Final analysis of the 2025 Iberian blackout: How policy left Spain at risk

Background

In the wake of the 2025 blackout that rippled across the Iberian Peninsula, engineers confronted an uncomfortable truth: the grid didn’t fail only because something broke. It failed because a large number of devices did exactly what they were allowed to do under existing rules.

That paradox sits at the center of the final analysis released by Iberian grid operators and their partners. The report concludes that policies, standards, and legacy settings—especially in Spain—permitted too much equipment to trip offline at the edge of what most operators would consider “normal” operating conditions for a modern power system. The loss of that equipment at precisely the wrong moment turned a routine disturbance into a cascading event.

If this story sounds familiar, it’s because it echoes a pattern seen in other high-renewables grids from Australia to the UK: as the system’s physics changes, rules that once seemed harmless can, in aggregate, create sharp edges. The 2025 event is, in effect, a case study in how today’s electricity grids are only as robust as the weakest, most permissively configured device that’s connected to them—especially when millions of such devices behave the same way.

Why Iberia is a special case

Semi-isolation: Spain and Portugal are still comparatively weakly interconnected with the rest of continental Europe. Limited cross-border capacity means local disturbances aren’t always smoothed out by the sheer inertia and diversity of the broader European system.
A rapid renewables buildout: Spain, in particular, added large volumes of solar PV in the 2010s and early 2020s, much of it under earlier codes or manufacturer defaults that didn’t anticipate today’s system needs. That created a tail of legacy devices with permissive trip settings.
Changing grid physics: With fewer synchronous plants online at any given time, the system can have lower inertia and faster frequency dynamics. Small errors and local voltage swings propagate faster, and protection gear must be tuned accordingly.

What happened

The triggering incident (an otherwise manageable network disturbance) initiated a modest frequency and voltage deviation—well within the bands a resilient system should ride through. In a large, high-inertia grid with uniformly modern ride-through requirements, that would have been a footnote. On the day, however, it wasn’t.

Here’s the sequence described in the final analysis:

A disturbance pushed frequency and voltage toward the edge of normal operating ranges.
Thousands of devices—particularly inverter-based resources (distributed solar PV, some utility-scale units running conservative firmware), industrial variable-speed drives, and certain protection relays—detected conditions close to their programmed thresholds and disconnected almost simultaneously.
That mass disconnection instantly altered the power balance. In some places it was a sudden loss of generation (PV dropping out). In others it was the abrupt loss of controllable load or reactive power support. Either way, it sharpened the frequency deviation.
The deviation then tripped other layers of protection (including additional DER and some network elements), making what began as a routine event snowball into a regional outage.

Two features of the event stood out:

Cliff effects at the edge of “normal”: The analysis underscores that many devices were allowed, by policy or by national implementation of European codes, to disconnect at thresholds barely outside day-to-day fluctuations. That meant a narrow shift could tip thousands of small, invisible switches at once.
Heterogeneous device behavior: Not all inverters, drives, and relays acted the same way. Some rode through without incident. Others disconnected immediately or after a short counter. The lack of coordinated, staggered, and verified settings amplified the net effect.

The policy and standards side of the story

European network codes require generators and devices to ride through a range of frequency and voltage conditions. But those codes have wide parameter bands, transitional periods, and national discretion in implementation. The final report argues that Spain’s implementation left more room than advisable for legacy and small devices to adhere to permissive defaults. Examples include:

Narrow frequency ride-through: Many distributed solar systems, certified years earlier, were allowed to disconnect near the very edge of what utilities consider normal frequency drift, rather than at more conservative, system-supportive levels.
Limited fault ride-through counters: Some inverter firmware permitted only a handful of rapid voltage dips before tripping. A burst of closely spaced dips during the event exhausted counters and triggered mass drop-offs.
Protective relays tuned for asset safety, not system stability: Industrial drives and facility-level protection often favored aggressive self-protection settings. Individually rational, those choices were systemically risky when mirrored across thousands of sites.
Administrative lag: Updates to codes had been published, but not all older assets were retrofitted or recertified. In many cases, device telemetry was absent, making detection and enforcement difficult.

Portugal, facing a similar technology mix, had a smaller tail of such legacy devices and, in certain categories, stronger enforcement of updated settings. The blackout was felt across the peninsula, but the analysis suggests Spain’s installed base left it more exposed to a cascading effect.

Why this matters more in high-renewables grids

In a synchronous, fossil-heavy grid with high inertia, frequency moves slowly. Devices can be conservative without causing synchronized trips. But in grids with large fractions of inverter-based generation and reduced synchronous inertia, frequency can change faster, and voltage support is more localized. In that environment:

Inverter ride-through is system-critical. Defaults that prioritize anti-islanding or asset protection can destabilize the grid if widely shared.
Reactive power and voltage control from small devices matter. If they all relinquish support at once, voltage sags can propagate.
RoCoF (rate of change of frequency) thresholds need harmonization. Wide variation in relay and inverter RoCoF trip levels (and filtering) can create hidden cliffs.

