Andy Garcia · freelance dev
FRENES
Back to the blog
Engineering

Iberia's Blackout Had No Single Cause. All 8 Trip Settings the Panel Saw Diverged From the Rules.

October 20, 2026 8 min read

On April 28, 2025, at 12:33 Central European Summer Time, the power systems of continental Spain and Portugal collapsed. Spain lost 25,638 MW of demand, all of it. Portugal lost 5,900 MW, all of it. Portugal's transmission grid was restored by 00:22 the next morning, Spain's by about 04:00. The investigation published by ENTSO-E, the association of Europe's transmission system operators, calls it the most severe blackout in Europe in the past 20 years.

On March 20, 2026, the expert panel set up under EU rules published its final report: 472 pages, written by 49 experts (30 from energy regulators, 19 from grid operators, regional coordination centres and ENTSO-E bodies), led by two experts from operators that were not directly affected, Klaus Kaschnitz of Austria's APG and Richard Balog of Hungary's MAVIR. It builds on a factual report from October 3, 2025, and it states up front that it is "not intended to assign liability".

I am not a power engineer. I build and run software, and the first draft of an incident review often wants one culprit. This one refuses to name one, on purpose. I read its management summary, the trip-by-trip analysis, the voltage-control chapter and the recommendations. Here is how the grid failed, and what I think transfers.

The 78 seconds, simply

An AC grid must keep its voltage inside a band. Operators steer voltage with reactive power: some equipment absorbs it and pulls voltage down, while lightly loaded high-voltage lines push it up. Just before the event, production in Spain's south-west was very high relative to local consumption.

Two bouts of oscillation came first. From 12:03 to 12:08, a local swing at 0.63 Hz, which the panel classifies as a converter-driven forced oscillation, strongest near an inverter-based power plant. From 12:19 to 12:22, a 0.2 Hz swing between eastern, central and western Europe. Control rooms damped both by cutting exports to France, coupling lines and changing the mode of the HVDC link to France. It worked. It also raised the voltage.

From 12:32:00, voltage climbed at many nodes. Within 48 seconds, large renewable plants cut their output by about 500 MW. They ran at a fixed power factor, as Spain's rules for renewables provided: they absorbed reactive power in proportion to their output and ignored the voltage. Less output meant less absorption, so voltage rose further. In the panel's analysis, several conventional plants provided less reactive power support than their reference called for. Shunt reactors, the grid's static tool for absorbing reactive power, were switched by hand, and some had been disconnected minutes earlier because voltage was then too low.

At 12:32:57, the first major trip: a 400/220 kV transformer near Granada, carrying 355 MW. Then 727 MW near Badajoz at 12:33:16, and 928 MW across five provinces by 12:33:18. Those trips removed plants that had been absorbing reactive power, which pushed voltage higher and set off more trips. Counting lost generation and a rise in net load in the distribution grids, the panel adds up more than 2.5 GW between 12:32:00 and 12:33:18. That is 78 seconds.

At 12:33:19, Spain and Portugal began losing synchronism with the rest of Europe. Automatic load shedding fired as designed and could not stop the collapse. At 12:33:21.535, protections opened the lines to France, which kept the disturbance out of the rest of the continent.

A tree, not a culprit

The panel's method is "loosely based on the Five Whys". Its answer is a root cause tree, and it says explicitly that the order of the factors does not rank them. The list includes the fixed power factor, several conventional generators that met their reactive power reference in fewer than 75% of samples, a rule with no dynamic requirement and no economic consequence, no ramp limit for fixed-power-factor plants, manual reactors, protection settings out of line with requirements, rooftop solar tripping on overvoltage, and a Spanish 400 kV grid run in a wider voltage band than the rest of Europe.

Two further points matter as much as the list. Simulations indicate that even significantly higher inertia would not have prevented the loss of synchronism, while larger reactive power margins could have prevented the collapse. And for many trips, the panel could not establish the cause: owners cited a lack of fault records.

