The GRANADA Incident

It could be the title of Shyamalan’s next movie or the real trigger of the Iberian Peninsula blackout. In both cases, one thing is certain: nothing good will come of it.

Yesterday, Sara Aagesen, Minister for Ecological Transition and the Demographic Challenge, shared new details about the investigation into the blackout. For non-Spanish-speaking readers, it's important to note that her choice of words matters, and the way she presented the information allows for different technical interpretations. Therefore, following her appearance in the Spanish Parliament, the Spanish TSO, Red Eléctrica de España (REE), released a statement that appears to amend, or clarify, the Minister’s remarks.

Let’s try to untangle the situation, not by speculating, but by sticking to a (official) data-driven analysis, as always.

A substation in Granada.

The Minister stated that: "A few minutes after 12:30, a process of successive generation losses began" (left photogram). And then she proceeds to elaborate that information, saying that first one was "a generation loss at a substation in Granada" (right photogram).

Substations are not generation plants; they are essentially components of the transmission or distribution network. Technically, we can interpret that what the Minister really meant was that the loss of generation was detected at a substation, understood as a point where the power flow between generation plants and the transmission grid can be measured. However, it’s also possible to interpret that a substation failure interrupted the power flow. In light of this ambiguity, REE published a clarification

"The transmission network, that is, the one managed by REE, did not experience any incidents on April 28. The three generation loss events prior to the blackout were caused by factors unrelated to the transmission network. The origin of these disconnections could be traced to the generation plants themselves or to networks not managed by Red Eléctrica."

This statement is quite important, not only does it clarify the Minister’s remarks, but it also provides a crucial detail: REE did not detect any issues within the transmission network it operates, pointing instead directly to the generation plants or to ‘networks not managed by Red Eléctrica.’ What does this imply? It could mean the distribution network. However, at this point, I’m reluctant to consider that a distribution failure in a province of 940,000 inhabitants could have caused a total blackout.

So, let’s focus on the generation plants and their associated substations.

Power grid in Granada

The top 3 primary sources to the power mix in Granada are:

• Photovoltaic: ~584 MW, plus 214 MW of self-consumption installations.
• Wind : ~407 MW
• Thermosolar: ~150 MW

In general terms, the largest generation plants are around 50 MW each, occasionally grouped together to reach up to 150 MW. There are no large-scale plants.

For instance, top photovoltaic plants:

1. Kissoro (50 MW)
2. Fotosfera (50 MW)
3. Solar Sunplex (50 MW)
4. Pinos Puente I, II, III and IV (175 MW)
5. Las Salinas (30 MW)
6. Los Llanos (50 MW)
7. Los picos (19 MW)
8. Alhendin I (41 MW)

So, why did REE want to explicitly amend the Minister’s description of the issues? I’d guess it’s because there’s a lot at stake, and because, technically, they did the right thing to avoid misunderstandings. REE does not own all components of the Spanish power grid. As I introduced earlier regarding third-party generation control centers, some substations and lines are not operated by REE.

Instead, between the generation plants and the REE's substations there are a series of 30kV/66kV/220kV/400kV substations operated by different private entities.

To illustrate this, I created the following (non-canonical but based on real data) single-line diagram

On the right side, we find generation plants such as photovoltaic installations (e.g., Kissoro, Fotosfera, Solar Sunplex), wind farms (e.g., Ferreira, Dólar), and thermosolar plants (e.g., Andasol I, II, III). From there, the energy flows through various substations before reaching REE’s Huéneja substation, which is operated by REE.

As we can see, REE’s control centers have direct visibility over their own substations (Caparacena and Huéneja), but not necessarily over all others. That said, this doesn’t mean they are unaware of what’s happening at the remaining ones.

So, did everything start in Granada?

Well, that might be the case, the Spanish government itself has pointed to it, and the numbers do add up. Let’s take a look at why.

It is theoretically possible to estimate the amount of megawatts (MW) lost by analyzing the frequency drop. This depends on a frequency coefficient set annually by ENTSO-E for each zone, in our case, Spain. However, this coefficient is not publicly available. As I explained in the Week 1 analysis, I attempted to estimate this K-factor by using the total TSO K-factor for the Continental Europe grid and applying Spain’s approximate share, arriving at ~2000 MW/Hz. A few days later, Leonhard Probst published his analysis and reached the same value using the same approach, providing a helpful point of comparison.

This means two things:

1. The first generation loss event caused a frequency drop of approximately 25 mHz, which suggests that around 50 MW were suddenly lost. As we've seen, 50 MW is roughly the average capacity of the largest generation plants in Granada.
2. ~20 seconds later, 2200 MW were lost, which would have brought the frequency close to 49 Hz. (GridRadar's data doesn’t seem entirely accurate here, as the drop should have been more pronounced according to the ENTSO-E timeline). Once again, this aligns with a K-factor of approximately 2000 MW/Hz.

It’s entirely plausible that generation plants in Granada tripped, whatever the reason, or that there was a failure in a non-REE substation. Why this ultimately led to a total blackout is a completely different story.

Conclusions

From a cyber perspective, it's particularly interesting to consider Granada as the potential trigger for the cascade of failures. The power mix and total power production in the region make it entirely feasible for such an event to be replicated through cyber means, and I repeat, entirely feasible. However, I'm not suggesting this is what happened, but it’s crucial that we examine the final reports carefully.

Even if this blackout had no targeted cyberattack component (which I don’t believe it does), it could still redefine how we think about cyberattacks on decentralized power grids.