Networks (DSN-2003}, San 

Francisco, CA, June 22-2S, 2003, pp. 615-624. 

A. T. Tai, K. S. Tso, L Alkalai, S. N. Chau, and W. H. Sanders, "Opportunity-Adaptive QoS Enhancement in 

Satellite Constellations: A Case Study," Proceedings of the 2003 International Conference on Dependable 

Systems and Networks (DSN-2003), San Francisco, CA, June 22-25, 2003, pp. 655-664. 

H. Bohnenkamp, T. Courtney, D. Daly, 5. Derisavi, H. Hermanns, J.-P. Katoen, R. K!aren, V. V. Lam, and W. H. 

Sanders, "On Integrating the Mobius and Modest Modeling Tools," tools paper in the Proceedings of the 2003 

International Conference on Dependable Systems and Networks (DSN-2003), San Francisco, CA, June 22-25, 

2003, p. 671. 

T. Courtney, D. Daly, S. Derisavi, V. Lam, and W. H. Sanders, "The Mobius Modeling Environment," in Tools of 

the 2003 1/finoislnternatianal Multiconference on Measurement, Modelling, and Evaluation of ComputerCommunication Systems, Universitat Dortmund Fachbereich lnformatik research report no. 781/2003, 2003, 

pp. 34-37. 

s. Derisavi, P. Kemper, and W. H. Sanders, "Symbolic State-space Exploration and Numerical Analysis of Statesharing Composed Models," Proceedings of NSMC '03: The Fourth International Conference on the Numerical 

Solution of Markov Chains, Urbana, Illinois, September 3-5, 2003, pp. 167-189. 

A. T. Tai, K. S. Tso, and W. H. Sanders, "Protecting Distributed Software Upgrades that Involve MessagePassing Interface Changes," Proceedings of COMPSAC 2003: The 27th Annual International Computer 

Software and Applications Conference, Dallas, TX, September 3D-October 3, 2003, pp. 385-390. 
46 

William H. Sanders 9/12/2017 20 

R. M. Lefever, M. Cukier, and W. H. Sanders, "An Experimental Evaluation of Correlated Network Partitions in 

the Coda Distributed File System," Proceedings of the 22nd International Symposium on Reliable Distributed 

Systems {SRDS'03), Florence, Italy, October 6-8, 2003, pp. 273-282. 

V. Gupta, V. lam, H. V. Ramasamy, W. H. Sanders, and S. Singh, "Dependability and Performance Evaluation of 

Intrusion-Tolerant Server Architectures," Dependable Computing: Proceedings of the First Latin-American 

Symposium (LADC 2003}, Sao Paulo, Brazil, October 21-24, 2003, Lecture Notes in Computer Science, val. 2847 

(Rogerio de Lemos, Taisy Silva Weber, and Joao Batista Camargo Jr., eds), Berlin: Springer, 2003, pp. 81-101. 

A. Sharma, J. R. Martin, N. Anand, M. Cukier, and W. H. Sanders, "Ferret: A Host Vulnerability Checking Tool," 

Proceedings of the lOth IEEE Pacific Rim International Symposium on Dependable Computing (PRDC-10 2004), 

Papeete, Tahiti, French Polynesia, March 3-5, 2004, pp. 389-394. 

A. Agbaria and W. 'H. Sanders, "Distributed Snapshots for Mobile Computing Systems," Proceedings of the 2nd 

IEEE Annual Conference on Pervasive Computing and Communications, Orlando, Fl, March 14-17, 2004, pp. 

177-186. 

K. R. Joshi, N. Neogi, and W. H. Sanders, "Dynamic Partitioning of large Discrete Event Biological Systems for 

Hybrid Simulation and Analysis," Proceedings of the 7th International Workshop on Hybrid Systems: 

Computation and Control (HSCC 2004), Philadelphia, PA, March 25-27, 2004, pp. 463-476. 

A. T. Tai, K. S. Tso, and W. H. Sanders, "Cluster-Based Failure Detection Service for large-Scale Ad Hoc 

Wireless Network Applications," Proceedings of the International Conference an Dependable Systems and 

Networks (DSN-2004), Florence, Italy, June 28-July 1, 2004, pp. 805-814. 

R. K. lyer, W. H. Sanders, J. H. Patel, and Z. Kalbarczyk, "The Evolution of Dependable Computing at the 

University of Illinois," in R. Jacquart, Ed., Building the Information Society: IFIP 18th World Computer Congress 

Topical Sessions, Toulouse, France, August 22-27, 2004, pp. 135-164. Boston: Kluwer Academic Publishers. 

H. V. Ramasamy, A. Agbaria, and W. H. Sanders, "CoBFIT: A Component-Based Framework for Intrusion 

Tolerance," Proceedings of the 30th Euromicro Conference, Rennes, France, August 31-September 3, 2004, pp. 

591-600. 

P. Buchholz and W. H. Sanders, "Approximate Computation of Transient Results for large Markov Chains," 

Proceedings of the 1st International Conference on Quantitative Evaluation af Systems (QEST 2004), Enschede, 

The Netherlands, September 27-30,2004, pp. 126-135. 

V. V. Lam, P. Buchholz, and W. H. Sanders, "A Structured Path-Based Approach for Computing Transient 

Rewards of large CTMCs," Proceedings of the 1st International Conference on Quantitative Evaluation of 

Systems (QEST 2004}, Enschede, The Netherlands, September 27-30, 2004, pp. 136-145. 

T. Courtney, D. Daly, S. Derisavi, S. Gaonkar, M. Griffith, V. lam, and W. H. Sanders, "The Mobius Modeling 

Environment: Recent Developments," Proceedings of the 1st International Conference on Quantitative 

Evaluation of Systems (QEST 2004), Enschede, The Netherlands, September 27-30, 2004, pp. 328-329. 

F. Stevens, T. Courtney, S. Singh, A. Agbaria, J. F. Meyer, W. H. Sanders, and P. Pal, "Model-Based Validation 

of an Intrusion-Tolerant Information System," Proceedings ofSRDS 2004: The 23rd Symposium on Reliable 

Distributed Systems, Florian6polis, Brazil, October 18-20, 2004, pp. 184-194. 
47 

William H. Sanders 9/12/2017 21 

K. R. Joshi, M. Hiltunen, R. Schlichting, W. H. Sanders, and A. Agbaria, "Online Model-Based Adaptation for 

Optimizing Performance and Dependability," Proceedings of the Workshop on Self-Managed Systems (WOSS 

2004}, Newport Beach, CA, October 31-November 1, 2004 (CD-ROM). 

V. S. Adve, A. Agbaria, M.A. Hiltunen, R. K. lyer, K. R. Joshi, Z. Kalbarczyk, R. M. Lefever, R. Plante, W. H. 

Sanders, and R. D. Schlichting, "A Compiler-Enabled Model- and Measurement-Driven Adaptation 

Environment for Dependability and Performance," Proceedings of the Next Generation Software (NGS} 

Workshop at the International Parallel & Distributed Processing Symposium {IPDPS), Denver, Colorado, April 

4, 2005 (CD-ROM). 

A. Agbaria and W. H. Sanders, "Application-Driven Coordination-Free Distributed Checkpointing," Proceedings 

of the 25th IEEE International Conference on Distributed Computing Systems, Columbus, Ohio, June 6-10, 

2005, pp, 177-186. 

A. T. Tai, K. S. Tso, W. H. Sanders, and S. N. Chau, "A Performability-Oriented Software Rejuvenation 

Framework for Distributed Applications," Proceedings of the 2005 International Conference on Dependable 

Systems and Networks (DSN-2005), Yokohama, Japan, June 28-July 1, 2005, pp, 570-579. 

S. Derisavi, P. Kemper, and W. H. Sanders, "Lumping Matrix Diagram Representations of Markov Models," 

Proceedings of the 2005 International Conference on Dependable Systems and Networks (DSN-2005), 

Yokohama, Japan, June 28-July 1, 2005, pp. 742-751. 

E. Athanasopoulou, P. Thakker, and W. H. Sanders, "Evaluating the Dependability of a LEO Satellite Network 

for Scientific Applications," Proceedings of the 2nd International Conference on the Quantitative Evaluation of 

Systems (QEST}, Torino, Italy, September 19-22, 2005, pp, 95-104. 

T. Courtney, S. Derisavi, S. Gaonkar, M. Griffith, V. Lam, M. McQuinn, E. Rozier, and W. H. Sanders, "The 

Mobius Modeling Environment: Recent Extensions- 2005," Proceedings of the 2nd International Conference 

on the Quantitative Evaluation of Systems (QEST}, Torino, Italy, September 19-22, 2005, pp. 259-260. 

K. R. Joshi, M.A. Hiltunen, and W. H. Sanders, "Performability Optimization Using Linear Bounds of Partially 

Observable Markov Decision Processes," Proceedings of the 7th International Workshop on Performabi/ity 

Modeling of Computer and Communication Systems (PMCCS-7}, Turin, Italy, September 23-24, 2005, pp. 73-

76. 

H. V. Ramasamy, A. Agbaria, and W. H. Sanders, "Parsimony-Based Approach for Obtaining Resource-Efficient 

and Trustworthy Execution," Dependable Computing: Proceedings of the 2nd Latin-American Symposium 

(LADC 2005), Salvador, Brazil, October 25-28,2005, LNCS vaL 3747, Springer-Verlag, pp. 206-225. 

K. R. Joshi, M. Hiltunen, W. H. Sanders, and R. Schlichting, "Automatic Model-Driven Recovery in Distributed 

Systems," Proceedings of the 24th IEEE Symposium on Reliable Distributed Systems (SRDS 2005}, Orlando, 

Florida, October 26-28, 2005, pp. 25-36. 

V. V. Lam, P. Buchholz, and W. H. Sanders, "A Component-Level Path-Based Simulation Approach for Efficient 

Analysis of Large Markov Models," Proceedings of the 2005 Winter Simulation Conference, Orlando, Florida, 

December 4-7, 2005, pp. 584-590. 

S. Gaonkar and W. Sanders, "Simultaneous Simulation of Alternative System Configurations," Proceedings of 

the 11th Pacific Rim International Symposium on Dependable Computing, Changsha, Hunan, China, Dec. 12-

14, 2005, pp, 41-48, 
48 

William H. Sanders 9/12/2017 22 

S. T. Beaudet, T. Courtney, and W. H. Sanders, "A Behavior-Based Process for Evaluating Availability 

Achievement Risk Using Stochastic Activity Networks," Proceedings of the 52nd Annual Reliability and 

Maintainability Symposium (RAMS 2006), Newport Beach, California, January 23-26, 2006, pp. 21-28. 

M. lhde and W. H. Sanders, "Barbarians in the Gate: An Experimental Validation of NIC-based Distributed 

Firewall Performance and Flood Tolerance," Proceedings of the 2006/nternational Conference on Dependable 

Systems and Networks {DSN'06}, Philadelphia, PA, USA, June 25-28, 2006, pp. 209-216. 

K. R. Joshi, M.A. Hiltunen, W. H. Sanders, and R. D. Schlichting, "Automatic Recovery Using Bounded Partially 

Observable Markov Decision Processes," Proceedings of the International Conference on Dependable Systems 

and Networks (DSN-2006}, Philadelphia, PA, USA, June 25-28, 2006, pp. 445-456. 

S. Gaonkar, K. Keeton, A. Merchant, and W. H. Sanders, "Designing Dependable Storage Solutions for Shared 

Application Environments," Proceedings of the International Conference on Dependable Systems and 

Networks (DSN-2006}, Philadelphia, PA, USA, June 25-28, 2006, pp. 371-382. 

V. V. Lam, P. Buchholz, and W. H. Sanders, "A Component-Level Path Composition Approach for Efficient 

Transient Analysis of Large CTMCs," Proceedings of the International Conference on Dependable Systems and 

Networks {DSN-2006}, Philadelphia, PA, USA, June 25-28, 2006, pp. 485-494. 

D. Daly, P. Buchholz, and W. H. Sanders, "Bound-Preserving Composition for Markov Reward Models," 

Proceedings of the 3rd International Conference on the Quantitative Evaluation of SysTems (QEST} 2006, 

Riverside, CA, September 11-14, 2006, pp. 243-252. 

T. Courtney, S. Gaonkar, M. Griffith, V. Lam, M. McQuinn, E. Rozier, and W. H. Sanders, "Data Analysis and 

Visualization within the Mobius Modeling Environment," Proceedings of the 3rd International Conference on 

the Quantitative Evaluation of SysTems {QEST}, Riverside, CA, Sept. 11-14, 2006, pp. 137-138. 

P. Sousa, N. F. Neves, P. Verlssimo, and W. H. Sanders/ 11Proactive Resilience Revisited: The Delicate Balance 

Between Resisting Intrusions and Remaining Available," Proceedings of the 25th IEEE Symposium on Reliable 

Distributed Systems {SRDS 2006}, Leeds, UK, October 2-4, 2006, pp. 71-82. 

S. Gaonkar, T. Courtney, and W. H. Sanders, "Efficient State Management to Speed Up Simultaneous 

Simulation of Alternate System Configurations," Proceedings of the International Mediterranean Modelling 

Multiconference, Barcelona1 Spain, October 4-61 20061 pp. 31-36. 

W. D. Oballl, M.G. McQuinn, and W. H. Sanders, "Detecting and Exploiting Symmetry in Discrete-State 

Markov Models," Proceedings of the 12th Pacific Rim International Symposium on Dependable Computing 

{PRDC'06}, Riverside, CA, Dec. 18-20, 2006, pp. 26-38. 

S. Singh, D. M. Nicol, W. H. Sanders, and M. Seri, "Verifying SCADA Network Access Control Policy 

Implementations Using the Access Policy Tool," First Annual IFIP WG 11.10 International Conference on 

Critical Infrastructure Protection, Hanover, New Hampshire, March 18-21, 2007. (Presented but not published 

in a proceedings.) 

R. Cunningham, S. Cheung, M. Fang, U. Undqvist, D. Nicol, R. Pawlowski, E. Robinson, W. Sanders, S. Singh, A. 

Valdes, B. Woodworth, and M. Zhivich, "Securing Process Control Systems of Today and Tomorrow," 

Proceedings of the First Annual IFIP WG 11.10 International Conference on Critical Infrastructure Protection, 

Hanover, New Hampshire, March 18-21, 2007. 
49 

William H. Sanders 9/12/2017 23 

E. Von Ruitenbeek, T. Courtney, W. H. Sonders, ond F. Stevens, "Quantifying the Effectiveness of Mobile 

Phone Virus Response Mechonisms," Proceedings of the 37th AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks, Edinburgh, UK, June 25-28, 2007, pp. 790-800. 

Y. Zhou, D. Morinov, W. Sonders, C. Zilles, M. d'Amorim, S. Lauterburg, R. M. Lefever, ond J. Tucek, "Delta 

Execution for Softwore Reliobility," in Proceedings of the 3rd Workshop on Hot Topics in System Dependability 

(Hot0ep'07}, Edinburgh, UK, June 26, 2007, Article No. 16. 

H. Ramasamy, M. Seri, and W. H. Sanders, "The CoB FIT Toolkit," Proceedings of the 26th Annual ACM SIGACTSIGOPS Symposium on Principles of Distributed Computing (POOC 2007}, Portland, Oregon, Aug. 12-15, 2007, 

pp. 350-351. 

M.G. McQuinn, P. Kemper, and W. H. Sanders, "Dependobility Analysis with Markov Chains: How Symmetries 

Improve Symbolic Computations," Proceedings of the 4th International Conference on the Quantitative 

Evaluation of SysTems (QEST} 2007, Edinburgh, UK, Sept. 16-19, 2007, pp.151-160. 

T. Courtney, S. Gaonkar, M.G. McQuinn, E. Rozier, W. H. Sonders, and P. Webster, "Design of Experiments 

within the Mobius Modeling Fromework," Proceedings of the 4th International Conference on the 

Quantitative Evaluation of SysTems (QEST) 2007, Edinburgh, UK, Sept. 16-19, 2007, pp. 161-162. 

A. T. Toi, K. S. Tso, and W. H. Sanders, "Recurrence-Relation-Based Reword Model for Performability 

Evaluation of Embedded Systems," Proceedings of the 8th International Workshop on Perform ability Modeling 

of Computer and Communication Systems, Edinburgh, Scotland, Sept. 20-21,2007. 

S. Gaonkor and W. H. Sanders, "Analysis of the Reliability/Availability of Distributed File Systems in LargeScale Systems: A Case Study Using Simultaneous Simulation," Proceedings of the 8th International Workshop 

on Performability Modeling of Computer and Communication Systems, Edinburgh, Scotland, Sept. 20-21, 

2007. 

S. A. Zonouz and W. H. Sanders, "A Kalmon-based Coordination for Hierarchical State Estimation: Algorithm 

and Analysis," Proceedings of the 41st Annual Hawaii International Conference on System Sciences (HICSS 

'08), Waikoloa, Hawaii, January 7-10,2008. 

A. T. Tai, K. S. Tso, and W. H. Sanders, "A Recurrence-Relation-Based Reward Model for Performability 

Evaluation of Embedded Systems," Proceedings of the 38th AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks (DSN 2008), Anchorage, Alaska, June 24-27, 2008, pp. 532-541. 

S. Gaonkar, E. Rozier, A. Tong, and W. H. Sanders, "Scaling File Systems to Support Petascale Clusters: A 

Dependability Analysis to Support Informed Design Choices," Proceedings of the 38th AnnuaiiEEE/IFIP 

International Conference on Dependable Systems and Networks {OSN 2008}, Anchorage, Alaska, June 24-27, 

2008, pp. 386-391. 

J. Scheffran, T. Bajar, and W. H. Sanders, "Dynamic Coalition Formation in Energy and Climate Systems," 13th 

International Symposium on Dynamic Games and Applications, Wroclaw, Poland, June 30-July 3, 2008. 

(Presented but not published in a proceedings.) 

E. Van Ruitenbeek and W. H. Sanders, "Modeling Peer-to-Peer Botnets," Proceedings of the 5th International 

Conference on the Quantitative Evaluation of Systems (QEST}, St. Malo, france, September 14-17,2008, pp. 

307-316. 
50 

William H. Sanders 9/12/2017 24 

5. Chen, K. R. Joshi, M. A Hiltunen, W. H. Sanders, and R. D. Schlichting, "Link Gradients: Predicting the Impact 

of Network Latency on Multitier Applications," Proceedings of the 20091EEE Conference on Computer 

Communications {INFDCDM), Rio de Janeiro, Brazil, April19-25, 2009, pp. 2258-2266. 

S. A. Zonouz, H. Khurana, W. H. Sanders, and T. M. Yardley, "RRE: A Game-Theoretic Intrusion Response and 

Recovery Engine," Proceedings of the 39th AnnuaiiEEE/IFIP International Conference on Dependable Systems 

and Networks {DSN 2009), Estoril, Lisbon, Portugal, June 29-July 2, 2009, pp. 439-448. 

T. Courtney, S. Gaonkar, K. Keefe, E. W. D. Rozier, and W. H. Sanders, "Mobius 2.3: An Extensible Tool for 

Dependability, Security, and Performance Evaluation of Large and Complex System Models," Proceedings of 

the 39th AnnuaiiEEE/IFIP International Conference on Dependable Systems and Networks {DSN 2009), Estoril, 

Lisbon, Portugal, June 29-July 2, 2009, pp. 353-358. 

K. Keefe, Q. Mitchell, E. Rozier, and W. H. Sanders, "Remote Job Management in the Mobius Modeling 

Framework," Proceedings of the 6th International Conference on Quantitative Evaluation of SysTems {QEST) 

2009, Budapest, Hungary, September 13-16, 2009, pp. 209-210. 

S. Chen, K. R. Joshi, M.A. Hiltunen, R. D. Schlichting, and W. H. Sanders, "Gradient-based Models of Multitier 

Systems," Proceedings of the Ninth International Workshop on Performability Modeling of Computer and 

Communication Systems {PMCCS-9), Eger, Hungary, September 17-18, 2009, pp. 34-38. 

S. Gaonkar and W. H. Sanders, "G-SSASC: Simultaneous Simulation of System Models with Bounded Hazard 

Rates," Proceedings of the 2009 Winter Simulation Conference, Austin, Texas, USA, December 13-16,2009, 

pp. 663-673. 

D. M. Nicol, W. H. Sanders, M. Seri, and S. Singh, "Experiences Validating the Access Policy Tool in Industrial 

Settings," Proceedings of the 43rd Annual Hawai'i International Conference on System Sciences {HICSS), Koloa, 

Kauai, Hawaii, January 5-8,2010, pp. 1-8. 

5. Chen, K. R. Joshi, M.A. Hiltunen, R. D. Schlichting, and W. H. Sanders, "Biackbox Prediction of the Impact of 

DVFS on End-to-End Performance of Multitier Systems," in ACM SIGMETR/CS Performance Evaluation Review 

(special issue with Proceedings of Green Metrics 2009 Workshop, Seattle, Washington, June 15, 2009), vol. 37, 

no. 4, March 2010, pp. 59-63. 

R. M. Lefever, V. S. Adve, and W. H. Sanders, "Diverse Partial Memory Replication," Proceedings ofthe2010 

IEEE/IFIP International Conference on Dependable Systems and Networks {DSN 2010), Chicago, Illinois, June 

28-July 1, 2010, pp. 71-80. 

A. T. Tai, K. 5. Tso, and W. H. Sanders, "Diversity-Inspired Clustering for Self-Healing MANETs: Motivation, 

Protocol, and Performability Evaluation," Proceedings of the 2010 IEEE/IFIP International Conference on 

Dependable Systems and Networks {DSN 2010), Chicago, Illinois, June 28-July 1, 2010, pp. 547-556. 

W. H. Sanders, "Progress Towards a Resilient Power Grid Infrastructure," Proceedings of the IEEE Power and 

Energy Society General Meeting {PES GM), Minneapolis, Minnesota, July 25-29, 2010, pp. 1-3. 

S. Chen, K. R. Joshi, M.A. Hiltunen, R. D. Schlichting, and W. H. Sanders, "CPU Gradients: Performance-aware 

Energy Conservation in M ultitier Systems," Proceedings of the 1st International Green Computing Conference, 

Chicago, Illinois, August 15-18, 2010, pp. 15-29. 
51 

William H. Sanders 9/12/2017 25 

E. LeMay, W. Unkenholz, D. Parks, C. Muehrcke, K. Keefe, and W. H. Sanders, "Adversary-Driven State-Based 

System Security Evaluation," Proceedings of the 6th International Workshop on Security Measurements and 

Metrics (MetriSec 2010}, Bolzano-Bozen, Italy, September 15, 2010, article no. 5, 9 pages. 

S. A. Zonouz, K. R. Joshi, and W. H. Sanders, "Cost-aware Systemwide Intrusion Defense via Online Forensics 

and On-demand Detector Deployment," Proceedings of the 3rd ACM Workshop on Assurable & Usable 

Security Configuration (SafeConfig}, Chicago, Illinois, October 4, 2010, pp. 71-74. 

R. Berthier, W. H. Sanders, and H. Khurana, "Intrusion Detection for Advanced Metering Infrastructures: 

Requirements and Architectural Directions," Proceedings of the 1st IEEE International Conference on Smart 

Grid Communications (SmartGridComm), Gaithersburg, Maryland, October 4-6, 2010, pp. 350-355. 

S. A. Zonouz, A. Sharma, H. V. Ramasamy, Z. T. Kalbarczyk, B. Pfitzmann, K. McAuliffe, R. K. lyer, W. H. 

Sanders, and E. Cope, "Managing Business Health in the Presence of Malicious Attacks," Proceedings of the 

IEEE/IFIP 41st International Conference on Dependable Systems and Networks Workshops (DSN-W}, Hong 

Kong, China, June 27-30, 2011, pp. 9-14. 

E. LeMay, M.D. Ford, K. Keefe, W. H. Sanders, and C. Muehrcke, "Model-based Security Metrics using 

ADversary VIew Security Evaluation (ADVISE)," Proceedings of the 8th International Conference on 

Quantitative Evaluation of SysTems (QEST 2011), Aachen, Germany, September 5-8, 2011, pp. 191-200. 

D. Eskins and W. H. Sanders, "The Multiple-Asymmetric-Utility System Model: A Framework for Modeling 

Cyber-Human Systems," Proceedings of the 8th International Conference on Quantitative Evaluation of 

SysTems (QEST 2011), Aachen, Germany, September 5-8, 2011, pp. 233-242. 

S. A. Zonouz, K. R. Joshi, and W. H. Sanders, "FioGuard: Cost-aware Systemwide Intrusion Defense via Online 

Forensics and On-demand IDS Deployment," Proceedings of the 30th International Conference on Computer 

Safety, Reliability and Security (SAFECOMP 2011), Naples, Italy, September 19-22, 2011, pp. 338-354; Lecture 

Notes in Computer Science {LNCS}, val. 6894, Springer, 2011. 

E. W. D. Rozier, W. H. Sanders, P. Zhou, N. Mandagere, S. M Uttamchandani, and M. L. Yakushev, "Modeling 

the Fault Tolerance Consequences of Deduplication," Proceedings of the 30th IEEE Symposium on Reliable 

Distributed Systems (SRDS 2011), Madrid, Spain, October 5-7, 2011, pp. 75-84. 

R. Berthier and W. H. Sanders, "Specification-based Intrusion Detection for Advanced Metering 

Infrastructures," Proceedings of the 17th IEEE Pacific Rim International Symposium on Dependable Computing 

(PRDC 2011), Pasadena, California, December 12-14, 2011, pp. 184-193. 

A. Fawaz, R. Berthier, W. H. Sanders, and P. Pal, "Understanding the Role of Automated Response Actions in 

Improving AMI Resiliency," Proceedings of the NIST Cybersecurity for Cyber-Physical Systems Workshop, 

Gaithersburg, Maryland, April 23-24, 2012. Online proceedings: http://www.nist.gov/itl/csd/cyberphysicalworkshop.cfm 

R. M. Lefever, V. S. Adve, and W. H. Sanders, "A Mirrored Data Structures Approach to Diverse Partial 

Memory Replication," Proceedings of the 9th European Dependable Computing Conference {EDCC-2012), 

Sibiu, Romania, May 8-11, 2012, pp. 61-72. 

J. Zhang, R. Berthier, W. Rhee, M. Bailey, P. Pal, F. Jahanian, and W. H. Sanders, "Safeguarding Academic 

Accounts and Resources with the University Credential Abuse Auditing System," Proceedings of the 42nd 

Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN-2012), Boston, 

Massachusetts, USA, June 25-28, 2012, pp. 1-8. 
52 

William H. Sanders 9/12/2017 26 

E. W. D. Rozier and W. H. Sanders, "A Framework for Efficient Evaluation of the Fault Tolerance of 

Deduplicated Storage Systems," Proceedings of the 42nd AnnuaiiEEE/IFIP International Conference an 

Dependable Systems and Networks (DSN-2012}, Boston, Massachusetts, USA, June 25-28, 2012, pp. 1-12. 

J. Zhang, R. Berthier, M. Bailey, W. Rhee, W. H. Sanders, P. Pal, and F. Jahanian, "Learning from Early Attempts 

to Measure Information Security Performance," Proceedings of the 5th Workshop on Cyber Security 

Experimentation and Test (CSET'12), Bellevue, Washington, Aug. 6, 2012. Available online: 

https :/ /www .use nix. o rg/ conference/ cset 12/tech -schedule/workshop-program. 

M.D. Ford, P. Buchholz, and W. H. Sanders, "State-Based Analysis in ADVISE," Proceedings of the 9th 

International Conference on Quantitative Evaluation of SysTems (QEST}, London, UK, Sept. 17-20, 2012, pp. 

148-157. 

A. Fawaz, R. Berthier, and W. H. Sanders, "Cost Modeling of Response Actions for Automated Response and 

Recovery in AMI," Proceedings of the 3rd IEEE International Conference on Smart Grid Communications 

(SmartGridCamm}, Tainan City, Taiwan, Nov. S-8, 2012, pp. 348-353. 

D. Grochocki, J. H. Huh, R. Berthier, R. Bobba, W. H. Sanders, A. A. Clrdenas, and J. G. Jetcheva, "AMI Threats, 

Intrusion Detection Requirements and Deployment Recommendations," Proceedings of the 3rd IEEE 

International Conference an Smart Grid Communications {SmartGridComm), Tainan City, Taiwan, Nov. S-8, 

2012, pp. 395-400. 

F. Faghri, S. Bazarbayev, M. Overholt, R. Farivar, R. H. Campbell, and W. H. Sanders, "Failure Scenario as a 

Service (FSaaS) for Hadoop Clusters," Proceedings of the Workshop an Secure and Dependable Middlewarefor 

Claud Monitoring and Management {SDMCMM), held in conjunction with ACM/IFIP/USENIX ACM 

International Middleware Conference, Montreal, Quebec, Canada, Dec. 4, 2012, article no. 5. 

T. Yardley, R. Berthier, D. Nicol, and W. H. Sanders, "Smart Grid Protocol Testing Through Cyber-Physical 

Testbeds," Proceedings of the 4th IEEE PES Innovative Smart Grid Technologies Conference {ISGT 2013), 

Washington, D.C., Feb. 24-27, 2013, pp. 1-6. 

M.D. Ford, K. Keefe, E. LeMay, W. H. Sanders, and C. Muehrcke, "Implementing the ADVISE Security Modeling 

Formalism in Mobius," Proceedings of the 43rd AnnuaiiEEE/IFIP International Conference an Dependable 

Systems and Networks {DSN-2013), Budapest, Hungary, June 24-27, 2013, pp. 1-8. 

S. Bazarbayev, W. H. Sanders, M. Hiltunen, K. Joshi, and R. Schlichting, "Content-Based Scheduling of Virtual 

Machines (VMs) in the Cloud," Proceedings of the 33rd International Conference on Distributed Computing 

Systems {ICDCS 2013), Philadelphia, Pennsylvania, July 8-11, 2013, pp. 93-101. 

K. Keefe and W. H. Sanders, "Mobius Shell: A Command-line Interface for Mobius," Proceedings of the lOth 

International Conference on Quantitative Evaluation of SysTems (QEST 2013}, Buenos Aires, Argentina, Aug. 

27-30, 2013, Lecture Notes in Computer Science, val. 8054, Springer, pp. 282-285. 

B. Chen, Z. Kalbarczyk, D. M. Nicol, W. H. Sanders, R. Tan, W. G. Temple, N. 0. Tippenhauer, A. H. Vu, and D. 

Yau, "Go with the Flow: Toward Workflow-Oriented Security Assessment," Proceedings of the 2013 New 

Security Paradigms Workshop {NSPW), Banff, Canada, Sept. 9-12, 2013, pp. 65-76. 

S. Malik, R. Berthier, R. B. Bobba, R. H. Campbell, and W. H. Sanders, "Formal Design of Communication 

Checkers for ICCP Using UPPAAL," Proceedings of the IEEE International Conference on Smart Grid 

Communications {SmartGridComm), Vancouver, Canada, Oct. 21-24, 2013, pp. 486-491. 
53 

William H. Sanders 9/12/2017 27 

R. Berthier, J. G. Jetcheva, D. Mashima, J. H. Huh, D. Grochocki, R. B. Bobba, A. A. Cardenas, and W. H. 

Sanders, "Reconciling Security Protection and Monitoring Requirements in Advanced Metering 

Infrastructures," Proceedings of the IEEE International Conference on Smart Grid Communications 

(SmartGridComm), Vancouver, Canada, Oct. 21-24, 2013, pp. 450-455. 

W. Niemira, R. B. Bobba, P. Sauer, and W. H. Sanders, "Malicious Data Detection in State Estimation 

Leveraging System Losses & Estimation of Perturbed Parameters," Proceedings of the IEEE International 

Conference on Smart Grid Communications (SmartGridComm), Vancouver, Canada, Oct. 21-24, 2013, pp. 402-

407. 

S. Bazarbayev, M. Hiltunen, K. Joshi, W. H. Sanders, and R. Schlichting, "PSCioud: A Durable Context-Aware 

Personal Storage Cloud," Proceedings of the 9th Workshop on Hot Topics in Dependable Systems (HotDep '13), 

Farmington, Pennsylvania, Nov. 3, 2013, article no. 9. 

G. A. Weaver, C. Cheh, E. J. Rogers, W. H. Sanders, and D. Gammel, "Toward a Cyber-Physical Topology 

Language: Applications to NERC CIP Audit," Proceedings of the First ACM Workshop on Smart Energy Grid 

Security (SEGS), Berlin, Germany, Nov. 8, 2013, pp. 93-104. 

R. Berthier and W. H. Sanders, "Monitoring Advanced Metering Infrastructures with Amilyzer," Proceedings of 

C&ESAR: The Computer & Electronics Security Applications Rendez-vous, Rennes, France, Nov. 19-21, 2013, 

pp. 130-142. 

U. Thakore, G. A. Weaver, and W. H. Sanders, "An Actor-Centric, Asset-Based Monitor Deployment Model for 

Cloud Computing," Proceedings of the 6th IEEE/ACM International Conference on Utility and Cloud Computing 

(UCC 2013}, Dresden, Germany, Dec. 9-12, 2013, pp. 311-312. 

L. Heng, J. J. Makela, A. D. Dominguez-Garcia, R. B. Bobba, W. H. Sanders, and G. X. Gao, "Reliable GPS-Based 

Timing for Power Systems: A Multi-Layered Multi-Receiver Architecture," Proceedings of the IEEE Power and 

Energy Conference at Illinois (PECI), Champaign, Illinois, February 28-M arch 1, 2014. 

A. Hussain, T. Faber, R. Braden, T. Benzel, T. Yardley, J. Jones, D. M. Nicol, W. H. Sanders, T. W. Edgar, T. E. 

Carroll, D. 0. Manz, and L. Tinnel, "Enabling Collaborative Research for Security and Resiliency of Energy 

Cyber Physical Systems," Proceedings of the 20141EEE International Conference on Distributed Computing in 

Sensor Systems, Marina Del Rey, CA, May 26-28, 2014, pp. 358-360. 

N. 0. Tippenhauer, W. G. Temple, A. H. Vu, B. Chen, D. M. Nicol, Z. Kalbarczyk, and W. H. Sanders, "Automatic 

Generation of Security Argument Graphs," Proceedings of the 20th IEEE Pacific Rim International Symposium 

on Dependable Computing (PRDC 2014), Singapore, Nov. 18-21, 2014, pp. 33-42. 

B. Feddersen, K. Keefe, W. H. Sanders, C. Muehrcke, D. Parks, A. Crapo, A. Gabaldon, and R. Palla, "An 

Ontological Model for Constructing Mobius ADVISE Security Models," Fast Abstract at the 45th Annual 

IEEE/IFIP International Conference on Dependable Systems and Networks, Rio de Janeiro, Brazil, June 22-25, 

2015. (Presented but not published in a proceedings.) 

B. Feddersen, K. Keefe, W. H. Sanders, C. Muehrcke, D. Parks, A. Crapo, A. Gabaldon, and R. Palla, "Enterprise 

Security Metrics with the ADVISE Meta Model Formalism," Proceedings of SECURWARE 2015: The Ninth 

International Conference on Emerging Security Information, Systems and Technologies, Venice, Italy, Aug. 23-

28, 2015, pp, 6S-66. 
54 

William H. Sanders 9/12/2017 28 

V. Badrinath Krishna, G. A. Weaver, and W. H. Sanders. "PCA-Based Method for Detecting Integrity Attacks on 

Advanced Metering Infrastructure," Proceedings of the 12th International Conference on Quantitative 

Evaluation of Systems (QEST), Madrid, Spain, Sept.l-3, 2015, Lecture Notes in Computer Science vaL 9259, pp. 

70-85, Springer. 

B. Chen, C. Schmittner, Z. Ma, W. G. Temple, X. Dong, D. L Jones, and W. H. Sanders, "Security Analysis of 

Urban Railway Systems: The Need for a Cyber-Physical Perspective," Proceedings of the International 

Conference on Computer Safety, Reliability, and Security: SAFECOMP 2015 Workshops: ASSURE, DECSoS, /SSE, 

ReSA4CI, and SASSUR, Delft, The Netherlands, Sept. 22, 2015, Lecture Notes in Computer Science, val. 9338 (F. 

Koornneef and C. van Gulijk, Eds.), pp. 277-290, Springer. 

V. Badrinath Krishna, R. K. lyer, and W. H. Sanders, "ARIMA-based Modeling and Validation of Consumption 

Readings in Power Grids," Proceedings of the lOth International Conference on Critical Information 

Infrastructures Security (CRITIS}, Berlin, Germany, Oct. 5-7, 2015, Lecture Notes in Computer Science val. 95 78, 

pp. 199-210, Springer. 

C. Cheh, G. A. Weaver, and W. H. Sanders, "Cyber-Physical Topology Language: Definition, Operations, and 

Application," Proceedings of the 2015 IEEE 21st Pacific Rim International Symposium on Dependable 

Computing (PRDC), Zhangjiajie, China, Nov. 18-20, 2015, pp. 60-69. 

S. Jauhar, B. Chen, W. G. Temple, X. Dong, Z. Kalbarczyk, W. H. Sanders, and D. M. Nicol, "Model-based 

Cybersecurity Assessment with NESCOR Smart Grid Failure Scenarios," Proceedings of the IEEE 21st Pacific 

Rim International Symposium on Dependable Computing (PRDC}, Zhangjiajie, China, Nov. 18-20, 2015, pp. 

319-324. 

K. Keefe and W. H. Sanders, "Reliability Analysis with Dynamic Reliability Block Diagrams in the Mobius 

Modeling Tool," Proceedings of the 9th EA/Internationol Conference on Performance Evaluation 

Methodologies and Tools (VALUETOOLS}, Berlin, Germany, Dec. 14-16, 2015, pp. 164-170. 

A. Bohara, U. Thakore, and W. H. Sanders, "Intrusion Detection in Enterprise Systems by Combining and 

Clustering Diverse Monitor Data," Proceedings of the Symposium and Boot camp on the Science of Security 

(HotSoS), Pittsburgh, Pennsylvania, April19-21, 2016, pp. 7-16. 

X. Dong, S. Jauhar, W. G. Temple, B. Chen, Z. Kalbarczyk, W. H. Sanders, N. 0. Tippenhauer, and D. M. Nicol, 

"The Right Tool for the Job: A Case for Common Input Scenarios for Security Assessment," in Graphical 

Models for Security: Third International Workshop, GroMSec 2016, Lisbon, Portugal, June 27,2016, Revised 

Selected Papers, Lecture Notes in Computer Science {LNCS} vaL 9987, Springer, pp. 39-61. 

V. Badrinath Krishna, K. Lee, G. A. Weaver, R. K.lyer, and W. H. Sanders, "F-DETA: A Framework for Detecting 

Electricity Theft Attacks in Smart Grids," Proceedings of the 46th Annuai/EEE/IFIP International Conference on 

Dependable Systems ond Networks, Toulouse, France, June 28-July 1, 2016, pp. 407-418. 

U. Thakore, G. A. Weaver, and W. H. Sanders, "A Quantitative Methodology for Security Monitor 

Deployment," Proceedings of the 2016 46th Annuai/EEE/IF/P International Conference on Dependable 

Systems and Networks, Toulouse, France, June 28-July 1, 2016, pp. 1-12. 

M. Rausch, B. Feddersen, K. Keefe, and W. H. Sanders, "A Comparison of Different Intrusion Detection 

Approaches in an Advanced Metering Infrastructure Network Using ADVISE," Proceedings of the 13th 

International Conference on Quantitative Evaluation of Systems (QEST 2016}, Quebec City, Canada, August 23-

25, 2016, Lecture Notes in Computer Science val. 9826, Springer, pp. 279-294. 
55 

William H. Sanders 9/12/2017 29 

A. Fawaz, A. Bohara, C. Cheh, and W. H. Sanders, "Lateral Movement Detection Using Distributed Data 

Fusion," Proceedings of the 20161EEE 35th Symposium on Reliable Distributed Systems (SRDS), Budapest, 

Hungary, Sept. 26-29, 2016, pp. 21-30. 

R. J. Wright, K. Keefe, B. Feddersen, and W. H. Sanders, "A Case Study Assessing the Effects of Cyber Attacks 

on a River Zonal Dispatcher," Proceedings of the 11th International Conference on Critical Information 

Infrastructures Security (CRITIS), Paris, France, October 10-12, 2016, to appear. 

M.A. Noureddine, A. Fawaz, W. H. Sanders, and T. Ba~ar, "A Game-Theoretic Approach to Respond to 

Attacker Lateral Movement," Proceedings of the 7th International Conference on Decision and Game Theory 

for Security (GameSec 2016}, New York, New York, November 2-4, 2016, Lecture Notes in Computer Science 

val. 9996, Springer, 2016, pp. 294-313. 

A.M. Fawaz and W. H. Sanders, "Learning Process Behavioral Baselines for Anomaly Detection," Proceedings 

of the 22nd IEEE Pacific Rim International Symposium on Dependable Computing (PRDC 2017), Christchurch, 

New Zealand, January 22-25,2017, pp. 145-154. 

M.A. Noureddine, A. Marturano, K. Keefe, M. Bashir, and W. H. Sanders, "Accounting for the Human User in 

Predictive Security Models," Proceedings of the 22nd IEEE Pacific Rim International Symposium on 

Dependable Computing (PRDC 2017), Christchurch, New Zealand, January 22-2S, 2017, pp. 329-338. 

W. G. Temple, B. A. N. Tran, B. Chen, Z. Kalbarczyk, and W. H. Sanders, "On Train Automatic Stop Control 

Using Balises; Attacks and a Software-Only Countermeasure," Proceedings of the 22nd IEEE Pacific Rim 

International Symposium on Dependable Computing {PRDC 2017}, Christchurch, New Zealand, January 22-25, 

2017, pp. 274-283. 

V. Badrinath Krishna, M. Rausch, B. E. Ujcich, I. Gupta, and W. H. Sanders, "REMAX: Reach ability-Maximizing 

P2P Detection of Erroneous Readings in Wireless Sensor Networks," Proceedings of the 47th IEEE/IFIP 

International Conference on Dependable Systems and Networks, Denver, Colorado, June 26-29, 2017, to 

appear. 

B. E. Ujcich, U. Thakore, and W. H. Sanders, "ATTAIN; An Attack Injection Framework for Software-defined 

Networking," Proceedings of the 47th IEEE/IFIP International Conference on Dependable Systems and 

Networks, Denver, Colorado, June 26-29, 2017, to appear. 

B. E. Ujcich, A. Miller, A. Bates, and W. H. Sanders, "Towards an Accountable Software-Defined Networking 

Architecture," Proceedings of the 3rd IEEE Conference on Network Softwarization (NetSoft 2017), Bologna, 

Italy, July 3-7,2017, to appear. 

C. Cheh, B. Chen, W. G. Temple, and W. H. Sanders, "Data-Driven Model-Based Detection of Malicious 

Insiders via Physical Access Logs," Proceedings of the 14th International Conference an Quantitative 

Evaluation of SysTems (QEST 2017}, Berlin, Germany, September 5-7, 2017, to appear. 

A. Bohara, M.A. Noureddine, A. Fawaz, and W. H. Sanders, "An Unsupervised Multi-Detector Approach for 

Identifying Malicious Lateral Movement," Proceedings of the 36th Symposium on Reliable Distributed Systems 

(SRDS 2017), Hong Kong, China, September 26-29,2017, to appear. 

M. Rausch, K. Keefe, B. Feddersen, and W. H. Sanders, "Automatically Generating Security Models from 

System Models to Aid in the Evaluation of AM I Deployment Options," Proceedings of the 12th International 

Conference on Critical Information Infrastructures Security (CRITIS}, Lucca, Italy, October 9-13,2017, to 

appear. 
56 

William H. Sanders 9/12/2017 30 

Abstracts in Conference Proceedings 

W. H. Sanders and K. H. Prodromides, "Performability Evaluation of Media Access Control Protocols," at TIMS 

XXX-SOBRAPOXXII, Rio, Brazil, July 15-17,1991. 

W. H. Sanders and M.A. Qureshi, "Reward Model Solution Methods with Impulse and Rate Rewards: An 

Algorithm and Numerical Results," at 2nd ORSA Telecommunications Conference, Boca Raton, FL, Mar. 1992. 

W. H. Sanders, "The Importance of the Integration of Measures, Solution Types, and Application Domains in 

Modeling Schemes," at /CASE Workshop on Software Tools and Techniques for Performance and Reliability 

Estimation, Hampton, VA, June 17-18, 1993. 

W. H. Sanders and L.A. Kant, "Performance Evaluation of the Knockout Switch under Bursty and Non-Uniform 

Traffic Conditions," at ORSA/TIMS Joint Meeting, Detroit, Ml, Oct. 23-26, 1994. 

W. H. Sanders and L.A. Kant, "Analysis of Cell Loss Process in an ATM Switch with Stochastic Activity 

Networks," at 3rd ORSA Telecommunications Conference, Boca Raton, FL, Mar. 20-22, 1995. 

W. D. Oballl and W. H. Sanders, "Quick Simulation of a Performability Model," at Third International 

Workshop on Performobility Modeling of Computer and Communication Systems, Bloomingdale, IL, Sept. 7-8, 

1996. 

K. S. Tso, A. T. Tai, L. Alkalai, S. N. Chau, and W. H. Sanders, "GSU Middleware Architecture Design," 

Proceedings of the 5th IEEE International Symposium on High Assurance Systems Engineering (HASE 2000}, 

Nov. 15-17,2000, Albuquerque, New Mexico, pp. 212-215. 

W. H. Sanders, "Building Dependable Distributed Systems Using the AQuA Architecture" (invited talk) 

Proceedings of SCTF'2001-IX Brazilian Symposium on Fault-Tolerant Computing, Florianopolis, Santa 

Catarina, Brazil, March 5-7, 2001, p. 1. 

D. Daly and W. H. Sanders, "Bounded Decomposition of Stochastic Models," in Extended Abstracts from 

PMCCS-6: the Sixth International Workshop on Performobility Modeling of Computer and Communication 

Systems, Monticello, IL, September 5-7,2003, pp. 1-4. 

A. T. Tai and W. H. Sanders, "Performability Modeling of Coordinated Software and Hardware Fault 

Tolerance," in Extended Abstracts from PMCCS-6: the Sixth International Workshop on Performobility 

Modeling of Computer and Communication Systems, Monticello, IL, September 5-7, 2003, pp. 31-34. 

W. H. Sanders, "Cooperative Research in Multi-Formalism, Multi-Solution Modeling: Opportunities and 

Challenges" (keynote address), Proceedings of ICALP 2003 Satellite Workshop on Stochastic Petri Nets and 

Related Formalisms (Universitiit Dortmund Research Report No. 780), Eindhoven, The Netherlands, June 28-

29, 2003, p. 170. 

W. H. Sanders, "Stochastic Methods for Dependability, Performability, and Security Evaluation," Proceedings 

of the 25th International Conference on Applications and Theory of Petri Nets 2004 (ICATPN 2004}, Bologna, 

Italy, June 21-25,2004. Lecture Notes in Computer Science val. 3099, Springer, p. 97. 
57 

William H. Sanders 9/12/2017 31 

W. H. Sanders, "Probabilistic Validation of Computer System Survivability," Dependable Computing: 

Proceedings of the 2nd Latin-American Symposium {LADC 2005), Salvador, Brazil, October 25-28, 2005, LNCS 

val. 3747, Springer-Verlag, p. 1. 

C. A. Gunter, W. H. Sanders, D. E. Bakken, A. Bose, R. Campbell, G. Gross, C. H. Hauser, H. Khurana, R. K. lyer, 

Z. T. Kalbarczyk, K. Nahrstedt, D. M. Nicol, T. J. Overbye, P. W. Sauer, S. W. Smith, R. J. Thomas, V. Welch, and 

M. Winslett, "Trustworthy Cyber-lnfrastructure for Power {TCIP)," Proceedings of the Workshop on Research 

Directions for Security and Networking in Critical Real-Time and Embedded Systems, San Jose, CA, April4, 

2006, online at <http:/ /moss.csc.ncsu.edu/-mueller/crtes06/>. 

H. V. Ramasamy, C. Cachin, A. Agbaria, and W. H. Sanders, "The Parsimonious Approach to Constructing FaultTolerant Protocols," Fast Abstract in the International Conference on Dependable Systems and Networks 

{DSN-2006), Philadelphia, PA, USA, June 25-28, 2006. 

S. Chen, K. R. Joshi, M.A. Hiltunen, W. H. Sanders, and R. D. Schlichting, "Transaction Dependency Graph 

Construction Using Signal Injection," FastAbstract in the Supplemental Volume afthe 37th AnnuaiiEEE/IFIP 

International Conference on Dependable Systems and Networks, 2007, pp. 424-42S. 

W. H. Sanders, "RRE; A Game-Theoretic Intrusion Response and Recovery Engine for Process Control 

Applications," Proceedings of the 4th International Conference on Critical Infrastructures (CRIS 2009}, 

Linkoping, Sweden, Apr. 28-30, 2009. 

E. Van Ruitenbeek, K. Keefe, W. H. Sanders, and C. Muehrcke, "Characterizing the Behavior of Cyber 

Adversaries; The Means, Motive, and Opportunity of Cyberattacks," FastAbstract in the 2010 International 

Conference on Dependable Systems and Networks Supplemental, Chicago, Illinois, June 28-July 1, 2010, pp. 

17-18. 

W. H. Sanders, "Quantitative Security Metrics" (Keynote 1), Proceedings of the 2010 IEEE International 

Symposium on Modeling, Analysis & Simulation of Computer and Telecommunication Systems (MASCOTS}, 

Miami Beach, Florida, Aug. 17-19,2010, p. xv. 

W. H. Sanders, "Quantitative Evaluation of Security Metrics," Proceedings afthe 7th International Conference 

on the Quantitative Evaluation of Systems (QEST), Williamsburg, Virginia, Sept. lS-18, 2010, p. 306. 

W. H. Sanders, "Building Resilient Infrastructures for Smart Energy Systems (Abstract)," Proceedings of the 3rd 

IEEE PES Conference on Innovative Smart Grid Technologies (ISGT 2012), Washington, D.C., Jan. 16-20, 2012. 

W. H. Sanders, "TCIPG; Trustworthy Cyber Infrastructure for the Power Grid Overview," Proceedings of the 

3rd IEEE PES Conference on Innovative Smart Grid Technologies {ISGT 2012), Washington, D.C., Jan. 16-20, 

2012. 

Bulletins or Reports 

J. F. Meyer, K. H. Muralidhar, and W. H. Sanders, "LAN Protocol Validation," IT/ Technical Report IT/-TR-87-26, 

Communications and Distributed Systems Laboratory, Industrial Technology Institute, Ann Arbor, Ml, Oct. 

1987. 

W. H. Sanders and C. N. Thurwachter, "The Effect of Slot Time on the Perform ability ofToken Bus Networks," 

GAINS Technical Report_ Communications and Distributed Systems Laboratory, Industrial Technology 

Institute, Ann Arbor, Ml, Feb. 1988. 
58 

William H. Sanders 9/12/2017 32 

J. F. Meyer, K. H. Muralidhar, and W. H. Sanders, "Model-Based Performability Evaluation of Local Area 

Networks," Technical Report ITI-TR-88-7, Communications and Distributed Systems Laboratory, Industrial 

Technology Institute, Ann Arbor, Ml, May 1988. 

W. H. Sanders, "Construction and Solution of Performability Models Based on Stochastic Activity Networks," 

Technical Report CRL-TR-9-88, Computing Research Laboratory, Department of Electrical Engineering and 

Computer Science, University of Michigan, Ann Arbor, Ml, Aug. 1988. 

W. P. Delaney, M.P. Kaplan, S.M. Mahoney, W. H. Sanders, and S.C. West, "Experiences in Porting UltraSAN 

from Unix to AIX and the RISC SYSTEM/6000," Tucson Technical Report, TR-82.0531, IBM ADSTAR, Tucson, AZ, 

Sept. 1992. 

A. P. A. van Moorsel and W. H. Sanders, "Adaptive Uniformization: Technical Details," PMRL Technical Report 

93-4, Dept. of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, Jan. 1993. (Also 

Memoranda Informatica 93-22, Computer Science Dept., University ofTwente, The Netherlands). 

L. M. Malhis, W. H. Sanders, B. P. Shah, and S.C. West, "Modeling OAM Using Stochastic Activity Networks 

and UltraSAN," PMRL Technical Report 93-1, Dept. of Electrical and Computer Engineering, University of 

Arizona, Tucson, AZ, Mar. 1993. 

L. M. Malhis, W. H. Sanders, B. P. Shah, and S.C. West, "UitraSAN Models for OAM Modeling Project," PMRL 

Technical Report 93-2, Dept. of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, Mar. 

1993. 

L.A. Kant, L. M. Malhis, W. H. Sanders, B. P. Shah, and S.C. West, "UitraSAN Models for Recycle Modeling 

Project," PMRL Technical Report 93-18, Dept. of Electrical and Computer Engineering, University of Arizona, 

Tucson, AZ, Dec. 1993. 

L.A. Kant, L. M. Mal his, W. H. Sanders, B. P. Shah, and S.C. West, "Modeling Recycle Using Stochastic Activity 

Networks and UltroSAN," PMRL Technical Report 93-19, Dept. of Electrical and Computer Engineering, 

University of Arizona, Tucson, AZ, Dec. 1993. 

V. Gupta, V. Lam, H. V. Ramasamy, W. H. Sanders, and S. Singh, "Stochastic Modeling of Intrusion-Tolerant 

Server Architectures for Dependability and Performance Evaluation," University of Illinois at UrbanaChampaign Coordinated Science Laboratory technical report UILU-ENG-03-2227 (CRHC-03-13), December 

2003. 

H. V. Ramasamy, A. Agbaria, and W. H. Sanders, "Semi-Passive Replication in the Presence of Byzantine 

Faults," University of Illinois at Urbana-Champaign Coordinated Science Laboratory technical report UILUENG-04-2202 (CRHC-04-02), February 2004. 

D. Daly, P. Buchholz, and W. H. Sanders, "An Approach for Bounding Reward Measures in Markov Models 

Using Aggregation," University of Illinois at Urbana-Champaign Coordinated Science Laboratory technical 

report UILU-ENG-04-2206 (CRHC-04-06), July 2004. 

D. Daly, P. Buchholz, and W. H. Sanders, "A Preorder Relation for Markov Reward Processes," IBM Research 

Report RC23827 (W0512-025), December 6, 2005. 

S. Gaonkar, E. Rozier, A. Tong, and W. H. Sanders, "Scaling File Systems to Support Petascale Clusters: A 

Dependability Analysis to Support Informed Design Choices," University of Illinois at Urbana-Champaign 

Coordinated Science Laboratory technical report UILU-ENG-08-2202 (CRHC-08-01), January 2008. 
59 

William H. Sanders 9/12/2017 33 

S. Singh, W. H. Sanders, D. M. Nicol, and M. Seri, "Automatic Verification of Distributed and Layered Security 

Policy Implementations," University of illinois at Urbana-Champaign Coordinated Science Laboratory technical 

report UILU-ENG-08·2209 (CRHC-08-0S), July 2008. 

S. Chen, K. R. Joshi, M.A. Hiltunen, W. H. Sanders, and R. D. Schlichting, "Link Gradients: Predicting the Impact 

of Network Latency on Multi-Tier Applications," University of Illinois at Urbana-Champaign Coordinated 

Science Laboratory technical report UILU·ENG-08-2214 (CRHC-08-08), August 2008. 

S. Gaonkar and W. H. Sanders, "Simultaneous Simulation of Alternative Configurations of Markovian System 

Models," University of illinois at Urbana-Champaign Coordinated Science Laboratory technical report UILU· 

ENG-09-2203 (CRHC-09·02), March 2009. 

E. W. D. Rozier and W. H. Sanders, "Dependency-Based Decomposition of Systems Involving Rare Events/' 

University of Illinois at Urbana-Champaign Coordinated Science Laboratory technical report UILU-ENG-11· 

2203 (CRHC-11-03), January 2011. 

U. Thakore, G. A. Weaver, and W. H. Sanders, "An Actor-Centric, Asset-Based Monitor Deployment Model for 

Cloud Computing." University of illinois at Urbana-Champaign Coordinated Science Laboratory technical 

report UILU-fNG-14-2202, July 2014. 

Publications in above categories that have been submitted for pub!Jcation but not yet accepted 

K. Keefe, B. Feddersen, M. Rausch, R. Wright, and W. H. Sanders, "Stochastic Cybersecurity Model Generation 

with the Mobius Ontology Framework," submitted to the ACM/IEEE 20th International Conference on Model 

Driven Engineering Languages and Systems (MODELS 2017), Austin, Texas, September 17-22, 2017. 

V. Badrinath Krishna, R. Macwan, C. A. Gunter, and W. H. Sanders, "Integrity Attacks on Renewable Energy 

Generators," submitted to the ACM Conference on Computer and Communications Security (CCS), Dallas, 

Texas, October 30-November 3, 2017. 

Matti Hiltunen, Richard Schlichting, Kaustubh Joshi, and William Sanders, U.S. patent 7,536,595: "Systems, Devices, 

and Methods for Initiating Recovery," issued May 19, 2009. 

Shuyi Chen, William Sanders, Matti Hiltunen, Kaustubh Joshi, and Richard Schlichting, U.S. patent 8,073,655: 

"Quantifying the Impact of Network Latency on the End-to-End Response Time of Distributed Applications," 

issued December 6, 2011. 

D. M. Nicol, W. H. Sanders, S. Singh, and M. Seri, U.S. patent 8,209,738: "Analysis of Distributed Policy Rule-Sets for 

Compliance with Global Policy," issued June 26, 2012. 

Invited Talks and Seminars (unpublished) 

"Construction and Solution of Performability Models Based on Stochastic Activity Networks," presented at the 

Computer Science Colloquium, Computer Science Dept., University of Arizona, Tucson, AZ, Sept. 21, 1989. 

"Efficient Modeling Methods for Stochastic Activity Networks," presented at the Computer Group Seminar, 

Department of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, Oct. 6, 1989. 
60 

William H. Sanders 9/12/2017 34 

"Efficient Modeling Methods for Stochastic Activity Networks," presented at the Systems and Industrial 

Engineering Seminar, Department of Systems and Industrial Engineering, University of Arizona, Tucson, AZ, 

Nov. 9, 1989. 

"Applications of Stochastic Activity Networks to Performance/Dependability Evaluation," presented at the 3rd 

International Workshop on Petri Nets and Performance Models, Kyoto, Japan, Dec. 11-13, 1989. 

"Performance Evaluation of Interconnection Networks for ISDN Switching Applications," presented at ltaltel, 

Milan, Italy, June 19, 1990. 

"Performance Evaluation of Computer Systems and Networks," presented at Technology '90, Mesa, AZ, Dec. 

5,1990. 

"Performability Evaluation of Computer Networks Using Stochastic Activity Networks," presented at the 

Hartford Graduate Center, School of Engineering and Science, Hartford, CT, Jan. 18, 1991. 

"Performability Modeling with UltraSAN," Research Report presented at the 19th IFIP Working Group 10.4 

and 11.3 Joint Meeting, Grand Canyon, AZ, Feb. 22-24, 1991. 

"Performability Evaluation of CSMA/CD and CSMA/DCR Protocols under Transient Fault Conditions," Research 

Report presented at the 20th IFIP Working Group 10.4 Meeting, Quebec City, Canada, June 28- July 1, 1991. 

"Evaluation of Computer Networks Using UltraSAN," presented at Computer Science Dept. Seminar, 

University of Twente, The Netherlands, Oct. 4, 1991. 

"Performability Modeling with UltraSAN," presented at Siemens Research Center, Munich, Germany, Oct. 7, 

1991. 

"Dependability Evaluation Using Composed SAN-Based Reward Models," Research Report presented at the 

21st IFIP Working Group 10.4 Meeting, Maui, Hawaii, Feb. 20-24, 1992. 

"Evaluation of Media Access Control Protocols under Transient Fault Conditions," presented at the 21st IFIP 

Working Group 10.4 Meeting, Maui, Hawaii, Feb. 20-24, 1992. 

"Performability Evaluation: Models, Algorithms, and Applications," presented at the Systems and Industrial 

Engineering Seminar, Dept. of Systems and Industrial Engineering, University of Arizona, Tucson, AZ, Feb. 27, 

1992. 

"Reward Models with Impulse and Rate Rewards: An Algorithm and Numerical Results," Research Report 

presented at the 22nd IFIP Working Group 10.4 Meeting, Cape Cod, MA, July 9-14, 1992. 

"A Model-Based Foundation for Evaluating Large Scale Telecommunications Systems," presented at US West 

Advanced Technologies, Boulder, CO, Dec. 14, 1992. 

"Analytic Performability Evaluation of a Group-Oriented Multicast Protocol," presented at Computer Science 

Dept. Seminar, University of Twente, The Netherlands, July 2, 1993. 

"Analytic Performability Evaluation of a Group-Oriented Multicast Protocol: A Case Study in the Use of 

Reduced Base Model Construction Methods," presented at ECE Dept. Seminar, Dept. of Electrical and 

Computer Engineering, University of Illinois, Urbana-Champaign, IL, Sept. 20, 1993. 
61 

William H. Sanders 9/12/2017 35 

"Performability Evaluation of Psync," presented at the Institute lnformatik, TU Wien (Technical University 

Vienna), Wien, Austria, Oct. 18, 1993. 

"Analytic Performability Evaluation of a Group-Oriented Multicast Protocol," Research Report presented at 

the IFIP Working Group 10.4 Meeting, San Diego, CA, Jan. 7-8, 1994. 

"Adaptive Uniformization," Research Report presented at IFIP Working Group 10.4 Meeting, Horseshoe Bay, 

TX, June 18-19, 1994. 

"The UltraSAN Project," presented at Electrical and Computer Engineering Dept., University of California at 

Irvine, Oct. 1994. 

"SAN-Based Importance Sampling Methods," Invited Lecture at Dagstuhl Seminar on Performance and 

Dependability Modeling with Stochastic Petri Nets, Dagstuhl, Germany, May 22-25, 1995. 

"New Methods for Performance/Dependability Evaluation," Invited Seminar, Siemens Corporate Research 

and Development, May 29, 1995. 

"The UltraSAN Project," presented at Dept. of Systems and Computer Engineering, Carleton University, 

Ottawa, Canada, Sept. 25, 1995. 

"An Analytic Performability Evaluation of a Group-Oriented Multicast Protocol," Carleton University, Ottawa, 

Canada, Sept. 26, 1995. 

"Transient Solution of Markov Models by Combined Adaptive and Standard Uniformization," IFIP 7.3 

Workshop, Lambertville, NJ, May 27-28, 1996. 

"Transient Solution of Markov Models by Combined Adaptive and Standard Uniformization," 30th Meeting of 

IFIP WG 10.4, Appi, lwate, Japan, June 27-July 1, 1996. 

"Uniformization Methods for Markov Models," !CASE Colloquium, NASA Langley Research Center, July 17, 

1996. 

"A Changepoint Algorithm for Parallel Simulation," NASA !CLASS Review, NASA Langley Research Center, 

October 1, 1996. 

"Largeness-Tolerant Methods for Markov Models," Performance '96 Hot Topic Session Presentation, 

Lausanne, Switzerland, October 7-11,1996. 

"Issues in Modeling Distributed System Software with Stochastic Activity Networks: A Case Study: Modeling 

Psync Communication Software/' Performance '96 Hot Topic Session Presentation, Lausanne, Switzerland, 

October 7-11,1996. 

"A New Algorithm to Compute the Distribution of Reward Accumulated Over a Finite Interval," WG7.3 

Workshop on Performance Evaluation, Lausanne, Switzerland, October 11-12, 1996. 

"Unified Performance/Dependability Assessment Environments," Department Seminar, Electrical Engineering 

and Computer Science Department, University of Michigan, April 21, 1997. 

"Unified Performance/Dependability Assessment Environments," Departmental Seminar, Department of 

Computer Science, Dartmouth University, April 28, 1997. 
62 

William H. Sanders 9/12/2017 36 

"AQuA: Adaptive Quality of Service for Availability," presented at IFIP WG 10.4 meeting, Honolulu, Hawaii, 

January 10-15, 1999. 

"Dependability Management of Distributed Objects in AQuA Using Proteus," presented at a Computer Science 

Department Seminar, University of Arizona, February 2, 1999. 

"Mobius: An Integrated Performance/Dependability Evaluation Environment," presented at the 4th DARPA 

Fault-Tolerant Computing Workshop at JPL, Pasadena, CA, March 23-25, 1999. 

Keynote speaker at the 1999 International Workshop on Petri Nets and Performance Models (Sept. 1999). 

Keynote speaker at MASCOTS '99, the Seventh International Symposium on Modeling, Analysis and 

Simulation of Computer and Telecommunication Systems (Oct. 1999). 

"Integrated Frameworks for Multi-Level and Multi-Formalism Modeling," presented at the Workshop on 

Modeling of Heterogeneous Networks, University of Maryland, October 25, 1999. 

"Integrated Frameworks for Multi-Level and Multi-Formalism Modeling," Distinguished Seminar Series, ECE 

Department, Washington State University, March 2, 2000. 

"AQuA: An Infrastructure for Building Dependable Distributed Systems," Seminar Series, ECE Department, 

University of Wisconsin, April14, 2000. 

"AQuA: An Infrastructure for Building Dependable Distributed Systems," Seminar Series, EE Department, 

University of Pennsylvania, April17, 2000. 

"Model Construction in U/traSAN," Formal Methods and Performance Analysis: The First EEF-Summerschool 

on Trends in Computer Science, Nijmegen, the Netherlands, July 3-7, 2000. 

"Building Dependable Distributed Systems Using the AQuA Architecture," invited talk presented at Microsoft 

Research, August 24, 2000. 

"AQuA- Adaptive Quality of Service for Availability," invited talk presented at the International SRDS 

Workshop on Dependable System Middleware and Group Communication, NUrnberg, Germany, October 

2000. 

"Integrated Frameworks for Multi-level and Multi-formalism Modeling," invited talk presented at AT&T 

Research, November 17,2000. 

"Enabling and (in my Humble Opinion) Essential Technologies for Dependability Benchmarking," 39th IFIP 

Working Group 10.4 Meeting, March 1, 2001. 

"Design and Validation of Highly Available Systems," IBM Manageability Workshop, May 8, 2001. 

"The Mobius Framework- With an Application to Stochastic Process Algebras," 40th IFIP Working Group 10.4 

Meeting, Stenungsund, Sweden, July 2001. 

"Multi-level and Multi-formalism Modeling of Ultra .. farge Networks," Workshop on Modeling and Simulation 

of Ultra .. Large Networks: Challenges and New Research Directions, Tucson, AZ, November 19-20, 2001. 
63 

William H. Sanders 9/12/2017 37 

"Strategy for a Dependable Information Society: Creating a Science/Engineering to Validate the Critical 

Information Infrastructure," EU-US Workshop on RCD Strategy for a Dependable Information Society, 

December 1, 2001. 

"Dealing with Largeness and Complexity in System Models," invited talk at the Universitat Dortmund, 

Germany, December 2001. 

"Designing and Assessing Adaptive Dependable Distributed Systems: Putting the Model in the Loop," invited 

talk presented at the 41st Meeting of IFIP Working Group 10.4, Saint John, Virgin Islands, USA, January S, 

2002. 

liThe MObius Performance Engineering Framework/' NSF Next Generation Software Workshop, Austin1 Texas, 

February 28, 2002. 

"The Mobius Performance/Dependability Evaluation Framework," invited talk presented at CNR, Pisa, Italy, 

March 21, 2002. 

"The Mobius Framework and Tool," invited talk presented at the University ofTwente, The Netherlands, May 

23,2002. 

"Building and Validating Intrusion-Tolerant Distributed Systems," presented at HP Labs, Palo Alto, CA, 

February 11, 2003. 

"Multi-formalism and Multi-solution Frameworks for Dependability and Performability Evaluation," presented 

at Dagstuhi-Seminar 03201 on Probabilistic Methods in Verification and Planning, May 11-16,2003. 

Keynote talk on "Cooperative Research in Multi-Formalism, Multi-Solution Modeling: Opportunities and 

Challenges" at the Workshop on Stochastic Petri Nets and Related Formalisms (ICALP 2003 Satellite 

Workshop), Eindhoven, The Netherlands, June 28-29, 2003. 

"Design, Implementation, and Validation of an Intrusion-Tolerant Publish and Subscribe System," Department 

Seminar, University of Erlangen-Nuremberg, October 3, 2003. 

Participated in panel on "Trustworthiness of Open Information Systems: How Should It Be Achieved?" at the 

22nd IEEE Symposium on Reliable Distributed Systems, Florence, Italy, October 6-8, 2003. 

Participated in panel on "Dependability Benchmarks- Can You Rely on Them?" at the 1st Latin American 

Symposium on Dependable Computing, Sao Paulo, Brazil, October 21-24, 2003. 

"Design, Implementation, and Validation of an Intrusion-Tolerant Publish and Subscribe System," Department 

Seminar, Universidade de Lisboa, Portugal, February 16, 2004. 

"Design, Implementation, and Validation of an Intrusion-Tolerant Publish and Subscribe System," IFIP 

Research Report Presentation, Moorea, French Polynesia, March 9, 2004. 

Keynote talk at Petri Nets 2004: 25th International Conference on Application and Theory of Petri Nets, 

Bologna, Italy, June 21-25, 2004. 

Keynote speaker at the Windber Research Institute Showcase for Biotechnology, Johnstown, Pennsylvania, 

August 15, 2005. 
64 

William H. Sanders 9/12/2017 38 

Keynote speaker at LADC'2005: 2nd Latin-American Symposium on Dependable Computing, Bahia, Brazil, 

October 25-28, 2005. 

"Protecting the Power Grid in Cyberspace," A CD IS Seminar at the University of Illinois Program in Arms 

Control, Disarmament, and International Security, March 29, 2006. 

"Infrastructure Reliability & Security Management using Partially Observable Markov Decision Processes," IFIP 

10.4 Working Group Meeting, June 29-30, 2006. 

"Automatic Recovery Using Bounded Partially Observable Markov Decision Processes," IBM Research 

Seminar, Zurich, July 13, 2006. 

"Probabilistic Validation of Computer System Security," Invited Tutorial at 2006 Quantitative Evaluation of 

Systems Conference, Sept. 2006. 

"TCIP: Trustworthy Cyber Infrastructure for the Power Grid," DOE Office of Electricity Delivery and Energy 

Reliability Visualization and Controls Program Peer Review, Oct. 2006. 

"TCIP: Trustworthy Cyber Infrastructure for Power," IFIP 10.4 Workshop, Jan 2007. 

"Implementing Sound Access Policy with the Access Policy Tool," 13P Control Systems Security Workshop, Feb. 

15, 2007. 

"Dealing with Largeness and Complexity in System Models: The Mobius Approach," Virginia Tech, February 

26, 2007. 

"TCIP: Trustworthy Cyber Infrastructure for Power," Department Seminar, Agricultural Engineering Dept., 

University of Illinois, March 2007. 

"Probabilistic Validation of Computer System Security," Department Seminar, University of Erlangen, 

Germany, March 19, 2007. 

Keynote speaker, "Probabilistic Validation of Computer System Security," at First Open Workshop ofthe 

ReSIST European Network of Excellence (Resilience for Survivability in Information Society Technologies), 

Budapest, Hungary, March 21-22, 2007. 

Keynote speaker, "Automatic Recovery from Failures and Attacks Using Bounded Partially Observable Markov 

Decision Processes," at the Workshop on Recent Advances in Intrusion-Tolerant Systems (WRAITS 2007), held 

in conjunction with the European Conference on Computer Systems (EuroSys 2007), Lisbon, Portugal, March 

23, 2007. 

Keynote speaker, "TCIP: Trustworthy Cyber lnfrastucture for Power," at the Cyber Security and Information 

Infrastructure Research Workshop (CSIIR), Oak Ridge, Tennessee, May 14-15, 2007. 

Participated in panel on "Architecting Critical Infrastructures" at the DSN 2007 Workshop on Architecting 

Dependable Systems, Edinburgh, Scotland, June 27,2007. 

"Dealing with Largeness and Complexity in System Models: The Mobius Approach," Department Seminar, 

University of Edinburgh, UK, June 2007. 
65 

William H. Sanders 9/12/2017 39 

"Probabilistic Validation of Computer System Security," Department Distinguished Seminar, Computer 

Science Department, College of William & Mary, Williamsburg, VA, Nov. 1, 2007. 

"Mobius: A Flexible, Extensible, Environment for Dependability, Safety, and Security Evaluation," U.S. Army 

Engineering and Support Center, Huntsville, AL, Nov. 27, 2007. 

Keynote speaker, "Probabilistic Quantification of Security," at the 2007 Pacific Rim Dependable Computing 

Conference, Melbourne, Australia, Dec. 17,2007. 

Keynote speaker, "RRE: A Game-Theoretic Intrusion Response and Recovery Engine," CeDICT Workshop on 

Dependable ICT Systems, Haag Brabant, Utrecht, The Netherlands, Apr. 24, 2009. 

Keynote speaker, "RRE: A Game-Theoretic Intrusion Response and Recovery Engine for Process Control 

Applications," 4th International CRIS Conference on Critical Infrastructures, Link6ping, Sweden, Apr. 28, 2009. 

Participant on panel on "Research Challenges in Failure Diagnosis," Workshop on Failure Diagnosis at the 58th 

IFIP WG 10.4 Meeting, Chicago, IL, June 26, 2010. 

Keynote speaker, "Quantitative Security Metrics," 18th Annual Meeting of the IEEE International Symposium 

on Modeling, Analysis and Simulation of Computer and Telecommunication Systems (MASCOTS 2010), Miami 

Beach, FL, Aug. 17-19,2010. 

"Trustworthy Cyber Infrastructure for the Power Grid," Department of Electronic Systems, Aalborg University, 

Denmark, Nov. 16, 2010. 

"Cyber·security in the Electrical Power Grid/' Tutorial, Hawaii International Conference on System Sciences, 

Jan 4, 2011. 

"Smarter Power Grids: Challenges and Research Directions," IFIP 10.4 Workshop on Workshop on 

Dependability Issues for a Smarter Planet, Snowmass, CO, Jan. 12-16, 2011. 

Securing the Grid Panel, 2011 National Electricity Forum, Washington DC, Feb. 16-17, 2011. 

"Smart Grid Security Efforts@ Illinois," SANS 2011 North American SCADA and Process Control Summit, 

Orlando, FL, Feb. 28 Mar. 1, 2011. 

"Making Sound Cyber Security Decisions Through a Quantitative Metrics Approach," Dept. Seminar, City 

University, London, March 9, 2011. 

Congressional Briefing on Power Grid Infrastructure and Security and Resiliency, Washington, D.C., Mar. 30, 

2011. 

"RRE: A Game-Theoretic Intrusion Response and Recovery Engine," TRUST Seminar, University of California, 

Berkeley, Mar. 31, 2011. 

Panel chair and participant, "Perspectives from Industry," Innovation Summit: Building Bridges to 

Interdisciplinary Learning at Illinois Integrating Education and Research, Apr. 13-14,2011. 

Keynote speaker, "Making Sound Cyber Security Decisions through a Quantitative Metrics Approach," 1st 

International Workshop on Resilience Assessment of Critical Infrastructures, Silo Jose dos Campos, Brazil, Apr. 

25, 2011. 
66 

William H. Sanders 9/12/2017 40 

Keynote speaker, "Making Sound Cyber Security Decisions through a Quantitative Metrics Approach," 11th 

Annual Conference on High Confidence Software and Systems, Annapolis, Maryland, May 1-6, 2011. 

"Building Resilient Infrastructures for Smart Energy Systems," TCIPG Summer School on Cyber Security for 

Smart Energy Systems, Q Center, St. Charles, Illinois, June 13-17, 2011. 

"TCIPG Highlights," NITRO Tailored Trustworthy Spaces: Solutions for the Smart Grid Workshop, Arlington, 

Virginia, July 18-20, 2011. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," Distinguished ECE 

Department Seminar, Vanderbilt University, Sept. 13, 2011. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," University of Texas at Dallas, 

Sept. 26, 2011. 

