Operational security · Glossary

Operational security refers to the ability of a power system to stay within its technical limits during real-time operation and to manage disturbances so that they do not lead to large-scale supply interruptions. It means the operational security of the system over a timescale of minutes, seconds and, in part, milliseconds. This includes frequency, voltage, power flows, protection systems, the stability of generation plants and grids, and the availability of the necessary means of intervention.

In European law the term is defined more narrowly and more precisely. The guideline on electricity transmission system operation, Regulation (EU) 2017/1485, is also known as the System Operation Guideline (SO GL). It defines operational security as the transmission system's capability to retain a normal state or to return to a normal state as soon as possible, determined by operational security limits. For this purpose the regulation distinguishes several system states: normal state, alert state, emergency state, blackout state and restoration state. Operational security is therefore not only about avoiding disturbances. It expressly includes a swift return to the normal state.

The term does not describe a single measured variable. It bundles several technical conditions that together determine whether a grid can be operated safely. In the continental European interconnected system, grid frequency must be kept close to 50 hertz. Voltages must remain within permissible bands depending on the grid level. Lines and transformers must not be thermally overloaded. Protection systems must detect faults and disconnect selectively, that is, separate only the affected part of the grid where possible. Power plants, storage units, converters and consuming installations must behave during disturbances in such a way that they do not aggravate the fault.

Operational security is part of security of supply, but is not identical with it. Security of supply additionally asks whether sufficient generation capacity, storage, grids, fuels, flexibility and organisational preparedness are available in the long term. Operational security asks more narrowly: can the existing system be run stably at a given moment? A power system can have sufficient power plant capacity and still be operationally insecure. This is the case, for example, when grid congestion occurs, reactive power is lacking, protection concepts do not fit, or frequency deviations are not corrected quickly enough. Conversely, a grid can run stably in a particular hour even though too little firm capacity is available for future periods of low wind and solar output (Dunkelflauten) or extreme weather situations.

In German there is a risk of confusion with the Betriebssicherheitsverordnung (BetrSichV, Industrial Safety Ordinance). It governs occupational health and safety in the use of work equipment and installations requiring monitoring, and has nothing to do with the operational security of the power system in the sense meant here.

Legal framework in the EU and in Germany

In the EU, the SO GL applies directly to transmission systems, distribution systems and interconnectors, as well as to regional security coordinators. It obliges each transmission system operator to ensure operational security in its control area. This includes operational security analyses and remedial actions, as well as data exchange with distribution system operators and significant grid users. For the synchronous area of Continental Europe it sets central frequency parameters:

Standard frequency range: ±50 mHz around 50 Hz. This is a quality benchmark for normal operation, not a disconnection limit.
Maximum steady-state frequency deviation: 200 mHz. Maximum instantaneous frequency deviation: 800 mHz.
Reference incident: 3000 MW power imbalance, in both the positive and the negative direction. This figure is the basis for sizing the frequency containment reserve (FCR).

In Germany, the Energy Industry Act (Energiewirtschaftsgesetz, EnWG) does not use the word operational security, but refers to the security or reliability of the electricity supply system. Under § 13 paragraph 4 EnWG, a threat exists if local outages of the transmission grid or short-term grid congestion are to be feared. The same applies if it is to be feared that frequency, voltage or stability cannot be maintained to the required extent. The transmission system operators are then entitled and obliged to eliminate the threat. They proceed in stages:

Grid-related measures, in particular grid switching operations.
Market-related measures, such as balancing energy, redispatch under § 13a EnWG, contractually agreed interruptible and switchable loads, and congestion management.
Additional reserves, in particular the grid reserve under § 13d and the capacity reserve under § 13e EnWG.
If this is not sufficient, the transmission system operators may and must, under § 13 paragraph 2 EnWG, adjust generation, transits and electricity withdrawals in their control area or demand such adjustment. In this case, liability for financial losses is largely excluded.

In addition, under § 13 paragraph 9 EnWG the transmission system operators must prepare a vulnerability analysis every two years. The aim is to avoid serious supply disruptions. The information refers to the version of § 13 EnWG that was available on gesetze-im-internet.de in November 2026. The law is amended frequently.

