When Feedback Misses Its Window
The Iberian blackout of April 2025 had a closed-loop system with feedback, protection, and reactive power reserves. The correction mechanism existed and sat unused while voltage climbed toward collapse. The loop existed. It didn't govern.
At 12:33 in the afternoon on April 28, 2025, the power went out across nearly all of Spain and Portugal at once.
Trains stopped between stations. Traffic lights went dark mid-intersection. Hospitals switched to backup generators. In Madrid, people walked down from high floors in the dark because the elevators had stopped. Seven people in Spain and one in Portugal died in the hours that followed, from candle fires and from carbon monoxide poisoning as households ran generators indoors. It took twelve to sixteen hours to restore power across most of the peninsula, a recovery later regarded as comparatively successful given the scale of the collapse.
Thirty-one gigawatts of load disconnected in the time it takes to read this sentence twice.
I want to be careful with this one, the way I tried to be careful with Cruise in the last article. Nobody should read a grid collapse as a tidy engineering parable. But eighteen months later, the people whose job it is to prevent this from happening again have published their findings, and what they found says something precise and useful about a claim this publication made back in article three: that closed-loop systems correct themselves, and open-loop systems don't.
The Iberian Peninsula runs one of the largest closed-loop electrical systems humans have built. It has feedback. It has protection. It has reactive power reserves designed for exactly this kind of disturbance. And on that Monday afternoon, it failed anyway, in a way that looked, for the seconds that mattered most, exactly like an open-loop system would fail.
The loop existed. It didn't govern.
The finding that changes how I think about it
Here's the finding that stayed with me longest, from the Expert Panel's final report. A substantial amount of reactive power capacity, sitting in shunt reactors across the Spanish grid, was available during the voltage rise that preceded the blackout. It simply wasn't activated in time.
That single observation changes how I think about the blackout. This wasn't a grid without a correction mechanism. It was a grid whose correction mechanism existed, was sized appropriately, and sat unused while voltage climbed toward the point of no return. The investigators identified oscillatory instability at two frequencies - roughly 0.63 Hz locally and 0.2 Hz across the wider interconnected system - compounding with gaps in voltage control and inconsistent voltage regulation practices between operators. Protection settings meant to isolate faults diverged from what the rulebook required. Somewhere in the chain, a correction that should have happened sooner didn't.
None of that is a story about renewable energy, whatever you may have read elsewhere. The chair of the investigating body said as much when the report came out: the problem was never the generation mix, it was voltage control, and voltage control is not a new problem. It is one of the oldest problems in power systems engineering. What changed is the speed at which it needed solving.
Feedback has a deadline
That's the idea I want to sit with. The value of a feedback loop isn't determined only by what it measures. It's determined by whether its correction still matters. Feedback isn't a yes-or-no property of a system. It has a deadline. A correction only means something if it arrives while the system is still in a state where correction is possible. Once the disturbance has moved faster than the response meant to contain it, the mechanism can still exist - wiring intact, logic sound - and still fail to do the one thing it was built to do.
Stress test: does the correction arrive before the window closes?
Article three's claim was that closed-loop systems compare their own output against a target and adjust. That's true as a description of architecture. It says nothing about timing.
Iberia is the stress test for the piece that claim left out. A closed-loop system doesn't promise the correction will win. It promises the correction will be attempted, and it will only succeed if it's attempted inside the window the disturbance allows. Outside that window, the loop is still there. It just can't influence the outcome anymore. The distinction that matters isn't whether feedback exists. It's whether the system remains recoverable long enough for that feedback to act - which is a claim about time, not about architecture.
What was already known
I try not to write "nobody could have predicted this," because it's rarely true and it lets everyone off the hook too easily. This is one of those cases where the more honest question is what was already known.
The Expert Panel's report noted something worth sitting with: the root causes behind the Iberian blackout closely echoed a grid incident in southeastern Europe the year before. This wasn't a novel failure mode discovered for the first time in 2025. It was a recognized one, recurring, in a system that had the information needed to prevent a repeat and hadn't yet acted on it. The panel's own recommendations, once published, were described by the people who wrote them as things that could be implemented immediately. Not researched. Not invented. Implemented.
That's a harder thing to write about than a freak accident, and I think it's the more useful one. Most failures of this kind aren't failures of knowledge. They're failures of the gap between knowing and acting on it before the disturbance arrives.
Closing
Closed-loop control doesn't promise success. It promises correction, and only for as long as the system can still be corrected. Once a disturbance outruns the controller, the loop hasn't disappeared. It has simply stopped governing anything.
That's a harder standard than most people assume feedback provides, and it's one worth sitting with before you trust a diagram that shows an arrow pointing back to the beginning. A loop on paper is not a guarantee. It's an architecture. Whether it holds depends on something a diagram can't show you: whether the reflex behind it is fast enough to still matter when it's needed.
Power systems engineering has spent decades building mechanisms that don't wait for a control room to notice something has gone wrong. That reflex is older than almost anything else this publication has tested so far, and it's where we're headed next.