Grid resilience | Case study
A voltage-driven cascade, not a shortage of energy took mainland Spain and Portugal from a normal spring afternoon to total collapse in about five seconds. The failure propagated upward from a distribution layer saturated with inverter-based generation, past a defence plan built for a different kind of emergency.
Grounded in the ENTSO-E ICS Investigation Expert Panel Final Report (20 March 2026), building on the Factual Report of 3 October 2025. Economic figures from CaixaBank Research, Bloomberg Economics and CEOE.
On 28 April 2025 the Iberian system was running with solar PV supplying close to 59% of Spanish generation and wind another ~12%. Synchronous machines, the rotating plant that anchors voltage and inertia had been pushed to the margins. The morning brought rising renewable output, 5 GW of exports, and increasing voltage variability. The system was N-1 secure on paper, yet structurally thin on the one resource that would matter: controllable reactive power.
In the half hour before the blackout, two distinct oscillation episodes swept the Continental Europe synchronous area. Operators damped them successfully, but the very measures that worked (cutting exports to France, re-coupling southern lines, changing the HVDC mode) had a side effect: they pushed Iberian voltage up.
The incident began at 12:32:00. As voltage climbed, reactive-absorbing units began to disconnect and each disconnection removed absorption, driving voltage higher still. At 12:32:57 a 400/220 kV transformer near Granada tripped on over-voltage. Then, between 12:33:16 and 12:33:18, two waves of trips in Badajoz, Segovia, Huelva, Sevilla and Cáceres removed roughly 1.65 GW. In total more than 2.5 GW of generation and net-load rise accumulated before the system lost synchronism.
At 12:33:19 Spain and Portugal began losing synchronism with the rest of Europe. The interconnection to Morocco tripped on under-frequency (12:33:20.473), the France-Spain AC lines opened on loss of synchronism (12:33:21.535), and the HVDC link tripped last (12:33:23.960), completing the electrical separation. The Iberian Peninsula went dark. France lost only ~7 MW of load and one nuclear unit, the disturbance did not propagate into Continental Europe.
The Final Report is emphatic that this was, above all, a voltage-control failure. Increased reactive-power margins, its simulations show, could have prevented the collapse. The reactive resources that could have helped were, in large part, present but not deployed.
Three structural gaps stand out. RES plants ran on a fixed power factor, so they absorbed reactive power in proportion to output and did nothing to oppose the voltage rise. Several conventional units sat below their reactive reference for more than a quarter of the hour, with no economic consequence for missing it. And shunt reactors were switched manually requiring operator decisions and processing time the cascade did not allow. Layered on top, many over-voltage protection settings diverged from the applicable requirements, and Spain’s wider 400 kV operating band left almost no margin between “allowed” and “disconnect.”
Much of the early loss came from below the transmission grid. Between 12:32:00 and 12:32:57 net load in the distribution grids rose ~317 MW, part voltage-dependent load, part rooftop PV under 1 MW disconnecting as inverter over-voltage protection activated. The report correlates the proportion of small-inverter trips directly with rising transmission voltage and TSO-DSO flows.
The blackout had no single cause. The Panel’s root-cause tree shows a set of concurrent contributing factors converging on one outcome, an uncontrollable voltage rise which then cascaded to collapse.
Restoration began immediately, combining bottom-up black-start islands with top-down re-energisation from France and Morocco. Portugal was back within 12 hours and Spain within 16, a credit to fallback strategies and operator commitment, though the Panel flagged black-start difficulties, voice-communication failures, and poor observability of distribution-level restoration.
A ten-hour voltage event erased hundreds of millions of euros of output. The asymmetry is the point: a robustly growing economy absorbed the shock, but scaled across Europe’s decarbonising grids, the resilience premium is very real.
The very first factor in the Panel’s root-cause tree is not a device that failed, it is a blind spot: the absence of real-time monitoring of the gap between reactive-power output and its reference as voltage approaches critical levels. Closing that gap is the whole game. Preventing a repeat means continuous, wide-area observability of reactive-power margins and voltage-stability headroom across the TSO-DSO boundary tracking emerging oscillation modes and over-voltage build-up, and surfacing the “point of no return” minutes before it arrives, rather than in the post-event report. The data to do this already exists in PMU, SCADA and inverter telemetry; what has been missing is the layer that fuses it into an early warning an operator can act on.
We work with system operators and asset owners on reactive-power observability, voltage-stability early warning, and cross-boundary TSO-DSO visibility. If the mechanisms in this case study map onto risks in your system, let’s talk.
Reach out to discuss →