The Iberian Blackout: A Black Swan or a Gray Rhino? A Protection-Aware Dynamic Voltage Security Assessment

Abstract

On 28 April 2025, the Iberian mainland power system collapsed after a rapid voltage rise, widespread generation disconnections, and loss of synchronism. The ENTSO-E Expert Panel final report attributes the blackout to multiple interacting factors including ineffective voltage control, fixed power factor reactive behavior, fast generation ramps, protection settings not aligned with requirements, slow or unavailable reactive absorption, and limited observability outside the transmission system. This paper uses the incident as a motivating case for a broader operational voltage security problem: given the present grid state, can the next plausible trip, ramp, topology action, or shunt action push protected downstream voltages above relay thresholds before available voltage controls can respond? We develop a protection-aware dynamic voltage security assessment for this question. Starting from a nonlinear hybrid differential-algebraic equation (DAE) model, we derive mode wise finite window voltage maps that include automatic voltage regulators (AVRs), inverter-based resources (IBRs), static synchronous compensators (STATCOMs), high-voltage direct-current (HVDC) links, loads, shunts, transformers, protection functions, and limiter behavior whenever the corresponding models are available. We define normalized overvoltage margin erosion at the protection measurement side and time resolved lower bounds on useful control response. We then develop a monotone pickup cascade screen, robust data-limited certificates under uncertain relay and protected-voltage data, and a mitigation optimization that computes the minimum fast reactive action needed to keep protected voltages below relay thresholds. Case studies on a 2000-bus mechanism replica and multiple dynamic benchmark systems show that the screen predicts nonlinear cascade propagation.