60 Million People Lost Power in 5 Seconds — And the AI Industry Learned Nothing

I was on a call with a potential partner when the news broke. April 28, 2025. Someone in the meeting dropped a link in the chat: Spain and Portugal had gone completely dark. Sixty million people, no electricity. Traffic lights dead. Hospitals on backup generators. Trains stopped in tunnels.

My first thought — and I'm not proud of this — was relief. Not that it happened, obviously. But that the thing we'd been warning about for two years had finally become impossible to ignore. We'd been building deterministic AI systems at Veriprajna specifically because we believed that probabilistic models — the kind most AI companies sell — would eventually fail catastrophically in critical infrastructure. And here it was: 15 gigawatts of generation capacity gone in five seconds. Not a cyberattack. Not a natural disaster. A cascade of control failures that better AI could have prevented.

My second thought was anger. Because within hours, the narrative had already calcified: "Renewables caused the blackout." It was everywhere. And it was wrong.

What Actually Killed the Grid on April 28?

Let me be precise about what happened, because the details matter more than the headlines.

That morning, renewables were generating 78% of Spain's electricity. Solar and wind were doing their job beautifully. But here's what most people don't understand about a power grid: generating electricity is only half the problem. The other half is managing reactive power — the invisible force that keeps voltage stable across thousands of kilometers of transmission lines.

Think of it like water pressure in a pipe system. You can have plenty of water (active power), but if the pressure (voltage) drops or spikes in the wrong places, pipes burst. Reactive power is what regulates that pressure. Spanish regulations — specifically something called Operating Procedure 7.4 — require every power plant to dynamically absorb or inject reactive power to keep voltages stable. Each plant must be capable of providing at least 30% of its maximum power as reactive support.

On April 28, the grid started experiencing strange oscillations around noon — sub-synchronous vibrations at 0.21 Hz and 0.63 Hz. The transmission system operators tried to dampen them by meshing more lines together and switching HVDC links to fixed-power mode. Reasonable moves. But they had an unintended consequence: voltages started climbing.

And then the critical failure: multiple generation facilities didn't absorb reactive power as required. They responded too slowly, or not at all. One major facility actually injected reactive power into an already overvoltaged grid — the exact opposite of what physics demanded. It was like pouring gasoline on a fire you're supposed to be extinguishing.

At 12:33 CEST, the cascade completed. Fifteen gigawatts gone in five seconds. Total blackout across the Iberian Peninsula for up to ten hours. Several people died.

The Invisible Gap That Nobody Was Watching

Here's the detail from the post-incident investigation that kept me up at night.

The transmission system operators were watching their screens the entire time. At the 400 kilovolt level — the high-voltage backbone — everything looked fine. Voltages read 418 kV, well within limits. But at the collector-level substations, where solar and wind farms actually connect to the grid at 220 kV, voltages had already hit 242 kV — past the protection thresholds that trigger automatic shutdowns.

The transformer tap-changers between these voltage levels couldn't adjust fast enough. So the TSO's monitoring dashboard showed green while the actual grid was already in crisis. I started calling this the observability gap: the distance between what operators can see and what the grid is actually doing.

The Iberian blackout wasn't a failure of generation. It was a failure of intelligence — the gap between what the control room could see and what the grid was actually doing.

When I presented this analysis to our team, one of our engineers — Priya — said something that stuck with me: "It's like a doctor monitoring your heart rate while your blood pressure is killing you. They're watching the wrong vital sign." That's exactly right. And it's exactly the kind of failure that better AI should prevent.

Why Didn't AI Prevent This?

This is where I get genuinely frustrated with my own industry.

There's been an explosion of AI companies selling "smart grid" solutions. Most of them are what we call wrapper applications — thin interfaces built on top of large language models like GPT-4 or Claude. You feed in grid data, the model processes it, you get back analysis. It sounds sophisticated. It's dangerously inadequate for this problem.

I had an investor tell me, about a year before the blackout, that we should "just use GPT with a fine-tuned layer" for our grid monitoring work. I tried to explain why that wouldn't work, and he looked at me like I was being difficult. "Everyone's using LLMs," he said. "Why are you overcomplicating this?"

Here's why. Probabilistic AI models have three fatal weaknesses when applied to critical infrastructure:

They hallucinate physical states. An LLM optimizes for the most plausible-sounding output. During a grid crisis, it might report that "voltage levels are stabilizing" because that's what usually happens during oscillation events in its training data. It has no mechanism to verify this against actual physics. "Likely" and "correct" are treated as the same thing.

They're too slow. Wrapper-based AI routes data through cloud APIs. Round-trip latency: 500 milliseconds to several seconds. The Iberian cascade completed in five seconds. By the time a cloud-based model finished its inference, the blackout would already be irreversible. The edge-native systems we build at Veriprajna achieve inference in under 0.7 milliseconds — fast enough to intervene before a cascade completes.

