f97.beERIK SCHMIDT’S WORKSHOP
← All terms

Glossary · Energy industry & energy transition

Defense Plan

Defense plan defence plan security of supply electricity grid system protection Blackout

A defense plan is a predefined plan of measures. In EU law, its German name is Systemschutzplan, colloquially also Verteidigungsplan. It is intended to stabilise a power supply system during severe disturbances before it collapses on a large scale. The plan specifies which technical interventions, communication channels and responsibilities apply when normal grid operation is no longer sufficient to keep frequency, voltage and power flows within safe limits.

The concept originates from the operation of large interconnected grids. A power grid must generate exactly as much electricity at every moment as is consumed. If this balance is severely disrupted, frequency and voltage change. Lines can become overloaded, power plants or inverters disconnect to protect themselves, and parts of the grid can separate from one another. This is precisely the phase in which the defense plan comes into play. It is meant to limit a chain reaction, give control rooms time to make decisions and prevent a severe disturbance from turning into a blackout.

Legal framework in the EU

In the European power system, the defense plan (Systemschutzplan) is mandatory and not a voluntary additional instrument. Its basis is Commission Regulation (EU) 2017/2196 of 24 November 2017. It is the network code on emergency and restoration (Network Code Emergency and Restoration, NC ER) and applies directly in all Member States. Under Article 11, each transmission system operator (TSO) had to draw up a defense plan by 18 December 2018. In doing so, it had to coordinate with the affected distribution system operators, significant grid users, the regulatory authority, neighbouring TSOs and the other TSOs of its synchronous area. The measures then had to be implemented by 18 December 2019. The Regulation distinguishes three phases: the design with its detailed content, the implementation with installation of the necessary means and services, and finally activation in an emergency. The defense plan thus forms part of the institutional framework of security of supply, even though it is barely visible in everyday life.

According to the Regulation, the plan must regulate at least three things: the conditions under which it is activated pursuant to Article 13, which instructions the TSO then issues, and which measures require real-time coordination with other parties. The measures are to burden grid users as little as possible and be economically efficient. In addition, only the measures necessary in each case are to be triggered. Anyone who contributes to measures of the plan by legal or contractual obligation is considered a defense service provider. Each TSO must review the effectiveness of its complete defense plan at least every five years (Article 50). For relays, communication and IT systems, the Regulation additionally prescribes conformity tests. In Germany, the four TSOs 50Hertz, Amprion, TenneT and TransnetBW have drawn up a joint defense plan (Systemschutzplan). It was published in a revised version in 2024.

Distinction from grid operation, redispatch and the restoration plan

The defense plan must be clearly distinguished from normal grid operation. In regular operation, schedules, balancing energy, congestion management and the monitoring of limit values keep the grid stable. Measures such as redispatch or the use of balancing reserves belong to normal or strained operation, as long as grid security can be maintained with the standard instruments of the market and grid operation. The defense plan only takes effect when these instruments are no longer sufficient or act too slowly. It therefore contains interventions that are not provided for in normal market processes. These include automatic load shedding, emergency instructions to plant operators, the separation of grid areas or the blocking of tap changers on transformers. These interventions are not market instruments. They serve solely to keep the grid physically stable.

The defense plan differs from the restoration plan in timing and objective. The defense plan acts before or during an imminent collapse. The restoration plan, by contrast, sets out how voltage is rebuilt after a partial or complete collapse, how islanded grids are synchronised and how consumers are reconnected step by step. The same Regulation governs both plans, and they must fit together. Even so, they must not be equated: one is meant to prevent the slide, the other organises the grid restoration afterwards. Nor does the plan describe a blackout itself. It comprises the prepared countermeasures and is not an indication that a blackout is imminent.

Which measures a defense plan contains

The Regulation names technical and organisational minimum components. These include automatic grid protection schemes and procedures controlled by humans.

  • Automatic low frequency control scheme (Article 15): If the frequency drops sharply, load is shed in steps. Energy storage units switch from consumption to generation or disconnect from the grid. In addition, there are settings for the frequency-dependent behaviour of generating units.

  • Automatic high frequency control scheme (Article 16): In the event of a generation surplus, feed-in is reduced automatically.

  • Automatic scheme against voltage collapse (Article 17): This includes load shedding at low voltage and the blocking of on-load tap changers on transformers.