"Analysis of Enterprise and Control Network Firewall Configurations for Compliance with Global Policy," 

Honeywell, Minneapolis, Minnesota, Oct. 3, 2011. 

"Making Sound Design Decisions Using Quantitative Security Metrics," CyLAB Seminar, Carnegie Mellon 

University, Pittsburgh, Penn., Nov. 14, 2011. 

"Making Sound Design Decisions Using Quantitative Security Metrics," TCIPG Seminar Series on Technologies 

for a Resilient Power Grid, University of Illinois at Urbana-Champaign, Jan. 6, 2012. 

"Intrusion Detection for AMI," EPRI Workshop, Huntington Beach, CA, Feb.13, 2012. 

"Making Sound Design Decisions using Quantitative Security Metrics," FY12 NSF Distinguished Lecture Series 

in Computer Information Science & Engineering, National Science Foundation, Arlington, Virginia, Feb. 15, 

2012. 

"CPS Challenges for a Trustworthy Power Grid Cyber Infrastructure," NIST Foundations for Innovation in 

Cyber-Physical Systems, Chicago, IL, Mar. 13, 2012. 

"The Path to a Secure and Resilient Power Grid Infrastructure/' Cybersecurity and Smart tnfrastructure: 

Ensuring Resilience and Deterrence, American Chemical Society Hill Briefing, Rayburn House Office Building, 

Washington DC, April19, 2012. 

Keynote speaker at the 3rd ACM/SPEC International Conference on Performance Engineering (ICPE 2012), 

"Assuring the Trustworthiness of the Smarter Electric Grid," Boston, Massachusetts, Apr. 23, 2012. 

"Understanding the Role of Automated Response Actions to Improve AMI Resiliency," NIST Cyber-Physical 

Systems Workshop, Gaithersburg, MD, April 24, 2012. 

Keynote speaker, "Ensuring System Resilience at Design Time: A User and Attacker Oriented Approach," 

Designed-In Security Workshop at the 2012 High Confidence Software and Systems Conference (HCSS), 

Annapolis, Maryland, May 6-11, 2012. 

"CPS Challenges for a Trustworthy Power Grid Cyber-Physicallnfrastructure," CTO Roundtable on CyberPhysical Systems: Building Safety, Security, Reliability, and Robustness into the Smart System Technologies of 

the Future, Washington, DC, June 18, 2012. 
67 

William H. Sanders 9/12/2017 41 

"Quantitative Evaluation of System Security using ADVISE," Workshop on the Science of Humans and CyberSecurity, Dartmouth College, Dartmouth, NH, June 19, 2012. 

"Trustworthy Cyber Infrastructure for the Power Grid (TCIPG)," DOE Cybersecurity for Energy Delivery 

Systems Peer Review, Washington, DC, July 24-26, 2012. 

Keynote speaker, "Assuring the Trustworthiness of the Smarter Electric Grid," 11th IEEE International 

Symposium on Network Computing and Applications {IEEE NCA12), Cambridge, Massachusetts, Aug. 23-25, 

2012. 

"Analysis of Enterprise Network Firewall Configurations for Compliance with Global Policy," School of 

Electrical Engineering and Computer Science Seminar, Washington State University, Pullman, Washington, 

Sept. 6, 2012. 

Distinguished Lecture speaker, "Building Resiliency into the Smarter Electric Grid," Department of Computer 

Science, Wayne State University, Detroit, Michigan, Sept. 11, 2012. 

Keynote speaker at the Workshop on Research and Use of Multiformalism Modeling Methods (WRUMMM), 

London, UK, Sept. 17, 2012. 

Keynote speaker, "Building Resiliency into the Smarter Electric Grid," Association of Illinois Electric 

Cooperatives Annual Meeting, Springfield, IL, Oct. 3, 2012. 

"Building Resiliency into the Smarter Electric Grid," Electrical and Computer Engineering Dept. Seminar, Univ. 

of Miami, Miami, FL, Oct. 8, 2012. 

"Attack Prevention and Detection," at the IEEE Central illinois Section's Technical Workshop: Cyber Security 

with Application on Electric Power Grids, Urbana, Illinois, Nov. 17, 2012. 

"Challenges and Approaches for a Trustworthy Smart Grid Infrastructure," Department of Computing 

seminar, Imperial College London, London, UK, Dec. 10, 2012. 

"Science of Security Lab lets Propose a Hard Problems Structure That Can Be Used to Organize Their Current 

and Potentially Future Research,'7 2012 Science of Security Community Meeting, National Harbor, Maryland, 

Nov. 29-30, 2012. 

"Cybersecurity Needs for the Smart Grid," NIST Smart Grid Advisory Committee Meeting, Gaithersburg, MD, 

Dec. 19, 2012. 

"Challenges and Progress Toward a Resilient Electric Grid," Research Report at IFIP 10.4 Working Group on 

Dependable Computing, Tavira, Portugal, Jan. 21, 2013. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," College of Computing and 

Informatics Seminar, University of North Carolina- Charlotte, Charlotte, NC, Feb. 6, 2013. 

"Securing the Grid," Tech Council of Maryland, Bethesda, MD, Feb. 7, 2013. 

"TCIPG Center Overview: Trustworthy Cyber Infrastructure for the Power Grid," FREEDM Center Industry 

Workshop, North Carolina State University, Raleigh, NC, Feb. 13, 2013. 
68 

William H. Sanders 9/12/2017 42 

Plenary speaker, "Analysis of Process Control Network Firewall Configurations for Compliance with Global 

Policy," at the 2nd IEEE INFOCOM Workshop on Communications and Control for Smart Energy Systems 

(CCSES 2013), INFOCOM'13, Turin, Italy, Apr. 19, 2013. 

"Security through Resilience," United Technologies Research Center, East Hartford, CT, Sept. 23, 2013. 

Keynote speaker, "Building Resilience into the Smart Grid," 3rd Great Lakes Symposium on Smart Grid and 

the New Energy Economy, Chicago, IL, Sept. 25, 2013. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," Institution en for 

Datavetenskap IDA-30 lecture, Linkopings Universitet, Linkoping, Sweden, Nov. 11,2013. 

"Challenges and Opportunities in Modeling the Power Grid Cyber-Physicallnfrastructure," invited lecture at 

Schloss Dagstuhl Seminar 14031: Randomized Timed and Hybrid Models for Critical Infrastructures, Dagstuhl, 

Germany, Jan. 12-17, 2014. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," Cyber Seminar Series, 

Department of Homeland Security, Washington, D.C., Apr. 14, 2014. 

Semi-plenary keynote speaker, "Making Sound Design Decisions using Quantitative Security Metrics," 

Resilience Week 2014, Denver, CO, Aug. 19-21, 2014. 

"Making Sound Security Decisions using Quantitative Security Metrics," presentation to SCORE Working 

Group, Office of the Director of National Intelligence, Baltimore, MD, Oct. 3, 2014. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," presented at the U.S. 

Department of Energy, Washington, DC, Dec. 15, 2014. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," School of Electrical 

Engineering and Computer Science Colloquium talk, Oregon State University, Corvallis, OR, Jan. 12, 2015. 

Panel speaker, "Department Heads Panel," ECEDHA Annual Conference and ECExpo, Hilton Head, SC, Mar. 14, 

2015. 

Keynote speaker, "Cyber Security of Power Grids," JST-NSF-DFG-RCN Workshop on Distributed Energy 

Management Systems, Washington, DC, Apr. 20, 2015. 

"Challenges and Approaches for a Trustworthy Power Grid Cyber Infrastructure," ECE Spring 2016 Colloquium 

Series, Rutgers University, Piscataway, NJ, Mar. 9, 2016. 

Afternoon keynote speaker, "Engineering in Cyber Resiliency: A Pragmatic (But Not Perfect) Approach," 

October 2016 C3E Workshop, Atlanta, GA, Oct. 17, 2016. 

"Engineering in Cyber Resiliency: A Pragmatic (But Not Perfect) Approach," Computer Systems Colloquium, 

Stanford University Department of Electrical Engineering, Stanford, CA, Oct. 19, 2016. 

"Engineering in Cyber Resiliency: A Pragmatic (But Not Perfect) Approach," SnT Distinguished Lecture, 

Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg, Nov. 11, 2016. 

Participated in panel on "Security and Privacy of Big-data Applications," 22nd IEEE Pacific Rim International 

Symposium on Dependable Computing (PRDC 2017), Christchurch, New Zealand, Jan. 24, 2017. 
69 

William H. Sanders 9/12/2017 43 

Title TBD: Invited talk at the Workshop on Data Mining for Cyber-physical and Industrial Systems {organized in 

association with the International Conference on Data Mining (ICDM 2017), New Orleans, LA, Nov. 18,2017. 

Software Demonstrations at Technical Conferences 

Presented at 4th International Workshop on Petri Nets and Performance Models, Melbourne, Australia, Dec. 

2-5, 1991. (U/traSAN Version 0.1) 

Presented at !CASE Workshop on Software Tools and Techniques for Performance and Reliability Estimation, 

June 17-18, 1993. (UitraSAN Version 1.1.3) 

Presented at 23rd Annual International Symposium on Fault-Tolerant Computing, Toulouse, France, June 22-

24, 1993. (UitraSAN Version 1.1.3) 

Presented at Performability Modeling of Computer and Communication Systems, Mont St. Michel, France, 

June 28-30, 1993. (UitraSAN Version 1.1.3) 

Presented at 12th Symposium on Reliable Distributed Systems, Princeton, NJ, Oct. 6-8, 1993. (UitraSAN 

Version 2.0) 

Presented at 4th International Workshop on Petri Nets and Performance Models, Toulouse, France, Oct. 20-

22, 1993. (UitraSAN Version 2.0) 

Presented at 7th International Conference on Modelling Techniques and Tools for Computer Performance 

Evaluation, Vienna, Austria, May 3-6, 1994. (UitraSAN Version 2.0.1) 

Presented at 1995 International Workshop on the Numerical Solution of Markov Chains, Raleigh, NC, January 

16-18, 1995. (U/traSAN Version 3.0) 

Presented at IEEE International Computer Performance and Dependability Symposium, Erlangen, Germany, 

April1995. (UitraSAN Version 3.01) 

Presented at 5th IFIP Working Conference on Dependable Computing for Critical Applications, Urbana, IL, 

Sept. 27-29, 1995. (UitraSAN Version 3.01) 

Presented at 6th International Workshop on Petri Nets and Performance Models, Durham, NC, Oct. 3-6, 1995. 

(U/traSAN Version 3.01) 

Presented at IEEE International Computer Performance and Dependability Symposium, Urbana, Illinois, Sept. 

1996. (UitraSAN Version 3.1) 

Presented at International Workshop on Petri Nets and Performance Models/International Conference on 

Modelling Techniques and Tools for Computer Performance Evaluation, June 1997. ( U/traSAN Version 3.3) 

Presented at 27th International Symposium on Fault-Tolerant Computing, Seattle, Washington, June 24-27, 

1997. (UitraSAN Version 3.3) 

Presented at DARPA Quorum/High Confidence Computing PI Meeting, San Diego, California, July 12-17, 1998. 

(AQuA Architecture 1.0) 
70 

William H. Sanders 9/12/2017 44 

Presented at 4th DARPA Fault-Tolerant Computing Workshop, Jet Propulsion laboratory, Pasadena, 

California, March 23-25, 1999. (Mobius Version 1.0) 

Presented at PNPM'99: 8th International Workshop on Petri Nets and Performance Models, Zaragoza, Spain, 

Sept. 8-10, 1999. {Mobius Version 1.0) 

Presented at DARPA Quorum Technology Demonstration Event, Crystal City, VA, February 7-11, 2000. (AQuA 

Architecture 2.1) 

Presented at IEEE International Computer Performance and Dependability Symposium /International 

Conference on Modelling Techniques and Tools for Computer Performance Evaluation, Schaumburg, !L, 

March 27-30, 2000. (Mobius Version 1.0) 

Presented at the DARPA OASIS PI meeting, Santa Fe, New Mexico, July 24-27, 2001. (ITUA Group 

Communication System Version 1.0) 

Presented at the International Workshop on Petri Nets and Performance Models, Aachen, Germany, 

September 11-14, 2001. (Mobius Version 1.1) 

Presented at the DARPA Oasis PI Meeting, Hilton Head Island, South Carolina, March 12-15, 2002. (ITUA 

Architecture 1.0) 

Presented at DARPA Tech 2002 (DARPA's 22nd Systems and Technology Symposium), Anaheim, CA, July 31, 

2002. (ITUA Architecture 3.0) 

Presented at DARPA DISCEX Ill, Washington, D.C., April 23, 2003. (ITUA Architecture 3.1) 

Grants, Contracts and Gifts received for Research and Teaching 

Year BriefTitle Source of Funds #of PI's 

1990-1992 Model-Based Evaluation of Manufacturing Intel Corp. 

Networks and Systems, $160,000, PI Sanders. 

1990-1992 SAN-Based Perform ability Tools for Evaluating Bellcore 

Large-Scale Telecommunication Systems, $43,090, PI 

Sanders. 

1990-1993 Picture Archiving and Communications Systems: Toshiba Corp 

System-level and Modeling Issues, $75,000, PI Sanders. 

1991-1992 A Model-Based Foundation for Evaluating UA Adv. Telecom. 

Large-Scale Telecommunications Systems, Research Project 

$12,700, PI Sanders. 

1991-1993 SAN-Based Performability Tools for Evaluating US West Adv. Tech. 

large-Scale Telecommunication Systems, $239,775, 

PI Sanders. 

1992-1994 SAN-Based Performance Modeling of Distributed- IBM Corp. 

System Software, $322,995, PI Sanders. 
71 

William H. Sanders 9/12/2017 45 

1992-1999 Algorithm Development in Support of Computer-Based Motorola Corp. 

Performance-Dependability Evaluation, $520,000, PI Sanders. 

1993-1996 Massively Parallel Simulation of Large-Scale, Nat'! Science Found. 6 

High Resolution Ecosystem Models, $900,000, PI 

Zeigler. (left project in Aug. 1994, when I moved to Ul) 

1995 Methods for Perform ability Evaluation, $10,000 Vysis Corp. 

unrestricted gift, PI Sanders. 

1995 Equipment in Support of Performance/Dependability Intel Corp. 

Evaluation, PI Sanders. 

1995-1996 Algorithms for Performance, Dependability, and NASA Langley Res. Ctr. 

Perform ability Evaluation using Stochastic Activity 

Networks, $75,000, PI Sanders. 

1996 Methods for Performability Evaluation, $10,000 Nat. Media Labs (3M) 

unrestricted gift, PI Sanders. 

1996 Routing and Robust Transport of Multi-Class Bellcore 

Applications Subject to QOS Constraints, $35,000 

unrestricted gift, PI Sanders. 

1996-1997 Acquisition of Research Equipment for High-Speed NSF and 

Computing and Networking Initiative, $750,000 matching funds 

(NSF) plus matching funds (total: $1,601,738), PI 

lyer. 

1996-1999 A Quality of Service Approach to Survivability, DARPA(BBN 

$726,086 (Amount of subcontract to Ul from BBN; prime) 

Total amount of DARPA contract to BBN $1,981,642), 

PI Sanders. 

1996-2000 Rapid Analysis and Recovery Techniques for Critical DARPA 

Defects and Failures in Command and Control 

Applications, $1,437,632, PI Sanders. 

1997 Performability Modeling of Embedded Systems, Interstate Electronics 

$20,000 unrestricted gift, PI Sanders. 

1997-2000 Survivability of Large-Scale Information Systems, DARPA (BBN 

$300,000 (amount of subcontract from BBN; total prime) 

amount of DARPA contract to BBN is $1,644,301), 

PI Sanders. 

1999-2002 An Integrated Framework for Performance Engineering NSF 

and Resource-Aware Compilation, $1,949,330, PI Sanders. 

1999-2002 Motorola Center for High-Availability System Motorola 
72 

William H. Sanders 9/12/2017 46 

Validation, $850,000, PI Sanders. 

2000-2001 Distributed Object Integration for the Quorum Integration DARPA(BBN 

Effort, $850,000, PI Sanders. prime) 

2000-2003 Intrusion Tolerance by Unpredictable Adaptation, DARPA(BBN 

$514,977 (subcontract amount; total award $1,994,657), prime) 

PI Sanders. 

2000-2003 ITR: Experimental Validation of Large-Scale Networked NSF 

Software Systems, $1,800,000, PI Sanders. 

2001-2003 Validation of Intrusion-Tolerant Systems, $327,170, DARPA(BBN 

PI Sanders. prime; add-on to the 

Intrusion Tolerance project) 

2002-2004 Survivability of CECOM SMS Services: An ITUA Approach DARPA (BBN prime) 

and Probabilistic Quantification of Security Metrics fn 

Cyberspace, $1SO,OOO, PI Sanders. 

2002-2005 Designing Protection and Adaptation into a Survivability DARPA (BBN prime) 

Architecture: Demonstration and Validation (DPASA-DV), 

$1,285,437, PI Sanders. 

2003-2005 US-Germany Cooperative Research: Analysis of Multi- NSF 

Paradigm Mobius Models Using Kronecker-Based 

Techniques, $19,666, PI Sanders. 

2003-2006 Creating an Integrated Modular Environment for the NSF 

Modelling, Analysis, and Verification of Embedded 

Hybrid Systems, $255,000, PI Neogi. 

2004-2005 Applications of Stochastic Modeling to Biological Systems Pioneer Hi-Bred 

gift, $240,000, PI Sanders. 

2004-2006 Information Trust Institute funding, $500,000, State of Illinois Dept. of 

PI Sanders. Commerce and Economic 

Opportunity 

2004-2006 On-Line Model-Based Adaptation Research, $70,000, AT&T 

PI Sanders. 

2004-2008 NGS: A Compiler-Enabled Model- and Measurement-Driven NSF 4 

Adaptation Environment for Dependability and Performance, 

$1,200,000, PI Sanders. 

2004-2012 Cyber Situational Awareness and Network Defenses Boeing 

($1,094,640), PI Sanders initially, then later Kalbarzcyk. 

2004- Boeing Trusted Software Center, $6,584,000 ($484,000 Boeing 

of which is allocated to Sanders), PI Sanders initially, 
73 

William H. Sanders 9/12/2017 47 

later transitioned to Nicol. 

2005-2006 Information Trust Institute funding, $986,643, US Commerce Dept. 

PI Sanders. 

2005-2007 Unifying Stakeholders and Security Programs to Address DHS (13P prime) 

SCADA Vulnerability and Infrastructure Interdependencies, 

$535,000 ($267,500 allocated to Sanders), PI Sanders. 

2005-2010 CT-CS: Trustworthy Cyber Infrastructure for the Power Grid, NSF 

$7,125,000, PI Sanders. 

2006 EU-US Summit Series on Cyber Trust: Workshop on System NSF 

Dependability & Security, $61,127, PI Sanders. 

2006-2007 Adoptability Evaluation of SPI Technologies, $325,000, SAIC-DEMACO 

PI Nicol. 

2006-2007 Sandia-Trustworthy Cyber Infrastructure for the Power Grid, Sandia National 

$125,000, PI Sanders. Laboratories 

2006-2008 Information Trust Institute funding, $987,228, US Commerce Dept. (SBA) 

PI Sanders. 

2006-2009 Detecting and Preventing Attacks with Vulnerability NSF 

Signatures, $412,000, PI Borisov. 

2006-2010 CSR-PDOS: Improving System Reliability via Delta NSF 4 

Execution, $762,000 ($168,449 allocated to Sanders), PI 

Zhou. 

2006-2011 CRI-A Configurable Application-Aware High-Performance NSF 4 

Platform for Trustworthy Computing, $500,000, PI Hwu. 

2007-2009 Policy Assessment and Verification in Survivable Process DHS (13P prime) 

Control Systems, $500,000 ($250,000 allocated to Sanders), 

PI Nicol. 

2007-2009 Assessable Identity and Privacy Protection: End-to-End DHS (13P prime) 

Assessment of Identity & Privacy Protection, $600,000 

($200,000 allocated to Sanders), PI Nicol. 

2007-2012 M LS Computing Platform Based on COTS and Open Rockwell Collins 

Source Technology, $610,000, PI Nicol. 

2008 2008 Summer School on "Cyber Security for Process Control Battelle Energy Alliance 

Systems," $30,000, PI Sanders. 

2008 unrestricted research support, $100,000, PI Sanders. Raytheon 

2008 A Simulation Emulations Testbed for SS7 Networks, Raytheon 
74 

William H. Sanders 9/12/2017 48 

$70,000, PI Nicol. 

2008 unrestricted research support, $30,000, PI Sanders. Deere & Co. 

2008-2009 Helmet Integrated Nanosensors Signal Processing and Army 

Wireless Real Time Data Communication for Monitoring 

Blast Exposure to Battlefield Personnel, $203,280, PI Watkin. 

2008-2010 Trustworthy Communication Architecture for Converged Pacific Northwest Nat'l Lab 

SCADA Applications, $249,056, PI Khurana. 

2008-2012 Quality of Information Assurance: Assessment Management BBN Technologies 

and Use (QIAAMU), $201,999, PI Sanders. 

2008-2014 Illinois Cyber Security Scholar Program, $6,571,180, NSF 

PI Campbell. 

2009 National Cyber Range Program, $197,738, SAIC 

PI Sanders. 

2009 DURIP: Timing Traffic Analysis Testbed, $83,800, U.S. Air Force 4 

PIT. Coleman. 

2009 unrestricted research support, $20,000, PI Sanders. AT&T 

2009 IBM Faculty Award, $75,000, PI Sanders. IBM 

2009-2010 Design and Development ofTCIP Education Applets for Pacific Northwest Nat' I Lab 

Integration of Renewable Resources in the Power Grid, 

$100,000, PI Sanders. 

2009-2011 Research and Experimentation with PMU Data and Delivery Pacific Northwest Nat'! Lab 

Network, $150,000, PI Sanders. 

2009-2011 Cyber Security Risk Metrics for DHS (TTA03), $125,000, AF (Cyber Defense Agency 

PI Sanders. prime) 

2009-2012 Prediction and Provenance for Multi-Objective Information Hewlett-Packard 

Security Management, $223,900, PI Sanders. 

2009-2012 unrestricted research funds, $37,500, PI Sanders. Rockwell Collins 

2009-2015 TCIPG Trustworthy Cyber Infrastructure for the Power Grid, U.S. Dept. of Energy (NETL) 

$18,753,340, PI Sanders. 

2010 IBM Faculty Award, $75,000, PI Sanders. IBM 

2010 Design of Trustworthy Automated Off-Road Vehicles, Deere & Co. 

$40,000, PI Bretl. 

2010-2011 Methods to Quantify the Cyber Security Smart Grid GE Global Research 
75 

William H. Sanders 9/12/2017 49 

System Architectures and Applications, $151,477, 

PI Sanders. 

2010·2011 gift, $100,000, Pis Nicol and Sanders. Northrop Grumman 

2010·2012 Center for Assured Critical Application & Infrastructure Office of Naval Research 

Security (CACAIS), $1,192,650, PI Nicol. (ONR) 

2010·2013 Design Development and Demonstration of Wide-Area DOE (Entergy prime) 

PMU Data Sharing System for Entergy, $600,000, PI 

Sanders. 

2010·2015 Illinois Center for a Smarter Electric Grid (ICSEG), IL Dept. of Commerce and 4 

$5,000,000, PI Overbye. Economic Opportunity 

2011·2012 gift, $40,000, PI Sanders. Fujitsu 

2011·2013 Assured Cloud Computing University Center of Excellence Air Force 4 

(ACC·UCoE), $6,000,000, PI Campbell. 

2011·2013 Secure Information Exchange Gateway for Electric Grid DOE (GPA prime) 4 

Entities, $1,175,000, PI Sanders. 

2011·2013 Tools and Methods for Hardening Communication Security DOE (Telcordia prime) 

of Energy Delivery System (EDS), $750,000, PI Sanders. 

2012 Scalable Intrusion Detection Systems for Advanced Metering Electric Power Research2 

Infrastructures, $114,111, PI Sanders. Institute 

2012·2016 Science of Security Administration, $391,319, PI Nicol. National Security Agency 

(CMU prime) 

2012·2016 Program in Digital Forensics (PDF), $548,721, PI Campbell. National Science Foundation 

2012·2016 A Game-Theoretic Approach to Building Resilient Cyber National Security Agency 

Systems, $2,183,464, PI Sanders. 

2013·2015 Quantitative Security Metrics for Cyber-Human Systems, National Security Agency 

$275,000, PI Sanders. (CMU prime) 

2013·2015 Quantitative Assessment of Access Control in Complex National Security Agency 

Distributed Systems, $280,568, PI Nicol. (CMU prime) 

2013·2016 Applied Resiliency for More Trustworthy Grid Operation Dept. of Energy 4 

(ARMORE), $975,000, PI Sanders initially, then Yardley. (GPA prime) 

2013·2016 Practical Metrics for Enterprise Security Engineering Dept. of Homeland 

$1,899,995, PI Sanders. Security 

2013·2016 Collaborative Defense of Transmission and Distribution Dept. of Energy 5 
76 

2013-2016 

2013-2016 

2013-2017 

2014-2016 

2014-2016 

2015 

2015-2020 

Protection and Control Devices against Cyber Attacks 

$1,273,000, PI Valdes. 

Secure Policy Based Configuration Framework, $930,000 

PI Yardley. 

SDN {Software Defined Network) Project 

$1,100,000, PI Bobba. 

Illinois Cyber Security Scholar Program, $5,071,180, 

PI Campbell. 

Science of Security for Systems, $6,474,953, 

PI Nicol. 

Data-Driven, Model-Based Decision-Making based on 

Quantifiable Security Metrics, $803,787, PI Sanders. 

Design and Evaluation of Methods to Detect Electricity 

Theft in Advanced Metering Infrastructure, $2S,OOO, PI 

Sanders. 

Cyber Resilient Energy Delivery Consortium (CREDC), 

$28,099,2S8, PI Nicol 

b. For Instruction 

1998-1999 Development of Short Courses for Motorola Univ. 

$431,800 

Graduate Thesis Research Advising 

M.S. Degrees Granted 

William H. Sanders 9/12/2017 50 

(ABB prime) 

Dept. of Energy 

(EPRI prime) 

Dept. of Energy 

{SEL prime) 

NSF 

National Security Agency 

National Security Agency 

Siebel Energy Institute 

Dept. of Energy 

Motorola, Inc. 

4 

4 

George Lin, May 1990, Performance Evaluation of Interconnection Networks for ISDN Switching Applications. 

Man ish Rai, July 1990, Design and Implementation of a Reduced Base Model Construction Technique for 

Stochastic Activity Networks. 

Yasser Alsafadi, Aug. 1990, Definition and Evaluation of the Data Link Layer of PACnet. 

Roberto Freire, Dec. 1990, A Technique for Simulating Composed SAN-Based Reward Models. 

Janet Tvedt, Dec. 1990, Solution of Large-Scale Stochastic Process Representations of Stochastic Activity 

Networks. 

Kevin Prodromides, Jan. 1991, Perform ability Evaluation of Two Collision-Resolution Schemes for Carrier Sense 

Multiple Access Protocols. 

Hemal Shah, Dec. 1991, Performance Evaluation of Manufacturing Systems using Stochastic Activity 

Networks. 

M. Akber Qureshi, Aug. 1992, Reward Model Solution Methods with Impulse and Rate Rewards: An Algorithm 

and Numerical Results. 

Bruce D. Mcleod, May 1993, Performance Evaluation of N-Processor Time Warp using Stochastic Activity 

Networks. 
77 

William H. Sanders 9/12/2017 51 

W. Douglas Oballl, Aug. 1993, Importance Sampling Simulation of SAN-Based Reward Models. 

Bhavan P. Shah, Aug. 1993, Analytic Solution of Stochastic Activity Networks with Exponential and 

Deterministic Activities. 

John Diener, July 1994, Empirical Comparison of Uniformization Methods for Continuous-Time Markov Chains. 

Anand Kuratti, July 1994, Analytical Evaluation of the RAID 5 Disk Array. 

Fransiskus Krisnadi Widjanarko, Dec. 1994, Evaluation of an Adaptive Checkpointing Scheme for 

Multiprocessor Systems. 

George Wilkey Richardson, Dec. 1995, Evaluation of a Parallel Chaos Router Simulator. 

Raman Krishnan, Dec. 1995, The Impact of Workload on the Dependability of Microprocessors Used in Control 

Applications. 

Brian Melcher, Dec. 1995, A Methodology for Evaluating the Availability of Computer-Integrated 

Manufacturing Management Systems. 

Daniel D. Deavours, May 1997, Solutions to Lorge Markov Chains Produced by Stochastic Petri Nets. 

David Henke, August 1998, Loki-An Empirical Evaluation Tool for Distributed Systems: The Experiment 

Analysis Framework. 

G. P. Kavanaugh, August 1998, Design and Implementation of an Extensible Too/for Performance and 

Dependability Model Evaluation. 

Jessica Pistole, August 1998, Loki-An Empirical Evaluation Tool for Distributed Systems: The Run-Time 

Experiment Framework. 

Brijbhushan Sabnis, August 1998, Proteus: A Software Infrastructure Providing Dependability for CORBA 

Applications. 

John Sowder, August 1998, State-Space Generation Techniques in the Mobius Modeling Framework. 

Alex Williamson, August 1998, Discrete Event Simulation in the Mobius Modeling Framework. 

Aaron Stillman, October 1999, Model Composition within the Mobius Modeling Framework. 

Jay M. Doyle, May 2000, Abstract Mode/Specification Using the Mobius Modeling Tool. 

Paul G. Rubel, October 2000, Passive Replication in the AQuA System. 

Amy Christensen, October 2000, Result Specification and Model Connection in the Mobius Modeling 

Framework. 

Ramesh U.V. Chandra, January 2001, Loki: A State-Driven Fault Injector for Distributed Systems. 

David Daly, May 2001, Analysis of Connection as a Decomposition Technique. 

Prashant Pandey, September 2001, Reliable Delivery and Ordering Mechanisms for an Intrusion-Tolerant 

Group Communication System. 

Harigovind Venkatraj Ramasamy, April 2002, A Group Membership Protocol for an Intrusion-Tolerant Group 

Communication System. 

Patrick Gerald Webster, October 2002, Design of Experiments in the Mobius Modeling Framework. 

Salem Derisavi, May 2003, The Mobius State-Level Abstract Functional Interface. 

Ryan Michael Lefever, May 2003, An Experimental Evaluation of the Coda Distributed File System Using the 

Loki State-Driven Fault Injector. 

Kaustubh Raghunandan Joshi, May 2003, Evaluating Unavailability Caused by Group Membership Using 

Global-State-Based Fault Injection. 

Vishu Gupta, May 2003, Intrusion-Tolerant State Transfer for Group Communication Systems. 

James Patrick Lyons, August 2003, A Replication Protocol for an Intrusion-Tolerant System Design. 

Sankalp Singh, December 2003, Probabilistic Validation of an Intrusion-Tolerant Replication System. 

Fa brice Stevens, May 2004, Validation af an Intrusion-Tolerant Information System Using Probabilistic 

Modeling. 

Michael A. lhde, July 2005, Experimental Evaluations of Embedded Distributed Firewal/s: Performance and 

Policy. 

Mark Griffith, May 2006, Dynamic Partitioning of Stochastic Networks of Molecular Interactions. 

Elizabeth Van Ruitenbeek, July 2007, Made ling Mobile Phone Virus Propagation to Quantify Response 

Mechanism Effectiveness. 
78 

William H. Sanders 9/12/2017 52 

Michael Graham McQuinn, December 2007, Solution of Graph-Composed Markov Models Using Symmetry 

Detection and Symbolic Data Structures. 

Shuyi Chen, 2008, Link Gradients: Predicting the Impact af Link Latency on Multi-tier Applications. 

Michael D. Ford, May 2012, A Generalized Adversary Decision Algorithm and Analytic Solution Methods for 

ADVISE Models. 

Sobir Bazarbayev, May 2013, Content-Aware Resource Scheduling for Commercial and Personal Clouds. 

Ahmed Mohamad Fawaz, May 2013, A Response Taxonomy and Cost Model for Advanced Metering 

Infrastructures. 

David Raymond Grochocki Jr, May 2013, Deployment Considerations for Intrusion Detection Systems in 

Advanced Metering Infrastructure. 

Craig Thomas Buchanan, May 2014, Simulation Debugging and Visualization in the Mobius Modeling 

Framework. 

Carmen Cheh, December 2014, The Cyber-Physical Topology Language: Definition and Operations. 

Ronald Joseph Wright, December 2014, A Job Server for Parallel and Concurrent Execution af Mobius 

Simulators. 

Uttam Thakore, July 2015, A Quantitative Methodology for Evaluating and Deploying Security Monitors. 

Benjamin E. Ujcich, July 2015, An Attack Model, Language, and Injector for the Control Plane of Softwaredefined Networks. 

Varun Badrinath Krishna, December 2016, An Energy-Efficient P2P Protocol for Validating Measurements in 

Wireless Sensor Networks. 

Michael J. Rausch, December 2016, Determining Cost-Effective Intrusion Detection Approaches for an 

Advanced Metering Infrastructure Deployment Using ADVISE. 

M.S. Students Currently Supervised 

Atul Bohara 

Ph.D. Degrees Granted 

Luai Malhis, January 1996, Development and Application of an Efficient Method for the Solution of Stochastic 

Activity Networks with Deterministic Activities. 

Akber Qureshi, April1996, Construction and Solution of Markov Reward Models. 

Lath a Arun Kant, August 1996, Analysis of Cell-Loss Processes and Restoration Schemes in ATM Networks. 

Anand Kuratti, September 1997, Improved Techniques for Parallel Discrete Event Simulation. 

Douglas Obal, August 1998, Measure-Adaptive State-Space Construction Methods. 

Yansong (Jennifer) Ren, May 2001, AQuA: A Framework for Providing Adoptive Fault Tolerance to Distributed 

Applications. 

Daniel Deavours, August 2001, Formal Specification afthe Mobius Modeling Framework. 

Sudha Krishnamurthy, October 2002, An Adaptive Quality of Service Aware Middleware for Replicated 

Services. 

David Daly, May 2005, Bounded Aggregation Techniques to Solve Large Markov Models. 

Salem Derisavi, May 2005, Solution of Lorge Markov Models Using Lumping Techniques and Symbolic Data 

Structures. 

HariGovind Venkatraj Ramasamy, 2005, Parsimonious Service Replication for Tolerating Malicious Attacks in 

Asynchronous Environments. 

Kaustubh Raghunandan Joshi, 2007, Stochastic-Model-Driven Adaptation and Recovery in Distributed Systems. 

Shravan Gaonkar, 2008, Exploring Design Configurations of System Models: From Simultaneous Simulation to 

Search Heuristics. 

Vinh V. Lam, 2011, A Path-based Framework for Analyzing Lorge Markov Models. 

Ryan M. Lefever, 2011, Diverse Partial Memory Replication. 

Sam an Aliari Zonouz, 2011, Game-Theoretic Intrusion Response and Recovery. 
79 

William K Sanders 9/12/2017 53 

Elizabeth LeMay, 2011, Adversary-Driven State-Based System Security Evaluation. 

Shuyi Chen, 2011, Gradient Techniques for Performance Prediction and Control in Multitier Systems. 

Eric William Davis Rozier, 2011, Understanding the Fault- Tolerance Properties of Large-Scale Storage Systems. 

Sankalp Singh, 2012, Automatic Verification of Security Policy Implementations. 

Douglas C. Eskins, 2012, Modeling Human Decision Points in Complex Systems. 

Ahmed M. Fawaz, 2017, Achieving Cyber Resiliency against Lateral Movement through Detection and 

Response. 

Ph.D. Thesis Students Supervised at Present 

Varun Badrinath Krishna 

Carmen Cheh 

Ahmed Fawaz 

Mohammad Noureddine 

Michael Rausch 

Uttam Thakore 

Benjamin Ujcich 

Ronald Wright 

Editorships of Journals 

Guest Co-Editor, Performance Evaluation journal special issue on Modelling Techniques and Tools for 

Computer Performance Evaluation, vo!. 63, no. 6, June 2006. 

Member of the Editorial Board of IEEE Security and Privacy magazine, 2005-2006. 

Member of the Editorial Board of the journal Performance Evaluation, 2004-2011. 

Area Editor for Simulation and Modeling of Computer Systems for the ACM Transactions on Modeling and 

Computer Simulation, 2002-2010. 

Associate Editor of IEEE Transactions on Reliability, 1999-2005. 

Associate Editor of IEEE Transactions on Software Engineering, 1996-2000. 

Guest Co-Editor, Special Section on Petri Nets and Performance Models, IEEE Transactions on Software 

Engineering, val. 25, no. 2, March/April1999. 

Guest Co-Editor, Special Section on Dependable Computing for Critical Applications, IEEE Transactions on 

Software Engineering, vol. 25, no. 5, Sept./Oct. 1999. 

Post~doctoral Associates 

Aad van Moorsel, May 1994- Jan. 1996, ofThe Netherlands, now at the University of Newcastle upon Tyne. 

Michel Cukier, Nov. 1996 Nov. 2001, of France, now at the University of Maryland. 

Ad nan Agbaria, Oct. 2002 -July 2005, of Israel, now at Toga Networks (Huawie Research) and Haifa 

University. 

Robin Berthier, Oct. 2009- Feb. 2012, of France, now at the University of Illinois and Network Perception. 

Eric W. D. Rozier, Jan.- June 2012, of the U.S., now at Iowa State University. 

Sankalp Singh, July 2012 Dec. 2012, of India, now at Google. 

Gabriel Weaver, Jan. 2013 Feb. 2014, of the U.S., now at the University of Illinois. 

Other Scholarly Activities 

Conference Organization 

Executive Committee Member, IEEE lOth Annual International Phoenix Conference on Computers and 

Communications, 1991. 
80 

William H. Sanders 9/12/2017 54 

Local Arrangements Chairperson, Second IFIP International Conference on Dependable Computing for Critical 

Applications, 199L 

Publication Chair, IEEE International Computer Performance and Dependability Symposium, 1995. 

Co-Vice-Chair, Illinois Computer Affiliates Conference, 1995. 