They can't be verified. You cannot formally prove that an LLM will obey Kirchhoff's Voltage Law or the Swing Equation. You can't audit its reasoning. You can't guarantee it won't suggest injecting reactive power during an overvoltage event — the exact error that a human operator made on April 28. For a deeper technical analysis of these failure modes, I wrote about this extensively in our research paper on deterministic grid immunity.

In critical infrastructure, the difference between "probably correct" and "provably correct" is measured in human lives.

What Does "Deterministic Immunity" Actually Mean?

After the blackout, my team spent weeks dissecting every published report — from ENTSO-E, from Red Eléctrica, from independent researchers. We mapped the entire failure chain. And we kept coming back to one question: what kind of AI architecture would have made this cascade physically impossible?

Not unlikely. Not improbable. Impossible.

That's what we mean by deterministic immunity. And building it requires abandoning the idea that one type of AI can do everything.

The architecture we developed has multiple layers, each solving a different part of the problem. I won't go deep into the math here — you can explore the interactive version of our whitepaper for the full technical framework — but the core ideas are surprisingly intuitive.

Teaching Neural Networks to Obey Physics

Standard neural networks learn patterns from data. Show them enough examples of grid behavior, and they'll learn to predict what comes next. But they have no concept of why things happen. They don't know that voltage and reactive power are linked by fundamental electromagnetic laws. They just know that when input pattern A appears, output pattern B usually follows.

Physics-Informed Neural Networks — PINNs — are different. We embed the actual differential equations that govern power system dynamics directly into the training process. The neural network doesn't just learn from historical data; it learns subject to the constraint that its outputs must satisfy the laws of physics.

Here's what that means in practice. During the Iberian event, sub-synchronous oscillations at 0.63 Hz were a warning sign that conventional controllers interpreted as noise. A PINN-based controller would have recognized these oscillations as a dynamic violation of stability equations and provided active damping — our simulations show response times up to 87 times faster than conventional optimization methods. Not because the neural network is faster at math, but because it already knows the math. The physics is baked into its architecture.

I remember the afternoon we first got this working in simulation. We'd been struggling for weeks with training stability — the physics constraints kept fighting the data-driven learning. Our ML lead, who'd come from a pure deep learning background, was skeptical that the constraints would help rather than hurt. Then we ran the Iberian scenario through the trained model. The PINN caught the oscillation pattern at 12:00 PM — thirty-three minutes before the actual cascade. He just stared at the screen and said, "Okay. I get it now."

The Sandwich That Blocks Stupid Decisions

Physics-informed inference is the first layer. The second is what we call the Neuro-Symbolic Sandwich — and it's the piece that would have directly prevented the most egregious failure of April 28.

Remember the power plant that injected reactive power during an overvoltage event? That happened because the plant's control system — whether automated or human-directed — issued a command that violated Operating Procedure 7.4. The command was physically possible to execute, so it was executed. The grid had no immune system to reject it.

In our architecture, a symbolic logic layer sits around the neural network like a constitutional guardrail. We encode the entire P.O. 7.4 regulation — and any other applicable grid code — into a formal domain-specific language. The neural network proposes actions. The symbolic layer checks every proposed action against the hard rules before it reaches the physical equipment.

If the voltage is above the maximum threshold and rising, and the neural layer suggests injecting reactive power — for whatever reason, however confident its prediction — the symbolic layer blocks it. Not with a warning. Not with a probability score. It physically cannot pass through. The system treats regulatory compliance the way a bridge treats gravity: not as a guideline, but as a constraint that cannot be violated.

A neuro-symbolic grid controller doesn't warn you about bad decisions. It makes bad decisions physically impossible to execute.

This is what I mean when I talk about moving beyond the "Infinite Freedom Fallacy" — the assumption that more flexible AI is always better AI. In critical infrastructure, you want less freedom, not more. You want an AI that is brilliantly adaptive within hard boundaries and absolutely rigid at those boundaries.

Why Does the Intelligence Need to Live at the Edge?

There's a practical question that comes up every time I present this work: where does the computation happen?

The observability gap that doomed the Iberian grid existed because intelligence was centralized. The TSO's control room monitored the 400 kV backbone. The 220 kV collector-level substations — where the actual crisis was unfolding — were essentially flying blind. Data from those substations was aggregated, averaged, and reported on cycles too slow to catch a five-second cascade.

Our Neural Grid Controllers are edge computing devices that sit at the collector-side transformer itself. They perform high-resolution synchro-waveform measurements, run continuous optimization loops every 100 milliseconds, and execute inverter commands to maintain local voltage stability within ±0.02 per unit. They don't wait for the control room to notice a problem. They don't send data to a cloud API and wait for a response. They act locally, at the speed the physics demands.

There was a moment during our edge hardware testing — late on a Thursday, the kind of session that starts at 2 PM and ends at midnight — when we realized that our prototype was detecting simulated voltage anomalies faster than the monitoring system could even display them. The anomaly was corrected before the dashboard updated. One of our hardware engineers laughed and said, "We just made the control room obsolete." He was joking. Mostly.

