Maintaining grid stability in a wind and solar world

Here is a transcript of a speech on grid stability that I gave to the International Energy Credit Association in Valencia on 16 July 2026…

……………………………

Good morning, and thank you for inviting me to speak here today.

This is a risk audience, so I want to begin with a few risk manager’s questions: what can go wrong, how fast can it go wrong, who bears the loss when it does go wrong, and have we priced that loss properly?

In electricity, the traditional answer has been: make sure there is enough generation to meet demand. Make sure the market clears. Make sure counterparties can perform. Make sure fuel is available. And make sure there’s enough capacity margin.

All of that still matters, but it’s no longer enough.

In a power system increasingly dominated by wind, solar and batteries, the central risk question is changing. It’s not simply whether we have enough megawatts, it’s whether the system can remain stable while those megawatts are being delivered?

That distinction is crucial. A system can have plenty of installed capacity, plenty of renewable generation, and even a healthy-looking market position, while still being vulnerable to fast-moving physical instability.

The Iberian blackout of April 2025 should be understood in precisely that way. The final ENTSO-E expert panel report described the event as the result of interacting factors, including oscillations, gaps in voltage and reactive power control, rapid output reductions and generator disconnections, leading to fast voltage increases and cascading disconnections in Spain and Portugal.

That’s not a conventional fuel-supply problem. It’s not a simple “there wasn’t enough generation” problem. It’s a power-system stability problem.

Which also makes it a credit problem, a collateral problem, a contract problem, a regulatory problem, an insurance problem and an asset-valuation problem.

The physical event and the financial event are not separate. A voltage problem can become a settlement problem, a collateral problem, a performance problem and a disputes problem within minutes. When protection systems trip, generation disappears, imbalance positions change, interconnector flows change and prices can move in ways that standard base-case models rarely capture. So the question isn’t just whether the engineering works, it’s whether the commercial architecture assumes that the engineering will always work.

The difficulty is that many of the most important stability services in a power system have historically been invisible to markets because they were bundled with conventional power stations. Coal, oil, gas, nuclear and hydro generators connected to the grid, are heavy rotating equipment, which have both physical and electromagnetic coupling with the grid, delivering inertia, voltage support and fault current. The market paid for electricity, but it received grid stability more or less for free.

But that bundle is now being unpicked because inverter-based resources – wind, solar and batteries work differently. They produce direct rather than alternating current and they are not coupled to the grid in the same way that conventional generation is.

Their only resource is current, so while they can provide grid services, they can only do that by using some of the current that would otherwise power loads. This means they become less useful as a generation source and they have to be paid to provide services conventional generators provide for free.

And on top of that, current power electronics fall far short of what conventional generators provide – they are passive, and experiments with more active inverters show they often revert to passive behaviours under fault conditions.

Worse, not only do they fail to provide the same level of grid strength that conventional generators do, under some conditions they may actively undermine grid stability.

Unlike synchronous machines, inverters can inject harmonics, flicker and voltage unbalance into the power system. Where synchronous generators act like a sink for some harmonics, including significant ones such as the second harmonic, grid-forming inverters typically emit rather than dampen harmonics. The commercially available inverters in use today should not be assumed to behave like large synchronous machines.

One of the most dangerous assumptions in current electricity policy is that power system security is mostly about having enough megawatts, particularly in the presence of weather-related intermittency. The Iberian blackout showed very clearly that this isn’t true.

You can have plenty of installed capacity, plenty of renewable generation, and still experience a fast-moving, system-wide failure if voltage control and system stability are not properly managed.

Renewables dominated grids are fundamentally more fragile than conventional power grids. But unfortunately, policy continues to lag behind engineering reality — often assuming a false sense of security.

I’m not going to give you a lecture in electrical engineering, but there are three ideas we need to keep in mind.

The first is frequency. Frequency is the system’s heartbeat. Most European grids operate at 50 hertz – that is voltage and current go through 50 complete cycles per second. If supply and demand are in balance, frequency stays close to that value, but if demand is greater than supply, frequency falls, and if supply is greater than demand, frequency rises.

Equipment is designed to tolerate only limited deviations, so if frequency moves too far, protection systems disconnect machines to prevent damage. This means that even relatively modest frequency deviations can lead to blackouts.