Industrial Relations Chairperson, 1995 Pacific Rim International Symposium on Fault-Tolerant Systems, Dec. 

1995. 

Co-Organizer, IFIP 10.4 Workshop on Tools for Dependable System Design and Evaluation, June 1995. 

General Chair of Illinois Computer Affiliates Program (ICAP) Meeting, April1996. 

Vice-General Chair, IEEE International Computer Performance and Dependability Symposium, 1996. 

Co-Organizer, Third International Workshop on Performability Modeling of Computer and Communication 

Systems (PMCCS3), 1996. 

Program Co-Chair, Sixth IFIP International Working Conference on Dependable Computing for Critical 

Applications, 1997. 

Software Tools Chairperson, IEEE 7th International Workshop on Petri Nets and Performance Models, 1997. 

Software Tools Chairperson, International Conference on Modelling Techniques and Tools for Computer 

Performance Evaluation (TOOLS'97), 1997. 

Software Tools Co-chairperson, IEEE 27th Annual Fault-Tolerant Computing Symposium, 1997. 

Publications Chair, IEEE 28th Annual Fault-Tolerant Computing Symposium, 1998. 

Program Co-chair, IEEE 29th Annual Fault-Tolerant Computing Symposium, 1999. 

Co-organizer, International Workshop on Perform ability Modeling of Computer and Communication Systems 

(PMCCS), 2001. 

Member, Advisory and Publicity Committee, 7th IEEE International Workshop on Object-oriented Real-time 

Dependable Systems (WORDS 2002). 

Program Co-chair, Sigmetrics 2003: International Conference on Measurement and Modeling of Computer 

Systems, 2003. 

General Chair and Program Co-chair, PNPM-03 (the 11th International Workshop on Petri Nets and 

Performance Models), 2003. 

General Chair and Program Co-chair, Performance Tools 2003: 13th International Conference on Modelling 

Tools and Techniques for Computer and Communication System Performance Evaluation, 2003. 

General Chair, 2003111inois Multiconference on Measurement, Modelling, and Evaluation of ComputerCommunication Systems, 2003. 

Ad Hoc Steering Committee Chair, QEST '04: 1st International Conference on Quantitative Evaluation of 

SysTems, 2004. 

Publicity Co-Chair, SRDS 2004 (23rd Symposium on Reliable Distributed Systems). 

Steering Committee Chair, QEST (International Conference on Quantitative Evaluation of Systems), 2004-

2008. 

International Liaison Chair, European Dependable Computing Conference (EDCC-5), 2005. 

Local Organizing Committee member, 6th Symposium on Understanding Complex Systems (UCS 2006), 2006. 

Fundraising co-Chair for North America, 40th AnnuaiiEEE/IFIP International Conference on Dependable 

Systems and Networks (DSN 2010), 2010. 

IEEE Symposium on Reliable Distributed Systems (SRDS), Best Paper Co-Chair, 2013. 

Permanent member, Steering Committee of the IEEE Symposium on Reliable Distributed Systems (SRDS), 

2013-present. 

Co-organizer, Schloss Dagstuhl Seminar 14031: Randomized Timed and Hybrid Models for Critical 

Infrastructures, 2014. 

Program Committee Co-Chair, QEST: International Conference on Quantitative Evaluation of SysTems, 2014. 

Panel moderator, "The Science of Security" panel, the Cybersecurity Innovation Forum, 2014. 

Conference Program Committee Service 

IEEE 9th Annual International Phoenix Conference on Computers and Communications, 1990. 
81 

William H. Sanders 9/12/2017 55 

IEEE 4th International Workshop on Petri Nets and Performance Models, 1991. 

IEEE 12th International Conference on Distributed Computer Systems, 1992. 

IEEE 5th International Workshop on Petri Nets and Performance Models, 1993. 

IEEE 12th Symposium on Reliable Distributed Systems, 1993. 

IEEE 23rd Fault-Tolerant Computing Symposium, 1993. 

IEEE Workshop on Fault-Tolerant Parallel and Distributed Systems, 1994. 

IEEE 13th Symposium on Reliable Distributed Systems, 1994. 

28th Annual Simulation Symposium (SCS and IEEE), 1995. 

IEEE 15th International Conference on Distributed Computing Systems, 1995. 

IEEE International Computer Performance and Dependability Symposium, 1995. 

IEEE 25th Fault-Tolerant Computing Symposium, 1995. 

IEEE 6th International Workshop on Petri Nets and Performance Models, 1995. 

Joint 8th International Conference on Modelling Techniques and Tools for Computer Performance Evaluation 

and 8th Conference on Measuring, Modelling, and Evaluating Computing and Communication Systems, 

1995. 

5th IFIP Working Conference on Dependable Computing for Critical Applications, 1995. 

IEEE 26th Fault-Tolerant Computing Symposium, 1996. 

SCS Conference on Analytical and Numerical Modeling Techniques, 1996. 

International Conference on Performance Theory, Measurement and Evaluation of Computer and 

Communication Systems (PERFORMANCE'96), 1996. 

IEEE 15th Symposium on Reliable Distributed Systems, 1996. 

29th Annual Simulation Symposium (SCS and IEEE), 1996. 

IEEE International Workshop on Dependability in Advanced Computing Paradigms, 1996. 

IEEE International Workshop on Embedded Fault-Tolerant Systems, 1996. 

6th IFIP Working Conference on Dependable Computing for Critical Applications, 1997. 

IEEE 7th International Workshop on Petri Nets and Performance Models, 1997. 

International Conference on Modelling Techniques and Tools for Computer Performance Evaluation 

(TOOLS'97), 1997. 

3rd International Conference on Reliability, Quality and Safety of Software-Intensive Systems (ENCRESS'97), 

1997. 

SIGMETRICS '97, 1997. 

30th Annual Simulation Symposium (SCS and IEEE), 1997. 

IEEE 28th Fault-Tolerant Computing Symposium, 1998. 

Workshop on Software and Performance (WOSP98), 1998. 

International Conference on Modeling Techniques and Tools for Performance Evaluation (Tools '98), 1998. 

3rd IEEE High-Assurance Systems Engineering Symposium (HASE), 1998. 

20th International Conference on Applications and Theory of Petri Nets (ICATPN '99), 1999. 

32nd Annual Simulation Symposium, 1999. 

International Conference on the Numerical Solution of Markov Chains (NSMC '99), 1999. 

8th International Workshop on Petri Nets and Performance Models (PNPM '99), 1999. 

7th International Workshop on Parallel and Distributed Real-Time Systems (WPDRTS), 1999. 

7th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication 

Systems (MASCOTS '99), 1999. 

4th IEEE Symposium on High Assurance Systems Engineering (HASE '99), 1999. 

IEEE International Computer Performance and Dependability Symposium {IPDS 2K), 2000. 

33rd Annual Simulation Symposium, 2000. 

TOOLS 2000 (lnt'l Conf. on Techniques and Tools for Computer Performance Evaluation), 2000. 

DSN-00: International Conference on Dependable Systems and Networks (FTCS-30 & DCCA-8), 2000. 

Pacific Rim International Symposium on Dependable Computing (PRDC 2000), 2000. 

SIGMETRICS/Performance, 2001. 

21st IEEE International Conference on Distributed Computing Systems (ICDCS-21), 2001. 
82 

William H. Sanders 9/12/2017 56 

DSN-01: International Conference on Dependable Systems and Networks, 2001. 

20011EEE CS Workshop on Object-oriented Real-Time Dependable Systems (WORDS 2001), 2001. 

Internet Performance Symposium (IPS-2001) at Globecom 2001. 

PRDC 2001: IEEE Pacific Rim Dependable Computing Conference. 

IPDS (Computer Performance and Dependability) track of DSN (International Conference on Dependable 

Systems and Networks), 2002. 

Sigmetrics 2002. 

Internet Performance Symposium (IPS 2002) in conjunction with Globecom 2002. 

Performance Tools 2002: 12th International Conference on Modelling Tools and Techniques for Computer 

and Communication System Performance Evaluation, 2002. 

lOth IEEE/ACM Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication 

Systems (MASCOTS 2002), 2002. 

4th IEEE International Workshop on Advanced Issues of E-Commerce and Web-Based Information Systems 

(WECWIS 2002), 2002. 

PAPM-ProbMiV: 2nd Joint International Workshop on Process Algebra and Performance Modelling, 

Probabilistic Methods in Verification, 2002. 

Pacific Rim International Symposium on Dependable Computing (PRDC 2002), 2002. 

International Workshop on Self-Repairing and Self-Configurable Distributed Systems, 2002. 

23rd IEEE International Conference on Distributed Computing Systems (ICDCS), 2003. 

Middleware 2003: 4th IFIP/ACM/USENIX International Conference on Distributed Systems Platforms, 2003. 

Latin American Symposium on Dependable Computing (LADC), 2003. 

3rd DARPA Information Survivability Conference and Exposition (DISC EX 3), 2003. 

MASCOTS 2003, the 11th IEEE/ACM Symposium on Modeling, Analysis and Simulation of Computer and 

Telecommunication Systems, 2003. 

DSN Dependable Computing and Communications Symposium, 2003. 

DSN IPDS (Performance and Dependability Symposium), 2003. 

ACM Workshop on Survivable and Self-Regenerative Systems, 2003. 

25th International Conference on Applications and Theory of Petri Nets (ICATPN), 2004. 

International Conference on Dependable Systems and Networks (DSN-04), 2004. 

PDS (Computer Performance and Dependability) track of the International Conference on Dependable 

Systems and Networks (DSN-04), 2004. 

2nd Workshop on Mobile Distributed Computing (MDC04), held in conjunction with the 24th International 

Conference on Distributed Computing Systems (ICDCS'04). 

International Service Availability Symposium (ISAS), 2004. 

1st International Conference on Quantitative Evaluation of Systems (QEST), 2004. 

5th International Workshop on Software and Performance (WOSP 2005). 

International Conference on Application and Theory of Petri Nets 2005. 

PDS (Performance and Dependability Symposium) track of the 2005 International Conference on Dependable 

Systems and Networks (DSN 2005). 

DCCS (Dependable Computing and Communications Symposium) track of the 2005 International Conference 

on Dependable Systems and Networks (DSN 2005). 

Latin American Symposium on Dependable Computing (LADC 2005). 

Performance 2005: IFIP WG 7.3 International Symposium on Computer Performance, Modeling, 

Measurements and Evaluation. 

Second International Service Availability Symposium (ISAS 'OS), 2005. 

PRDC-11: The 2005 Pacific Rim International Symposium on Dependable Computing (PRDC 2005). 

RAID 2005: 8th International Symposium on Recent Advances in Intrusion Detection, 2005. 

4th IEEE International Symposium on Network Computing and Applications (IEEE NCAOS), 2005. 

24th Symposium on Reliable Distributed Systems (SRDS 2005), 2005. 

2nd International Conference on Quantitative Evaluation of Systems (QEST), 2005. 

IFIP Conference on Biologically Inspired Cooperative Computing, 2006. 
83 

William H. Sanders 9/12/2017 57 

Performance and Dependability Symposium (PDS) track of the 2006 International Conference on Dependable 

Systems and Networks (DSN 2006), 2006. 

26th IEEE International Conference on Distributed Computing Systems (ICDCS-26), 2006. 

25th IEEE International Symposium on Reliable Distributed Systems {SRDS 2006), 2006. 

SIGMETRICS/Performance 2006. 

3rd International Conference on Quantitative Evaluation of Systems (QEST), 2006. 

Performance and Dependability Symposium (PDS) track of the 2007 International Conference on Dependable 

Systems and Networks {DSN 2007). 

PERFORMANCE 2007, the 26th IFIP WG 7.3 International Symposium on Computer Performance Modeling, 

Measurement and Evaluation. 

ACM SIGMETRICS 2007, the International Conference on Measurement and Modeling of Computer Systems. 

4th International Conference on Quantitative Evaluation of Systems (QEST'07), 2007. 

1st AnnuaiiFIP WG 11.10 International Conference on Critical Infrastructure Protection, 2007. 

IEEE International Symposium on Network Computing and Applications, 2007. 

Performance and Dependability Symposium (PDS) at the 38th AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks (DSN 2008), 2008. 

3rd Workshop on Recent Advances in Intrusion-Tolerant Systems {WRAITS), 2009. 

Performance and Dependability Symposium (PDS) at the 39th AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks (DSN 2009), 2009. 

International Workshop on Security Measurements and Metrics (MetriSec 2009), 2009. 

Performance and Dependability Symposium (PDS) at the 40th AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks (DSN 2010), 2010. 

7th International Conference on the Quantitative Evaluation of SysTems (QEST), 2010. 

6th International Conference on the Numerical Solution of Markov Chains (NSMC), 2010. 

ACM SIGMETRICS 2010: International Conference on Measurement and Modeling of Computer Systems, 

2010. 

4th Workshop on Recent Advances in Intrusion-Tolerant Systems (WRAITS), 2010. 

International Workshop on Security Measurements and Metrics (MetriSec 2010), 2010. 

5th International Workshop on Critical Information Infrastructures Security (CRITIS 2010), 2010. 

1st Workshop on Smart Grid Networking Infrastructure {SGNI 2010), 2010. 

IEEE SmartGridComm Symposium on Architectures and Models for the Smart Grid, 2010. 

Performance and Dependability Symposium (PDS) at the 41st AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks (DSN 2011), 2011. 

Fault Tolerance and Dependability track for the 31st International Conference on Distributed Computing 

Systems {ICDCS 2011), 2011. 

1st International Workshop on Resilience Assessment of Critical Infrastructures, 2011. 

International Workshop on Security Measurements and Metrics {MetriSec), 2011. 

International Conference on Critical Information Infrastructure Security (CRITIS), 2011. 

Performance and Dependability Symposium {PDS) at the 42nd AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks (DSN 2012), 2012. 

9th International Conference on the Quantitative Evaluation of SysTems {QEST), 2012. 

1st International Conference on High Confidence Networked Systems (HiCoNS), 2012. 

Workshop on Open Resilient human-aware Cyber-physical Systems (WORCS-2012), 2012. 

IEEE SmartGridComm Symposium- Cyber Security, 2012. 

IEEE SmartGridComm Symposium- Smart Grid Communication Networks, 2012. 

Winter Simulation Conference (WSC), 2012. 

International Workshop in Quantitative Aspects in Security Assurance (QASA), 2012. 

ICT for Energy Symposium of the 2nd IEEE International Energy Conference and Exhibition (EnergyCon), 2012. 

Performance and Dependability Symposium {PDS) at the 43rd AnnuaiiEEE/IFIP International Conference on 

Dependable Systems and Networks (DSN), 2013. 
84 

William H. Sanders 9/12/2017 58 

Fault Tolerance and Dependability track of the 33rd IEEE International Conference on Distributed Computing 

Systems (ICDCS), 2013. 

lOth International Conference on the Quantitative Evaluation of SysTems (QEST), 2013. 

Risk Management Embedded Topical Meeting (part of the 2013 American Nuclear Society Winter meeting), 

2013. 

"Smart Grid Cyber Security and Privacy" symposium for SmartGridComm, 2013. 

2nd International Workshop on Quantitative Aspects in Security Assurance (QASA), 2013. 

IEEE International Workshop on Measurements and Networking (M&N), 2013. 

44th AnnuaiiEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2014. 

Fault Tolerance and Dependability track, International Conference on Distributed Computing Systems (ICDCS), 

2014. 

International Workshop on Graphical Models for Security (GraMSec), 2014. 

IEEE International Conference on Smart Grid Communications (SmartGridComm): Cyber Security and Privacy 

Symposium, 2014. 

45th AnnuaiiEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2015. 

1st Workshop on Safety and Security of Intelligent Vehicles, 2015. 

4th International Conference on Smart Cities and Green ICT Systems (SMARTGREENS), 2015. 

IEEE International Conference on Smart Grid Communications (SmartGridComm): Cyber Security and Privacy 

Symposium, 2015. 

HotSoS Symposium and Bootcamp on the Science of Security, 2016. 

2nd Workshop on Safety and Security of Intelligent Vehicles, 2016. 

SmartGridComm2016-Security (2016 IEEE International Conference on Smart Grid Communications 

(SmartGridComm): Cyber Security and Privacy for the Smart Grid), 2016. 

4th Annual Symposium and Bootcamp for Hot Topics on Science of Security (HoTSoS), 2017. 

20th Symposium on Research in Attacks, Intrusions and Defenses (RAID), 2017. 

8th IEEE International Conference on Smart Grid Communications (SmartGridComm), Cyber Security and 

Privacy Track, 2017. 

SAFECONFIG 2017: Applying the Scientific Method to Active Cyber Defense Research Workshop, 2017. 

48th AnnuaiiEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2018. 

Conference Session Chairs 

IEEE 8th Annual International Phoenix Conference on Computers and Communications, 1989. 

IEEE 4th International Workshop on Petri Nets and Performance Models, 1991. 

IEEE 12th Annual International Phoenix Conference on Computers and Communications, 1993. 

IEEE 12th Symposium on Reliable Distributed Systems, 1993. 

1995 AIAA Conference, San Antonio, TX, March 1995. 

Joint 8th International Conference on Modelling Techniques and Tools for Computer Performance Evaluation 

and 8th Conference on Measuring, Modelling, and Evaluating Computing and Communication Systems, 

1995. 

Performance '96, 1996. 

IEEE 27th Fault-Tolerant Computing Symposium, 1997. 

IEEE 28th Fault-Tolerant Computing Symposium, 1998. 

2002 Pacific Rim International Symposium on Dependable Computing (PRDC2002), 2002. 

1st Latin American Symposium on Dependable Computing, 2003. 

2004 Pacific Rim International Symposium on Dependable Computing (PRDC 2004), 2004. 

18th IFIP World Computer Congress, 2004, session on "Further Challenges and Perspectives" in Fault 

Tolerance for Trustworthy and Dependable Information Infrastructures T apical Day. 

1st International Conference on the Quantitative Evaluation of Systems (QEST) 2004, session on "Scheduling 

and Optimization." 
85 

William H. Sanders 9/12/2017 59 

DSN-05, the International Conference on Dependable Systems and Networks, 2005, session on "Intrusion 

Detection and Tolerance." 

Session Chair, "Expanding the Research Horizon," GridWise Global Forum, September 2010. 

SmartGridComm: 2nd IEEE International Conference on Smart Grid Communications, 2011, session on 11Cyber 

and Physical Security and Privacy." 

Review papers for numerous journals and conferences. 

Professional Society 

Vice-Chairperson of IFIP Working Group on Dependable Computing, 1999-2005. 

Executive Committee of the IEEE Technical Committee on Dependable Computing and Fault Tolerance, 2000-

present. 

Elected Vice-Chair and then Chair of IEEE Technical Committee on Fault-Tolerant Computing. Served as ViceChair 2000, and as Chair 2001-2003. 

Elected member of the Board of Directors, ACM Sigmetrics, served 2001-2003, 2005-2007. 

IEEE Computer Society Smart Grid Vision Project (SGVP), cyber security topic area leader, 2011-. 

IEEE CS Fellows Evaluation Committee, 2014 and 2016. 

Participated in NSF/DARPA workshop on Performance Engineering, Sept. 1996. Gave advice to NSF and 

DARPA officials that resulted in a new DARPA research program on performance engineering. 

Participated in DARPA !SAT Study Group on Complex Systems, January 1997-August 1997.1n doing so, I 

helped establish priorities for and create research directions for work in the area of representation and 

analysis for system modeling, specification, design, prediction, control and assurance of large scale, complex 

systems. 

Participated in Natio·nal Science Foundation panel evaluating pre-proposals (for Group Projects) submitted to 

the ITR program, Feb. 2001. 

Participated in National Science Foundation panel evaluating proposals submitted to the NGS Program, March 

2001. 

Participated in National Science Foundation workshop on Information Technologies for Security, Nov. 2001. 

Participated in National Science Foundation panel evaluating proposals to NSF 1/UCRC Planning Grant 

Program, Nov. 2001. 

At the request of the National Science Foundation, participated in the EU-US meeting and workshop entitled 

"R&D Strategy for a Dependable Information Society: EU-US Collaboration," Dec. 2001. 

Participated in National Science Foundation panel evaluating proposals to Federal Cyber Service: Scholarship 

for Service (SFS) program, Jan. 2002. 
86 

William H. Sanders 9/12/2017 60 

Participated in National Science Foundation panel evaluating proposals to Trusted Computing program, 

March 2002. 

Served on NSF Panel on Next Generation Software Program, 2003. 

Served on NSF Panel on medium ITR proposals, May 2003. 

Served on NSF Panel on the Highly Dependable Computing Program, July 2003. 

Served on NSF Panel on CyberTrust, June 2004. 

Served on NSF CCFST-HEC Panel, August 2004. 

Served on NSF Computer System Research proposal review panel, March 2005. 

Member, Networking and Information Technology Technical Advisory Group (TAG) of the President's Council 

of Advisors on Science and Technology (PCAST), 2006-2007. 

Served as an NSF reviewer for FREEDM Center, 2009, 2010, 2011, 2012, 2013. 

Served on a smart grid panel for the U.S. Government Accountability Office (GAO), May 25-27, 2011. 

Participated in SECURE GRID 2010 Table Top Exercise at government request, USAF Academy Falcon Club, 

Colorado, July 13-14, 2010. 

National Institute of Standards and Technology (NIST) Smart Grid Advisory Committee (SGAC), three-year 

term starting August 2010. 

DHS steering committee to develop a roadmap for securing control systems in the nuclear sector, 2011-

present. 

Participated in Grid Security Panel discussion at the 2011 DOE-NARUC National Electricity Forum, February 16, 

2011. 

Member of the Intelligence Science and Technology Experts Group (ISTEG) of the National Academies of 

Sciences, Engineering, and Medicine, supporting the Office of the Director of National Intelligence, 2015-

present. 

University Committees 

Member, Network Manager's Committee, University of Arizona, Sept. 1990-Aug. 1993. 

Member, College of Engineering Committee on Computational Science, University of Arizona, Dec. 1991-Aug. 

1993. 

Member, Arizona Advanced Telecommunications Research Project, Technical Steering Committee, Sept. 

1991-Aug. 1993. 

Member, College of Engineering Computer Policy Committee, University of Arizona, Sept. 1991-Aug. 1994. 

Member, University Telecommunications Advisory Committee, University of Arizona, Sept. 1992-Aug. 1994. 

Member, University of Illinois Library Committee, 1995-2000. 

Senator, University of Illinois Faculty Senate, 1996-1998. 

Member, Stewarding Excellence@ Illinois Beckman and 1GB Project Review Team, 2010-present. 

Member, University of Illinois Entrepreneurship Roundtable, 2011-present. 
87 

William H. Sanders 9/12/2017 61 

Member, Grainger Big Data Committee, University of Illinois College of Engineering, 2013-present. 

Member, Ul Labs Campus Committee, 2014-present. 

Member, Ul College of Engineering Zhejiang University partnership committee, 2014-present. 

Member, ZJU-UIUC Institute (Zhejiang University and the University of Illinois at Urbana-Champaign} 

Operating Committee, 2016-present. 

Member, Search Committee, Vice Chancellor for Advancement, 2016-present. 

Member, Chancellor's Transition Advisory Committee, 2016-present. 

Departmental Committees 

Co-Chairman, Computer Engineering Distinguished Lecture Series Committee, 1991-1992. 

Member, Department Computer Policy Committee, Dept. of Electrical and Computer Engineering, University 

of Arizona, Sept. 1989 -Aug. 1992. 

Member, Department Graduate Policy Committee, Dept. of Electrical and Computer Engineering, University 

of Arizona, Sept. 1990- Aug. 1992. 

Chairperson, Computer Engineering Faculty Search Committee, Dept. of Electrical and Computer Engineering, 

University of Arizona, Spring 1994. 

University of Illinois, Co-Chairperson, Illinois Computer Affiliates Program, 1994-1996. 

Member, University of Illinois ECE Dept. Fellowship Committee, 1994-1997. 

Member, University of Illinois ECE Dept. Curriculum Committee, 1995-1998. 

Member, University of Illinois ECE Dept. Qualifying Examination Committee, 1995-1996. 

Elected Member, University of Illinois ECE Dept., Dept. Advisory Committee, 1996-1998, 1999-2001. 

Elected Member, Coordinated Science Laboratory Policy and Planning Committee, 1998-2000. 

Member, University of Illinois, ECE Dept. Graduate Committee, 1998-2000. 

Member, University of Illinois, ECE Dept. Graduate Recruitment Committee, 1999-2000. 

Member, University of Illinois, ECE Dept. ABET Preparation Committee, 1999-2001. 

Chairperson, University of Illinois, ECE Dept. Computer Engineering Area Committee, 1999-2001. 

Member, University of Illinois, ECE Dept. Faculty Search Committee, 2000-. 

Member, University of Illinois, ECE Dept. Public Relations Committee, 2005-. 

ECE Alternate Alumni Coordinator, 2005-. 

Other Outside Service 

External reviewer, College of William and Mary's Department of Computer Science, winter 2018. 

Member of the External Advisory Council of the Santa Fe Community College's proposed NSF for ATE project 

INTEGRATE (lnterdisciplinarity Network for Trustworthy Energy Grid Resiliency Through Advanced 

Technological Education}, 2017-. 

Member at Large ofthe Board of Directors of the Electrical and Computer Engineering Department Heads 

Association (ECEDHA}, 2017-2019. 

Member of the Jean-Claude Laprie award committee, 2017. 

Member of the National Academies' Panel on "Enhancing the Resilience of the Nation's Electric Power 

Transmission and Distribution (T&D} System, 2016-present. 

Member of the National Academies' Forum on Cyber Resilience, 2015-present. 

Member of the 2014 Visiting Committee, Department of Electrical & Computer Engineering, National 

University of Singapore, 2014. 

Member of the Advisory Group for SRI International and USC/lSI's collaborative NSF project on "The Road to 

Tomorrow: Cybersecurity Experimentation of the Future," 2013-2014. 

Member of the Scientific Advisory Board (SAB) for the Forschungszentrum Telekommunikation Wien (FTW) 

Telecommunications Research Center Vienna, 2012-2015. 

Member of the Cyber Security Research Alliance (CSRA) Advisory Board, 2012-present. 
88 

William H. Sanders 9/12/2017 62 

Member of the Advisory Committee for the Computing and Computational Sciences Directorate of Oak Ridge 

National Laboratory, 2011-present. 

Served on panel on "The Most Promising New Control System Research Projects" at the 2011 North American 

SCAD A and Process Control Summit. 

Served on Academic Review Panel for the Center for Information Technology Research in the Interest of 

Society (CITRIS). 

Served on Economist "Smart Grid Tour" panel in the Economist Intelligent Infrastructure Series, September 

2010. 

Served on National Academy of Sciences panel on "Shifting Power: Smart Grid Energy 2010," August 2010. 

Member of the TRUST Distinguished External Advisory Board, University of California at Berkeley, 2006-

present. 

Member, Advisory Board for the European Union Integrated IRRIIS (Integrated Risk Reduction of Informationbased Infrastructure Systems), 2006-present. 

Member of the Advisory Committee for the Computational Sciences and Engineering Division (CSED) for Oak 

Ridge National Laboratory, 2005-present (renewed 2010). 

Named member of the Motorola Research Visionary Board (RVB), 2005 (re-invited 2007). 

Member of the University of Michigan EECS Department National Advisory Committee, 2004-present. 

Acted as mentor to Univ. of Arizona Flinn Scholar Program, 1989-1990. 

Administered Univ. of Arizona ECE Department Master's Exam, Spring 1989. 

Improvement Activities 

Took University of Illinois Course on "Teaching College," Fall1994. 
89 

Chairman SMITH. Thank you, Dr. Sanders. And, Mr. Imhoff. 

TESTIMONY OF MR. CARL IMHOFF, MANAGER, 

ELECTRICITY MARKET SECTOR, 

PACIFIC NORTHWEST NATIONAL LABORATORY 

Mr. IMHOFF. Thank you, Chairman Smith, Ranking Member 

Veasey, and Members of the Committee today, for the opportunity 

to join this important conversation. My name is Carl Imhoff, and 

I lead the Grid Research Program in DOE’s Pacific Northwest National Laboratory in Washington State. For more than two decades, 

PNNL has supported power system resilience, reliability, and innovation for DOE and utilities across the Nation. I also chair DOE’s 

Grid Modernization Laboratory Consortium, a team of 12 National 

Labs that support DOE’s grid modernization initiative with—along 

with over 100 partners from industry and academia such as 

ERCOT and Texas A&M and the University of Illinois. 

Today, I offer three main points regarding grid resilience. Point 

1, substantial opportunity exists to leverage fundamental science 

and applied research to enhance the Nation’s options for modernizing the grid in ways that enhance overall resilience, and I’ll share 

five examples. 

Point 2, the national laboratories have delivered important new 

approaches to enhance grid resilience, and I’ll share some recent 

accomplishments and some emerging new efforts that were just recently announced. 

And point 3, state and federal regulatory stakeholders need resilience valuation tools in addition to the science and technology innovation so that they can better enable the required investment to actually deliver the science and technology innovations. 

Let’s start with science and technology opportunities themselves. 

The definition of a resilient grid addresses both avoiding and resisting outages before an incident occurs, as well as rapidly responding to an incident and recovering as quickly as possible afterwards, two sides of the coin. Science and technology can contribute 

on both sides, avoidance before events and recovery afterwards. 

Specific S and T topics we think are vital to the future include 

the following: enhanced, real-time, predictive operational tools to 

detect problems early and steer around them; enhanced precision 

planning tools to better predict risk and design accordingly to make 

systems more resilient; advanced grid architecture, coordination, 

and control of the grid to pinpoint new structural risks and options 

on how to control the system and recover it more quickly; number 

4, advanced data and visual analytic tools for better situational 

awareness across all hazards whether it’s physical, weather, cyber; 

and then number 5, energy storage at an affordable price point to 

provide a new grid flexibility option for the future. 

For the hearing objective of improved cyber resilience, advanced 

data analytics and new grid architectures and controls would substantially improve the situational awareness of cyber threats and 

provide more resilient control options to present—to prevent further system damage. And advanced predictive operation tools and 

energy storage would help operators limit the spread of cyber-induced outages. 
90 

For the hearing objective of physical resilience, an important 

emerging tool is the development of design basis threat assessments to frame the physical threat scenarios of highest priority to 

individual utilities. These systematic threat assessments, linked 

with enhanced planning tools, would better guide resilience investments for utilities and other stakeholders. 

Switching now to progress in the national laboratory grid modernization efforts, a foundational project in that effort is developing 

metrics to support government and industry efforts in grid modernization. Grid resilience is one of those six metrics. It’s one that’s 

still under debate in terms of its definition, and it’s closely related 

to the traditional metric of grid reliability, as well as emerging 

metric called grid flexibility. 

Other projects include dynamic contingency analysis tools to help 

planners better avoid white area cascading outages like we experienced in the Northeast in 2003. This tool was developed in partnership with DOE and ERCOT and soon will become part of ERCOT’s 

regular planning efforts. 

Grid analysis and design for resilience was another recent GMLC 

project delivered for New Orleans to help coordinate microgrids and 

other critical functions like water pumping, et cetera, to help them 

ride through emergencies. Finally, DOE awarded $32 million last month to fund seven resilient distribution public-private projects around the country to validate the performance of new resilience innovations emerging from 

the GMLC portfolio. 

My third point is that science and technology advances must be 

complemented by new tools to help utilities and regulators chart 

the investment strategies to improve grid resilience. Utilities at all 

levels, consumer-owned and, must have the capacity to understand 

the value of alternatives to improve their system, and state regulators need the same tools to provide the regulatory incentives to 

deliver the resilience improvements at scale. The National Labs are 

developing such evaluation framework with state and industry participation. 

So I conclude that science and technology innovation can enable 

a modernized grid that we can see, control, and protect like never 

before. Big data management, new data analytics, machine learning, and exascale computing will be central to delivering this modern grid and maintaining U.S. leadership. Grid resilience is intricately linked to other attributes such as reliability and flexibility, 

and new tools to value and simulate grid resilience concepts in concert with public-private field validation will accelerate national grid 

modernization efforts. 

I look forward to answering any questions. 

[The prepared statement of Mr. Imhoff follows:] 
91 

Statement of Carl Imhoff 

Manager, Electricity Market Sector 

Pacific Northwest National Laboratory 

Before the 

United States House of Representatives 

Committee on Science, Space and Technology 

October 3, 2017 

Good morning. Thank you, Chairman Smith, Ranking Member Johnson, and Members of the 

committee. I appreciate the opportunity to appear before you today to discuss U.S. electric 

infrastructure resilience issues and opportunities. 

My name is Carl Imhoff: and !lead the Grid Research Program at the Pacific Northwest National 

Laboratory (PNNL), a Department of Energy (DOE) national laboratory located in Richland. 

Washington. I also serve as the Chair ofDOE's Grid Modernization Laboratory Consortium, a 

team of national labs that, along with industry, industry groups such as the Gridwise Alliance 

and Electric Power Research Institute (EPRI), and university pminers, supports the Department's 

Grid Modernization Initiative. The consortium members include PNNL, the National Renewable 

Energy National Laboratory, Sm1dia National Laboratories, Oak Ridge National Laboratory, 

Brookhaven National Laboratory, Lawrence Berkeley National Laboratory, Los Alamos 

National Laboratory, Idaho National Laboratory, Argonne National Laboratory, the National 

Energy Technology Laboratory, Savannah River National Laboratory, Lawrence Livermore 

National Laboratory and the National Accelerator Laboratory at Stanford. 

Today I will address three main points: 

I. Substantial opportnnity exists to leverage fundamental science and applied research to 

enhance the nation's options for modernizing the grid in ways that enhance overall 

resilience. 

2. The national laboratories have delivered important contributions in new approaches to 

enhance grid resilience. I will discuss the importance of research and development to 

ensuring a resilient, reliable and flexible grid, share recent accomplishments delivered in 

pminership with industry, and highlight emerging resilience research activities. 

3. State and federal regulatory stakeholders need innovative tools and data sets to improve 

valuation of power system resilience so that they can better enable the investment 

required to deliver a modern grid that is resilient, reliable and flexible. 

1 
92 

Background 

For more than two decades, PNNL has supported power system reliability, resilience and 

innovation for the State of Washington, the Pacific Northwest, and the nation, Over this period, 

the laboratory has: 

I. Led DOE-industry collaborations in developing and deploying synchrophasor technology 

to help avoid blackouts. Phasor measurement unit networks are designed to enhance 

situational awareness of wide area systems. This new grid tool has demonstrated value by 

detecting impending system control and equipment faults for system operators, thus 

avoiding major outages. California estimates $360 million annual savings to customers 

due to avoided outages, plus $90 million annual savings in improved utilization of 

existing generation and delivery systems. In east Texas, phasor measurement units 

enabled Entergy to respond to major storm outages by synchronizing a temporary 

electrical island to reduce outages during the recovery. At the Columbia Generating 

Station, an 1100-megawatt nuclear reactor in Washington State, the Bonneville Power 

Administration has demonstrated savings of $400,000, on average, for testing generator 

controls settings without requiring a plant shutdO\m. 

2. Led a public-private collaboration with utilities and vendors to develop and demonstrate 

transactive control concepts on the Olympic Peninsula in Washington and for the Pacific 

Northwest Smart Grid Demonstration project--the largest of its kind-to validate smart 

grid benefits and new control approaches that engage demand and distributed resources at 

scale. Exan1ple outcomes include A vista Corporation implementing distribution 

automation and smart metering pilots that delivered a 1 0-percent reduction in customer 

outages, reduced consumer outage durations by 21 percent, and resulted in 1.5 million 

avoided outage minutes between April 2015 and April 2016. A vista also saved 42,000 

megawatt hours in 12 months. Idaho Falls Power implemented transactive control of end 

uses and utilized the concept to minimize customer outages during an extreme winter 

storm when the westem system operators were calling for emergency reductions in load. 

3. Delivered the first applications of high performance computing to grid tools such as 

interconnection-scale contingency analysis, reducing run times from days to under two 

minutes. Pl\TNL also applied high performance computing and phasor measurement unit 

data to deliver the first real-time dynamic state estimation to open the door to the future 

world of predictive grid tools. This parallelized state estimator tool enabled PNNL to 

meet an ARPA-E challenge to reduce dynamic line rating calculations from 24 hours to 

I 0 minutes, creating the potential to operate the system with much higher asset 

utilization. 

These examples illustrate the high return on investment possible by utilities and national labs 

across the country when combining new electric infrastructure innovation with public-private 

validation and deployment. 

2 
93 

The DOE Grid Modernization Initiative is an important source of innovation for national efforts 

to modernize the energy infrastructure. Improved grid resilience is a major objective of the 

overall effort. The Initiative is a DOE-wide effort across multiple program offices to accelerate 

the development ofteclmology, modeling analysis, tools, and frameworks to enable grid 

modemization adoption. As a key component of this Initiative, the Grid Modernization 

Laboratory Consortium is working closely with partners in industry, academia, and cities and 

states to deliver on the objectives outlined in DOE's Grid Modernization Multiyear Program 

Plan. These integrated efforts will deliver new concepts, tools, platforms, and technologies to 

better measure, analyze, predict, and control the grid of the future to improve resilience, 

reliability and productivity. Public/private collaboration in field validation accelerates the 

development of lessons learned and data that support states and utilities to develop business 

cases for their grid modemization efforts. I respectfully request that the appended fact sheet on 

the Grid Modernization Laboratory Consortium be entered into the record along with my written 

testimony. 

Emerging Science and Technology Opportunities to Enhance Power System Resilience 

The definition of a resilient grid addresses both avoidance and resistance to outages before an 

incident, as well as to the ability to rapidly respond to an outage and achieve full recovery as 

quickly as possible. Science and technology provide substantial contributions to avoidance and 

resistance to outages, as well as to the post -event assessment and recovery. New digital sensing, 

measurement, and control concept~. often termed "smart grid", are enabling system operators to 

"see" and "control" the grid with exceptional precision and speed. These new concepts, 

combined with new distributed energy resources such as energy storage, local generation 

sources, or microgrids, are paving the way for enhanced grid performance that is more resilient, 

reliable and flexible. Selected examples of significant science and technology advances include: 

I. Enhanced real-time, predictive operational tools: High-precision fast sensor networks 

linked to utility control centers enable operators to predict grid system behavior, anticipate 

dangerous oscillations, and optimally adjust power flows and power transfer limits. These 

tools leverage advanced computing and mathematical algorithms to deliver modeling and 

simulation tools that dramatically enhance resilience by helping avoid outages in the first 

place. They also help operators adapt to outages and recover system operations faster. These 

modeling and simulation tools are examples of the tools recommended in the National 

Academies report on grid resilience. 