What Happens When the Grid Goes Dark Anyway?

Even with prevention, you need recovery. The Iberian grid took up to 24 hours to fully restore — a painfully manual process of restarting generation units, carefully reconnecting load islands, and synchronizing frequency across regions.

We use multi-agent reinforcement learning for automated grid restoration. Think of it as a team of AI agents, each managing a local power island, coordinated by higher-level agents that oversee synchronization. During the 2025 recovery, Morocco provided 900 MW and France contributed 2 GW of support power. But routing that power to the right places, in the right sequence, without causing secondary collapses, required human operators making hundreds of sequential decisions under extreme pressure.

Our simulations suggest that autonomous agents operating within the same deterministic framework — physics-informed, symbolically constrained — could reduce a 24-hour restoration to roughly four hours. Not by being smarter than human operators, but by being faster, more coordinated, and incapable of the panic-driven errors that compound during a crisis.

How Does This Survive Regulatory Scrutiny?

People ask me this constantly, and it's a fair question. The EU AI Act classifies grid control as critical infrastructure, which means any AI system operating in this space faces stringent transparency and explainability requirements. This is where wrapper-based LLMs face their most fundamental problem: they literally cannot explain why they made a specific prediction. The math doesn't work that way.

Our neuro-symbolic architecture produces a complete audit trail for every intervention. Not a post-hoc rationalization — an actual decision trace:

The neural layer detected 0.63 Hz sub-synchronous oscillation. The symbolic layer identified a P.O. 7.4 violation: dynamic voltage limit of 435 kV exceeded. The symbolic layer enforced mandatory reactive power absorption at 30% of maximum capacity. Voltage stabilized at 418 kV. Collector-side protective trip prevented.

Every link in the chain is inspectable, auditable, and legally defensible. This isn't a nice-to-have. After the Iberian blackout, regulators across Europe are rewriting grid codes. The systems that survive the next decade of regulatory tightening will be the ones that can prove — not just claim — that their AI follows the rules.

The Question Nobody Wants to Ask

Here's what bothers me most about the industry response to the Iberian blackout.

Within weeks, the conversation moved on. AI companies went back to selling wrapper products. Grid operators patched their most obvious vulnerabilities. The renewables-versus-fossil debate consumed all the oxygen. And the fundamental architectural problem — that we're managing 21st-century energy systems with control paradigms that can't see, think, or act fast enough — remained unaddressed.

Sixty million people lost power. Several people died. The economic damage ran into billions. And the root cause wasn't a freak event. It was a predictable consequence of known architectural weaknesses. The sub-synchronous oscillations had been observed before. The reactive power compliance gaps had been documented. The observability gap between transmission and collector-level monitoring was well-understood in academic literature.

The Iberian blackout was not a black swan. It was a gray rhino — a highly probable, high-impact threat that everyone saw coming and nobody stopped.

We knew. The industry knew. And we built systems that couldn't handle it anyway.

This Is Not a Renewables Problem

I want to be absolutely clear about this, because the misinformation still circulates.

Renewable energy did not cause the Iberian blackout. The 78% renewable penetration on April 28 reduced system inertia, which made the grid more sensitive to disturbances — that's true. But sensitivity is not causation. The cause was the failure of generation facilities to provide the reactive power support they were legally required to provide. The cause was control systems too slow and too dumb to manage voltage dynamics in real time. The cause was an observability architecture that left operators blind to the crisis unfolding at the collector level.

Blaming renewables for this blackout is like blaming lightweight building materials for an earthquake collapse when the real problem was that nobody followed the building code. The materials require different engineering. The engineering wasn't done. That's a human and institutional failure, not a physics failure.

And it's exactly the kind of failure that deterministic AI is designed to eliminate — not by replacing human judgment, but by ensuring that when human judgment fails, or when legacy controllers fail, or when a power plant operator makes the wrong call at the wrong moment, the system itself enforces the laws that keep the lights on.

The Lights Will Stay On Because We Engineered Them To

I started Veriprajna because I believed that the most important AI systems in the world wouldn't be chatbots or image generators or recommendation engines. They'd be the invisible systems governing the infrastructure that civilization depends on — power grids, water treatment, transportation networks, financial clearing systems. Places where "probably right" is a death sentence.

The Iberian blackout proved that belief correct in the worst possible way. Fifteen gigawatts in five seconds. An entire peninsula in the dark. And the AI industry's response was to keep selling probabilistic wrappers for problems that demand deterministic certainty.

The grid of the future won't stay stable because we hope it will. It won't stay stable because an LLM thinks it probably should. It will stay stable because we embedded the laws of physics into the neural architecture, encoded the regulations into symbolic logic, pushed the intelligence to the edge where the milliseconds matter, and built a system that is physically incapable of making the decisions that brought down the Iberian grid. That's not optimism. That's engineering.