Because stable frequency is linked to a maintaining a balance between supply and demand, it stands to reason that sources of generation that involve rapid variations such as gusts of wind and clouds passing in front of the sun make that balance harder and more expensive to maintain.

The second idea is voltage. Voltage is often described as electrical pressure which pushes current through the network. Unlike frequency, which is broadly the same everywhere on the grid, absent fault conditions, voltage varies with location. This is because they type of equipment connected to the grid affects the voltage – capacitive and inductive loads affect voltage differently.

Grid operators cannot control what types of machines people use and therefore they cannot control the underlying voltage characteristics of the grid. They can only respond the changes in the voltage and try to keep it stable.

The third idea is inertia, although it’s a concept that is not always used correctly. People often use inertia as if it’s a single number, but in practice, it’s a shorthand for a broader set of stabilising properties provided by synchronous machines. Their physical mass resists rapid changes in speed – this is physical inertia and the most conventional application of the term.

But conventional generators also have electromagnetic inertia –  their electromagnetic coupling with the grid helps hold the voltage waveform together and supports local voltage, and their fault current helps protection systems identify and isolate faults.

Replacing these inherent properties of synchronous generators in a grid dominated by intermittent renewables is not automatic. It’s not costless, and it’s not risk-free.

As wind and solar replace conventional generators, these stabilising properties are lost, and grids become less stable. They are more prone to faults, and the faults are more difficult to dampen when they occur.

Synchronous machines respond instantly to fault conditions due to their physical and electromagnetic coupling to the grid. But inverters have to measure, interpret and act through software and controls.

That difference may sound academic but it’s not.

A grid does not fail in the average condition. It fails at the edge. Much like the way that financial failures rarely have a single cause but emerge from correlated assumptions. They emerge when everyone believes their own exposure is hedged, only to discover that the hedge depends on the same stressed liquidity as everyone else’s hedge. Or when models assume normal conditions and ignore the dynamics of stress. Or when compliance becomes a paperwork exercise rather than evidence of real-world performance.

Last year’s Iberian blackout showed is that when the physical system changes faster than the operating model, the market model and the compliance model, hidden risks accumulate.

Red Eléctrica’s own report said the incident was caused by cumulative circumstances that exceeded the N-1 safety criterion and led to an overvoltage problem and cascading generation shutdowns.

Generation subject to Spain’s dynamic voltage regulation procedure did not comply with its obligations to absorb reactive power, while the system operator had assumed compliance when making its calculations.

And large amounts of wind and solar generation failed to operate when frequency fell, failing to meet grid code fault ride-through obligations. That compliance failure was ultimately what brought down the grid, leading to eleven direct deaths and as many as 165 excess deaths over the two days affected by the outage.

The grid operator assumed compliance. But compliance was patchy at best.

In finance, we know how dangerous that can be. We know the difference between a covenant and a covenant that is monitored, between a margin model and a margin model tested under stress and between a legal obligation and a counterparty that can actually perform under market volatility.

It was also apparent that voltage and frequency oscillations are often observed both on the Spanish grid and across Europe, and are now considered to be normal. This sounds a lot like the normalisation of deviance.

Diane Vaughan used that phrase in her analysis of the Challenger disaster to describe how organisations can become complacent about warning signs because nothing bad happened yet.

Behaviour that should be treated as abnormal becomes accepted as normal, and the absence of catastrophe is mistaken for evidence of safety. This can be applied directly to the Iberian blackout and the acceptance of these deviations by the official reports suggests the danger remains.

Persistent oscillations, poor damping and inverter-based resources failing to respond correctly were warning signs, even if the system was still operating notionally within its parameters. Until obviously it wasn’t and the blackout happened.

In a changing electricity system, yesterday’s normal operating range may not be a reliable guide to tomorrow’s risk. Repeated small disturbances are not necessarily proof that the system is resilient. They may be proof that the system is tolerating abnormal conditions. Assuming that tolerance will continue or we know what the boundary conditions are is not risk management, it’s hope.

The normalisation of deviance is not a theoretical concept – it’s visible in every sector. In electricity, examples might include frequent voltage oscillations, repeated constraint actions, increasing system redispatch with growing reliance on emergency redispatch, greater volumes of curtailment, untested black-start assumptions, repeated delays in grid reinforcement, grid-code non-compliance treated as administrative issues, or dependence on a small number of ageing synchronous machines for local stability.