2. Enhanced precision planning tools: The nation invests substantial capital in grid 

infrastructure, and these investments typically have multi-decade lifetimes. Recent advances 

in computation and simulation tools promise to improve the accuracy and speed of system 

planning tools that can better assess complex risk scenarios and improve system designs that 

will improve resilience for future decades. DOE tean1ed with PNNL and ERCOT to develop 

a new dynamic contingency modeling tool that helps grid planners explore larger, more 

complex cascading failure scenarios. Successful testing with ERCOT has led to broader 

3 
94 

industry use of this tool that promises to support the design of systems that are more resilient 

to increasingly complex "all hazards" threats to the system. This effort is consistent with the 

National Academies grid resilience recommendations for improved "visioning" of future 

resilient grid system outcomes and the modeling tools to validate cost effective system 

designs to deliver the desired resilience. 

3. Advanced grid architecture, coordination and control: Technology and business model 

evolution are driving substantial change to power systems and related critical infrastructures 

such as communications, fi.tel supply, markets and control. DOE is working with states and 

industry to envision how the new aspects of a modern grid will change and fit together in the 

future. This effort will then frame where changes in coordination and control of utility 

systems and consumer systems must occur to ensure a resilient and reliable grid. Success will 

lead to new control concepts that ensure modern, distributed power systems will be more 

resilient and secure. These new paradigms of grid structures and control will be a 

fundamental element in the National Academies recommended "visioning" processes to chart 

new approaches for grid resilience. 

4. Advanced data and visual analytic tools: Trends in e-commerce, digital grid technologies, 

and consumer devices and services are creating a dramatic increase in data on the power 

system, much of which flows at very high speed. GE Digital Energy testified earlier this year 

that the grid has approximately two billion "edge devices" today, estimated to grow to more 

than 20 billion in 2025. Substantial opportunities exist for "big data" management, advanced 

data analytics, machine learning, network science, and research to ensure security of the grid 

and effective use ofthe data generated by the grid. Fundamental advances will be required in 

high performance computation. mathematics, statistics, and communications networks to 

deliver on the potential for full system obscrvability and control. PNNL, in partnership with 

Argonne National Laboratory and the National Renewable Laboratory, has launched the first 

grid application of exascale computing for the grid as part of the DOE Exascale Computing 

program. 

5. Energy storage at an affordable price point to provide a new grid element: Large 

complex systems typically require the flexibility to decouple supply and demand to maintain 

reliability. Examples include warehouses for logistics and storage tanks for water systems. 

The equivalent for power systems is energy storage. The power system of the future will 

greatly benefit from increased use of energy storage to serve this "shock absorber" role as 

loads become more complex and generation becomes more variable. Energy storage systems 

will reduce the risk of outage, enhance emergency operations oflocal microgrids during 

emergencies, and improve the recovery of failed systems. Early GMLC research indicates 

that affordable grid-scale storage, linked with smart power electronics and new control 

theory, offers significant potential to improve grid resilience to all hazards. Materials science 

is vital to driving the grid-scale price points down, and advanced theory for coordination and 

control linked with storage is important to delivering increased grid flexibility m1d resilience. 

4 
95 

With regard to the Hearing objective of improved cyber resilience, advanced data analytics (item 

4 above) and new grid architecture and controls (item 5 above) would substantially improve 

situational awareness of cyber threats and provide more resilient control options to mitigate the 

impact from attacks. And the advanced predictive, real-time operational tools (item I above) 

would give operators precise tools to limit the spread of a cyber-induced outage and speed 

recovery. Energy storage (item 5 above) would provide more flexibility in how operators 

mitigate any cyber outage and speed recovery. In addition to technology innovations, small and 

mid-sized utilities could substantially improve their cyber readiness through implementation of 

existing cyber security maturity self-assessment tools and vulnerability assessments. The 

challenge small utilities face is limited engineering staff and financial resources to systematically 

conduct cyber vulnerability assessments and cyber maturity self-assessments. 

For the Hearing objective of physical resilience, an important emerging tool is the development 

of ''design basis threat" assessments to frame the physical threat scenarios of highest priority to 

individual utilities. PNNL recently developed the first design basis threat assessment for NERC 

targeting physical resilience. This approach is consistent with the National Academies grid 

resilience report recommendation to systematically "vision" the emerging threat profiles and 

define priorities for improved resilience. With a prioritized plan for reducing physical security 

risk, the predictive real-time operation tools (item l above), enhanced planning tools to mitigate 

the risk of cascading outages triggered by physical attack (item 2 above), and sources of 

flexibility to cushion the system and speed recovery (e.g., energy storage in item 5 above or 

adaptive controls in item 3 above) would provide a path to improving physical attack resilience. 

In summary, advances in science and technology concepts, conducted and validated in the field 

\vith public-private pmtnerships, offer substantial potential to improve grid resilience to cyber 

threat, physical attack and other sources of threat to the grid. 

National Laboratorv Collaborative Efforts To Improve Power System Resilience 

DOE convened a consortium of 13 national laboratories-the Grid Modemization Laboratory 

Consortium (GMLC)-in 2014 to support its Grid Modemization Initiative in a coordinated, 

collaborative manner. A foundational element of this cff()rt has been to frame mctrics to support 

government and industry efforts in grid modernization. Grid resilience is one of the six me tries; 

it is closely related to the traditional metric of grid reliability, as well as an emerging metric 

called grid flexibility. 

The National Academies grid resilience definition is similar to the definition in the GMLC 

Metrics effort. The challenge, however, is that metrics for resilience depend upon the type of 

threat or risk being addressed. And the attribute of "grid flexibility" is an emerging grid attribute 

that will be important to providing improved grid resilience in the future grid. Definitions and 

perspectives for these three metrics are described below. 

5 
96 

GMLC Grid Modernization Metrics Research Related to Resilience 

GMlC Definition Current Status Next steps· 

Resilience: The ability to prepare Widely-accepted metrics for With key stakeholders, GMLC is 

for and adapt to changing resilience do not exist piloting new metrics through case 

conditions and withstand and currently. Existing metrics do studies: 

recover rapidly from disruptions, not focus on impacts resulting 

deliberate attacks, accidents, or from individual events or on . Electrical service 

naturally occurring threats or individual critical sectors, . Critical electrical service 

incidents. especially resilience events, . Restoration cost and time 

which are generally infrequent . Monetary impacts 

yet have large consequences. 

Reliability: Maintain the delivery of Existing metrics are mature but For distribution, the GMLC is 

electric services to customers in the focus on distribution networks. developing more granular, valueface of routine uncertainty in They gauge the frequency and based metrics that enable utilities to 

operating conditions. For duration of outages averaged estimate the likely costs to customers 

distribution systems, focus is on over all customers within a in specific locations so that 

interruptions in the delivery of service territory over a specific investment dollars can be allocated to 

electricity in sufficient quantities time period. This approach reduce the likelihood of the most 

and quality. For bulk power system masks the wide variance costly interruptions. These are being 

reliability, metrics focus on near- among outages in terms of developed and demonstrated through 

term operations and longer term size, duration and economic a partnership with the American 

planning. impact on customers. Public Power Association. Bulk power 

efforts include working with the 

North American Electric Reliability 

Corporation new transmission metrics 

to gauge overall reliability of the 

three North American 

interconnections. 

Flexibility: The ability to respond Widely accepted metrics for Industry feedback indicates the 

to future uncertainties that stress flexibility do not exist. highest priority for flexibility metrics 

the system in the short term and pertain to coping with short-term 

I may require the system to adapt fluctuations in the availability of 

over the long term. For near-term generation from wind and utility-scale 

i operations, flexibility refers to the solar facilities. The GMLC is evaluating 

; agility of electrical networks to more than 20 separate metrics that 

I adjust to known or unforeseen could quickly identify the nature of a 

short-term changes, such as abrupt given fluctuation or estimate the 

changes in load conditions or sharp likely effectiveness of alternative 

ramps due to errors in renewable options for dealing with that 

generation forecasts. For longer- fluctuation. 

term investment perspectives, 

flexibility refers to the ability to The GMLC will also examine how to 

respond to major regulatory and build more flexibility into long-term 

policy changes and technological system planning. 

breakthroughs without incurring 

stranded assets. 

6 
97 

The GMLC research portfolio includes projects focused on improved power system resilience. 

Some highlights of recent results include the folllming (fact sheets attached): 

Transactive Campus Tcstbeds for Local and Regional Grid Resilience and Flexibility: 

Corporate, university, and govemment campuses represent a substantial resource for 

microgrid and load coordination to support emergency response and deliver power system 

flexibility at local and regional levels. In Washington State, three campuses (PNNL, the 

University of Washington, and Washington State University) are establishing transactive 

controls of responsive distributed energy resources, major loads and energy storage to 

coordinate at the local campus and to collectively deliver resilience and flexibility to the 

regional grid. lbese testbeds will deliver design and operational strategies and lessons 

learned to support wider adoption across the nation. 

Grid Analysis and Design for Energy and Infrastructure Resiliency for New Orleans: 

Coastal cities like New Orleans, Louisiana, often experience extended disruption of electric 

grid operations, resulting in impacts to other energy intensive infrastructures vital to 

recovery, including flood control operations, water supply and treatment, transportation, 

emergency response, and banking. A recently completed GMLC project developed strategies 

with stakeholders to effectively usc local distributed generation, micro grids, and renewable 

energy resources as well as cost -effective grid resilience enhancements to reduce the severity 

of power outage impacts and enhance community resilience for U.S. coastal communities. It 

delivered an integrated strategy engaging city emergency response officials, utility 

representatives and others to deliver a more robust city response that supported flooding 

management and emergency services in addition to power restoration to city neighborhoods. 

Microgrid Enhancements for Grid Resilience in Kentucky and Alaska: Two projects 

addressed how to enhance resiliency of power grids supporting critical loads and remote 

communities, respectively, through advanced microgrid controls, as well as informing 

investment decisions to reduce risks to extreme storms and other threats. These projects have 

delivered enhanced microgrid toolsets available to industry microgrid designs, and strategies 

for system planning and financing to expand the availability of microgrids to support 

improved grid resilience. 

Threat Detection and Response with Data Analytics: The nation's power grid faces 

dynamic and complex threats from cybcr-attacks, physical attacks, and storms. This research 

brings together six laboratories to develop an all-hazards approach to protect the grid through 

advancements in three key areas of technology development: sensors, data analytics, and a 

response/mitigation fi·amework. Industry pm1ncrs are advising the research and will 

ultimately be candidates for field validation of these emerging analytic concepts. 

Southeast Regional Consortium for Improving Distribution Resiliency through 

Advanced Sensors and Controls: GMLC labs have teamed with multiple utilities in the 

Southeast to deploy and test advanced sensor platforms and analytic tools to enhance power 

system monitoring and recovery in the face of increasing extreme events (e.g., hurricanes). 

Through the development of an advanced sensing, communication, and control ecosystem, 

increased situational awareness technologies have been deployed for field validation that will 

improve overall storm resilience and response. 

7 
98 

Finally, DOE recently awarded seven new resilient distribution systems projects in September. 

These public-private efforts will validate emerging GMLC resilience concepts in utility and 

community environments. 

Innovation in Valuation Tools and Data Sets to Advance State and Federal Regulatory 

Consideration oflnvestment for Power System Resilience 

Science and technology efforts are critical to modernize the grid for resilience, reliability and 

flexibility, but alone cannot achieve the end state goal. Utilities at all levels--consumer-owned, 

investor-owned, municipalities-must have the capacity to understand the value of alternatives 

to improve their system resilience and performance. State regulators need the same tools and 

data sets with which to evaluate modernization plans and provide the regulatory incentives to 

achieve prudent modernization that delivers affordable resilience improvements to product 

offerings that enable modernization at scale. Finally, vendors must be able to define market 

opportunities to ensure rapid i1movation in their product offerings. 

The GMLC portfolio includes research projects to develop a framework for valuation of the new 

grid technologies and concepts so that government and industry stakeholders can work together 

to assess the benefits and costs of resilience improvement strategies. This partnership between 

DOE, states, and industry is an important collaboration in charting a timely path to a more 

resilient U.S. power system. 

Conclusion 

In conclusion, science and technology innovation offer the capacity to deliver a resilient and 

modernized grid that we can "see and control and protect" like never before. Big data 

management, new data analytics and fundamental advances in machine learning, and exascale 

computing will be central to delivering this modern grid and maintaining U.S. leadership. Grid 

resilience is intricately linked to other grid attributes such as reliability and flexibility. And new 

tools to value and simulate grid resilience concepts, in concert with public/private field 

validation, will accelerate national grid modernization efforts. 

I appreciate the opportunity to discuss this important issue with you today, and I am happy to 

answer your questions. Thank you. 

8 
99 

power system. 
100 
101 

Pacific Northwest National 

W'"hinoton State 

w,"hinntnn (UW). is the first time researchers will test the use of 

rlPmnnrl-<irtn transactive controls ("behind the 

involving multlp!e and devices. Primary 

campus include the 

., PNNL n1ulti-campus network ""'"'"'tinrK trnn<r,ctiivn 

response applications; trans:,ctive.ladvallCctd 

~ WSU- microgrids as a resl!ience resource/smart city; solar and battery 

in microgrid operations; flexible loads; thermal storage 

controls, 

leveraging transactive network; 

with distribution; transactive grid 

objective is the establishment of a transactive energy 

partners will examine how tl1e testbed can be 

both a flexibility resource to help manage loads and bring 

intermittent renewable energy onto the power and as a for 

future research and in the discipline. 

of this expands to new partners Case Western 

Reserve University of Toledo in 2017_ 
102 

EXPECTED OUTCOMES 

and future grid modernization decision making, 

regionally and nationally, This is a key 

achieving a more modern, efficient, and 

grid. 
103 

Alaska-perhaps more than any 

other region in the country-faces 

unprecedented challenges in 

modernizing its rural energy 

infrastructure. Across the state, 

approximately 200 isolated 

m!crogrid systems are not 

connected to larger grids, and most 

of these systems rely almost 

exclusively on imported fuel 

(primarily diesel) to meet electrical, 

space/water heating, and 

transportation requirements. 

These communities have populations mnging from 50 to 6,000 people, are 

composed primarily of native Alaskans, and have some of the highest 

energy costs in the nation (up to -10 times the national average), 

Alaska has extensive renewable energy resources, access to advanced 

diesel and load control technologies, and significant opportunities to 

improve energy efficiency, Despite this potential, relatively few energy 

projects have been completed with most of these projects being funded by 

grants, Rural Alaska likely has the lowest reliability and least resilient 

power systems in the country. 

This project involves creating a development pathway for islanded 

microgrids that emphasizes leading by example, ttlen testing the pathway 

using two pilot projects, and making the pathway data and other useful 

information avaHab!e for other communities to follow. Key project activities 

include the following: 

• developing a consistent assessment pathway to reduce total imported 

energy usage in a holistic way, working to address electrical, heating, 

and transportation energy needs; 

• pulling together largely existing analytical tools to coordinate technical 

and financial methods that support full development assessments, 

allowing expanded public and private sector engagement: 

" integrating more robust financial pro-forma assessment into the analysis 

of energy options, facilitating private sector investment in energy system 

improvements; 

• implementing the pathway with two pilot communities, providing a 

workable example for other, non-pilot communities; and Rev 2, June2017 
104 

• developing new data sources and sharing 

information with project developers-via the Alaska 

Energy Data Gateway-that details the human, 

EXPECTED OUTCOMES 

The over-arching goal ofthe Alaska Microgrid 

Partnership is to significantly reduce the use of 

imported energy sources in Alaska's remote microgrlds 

without increasing system lifecycle costs, while 

improving overall system reliability, security, and 

resilience, Expected outcomes from this project 

include the following: 

.. documenting the full techno-economic development 

process for reducing imported energy consumption 

by at least 50% in remote microgrids in Alaska, using 

a combination of energy efficiency, building energy 

improvements, power system upgrades, and 

transportation options analysis; 

• identifying investment opportunities (i.e., the 

business case) to attract the funding needed to 

implement these types of projects on a wide scale; 

• creating an implementation methodology for other 

communities to follow by documenting and 

publicizing the community assessment, data 

collection, project analysis. and development 

process; and 

• implementing the methodology in two pilot 

communities to serve as models to position the 

communities to seek private and public funding to 

implement project recommendations . 

.. making Alaska Mircrogrid Partnership project and 

community information and data more readily 

available through an expansion of the Alaska Energy 

Data Gateway: https:llakenergygateway.alaska.edul 

LAB TEAM 

financial, and technical capacity of communities 

across Alaska to undertake new energy infrastructure 

projects. 

The potential worldwide market and impact are 

significant: 400 diesel microgrids in Canada, 70 in 

Greenland, and more than 1,000 in Indonesia. The 

International Energy Agency estimates that more than 

700 million people currently without electricity access 

could be most cost-effectively served by mini-grids or 

micro grids . 

Pathway for Holistic Community Microgrfd Development 
105 

Industrial Microgrid Analysis and 

Design for Energy Security and 

Resiliency 

CHALLENGE 

Industrial utility customers have a unique opportunity to support a modern 

energy economy and a stronger, more reliable grid. They typically need 

reliable, secure power in high quantities, and many facilities have their 

own backup generators and redundant electrical feeds to bolster their 

reliability. However, many of the generators are on!y used for routine 

testing and for their intended purpose only a few hours a year. If these 

backup assets could be used as a microgrid for both blue-sky and 

contingency cases. then the microgrid could provide both reliability to the 

customer and services to the grid. Some utilities are not familiar with 

some of the emerging grid technologies and how they can be 

incorporated into their operations to increase grid resilience for their 

customers. The perceived risk associated with new technology adoption 

can present a significant barrier to modernizing the grid. 

Addressing utility hesitation head-on by involving utilities in the entire 

development of grid modernization technologies and providing hard 

evidence of benefit to both customers and utilities could be the key to 

unlocking utility modernization efforts across the country. 

APPROACH 

Advanced microgrid control schemes are one way to increase the 

reliability and strength of the grid. Oak Ridge National Laboratory (ORNL), 

in partnership with Sandia National Laboratories (SNL) and Fortune 10 

company United Parcel Service (UPS), is investigating, developing, and 

analyzing the risks, costs, and benefits of a microgrid at the UPS World 

Port and Centennial Hub facilities in Louisville, Kentucky. This processing 

hub, the crown jewel of UPS's company, is the most technically advanced 

facility of its kind in the world, and UPS is very interested in the 

development of an industrial microgrid to serve its 50-megawatt power 

needs. 

This partnership will keep the utility engaged in the project and aware of 

how industry customers want to use microgrids, and how microgrids will 

affect the larger electric grid. 

PROJECT 1 3 04 I FACT SHEET 

Rev. 2. June 2017 
106 

EXPECTED OUTCOMES 

Technical documents developed from this project will 

provide a roadmap and set of open-source tools for 

UPS and other industries interested in microgrid 

technologies. The institutional and regulatory 

challenges associated with development of an 

industrial microgrid will be spelled out The methods 

and open-source tools used in this project can be 

LAB TEAM 

directly applied to other interested industries. The 

project will also highlight the interaction between an 

industria! customer interested in pursuing a micro grid 

and a utility that may be unfamiliar with adopting such 

a technology-a scenario that industries across the 

country are highly likely to face. 
107 

The heightened risk coastal 

cities !ike New Orleans, 

encounter 

floods, and 

other natura! disasters ls never 

farther than the memory of 

Hurricane Katrina. During such 

events, extended disruption of 

electric grid operations 

exacerbate interruption of 

energy !ntens!ve infrastructures 

vital to including flood 

control water supply 

and treatment, transportation, 

emergency response, and 

banking, The resilience of 

communities is dependent on 

grid resilience. 

Th1s color-coded schematic of New Orleans mdicates 

where critiCal inlraMmctUIR in the area does not exi_sf 

reqwrements (green) 

Identifying approaches to use local distributed generation and 

renewable energy resources as as cost-effective grid resilience 

enhancements can he!p reduce the severity of power outage impacts and 

enhance community resilience for many U.S. coastal communities subject 

to similar threats and risks, This project will support the development of 

priority electrical distribution system upgrades and advanced microgrid pilot 

projects that can bolster community-level resilience lor NOlA and 

other coastal U.S, This project will provide detailed information and 

conceptual models that can help NOLA and other coastal cities prepare lor, 

prioritize, and execute grid resilience projects. Data will be available to 

stakeholders from the following efforts: 

• Infrastructure Impact Modeling and Analysis 

• Resilient Power Distribution Modeling and Analysis 

• Integration of Distributed, Renewable, Energy Storage, and Energy 

Efficiency Options 

• Cost/Benefit Analysis, 
108 

EXPECTED OUTCOMES 

NOLA, the local electric utility Entergy, and relevant 

stakeholders will have a set of risk-informed, costeffective recommendations for grid resilience 

enhancement. NOLA, Entergy, and stale and federal 

agencies can use these recommendations to rank 

energy infrastructure improvement options and set 

improvement implementation and funding priorities. 

This effort will produce a template for other 

communities to use for increasing grid and community 

resilience. 
109 

Different geographical 

regions across the United 

States face specific electric 

grid challenges, such as 

recurring weather 

extremes, integration of 

distributed 

and an 

hurricane-prone Southeast 

Coast of the United States. 

damage to electrical 

infrastructure is not merely 

inconvenient·-it can cause Timo-sensttive nel><lork testmg locations 

loss of life and millions to billions of dollars in economic losses. Advancing 

the state of the grid in the Southeast to improve overall system resiliency 

will reduce the impact of these weather events 

stakeholders is crucial to effectively 

address the regional 

The Southeast 

to enhance and 

increase the concentration of DERs for overall system Led by 

(ORNL), Savannah River National 

the Center for Advanced Power 

Energy and Clemson 20 MVA Electrical Grid Laboratorywith critical industry partners, such as Duke Energy. Tennessee 

Authority, Southern Company, Electric Power Board 

and Santee Cooper-this effort includes 

Development and testing of distributed control 

for the future EPB distribution center 

ha1rd~lane-ir1-t~re-looo testing at ORNL. ORNL's distributed 

fr~me,wc,rk--C:onmlr>te System-Level Efficient and lnilemne,r~h,le 

Integrated Controls-will be 

future EPB microgrid that 

Inverters, communications, storage, and loads to 
110 

the EPB microgrid from bits to electrons. This will 

be done using ORNL's Distributed Energy 

Communications and Controls laboratory !owvoltage hardware-based microgrid simulator and 

Real-time Digital Simulator. 

2. Development and validation of a cyber-resilient 

dual-mode, terrestrial and satellite-based wireless 

sensor/control network-applicable not only to the 

Southeast, but any region in the United States due 

to the use of satellite networks. 

3. Testing of new time~sensltive network 

technologies using dark fibers on the EPB fiberoptic data network. 

4. Development of step distance protection for 

distribution systems using passive optical sensors, 

Step distance protection is currently only applied at 

the transmission level. 

EXPECTED OUTCOMES 

Distributed control technologies will improve 

distribution system resiliency while increasing the 

concentration of DERs, and dual-mode wireless 

networks will allow rapid detection of cyber-attacks. 

Time-sensitive networks wi!! provide the information 

needed for fast digital control over networks and 

transient monitoring in distribution systems. 

The increased resolution of optical sensors will provide 

increased visibility, opportunities for new more resilient 

protection schemes at the distribution !eve!, improved 

fault localization, and bi-directional power flow. Dual 

wireless sensing/control will create weatherIn addition, the consortium is convening a workshop to 

connect regional stakeholders, foster shared 

understanding of the technical challenges facing 

utilities in the Southeast, and discuss the new 

technologies emerging from DOE grid modernization 

efforts. 

independent information networks that will help restore 

power to critical loads more quickly during storms. 

Building on existing collaborations, the consortium will 

foster new engagements with the University of 

Tennessee, Clemson, Duke University, The University 

of North Carolina, EPB, Santee Cooper, Southern 

Company, Dominion, SRNL, and ORNL to assure that 

these and other emerging technology developments to 

create a modern resilient grid are more rapidly moved 

from laboratories to industry implementation. 
111 

Large amounts of data related to regional outages, cyber health, 

distribution sensors, and advanced metering infrastructure (AMI) are 

gathered from the electrical grid. However, it is difficult to identify cyberattacks and differentiate them from non-cyber incidents. Furthermore, 

degradation of the grid can come in many forms, including failure of 

materla!s, equipment, and information infrastructure resulting from natural 

or malicious events. Consequences from any of these scenarios can affect 

the reliability, maintainability, and availability of data required for decision 

making at numerous levels. 

This project will develop advanced analytics using operational technology 

(OT) cyber data to detect complex cyber threats. Analytics will be 

developed that can assist in differentiating between cyber and non-cybercaused incidents using available cyber data. To this end, the project team 

will conduct the following activities: 

• Evaluate which sensor data are most valuable and could provide the 

biggest positive impact (in terms of grid resiliency/security) if an event is 

successfully detected. Possible data sources are phasor measurement 

units (PM Us) in electrical distribution systems, renewable generation and 

distributed energy resources (photovoltaics/inverters), demand response 

data for energy dispatch on the bulk electric system or electric vehicles 

on the consumer side, AMI data, and building automation data 

• Develop analytics to identify emerging cyber incidents on the electric grid 

using OT data identified in the previous objective. 

• Attempt to differentiate cyber grid incidents from other grid hazard 

incidents, such as physical attacks, natural hazards, etc. 

• Test analytics with industry and asset owner partners. 

Rev 2, June 2017 
112 

a!low us to 

events and non-cyber events on the grid, By 

differentiating between cyber-related and non-cyberre!atedloperatlona! events, determinations can be 

made about the type of incident and its root cause, We 

will a U,S, utility to obtain sensor data and 

prototype analytics against the data, 

Research results will lead to development of 

commercial tools that will improve a 

differentiate between cyber and 

so that they can make the most appropriate response 

during an event 
113 

Carl Imhoff 

Manager 

Electricity Market Sector 

Pacific Northwest National 

Mr. Imhoff manages the Electric Infrastructure market sector within Pacific Northwest National Laboratory's Energy 

and Environment Directorate. The market sector conducts advanced electric infrastructure research and product 

development with the U.S. Department of Energy, state governments, vendors, and commercial energy firms. In this 

role he is responsible for PNNl's research and development programs on innovations in the areas of advanced 

power transmission reliability concepts, demand response, development of improved integration concepts for 

renewable energy generation technologies, policy and strategy for smart grid concepts, and cross-cutting grid analytic 

tools in visualization and high performance computing. 

As leader of PNNL's laborat01y Objective for a Secure and Efficient Grid, Mr. Imhoff is accountable for Lab-level 

strategy and execution of strategic development for grid strategy, capabilities, and partnerships, ensuring continued 

leadership by PNNl in grid modernization over the next decade. In November 2014, Mr. Imhoff was selected by DOE 

as laboratory Integrator Team Chair for the DOE Grid Modernization laboratory Consortium. This Consortium is 

charged with increasing integration among DOE offices and national laboratories working to transform the U.S. power 

grid to meet the consumer, economic, environmental, and security priorities of the 21st century. 

During his 30-plus years at PNNL, Mr. Imhoff has conducted and managed a broad range of energy research. His 

technical work emphasizes systems engineering and operations in the areas of power system reliability, smart grid, 

energy efficiency, energy storage and clean power generation. He has been actively involved in a number of electric 

power system organizations and bodies, including the North American Synchrophasor Initiative, the GridWise 

Alliance, the Consortium for Electric Reliability Technology Solutions, and the Western Electric Coordinating CounciL 

1 
114 

Chairman SMITH. Thank you, Mr. Imhoff. 

And, Dr. Dillingham. 

TESTIMONY OF DR. GAVIN DILLINGHAM, 

PROGRAM DIRECTOR, 

CLEAN ENERGY POLICY, 

HOUSTON ADVANCED RESEARCH CENTER 

Dr. DILLINGHAM. Good morning. Chairman Smith, Ranking 

Member Veasey, and Members of the Committee, thank you for the 

opportunity to appear before you today. I’m Gavin Dillingham, Program Director of Clean Energy Policy at HARC. We’re a nonpartisan research institute in the Woodlands, Texas. I’m pleased to 

provide testimony on the resiliency of the United States’ power infrastructure, particularly in respect to risks posed by extreme 

weather events. 

Thank you for the opportunity to discuss the findings of the latest NAP report on resilience. It’s very timely and important. It 

pushes forward the discussion that we must have to ensure a more 

resilient power system. 

A key area of interest for me is the discussion on the increasing 

intensity of extreme weather and the impact on the electric system. 

The systems must be designed and constructed for a multitude of 

extreme weather events, and I wanted to provide one example and 

specific to Texas. Texas has experienced multiple extreme weather 

patterns resulting in significant power outages in the last few 

years. 

First of all, there was the statewide drought of 2011/2012. This 

multiyear drought placed considerable pressure on power generation, which is highly dependent on water for cooling. During the 

drought, there was not enough water to cool the plants or the 

water was too warm for cooling. There was a significant concern by 

ERCOT about losing millions of potentially several thousand 

megawatts of power if the drought did not end. 

A recent Argonne National Labs study finds—that looked at the 

drought situation finds that the Texas grid could face severe stress 

due to lack of water availability, as well as derating of thermal 

electric plants due to high water temperatures. The stress on the 

power system due to this drought is not only limited to Texas. It’s 

an issue across the entire western United States, particularly in 

the arid States. 

And Texas, beyond drought, we’ve had three 500-year-plus flood 

events in the last three years, the most recent being Hurricane 

Harvey, which dumped about 27 trillion gallons of water along the 

Gulf Coast. If you’re familiar with Texas and the eighth wonder of 

the world, that’s 68,000 Astrodomes’—or 86,000, I’m sorry, Astrodomes’ worth of water. If you actually added that out, it’d be about 

400 square miles about 128 feet high, I mean, a huge amount of 

water at one point, left close to one million utility customers without power. 

The other two floods we’ve had was the tax day flood of 2016, 

and the 2015 Memorial Day flood. Flooding can cause significant 

damage to transmission and distribution systems, particularly substations, and the potential long-term duration of floods can significantly delay the restoration of power to communities. 
115 

I’d be remiss not to mention Hurricane Ike, which happened in 

2008. During Hurricane Ike, 2.1 million customers lost power. 

Many of them were out of power for over two weeks. which is actually fairly small when you look at what just happened with Hurricane Irma where there were over 9 million customers that lost 

power. And then you look at the Hurricane Maria, which essentially took out the entire island of Puerto Rico. Texas also deals on 

average with 146 tornadoes per year, wildfires and ice storms, and 

most recently, the Texas panhandle, January 2017 ice storm that 

cut power to 31,000 customers. 

This is one example of one State. Similar stories of extreme 

weather events can be found across all States. For more info, you 

could check out the Department of Energy’s U.S. Energy Sector 

Vulnerabilities to Climate Change and Extreme Weather. 

Natural disasters will increase in number and have already increased in intensity, and this puts our existing grid at risk. It’s 

very difficult to determine the timing, location, and intensity of 

these events. With this level of uncertainty and when financial resources are limited, it is challenging to make the appropriate investment decisions. When decisions are not made, infrastructure is 

not built, and our systems are not prepared. This will result in significant damage and loss. 

Uncertainty is the enemy of action. Fortunately, we’re seeing the 

deployment of downscaled regional climate models that provide improved certainty of the likelihood of extreme weather events. Texas 

Tech University Climate Science Center is a great example of doing 

some of this work. Better visibility into future climate patterns will 

improve planning for power systems and decision-making, and 

the—more investment must go into these models to reduce further 

uncertainty. 

Some of the solutions we’d like to discuss, first of all, in the 

United States, the power portfolio is very highly water-dependent. 

Approximately 85 percent of our power generation requires water. 

Fortunately, systems not requiring water being deployed across the 

country largely in the form of wind and solar generation systems, 

battery storage, and microgrid. However, the speed at which these 

systems are being deployed does not look to significantly shift the 

grid away from water dependency. Projections differ significantly, 

but regardless of what projection you look at, both—most of them 

look at over 60 percent of the power system dependent on water 

out to 2050. 

The technology and capability is available to quickly deploy these 

systems. Unfortunately, policy and regulations have not kept up. It 

should hearten the Committee to know that the recently released 

DOE grid reliability study finds increased deployment of renewable 

resources has not and will not negatively impact the operation of 

the grid. This should remove some of the policy and regulatory 

headwinds here. 

A key issue is availability of funding. Two funding mechanisms 

that could increase the deployment of renewable energy is to allow 

renewables to participate in master limited partnerships, similar to 

what fossil fuel assets are allowed to participate in, and allowing 

the deployment of green bonds to fund renewable infrastructure. 

These are two market-based funding solutions. 
116 

Other hindrances are the patchwork of grid interconnection 

standards, old utility models that do not account for the benefits 

of DER. We should also start looking into PEER, performance excellence electricity renewable—renewal. These are voluntary power 

resilience standards that should be considered to improve the reliability and resilience and operational effectiveness of our grid. And 

then also looking at microgrids and microgrids with combined heat 

and power. These are proven systems to improve—increase the resilience of critical infrastructure. It’s estimated that 3.7 gigawatts 

of microgrid systems will be deployed by 2020, which is small in 

comparison to other resources. But a very important resource as we 

look for systems that are resilient and have demonstrated their efficacy through a wide number of natural disaster events, most recently being the UTMB in Galveston during Hurricane Harvey. 

The DOE has actively worked to increase deployment of CHP 

through its Better Buildings Initiative Resiliency Accelerator and 

Combined Heat and Power Technical Assistance Partnership. It is 

recommended this technical assistance continue. 

To conclude, the tendency is to count the number of hurricanes 

and extreme weather events and make that the key climate metric. 

The numbers are increasing. There is uncertainty when exactly 

there’ll be a material increase, but that is largely irrelevant as the 

intensity of these storms increase. There’s considerable agreement 

by climate models that they will continue to do so. We are not prepared for this growing intensity. 

Natural disasters threats are real and now directly impact the 

operation of our grid. If we continue business as usual, systems 

will become more vulnerable, the economic and social—societal disruption cost will increase, and recovery will be less sustainable to 

growing demand on constrained resources. The technology and systems exist that are being deployed now to limit this risk. However, 

barriers exist with funding, regulations, and utility models that 

hinder deployment of these resilient systems. 

Thank you for the opportunity today. Sorry for going long. 

[The prepared statement of Dr. Dillingham follows:] 
117 

Testimony of: 

Gavin Dillingham, PhD Program Director at HARC 

On behalf of: 

HARC 

Before the: 

House Committee on Science, Space and Technology 

October 3, 2017 

HARC 

8801 Gosling Dr 

The Woodlands, TX 77381 
118 

Chairman Smith, Ranking Member Johnson, and members oft he committee, thank you for the 

opportunity to appear before you today. I am Gavin Dillingham, Program Director for Clean Energy 

Policy at HARC and I am pleased to provide testimony on the resilience of the United States' power 

infrastructure, particularly in respect to the risks posed by the increasing number of extreme weather 

events. 

HARC is a non-partisan research institute in The Woodlands, TX. We were founded by George Mitchell in 

1982. The organization was founded to conduct research and analysis that can be shared with 

communities to help with their decision making. Our researchers focus on areas of water quality and 

supply, air quality, ecosystem services, and energy, both clean energy deployment, as well as research 

to reduce the environmental impact and improve the health and safety of upstream oil and gas 

operations. HARC is an inter-disciplinary organization so many of us work across these disciplines to 

improve the resilience and adaptive capacity of our communities. 

I appreciate the opportunity to discuss the findings of Enhancing the Resilience of the Nation's Electricity 

System report. This report is very timely and important. It pushes forward the discussion that we must 

have to ensure a more resilient power system. A key area of interest for me is the discussion related to 

the increasing number and intensity of extreme weather and their current and future impact on national 

electric power system. These systems must be designed and constructed for a multitude of extreme 

weather events. To give you a Texas example, in recent years, Texas has experienced some pretty 

extreme weather patterns resulting in significant power outages and disruption to communities. 

First, there was the state wide drought in 2011 and 2012. This multi-year drought placed considerable 

pressure on power generation. Most power generation is dependent on water for cooling. During the 

drought there was either not enough water to cool the plants or water was too warm for cooling. 

During 2011, ERCOT, the organization that manages the Texas grid, was concerned about losing 

"potentially several thousand megawatts" ifthe drought did not end 1

• There were also plants during this 

time curtailing operation at night so they would have plenty of water to provide power during the day, 

as well as plants that were piping water from other sources to ensure they could operate. A recent 

paper by Argonne National Lab "Impact of Future Climate Variability on ERCOT Thermoelectric Power 

Generation" considered the drought implications for the ERCOT grid. The findings indicate that out to 

2030, unless we become less dependent on water, the Texas grid could face severe stress due to lack of 

water availability both in drought and non-drought scenarios, as well as derating ofthermoelectric 

plants due to high water temperatures'. This stress on the power system due to water supply is not 

limited to Texas. It is an issue particularly across the western United States. 

Most recently we have had to manage extreme flooding events, three five hundred year plus flood 

events in the last three years. The most recent being two weeks ago with the arrival of Hurricane 

Harvey. Harvey dumped about 27 trillion gallons of water along the Gulf Coast, about 86,000 

Astrodomes3 worth of water, and left close to one million utility customers without power. The other 

two floods were the Tax Day Flood of 2016 and the 2015 Memorial Day flood. The Memorial Day Flood 

1 https :/ /www. texastri b une .org/20 11/09/16/ d rough! -could-post-problems-texas-power -pi ants/ 2 http://www.ipd.anl.gov/anlpubs/2013/03/75723.pdf 

3 http://www .housto nchron icl e.com/1 ife/ a rticl e/H u rricane-H a rvey-by-the-n u m bers-12172 28 7. ph p 

1 
119 

flooded communities stretching from the Texas Hill Country to the Gulf Coast. Flooding can cause 

significant damage to transmission and distribution infrastructure, particularly substations. The potential 

long-term duration of floods can significantly delay the restoration of power to communities where 

substations and other power infrastructure are inaccessible. 