Distinction from grid security, system stability and resource adequacy

Grid security usually refers to the safe loading and controllability of the grid infrastructure. This includes lines, transformers, switchgear, voltage bands and grid congestion. Operational security is broader. It also covers frequency control, balancing energy, instantaneous reserve, system protection and operating processes. System stability describes more strongly the dynamic behaviour after disturbances: do generators remain in synchronism, do converters respond correctly, do voltage dips subside? Operational security uses such stability properties, but is at the same time an organisational task of ongoing grid operation. The terms are not used uniformly in the specialist literature. In case of doubt, one should refer to the definition in the relevant set of rules.

Operational security must be kept particularly clearly separate from resource adequacy. Resource adequacy asks whether the available firm capacity is sufficient to meet demand even in tight situations. Operational security deals with the physical management of the grid. In political debates this difference is often blurred. When the issue is missing power plants, what is usually meant is resource adequacy. When it concerns frequency jumps, redispatch, voltage control or grid congestion, operational security is affected. The two levels influence each other, but follow different rules and time horizons.

How operational security is achieved in grid operation

Operational security does not arise automatically from an installed amount of generation. It is achieved through planning, monitoring, minimum technical requirements and interventions during real-time operation. Transmission system operators monitor the state of the extra-high-voltage grid in control centres. They calculate expected load flows, examine possible outages and coordinate measures with neighbouring grid operators and regional security coordinators. Distribution system operators perform corresponding tasks at their grid levels. Increasingly this also involves photovoltaics, heat pumps, charging points and local voltage problems.

A central principle is the N-1 criterion. The grid must withstand the outage of a single important network element without safety-relevant limits being violated. Such an element can be a line, a transformer or a power plant unit. The criterion does not mean that any arbitrary combination of multiple outages remains without consequences at all times. It sets a minimum standard for normal operation. Grid operators must therefore keep reserves in the grid loading or initiate countermeasures in good time.

These countermeasures include redispatch, grid switching operations, the use of balancing energy, the provision of reactive power and requirements for the behaviour of installations. Redispatch changes the operation of power plants, storage units or other controllable installations in order to relieve lines. In Germany, the former feed-in management under the EEG (Renewable Energy Sources Act) was abolished as of 1 October 2021. Since then, the curtailment of renewable energy and CHP installations has been part of the unified Redispatch 2.0, which distribution system operators also apply. The feed-in priority of these installations is taken into account through calculated costs and minimum factors. Balancing energy compensates short-term deviations between feed-in and withdrawal and stabilises the frequency. Reactive power supports the voltage without itself arriving at the consumer as usable electrical work. These services are technically necessary but hardly appear in simple electricity-volume considerations.

Why frequency and voltage must be considered separately

In the interconnected system, grid frequency indicates whether generation and consumption are in balance at a given moment. If more electricity is withdrawn than fed in, the frequency falls. If more is fed in than consumed, it rises. Immediately after a disturbance, the instantaneous reserve of rotating masses slows the rate of change of frequency. Staged reserves then take effect. The frequency containment reserve (FCR, formerly primary control) responds automatically within seconds and proportionally to the deviation. At a deviation of 200 mHz it is fully activated in Continental Europe. The automatic and manual frequency restoration reserves (aFRR and mFRR, formerly secondary control and minute reserve) subsequently return the frequency to its setpoint and replace the FCR. These reserves are procured in markets and activated through grid operator processes.

Voltage is more strongly local in character. It depends on grid impedances, reactive power, line lengths, transformers, feed-in points and consumption behaviour. A power system can be unremarkable in terms of frequency and nevertheless have local voltage problems. This is particularly relevant in distribution grids when many photovoltaic installations feed in at the same time or many consumers draw high power simultaneously. A balanced economy-wide energy balance is therefore not sufficient for operational security. Feed-in, consumption and control options must also be distributed in a way that suits the grid technically.

Change through renewable energies and converters

With a higher share of renewable energies, the technical foundations of operational security change. Conventional synchronous machines inherently provide rotating mass, short-circuit power and certain stability properties. Wind turbines, photovoltaic installations and battery storage are mostly connected to the grid via power electronics. Such converters can regulate very quickly, but have different properties from synchronous machines. Grid connection rules, protection concepts and operational management requirements must integrate them so that they do not disconnect uncontrollably during faults and can be used for frequency and voltage control.

This does not result in a simple contrast between old, secure technologies and new, insecure ones. Conventional power plants can fail, respond sluggishly or be located in unfavourable places. Converters can support the grid, provide synthetic inertia, supply reactive power and be controlled very precisely. How secure operation is depends on which technical requirements apply and which installations are actually controllable. It is equally important which data are available and how grid operators can intervene in the event of a disturbance.