Individually, any one of those may be manageable, but together, they may indicate a system drifting toward fragility, and one we lack the tools to manage.

Unfortunately, decades of strong grids led system operators to focus almost exclusively on frequency control. Voltage stability was taken for granted. Now they are re-discovering the local nature of voltage. REE is concerned about voltage control in the south of Spain after allowing too many conventional generators to close. Scotland faces similar challenges being down to just two large synchronous generators.

I hear politicians talking up the huge surpluses in wind generation that Scotland has with absolutely no understanding that if the grid is unable to operate because there are no synchronous generators it won’t matter. It will be like trying to play jump rope with no rope.

The British system operator is experimenting with alternative technologies but no grid the size of Scotland has ever been operated on that basis, without large synchronous generators.

It’s an unsanctioned experiment that Scottish politicians don’t even realise is being set up on their patch. It may well fail which will mean the Scottish grid will stop working. Not having electricity will be the norm rather than the exception unless new synchronous generation can be built quickly. But with long lead times for equipment, that’s very hard to deliver.

Of course, if a regional grid becomes non functioning, the knock-on effects will be severe. Lives will be at risk. Businesses will be unable to function. Assets will lose value. Law and order may even break down.

Even if the outcomes are less extreme, unstable grids that experience periodic outages have wide-ranging consequences.

It will affect asset value. A renewable project connected in a weak part of the grid may face curtailment, constraint costs, additional connection requirements, changing grid-code obligations or retrofit costs. A battery may earn revenue from arbitrage in one model, but be required to reserve headroom for grid services in another. A thermal plant may appear uneconomic on an energy-only basis, but become valuable because the system needs its stability services.

It affects counterparty performance. If a generator has a grid-code obligation to provide voltage support or ride through a fault, does it actually have that capability? Has it been tested? Are the settings correct? Is the obligation enforceable? What happens if it fails? Does the offtaker bear imbalance costs? Does the lender bear availability risk? Does the insurer treat the event as mechanical failure, grid failure, force majeure or operator error?

It affects liquidity and collateral. Blackouts and major grid disturbances are not only physical events. They create price spikes, imbalance charges, settlement disputes, margin calls and operational disruption. If a region experiences system stress, the commercial impact may not be evenly distributed. Some parties may gain from volatility while others face sudden collateral calls. Some contracts perform as expected but others will reveal ambiguous drafting and end up in protracted disputes.

It affects regulatory risk. As system operators learn more about operating low-synchronous grids, rules will change. Grid codes will tighten and testing will become more intrusive. Dynamic voltage control may become mandatory for more assets. Fault ride-through requirements may be enforced more seriously. Connection studies may become more conservative. The cost of compliance will rise, especially for assets built under older assumptions.

It also affects contract interpretation. A power purchase agreement, balancing-services contract or tolling agreement may use familiar terms such as availability, outage, force majeure, change in law and prudent operating practice. In a weak-grid event those words become contested. Was the plant unavailable, or was the network unable to accept its output? Was a trip caused by equipment failure, grid disturbance, software protection or a non-compliant setting? These distinctions determine who pays.

Many decarbonisation plans assume that wind, solar, batteries and grid-forming electronics will scale smoothly. Perhaps they will. But a prudent risk manager should ask what happens if the engineering takes longer than the policy timetable. What happens if assets are built before the network is ready? What happens if markets reward energy production but underpay stability? What happens if the system becomes dependent on services that have yet to be demonstrated at scale?

We hear a lot these days about energy security. Mostly people think about this in terms of fuel supplies, or managing intermittency. Grid stability is neglected, not least because of the perceived threat to the energy transition – if we admit that wind, solar and batteries make the grid less stable, the public might be less keen on continuing with a transition they are already realising is far more expensive than they were promised.

Unfortunately there are too few people making energy policy that understand the physics of power grids. They just about understand capacity but have no idea about voltage. Even within the sector too many people use terms such as “reactive power” without really understanding what they mean. Worse, they misunderstand them, for example, reactive power is now often assumed to be a commodity that any current bearing device and provide when that is a highly dangerous assumption.

Not only do they not understand the risks to grid stability, they actively seek to avoid understanding it. But that’s not a luxury those of us working in the market can afford.