I would be remiss not to mention Hurricane Ike in 2008. Ike caused power losses for over 2.1 million 

customers in a service territory of 2.2 million people. Many ofthese customers did not have power for 

over two weeks'. This is a fairly small number when you consider the power outages from Hurricane 

Irma, at over 9 million and Hurricane Maria cutting power to nearly the entire island of Puerto Rico. 

Beyond droughts, hurricanes and floods, Texas also deals with on averages 146 tornadoes per year, 

more than any other state,5 and has had to deal with two of the largest fires in recent history, the 

Bastrop Fire in 2011, small in acreage but with a large price tag of $325 million' and the 2017 fire in the 

Texas panhandle which scorched 750 square miles. Not only did 2017 bring Harvey and the Panhandle 

fire, a large ice storm blew through the Texas Panhandle in January cutting power to 31,000 customers. 

This is just an example of one state that has had significant stress placed on its power system due to 

extreme natural disaster events. Similar stories of extreme weather events can be told across all states. 

The Department of Energy published a report in 2013, titled "US Energy Sector Vulnerabilities to Climate 

Change and Extreme Weather"' that goes into significant detail concerning the problems power systems 

have experienced and will experience due to extreme weather. 

The events listed above very much parallel the findings ofthe report. Natural disasters are increasing in 

number and intensity and this puts our existing grid at considerable risk. A problem faced by the power 

industry is that there is not just one type of natural disaster placing stress on the power system. There 

are multiple pending disasters. Further this does not include cyber or physical attacks to these system. 

The problem with all of these pending threats is that it is very difficult to determine the timing, the 

location and intensity ofthese events. With this level of uncertainty and when resources are limited, it is 

very challenging to make the appropriate investment decisions. 

My expertise is not with cyber or physical threats, I can only speak to natural disaster threats. Due to the 

multitude of natural disaster threats, we have seen the development and growth of what is called the 

adaptation gap. Due to uncertainty of timing and intensity of natural disaster events, decision making 

can be hampered. When decisions are not made, infrastructure is not built. When the natural disaster 

events occur our systems are not prepared. The result is significant damage and loss to our 

communities, environment and economy. Unfortunately, most of the US is largely in a reactive mode of 

loss recovery, rather than focusing on loss mitigation and resilience. This is not to say there are not 

some efforts underway, particularly on the east coast with the aftermath of Superstorm Sandy, but 

there is considerable work that still must be done. 

4 http://www. ch ron. com/business/ energy I article/ Outages-dwindling-a cross-Texas-but -m any-still-1216 5137. ph p 5 http:/ /www.ustornadoes.com/2016/04/06/annual-and-monthly-tornado-averages··across-the-united-states/ 6 https:/ /en. wikipedia.org/wiki/Bastrop _County_ Complex_Fire 7 https :/I energy .gov /sites/pro d/files/2013 /07 /12/20130710-E ne rgy-Sector-Vulnera biliti es-Report.pdf 

2 
120 

Uncertainty is the enemy of action. Fortunately, we are seeing the development and deployment of 

down scale regional climate models that can provide significantly improved information on the 

likelihood of future extreme weather events. Texas Tech University Climate Science Center is doing great 

work in developing down-scaled models that are being shared with key decision makers as they conduct 

resilience planning. Better visibility into future climate patterns will improve planning and decision 

making across all critical infrastructure, particularly our power generation systems. 

There are two key areas I would like to discuss a bit further. First, the potential lack of water supply 

available to existing and future power systems and one solution, microgrids and their current 

deployment. 

The NAP report suggests there will be an increased likelihood of water stress across the United States. 

This is due not only to drought, but increasing competing demands by communities, agriculture and 

industry. The ANL report mentioned above provides a nice explanation of water constraints. 

At present, the United States current power generation portfolio is highly water dependent; 

approximately 85% of power generation requires water to operate8• This does not include hydropower, 

rather this is water to cool coal, natural gas, and nuclear based power generation systems9 Fortunately, 

systems that do not require water to produce power are being actively deployed across the country, 

largely in the form of wind and solar generation systems and to a growing extent, battery storage, 

micro-grid and micro-grid combined heat and power (CHP) systems. However, to date, the speed to 

which these systems are being deployed does not look to significantly shift the grid away from water 

dependent power generation resources in the near future. This has been well illustrated in the 

Department of Energy's 2017 Annual Energy Outlook (AE0)10 Some argue the AEO is too conservativen 

and place projections of solar and wind at 35% oftotal installed capacity by 2050. Regardless of what 

projection you accept, both still have over 60% of the power system dependent on water. 

The highly anticipated DOE Grid Reliability which considered the impact of renewable energy on grid 

reliability finds that increased deployment of solar and wind does and will not negatively impact the 

operation of the grid. The technology and capability is available to quickly deploy these systems, 

unfortunately, policies and regulations do not. As with any infrastructure system a key issue is the 

availability of funding. Two key funding mechanisms that could increase the deployment of renewable 

energy is to allow renewables to participate in master limited partnerships, similar to fossil fuel assets. 

Second, accelerating the deployment of green bonds to fund renewable infrastructure. Although there 

has been a growing number of green bonds issued for green infrastructure, there is still some hesitancy 

due to what defines a green bond, what can be funded by these bonds and how they can be positioned 

in the financial markets. Two other key issues are the lack of interconnection standards across many 

states and an old-utility model that still largely cannot account for the benefits provided by distributed 

energy resources (DER). Granted, there are some utilities that are doing great work and actively working 

8 https://750astrodomes.com/2017/07/14/ electric-power-sector-you-have··a-water-problem/ 9 https ://www .eia .gov j outlooks/ a eo/ pdf/0383 ( 2017). pdf 10 https:/ /www.eia.gov/outlooks/aeo/pdf/0383(2017). pdf 

http ://theh i ll.com/blogs/ pun dits-blog/ energy-environ ment/3 2244 2 -the-trou ble-with-u nderesti mating-cleanenergy 

3 
121 

on valuing and deploying DER. However, the current patchwork of activity does not allow for a rapid 

deployment of DER and/or utility scale systems. Finally, federal and state policy makers should consider 

the development and deployment of power resilience standards such as PEER (Performance Excellence 

in Electricity Renewal). PEER is a rating process designed to measure and improve sustainable power 

system performance". Very similar to the LEED building rating program. PEER is a voluntary program 

that utilities and power providers can work toward. A PEER rated power system meets strict criteria for 

reliability and resilience, operational effectiveness and environmental standards. 

One final note onDER concerns the growing deployment of microgrids. These are mini-power systems 

for a building, campus, neighborhood, that typically have a variety of generation resources working 

together including a combined heat and power system, solar panels, and/or batteries. Microgrids and 

particularly microgrids with CHP are being considered more often to increase the resilience of critical 

infrastructure, such as hospitals, wastewater and water treatment plants, police and fire stations, data 

centers, emergency centers, etc. It is estimated that approximately 3.7 GW of microgrid systems will be 

deployed by 2020.13 Small in comparison to other resources, but a very important resource as we look 

for systems that are resilient and have demonstrated their efficacy through a wide number of natural 

disaster events. Microgrid CHP systems have on multiple occasions demonstrated their ability to stay 

online during and after significant natural disaster events14, with the most recent example being the 

new CHP system at the University of Texas Medical Branch in Galveston during Harvey. The deployment 

of these systems have seen a significant level of support from, the Department of Energy. The DOE has 

been actively working to increase the deployment of CHP through its Better Buildings Initiative 

Resiliency Accelerator15 and the Combined Heat and Power Technical Assistance Partnership15• It is 

recommended this technical assistance continue. 

To conclude, the tendency is to count the number of hurricanes and extreme weather events and make 

that a key climate metric. The numbers are increasing, there is uncertainty when exactly there will be a 

material increase, but that is largely irrelevant as the intensity of these storms increase, which they 

have. There is considerable agreement by the climate models that they will continue to do so17 We are 

not prepared for this growing intensity, much less an increasing number and intensity. 

Natural disaster threats are real and are now directly impacting the operation of our grid. If we continue 

business as usual, systems will become only more vulnerable. The economic and societal disruption 

costs will continue to increase and recovery will become less sustainable due to growing demand on 

constrained resources. The technology and systems exists that are being deployed now to limit this risk. 

However, significant barriers still exist, particularly funding, regulations and utility models that hinder 

the deployment of theses resilient systems. 

http:/ /peer.gbci.org/faq 13 https:/ /www.greentechmedia.com/articles/readlu-s-microgrid-growth-beats-analyst-estimates-revised-2020-

capacity-project 

14 htt ps :/ lwww 1. ee re .energy .gov I man ufa ctu ri ngl distributeden ergy I p dfs/ ch p _ critica l_faci liti es. pdf 

ht tps :/ /betterb ui ldingsso lutio ncenter. energy .gov I accelerators/ combined -heat -and-power -resiliency 16 https:// energy .gov I eerel a mo/ ch p-technica 1-assistan ce-pa rtnersh i ps-ch p-ta ps 

'' https:/lwww.gfdl.noaa.gov/globai-'YillilliDg-and-hurricane_:iL 

4 
122 

5 
123 

Gavin Hillingham, PhH Bio 

Dr. Gavin Dillingham is Program Director for Clean Energy Policy at HARC and Director of the 

US DOE's Southwest Combined Heat and Power TAP. Dr. Dillingham joined HARC in2012 

where he leads research and program efforts focusing on improving the climate resilience of the 

electric power infrastructure and built environment. 

Dr. Dillingham has worked in the clean energy industry for the last twenty years in both the 

private and public sector. Much of this work focused on climate action planning, greenhouse gas 

mitigation strategies and strategic energy management for large institutions and cities. 

His current work at HARC includes studying and developing climate risk mitigation strategies 

for the public and private sector, climate action decision making and planning. and clean energy 

tinance. Specific projects Dr. Dillingham is leading includes research on decision making in 

regards to the deployment of critical power in/1-astructnre across the United States; a study on the 

deployment of climate resilience standards for the built environment; and research on corporate 

operational decisions in regards to climate vulnerability and risk. 

Dr. Dillingham's programmatic activity includes directing the Department of Energy's 

Southwest Combined Heat and Power Technical Assistance Partnership which is tasked with 

improving community resilience and reducing energy waste through increased investment in 

CHP. He also leads HARC's efforts with the Texas State Energy Conservation Office which is 

working on improving energy data access and the deployment of PACE financing. 

Dr. Dillingham received his PhD in Political Science from Rice University in 2008 where he 

studied policy diffusion and adoption of natural resources policies across U.S. states. 

6 
124 

Gavin Dillingham, PhD 

Program Director, Clean Energy Policy and Director of DOE's Southwest CHP TAP at Houston 

Advanced Research Center (HARC) 

ga\'in.di!lingllam:~:gmail.com 

Summary 

Program Director for research institute focusing on climate adaptation with specific focus on investment in 

resilient power infrastructure and the adoption of clean energy policies at the local, state and federal leveL 

Highlights Include: 

-Expert in Electric Power Resilience- Lead the DOE's Southwest CliP Technical Assistance Partnership with 

the responsibility of increasing investment in combined heat and power (CHP) and micro grid applications 

across the region. The focus is largely on improving community resilience and reducing energy consumption 

by providing technical assistance to end-users, as well as conducting education and outreach to potential 

investors and policy makers. 

-Predictive Modeling and Quantitative Analysis- Conduct research developing predictive models with event 

history analysis to better understand state and city adoption of clean energy policies 

-Accomplished in grant research, writing, management and evaluation; securing and managing over $30 

million in grants in the past 8 years 

-Expert in City-level Clean Energy Policy and Sustainability Best practices- authored multiple best practice 

case studies for energy management for large and mid-sized Texas cities; Technical Advisor to the City of 

Houston for its City Energy Project, a joint project ofNRDC and IMT, which will work to develop energy 

efficiency policies for the city. 

-Lecturer at Rice University in Policy Studies Department teaching a class on public policy planning. 

Experience 

Program Director, Clean Energy Policy; Senior Research Scientist at Houston Advanced Research 

Center (HARC) 

January 2016 - Present 

HARC is a research hub providing independent analysis on energy, air, and water issues to people seeking 

scientific ans-wers. We arc fOcused on building a sustainable future that helps 

Page J 
125 

people thrive and nature Jlourish. 

- Lead research efforts focusing on policy adoption and innovation of clean energy policy at locaL state and 

national levels. 

Lead market analysis and program design efforts for utility incentive and rebate programs 

Conduct policy design and analysis for local and state clean energy programs. 

- Direct federal and state grant funded programs focusing on the identification of regulatory and policy 

barriers barriers to clean energy implementation. 

-Technical Advisor to local government - provide advice on clean energy policy development and design; 

conduct cost-benefit analysis and life-cycle cost analysis to assess policy feasibility. 

Director- Southwest CHP Technical Assistance Partnership at HARC 

October 2015 - Present 

Lead the Southwest CHP Technical Assistance Partnership at the J !ouston Advanced Research Center. 

The Center's mission is to improve community resilience and reduce energy consumption by promoting 

combined heat and power and microgrid applications through technical assistance and project qualification 

screenings. education and outreach to end-users and policy. 

Lecturer- Public Policy Planning- Adoption and Innovation 

January 2013 - Present 

Teaching a class on the public policy process with a specific focus on policy adoption and innovation using 

event history and survival analysis modeling. Presented a variety of key policy process topics including the 

advocacy coalition framework, punctuated equilibrium, net\\'ork analysis and policy ditTusion via economic 

competition and social learning. Discussed topics related to energy efficiency, climate change, oil and gas 

exploration and production, gun control, public health and public education. 

Research Scientist, Clean Energy Policy at Houston Advanced Research Center 

August 2012 - December 2015 ( 3 years 4 months) 

• Acting as Technical Advisor to the City of Houston for the City Energy Project~ lead effort in developing 

and deploying strategy to implement CEP program in Houston: identity best practices around proposed 

policies, determine applicability and feasibility for Houston and incorporate best practice intormation into 

outreach and education documents, as yvell as in policy language~ conduct data analysis regarding policy cost 

benefit, energy savings. emissions reductions, and economic impact to help with drafting policy~ provide 

technical assistance. editing and review for drafting of each policy; 

• Working SECO and SPEER on the City Efficiency Leaders Project; conduct research and analysis on best 

practices and lessons learned for public sector energy efficiency policies and initiatives; deYelop case studies 

based on research. 

• Lead efforts for SECO's DOE SEP 2013 grant award for removing barriers to combined heat and power 

and industrial energy efficiency: lead stakeholder engagement efforts and developing action plan with 

stakeholders to overcome barriers. 

Page 2 
126 

• Lead the development and drafting of the City of Houston's Sustainability Action Plan; the action plan 

provides a way forward for the City to reach is 50% GHG reduction goal by 2020. 

• Conduct research regarding the development of predictive models to better understand the diffusion and 

innovation of energy eflicicncy and rene\Yable energy policy across state and local governments; considering 

how networks, learning, competition and state characteristics a !Teet the adoption of policy; Assessment of 

existing micro-grid policies in±1uencing the deployment of CI IP, solar and storage in micro-grid setting 

Manager, Energy and Sustainability at Houston TSD 

November 2010 - July 2012 ( 1 year 8 momhs) 

-Lead the development ;md implementation of a 30 million square foot energy ef1iciency retrofit with an 

expected yearly energy savings of $12 million per year upon project completion; 

-Manage the procurement of electricity and natural gas contracts for 300 campuses; 

-Develop and deploy the Green School Challenge, A District wide behavioral change program to reduce 

energy and \Vater consumption at District campuses; 

-Implementing single stream recycling program for District, secured $300,000 in funding for program 

development: 

-Lead the development of renewable energy projects at District: secured grant for solar installation at Wilson 

Elementary SchooL 

Lecturer- Energy Efficiency Policy at Rice University 

August 2010 - December 201014 months) 

Taught public policy seminar related to energy efficiency and the built environment 

Director of Sustainable Growth 

Februmy 2009 - November 2010 (I year 9 months) 

Implemented a $75 million energy performance contracting project, resulting in over $6 million energy 

savings per year. The retrofit included City HalL the Hobby Center for Performing Arts, the City's Admin 

Building, Police lleadquarters, Courthouse, parks. libraries, health facilities and police stations; the project 

also jncluding a feasibility study to implement a district cooling/heating system for City administration 

facilities in Downtown Houston; 

-Participated in the feasibility study of a combined heat and power installation at two of the City's waste 

water treatment plants. This was a $30 million project that would install gas fired turbine generators on each 

site a11d utilize waste heat for sludge drying purposes; 

-Led energy ef1iciency, renewable energy and SLlstainability grant development writing e!Torts for City 

securing over $53 million in grants from the Department of Energy, State Energy Conservation Office and 

the Environmental Protection Agency; 

-Led Texas' largest weatherization assistance program;lcading a team to weatherize over 8,000 residence in 

Houston: 

-Led the development and publication of the City's emission reduction plan: 

-Assisted in the procurement of electricity contracts. 

Page 3 
127 

Senior Business Consultant 

June 2008 - February 2009 (8 months) 

-Conducted financial analysis to determine suitability of business life-cycle management (BLCM) solution 

for upstream oil and gas companies: 

-Built business case for Human Resource transfOrmation initiative at a $6B petroleum engineering and 

construction company; 

-Conduct research and analysis on the affect federal government policy has on upstream exploration and 

production behavior. 

Staff Analyst- Public Policy Land Use Planning at City of Houston 

January 2007 - May 2008 (I Year 4 months) 

-Acted as a liaison between city council members, the Mayor's office and the Planning and Dewlopment 

Department worked to establish etTeetivc policies pertaining to annexation, land development and extraterritorial jurisdiction issues: 

Workedjointly with Public Works" Public Utilities Division on analyzing the feasibility and applicability of 

municipal utility district (MUD) creation and MUD annexations; 

- Conducted legislative review and analysis for all Texas State Legislature bills concerning planning. land-use 

and economic development. 

PhD Candidate at Rice University 

August 2002 - January 2007 (4 years 5 months) 

-PhD student at Rice University in Political Science- Doctorate earned end ofJanuary 2007. 

-Conducted research on land usc public policy analysis, development and adoption: institutional effectiveness 

and civic participation in environmental issues 

-Taught classes in statistics and American Politics; 

·Project manager for a National Science Foundation grant studying the effects of I lurricane Katrina on 

evacuees from New Orleans. 

Environmental Specialist 

November J 998 - August 2002 (.1 years 9 mon\16) 

-Actively worked with Chief Environmental Officer to develop Enron's renewable energy position and policy 

strategy toward state and federal legislation. specifically focused on with greenhouse gas and air quality 

issues: 

Conducted analysis of alternative energy legislation and collaborated with energy traders to determine binfuel market plays and opportunities 

Participated in the development of the Enron Corp. greenhouse gas inventory utilizing the IPPC guidelines 

and global climate change policy; 

-Participated in the design, content and publication of company's Corporate Responsibility and Sustainability 

report following Ceres transparency guidelines; 

Page 4 
128 

Managed the design. development and implementation of Web-based environmental health and safety 

performance management system resulting in more efficient effective and accurate reporting by global 

assets. 

Education 

Rice University 

PhD, Political Science- Public Policy Adoption and Analysis. 2002- 2007 

Texas Tech University 

B.A, Psychology- Summa Cum Laude, 1995 - 1997 

Activities and Societies: Psi Chi, Treasurer; Golden Key International Honor Society; Research Assistant with 

Psychology Department; 

Honors and Awards 

Leadership in Action for EnvironmcntallmprovementEnergy Efficiency, Renewable Energy, Public Policy, 

Economic Development, Running, Cooking and Reading 

Page 5 
129 

Gavin Dillingham, PhD 

Program Director, Clean Energy Policy and Director of DOE's Southwest CHP TAP at Houston 

Advanced Research Center (HARC) 

gavin.di1linghmn(iTgmnil.com 

Contact Gavin on Linkedln 

Page 6 
130 

Chairman SMITH. Thank you, Dr. Dillingham. That is fine. 

Mr. Baum. 

TESTIMONY OF MR. WALT BAUM, 

EXECUTIVE DIRECTOR, 

TEXAS PUBLIC POWER ASSOCIATION 

Mr. BAUM. Thank you, Mr. Chairman, Ranking Member Veasey. 

I appreciate the opportunity to testify today. My name’s Walt 

Baum, and I’m the Executive Director of the Texas Public Power 

Association. TPPA represents the 72 municipally owned utilities in 

the State of Texas. We represent about 15 percent of the customers. In Texas you also have electric co-ops that serve another 

15 percent of the customers, and then the investor-owned utilities 

serve the rest. TPPA is also a proud member of American Public 

Power Association, APPA. 

I’m here today to talk about the real world—a real world example of a resilient grid and that is how ERCOT, the grid the serves 

most of Texas, recovered from Hurricane Harvey. I don’t have to 

tell any of you about the devastation that Hurricane Harvey 

caused. Many—all of you have seen it; many of you experienced it 

firsthand. It was an incredible storm that Dr. Dillingham talked 

about, all the water and wind that was dropped. It really was two 

different storms when it hit Texas. It was a wind event in the Corpus area where first made landfall as a category 4 hurricane, and 

a lot of transmission was damaged, but then, as it moved on to the 

coast and into the Houston and the Beaumont, Port Arthur areas, 

it became much more than just a rain event. And utilities there 

were dealing with flooded substations and other issues. 

In the Corpus area, AEP, the utility which serves the Corpus 

area, they alone had over 550 transmission structures that were 

damaged and 5,700 distribution poles that were hurt by the storm. 

And, as we said, then in the Houston and Beaumont and Port Arthur areas you had flooded substations. We actually had to bring 

in some temporary mobile substations to replace those flooded substations, which was—which is newer technology that probably 

wasn’t available 10, 15 years ago. We’re proud of that. 

It was a tough storm, but the story is largely good in Texas. 

There were about—right at about 1–1/2 million customers were affected but not at any time. Because of the way that the storm was 

very slow-moving, we never had more than about 300,000 customers out at any one time. And all customers were restored—96 

percent of the customers were restored within 14 days when the 

storm first made landfall. There were a few others that took a little 

bit longer to restore just because of flooding and high water. But 

as of—20 days after the storm originally made landfall, all customers who could take power were back and receiving power. And 

we’re really proud of that work and the tireless work of linemen 

and line workers to repair the grid. 

Reliability and resiliency are really closely intertwined concepts 

in the electric grid. Reliability is when you turn on that switch is— 

are the lights going to come on? And resiliency is when those lights 

don’t come—turn on when you flip that switch, how long does it 

take to get them back on. Our goal is always 100 percent reli-
131 

ability, but because we can’t prevent weather or other manmade 

emergencies, a reliable grid must have built-in resiliency. 

Every storm’s different and Harvey’s historic. And because I’m 

from Texas, this is where I’m contractually obligated to say this 

wasn’t our first rodeo. Utilities nationwide plan and coordinate to 

prepare for these types of events, and plans address how crews will 

be deployed and how information will be shared with customers 

and when to call for additional help. Grid resiliency is really part 

of day-to-day operations in the electric utility industry from going 

out and doing tree trimming and vegetation management to when 

you’re planning the grid, planning it with redundancy in mind, and 

grid operators and utilities with generation plan for reserve margins to make sure there’s ample power during our peak times, even 

if large generation units go off-line. Transmission and distribution 

systems are always designed with redundancy, and ERCOT actually conducts annual Black Start training which is done to simulate 

the total loss of our grid and bringing it back up from zero. 

Mutual aid is also a key important part of resiliency. Just as firefighters, police officers, and other emergency responders combine 

forces to help rebuild communities, line workers and other personnel do that as well. Crews from all across Texas and other areas 

of the country shared in our restoration efforts. Utilities that were 

most affected called in crews from other areas. In our systems, municipally owned utilities went to go help out the investor-owned 

utilities after getting there systems back online. CPS Energy sent 

crews to help AEP Texas and CenterPoint. And not just electric 

workers, they also sent IT personnel to help them get their networks back up and running. APPA, the American Public Power Association, has its own mutual aid network, and they coordinate 

with EEI, the investor-owned trade associations, and NRECA, the 

electric co-ops associations. 

During Harvey, we did daily calls with APPA to talk about how 

the municipally owned utilities were affected and then moved on 

to calls that DOE ran in which all of the different sectors of the 

electric industry got together to help. And similar coordination was 

in place for Irma. 

Once restoration was complete in Texas, we sent many crews to 

Florida and CPS Energy, Austin Energy, Denton, Garland and 

other Texas utilities were all out there helping Florida. And we 

have our own mutual assistance group in Texas as well to first respond to our different systems. 

While the story is positive, each event is also a way for individual utilities to learn and be better prepared for the next round 

of storms. Our new Public Utility Commission Chair had a hearing 

last week in which she identified several issues for the industry 

and government partners to work together to prepare for the next 

storm. My members’ Public Power utilities and the entire electric 

industry are committed to sharing information, technology crews, 

and equipment to continue to keep the lights on. 

I especially want to thank all the crews and personnel in our industry. The tireless work of the line workers and support staff behind them is truly inspirational. It’s also serious and dangerous 

business. Unfortunately, the industry lost a young lineman last 

month who is helping to restore power near Victoria. 
132 

Thank you very much for the opportunity to testify, and I’m 

happy to answer any questions. 

[The prepared statement of Mr. Baum follows:] 
133 

Testimony of 

Walt Baum 

Executive Director 

Texas Public Power Association 

Submitted to the 

HOUSE SCIENCE, SPACE AND TECHNOLOGY COMMIITEE 

for the October 3, 2017, Hearing 

"Resiliency: The Electric Grid's Only Hope" 

Chairman Smith, Ranking Member Bernice Johnson, and members of the Committee, thank you for 

inviting me to testify at the hearing today, "Resiliency: The Electric Grid's Only Hope." 

My name is Walt Baum. I am the Executive Director of the Texas Public Power Association (TPPA). TPPA 

represents the 72 municipally owned electric utilities (MOUs) in Texas, along with other public electric 

providers such as river authorities, joint action agencies and some electric cooperatives. MOUs serve 

more than 5.1 million Texans. TPPA is also a proud member of the American Public Power Association 

(APPA), the voice for not-for-profit, community-owned utilities that serve 49 million people in 2,000 

towns and cities nationwide. 

Hurricane Harvey Recovery Update 

I am here today to give a real world example of a resilient grid and how Texas electric utilities are 

recovering from Hurricane Harvey. 

I don't have to tell you about the devastation caused by Hurricane Harvey. Some of you have seen and 

experienced it firsthand. The combination of high winds, historic rainfall and torrential flooding led to 

over 1.5 million electric customers being temporarily affected by the storm. However, because it was 

such a slow storm that lasted several days the number of customers outages at any one given time was 

far less than 1.5 million, peaking at just over 300,000. Coastal utilities were primarily affected, but areas 

that were over 100 miles inland experienced 100 mph gusts leading to damage to electric distribution 

systems throughout the state. 

Fortunately, restoration efforts are complete for all customers who can take power. Within 14 days 

after the storm hit there were less than 30,000 customers without power. 
134 

The investor owned utilities that serve the majority of the coastal areas of Texas were most affected. 

AEP Texas serves the Corpus Christi and Victoria areas, where the storm first came onshore on the 

evening of Friday August 2S'h as a category 4 hurricane. They had 220,000 customers affected at the 

peak and restored power to 96% of them within 14 days. AEP brought in over 5600 resources from 

across the state and country. Crews are concentrated the largest effort in the Aransas Pass, Rockport, 

Victoria and Refugio areas, which were most devastated by the storm. AEP service territory had 549 

transmission structures and 5700 distribution poles downed or damaged. 

CenterPoint serves Houston and surrounding area. CenterPoint restored service to 1.27 million 

customers in about 10 days. Some of those outages were controlled in order to protect equipment (or 

for safety reasons). They did not suffer significant wind damage, but lost several substations due to 

flooding. A temporary mobile substation was constructed near a severely flooded substation to serve 

area distribution load while the permanent substation was repaired. CenterPoint brought in 1500 crews 

from 7 states to assist in restoration efforts. 

Entergy Texas serves the area east of Houston and the Beaumont/Port Arthur areas. They had 192,000 

customers affected by the storm. On September gth power has been restored to all other customers 

impacted by Hurricane Harvey except for customers served by flood damaged equipment and areas that 

are still flooded. Many customers experienced multiple outages as conditions changed from wind to 

rain to flooding. Temporary mobile substations were also brought in while severely damaged 

substations are rebuilt and repaired. 

TNMP (which serves several communities up and down the coast) restored power to almost 80,000 

customers, including 22,000 customers out during their peak. All customers were restored within 10 

days. They suffered no outages to their transmission system or industrial customers. The imported 

about 400 additional crews to help restore power. 

Electric cooperative members in Texas also worked tirelessly since September 25, when Hurricane 

Harvey made landfall. There were a total of 179,016 outages and they were down to less than 1,000 

outages within 10 days. Some of the biggest obstacles in getting folks turned back quickly included 

limited access due to high water and issues in East Texas with Entergy transmission. Co-op employees 

from across Texas assisted other co-ops hardest hit by the storm. 

Municipally owned systems did not suffer the worst impacts of the storm. Overall we had about 

160,000 customers affected, and had service restored to nearly everyone within three days. Robstown, 

which is located close to Corpus Christi, suffered wind damage but had crews out working on their lines 

the day after the storm passed and restored power to 95 percent of their customers within two days. 

Some East Texas systems lost power due to transmission outages in the area, but did not suffer large 

distribution damage. 

ERCOT 

ERCOT, the Electricity Reliability Council ofTexas, is the grid operator for most ofTexas affected by the 

storm. ERCOT's System Operations team worked 24/7 at ERCOT's System Control Center, which is built 
135 

to withstand hurricane-force winds, to monitor the situation and protect overall system reliability. Extra 

engineering staff supported their efforts throughout the storm. ERCOT sent out several operation 

notices to market participants before and during the storm and was in constant communication with 

transmission and generation owners regarding hurricane preparations. 

The ERCOT system experienced a number of transmission outages. Six 345 kV lines, ninety-one 139 kV 

lines and one hundred and thirty eight 69 kV lines were affected. Over 10,000 MWs of generation was 

also affected at some point, primarily due to floodwaters but also some due to transmission outages and 

some facilities that were impacted because they couldn't be reached by employees. ERCOT did instruct 

2 generation facilities to run under their "Reliability Unit Commitments" program to provide voltage 

support and system reliability. ERCOT did have sufficient generation resources available throughout the 

storm and recovery and did not have to shed load or import power. 

At the South Texas nuclear plant near Bay City, over 250 operators, engineers, maintenance and other 

support staff were stationed at the 2,700-megawatt plant throughout the storm. That plant continued 

to produce power safely at 100 percent capacity throughout the event. 

Electric Grid Resiliency 

The electric utility industry strives to maintain a reliable and resilient grid. A reliable grid is one where 

you can count on the light coming on when you flip the switch. A resilient grid is one that can bounce 

back quickly from an adverse event. They are closely intertwined concepts: a reliable grid is one with 

built- in resiliency. Our goal is one hundred percent reliability. But because we cannot prevent Acts of 

God or all manmade emergencies, a reliable grid must have built- in resiliency to allow for as quick as of 

recovery as possible. 

Every storm is different and Harvey was historic, but this is not the first storm to hit Texas. Electric 

utilities nationwide plan and coordinate to prepare, mitigate, and safely restore power in a wide variety 

of emergency events. Plans address how crews will be deployed, how information will be shared with 

customers, and when to call for additional help. 

Grid resiliency is part of day-to-day operations in our industry. Tree-trimming and vegetation 

management are part of normal utility operations. Our utilities are designed with redundancy in mind. 

Grid operators and utilities with power plants plan for reserve margins annually to ensure ample power 

during weather events or other grid emergencies. Transmission and distribution systems are designed 

with redundancy in mind. ERCOT conducts annual "blackstart" training which simiulates proper 

restoration of the ERCOT system in the event of a system wide black out. 

Mutual aid is an important component of resiliency. Just as firefighters, police officers, and other 

emergency responders combine forces to help rebuild communities devastated by natural disasters, 

lineworkers and other electric utility personnel come together in an emergency to turn the lights back 

on. Crews from all across Texas and other areas of the country have shared in the restoration efforts. 

The utilities that were most affected called in crews from around the country. After dealing with their 

outages CPS Energy, Austin Energy, New Braunfels and others went to go help other MOUs, and helped 
136 

out coops and IOUs as well. CPS Energy sent crews to help AEP Texas in the Victoria and Bloomington 

areas and in addition to over 50 lineworkers they also sent IT professionals to help with network and 

infrastructure work. Over 1500 mutual assistance crews from other parts of Texas as well as Louisiana, 

Mississippi, Missouri, Florida, Kansas, Alabama and Tennessee assisted CenterPoint in their recovery 

efforts. 

APPA has its own mutual aid network, which also coordinates with the Edison Electric Institute and the 

National Rural Electric Cooperative Association, the trade associations for investor-owned utilities and 

rural electric cooperatives, respectively. During Harvey, there were daily calls set up through APPA for 

MOUs in Texas and Louisiana to coordinate needs and recovery efforts. There were also daily calls run 

by the Department of Energy that APPA, EEl, NRECA, Nuclear Energy Institute the Department of 

Homeland Security, and others participated in to coordinate efforts between sectors and also CEO level 

calls hosted by Secretary Perry to discuss any specific needs. Similar coordination was in place for 

Hurricane Irma. Once restoration was complete in Texas, CPS Energy, Austin Energy, Denton, Garland 

and other Texas utilities sent crews to help Irma restoration efforts. 

Texas also has a Texas Mutual Assistance Group made up of the larger utilities that coordinate mutual 

aid agreements and efforts. Texas Public Utility Commission staff worked with the State Emergency 

Operations Center during the storm to provide a contact point for utilities and their needs. The Public 

Utility Commission also issued emergency orders after the storm giving the Executive Director discretion 

over disconnect, reconnect, billing estimation and customer disconnection rules. They also Retail 

Electric Providers to offer deferred payment plans for customers in affected areas. 

While the story is largely positive, each event is also a way for individual utilities to learn and be better 

prepared for the next round of emergency conditions. The new Public Utility Commission Chair held a 

meeting on September 28'" and identified several issues for industry and government partners to 

review. 

My members, public power utilities, and the entire electricity industry are committed to sharing 

information, technology, crews, and equipment to continue to keep the lights on. I especially want to 

thank all of the crews and personnel in our industry. The tireless work of the lineworkers and the 

support staff behind them is truly inspirational. But this is a serious and dangerous business; 

unfortunately the industry lost a young lineman last month when he was working to restore power near 

Victoria, TX. 

Thank you for the opportunity to testify. I'm happy to answer any questions you may have. 
137 

WALTBAUM 

Executive Director 

Texas Public Power Association (TPPA} 

Wolt Baum is the Executive Director of the Texas Public Power Association (TPPA). 

Texas Public Power Association represents the interests of public power providers in the 

state of Texas Including the municipally owned electric utilities, river authorities, joint 

action agencies} and some electric cooperatives. The 72 municipally owned electric 

utilities in Texas provide power to more than 4 million Texans over same 1.8 million 

meters. As a spokesperson and advocate he serves as the voice of the Public Power 

industry in Texas. 

Willt has over 20 years of experience managing the Interactions between State 

Government and the electric power industry and has lead teams in the passage of 

multiple pieces of legislation that have defined the Texas electric market. Prior to TPPA 

Walt served as the Executive Vice President of the Association of Electric Companies 

Texas (AECT) and as Chief Clerk of the Texas House of Representatives State Affairs 

Committee. 

A native of Amarillo, Walt holds a BA in Economics from Austin College in Sherman, TJ(. 

He ls a member of the Advisory Committee of the Amerlcan Public Power Association 

and serves on the Board of Directors of the Association of Women in Energy. 

~hihn_g Addres5": PO Bos 8276R Au~tin, TX ?H70HPhrsical A.ddress: 701 Bn1zos, Suitt' -i95 Austin, TX 7k70l 

512~ '172-5965 phone / .512~472-5967 f~1x 

www.tppa.cmn 
138 

Chairman SMITH. Thank you, Mr. Baum. 

Thank you all for your testimony, and I’ll recognize myself for 

five minutes for questions. And let me direct my first question, Dr. 

Sanders, to you. 

You will be challenged, by the way, to give a brief answer to my 

question, which is what are the short-term and long-term steps 

that need to be taken to protect the electric grid from cyber attacks? 

Dr. SANDERS. You’re right. Professors are not known for being 

brief, but I’ll do my best. 

Chairman SMITH. Okay. And if you have to pick, choose the 

short-term as opposed to long-term. 

Dr. SANDERS. Okay. 

Chairman SMITH. Yes. 

Dr. SANDERS. So, first, let me say that there’s a large effort underway today much different than there was at the turn of the century to protect the grid against cyber attacks. Since the early 2000s 

the Department of Energy, the National Science Foundation, the 

National Labs, and others have been working in this area, and substantial progress has been made. So, in a sense, what needs to be 

done and I think what we are doing is taking a concerted approach 

where industry, government, and academia come together to work 

on this problem. 

Many ideas, technical ideas and technical solutions, have been 

developed, and a short-term challenge and maybe the most important short-term challenge is to find ways within the very multifaceted landscape that includes regulation, that includes issues 

with cost, that includes States and Federal Governments to find 

ways to implement those solutions. We’ve made substantial 

progress there, but there are many things that still have been developed that need to be implemented to make our grid secure. 

Chairman SMITH. Okay. Thank you, Dr. Sanders. 

And, Mr. Imhoff, what can the government do to encourage innovation that will promote resiliency? 

Mr. IMHOFF. Another short answer. I think the key is to provide 

leadership, to encourage the combination of fundamental advances 

in mathematics, in control theory, and data analytics and advanced 

computing and link those closely with industry through bodies such 

as NERC, the Electric Subsector Coordinating Council, which is a 

strong government industry body, work with NRECA and APPA 

and others to help move those fundamental advances to practice 

and implementation within industry. Step one would be field validation. Most of those are cost-shared. I think most industry members would argue that they’ve been very productive. So I think 

from the federal standpoint, leadership to help drive forward the 

fundamental knowledge to help us innovate and stay in front of the 

wave is a fundamental contribution. 