A common mistake is to equate electricity volumes with operability. A kilowatt hour from a photovoltaic installation and a kilowatt hour from a power plant deliver the same amount of energy in balance terms. For operation, what also counts is when, where and with what grid-technical properties the power is fed in. The same applies to consumption. A flexible charging park that adjusts its output in a grid-serving way affects operational security differently from many simultaneous, uncoordinated charging processes in a weak grid section.

Market rules and physical grid operation

Electricity markets plan and remunerate energy, capacity and in part ancillary services. Physical power flow, however, follows the laws of the grid, not trading relationships. A power plant can be cheap on the market but feed in at a grid location where it aggravates a congestion. A consumer can respond in an economically sensible way and nevertheless worsen the voltage locally. Operational security therefore arises at the interface of market, grid operation and regulation.

Balancing groups ensure that market participants balance their feed-ins and withdrawals in accounting terms. Grid operators must additionally ensure that this balance is technically feasible. If market dispatch leads to grid overloads, redispatch and congestion management take effect. Where several suitable market-related or reserve-related measures for adjusting active power are available, § 13 EnWG in principle prescribes selecting the one expected to be the most cost-effective. The costs of such interventions are real system costs, even if they are not visible in the pure exchange electricity price. A discussion about cheap generation remains incomplete if it ignores the costs of grid management, reserves, reactive power, protection technology and communication infrastructure.

Responsibilities also shape operational security. Transmission system operators are responsible for the stability of the interconnected system in their control area and for supra-regional balancing. Distribution system operators secure their grid levels and must coordinate more and more decentralised installations. Plant operators follow technical connection rules and market incentives. Regulatory authorities set the framework for grid charges, investments and the procurement of ancillary services. Conflicts arise where technical possibility, market rule and political responsibility diverge.

Typical misinterpretations

Operational security is often noticed only when it is at risk. In the normal state it remains invisible, because successful grid management produces precisely no disturbance. From this arises the misinterpretation that it is a passive property of the power system. In fact it is produced continuously: through forecasts, security calculations, reserve holding, switching operations, control, communication and technical standards.

A second oversimplification is that operational security is primarily a question of sufficient power plant capacity. Firm capacity is important. But it does not fully explain frequency and voltage control, grid congestion, short-circuit power, protection behaviour and local overloads. In an electrified energy system with heat pumps, electromobility, electrolysers, battery storage and decentralised generation, the temporal and spatial controllability of flexibility becomes more important. Operational security then depends more strongly on whether millions of small installations are integrated into sensible operating rules.

A third misinterpretation concerns digitalisation. More measurement and control improve grid operation only if data quality, communication paths, IT security, responsibilities and fallback procedures are right. A remotely controllable installation that responds incorrectly in a communication outage, or disconnects en masse at the same time as others, can itself become an operational risk. Digital operational management does not replace physical reserves. It changes how these reserves are activated and coordinated.

The term operational security sharpens the view of the power system because it does not confuse the snapshot of supply with the annual balance. It asks about frequency, voltage, load flows, disturbance management, responsibilities and means of intervention. This makes clear that a secure power system must not only deliver enough energy. It must remain technically controllable at all times, even when generation, consumption, grid state and market behaviour change simultaneously.

Sources

Verordnung (EU) 2017/1485 der Kommission vom 2. August 2017 zur Festlegung einer Leitlinie für den Übertragungsnetzbetrieb — Europäische Union, EUR-Lex (ABl. L 220 vom 25.8.2017); 2017-08-02. Art. 1 und Art. 3 Nr. 1, 36, 38, 50, 58 (Begriffsbestimmungen); Bestimmungen zur Dimensionierung der FCR (Referenzstörfall); Anhang III (Frequenzqualitätsparameter)
Energiewirtschaftsgesetz (EnWG) § 13 Systemverantwortung der Betreiber von Übertragungsnetzen — Bundesministerium der Justiz / Bundesamt für Justiz (gesetze-im-internet.de); unbekannt (Fassung abgerufen am 2026-11-11). § 13 Abs. 1, 1a, 2, 4, 5 und 9 EnWG
Einspeisemanagement — Bundesnetzagentur, Beschlusskammer 8; unbekannt. Abschnitt Einspeisemanagement (EinsMan)

Related glossary entries

Edited by eCMS on 11.11.2026 15:33