We need to be asking under what conditions, at what scale, at what location, might the grid fail. What testing and contractual incentives could prevent it or mitigate the risks individual market participants face. And if the market fails, what will be the failure mode, and who will bear the residual risk?

Grid stability should not only sit in the technical appendix of a project-finance model. It should influence due diligence, covenants, events of default, representations, insurance assumptions, availability definitions and collateral valuation. If the data room contains the PPA and the financial model but not the grid connection assumptions, curtailment history, inverter settings, OEM limitations and compliance test results, that absence is itself a risk signal.

Electricity markets are very good at paying for measurable commodities such as energy and capacity. They are less good at paying for system qualities such as voltage support, inertia, fault current, damping, black-start capability and system strength.

Some these are local. Some are dynamic. Some only reveal their value during rare events. Some are provided continuously, in the background, until suddenly they are missing.

Resilience looks expensive before a failure event and cheap after it. The spare transformer, the synchronous condenser, the additional dynamic voltage support, the stricter compliance test, the conservative dispatch decision, the extra thermal unit held online for stability all can look inefficient under normal market conditions.

They reduce short-term optimisation and often increase consumer costs. They will generally reduce renewable output as described earlier and they quite often offend the dominant political narrative.

If they prevent a blackout, they are extraordinarily valuable, but we may not even realise that’s happened. For example, we all have to get our cars regularly tested for roadworthiness. We might be required to replace our tyres which costs money. We can easily quantify the cost of the new tyres, but we cannot quantify the cost of not replacing the tyres.

We can’t reasonably calculate the risk that old tyres will cause an accident, nor the potential severity of the accident. You could have a slow puncture that has no real consequence other than a need to replace the tyre that needed replacing anyway. Or you could have a blow out on a motorway, and cause a mutli-vehicle pile up in which people die and the motorway is closed for hours causing all sorts of direct and indirect costs as well as the obvious human tragedy.

Avoided disasters don’t settle through any market. No invoice arrives saying: “accident prevented, value £2 million” or “blackout prevented, value £5 billion.” Instead, the system operator is criticised for constraint costs and for running thermal plant when renewables output is high. The stability service is treated as an awkward side issue and engineers are told to be more ambitious.

Gradually, standards drift. In Britain, NESO keeps requesting permission to reduce its inertia holding – most recently the regulator has refused.

This is the commercial face of the normalisation of deviance.

So what does this mean for all of you? I would suggest a practical response. When assessing counterparties, projects or portfolios in high-renewables systems, ask five additional questions.

Number 1: what stability services does this asset depend on, and who provides them?

Ask about voltage support, fault level, inertia, system strength and black start. Is the asset in a strong part of the grid or a weak one? Is it dependent on nearby synchronous plant that may retire? Is reinforcement funded, permitted and scheduled? Is the connection agreement based on assumptions that might change?

Number 2: what stability services is this asset expected to provide, and can it actually provide them?

If an inverter-based asset has fault ride-through obligations, voltage-control obligations or frequency-response obligations, ask for evidence of compliance. Not just certificates but real evidence. That means test results, settings, event performance, manufacturer limitations and control-mode details. Has performance been validated under weak-grid conditions? Has it been tested when several neighbouring assets respond simultaneously?

Number 3: how does the commercial model change when stability, rather than energy, becomes scarce?

A battery may be most profitable when cycling aggressively for arbitrage, but the system may need it to hold headroom. A gas plant may be uncompetitive in the energy market, but essential for voltage support. A renewable project may have strong annual output but increasing curtailment. A transmission constraint may turn a low-cost region into a high-risk region. The revenue stack should be stressed against changing system needs, not just price curves.

Number 4: what are the consequences of non-performance?

If a plant trips when it should ride through, who pays? If voltage support is unavailable, is there a penalty? If a generator is instructed to absorb or inject reactive power and fails to do so, is that a compliance issue, a settlement issue, a default issue or merely a future regulatory discussion? A system that depends on unenforced obligations is not a resilient system. It is a system running on hope.

Number 5: are we mistaking administrative compliance for physical resilience?