Chairman SMITH. Okay. Thank you, Mr. Imhoff. 

And, Mr. Baum, in what way does the Texas electric grid—in 

what way does it differ from other grids and why? 

Mr. BAUM. Well, the Texas electric grid is—we talk a lot about— 

you know, Texas is very different and Texas has its own grid. 

ERCOT covers 85 percent of the area of the State and about 90 

percent of the load. It doesn’t cover the entire State. Areas in the 
139 

Panhandle and the corners of Texas aren’t part of the grid, but we 

are our own grid. Power that is generated in Texas largely stays 

in Texas. Of about 70,000 possible megawatts of generation, at any 

time we can only import or export under 1,000 megawatts. So, you 

know, we truly—we’re—I like to say that Texas is an island a lot 

in electricity. That sounds a little calloused now with what’s going 

on with Puerto Rico, but we pretty much are on our own, and so, 

you know, that—we are different from the rest of the country in 

terms of that goes. 

Chairman SMITH. Okay. But in positive ways that you just mentioned because the coverage and so forth. Okay. 

Mr. BAUM. Yes. 

Chairman SMITH. Thank you, Mr. Baum. 

Dr. Sanders, one last question for you. Would we benefit from 

simplifying our structure having fewer government agencies and 

departments involved? I guess it depends on how you simplify, but 

do you think that’s a direction we should go? And I think that’s one 

of your recommendations anyway. 

Dr. SANDERS. So the committee report was neutral on the actual 

government structure to be used. The committee felt very strongly 

that this is a complicated issue, that there are different issues, for 

example, the interaction between DHS and DOE that are working 

well, and—but these need to be correlated. 

Chairman SMITH. Okay. Thank you, Dr. Sanders. And that concludes my time, and the gentleman from Texas, Mr. Veasey, is recognized for his questions. 

Mr. VEASEY. Thank you, Mr. Chairman. 

I wanted to ask Dr. Dillingham a couple of questions particularly 

as it relates to climate change and rising global temperatures. I 

know that there are a lot of people including oftentimes on this 

committee we hear that—we don’t know human involvement as it 

relates to climate change or some people that outright deny that 

climate change is happening even though there’s a lot of consensus 

within the scientific community that there is some manmade contributions as it relates to climate change. 

And I wanted to ask you, as we consider potential infrastructure 

investments, do you think that States and utilities should consider 

climate change as it relates to the resiliency of the systems? 

Dr. DILLINGHAM. Yes, thank you for that question. Yes. And 

what we seem to find is that when we talk about climate change, 

there’s usually like a specific type of event that’s pointed to like 

hurricanes or to floods or just one particular type of weather phenomenon. And when you look at climate change, there’s a significant number of weather phenomena that are happening here for 

what I mentioned, from drought to floods to hurricanes to ice 

storms, and all of these are events that are becoming more intense 

and more extreme. And the—you know, we’ve seen that actually 

personally, and we’ve also seen that within the future climate models that are being deployed. 

One of the things that, you know, needs to be considered and 

we’ve been discussing this a lot more at HARC and across the 

State is, you know, now that these climate models, the downscaled 

regional climate models are becoming a lot more accurate in understanding the intensity and likelihood of these events happening. It 
140 

needs to be at least part of the conversation here. We have projections for—in ERCOT, for example the amount of solar and wind 

that are going to be deployed. That does not take into—that takes 

into account historical weather patterns but that does not take into 

account future weather patterns or future weather phenomena. 

And so if we have models that were getting greater—we’re feeling 

more comfortable with and feel like they have better accuracy, it 

is important that we start including those within our projections 

and understanding on how the grids operate for the future so we 

can start developing in that regard. 

Mr. VEASEY. Well, thank you very much. That sounds reasonable. What about insurance companies? Do you think that they 

need to consider changing environmental factors when engaging 

with potential clients? 

Dr. DILLINGHAM. The insurance companies are way ahead of us 

on this. They already are doing this. They have their catastrophe 

models and now they’re bringing in the downscaled climate models. 

And many of their decisions now are based on potential future climate factors that they’re looking into and what’s the risk of us 

funding this infrastructure into the future. And so what you’re seeing now is actually development of resilience bonds that are actually being coupled with catastrophe bonds. And these resilience 

bonds are largely put in place by the insurance companies to mitigate risk. The Brookings Institute had a nice report on this a couple years ago discussing the opportunity to bring the—in resilience 

bonds into the market to bring in another kind of funding source 

essentially, bring in the financial market to help better develop 

more resilient infrastructure. And so the insurance companies are 

way ahead in this regard. 

Mr. VEASEY. This is again for you, Dr. Dillingham, and Walt. As 

you know, Hurricane Harvey was not the first hurricane to damage 

Texas and won’t be the last. This is, you know, something that 

we’ve had experience with and will continue to have experience 

with. One—and communities are trying to look for ways they can 

harden their infrastructure to deal with future catastrophes. One 

notable example in Houston is the wall that was built after 

Hurricaine Allison to protect the substation that provides power to 

the medical center. 

I wanted to ask you how have communities adapted to the 

changing conditions that we are experiencing as a result of climate 

change? 

Dr. DILLINGHAM. There has been—I’ll just speak specific to the 

Houston region. There has been some significant activity or growing activity in this regard. UTMB Galveston is an example that 

was flooded out during Hurricane Ike. They had to essentially close 

that down, and there was questions whether or not it’d even become operational again. 

But what they’ve done since then is they’ve put in a combined 

heat and power system, which is an onsite natural gas-generated 

system that operated great during Hurricane Harvey. They also 

built that above grade. It’s up on the second floor, so it prevents 

floodwaters from getting in there and they also build a flood wall 

around it. So there’s steps happening especially within critical infrastructure, hospitals particularly, wastewater treatment plants 
141 

that are going into place, and a lot of it is focused on distributed 

generation and—which is typically a combined heat and power type 

system being put in place. 

As far as just in the community in general when you look at the 

parts of the community that have started taking action to be more 

resilient—so Meyerland is a neighborhood in Houston that has 

flooded multiple times. The homes that are starting to build above 

grade, the homes that are taking these—you know, starting to put 

in these resilience standards to make sure that they’re above 

grade, none of those flooded. So—and they’re—and those homes are 

in good shape. 

And so it’s a matter of starting to put in place these voluntary 

resilience standards, educating communities, educating project developers, engineers, architects to understand what is the way to 

start building more—in a more resilient fashion but do it in a costeffective manner. You can’t do it in Texas if you’re going to mandate regulations, and you’re not going to do it if it’s expensive. We 

built ourselves on low cost of business and low cost of living. 

And so what the important piece is is how do you implement this 

stuff and how do you build capacity within our building community 

to allow them to do this in a cost-effective way? 

Mr. VEASEY. Thank you. Thank you, Mr. Chairman. 

Chairman SMITH. Thank you, Mr. Veasey. 

And the gentleman from California, Mr. Rohrabacher, is recognized for questions. 

Mr. ROHRABACHER. Thank you very much, Mr. Chairman, and 

thank you, Mr. Chairman, for holding this hearing today. And it 

is something I just think that we have not given serious attention 

to this. I know we’ve had several Members over the years who have 

made it their crusade to talk to us about EMP and other threats, 

but it just—nothing seems to be—get done and there doesn’t seem 

to be a national strategy that actually coincides with how vital this 

could be to the well-being of the American people. 

If we have something go crazy with the sun, I understand it 

could knock out all of our grid. I mean, you’d knock out 75 percent 

of the people’s electricity in the United States of America. I mean, 

this is a tremendous threat that—and again, we’re talking today 

about reliability and resilience. 

Let me talk to you about some real specifics rather than having 

the experts get together and talk about it, all right? What about 

a more diversified power system that we would then target that 

would be a much more diversified power source for the American 

people? Would that be a major step towards dealing with this potential threat? Anybody want to say anything about that? 

Dr. SANDERS. You can go first. I’ll go second. 

Mr. IMHOFF. Thank you for the question, and I think that diversity, whether it’s in diversity of fuel mix, diversity of generation 

and other things provides resilience and robustness to the system. 

Mr. ROHRABACHER. Well—— 

Mr. IMHOFF. And from the standpoint of EMP and space weather 

or—— 

Mr. ROHRABACHER. Right. 

Mr. IMHOFF. —geomagnetic activities, there are differences. The 

higher risk is at the further northern latitudes and the southern 
142 

latitudes. I think the good news, sir, is that over the last year, both 

DOE has put in place an initial program plan dealing with the 

space weather issues. The Electric Power Research Institute has 

actually begun working on standards and operational approaches 

for component purchase and installation that would begin to deal 

with these issues. NERC has actually set two standards that are 

the beginning of a journey that would help utilities better plan for 

and defend and operate through these storm events. 

Mr. ROHRABACHER. Well, let me get real clear on this. We now 

depend on big, huge electric plants, and it seems to me that we 

could have, for example—let me ask you whether this would have 

been one solution—if we would have determined 20 years ago or 30 

years ago that we’re going to build small modular nuclear reactors 

which are now we are told we are very capable—have been capable 

of building, would that in some—would that type of diversification 

help us solve this or deal with this issue? 

Mr. IMHOFF. So I think diversity, regardless of the type, regardless of whether it’s natural gas or nuclear, can provide some resilience, but any device is going to be—has some risk in terms of electromagnetic fields. They would need to have—— 

Mr. ROHRABACHER. Right. 

Mr. IMHOFF. —the protection, the shielding, et cetera, on critical 

components regardless of the type of generation. So nuclear itself 

is not more or less robust. 

Mr. ROHRABACHER. So—but if we—so we have smaller nuclear 

power plants in various communities, for example, which I understand we’re capable of doing in very—which are, by the way, safer 

from what I understand than light-water reactors, that that would 

not protect—give us more protection than to have it in one major 

power plant? 

Dr. SANDERS. So let me follow up a bit on this. As Mr. Imhoff 

said, diversity in the source of generation, both in the type and in 

the geographical distribution of the generation, can be helpful. 

With regard to the kind of solar events that you talk about, the 

same issues, whether we’re diversified or—to different degrees or 

not will apply with regard to the resiliency of the transmission and 

distribution system of the overall grid. There are very interesting 

strategies that are talked about in the report. These include 

microgrids. These include—— 

Mr. ROHRABACHER. Right. Let me ask you this. Would it be easier to fix if you’ve got a major source versus many smaller sources, 

a big nuclear power plant versus small modular nuclear power 

plants? No? 

Dr. SANDERS. I’m not an expert enough to know that. 

Mr. IMHOFF. I can’t speak to that either, sir. 

Mr. ROHRABACHER. Okay. Well, let me just note that we also 

have solar panels that—you know, would that be affected as well, 

if a house—you go down right to the greatest diversification which 

is individual homes, would this be more resilient and have more 

protection? 

Mr. IMHOFF. I can’t speak to the inherent robustness of solar 

panels themselves per se, and I don’t think the outcome is to move 

to completely distributed energy. There are some values of some of 

the large centralized plants as well, so I think it’s really an issue 
143 

at each region, at each electrical region, whether it’s Texas or the 

Western Coordinating Council or the Southeast, they need to look 

at their fuel diversity, they need to look at their prices, they need 

to look at their vulnerability to things like geomagnetic storms and 

figure out what’s that right balance between centralized and decentralized activities. 

The one challenge, sir, what’s changing at the edge in terms of 

today’s grid is there’s an explosion of new devices and new services 

and new innovations coming at the edge, many of which are outside the boundary of the utilities. Microsoft is providing its own 

power. Walmart is generating its own renewables on rooftops in 

their stores all around the country, so these are dramatic shifts in 

how we plan the system, as opposed to how we did it 20 and 30 

years ago, so I think it’s regional and local. I think they each need 

to figure out what’s the right balance of distributed versus centralized generation and supply, and that’s part of what I think is so 

important about regional planning activities across the country, 

doing what makes sense for them locally. 

Mr. ROHRABACHER. Okay. Thank you very much. 

Chairman SMITH. Thank you, Mr. Rohrabacher. 

The gentleman from California, Mr. Takano, is recognized. 

Mr. TAKANO. Thank you, Mr. Chairman. 

On Friday, the Secretary of Energy submitted a proposed rule to 

the Federal Energy Regulation Commission, otherwise known as 

FERC, with the explicit purpose of adjusting market rules to favor 

coal and nuclear power plants. The justification that they provided 

was for—for this was that these sources have several weeks of fuel 

onsite and therefore are inherently more resilient than natural gas 

or renewable energy generators. 

However, this assertion, along with the overall proposal, has received widespread criticism not only from the renewable and natural gas industries but from respected independent and even conservative experts on power markets. For example, Utility Dive just 

published a point-by-point refutation of this misguided effort by 

Alison Silverstein, who is the lead author—who is lead author that 

DOE hired to draft the grid report that the agency used to justify 

the new proposal. 

The conservative R Street Institute also released a thorough 

analysis on Sunday, which concluded that this proposal is, quote, 

‘‘an arbitrary backdoor subsidy to coal and nuclear power plants 

that risks undermining electrical competition throughout the 

United States, end quote’’. And Nora Mead Brownell, a former Republican FERC commission said in an Energy & Environment 

News article posted yesterday that she, quote, ‘‘has never seen a 

credible argument, not one, that there is a problem with resiliency 

and reliability,’’ end quote, due to coal and nuclear power plant retirements. 

On the contrary, a story published in E&E News on Friday titled, quote, ‘‘Flooded Texas Coal Piles Dampen Reliability Arguments,’’ end quote, is—and it’s a clear example of how poorly justified this proposed rule really is. 

Now, each—gentlemen, I need to get through—I want to get to 

several questions. Do you think subsidizing the coal industry is an 
144 

efficient and cost-effective way to make the grid more resilient? I 

would prefer a yes or no answer. 

Dr. SANDERS. So I think, first and foremost, we have to remember that resiliency is a system issue. No single source of generation 

can determine the resiliency of the grid. It depends on having 

enough generation in a distributed fashion, having the transmission and distribution infrastructure to deliver the power to the 

consumer—— 

Mr. TAKANO. Excuse me, Mr. Sanders, I’ve got to get through—— 

Dr. SANDERS. Okay. 

Mr. TAKANO. —a few questions. Can you kind of give me a yes 

or no, I mean, as far as—I mean, my question is pretty simple. Do 

you think subsidizing the coal industry is an efficient and cost-effective way to make the grid more resilient knowing all we know 

about coal and competition—— 

Dr. SANDERS. Right. Right. The report did not find that to be 

true. 

Mr. TAKANO. Okay. Thank you. Mr. Imhoff? 

Mr. IMHOFF. So, just quickly, resilience is a system activity, and 

what I think is more important is what are those plans replaced 

with? If they’re replaced with combined-cycle natural gas or other 

things, those have equal and sometimes better resilience capabilities than the coal plant. I am not a markets person, so I can’t really speak to the issue of subsidy. 

Mr. TAKANO. All right. Thank you. Dr. Dillingham? 

Dr. DILLINGHAM. I would have to answer no. Being from the 

State of Texas, we’re not a big fan of subsidies and especially in 

this case. 

Mr. TAKANO. Thank you. Thank you for that. Mr. Baum? 

Mr. BAUM. The key, as has been mentioned is, you know, multiple fuel sources and redundancy on the grid, but I don’t think any 

special subsidies is needed. 

Mr. TAKANO. So subsidizing coal industry is not an efficient and 

cost-effective way to make the grid more resilient? Probably not? 

Would that be fair to say, Dr. Baum? 

Mr. BAUM. Probably not. 

Mr. TAKANO. Okay. Thank you. Thank you. Mr. Imhoff, in your 

testimony you discuss how energy storage could provide more flexibility in how operators might mitigate cyber outage and improve 

recovery. Can you expand more in the specifics about energy storage is able to accomplish such a task? 

Mr. IMHOFF. Yes, thank you, Mr. Takano, and thank you for your 

leadership on the advanced battery grid caucus. 

Mr. TAKANO. You’re welcome. 

Mr. IMHOFF. The issue around energy storage is it fundamentally 

decouples supply from demand. It’s like a shock absorber for your 

truck that you drive down your ranch road. The shock absorbers 

help smooth it out and enable you to keep from spilling the coffee 

in your lap. Energy storage will help decouple supply from demand, 

and what that adds to the grid is flexibility. So if there’s a cyber 

attack that takes out a certain substation or certain supply 

sources, having that added flexibility in terms of energy storage 

linked with advanced control and power electronics that are smart 

power electronics give the operator more degrees of freedom for 
145 

how they steer around that problem. So that’s the role it will play, 

adding more flexibility to the system to respond to an outage. 

Mr. TAKANO. Well, and it’s also energy-source neutral, so if we 

found—in the case of Mr. Rohrabacher—small nuclear power 

plants were more efficient than gas—than the gas-powered plants, 

I mean, this still would be a tremendous addition to the resilience 

of the system. 

Mr. IMHOFF. It is source-neutral, correct. 

Mr. TAKANO. Thank you, Mr. Chairman. I yield back. 

Chairman SMITH. Thank you, Mr. Takano. 

The gentleman from Florida, Mr. Posey, is recognized. 

Mr. POSEY. Thank you very much, Mr. Chairman, and thank you, 

gentlemen, for appearing today. 

Have any of you read the book One Second After? It’s a novel by 

William Forstchen. It was a New York Times bestseller. Well, it 

was obviously written from a report about the EMP, electromagnetic pulse, threat our nation faces, and if you’re in the energy 

business, I would really recommend the book to you to read. 

A little over a year ago, the Earth’s orbit missed by about one 

week a solar eruption which seems would have taken out all our 

satellite communications and probably destroyed our power grid. 

My question to you is what you think we should be doing to protect 

our citizens against that threat? About 60 seconds each would be 

appreciated with Dr. Sanders first. 

Dr. SANDERS. So, first, let me say that I am not personally an 

expert on this topic, but we did have expertise on our committee 

and I’ve—on this matter Tom Overbye from the University of—or 

from Texas A&M University is an expert on this topic. I talked 

with him about this issue, and this is an issue of intense research. 

This is an issue of intense study, and there are solutions that are 

beginning to emerge but they’re in the early stages. They include 

raising awareness to the potentially severe impacts of GMDs. 

There is software now to plan for the impacts of GMD on systems, 

and people are using that to do studies. 

We’re at the stage really where engineers are getting down to 

looking at what the real issues are. There are magnetometers that 

are being installed across the country to measure these kinds of 

disturbances. In fact, the University of Illinois has one on some 

land that my department owns right off site. And research is ongoing with groups like NERC and EPRI helping in this effort. 

So in summary, we don’t have all the solutions we need now, but 

progress is being made. 

Mr. POSEY. Thank you, sir. 

Mr. IMHOFF. To follow up, nor am I an expert but I will say the 

following. We have a number of disparate activities in the country 

related to electric magnetic pulse. We have a spread of tools, but 

what we don’t have is an integrated toolset, nor do we have a common reflection across the three different waveforms, E1, E2, and 

E3, and we need to get to that so that we can provide guidance to 

industry to—for them to better shield and protect the new devices 

that are being produced for the grid for which we are modernizing 

and investing heavily each year. 

So there is work underway. There are coordinating groups trying 

to drive that, but I think we need a more focused national effort 
146 

to move towards a common set of integrated tools that reflect all 

three of those E1, E2, E3 waveforms. And the challenge is—and 

some of the solutions for geomagnetic sometimes might interfere or 

confound the solutions for the EMP waveform, so that’s why we 

need this integrative view of the waveform so we can get a common 

voice to industry on how to design around this issue. 

Mr. POSEY. Thank you. 

Dr. DILLINGHAM. I would have to say Dr. Sanders and Mr. Imhoff 

are the experts here, and they did a good job in as far as explaining 

stuff. I learned something there, but I cannot speak to this issue. 

Mr. BAUM. And I would say, you know, this is an issue that is 

being studied right now. EPRI, the Electric Power Research Institute, is conducting a multiyear study on this where they are also 

releasing what they find every few months and all different types 

of utilities, investor-owned, municipally owned, co-ops are participating in that EPRI report. 

I know there are—my feeling is the first thing we need to do is 

study and figure out what if any technical changes needs to be 

made to the grid, but I think you need to do the study and research 

first. There are people out there saying we’ve got this quick fix that 

if you buy this type of Faraday cage or this type of new equipment, 

you know, then you’ll fix your problem, but I think you need—I 

think we need more study first and then decide what if any new 

equipment needs to be made. 

Mr. POSEY. Thank you. Which agency do you see having taken 

the lead in this or do you think should be taking a lead in it? We’ve 

had hearings on this before, and I found the industry had very little interest in this. 

Mr. IMHOFF. So, my understanding is a group called the Mission 

Executive Council is actually working on this, and I believe that 

that council has represented some Department of Energy and from 

the Department of Defense and other agencies that are linked to 

the satellite systems, et cetera. So I would start with Mission Executive Council. I don’t know a lot about them, but I believe there 

already is some coordination across the key involved agencies. 

Mr. POSEY. Okay. Thank you, Mr. Chairman. I see my time is 

expired. 

Chairman SMITH. Okay. Thank you, Mr. Posey. 

The gentleman from New York, Mr. Tonko, is recognized. 

Mr. TONKO. Thank you, Mr. Chair, and thank you to our witnesses for being here today. Obviously, this hearing was rescheduled due to the recent natural disasters. In light of those disasters, 

I believe it’s an appropriate time for this committee to consider 

how to strengthen our grid. I would hope as we invest in the comeback for all the States that have been impacted by these natural 

disasters and also areas like Puerto Rico, the Virgin Islands, and 

the various territories, I would hope we build a grid of the future. 

We’ve learned many lessons from Mother Nature. Following the 

devastation from major disasters, people begin to think and plan 

for all possibilities. In New York, the REV initiative, borne by the 

New York State Public Service Commission, came in the aftermath 

of Superstorm Sandy. It was inspired by Superstorm Sandy. That 

disaster showed the value of distributed generation and encouraged 
147 

the State to invest in microgrid R&D and consider barriers to deployment. 

So, Dr. Dillingham, you mentioned microgrids paired with combined heat and power systems. Can you describe the value these 

systems add to our grid system in general? 

Dr. DILLINGHAM. Yes, absolutely. So, a microgrid system with 

combined heat and power is typically a natural gas-based system, 

and so what these combined heat and power systems do is they 

produce power onsite and then also provide thermal services if it’s 

for hospital sterilization, domestic hot water, steam for industry 

manufacturing, and such. 

And so what we typically find is that the natural gas infrastructure is significantly—can be significantly more robust than a transmission distribution infrastructure. It seems to withstand a lot of 

the severe weather events. And so what we’re seeing now is a 

greater deployment of these CHB microgrid systems particularly in 

the hospitals—in Texas and in kind of most of our region in hospitals, wastewater treatment plants, first responder-type facilities, 

data centers, and you’re seeing a greater growing of flexibility in 

application of these. 

At one point, combined heat and power was largely seen as kind 

of an industrial type of approach. Now, you can get them down to 

very small even residential size to build even community microgrid 

systems. And in many cases these are fairly diverse systems to 

where you have maybe the CHP or a natural gas generator as your 

base system, and then you have solar and batteries there as well, 

so you have an additional—other types of generation components. 

But it’s largely, you know, a system that allows you to potentially island from the grid so if the power does go down, you would 

want to island from the grid. And if you do have that, you also 

need to have Black Start capability, so there’s plenty of other types 

of components that go into a more resilient type microgrid system 

there that have been demonstrated and proven to work time and 

time again. And it adds to the diversity that we’ve been talking 

about of a power system. 

Mr. TONKO. Okay. Thank you. I would add that school systems 

where you might have a swimming pool as part of the phys. ed. infrastructure are also opportune—— 

Dr. DILLINGHAM. Right. And filters are used quite a bit for—or 

high schools, schools use them quite a bit for shelters as a last resort, and that’s a very good application for that. 

Mr. TONKO. Absolutely. How important is federal funding for the 

development of these systems? 

Dr. DILLINGHAM. At this point, it’s a fairly mature system as far 

as the combined heat and power piece goes here. These have been 

around for quite a while. The diversity of applications now, most 

of the issues we find is there’s just a lack of knowledge as far as 

how these systems can be used beyond, say, a gas refinery or beyond a natural gas processing plant, and how do we move this into 

a diversity of other groups. 

And so most of the work that we do has to do with kind of educating and kind of capacity-building among those that have not had 

a lot of experience with this. It’s like when you talk with someone 

about solar and they still think it’s, you know, $5 a watt, and right 
148 

now, it’s down to 60 cents a watt. People still think the economics 

are not there, but they are now, and so you just need that education piece of that, as well as some early technical assistance. 

Now, as far as microgrids in general, you know, there’s still some 

significant work that can be done especially when you look at the 

communication devices, the sensors, how these are coupled together, how to do the appropriate optimization models. You know, 

there’s some—still some significant work that needs to be supported at the R&D level, but the basic component of like a CHP, 

combined heat and power system is largely there and just needs to 

continue to be built out. 

Mr. TONKO. Thank you. The National Academies of Science’s 

July report on resiliency suggested that distributed energy resources, and I quote, ‘‘may help avoid or defer the need for new 

generation transmission or distribution infrastructure to address 

congestion localized, reliability, or resilience issues.’’ So, Dr. Sanders, if integrated properly, can distributed generation contribute to 

making a resource generation mix more resilient? 

Dr. SANDERS. To give you a simple answer, yes. We believe that 

putting together distributed generation sources, together with an 

appropriately engineered grid, can add to resiliency. 

Mr. TONKO. And if we include other investments such as storage 

and microgrids, does that offer new opportunity? 

Dr. SANDERS. Definitely, they are all possibilities. It’s hard to 

predict the future, and in one of the chapters, we talk about various features and how the grid would have to adapt to those futures, but they’re all things that could be part of the mix. 

Mr. TONKO. Thank you. Mr. Chair, I yield. 

Chairman SMITH. Thank you, Mr. Tonko. 

The gentleman from Texas, Mr. Weber, is recognized for questions. 

Mr. WEBER. [Presiding] Thank you, Mr. Chairman. 

My district 14 in Texas, the three coastal counties starting at 

Louisiana and coming southwest, arguably ground zero for Harvey 

flooding. It’s just unbelievable. I have learned more about restoration, recovery, and all of the efforts that have gone on than I ever 

wanted to know about disasters, and I hope I never get to—have 

to use it again. 

So with that as a backdrop, Beaumont lost water because their 

electrical boxes went—lost their city water system because their 

electric boxes went underwater, and a lot of the infrastructure 

there, had it been raised above ground six, eight, ten feet or more, 

it could have been protected. We’re talking about infrastructure. 

Walt knows that I was on the Environmental Reg Committee in 

the Texas House and dealt with energy there that session so this 

is very—and I was an air-conditioning contractor before I sold my 

company, so this is very near and dear to my heart. A great, great 

discussion. 

A couple things I did want to follow up on. The gentleman from 

California, Mr. Rohrabacher, talked about EMPs and SMRs. Of 

course the SMRs are going to be more expensive to buy up front, 

so there’s a cost factor there, but when you talk about EMP protection, I don’t know probably which one of you guys can answer this 
149 

is—does EMP affect only a magnetic field that is in operation at 

the time, or is it all electrical devices? 

Mr. IMHOFF. Again, it’s not my area of expertise, but I believe it 

would affect all because it’s going to create currents that will tend 

to overheat and cause issues in various electrical devices, but 

again, I’m not an expert in this area. 

Mr. WEBER. So you’re—that is to suppose that a jet engine in an 

energy plant built by GE or whoever, this turbine that’s not spinning—in other words, if we had redundancy, if we had a plant sitting there that wasn’t operating, wasn’t active, EMP, solar flare, 

choose whatever method you want, you were thinking that that 

would destroy the windings in that engine. Dr. Sanders? 

Dr. SANDERS. So once again, not being an expert but talking with 

experts about this, my understanding is potentially yes if they are 

connected to the grid in a way that that current can get to them, 

but I think the important point is is that potentially, particularly 

when this is a solar-generated event, there is some warning, and 

so if we have appropriate detectors on the Earth, then we may be 

able to reconfigure parts of the grid—— 

Mr. WEBER. You would have a main switch you could throw—— 

Dr. SANDERS. In a sense. 

Mr. WEBER. —disconnect it? 

Dr. SANDERS. In a sense. It’s probably not as simple as one main 

switch, but there are ways in which we could build protection according to the understanding—— 

Mr. WEBER. Okay. 

Dr. SANDERS. —I have. 

Mr. WEBER. Let me—you know, reading through this and going 

back through this brings up some really interesting questions. I 

think there’s about five ways that we can help make our grid more 

resilient, and I’ll just name them real quick. We need to have portable deployable assets. We talked about SMRs. We talked about 

other systems. Mr. Dillingham, you called it a microgrid of sorts I 

guess. I don’t know how you have a natural gas pipeline that’s capable of running that kind of facility, high-pressure pipeline. That’s 

one of the challenges. 

You have to have preapproved—in other words, FERC, all these 

agencies have to have preapproved these in emergencies. You have 

to have multiple assets. You have to have more than one you can 

bring in. They have to be close. You have to have trained personnel. And I know in ERCOT—Mr. Baum, you and I talked about 

this—we really have a good—like I said, I’ve learned more about 

all of the collaboration that goes on after a disaster—a network of 

first responders. If you’ve got preapproved, if you’ve got portable 

assets, if you’ve got them close by, and you’ve got a network of 

trained responders that’s cooperating, that will help harden our 

grid. 

Now, you get to the transportation part, the lines and stuff, 

Fukushima taught us something over in Japan, their nuclear plant, 

their backup power was too low. If we had our way, we would raise 

everything up eight, ten feet in the air at least to get everything 

above groundwater. 
150 

Harvey was the single largest flooding event in United States 

history, so, you know, I don’t know if we can come in and fix all 

of those problems and raise all of those things up. 

Mr. Baum, I’m going to come to you with a question. What kind 

of technology is available in your experience to stop a domino effect 

of power outages from moving region to region? 

Mr. BAUM. In Texas, our grid operator, you know, is—as Dr. 

Dillingham talked about earlier, we deal with weather events all 

the time, nothing as extreme as Harvey normally, but our grid operators are used to dealing with loss of certain lines or loss of certain generation. During Harvey, ERCOT did have—they have certain power plants that they have under contract to provide emergency power when needed, and when we lost some transmission 

lines due to the storm, they were able to call those reliability unit 

commitments into play, and a couple of power plants spun up to 

provide voltage support for that area. So that type of coordination 

needs to continue. 

One of the things you mentioned earlier, the staging and the 

moving of equipment, having ways to, you know, before—you know, 

before Harvey and especially before Irma, being able to stage crews 

and equipment and already have polls on the way to help out, you 

know, is very key. 

And, you know, like you said with the, you know, having modular equipment, you know, I mentioned earlier the mobile substations that we are able to bring in and keep power on the grid, 

and those type of activities need to continue. 

And it’s like you said earlier, design changes do need to happen. 

The—you know, in Houston where you lost a big substation due to 

flooding, the Memorial substation, that had been there for 15 

years—— 

Mr. WEBER. Right. 

Mr. BAUM. —and—I’m sorry, for 50 years and had never had 

water inside it. But with this storm it was flooded and was underwater for over 10 days. So that is now—that substation is being rebuilt with, you know, the new normal to be prepared if we have 

another flood event—— 

Mr. WEBER. Right. 

Mr. BAUM. —and being raised and doing walls and other things 

like that, you know, our—we need to look—you know, we need to 

take what we’ve learned from this storm and be prepared to do 

those design changes. 

Mr. WEBER. Absolutely. Well, I appreciate that. Like I said, I’ve 

learned a lot. I hope I never have to use it again, but it is—it will 

be very, very important information to have. 

I’m going to now recognize the gentleman from California, Mr. 

McNerney. 

Mr. MCNERNEY. Well, I thank the sitting-in Chairman for recognizing me. I thank the panelists. 

A moment of self-promotion, I care a lot about resiliency and reliability, and that’s why, with Mr. Latta, we formed the bipartisan 

congressional caucus on grid innovation, and we’ve produced some 

bills that are now working their way through the system to answer 

some of these questions. 
151 

My first question goes to Mr. Dillingham. Is there a significant 

difference in terms of reliability and resiliency with regard to 

microgrids versus distributed systems, or do they pretty much look 

the same in terms of those two questions? 

Dr. DILLINGHAM. It’s largely the same. I mean, it just depends 

on how you’re defining a microgrid. Out there, there’s still a considerable amount of definitions on what a microgrid would be, but it’s 

largely distributed energy resources. You know, typically, if you 

look at solar rooftop, it’s distributed energy. If you look at a 

microgrid, it’s—typically has multiple resources associated with it, 

if it’s solar, battery, CHP, or the like. 

Mr. MCNERNEY. Okay. Thank you. You mentioned the adaption 

gap. Can you describe why that’s a challenging problem? 

Dr. DILLINGHAM. That’s been—starting to be discussed quite a 

bit more and just generally infrastructure issues as far as how do 

we best prepare for climate change issues and if that’s water treatment or stormwater mitigation or our transportation infrastructure 

or power infrastructure. But the concern is and the issue that we 

face is that, due to the multitude of potential weather events that 

are being faced, taking one action in one area may not necessarily 

solve other action. So if we deal with drought within our power system, does that necessarily solve high wind, ice storm, flooding, hurricane-type issues. 

And when you are limited—financially limited, as we are, you 

know, within cities and with kind of—just within our infrastructure budgets, you kind of have this difficulty of making the appropriate decision, which way do I go as far as investing in the right 

piece of infrastructure. If I go and prepare for droughts and then 

all of a sudden I have ten years of floods, I look like I’ve really 

made a mistake here. 

And so that’s one of the—when the expectations with these 

downscaled climate models, they’re becoming so precise now, you 

can actually start putting likelihood estimates associated with potential storm intensity, as well as number of events, and those 

should start at least being considered being incorporated in our 

planning as we go forward and that should potentially reduce that 

uncertainty. 

Mr. MCNERNEY. Very good. Mr. Imhoff, your testimony touches 

on the effort in framing metrics to support grid modernization. 

What role can the Federal Government play in developing metrics 

for the grid? 

Mr. IMHOFF. Thank you, sir, for the question. The Federal Government is involved. As part of the Grid Modernization Laboratory 

Consortium, we are framing a set of metrics for the next generation 

grid, three of which are the traditional usual suspects of reliability 

and affordability and environmental profile, but the new ones of resilience and flexibility are kind of challenging and under debate 

but they’re very essential as we go forward. 

So I think the Federal Government is providing some of the innovation to help frame and recast some of these activities, and 

they’ve established the opportunity then to work with States and 

the—at the regulatory bodies and the vendor community and others to help test and validate these, and they’re part of the current 

GMLC research portfolio. 
152 

Mr. MCNERNEY. I’ve been in standards committees, and they’re 

a pain, but it’s worth it. It’s worth the effort. 

Mr. Sanders, is enough being done regarding the interconnectedness of the grid with oil, gas, and other natural resources? 

Dr. SANDERS. That’s definitely an area in which more work needs 

to be done. Much of the work to date has been focused on the resiliency of the grid, but as I think many of us agree and as the report 

notes, that interconnectedness is important, so more work should 

be done. 

Mr. MCNERNEY. Well, how would you rank cybersecurity issues 

with the grid resiliency? 

Dr. SANDERS. Cybersecurity, if I understand your question correctly, is a very important impairment to grid resiliency, a very 

real impairment, and one of the important things we should consider. The report takes an all-hazards approach. In fact we talk 

about about 12 different impairments of the grid. They’re all important, can’t leave them out. What we need to understand is to what 

extent can we build protections that can protect against multiple 

of these impairments, and to what extent do we need to build specific mitigations for them? 

Mr. MCNERNEY. Well, then how does knowledge of previous cyber 

attacks prepare for future attacks? Is—— 

Dr. SANDERS. Great question. Clearly, knowledge is very important. On one hand, knowledge can be used through appropriate information-sharing in order to alert others that this particular vulnerability, which is being exploited, may be exploited in another location and in a very close period of time. On the other hand, there 

are always new kinds of attacks, so-called zero-day attacks, and so 

we cannot rely purely on history to think about the future. 

In a sense what we need to do—and this is where resiliency is 

very important—is we need to build systems that, rather than protecting against very specific cyber attacks, protect against whole 

classes of effects those cyber attacks may bring on the grid. So by 

thinking about the effects and through resiliency, through that resiliency cycle, mitigating those effects, then we can begin to protect 

against zero-day attacks that we haven’t seen before. 

Mr. MCNERNEY. All right. Thank you, Mr. Chairman. I yield 

back. 

Mr. WEBER. I thank the gentleman. 

The gentleman from Indiana, Mr. Banks, is recognized for five 

minutes. 

Mr. BANKS. Thank you, Mr. Chairman. 

What an incredibly important subject for us to tackle today, so 

I appreciate the Committee diving deeply into these issues. 

And when I continue to talk about the cyber-related aspect of 

this subject as the growing number of—the growing threat of cyber 

attacks is something that concerns me as a policymaker and does 

a number of my colleagues as well. And these are no longer hypothetical threats. We’ve seen two threats to the electrical grid in 

Ukraine, for example. And with the systems relying more and more 

on computers and information technology, we need to do everything, as you know, that we can to counter potential cyber threats. 

So with that, Dr. Sanders, could we take a step back and maybe 

give us more specifically how often is the cyber—is there a cyber 
153 

attack or an attempt of a cyber attack on our national grid? And 

have we seen that number rise over the past five years? 

Dr. SANDERS. Thank you very much for that important question. 

First, let me say that it’s a very difficult question to answer. Different people have different bits of knowledge, some of that knowledge in the open, some of that knowledge classified, some of that 

knowledge in the hands of other countries, so it’s a difficult question to answer. 

Having said that, what we’re seeing is an increase in the rate of 

observed cyber attacks, right? We now have documented cyber attacks that are known in the public. We didn’t have that just a few 

years ago. And we’re seeing that the frequency of lower-grade probing and attacks on both the operational technology and on the information technology, both on the—if you will, the online part of 

the grid and the offline control of the grid, those kinds of attacks 

increasing. 

