The Nervous Mesh: the communications that hold up the electricity grid — and why they cannot be an office network

The modern electricity grid is no longer just cables and power stations. It is today a living system, coordinated to the millisecond by millions of electronic devices — among them the inverters (the equipment that converts the energy of solar panels and wind turbines into current for the grid). And there is an invisible part that holds all this together: the communications network that carries, in real time, the measurements, the protection signals and the control orders from one end of the country to the other. It is the “nervous mesh” of the system.

The historical mistake has been to treat that mesh as an ordinary office network — what the sector calls an IT network (Information Technology: the everyday networks of computers, e-mail and internet). It is not. An office network can fail for a few minutes without serious consequences; the network that protects a high-voltage substation cannot.

An important clarification before going further: this mesh is not what makes the machines turn in synchrony — that is physics, it happens locally, in the equipment itself. What the mesh does is allow the operator to see, protect and coordinate the whole grid in real time. When it fails, the grid does not stop at once, but the operator is left “blind” and loses the ability to protect and command it in a coordinated way — and that is when a small problem turns into a blackout.

Defending this mesh against a saturation attack — a DoS (Denial of Service: flooding a system with traffic until it is blocked) — is not done with the off-the-shelf firewalls (computer security barriers) of an office. It is done with an architecture designed to be unbreakable, resting on four pillars. And this is not futuristic theory: it is the rigour that has been applied for years in land, sea and air transport — now carried over to energy.

A. Keeping the network separate from everything else (physical segregation)

First rule: the communications network that controls electricity cannot share the same cables as the public internet or commercial traffic. It has to be physically isolated — what is called air-gapping (literally an “air gap”: no physical connection with other networks).

In practice, this requires dark fibre (its own dedicated optical fibre, not shared with commercial operators), owned by the TSO itself (Transmission System Operator — the entity that manages the high-voltage grid; in Portugal, REN). Over that fibre runs a network designed to guarantee exact timing, with technologies such as TSN (Time-Sensitive Networking) and PTP (Precision Time Protocol). This is the architecture the electricity grid should adopt.

Where it already exists: in the European railway system. ERTMS (European Rail Traffic Management System) and its train control, ETCS (European Train Control System), use their own communications — historically GSM-R (the railway version of the GSM mobile network), now evolving into FRMCS (Future Railway Mobile Communication System, based on 5G) — completely separate from public mobile networks. Nobody mixes the braking signal of a high-speed train with the video the passengers are watching on their mobile phones. For the same reason, the command of a substation cannot be mixed with a city’s data traffic.

B. Two paths instead of one (seamless redundancy)

To withstand fibre cuts — accidental or deliberate — and simultaneous failures, the classic “ring” design is abandoned: in it, when something fails, the network takes some time to reorganise itself. That time is something the physics of electricity does not tolerate.

The solution is to send each critical message twice at the same time, over two physically different optical paths. If one goes down, the second copy has already arrived; the recovery time is, in practice, zero. The protocols that do this are called PRP (Parallel Redundancy Protocol) and HSR (High-availability Seamless Redundancy), standardised by the IEC (International Electrotechnical Commission) in standard IEC 62439-3.

Where it already exists: operators such as RTE (Réseau de Transport d'Électricité, the French grid operator) and Statnett (the Norwegian operator) already have digital substations built on these protocols, under IEC 61850, the standard for digital substations. And in aviation: AFDX (Avionics Full-Duplex Switched Ethernet, the on-board data network of the Airbus A350) uses exactly this principle — it carries the orders of the flight computers to the wing controls over two parallel paths, so that they always arrive on time, even if one fails.

C. Stopping attacks in the chip itself (hardware defence)

Against a mass saturation attack — a DDoS (Distributed Denial of Service: the same attack, but launched from thousands of points at the same time) — the defence cannot depend on software, which is easily smothered by a “storm” of data. It is solved in the chip itself.