Red Eléctrica, the Spanish operator, said on March 20 that the report shows no non-compliance or conduct on its part that could have caused the blackout. On April 17, 2026, Spain's regulator, the CNMC, opened sanction proceedings over indications of non-compliance, adding that they do not by themselves attribute the cause of the blackout to the companies concerned. Spanish press reported about 20 that day, one of them against Red Eléctrica itself, and Europa Press reported more a week later. The CNMC says such proceedings last at most nine to 18 months, depending on the severity of the alleged infringement.

Four details I keep coming back to

The control metric lived in a monthly report. Under Spain's Operational Procedure 7.4, published in 2000, the operator calculated each conventional generator's expected reactive power, its Q-reference. That reference was not sent in real time. It was used after the fact, for remuneration, penalties and monthly fulfilment reports, and the operator did not monitor the gap close to real time. The service counted as delivered if at least 9 of the 12 samples in an hour complied. Penalties existed on paper, but the panel says they appear not to have applied in practice, because the economic scheme they required had not been developed. The CNMC's president, in turn, told Spanish lawmakers on April 21, 2026 that the procedure was in force and binding on the day. An amendment proposed in 2021 was approved in June 2025, after the blackout. The software analogy, and it is only an analogy: a service-level objective that exists only in the invoice.

The margin was zero to 5 kV. Europe's harmonised range for the 400 kV grid is 380 to 420 kV, which the report says is "designed to ensure sufficient safety margins between normal operation and voltages where disconnections occur". Spanish provisions let the operator run the grid up to 435 kV, while generators had to stay connected only up to 435 or 440 kV, depending on when they were commissioned. The highest voltage the grid was allowed to reach and the voltage at which generators were allowed to disconnect were almost the same number.

A cutoff nobody upstream reviewed. The owner of the Granada transformer had set it to trip at 242 kV on its 220 kV side, 1.10 per unit, with zero delay. The operator did not review that setting, because it did not need to be coordinated with transmission protection. Just before it tripped, the 400 kV side read 417.9 kV, inside the normal range. A recorder about 500 meters away does not show the 5-millisecond transient that triggered it; the panel considers a measurement transient or a relay error possible. Across the 19 trips between 12:32:57 and 12:33:19, 18 of them after 12:33:16, the panel finds that 9 diverged from the applicable requirements, for 1,866.7 MW. It received the overvoltage settings of 8 protection devices. All 8 diverged.

There had been a rehearsal. On April 22, six days earlier, Spain's commercial net position fell by 1.6 GW at 19:00 as generation schedules changed, while solar output faded. Voltages rose; one 400 kV measurement point registered 452 kV at 19:02:27, and some generation and demand facilities disconnected on overvoltage. About three minutes after 19:00, conventional plants that were connecting reached their technical minimum and could control voltage, and by 19:05 the operator had connected 22 shunt reactors. April 22 brought no cascade, and no investigation under the European incident classification scale. Among the differences the panel points to: on April 22, there were no significant oscillations and no low-voltage spell before the rise.

What I would copy

Not the physics. The habits.

  1. Watch the control objective live. A metric computed only for a monthly report is not a control.
  2. Write down the margin between normal operation and the point where the system disconnects itself, and alert well before it.
  3. Inventory the protections other parties set on your system. A third party's zero-delay cutoff is part of your architecture whether you reviewed it or not.
  4. Ask what each fix does to the next failure. Damping the oscillations raised the voltage. Load shedding was there to stop the frequency drop, but some of the units it disconnected, pumped-storage plants for example, were absorbing reactive power, and the report says that intensified the overvoltage.
  5. Treat a near miss as an incident. April 22 got no European incident investigation; April 28 got 472 pages.
  6. Keep the evidence. The panel's leaders exchanged more than 240 emails and letters with third parties in Spain between June 28, 2025 and February 17, 2026 to collect data, and some trips still have no fault record. One of its 21 numbered recommendations asks for a standard post-event data package within 24 hours.

The recommendations are voluntary, and the report says monitoring them is outside its mandate. They include voltage-control mode for generators, automatic control of shunt reactors, applying the harmonised voltage range and black-start tests, preferably every three years.

The grid did not fail because one part broke. It failed because many local settings and rules, each owned by a different party, were never watched together, at the speed the voltage moved.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk