On 17 June Spain’s vice president and minister for ‘Ecological Transition and Demographic Challenge’, Sara Aagesen, presented to the Spanish Council of Ministers the report from the Committee for the analysis of the circumstances surrounding the major blackout of 28 April.
The report concludes that several factors contributed to the incident, resulting in a “cascade of events that progressively destabilised the system and culminated in the peninsula blackout due to overvoltage.” It includes a set of recommendations ranging from improving control and supervision of the behaviour of power plant operators and other organisations involved with the grid to increasing the level of interconnection with France. It is expected that the Council of Ministers will approve several measures, by next week.
The Committee’s two working groups, the Cybersecurity and Digital Systems Working Group and the Electrical System Operation Working Group, had the task of analysing over 300 GB of information. The first conducted the largest cybersecurity investigation in Spain’s history, with the participation of more than 75 experts. After analysing 133 GB of data it ruled out the possibility that the incident was caused by a cyberattack, either in the system operator’s facilities, or in the power plants analysed. The Operation Working Group made 770 information requests and analysed 170 GB of data.
Incident timeline
The Committee identified a sequence of events from which several conclusions have been drawn.
- Phase 0. In the days before the incident, voltage fluctuations occurred and on the morning of the 28th, the variations intensified.
- Phase 1: 12.00 noon– 12.30 pm. System oscillations. At 12:03 PM, an atypical oscillation of 0.6 Hz was recorded, causing significant voltage fluctuations for 4.42 minutes. This forced the system operator (SO) to apply ‘protocolised measures’ such as increasing the network’s meshing or reducing the interconnection flow with France. These actions worked but had the side effect of increasing voltages. At 12:16 pm, a smaller oscillation was recorded, and another at 12:19 pm. The SO applied the same measures to dampen it, which also contributed to increased voltage.
- Phase 2: Generation losses (12:32:57 – 12:33:18). Voltage began to rise rapidly, leading to numerous and progressive disconnections of generation facilities in Granada, Badajoz, Segovia, Huelva, Seville, Cáceres, and other provinces.
- Phase 3: Collapse (12:33:18 – 12:33:30). The progressive voltage increase triggered a chain reaction of disconnections owing to overvoltage that could not be contained, as each disconnection contributed to further voltage increases. A frequency drop was also recorded, leading to a loss of synchronisation with France, the disconnection from the rest of the continent, and the Iberian peninsula blackout.
Restoration
Restoration of the supply followed, thanks to energy contributions from interconnections with France and Morocco, and production from autonomous-start power plants (hydroelectric) in the Duero basin and elsewhere, forming growing energy islands. As a result, by 10:00 pm, almost 50% of the country’s electricity demand was being met, growing to 99.95% by 7:00 am on the 29th. Although the restoration has been considered a model by international standards, the Committee’s analysis identified additional best practices that could have been followed.
Main conclusions
The Committee concluded that the origin of the blackout involved three elements:
- Insufficient voltage control capacity. On 27 April the SO scheduled the operation of ten synchronous plants capable of regulating voltage for April 28. The final number of such plants entering operation was the lowest since the beginning of the year. In addition, several plants capable of regulating voltage did not adequately respond to the SO’s instructions to reduce it; some even produced reactive energy, exacerbating the problem.
- Oscillations occurred. The oscillations – the first originating in a facility on the Iberian peninsula – forced modifications to the system’s configuration, increasing its difficulties in stabilising voltage. After the second instance of oscillation, the SO requested the availability of a power plant capable of contributing to voltage regulation, but it was impossible for it to act before the collapse.
- Generating plants were disconnected, some apparently improperly. Some were disconnected before exceeding the voltage thresholds established by regulations (between 380 kV and 435 kV transmission), while others disconnected after exceeding these limits to protect facilities. Once the chain reaction began, the usual protections of the electrical system could not stop or contain this process. Some protections, such as load shedding, may have even contributed to overvoltage by further unloading lines as they acted to compensate for generation loss rather than manage voltage. In summary, there was a lack of voltage control resources, either because they were not sufficiently programmed, because those programmed did not provide adequate control, or a combination of both. But the blackout was not due to a lack of resources in the country; there was a more than sufficient generation capacity to respond.
Main recommendations
Based on conclusions deriving from the analysis, the Committee proposes a series of preventative actions, including strengthening supervision and verification of compliance with obligations by all participants in the electrical system, as well as technical measures to enhance voltage control and protection against system oscillations.
A key point is the implementation of PO 7.4, under the National Commission of Markets and Competition (CNMC), which will allow asynchronous facilities to apply power electronics solutions to manage voltage variations and may help reduce costs by introducing more competitive technologies.