In the border equipment of substations, traffic is filtered directly in dedicated electronic circuits: FPGA (Field-Programmable Gate Array, a chip that can be reconfigured for a specific task) or ASIC (Application-Specific Integrated Circuit, a chip built from scratch for a single function). With a mechanism called the Time-Aware Shaper (standard IEEE 802.1Qbv — IEEE is the Institute of Electrical and Electronics Engineers, the institute that defines these standards), the communication port only “opens” in windows of microseconds (millionths of a second) strictly scheduled in advance. Any data storm that arrives outside its time hits a hardware wall and is discarded, without even disturbing the main processor.

Where it already exists: in stock exchanges and ultra-fast automated trading — HFT (High-Frequency Trading, the buying and selling of shares in fractions of a second), in markets such as Euronext or Nasdaq. There, a delay of nanoseconds is worth millions, and so traffic is filtered by FPGA arrays that reject anomalous packets instantly, with a timing rigour impossible to achieve with ordinary software.

D. Working blind if everything else fails (time autonomy)

Good engineering always assumes that the main connection is going to fail. If the whole optical mesh is cut in an act of sabotage, the system cannot collapse.

Here a common misconception needs to be cleared up. Even in total communications silence, the grid stays at 50 Hz (50 hertz, the frequency of the electric current) — that frequency is kept physically by the machines and the inverters, not by the communications network. What is lost, without communications, is the common time reference that the measurement and protection systems need in order to “see” the grid accurately and act in a coordinated way. These very-high-precision measurements are called synchrophasors, or PMU (Phasor Measurement Unit), and they only work if every point of the grid shares the same clock to the microsecond.

That is why each critical substation must have its own local atomic clock, a rubidium clock (a very-high-precision clock), which keeps the exact time for days even without a satellite signal. That signal comes from the GNSS systems (Global Navigation Satellite System, such as the American GPS or the European Galileo), which have to be protected against interference (jamming: drowning out the signal) and against falsification (spoofing: sending a false signal to deceive the receiver). The ability to keep the reference without any external signal is called holdover (time autonomy).

Where it already exists: in 5G SA (5G Standalone) telecommunications networks and in military navigation. Telecommunications exchanges use rubidium master clocks that keep time accuracy (with an error of a few microseconds) for days without a satellite signal — for longer periods, even more stable caesium clocks are used. At sea, warships use CRPA antennas (Controlled Reception Pattern Antenna) that cancel the enemy’s interference signals, keeping position and time even under heavy electronic attack.

Conclusion: electrical stability is, today, a telecommunications problem

The Final Report on the 2025 Iberian Blackout showed that the security of the grid depends on system services — voltage, reactive power, robustness, inertia. But these only work if the “nervous mesh” that coordinates them is equally robust. In a grid dominated by inverters and software, the stability of electricity becomes, ultimately, a problem of deterministic telecommunications engineering: networks that deliver the right information, at the exact instant, always — without exception and without delay.

Treating that mesh as an office network, with the tools and the tolerance for failure of a commercial environment, is the real house of cards. The light that powers hospitals, transport and everyone’s life is not held up only by high-voltage cables: it is also held up by the invisible rigour of the network that runs beneath them. Resilience is not decreed; it is built, node by node.

Gaspar do Amaral

#SystemsEngineering #EnergyTransition #Cybersecurity #SmartGrids #Telecommunications #TSN #IEC61850 #Resilience #NIS2 #Engineering

Methodological note

What this page is. A translation of the article the author published on LinkedIn on 15 June 2026; the full Portuguese version is on this site.

Changes of form, not of content. The decorative symbols (emoji) of the LinkedIn version were left out, and the hashtags at the end were translated. The original illustration is reproduced with its texts in Portuguese and a translated caption. The acronyms keep their usual English expansions, which the original also gives.

Gaspar do Amaral · Original in Portuguese of 15 June 2026, published on this site; translation issued on 27 October 2026 · Figures and tables © Aprecisa.com · AI-assisted