The Power Grid

From generation to socket

A power grid is the network that carries electricity from where it is generated to where it is used, and the equipment and systems that control it. It has four parts:

• Generation: power plants, wind farms (on land and at sea), solar parks, and increasingly batteries and rooftop solar on the consumer side.
• Transmission: the high-voltage backbone that moves large amounts of power over long distances and across borders.
• Distribution: regional and local grids at medium and low voltage that deliver power to streets and buildings.
• Consumers: households at 230/400 V, businesses, and large industry that may connect directly at high voltage.

Why such high voltages?

The power a line carries is voltage times current. The heat lost in the conductors grows with the square of the current. So for the same power, doubling the voltage halves the current and cuts the losses to a quarter. That is why transformers next to large power plants step the voltage up, and why the backbone runs at hundreds of kilovolts. In the Netherlands the transmission grid typically uses 380 kV and 220 kV for the backbone and 150 kV and 110 kV for regional transport; the distribution grids below run at medium voltages such as 10 or 20 kV and end at 400/230 V in the street. Check the grid operators' own publications for the exact levels in a region.

Every voltage change happens in a substation, and every substation contains switching, protection and communication equipment: that is where most grid OT lives.

Who runs the grid

TSOs and DSOs

A transmission system operator (TSO) owns and operates the high-voltage transmission grid of a country or region, connects it to neighboring countries, and is responsible for system balance: keeping supply and demand equal so the frequency stays stable. A TSO is a natural monopoly and regulated as such.

TenneT is the TSO for the Netherlands and for a large part of Germany; its Dutch and German TSO companies are both members of ENTSO-E.

A distribution system operator (DSO) owns and operates a regional grid at medium and low voltage and connects homes and businesses. In the Netherlands, the largest DSOs are Liander (part of Alliander), Stedin and Enexis. DSOs do not balance the national system, but they manage their own congestion, outages and connections, and they operate thousands of medium and low voltage substations.

Producers and suppliers are separate companies. A household signs a contract with an energy supplier (such as the fictional Kestrel Energy used elsewhere on this site); the physical power flows over the DSO's and TSO's grids regardless of which supplier sells it.

ENTSO-E and the synchronous area

ENTSO-E, the European Network of Transmission System Operators for Electricity, is the association of Europe's TSOs; as of 2026 it lists 40 members from 36 countries. It writes network codes and operational policies with the regulators, coordinates system operation and planning, and publishes investigations into major disturbances.

Most of continental Europe, from Portugal to Poland and from the Netherlands to Greece, forms one synchronous area: every large generator in it rotates in step at the same frequency, 50 Hz. The benefit is shared strength: when a power plant trips in Spain, generators all over the area respond together. The cost is shared risk: a disturbance can spread across borders within seconds. Other synchronous areas, such as Great Britain and the Nordic countries, are connected to it through direct-current links, which transfer power without needing the same frequency.

Frequency and balancing

Electricity on this scale cannot be stored in the grid itself: generation must match consumption at every moment. The grid frequency, the number of complete cycles per second of the alternating voltage and current (50 Hz nominal in continental Europe), shows how well it does. Large generators store kinetic energy in their spinning rotors. When demand exceeds supply, the missing energy is taken from those rotors, they slow down a little, and the frequency drops below 50 Hz. When supply exceeds demand, they speed up and the frequency rises. The frequency is the same everywhere in the synchronous area, so it is a live signal of the balance that every operator can read.

The spinning mass (the system's inertia) slows the change and buys time. Solar panels, batteries and most modern wind turbines connect through power electronics and add little natural inertia, so grids with more of them can see faster frequency changes. This is one of the big engineering topics of the energy transition.

Balancing reserves in plain words

Balancing works in layers that take over from each other:

1. Frequency containment (FCR, frequency containment reserve, formerly called primary control). Within seconds, generators and batteries across the whole synchronous area change their output in proportion to the frequency deviation. This stops the fall, but leaves the frequency slightly off 50 Hz. In continental Europe the FCR is sized, according to ENTSO-E's operational policy, at about 3,000 MW: enough to cover the sudden loss of the two largest generating units.
2. Frequency restoration (FRR, formerly secondary and tertiary control). Within minutes, the TSO of the area where the imbalance started activates its own reserves, automatically (aFRR) and on instruction (mFRR). This brings the frequency back to 50 Hz and restores the planned power exchanges with neighbors, so the other countries can release their containment reserves.
3. Replacement. Over a longer period, schedules and markets replace the reserves used, so they are available for the next disturbance.

If the frequency still falls too far, automatic under-frequency load shedding disconnects blocks of consumers in planned steps to save the rest of the system. If it rises too far, generation is reduced or disconnected.

