The Iberian Blackout: A Black Swan or a Gray Rhino? A Thorough Power System Analysis

Abstract: On April 28, 2025, the Iberian power system suffered a full blackout. It was the first documented overvoltage-driven cascade in Europe. The event sparked debate about root causes, including high renewables output, low inertia, and operator actions. This paper presents a thorough power system analysis of the incident to sort signal from noise and explain, step by step, how the blackout unfolded. Specifically, we (i) reconstruct the timeline and causal chain of the incident, (ii) present and summarize contributing factors using factual findings from incident reports, (iii) reproduce the blackout on an IEEE test system, (iv) analyze the incident from a system-theoretic, voltage-control perspective, and (v) translate our analysis into practical, technical measures that aim to mitigate and prevent similar incidents.

• The paper demonstrates that protocol-driven topology modifications and operator interventions can trigger a rapid, cascading overvoltage collapse.
• The DAE framework quantitatively replicates system dynamics, linking >400 MVAr reactive losses to accelerated voltage escalation and protection trips.
• The study recommends real-time, stability-aware voltage margin tools and refined emergency coordination to mitigate risks in high-IBR, low-load conditions.

System-Theoretic Dissection of the April 28, 2025 Iberian Blackout

Event Chronology and Failure Mechanisms

The April 28, 2025 blackout on the Iberian Peninsula represents a paradigmatic instance of cascading overvoltage collapse in a mixed-synchronous/high-IBR grid. Distinguished from antecedent European blackouts by its genesis in sustained overvoltage, the event unfolded as conventional protection and operational protocols inadvertently interacted to undermine stability.

During light loading and unprecedented renewable penetration (82\%), oscillatory events prompted protocol-driven operator responses: meshing of major transmission corridors, shunt reactor disconnections, and reconfiguration of the Spain-France HVDC link. These interventions—intended for oscillation damping—reduced natural reactive absorption, stiffened network responses, and transformed the transmission-distribution interface dynamics.

Figure 1: High-level chronology of the April~28 blackout, delineating precursor oscillations, operator interventions, protection trips, and systemic collapse.

The critical initial failure was the tripping of a generation transformer at a collector (220 kV) due to local overvoltage—unobservable at the transmission level—which initiated a rapidly reinforcing positive feedback: each MVAr absorption loss caused further voltage elevation, precipitating sequential protection trips and widespread generation loss within approximately 30 seconds.

Dynamic Feedback Structure and DAE Model Analysis

The paper systematically reconstructs these cause-effect chains within a differential-algebraic equation (DAE) framework, elucidating how generator dynamics, network algebraics, and control actions intertwined under topological transformations.

Figure 2: Feedback loops underlying the cascading overvoltage collapse: stabilizing (dashed) actions via AVR failed due to compliance gaps, while trip-induced positive feedback (solid) led to accelerating voltage rise.

A central insight is the system's transition from negative feedback (voltage control via reactive absorption) to positive feedback driven by collector trips. Limited AVR compliance, deadband settings per P.O.~7.4, and near-instantaneous protection logic rendered the transmission system unable to absorb sudden $Q$ deficits, forcing algebraic rebalancing via voltage elevation. The effect is quantified through the network's $J_{QV}$ block: post-meshing, the topology-stiffened system possesses heightened voltage sensitivity to $Q$ disturbances.

Figure 3: Block diagram of the linearized DAE: dynamic states, algebraic network, and control/disturbance pathways depicted.

Topology Modifications and the Impact on Control Margins

Meshing, shunt reactor disconnection, and HVDC mode change each degraded voltage control via distinct but coupled mechanisms. Meshing reduced series reactance, lowering baseline MVAr absorption and steepening the $Q-V$ profile; reactor removal constrained available reactive buffer, and fixed-power HVDC operation eliminated frequency-damping flexibility.

Figure 4: Schematic illustration of parallel line meshing: reductions in reactance increase voltage sensitivity network-wide.

Figure 5: Meshing impact: parallel circuit energization precipitates greater overvoltage excursions, with the red (meshed) trajectory exceeding relay protection thresholds while the teal (unmeshed) case retains margin.

Operators lacked real-time tools capable of quantifying the voltage-control margin loss induced by these actions. Modal analysis focused on small-signal oscillatory stability, omitting finite-horizon voltage recovery capabilities, trajectory sensitivities, and nonlinear protection-coordination effects.

Transmission-Distribution Observability Mismatch

A key architectural vulnerability was the misalignment between transmission-level observations and collector-level reality. Transformer tap positions, lagged from morning undervoltage events, created conditions where collector voltages could exceed protection thresholds even as transmission buses remained nominal.

Figure 6: Protection mismatch: transformer tap settings induce collector overvoltage, tripping relays while transmission readings remain below system limits.

Distributed generation operating in reverse flow further complicated the $Q$ management landscape, with operators blind to MVAr absorption/injection dynamics downstream of step-up transformers. This observability gap fueled positive feedback, obscuring emergent risk until reactive absorption losses became non-recoverable.

Quantitative Replication and Cascade Dynamics

A physics-informed replication on the IEEE 39-bus system, constructed via ANDES, demonstrates the event sequence and validates the feedback structure. Collector bus emulation, calibrated protection logic, and topological interventions reproduce cascade acceleration, delineating the temporal coupling between operator actions, collector trip propagation, and system collapse.

Figure 7: Replication on IEEE 39-bus system: time series reveal transmission voltage escalation following operator actions and sequential collector trips, with the cascade window annotated.

Figure 8: Quantitative $Q$-V coupling: cumulative reactive absorption lost (blue) drives maximum transmission voltage rise (red), emphasizing the positive feedback loop during cascade.

Strong numerical results highlight the sensitivity: >400 MVAr loss triggers voltage escalations across the whole transmission corridor, closely matching empirical incident behavior. The simulation establishes the sufficiency of topology/AVR/protection interplay, contesting claims that inertia or renewable penetration alone were dominant causal factors.

Implications, Recommendations, and Theoretical Reflections

The blackout exposes an operational gap in modern grid management, particularly under high-IBR scenarios:

• Dynamic voltage margin verification must augment protocol-driven topology actions; simple modal analyses are insufficient.
• Stability-aware meshing: Future implementations should leverage trajectory sensitivities and finite-horizon voltage control assessments to quantify consequences beyond traditional small-signal paradigms.
• Voltage-aware emergency coordination: UFLS must optimize both $P$ and $Q$ removal—shedding low $Q/P$ loads preferentially—to avoid paradoxical acceleration of voltage instability.

The incident underscores the need for real-time, DAE-informed operator support tools that integrate fine-grained voltage, reactive, and frequency dynamics, accounting for distribution-transmission interface weaknesses and nonlinear protection interactions.

Conclusion

The April 28 Iberian blackout constitutes a vivid illustration of how cascading voltage collapse can emerge from interacting protocol-driven operator actions, protection coordination errors, and architectural mismatches in observability under high-renewable, light-load conditions. The paper provides a rigorous system-theoretic account, contesting inertia and renewable penetration as singular causes, and instead foregrounding dynamic voltage control authority, topology-induced sensitivity amplification, and control-and-observability gaps.

Implementation of defense-in-depth measures, leveraging DAE frameworks and trajectory sensitivity analysis, is necessary to transition from synchronous-centric paradigms to resilient, high-IBR grid operation. The event is best interpreted as a Gray Rhino—a visible, probable threat manifesting due to neglected vulnerabilities—rather than an unpredictable Black Swan.

---