In a world increasingly dominated by wind, solar, and batteries, the central risk question for grid stability is no longer just about having enough megawatts, but whether the system can remain stable while those megawatts are being delivered. This shift in focus is crucial, as a system with ample installed capacity and renewable generation can still be vulnerable to fast-moving physical instability. The Iberian blackout of April 2025 is a stark example of this, where interacting factors such as oscillations, gaps in voltage and reactive power control, rapid output reductions, and generator disconnections led to cascading disconnections in Spain and Portugal. This event highlights the need to understand grid stability as a power-system stability problem, not just a fuel-supply or generation adequacy issue. It also underscores the importance of grid stability in the context of credit, collateral, contract, regulatory, insurance, and asset-valuation concerns. The physical and financial events are not separate; a voltage problem can quickly escalate into settlement, collateral, performance, and dispute issues. The challenge lies in the fact that many critical stability services in a power system have historically been bundled with conventional power stations, which are heavy rotating equipment with physical and electromagnetic coupling to the grid. These stations provide inertia, voltage support, and fault current, which are now being unbundled as inverter-based resources like wind, solar, and batteries take over. However, these new resources work differently, producing direct current and lacking the same coupling to the grid, which means they can only provide grid services by using some of the current that would otherwise power loads. This makes them less useful as generation sources and requires them to be paid for services that conventional generators provide for free. Moreover, current power electronics fall short of what conventional generators offer, and under certain conditions, they may even undermine grid stability by injecting harmonics, flicker, and voltage unbalance. The most dangerous assumption in current electricity policy is that power system security is primarily about having enough megawatts, especially in the presence of weather-related intermittency. However, the Iberian blackout clearly demonstrated that this is not the case. A system can have ample installed capacity and renewable generation but still experience a fast-moving, system-wide failure if voltage control and system stability are not properly managed. Renewable-dominated grids are fundamentally more fragile than conventional power grids, and policy continues to lag behind engineering reality, often assuming a false sense of security. Three key ideas need to be kept in mind: frequency, voltage, and inertia. Frequency is the system's heartbeat, with most European grids operating at 50 hertz. If supply and demand are in balance, frequency stays close to this value, but if demand exceeds supply, frequency falls, and if supply exceeds demand, frequency rises. Equipment is designed to tolerate only limited deviations, so even relatively modest frequency deviations can lead to blackouts. Voltage, on the other hand, is often described as electrical pressure that pushes current through the network. Unlike frequency, which is broadly the same everywhere on the grid, voltage varies with location due to the type of equipment connected to the grid. Grid operators cannot control what types of machines people use, so they can only respond to changes in voltage and try to keep it stable. Inertia, a concept often misunderstood, is a shorthand for the broader set of stabilising properties provided by synchronous machines. Their physical mass resists rapid changes in speed, and their electromagnetic coupling with the grid helps hold the voltage waveform together and supports local voltage. Replacing these inherent properties of synchronous generators in a grid dominated by intermittent renewables is not automatic, costless, or risk-free. As wind and solar replace conventional generators, these stabilising properties are lost, and grids become less stable, more prone to faults, and the faults are more difficult to dampen when they occur. Synchronous machines respond instantly to fault conditions due to their physical and electromagnetic coupling to the grid, but inverters have to measure, interpret, and act through software and controls, which introduces delays. This difference may seem academic, but it is not. A grid does not fail in the average condition; it fails at the edge, much like financial failures that emerge from correlated assumptions. Last year's Iberian blackout showed that when the physical system changes faster than the operating model, market model, and compliance model, hidden risks accumulate. Red Eléctrica's report attributed the incident to cumulative circumstances that exceeded the N-1 safety criterion, leading to an overvoltage problem and cascading generation shutdowns. Generation subject to Spain's dynamic voltage regulation procedure did not comply with its obligations to absorb reactive power, while the system operator assumed compliance when making its calculations. Large amounts of wind and solar generation failed to operate when frequency fell, failing to meet grid code fault ride-through obligations. This compliance failure ultimately brought down the grid, leading to eleven direct deaths and as many as 165 excess deaths over the two days affected by the outage. The grid operator assumed compliance, but compliance was patchy at best. In finance, we know how dangerous this can be, understanding the difference between a covenant and a monitored covenant, a margin model and a stress-tested margin model, and a legal obligation and a counterparty that can perform under market volatility. It is also apparent that voltage and frequency oscillations are often observed on the Spanish grid and across Europe, and are now considered normal. This is