This may be the most important question of all. Markets love documentation. But what matters from an engineering perspective is testing. Risk managers need both. In a low-inertia, high-inverter system, a spreadsheet showing capacity adequacy is not enough. A grid-code certificate is not enough. A model is not enough. The system has to work during disturbances, and the assets have to behave as expected under fault conditions as well as in steady state.

Risk managers don’t need to become power engineers, but they do need to know when a power-system risk is being hidden behind language that sounds reassuring.

When we hear: “the system has enough capacity.” We should ask: enough capacity for what?

Enough to meet average demand? Enough to meet peak demand? Enough to maintain frequency after the largest loss? Enough to support voltage locally? Enough to provide fault current? Enough to restart after a blackout? Enough to survive correlated inverter behaviour? Enough if an interconnector trips? Enough if negative prices cause unexpected disconnections? Enough if a key synchronous plant is on outage?

When we hear: “the asset is grid-code compliant.”

We should ask: compliant on paper, in simulation, at commissioning, or under real disturbed conditions? When was it last tested? Who saw the data? What happened during actual events? Are settings controlled by the owner, the OEM, the aggregator or the system operator? Can they be changed remotely? Are there version-control and cyber controls around firmware updates?

When we hear: “batteries will solve it.”

We should ask: which problem? Energy adequacy, frequency response, voltage support, congestion, black start, reserve, inertia emulation or fault current? How long must they sustain the service? What state of charge is required? What revenue is sacrificed by holding headroom? What happens in a multi-hour system stress event? Who pays for readiness?

When we hear: “grid-forming inverters will replace synchronous machines.”

We should ask: at what scale has that been demonstrated? In what grid strength? With what mix of neighbouring assets? During what faults? With what current limits? With what protection settings? With what contractual accountability? And what is the plan if performance does not match the model?

I would add one further question, which is perhaps the most direct credit question: what happens to the money when the physics goes wrong? Where do imbalance charges fall? Who posts collateral? Which party has discretion to curtail? Does a failure to ride through a fault trigger a default, a warranty claim or a force majeure notice? Does insurance respond if the loss is caused by a grid disturbance rather than damage to the asset?

The energy transition is not merely a generation build-out, it’s a fundamental restructuring of one of the most complex real-time machines ever built. That machine has almost no storage in its wires and must balance in milliseconds. It must tolerate lightning strikes, plant trips, forecasting errors, market behaviour, cyber threats, human error and equipment failure. And it must do all this while public policy pushes it through the fastest technological transformation in its history.

We must tell the truth about the risks if we are to maintain a stable and reliable system.

The truth is that stability is valuable.

The truth is that location matters.

The truth is that compliance must be demonstrated, not assumed.

The truth is that voltage matters as much as energy.

The truth is that some services that were once bundled with conventional generation now need explicit markets, contracts and accountability.

The truth is that blackouts are not only engineering failures. They are failures of governance, incentives, information and risk culture.

And the truth is that normalisation of deviance is one of the greatest dangers in the modern energy system.

Energy policy is often driven by targets but engineering is driven by constraints. Finance sits somewhere in between. Capital can either reinforce wishful thinking or discipline it. It can fund projects that assume the grid will somehow cope, or it can ask the harder questions that force the system to become more resilient.

So my closing message is this.

A wind and solar world is fundamentally different from the world for which our power grids were designed. Not just in the obvious ways of being weather dependent and intermittent.

They are direct current resources being forced into alternating current infrastructure. This means we must look differently at every element of the grid, well beyond energy and capacity.

We have to pay attention to local voltage support, real fault ride-through, tested inverter behaviour, dynamic stability services, synchronous condensers where needed, robust black-start plans, better data sharing, enforceable grid codes, and markets that pay for resilience before a blackout happens rather than after it.

We need regulators who understand that reliability is not an optional extra, and system operators who are honest about physical limits rather than keeping quiet to satisfy policy ambitions.

We need developers who treat grid-code compliance as a core asset capability, not an administrative hurdle, and risk managers who are willing to ask uncomfortable questions.

And we need policymakers who don’t assume the laws of physics can be repealed by the legislature.

The lights stay on not because we have enough megawatts on a spreadsheet, but because millions of devices, machines, controls and contracts perform together in real time.

In the old system, much of that performance was supplied by the physics of synchronous machines. In the new system, it has to be designed, procured, tested and paid for.

There’s no room for complacency.

Thank you.