Frequency deviation and droop in Python

Frequency containment is proportional, and the setting that defines "in proportion" is called droop. A droop of 5% means that a frequency change of 5% (2.5 Hz at 50 Hz) would move the unit through its whole rated output; smaller deviations give proportionally smaller changes. Because every unit responds in proportion, they share the burden without talking to each other. The example uses illustrative values; real units also have a small dead band and limits on how much reserve they offer.

# Grid frequency deviation and a simple droop response.
NOMINAL_HZ = 50.0


def droop_response(freq_hz, rated_mw, droop):
    """Extra output (MW) a governor with this droop adds for a frequency.

    droop = 0.05 means: a 5% change in frequency (2.5 Hz) would move
    the unit through its full rated output.
    """
    shortfall = (NOMINAL_HZ - freq_hz) / NOMINAL_HZ  # per unit, + when low
    return shortfall / droop * rated_mw


rated_mw = 400  # an example gas-fired unit
droop = 0.05

for freq in (50.000, 49.980, 49.900, 49.800, 50.050):
    delta_mhz = (freq - NOMINAL_HZ) * 1000
    change = droop_response(freq, rated_mw, droop)
    print(f"{freq:.3f} Hz  deviation {delta_mhz:+5.0f} mHz  "
          f"unit output change {change:+5.1f} MW")

50.000 Hz  deviation    +0 mHz  unit output change  +0.0 MW
49.980 Hz  deviation   -20 mHz  unit output change  +3.2 MW
49.900 Hz  deviation  -100 mHz  unit output change +16.0 MW
49.800 Hz  deviation  -200 mHz  unit output change +32.0 MW
50.050 Hz  deviation   +50 mHz  unit output change  -8.0 MW

Grid frequency is usually discussed in millihertz: in normal operation it stays within a few tens of millihertz of 50 Hz, and a deviation of a few hundred millihertz is a serious event. A frequency that suddenly drops is also an early sign, visible to anyone with a frequency meter, that a large generator or interconnector has tripped somewhere in Europe.

Substations

A substation is a node of the grid where lines meet, voltage is transformed, and power can be switched and protected. Large transmission substations cover hectares; small distribution substations fit in a kiosk on the street. A substation is organized in bays: one bay per line, transformer or other connection, each with the same chain of equipment between the line and the busbar.

What is in a bay

• Busbars: thick conductors that connect all bays of a voltage level, often doubled so a bay can be switched from one busbar to the other.
• Circuit breakers: switches that can interrupt full load current and even short-circuit currents of tens of kiloamperes, within a few cycles. They are operated by protection and by operators.
• Disconnectors (isolators): switches that create a visible, safe gap so people can work on equipment. They cannot interrupt load current, so interlocking prevents opening them while current flows. Earthing (grounding) switches connect isolated equipment to earth (ground) for the safety of workers.
• Power transformers change voltage between levels; tap changers adjust the ratio to control voltage.
• Instrument transformers: current transformers (CT) and voltage transformers (VT) scale the huge primary values down to safe signals for meters and relays.
• Protection relays, today intelligent electronic devices (IEDs, see industrial control systems), watch currents and voltages and trip breakers within tens of milliseconds when they detect a fault such as a short circuit. Protection works locally and automatically; it does not wait for a control center.

The digital substation

Older substations wired every signal individually with copper cables between the yard and the relay room. Modern substations use IEC 61850 (see industrial protocols) over Ethernet, in two layers:

• The station bus connects IEDs with each other, the local HMI and the gateway to the control center. It carries MMS (client/server reporting and control) and GOOSE messages (fast multicast for trips and interlocking between IEDs).
• The process bus connects the IEDs with merging units in the yard, which send digitized current and voltage as sampled values and receive trip commands.

This is where the PRP and HSR redundancy and microsecond time synchronization from the industrial networks page are used. It also means the protection of a high-voltage line now depends on an Ethernet network, which brings both benefits (less copper, better supervision) and a cyber attack surface that copper wiring did not have.

Control centers, SCADA and EMS

A TSO operates its grid from one or more control centers, staffed around the clock. Two layers of software support the operators:

• SCADA (supervisory control and data acquisition) collects measurements and breaker positions from substations, typically over IEC 60870-5-104 from substation gateways or remote terminal units, shows them on the operators' screens, raises alarms, and sends commands such as opening a breaker or changing a transformer tap.
• An energy management system (EMS) adds network analysis on top of SCADA data. Two functions matter most. State estimation combines thousands of measurements, some missing or wrong, into the most likely picture of every voltage and power flow in the grid, and flags measurements that do not fit. Contingency analysis then asks, continuously, "if any single line, transformer or generator tripped now, would anything else become overloaded?". That is the N-1 criterion: the grid must survive the loss of any one element. The EMS also computes load flows and runs the automatic generation control behind frequency restoration.