a clear case of the normalization of deviance, where behaviour that should be treated as abnormal becomes accepted as normal, and the absence of catastrophe is mistaken for evidence of safety. Persistent oscillations, poor damping, and inverter-based resources failing to respond correctly were warning signs, even if the system was still operating within its parameters. However, assuming that tolerance will continue or knowing the boundary conditions is not risk management; it's hope. The normalization of deviance is not a theoretical concept but is visible in every sector. In electricity, examples might include frequent voltage oscillations, repeated constraint actions, increasing system redispatch with growing reliance on emergency redispatch, greater volumes of curtailment, untested black-start assumptions, repeated delays in grid reinforcement, grid-code non-compliance treated as administrative issues, or dependence on a small number of ageing synchronous machines for local stability. Individually, any one of these may be manageable, but together, they may indicate a system drifting towards fragility, and one we lack the tools to manage. Unfortunately, decades of strong grids led system operators to focus almost exclusively on frequency control, taking voltage stability for granted. Now they are re-discovering the local nature of voltage, with REE concerned about voltage control in the south of Spain after allowing too many conventional generators to close, and Scotland facing similar challenges with just two large synchronous generators. The British system operator is experimenting with alternative technologies, but no grid the size of Scotland has ever been operated on that basis without large synchronous generators. This is an unsanctioned experiment that Scottish politicians don't even realize is being set up on their patch, and it may well fail, leading to the Scottish grid stopping work. Not having electricity will be the norm rather than the exception unless new synchronous generation can be built quickly, but with long lead times for equipment, this is very hard to deliver. The knock-on effects of a regional grid becoming non-functioning will be severe, affecting lives, businesses, asset value, counterparty performance, liquidity and collateral, and regulatory risk. It will also impact contract interpretation, as a power purchase agreement, balancing-services contract, or tolling agreement may use familiar terms such as availability, outage, force majeure, change in law, and prudent operating practice, which become contested in a weak-grid event. Many decarbonisation plans assume that wind, solar, batteries, and grid-forming electronics will scale smoothly, but a prudent risk manager should ask what happens if the engineering takes longer than the policy timetable, what happens if assets are built before the network is ready, what happens if markets reward energy production but underpay stability, and what happens if the system becomes dependent on services that have yet to be demonstrated at scale. The energy transition is not merely a generation build-out but a fundamental restructuring of one of the most complex real-time machines ever built. This machine has almost no storage in its wires and must balance in milliseconds, tolerating lightning strikes, plant trips, forecasting errors, market behaviour, cyber threats, human error, and equipment failure. It must do all this while public policy pushes it through the fastest technological transformation in its history. We must tell the truth about the risks if we are to maintain a stable and reliable system. The truth is that stability is valuable, location matters, compliance must be demonstrated, not assumed, voltage matters as much as energy, and some services that were once bundled with conventional generation now need explicit markets, contracts, and accountability. The truth is that blackouts are not only engineering failures but failures of governance, incentives, information, and risk culture. And the truth is that the normalization of deviance is one of the greatest dangers in the modern energy system. Energy policy is often driven by targets but engineering is driven by constraints, and finance sits somewhere in between. Capital can either reinforce wishful thinking or discipline it, funding projects that assume the grid will somehow cope or asking the harder questions that force the system to become more resilient. So, my closing message is this: a wind and solar world is fundamentally different from the world for which our power grids were designed, not just in the obvious ways of being weather-dependent and intermittent. They are direct current resources being forced into alternating current infrastructure, which means we must look differently at every element of the grid, well beyond energy and capacity. We have to pay attention to local voltage support, real fault ride-through, tested inverter behaviour, dynamic stability services, synchronous condensers where needed, robust black-start plans, better data sharing, enforceable grid codes, and markets that pay for resilience before a blackout happens rather than after it. We need regulators who understand that reliability is not an optional extra and system operators who are honest about physical limits rather than keeping quiet to satisfy policy ambitions. We need developers who treat grid-code compliance as a core asset capability, not an administrative hurdle, and risk managers who are willing to ask uncomfortable questions. And we need policymakers who don't assume the laws of physics can be repealed by the legislature. The lights stay on not because we have enough megawatts on a spreadsheet but because millions of devices, machines, controls, and contracts perform together in real time. In the old system, much of that performance was supplied by the physics of synchronous machines. In the new system, it has to be designed, procured, tested, and paid for. There's no room for complacency. Thank you.