Key takeaways

The blackout was a policy failure as much as a technical one. No single part failed catastrophically. Instead, permissive standards and fragmented enforcement allowed many small, individually compliant decisions to align into a system-level hazard.
“Edge of normal” is not safe. Equipment capable of disconnecting at the margins of day-to-day frequency or voltage fluctuations creates synchronized behavior. That turns routine disturbances into pileups.
Distributed energy resources (DER) are now bulk power resources. Rooftop PV, small commercial inverters, EV chargers with grid support, and industrial drives collectively wield system-scale influence. Treating them as “behind the meter” and beyond coordination is no longer tenable.
Legacy tails matter. Large numbers of older devices, installed under earlier rules, can set the effective stability of the whole system. Unless those devices are updated or gradually retired, paper standards won’t fix actual risk.
Telemetry is the missing link. Operators can’t manage what they can’t see. Anonymous, privacy-preserving telemetry—even aggregated—helps system operators quantify risk and target remediations.
Iberia’s interconnection limits magnify local issues. Until the peninsula has stronger ties with the rest of Europe, local stability services and ride-through enforcement are the first line of defense.

What should change

Tighten and enforce ride-through envelopes for all DER. Minimum frequency and voltage ride-through requirements should prevent mass tripping during credible contingencies, with staggered, randomized reconnection to avoid secondary shocks.
Mandate firmware updates for legacy fleets. Provide a clear pathway—technical, legal, and financial—for updating inverters, relays, and drives. Where updates aren’t possible, require mitigation (e.g., external controllers) or accelerated replacement.
Harmonize RoCoF protection and filtering. Coordinate thresholds across generation, DER, and industrial loads to reduce synchronized trips. Include verification tests during commissioning.
Require basic DER telemetry. Even a few seconds of delayed, anonymized data on connected capacity and operational state dramatically improves operator situational awareness and post-event analysis.
Expand fast frequency response and grid-forming capabilities. Utility-scale batteries, wind, and solar should provide validated fast frequency response. For critical nodes, grid-forming inverters can add synthetic inertia and strengthen voltage.
Align customer and system incentives. Rebates, tariffs, and interconnection agreements should reward settings that support the grid (e.g., Volt-VAR, Volt-Watt, droop-based frequency response) and penalize risky configurations.

What to watch next

National code revisions. Expect Spain to tighten national implementations of European network codes for small generators and DER, with clearer enforcement and certification priority for high-risk areas.
A retrofit playbook. Look for programs that bundle firmware updates, smart reconnection logic, and telemetry into a single visit for residential and commercial sites—ideally with utility funding or shared savings.
Grid-forming pilots at scale. Iberian operators are likely to accelerate pilots for grid-forming inverters at renewable and storage plants, especially near weak nodes.
Interconnection with France. Political and environmental hurdles remain, but new interconnect capacity would dilute local disturbances and provide access to broader European balancing resources.
Data and models. Better DER behavior models in system studies are overdue. Watch for requirements that manufacturers disclose standardized dynamic models and ride-through logic to operators.
Industrial protection reform. Expect updated guidance and audits for industrial facilities with large variable-speed drives and sensitive protection schemes, ensuring they ride through credible events.

FAQ

What exactly is “ride-through”?

Ride-through refers to a device’s ability to stay connected and operate during short disturbances in voltage or frequency. Good ride-through prevents mass disconnections that can turn a small problem into a large one.

Why did so many devices disconnect at once?

Because many shared similar thresholds and logic. If a country’s policies allow devices to trip at or near common “normal” limits, then a small deviation can trigger a synchronized response.

Isn’t disconnecting protective?

For a single device, yes. But if thousands of devices disconnect together, the system can become less stable for everyone. Modern standards try to balance asset protection with system stability.

Why was Spain more exposed than Portugal?

The final analysis points to Spain’s larger population of legacy devices installed under older, more permissive rules and slower retrofit progress. Portugal had fewer such devices and, in some categories, stricter enforcement—though both countries were affected.

Can software updates really fix this?

Often, yes. Many inverters and protection relays can be updated with better ride-through settings, improved filtering, and smarter reconnection logic. Where hardware is too old, replacement or add-on controllers may be needed.

Will building more interconnectors solve the problem?

Stronger interconnections help, but they don’t replace good local standards. A well-connected system can still suffer if embedded devices share risky trip settings.

What’s different about inverter-based grids?

Inverter-based resources don’t inherently provide inertia or voltage support the way synchronous machines do. They must be programmed to emulate those services—and their protection must be coordinated to avoid synchronized trips.

What can consumers do?

If you own solar or industrial equipment, ask your installer or vendor about current ride-through settings and firmware versions. Utilities may offer update programs or incentives to bring devices in line with new requirements.

Source & original reading

Original article: https://arstechnica.com/science/2026/03/final-analysis-of-2025-iberian-blackout-policies-left-spain-at-risk/

What the 2025 Iberian Blackout Teaches Us: When “Normal” Settings Aren’t Safe