Blackouts: Why Grids Fail All at Once

N-1 and What It Assumes

The founding principle of grid planning is that no single failure should interrupt supply. Every transmission line, transformer and generator is sized so that if any one of them is lost, the rest can carry the load. Operators run this calculation continuously, checking against a list of contingencies and adjusting dispatch when a limit approaches.

The principle works well, which is why grids in developed countries deliver supply well above 99.9 percent of the time. Most faults - a lightning strike, a tree contact, a failed breaker - are absorbed invisibly, and the public never learns they occurred.

The assumption inside N-1 is independence: that failures happen one at a time and for unrelated reasons. Most of the time that holds. What breaks it is correlation. A storm does not take one line, it takes six. A cold snap does not stop one gas plant, it freezes wellheads across an entire basin simultaneously.

Operators know this and plan for selected N-2 combinations, but the space of possible pairs is vast and the cost of designing for all of them is prohibitive. Every grid therefore embodies a judgement about which simultaneous failures are worth protecting against, and large blackouts tend to occur at the edges of that judgement.

How a Cascade Runs

Electricity distributes itself across a network according to physics, not intention. Power flows along every available path in inverse proportion to impedance, so removing one line does not remove its load - it pushes that load onto the remaining paths within milliseconds.

If one of those paths was already near its thermal limit, it now exceeds it. A conductor carrying too much current heats, expands and sags, and its protection trips it before it can touch anything below. Its power now redistributes again. The next line receives more than it can carry, and the process repeats, each step faster than any human could intervene.

The important and counterintuitive point is that nothing is malfunctioning. Every relay is doing its job, which is to protect its own equipment from damage. The cascade emerges from many correct local decisions with no mechanism coordinating them. This is why cascades are properly a systems problem rather than an equipment problem.

Generators join the cascade through frequency. As the network fragments, some islands have more generation than load and some have less. Frequency rises in one and falls in another, and where it moves far enough, generator protection disconnects the plant - removing supply from an island that was already short. The 2003 blackout across the northeastern United States and Ontario, which affected some fifty million people, ran this sequence in about seven minutes from an initial line-and-software failure.

The last automatic defence is under-frequency load shedding. When frequency falls past a threshold, relays disconnect pre-selected blocks of demand without asking anyone. Losing a district deliberately is the price of not losing the region, and it is the reason most incidents end as partial outages.

Two Recent Cases

Texas in February 2021 is often described as a renewables failure and was not. An extended freeze cut output across the generation fleet, with gas contributing the largest absolute loss: wellheads froze, gas processing stopped, and plants that were running lost fuel supply. Some wind turbines iced, as did coal stockpiles and one nuclear unit's instrumentation.

The structural cause was that everything failed for the same reason at the same time. Texas equipment was not winterised to the degree used in colder regions - a rational choice for its normal climate and a costly one that week. Rolling outages lasted days and hundreds of people died, mostly of hypothermia. The debate afterwards concerned whether an energy-only market had procured enough reliability, or whether the failure was one of physical preparation.

The Iberian peninsula in April 2025 lost supply across Spain and Portugal within seconds. Investigations pointed to a voltage and oscillation disturbance that propagated faster than operators could respond, followed by the interconnection with France separating and the peninsula, weakly connected to the rest of Europe, being unable to draw support.

What the two share is structure rather than technology. In each case a contingency that the system was nominally designed to survive met a correlation that had not been modelled, and the defences operated correctly while the outcome was still a blackout. That is the recurring shape of these events, and it is why post-event analysis tends to change planning assumptions rather than equipment.

Why Restarting Is the Hard Part

A power station is a large industrial plant. It needs electricity for its own pumps, fans, control systems and lubrication before it can produce any. In normal operation it draws that from the grid. After a total blackout there is no grid to draw from, which is the circularity at the heart of restoration.

A few plant types can start unaided. Hydroelectric stations need only open a gate. Some gas turbines carry diesel generators sized to start them. These designated black start units are contracted and tested precisely because the capability is otherwise rare.

Restoration then proceeds outward. A black start unit energises a transmission path to a larger station, which uses that power to start itself, and the two together support the next. Load is reconnected in small blocks, because adding too much at once collapses the fragile island being built. Each step must keep generation and demand matched within a system that has almost no inertia yet.

This is why full restoration takes hours at best and days in the worst case, and why operators run black start exercises they hope never to use. It is also an argument for distributed generation and microgrids: a hospital or water treatment plant that can island itself keeps running through the hours when the grid above it is being rebuilt piece by piece.