  • Procedures for frequency and voltage deviations, for power flow management, for active power assistance and for manual demand disconnection.

The best known is the underfrequency-dependent load shedding. It acts in case of underfrequency, that is, when the grid frequency falls below certain thresholds. Predefined groups of consumers are then disconnected from the grid automatically and in steps so that generation and load come back into balance. For the Continental Europe synchronous area, whose nominal frequency is 50 Hz, the annex to the Regulation sets the framework:

  • Load shedding must begin at 49 Hz. At this first stage, 5 percent of the national total load is disconnected.

  • By the final stage at 48 Hz, a total of 45 percent of the total load must have been shed. The permissible deviation is plus or minus 7 percentage points.

  • At least six stages are prescribed before the final stage. At most 10 percent of the total load may be shed per stage.

  • Other synchronous areas have their own values. In the Nordic area it is 30 percent down to 48 Hz, in Great Britain 50 percent down to 48 Hz and in Ireland 60 percent down to 48.5 Hz.

The German defense plan (Systemschutzplan) in the 2024 version implements this framework in concrete terms. From 49.5 Hz, pumped-storage power plants that are currently pumping are switched off after 10 seconds. From 49.2 Hz, storage pumps are shed without delay and power reserves are activated immediately. The actual load shedding for Germany is set in the range between 49.0 Hz and 48.1 Hz. Older versions put the target at 45 percent of the total end-consumer load, plus or minus 7 percentage points. According to these versions, whether the load shedding is effective is checked at least every five years by means of a simulation study. Many of the relays are located in substations of the distribution grids. The distribution system operators therefore participate directly in implementation and testing.

Manual measures act more slowly but allow a more targeted assessment of the situation. Control rooms can instruct plants to change their output, carry out grid switching, request assistance from neighbouring TSOs or shed load in a controlled manner. This requires reliable measurement data, stable communication and clear responsibilities. The Regulation therefore requires, among other things, lists of the grid users that must implement measures. It also sets out special rules for high-priority grid users, for whose disconnection and reconnection special conditions apply.

Challenges in the changing power system

In the past, large synchronous power plants brought many stabilising properties with them as a matter of course: rotating masses, short-circuit power and voltage support. With more wind and solar plants, battery storage and direct-current links, this technical basis is changing. Inverters can support the grid if they are suitably designed, configured and integrated into operational management. With incorrect protection settings or a lack of coordination, however, they can also trigger undesired disconnections. Another problem is added: decentralised feed-in in the distribution grids reduces, on sunny days, the net load that a shed grid section actually draws. In an unfavourable case, load shedding even takes generation off the grid along with it. For this reason, how effective the load shedding stages still are is checked regularly.

Economic and political dimension

The measures are technically justified but have economic consequences. During load shedding, consumers temporarily receive no electricity, and plant operators who are instructed must change their mode of operation. The measures must therefore be legally ordered in advance. Otherwise, in an emergency it would be unclear which loads are protected and how critical infrastructure is treated. This also shows a limit of the electricity market: prices can signal scarcity, but they cannot stabilise a grid within milliseconds. In an acute disturbance, what counts is not short-term willingness to pay but safety logic and fixed chains of command. Flexible consumers such as heat pumps, electric cars or electrolysers only become useful for the plan once their response times, availability and communication channels have been clarified in a binding manner.

Typical misunderstandings

  • Misunderstanding 1: The plan is just a paper for crises. In fact, it influences even in normal operation which protection systems are installed, which requirements plants must meet and what is tested regularly.

  • Misunderstanding 2: The plan prevents every interruption. In reality, a limited, targeted disconnection is often precisely the means of avoiding a much larger disturbance.

  • Misunderstanding 3: More installed capacity automatically means more security. What matters are concrete capabilities such as frequency and voltage support, black start capability, communication capability and suitable protection behaviour.

The defense plan thus makes tangible what resilience means in the power system: detecting disturbances, containing them, setting priorities and returning in an orderly way to a stable state. How good such a plan is is not shown by the length of the document. What matters is whether the measures take effect in an emergency quickly, in a coordinated manner and with known side effects.

Sources

Related glossary entries

Edited by eCMS on 11.11.2026 18:43

© 2026 Erik Schmidt. All rights reserved. Quotations with a link to the source are welcome.