Mr. BANKS. How do we monitor those attacks? I mean, how do 

you—can you give us sort of a dummied-down version of how we 

monitor—how do we know that those attacks occur and exist? 

Dr. SANDERS. Sure. So some of them are big and we read about 

them in the news, right, the Ukraine attack and these kinds of 

things. Some of them we can monitor for. The lower-grade, more 

frequent ones we can monitor for using online technology. There 

are systems called intrusion detection systems first popularized in 

our corporate information technology systems that can look for 

packets, that can look for behavior that tends to be abnormal and 

flag those as possible attacks. There have been specific versions of 

those intrusion detection systems that have been built for the 

power grid both on the side of smart meters, for example. One was 

developed at the University of Illinois that’s been prototyped and 

used at FirstEnergy, for example, and other aspects of grid-specific 

kind of networks. 

Now, the trouble is is those signals are not always clear. We get 

a lot of noise in those, and so we have to fuse that information together, and we have to create higher-level intelligence that we then 

can make those determinations, and work to do that is ongoing. 

Mr. BANKS. So these might seem like obvious questions, but what 

do we know about these adversaries who carry out attacks like 

these? What are their motives? Where are they coming from? Can 

you talk a little bit—we haven’t talked enough about that today. 

Can we talk a little bit about—— 

Dr. SANDERS. Sure. Sure. 

Mr. BANKS. —what we know about these adversaries? 

Dr. SANDERS. Sure. I think we know a lot, but we know pieces 

of the whole story. We know that they come in all forms. We know 

that they come from kiddie scripters up to potentially nation-states, 

right? The evidence is pretty strong that nation-states are involved. 

We know that they’re coordinated, we know that they’re deliberate, 

we know that they will wait, they will insert code into a system 

and they may wait months until they activate that code. So the 

real challenge is to gain that understanding and to understand how 

to react to these things when the adversaries may be willing to 

wait months to gain their information. 
154 

Mr. BANKS. An incredibly important subject, and hopefully, Mr. 

Chairman, we’ll have many more opportunities to examine these 

issues. I appreciate all of you being here very much. With that, I 

yield back. 

Dr. SANDERS. Thank you very much. 

Chairman SMITH. Thank you, Mr. Banks. 

The gentleman from Illinois, Mr. Foster, is recognized. 

Mr. FOSTER. Thank you, Mr. Chairman. And this is a technical 

question here. A lot of the really destructive scenarios that people, 

you know, worry about have to do with phase imbalances, resonant 

conditions, this sort of stuff, frequency mismatches that make it 

really hard to control the grid. These don’t occur in a DC. grid, and 

there—I was wondering what studies may have been done about 

the potential resiliency differences on DC. grids versus A.C. grids 

which, you know, have just a number of advantages I can think of 

just in terms of being able to, you know, passively protect them 

with things like diode clamps from—and the interface is a much 

simpler one. You have—simply, are you delivering the voltage and 

current or are you not, and opening up the circuit. It’s just—from 

a number of ways, it seems to me it’s a lot easier to protect. I was 

wondering what work has been done on trying to quantify that difference and that may actually cause us to think over time of actually switching to a DC. grid, which gets mooted from time to time. 

Yes. 

Mr. IMHOFF. So I’ll start but defer to the professor. The—as you 

know, the history of our system being an A.C. system is long, and 

it started 2 centuries ago I guess, but there’s substantial experience with DC. interties mainly today focused on movement of large 

amounts of power over long distance. They are more efficient and 

you can—actually, right above the A.C. system and not have to 

deal with a lot of the reliability oscillatory control and other things 

underneath in that A.C. system. 

Mr. FOSTER. Correct. Right. 

Mr. IMHOFF. But it all gets down to cost, and so the planners— 

we don’t—have not seen a lot of DC. activity here in the United 

States over the last decade until the offshore wind issues became 

emergent, and so there is more direct-current activity in Asia and 

in Europe than in the United States. I think here is just an artifact 

of the economics of the current system where we have a flat demand. We have a lot of inexpensive natural gas, and I don’t think 

that the economics have really tripped it in the favor of more DC. 

activities going forward. 

I will say that, as part of the grid modernization consortium 

portfolio, there is a study that’s being coordinated with various 

ISOs, Midwest ISO, Southwest Power Pool, Bonneville, and the 

Western Interconnection looking at seams issues in terms of how 

my DC. overlays enable capacity-sharing beyond the current interconnection boundaries and what value would that provide and 

what sort of cost performance would that offer. So I think there’s 

an emerging body of knowledge and analytic tools that might look 

to the next generation of the modernized grid and re-examine this 

issue of what might be the relationship between A.C. and DC. systems at the bulk system-level. And that study should be wrapping 

up in January, I believe. 
155 

Mr. FOSTER. Well, the other thing that’s changed is essentially 

all power that goes out certainly at the consumer level goes 

through an A.C. to DC. converter, and so at some point, you know, 

we’ve been just converting more than we might necessarily have to. 

And the pure DC. system may have advantages just in terms of— 

you know, if we were to start over from scratch, I think we’d seriously consider a DC. system. 

Also, if you add the requirement of EMP hardness, which is a 

very expensive thing but may prove necessary, and cross your fingers that Rocket Man doesn’t do what he’s been talking about, but 

if that is a requirement added to this, then I think protecting a DC. 

system against that will be, my guess, significantly easier than an 

A.C. system where you have phase and frequency to worry about. 

So is there any work, you know, at the lower end in Europe or 

anywhere looking at—you know, at the distribution-level DC. system? 

Mr. IMHOFF. There is consideration of this notion of avoiding the 

transform—and the inherent losses in the transformers to go to 

more DC. I think some of the large data farms and others are 

emerging are very high consumers of electricity actually do some 

of that because they’re inherently D.C.-oriented inside and so 

they’re avoiding some of those issues. But it’s more kind of localized and off—one-off evaluations, I believe. I’m not aware of anything substantial in the United States. 

Mr. FOSTER. Yes, well inside big data centers, for example, I believe they are switching to DC. power. It is where they have got, 

you know, many megawatts. And so there’s another big vulnerability that gets worried about, which is just how long it would 

take us to remanufacture many, many high-powered transformers, 

whereas it probably would be easier to rebuild the fraction of D.C.- 

to-D.C. converters that got wiped out in an EMP pulse. And so if 

you add that as a requirement, it may again tip the balance when 

you add the hardness requirement. 

Anyway, if there’s anything specific that can be talked about either, you know, publicly or not publicly about efforts along that direction, I’d be interested. 

Mr. IMHOFF. I’d be happy to take that for the record. 

Mr. FOSTER. Thank you. I yield back. 

Chairman SMITH. Thank you, Mr. Foster. 

And the gentleman from Illinois, Mr. LaHood, is recognized. 

Mr. LAHOOD. Thank you, Mr. Chairman. And I want to thank 

the witnesses for your valuable testimony here today and want to 

particularly welcome Dr. Sanders, who’s the Department Head at 

our flagship university, the University of Illinois, and for what you 

do at the electrical and computer engineering program there. Great 

to have all of you here today. 

Dr. Sanders, in your testimony, you mentioned your work at the 

U of I, the University of Illinois with the cyber infrastructure for 

the power grid center and also the Cyber Resilient Energy Delivery 

Consortium. Two questions on that, could you talk a bit more about 

how these two centers are helping to make the U.S. power grid 

more resilient, and then secondly, is this the type of work that’s 

happening at other universities? 
156 

Dr. SANDERS. Thank you, Mr. LaHood. I’ll—at the risk of being 

self-promoting, I’ll try to be a bit brief on this. The University of 

Illinois started work on cyber infrastructure making trustworthy 

and making resilient and cyber secure the infrastructure for the 

grid back in 2005. I can say that this is a real need that we realized by the turn of the century, but it took time to get the attention 

of the funders and really have people understand this was an important thing to work on. 

The first of those efforts, TCIP we call it, or Trustworthy Cyber 

Infrastructure for Power was funded by the National Science Foundation in a grant, and in the wisdom of the National Science Foundation, even though financial contribution was not large at the 

time, they brought in Department of Energy and Department of 

Homeland Security to work closely with us. 

It was very different than your typical academic research project. 

From the very beginning, we brought in people from industry and 

the National Labs. People from Mr. Imhoff’s group were with us at 

2005, and we were defining the research agenda. People from about 

35 companies came together at that first meeting, and they worked 

closely with us from that point out. 

A follow-on effort was funded by the Department of Energy, 

which is called TCIPG, and TCIPG expanded the scope to say don’t 

just do the good academic research but find ways to transition that 

and get that in the hands of people that need it. 

Several startup companies have come out of that effort. Technology has been specifically transitioned to large power system 

equipment manufacturing, and you can see really that kind of 

input going on. 

Most recently, in 2015 there was once again an open competition 

from the Department of Energy, and the University of Illinois then 

received something called CREDC. That’s Cyber Resilient Energy 

Delivery Consortium. And at that point in time—and I should say 

in the original centers that I talked about, there were four universities that partnered together. Now, 10 universities and two National Labs, including PNNL, banded together to look at resiliency 

issues in the grid. 

So that, once again, is a project that takes basic research but 

takes basic research and then industry-government partnership in 

a way that we can have impact. In fact my colleague David Nicol, 

who is the principal investigator of the CREDC effort, is in Texas 

today talking with people from the oil and gas industry about how 

we can transition our technologies to them. We flew out together 

last night from Champaign, him to Texas, me to here, and this is 

the kind of effort we place going on. So thank you for that question. 

Mr. LAHOOD. Thank you. Those are all my questions. I yield 

back. Thank you, Mr. Chairman. 

Chairman SMITH. Thank you, Mr. LaHood. A good Texas-Illinois 

connection there I didn’t know about. 

The gentleman from Florida, Mr. Crist, is recognized for his 

questions. 

Mr. CRIST. Thank you very much, Mr. Chairman. And let me 

add, thank you for holding this hearing on this important issue. As 

a Floridian, I certainly appreciate it. I want to thank the panelists 
157 

for being here, too. I appreciate your presence and taking of your 

time to help educate us even more about our grid and its resiliency. 

I recently saw a comparison that the Energy Information Administration did on grid resiliency during Hurricane Irma and Hurricane Wilma, which hit Florida in 2005. The assessment states, 

quote, ‘‘Although the percentage of Florida customers without 

power during Irma was significantly higher than during Wilma, the 

rate of electric service restoration has been more rapid.’’ Five days 

after Irma’s landfall, the share of customers without power had 

fallen from a peak of 64 percent down to 18 percent, a recovery 

rate of about nine percent of the customers per day. Power outages 

during Wilma back in 2005 went from 36 percent of customers to 

16 percent by the fifth day after landfall, an average recovery rate 

of about four percent of customers per day. 

Dr. Dillingham, I’m curious. You know, with this in mind and— 

can you speak generally about improvements that have been made 

to make our grid more resilient and specifically maybe focus on discussion of the utilization of underground lines as a means of increasing resiliency? We see a lot of our barrier islands and beach 

communities in Florida moving to this not only because it’s aesthetically appealing, but we get hit by hurricanes a lot. 

Dr. DILLINGHAM. Yes, absolutely. Thank you for that question. 

Yes, there have been significant improvements, particularly in the 

resilience of the transmission distribution infrastructure. We are 

seeing quicker response times. There’s a lot better coordinated deployment, as Mr. Baum talked about within the ERCOT region. 

The systems are just becoming more robust to deal with this. 

When you talk about burying lines versus aerial lines, the significant issues with that is it may solve some problems in some 

areas where there is high wind events but where there’s a lot of 

flooding, that could actually put it at considerable risk if they’re 

not properly designed. And so you need to—as I kind of mentioned 

earlier, developing—— 

Mr. CRIST. I think I’m assuming proper designing. 

Dr. DILLINGHAM. Proper designing, right. 

Mr. CRIST. Wouldn’t we? 

Dr. DILLINGHAM. We would assume proper design there, but 

what we typically find is that if we start—you know, like within 

Houston we have lines that are aboveground and belowground. The 

concern there is that in more flooding environments, you just have 

a higher risk of those lines being disrupted versus if they’re aboveground, and so it’s just—you have to make that tradeoff. If you’re 

going to pay the additional dollars to bury them, are they properly 

developed and properly can mitigate against that, that flooding risk 

there. 

But to your point, they’re—we have seen significant improvements in the way in which our systems have been designed. 

They’re more flexible. They’re allowing for better rerouting of 

power. And so yes, they have improved considerably, but we need 

to keep in mind also that, you know, the focus right now of course 

we’ve had three significant hurricane events, and so we are talking 

about that quite a bit right now, but there’s a lot of other issues 

that are being dealt with across the country if it’s wildfire, if it’s 

ice storms, if it’s drought that can also have significant impacts, 
158 

and if we’re preparing just for hurricanes and preparing for floods, 

we may be missing the point as far as preparing for some of these 

other disasters. And so we need to continue to figure out what’s the 

best way to develop a diverse resiliency grid that can deal with as 

many problems as possible. 

Mr. CRIST. Maybe we should talk about those then. If we’re talking about fire, isn’t it probably better to have your transmission 

lines underground than aboveground also? 

Dr. DILLINGHAM. I would assume so, yes, because you’re taking 

away that risk. 

Mr. CRIST. And if you’re talking about ice, wouldn’t the same 

hold? 

Dr. DILLINGHAM. For ice it could, but then you’re—you’re looking 

at just a significant increase in the cost when you bury lines versus 

having them aboveground, and so it becomes how much are we 

willing to pay to have that additional resilience in there, and where 

is that funding going to come from them, and how much are we 

going to pass on to ratepayers in that regard? And that’s just the 

tradeoff there. In many cases, particularly—except for pretty much 

flooding, you can have a more resilient system underground. It’s 

just a—it’s protected from those events. But are we willing to pay 

that additional cost to have that resilience in there? 

Mr. CRIST. Maybe we should look at it this way. If you’re talking 

about additional cost and you don’t underground them but you 

keep replacing them aboveground, you’ve got that replacement cost 

every time or the repair cost every time versus maybe you come 

close to eliminating it. 

Dr. DILLINGHAM. Absolutely right, but the way in which economics are typically valued into these projects is first costs and what 

is the first cost and that initial cost for me versus long-term 

lifecycle analysis, which needs to be considered further. 

Mr. CRIST. Wouldn’t it be more enlightened to consider the reality of, you know, having to replace over and over and over again 

versus the likelihood of maybe not? 

Dr. DILLINGHAM. Absolutely, it’s just that’s not how decisions are 

made at this point. It’s very much kind of a short-term viewpoint 

versus a long-term viewpoint and so—— 

Mr. CRIST. We’re in this for the long haul. 

Dr. DILLINGHAM. Oh, absolutely—you’re absolutely right. 

Mr. CRIST. Right. 

Dr. DILLINGHAM. I agree with you on that. Yes. 

Mr. CRIST. I yield my time. Thank you very much, sir. 

Chairman SMITH. Thank you, Mr. Crist. 

The gentleman from South Carolina, Mr. Norman, is recognized. 

Mr. NORMAN. Thank you, Mr. Chairman. I just want to thank 

each of you for your testimony. It’s been very interesting on a very 

important subject. 

Let me switch gears with you. Smart meters, Mr. Imhoff, what 

kind of information is gathered and how is it used? 

Mr. IMHOFF. The smart meters typically monitor consumption in 

the home. The utilities then use that to support their billing function, and then in addition, the utilities use them in support of their 

outage management systems to help detect in real time when outages occur. Today, the majority of utilities still wait for a phone 
159 

call from a customer to inform them that the power is out in a distribution feeder area. But in areas that are served by a combination of smart meters and then distribution automation devices in 

the substation have delivered substantial improvements. 

Vista in Washington State, an investor-owned utility there, as 

they moved to distribution and smart metering, they reduced the 

frequency of outages by 21 percent for the customers and they reduced the duration of outages by ten percent and in a very costeffective fashion. So typically, that’s how that information is used, 

to support the billing and the outage management systems. I’m not 

aware of any other key value streams. 

Mr. NORMAN. Let me ask you this. What is your opinion? Are privacy and security concerns on the information that is gathered 

something that we ought to—that the customer ought to be concerned with? And is it encrypted in your—from what you know? 

Dr. SANDERS. So, thank you very much for that question. I’ll 

jump in. So with regard to the—well, to answer your question simply, there are many different brands of smart meters, there are 

many different schemes that are being used, but in general, yes, 

the information is encrypted, and steps are taken for privacy. 

With regard to cybersecurity issues and the meters, there’s probably less concern about privacy but a potential concern that again 

is being thought about carefully so the sky is not falling but potential concerns with regard to someone who may try to gain control 

of their—those smart meters from the outside. So smart meters do 

have the ability to control power flow to the house, and so one 

must design architectures—and those who are designing smart meters are well aware of this—that ensures that the control of those 

meters cannot be placed in the hands of an adversary. 

Mr. NORMAN. And we would depend on experts like each of you 

to tell us which meters, as technology improves, can avoid some of 

this because, as Congressman Banks said, the—when you mentioned cybersecurity hacks, particularly with the Chinese with the 

military, their face gets very serious and it’s a huge problem. 

And, Dr. Dillingham, again, back on the underground versus 

overhead, I’m a—we’re a developer. I’ve seen the number of lines 

that are cut inadvertently and the problems that it has, additional 

to the heavy cost that it takes to put them underground and the 

rights-of-way that come with that, so I appreciate your—mentioning the cost because it’s a huge factor. 

Mr. Chairman, I yield back. 

Chairman SMITH. Thank you, Mr. Norman. 

The gentleman from Virginia, Mr. Beyer, is recognized. 

Mr. BEYER. Thank you, Mr. Chairman, very much, and thank all 

of you for being with us today. 

You know, it’s very important that we’re having this hearing, especially because our President is visiting Puerto Rico today. And 

it’s in a time when we talk about electrical grid utility—resiliency, 

Puerto Rico has virtually no electrical grid to speak of. As FEMA 

Director Long said yesterday, ‘‘Rebuilding Puerto Rico after Hurricane Maria will be a Herculean effort.’’ 

The Army Corps of Engineers is doing temporary power right 

now, 74 generators in place, 400 to come, but I think, as of this 

morning, only a little more than five percent of Puerto Ricans have 
160 

had their power restored. According to the Army Corps of Engineers, for some areas of Puerto Rico, it might take upwards of 10 

months before their power is restored. And it’s not just the electrical grid system that’s in crisis. As of 3:00 p.m. yesterday, fewer 

than half of all Puerto Ricans had access to clean drinking water, 

limited to no cell phone service, 90,000 applications for FEMA assistance, we know of 16 known fatalities, and that doesn’t count 

those who may have died in their homes yet to be discovered. It’s 

two weeks after Maria, but now we do finally have an aid package 

for Puerto Rico and the U.S. Virgin Islands. 

So, Mr. Chairman, may I suggest perhaps a follow-up meeting— 

follow-up hearing on the resiliency of the electrical grid in Puerto 

Rico. 

And, Dr. Dillingham, if today was a hearing about how we 

should respond to Puerto Rico, based on your expertise, what solutions would you suggest to make the grid more resilient? What are 

the near-term solutions to bring power back faster to those, including renewables? 

Dr. DILLINGHAM. Thank you for that question. This is very—absolutely a very important topic at this point. The significant problem within Puerto Rico was the lack of—the loss of the transmission distribution infrastructure. The power plants fared just 

fine there, and they have a fairly diverse set of power plants there 

from—they have natural gas plants, solar, wind, variety of plants. 

There was a transmission distribution infrastructure that went 

down and is going to take a while to get back up. 

When you look at the power prices within Puerto Rico and look 

at what are the different microgrid options that are out there, it 

makes—it’s starting to make some pretty good economic sense to 

start seeing more solar battery deployments out there. We’ve already seen the—potentially the wall packs being donated by Tesla 

to some degree, but a wider distribution of these types of microgrid 

systems that are not dependent on fuel resources necessarily or not 

dependent on LNG terminals being on or transmission distribution 

terminals working or making sure that different types of fuel shipments make it there. 

And if you’re in a hurricane-prone area such as Puerto Rico, the 

ability to have smaller resilient microgrid systems is probably the 

best effort. And the quickness in which you can deploy a microgrid 

system, especially solar battery system, is far—happens far more 

quickly than you can deploy any other type of infrastructure out 

there at this point. 

And when you look at models of what’s happening in Hawaii, 

who has similar power costs, and you start seeing their distribution 

or their development and deployment of microgrids out there, it 

just—it’s a good example to start looking at. The economics are 

there, the technology is there, and it’s really just a matter of starting to introduce it. 

Mr. BEYER. Great. Great. Thank you very much. You know, this 

hurricane season, which isn’t even over yet, it’s generated more destructive storms than we’ve seen in a long time. Four of this year’s 

storms became category 4 or 5 storms. Three of those made landfall 

in the United States. The University of Wisconsin called Harvey a 

1,000-year flood, once every thousand years. Quote, ‘‘Nothing in the 
161 

historical record rivals this.’’ Maria was the 10th-most intense hurricane ever. Jose ́ and Irma, only time in recorded history that two 

active hurricanes simultaneously had wind speeds in excess of 150 

miles an hour. 

So while we talk about electrical grid, we cannot afford to avoid 

the larger-scale issue that these storms are becoming more intense 

as the climate warms as it changes. So, Mr. Baum, are utilities, especially those in Texas, taking climate change, the increasing severity of storms into account in their planning? What are you doing 

to upgrade the grid system to recognize that, you know, we’re living in a world where the climate is changing? 

Mr. BAUM. I think there’s no question that we are taking into 

consideration the new normal after events like this. And as I stated 

earlier, we had a substation in Houston that flooded that had not 

flooded in 50 years. That substation is now being rebuilt to prepare 

for, you know, what is now the flood of record. And I think all of 

the design that utilities do, it basically says, all right, what’s the 

worst-case scenario that we’ve seen and now how do we build our 

system to prepare and be ready to face the next type of storm? So 

I definitely think practical planning is something that utilities are 

doing and will continue to do going forward. 

Mr. BEYER. Well, thank you for your vision and your answer. Mr. 

Chairman, I yield back. 

Chairman SMITH. Thank you, Mr. Beyer. 

The gentleman from Florida, Mr. Webster, is recognized. 

Mr. WEBSTER. Thank you, Mr. Chairman. Thank you all for coming. 

I thought about, as Mr. Foster was talking about A.C. and D.C., 

maybe Edison will get a car named after him instead of the Tesla. 

And it’s amazing all the things he’s doing, including the battery 

packs that the company is sending are all D.C., and yet he was the 

greatest promoter of A.C. It’s a kind of interesting switch of events. 

Mr. Baum, in Texas in the last hurricane, which just passed, was 

there a lot or minimal or in between those two damage to the high 

tension wires from the generator to, let’s say, the substation, or 

were most of the outages caused by the lower voltages? 

Mr. BAUM. A combination of both, but I would say most of the 

customer outages were caused by—on—were more on the distribution system that were caused by flooding and substations being out, 

which then knocks out the distribution system. But we did have 

some large—we had six of our largest 345 kilovolt transmission 

lines were downed or damaged for a while during the storm, and 

a large number of smaller transmission lines were also affected. So 

it was both in this storm, transmission and distribution, which goes 

it—which again, the lights in the whole State never flickered, and 

a lot of that is because of the redundancy in both the transmission 

and the distribution network. 

Mr. WEBSTER. So from just a hardening standpoint, is there any 

change that needs to be done to the high tension lines in order to 

make them more resilient? 

Mr. BAUM. I think you’re always looking at ways to develop—— 

Mr. WEBSTER. Let me ask you—my knowledge is from a long 

time ago, so are they still aluminum with steel cable running with 

them or is it—is there a new type of transmission wiring? 
162 

Mr. BAUM. Most of the transmission wiring is still as you described. 

Mr. WEBSTER. Okay. 

Mr. BAUM. I think if there are advancements being made, a lot 

of it is in the structures that hold up the transmission lines and 

finding ways to design those better to withstand storms. 

Mr. WEBSTER. So what was the cause of a structure? Was it external flying debris or was it water or what was it that would—— 

Mr. BAUM. With our transmission lines that were affected, it was 

high winds that were twisting the structures that hold up the lines 

or—and you didn’t really have a lot of lines breaking. It was more 

high winds twisting the structures that holds them up that brought 

down power lines. 

Mr. WEBSTER. So was there—is—would there be an effort now to 

come up with a better way to build those structures or to harden 

them in any way? 

Mr. BAUM. I think definitely. We have a new Chair of our Public 

Utility Commission. DeAnn Walker was just named after the 

storm, and the—at a meeting last week, she basically said let’s get 

the utilities and other providers together to see what ways we can 

improve for the next storm, and I’m sure that’s one of the things 

that we’ll be looking at. 

Mr. WEBSTER. I mean, I would think that we’d be—building 

something like that would be a long-term—is there—was there a 

way—you were talking about rerouting, doing some other things. 

Were those all able to be rerouted around those structures that fell 

or were twisted? 

Mr. BAUM. We—they were able—through a combination of rerouting and having some power plants that our grid operator contracts with to ramp-up to provide voltage support to some of those 

areas that were affected by the lines that went down, and so there 

were ways to make it to where this did not—the loss of the transmission system didn’t cause a cascading effect. 

Mr. WEBSTER. Okay. I yield back. 

Chairman SMITH. Thank you, Mr. Webster. 

That concludes our questions for the day. Thank you all for your 

wonderful testimony. It was very enlightening to us, and we have 

lots to do on our part as well. 

So I appreciate everybody being here, and we stand adjourned. 

[Whereupon, at 12:06 p.m., the Committee was adjourned.] 
(163) 

Appendix I 

ANSWERS TO POST-HEARING QUESTIONS
164 

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. Carl Imhof 
165 

2. If it was decided to add sufficient spare capacity and protection for recovery from an 

EMP event, would this be the most economically achieved with an AC or DC electric grid? 

Answer: We do not have access to a full economic comparison of a U.S. system rebuild. 

Generally, DC transmission lines become more economic above distances of600 kilometers. 

For shorter hauls and the distribution system, our intuition is that a DC rebuild would be more 

expensive but we do not have definitive supporting information. 

It may be that planners could identify subsets of new transmission and distribution expansion 

planning that would merit DC to better serve large DC loads such as server farms and critical 

industrial loads. 

Both AC and DC systems have opportunities to harden them to EMP or GMD effects but the 

nation lacks a common wave form analytic basis for design and evaluation, and there are not 

have common protection standards and guidance for industry. Some recent publications in 

system protection literature express the view that current industry standards provide some EMP 

resilience value; we do not believe that there is consensus on this topic. 

2 
166 

Responses by Dr. Gavin Dillingham 

U.S. HOUSE OF REPRESENTATIVES 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY 

Full Committee 

Hearing Questions for the Record 

The Honorable Elizabeth Esty 

Resiliency: The Electric Grid's Only Hope 

Questions for Dr. Dillingham 

1. In your testimony, you explain that current policies and regulations do not favor 

integrating more renewable energy into the U.S. power grid. How would bringing more 

renewable energy into the grid improve its resilience and reliability? 

The diversity of power supply is important, particularly distributed energy systems that are locally 

based. This would include solar, battery storage, combined heat and power and geo-thermal energy 

sources. These systems reduce costs and risk associated with more centralized generation systems that 

require long range transmission and distribution systems. We saw during the recent hurricanes, the 

impact that major storm events can have on the transmission infrastructure. More diverse, distributed 

energy systems are not as susceptible to this risk. Unfortunately, the grid benefits these systems 

provide, particularly ancillary benefits are not properly valued or accounted for in the market, thus 

creating a signiticant disadvantage in comparison to traditional generation resources. The beneiits 

include reliability benefits such as grid regulation and frequency, as well as the resiliency benefits of 

being able to withstand stonn events that the centralized system are vulnerable to. 

2. In Connecticut, green bonds and loans issued by the Connecticut Green Bank are key 

funding mechanisms used to: 

accelerate funding of micro grid projects 

and increase the deployment of renewable energy. 

Costs related to building out and powering a microgrid are also eligible for 

Commercial and Industrial Property Assessed Clean Energy (C-PACE) financing. 

Can you explain how the use of green bonds and C-PACE financing would be beneficial 

to other states cun·ently in the process of building a more reliable and more resilient grid? 

One of the limiting factors of the deployment of distributed energy systems that are capable of improving 

the resilience and reliability of the grid is lack offunding options. Unlike the fossil fuel industry which 

can use master limited partnerships to fund projects, renewable energy resources and distributed energy 

resources do not have this access. C-PACE and green bonds can provide low-interest funding that 

otherwise is not available for many clean energy projects. Further, the structure of these funding tools can 

allow for the bundling of energy efficiency projects and renewable energy projects within the same 

project. This allows for a reduction in energy demand and an increase in clean energy supply. In Texas, 

much of the PACE projects that have been developed have combined solar with energy efficiency and 
167 

water conservation projects. The development of projects that can improve energy efficiency and increase 

diversity of the power supply results in a more resilient and reliable grid. 
168 

Responses by Mr. Walt Baum 

U.S. HOUSE OF REPRESENTATIVES 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY 

Full Committee 

Hearing Questions for the Record 

The Honorable Bill Foster 

Resiliency: The Electric Grid's Only Hope 

Questions for Dr. William Sanders 

1. What studies have been done on the potential resiliency advantage of high voltage DC 

grids, which are intrinsically immune to destructive phase imbalances and frequency 

mismatches, and are more easily protected via passive means like diode clamping against 

overvoltage and reverse voltage conditions? 

2. What arc the resiliency and characteristics of DC vs AC systems contemplated for home 

and micro-grid systems that may include local photovoltaic arrays and battery storage? 

3. How long and costly would it be for the US to remanufacture high power transformers 

and related components after a nuclear EMP pulse or large solar event, as compared to 

the amount of time it would take to rebuild a system based on DC-to-DC converters? 

4. If it was decided to add sufficient spare capacity and protection for recovery from an 

EMP event, would this be most economically achieved with an AC or DC electric grid? 

The questions submitted above did not receive a re.1ponse before the stated deadline. 
(169) 

Appendix II 

ADDITIONAL MATERIAL FOR THE RECORD
170 

STATEMENT SUBMITTED BY COMMITTEE

RANKING MEMBER EDDIE BERNICE JOHNSON
171 

It specifically highlights the critical work of DOE's Orfice of Electricity Delivery and Energy 

Reliability and the Office of Energy Efficiency and Renewable Energy. Unfortunately, the 

President has proposed to slash programs in these offices. I hope my colleagues will join me in 

offering our strong support for these activities in the face of these ill-advised proposed funding 

cuts. 

Before I conclude, I would also like to note for the record that it is now October and we have still 

not had a representative from the Department of Energy come before the Committee. That is 

unacceptable. In order for this Committee to be able to fulfill its oversight responsibilities, I urge 

the Chairman to schedule a hearing with Secretary Perry as soon as possible, and to invite 

Administration witnesses to relevant bearings a~ we examine key issues under their purview. 

Thank you. I yield back the balance of my time. 
172 

DOCUMENT SUBMITTED BY REPRESENTATIVE

MARC A. VEASEY
173 

But the DOE summary didn't recognize a broader set of conclusions about why those power 

plants retired, and it offered too few constructive recommendations about how to address 

reliability and resilience going forward. 

Rethinking the conclusions about power plant retirements 

A broader look at the technical sections of the Staff Report offers some inescapable conclusions 

about why so many coal, nuclear and natural gas power plants retired between 2002 and 2016. It 

is necessary to understand these retirement causes in order to design effective policy, market and 

operational solutions for the future. 

Many of the retirement stories differ by region, but here are some over-arching observations: 

While coal and nuclear generation were once the preferred choice for low-cost, roundthe-clock generation, the drastic fall in natural gas prices has irrevocably changed the 

competitive economic balance between fuel types, with gas driving coal and nuclear 

farther out the supply curve. 

Continuing improvements in natural gas plant flexibility and fuel efficiency have 

exacerbated gas plants' competitive advantage over coal and nuclear resources, 

particularly given the faster pace of grid operations driven by variable generation on both 

sides of the meter. 

Flat or falling electricity demand has removed the expected rising revenue and demand 

cushion that once helped high-cost plants. 

As a root cause of retirements, wholesale competition worked as intended, driving 

inefficient, high-cost generation out of the market. This is evident in the pattern of 

retirements, which occurred earlier in the highly competitive, easy entry and exit markets 

ofERCOT, California, and the Northeast, and much more slowly in the vertically 

integrated Midwest, West and Southeast. 

As another root cause, most of the plants that have retired were old, smaller, inefficient, 

and high-cost. These plants did not have the flexibility and cost profiles to compete in a 

fast-moving grid and were old enough to merit retirement. 

Renewable generation was an exacerbating factor, but in most cases not a causal factor 

behind power plant retirements. Many of these retirements occurred before significant 

quantities of renewable generation were added to the grid, or in regions with little or no 

renewable production. Negative prices occmTed- often bid by nuclear plants behind 

transmission constraints before the advent of deep renewablcs penetration. 

In many cases, the plants that retired were already less economically competitive and 

were being dispatched less before the time (2011-2016) when they would have to make 

new regulatory compliance investments. Therefore, regulations forced many plant 

retirement decisions and set their retirement dates, exacerbating but not causing many 

retirements. 

Policy recommendations 

Many more coal and nuclear plants face borderline economic viability and are at risk of 

retirement over the next few years. Before all of those plants retire, we need to understand-
174 

based on valid reliability analyses, not just the desire to protect existing assets and jobs 

whether those plants play a valid reliability role. 

lfl had written DOE's policy recommendations, they would include the following: 

Wholesale markets Today's wholesale electric markets were designed to manage reliability 

and low costs, not to manage carbon, jobs or preferred resources. But as we patch and re-patch 

the current market system, what have we learned from the past 20 years of experience with 

competitive wholesale markets? FERC and stakeholders might explore the question, if we were 

to design wholesale electric markets fresh today, to address the conflicting cost, reliability and 

societal needs and goals in a consistent and integrated fashion, what would those markets look 

like? 

Essential reliability and resilience services NERC has given us a starting set of essential 

reliability services, but many of those services are not yet compensated adequately. We don't yet 

have a comparable understanding of the key clements of resilience (including fuel security), nor 

how to measure, productize and compensate them. W c do know that a wide variety of supplyand demand-side resources can provide many of these services- and the better we define and 

productize these services and specify their need and value, the more resources can step up to 

deliver them. 

We must figure out what all these essential services are and how to compensate providers 

appropriately for each, even if compensation is not determined based on market solutions. Such 

compensation may help meet some generators' missing revenues problem. 

Frequency response provision- Not all inertia is created equaL While rotating mass-based 

generation was the only source of frequency response decades back in the days of a slow grid, 

such sources are no longer the only way to get frequency response. DOE, NERC and others 

should conduct immediate research to determine the capabilities and limits of rotating massbased inertia, inverter-based synthetic inertia, and a variety of storage and automated demand 

response sources to provide primary and secondary frequency response. 

If there is unique value to rotating mass-based inertia, we need to know the value of that resource 

relative to other frequency response sources, and how much and where (topologically) such 

rotating mass-based resources must be located for maximum eflectiveness. Early studies suggest 

that inverter-based resources can be used to f,'Teat advantage to manage frequency control and 

response and voltage, if we first identit)' the necessary perti.mnance expectations on a 

technology-neutral basis and build those into grid participation requirements. 

Building portfolios to mitigate risk- We have a complex society and a complex grid with 

conflicting sets of goals and requirements. Our electronically-based, electricity-dependent 

society needs a mix of fast, flexible, clean, resources that collectively deliver a low-cost, highreliability, highly resilient energy system. Diverse supply- and demand-side resources should be 

assembled in portfolios that have a solid probability of meeting societal and operational goals 

effectively tmder a wide variety of possible future paths, under a reasonable range of 

costs. Market operators are trying to incorporate societal needs and state preferences into 
175 

Æ 

reliability and market rules, but they need help (as do state and federal regulators) to design costeffective, risk-moderating portfolios of supply- and demand-side resources that will deliver 

lasting value under diverse, uncertain future paths. DOE and NERC should work with 

stakeholders to conduct research and offer guidance on better portfolio design. 

Subsidies- Every type of ener1,>y resource today receives some type of support or subsidy. Oil 

and gas get depletion allowances, renewables get production tax credits, investment tax credits 

and R&D, nuclear generation gets insurance, R&D and construction work in progress, natural 

gas gets depletion allowances and R&D, and so on. But new subsidies for coal and nuclear 

plants won't level the playing field relative to renewables nor undo the impact of old subsidies 

they'll just make the playing field even bwnpier. 

Any new subsidies- including direct state payments, out-of-market uplift payments, or potential 

cost-of-service payments for non-competitive resources-- should have a specific purpose and a 

limited duration. As renewable PTCs end, Congress and regulators should consider also ending 

old subsidies of traditional resources insofar as they are based on outdated assumptions about the 

unique role and value of these resources. 

Better information and modeling- Effective power system planning and operation requires a 

solid set of models and forecasts of supply resources and loads whose behavior is interdependent 

and hard to predict. EIA, FERC, NERC and the reliability coordinators should be directed to 

collect more information to improve models and forecasts of the individual and compound 

interactions of rapidly changing loads, behind-the-meter resources, demand response and energy 

efficiency. and all supply-side resources. 

Decision processes- Regulatory and administrative law processes can be painfully slow. So are 

NERC and reliability coordinator stakeholder processes, which can produce decisions and 

outcomes that don't always favor reliability and resilience over entrenched interests and 

precedent. This is not news, but the grid and reliability challenges are moving faster than ever 

and formal decision processes aren't keeping up. It is worth taking another look at whether there 

are good reasons and effective methods to make critical time-sensitive, reliability-affecting 

decisions more quickly. 

In closing 

Secretary Perry's April memo raised important and timely questions about power system 

reliability and resilience. We designed the Staff Report's technical analyses to explain why and 

how changes in the bulk power system economics, technology and markets caused coal, nuclear 

and natural gas plant retirement. There is much more work to be done to determine the evolving 

nature of reliability and resilience requirements, and to identify the additional changes in 

technology, economics and markets associated with a modern grid. This broad set of challenges 

will require far more than 60 days to study, understand and implement effective, forward-looking 

solutions.