Control centers of neighboring TSOs exchange real-time data with ICCP (also known as TASE.2), and DSOs run their own distribution control centers, often with a distribution management system (DMS) instead of an EMS. Because a control center can operate breakers in hundreds of substations, it is among the most protected OT environments: backup control centers, separated networks, and strict access control.

Blackouts and black start

Large blackouts are rare because of N-1 planning, protection and reserves. When they happen, they are almost always cascades: one event pushes the system into a state where protection disconnects more equipment, which makes things worse, within seconds.

The European system disturbance of 2006

On 4 November 2006, a double-circuit 380 kV line in northern Germany was disconnected manually as a planned operation (according to the UCTE final report, to let the cruise ship Norwegian Pearl pass under it on the river Ems). The N-1 criterion was not fulfilled after the switching and the change had been communicated late to neighbors. Overloads tripped further lines, and the continental grid, then coordinated by UCTE (a predecessor of ENTSO-E), split into three areas with different frequencies. More than 15 million households lost supply. Automatic under-frequency load shedding and other countermeasures prevented a Europe-wide blackout, and the areas were resynchronized within 38 minutes; normal operation was restored in all countries in less than two hours. The lessons were operational: coordination between TSOs, and checking N-1 after every switching action.

Spain and Portugal, 28 April 2025

Just after midday on 28 April 2025, the power systems of Spain and Portugal collapsed completely. ENTSO-E's expert panel called it the most significant power system event in Europe in over two decades. Its final report (20 March 2026) found no single cause, but a combination of many interacting factors: oscillations, gaps in voltage and reactive power control, differences in voltage regulation practices, rapid output reductions and generator disconnections in Spain, and uneven stabilization capabilities. Together they caused fast voltage increases and cascading disconnections of generation: an overvoltage-driven collapse, not a frequency event of the classic kind.

It was not a cyberattack; the Spanish government's own investigation ruled that out in June 2025. It is a useful reminder for security teams: most outages are not attacks, and jumping to conclusions during a disturbance costs credibility. Equally, investigators must be able to rule an attack in or out quickly, which needs good logs and monitoring.

Restoring the grid: black start

Most power plants need electricity from the grid to start: pumps, fans, control systems. After a total blackout, that electricity is missing. Black start is the process of restoring a grid from a total or partial shutdown using units that can start without external supply, such as hydro plants or gas turbines with their own diesel generators. TSOs contract such units and keep restoration plans: energize a path from the black-start unit to a larger plant, start that, pick up load in small blocks while keeping the frequency stable, build islands, and synchronize the islands with each other and with neighboring countries. Restoration depends on communication with substations and plants, so control centers, telecom networks and substation equipment need backup power that lasts through it.

Grid congestion in the Netherlands

Grid congestion (netcongestie) means that a part of the grid cannot carry the transport that customers want at peak moments. In the Netherlands, electrification (heat pumps, electric vehicles, industry switching from gas) and large amounts of solar and wind have grown faster than the grid could be expanded. In many regions, companies wanting a new or larger connection are placed on a waiting list; reported numbers run to well over ten thousand, and vary by source and date.

Since December 2022, grid operators, the national government and the regulator ACM have worked together in the Landelijk Actieprogramma Netcongestie (national action program on grid congestion), with three tracks: build faster, use the existing grid better, and make demand more flexible; its third progress report appeared in April 2026. Using the grid better means more measurement, more automation and more flexible connection contracts in which customers reduce their use when asked. All of that adds data flows, devices and remote control, which makes the OT security of grid operators and of their customers' equipment even more important.

Why this matters for OT security

Everything on this page is controlled by computers: protection IEDs, substation networks, SCADA, the EMS, the systems of generators and large consumers. A security incident in that chain can have a physical result.

• In December 2015, attackers used legitimate credentials to open breakers remotely at three Ukrainian distribution companies, cutting power to about 225,000 customers. In December 2016, malware built for grid protocols (Industroyer) caused an outage at a transmission substation near Kyiv. The threats and notable incidents page covers both.
• Because the synchronous area is shared, the security of one TSO matters to its neighbors. The EU Network Code on Cybersecurity (Commission Delegated Regulation (EU) 2024/1366) addresses cross-border electricity flows specifically, and grid operators fall under the Dutch Cyberbeveiligingswet, in force since 15 August 2026. In North America the equivalent role falls to NERC's mandatory CIP standards; Great Britain regulates its grid operators under the NIS Regulations. See OT regulation.
• Physics gives defenders time and tools: protection acts locally without a network, reserves absorb sudden losses, and operators train for manual operation. The OT security fundamentals page builds on that.