Resilience: The security concept of the future

How to make energy systems future-proof – even in crises

The energy system is becoming increasingly interconnected, digitalised and decentralised. This makes it more flexible, but also more vulnerable. Risks such as hacker attacks, extreme weather conditions and resource shortages could threaten the supply.

An ESYS Working Group has examined how the system can keep up its functional capability even during disruptions and can learn from crises.

Overview of the results

Why resilience is useful


Digitally interconnected infrastructures are vulnerable. This includes modern, digitally controlled energy systems. The global cyberattack in May 2017 has shown what may happen if hackers find a security gap in the operating system: At least 200,000 computer systems in 150 countries were disabled by means of a malware in order to extort ransom. Were criminals or terrorists to succeed in manipulating a critical infrastructure like the energy supply system, the damage to society and the economy would be immense. Fixed and mobile telephones would fail, trains would no longer run, hospitals, surgeries and pharmacies would be closed, food shortages might occur.

Snow storms, floods or heat waves resulting from climate change could likewise trigger serious blackouts. If the energy system is to cope with such dangers, it needs to be robust and flexible. It must be able to maintain essential functions at all times, or at least to quickly restore them. Ideally, the energy system is so adaptive that it is better prepared for future disturbances after an incident has occurred and been dealt with. In short, the energy system should be as resilient as possible.

In order to identify risks and weaknesses in time, the energy system requires a comprehensive, systematic monitoring. The methods and criteria for such an instrument, however, remain to be developed.

New risks


Climate change, but also the transformation of the energy supply system, harbour new risks for the security of the energy supply.

  • In late 2015, hackers succeeded in separating several Ukrainian substations from the grid. There is likewise the risk of terrorist attacks on the energy infrastructure, such as the attack in February 2014, when separatists blew up three important gas pipelines in Pakistan, leaving millions of people without gas for a day.
  • Experts expect extreme weather conditions to occur more frequently due to climate change. In recent years, floods have caused damages on a broad scale in Germany and elsewhere. The snow chaos that raged in the German region Münsterland in November 2005 left around 250,000 households without electricity for days. During long-term heat waves, on the other hand, cooling systems are running near breaking point. If at such times overheated rivers can no longer supply sufficient cooling water for power plants and if photovoltaic cells are less productive, a power shortage can ensue.
  • In 2010, China cut back on exports of rare earths. The result was a sharp rise in prices and supply shortages. The rare earths and other metals being indispensable for renewable energy plants, storage systems and grids, this would bog down the energy transition.
  • How political decisions can jeopardise supply security already became clear in the 1990s “Californian energy crisis”: In the context of the deregulation of the electricity market, the energy suppliers in California had to sell numerous power plants. In order to increase their profits, many producers artificially cut back the energy supply by shutting down power plants. This resulted in large-scale black-outs and economic damages amounting to more than 40 billion US dollars.
  • The energy transition cannot succeed without the support of the population. If citizens feel disadvantaged or reject a new technology, they may take action against energy policy decisions. Examples include the protests against the construction of new wind parks or power lines. A current example is the planned SuedLink power line.

Resilient infrastructures


  • A wide diversity of generation technologies makes the energy system more robust against the effects of extreme weather conditions. Wind turbines, for instance, are not affected by heat waves, while gas power plants can generate electricity when wind and solar radiation are scarce.
  • If more power lines, generators or transformers are installed than are necessary for normal operation (installed overcapacity), the supply can still be kept up if individual elements fail.
  • Double structures are also apt to cushion supply disruptions; for instance, underground cables and overhead lines can be used simultaneously. This would offer the further advantage that underground cables are better protected against extreme weather conditions and terrorist attacks. However, since such measures are very expensive, the costs must be weighed against the benefits. In any case, unassigned resources should be kept available in case of bottlenecks. This applies to technical installations such as reserve power plants as well as to any necessary task forces.
  • If the energy system were designed as the sum of interconnected, but separately functional elements, blackouts could not spread so far. Regional, cellular power grids, for instance, are self-sustaining, thus supplementing and relieving the transmission grid. Pilot projects are currently being conducted to test how they could maintain the supply in “isolated grids” in the case of disturbances.
  • Today, only spatial units (streets, city districts, etc.) can be separated from the grid. If the distribution grids were modified in such a way that the power demand could be throttled according to relevance, it would be possible, in a crisis, to switch out illuminated advertisements or street lamps, while hospitals, police stations and fire brigades would continue to be supplied with electricity.

Cyber attacks


  • If different software is used to control grids and other infrastructures, cyberattacks cannot easily spread to other systems. After all, most viruses and trojans are designed specifically for those programmes with the highest market share.
  • If possible, information technology should likewise be set up redundantly: GPS data used to connect grids can be transmitted twice and using different means, e.g. via radio channels and telephone lines. This could also help detect hacker manipulations.

Resource shortages


  • Since Germany has to import metals from partly unsafe and/or unreliable supplier countries, raw material efficiency should be pushed ahead, also with regard to the components of the energy infrastructure. A further approach implies substituting critical metals with other materials. Possible substitutions therefore need to be further researched.
  • It is also important to increase the recovery rates in the recycling of critical metals such as rare earths. There is still a lot of potential along the entire recycling process chain, e.g.: labels for recyclable product designs, more consumer-friendly collection systems, uniform recycling regulations across Europe, or more effective action against illegal scrap exports.


Energy policy and acceptance


  • Information and education can prepare the population for emergencies. The Concept for Civil Protection issued by the German Federal Ministry of the Interior is a case in point. It contains guidelines to protect the population in the event of a disaster and to ensure their continuous provision with energy, water, telecommunications and food. It would also be helpful to use according teaching material in schools.
  • Involving the citizens early on in the planning of energy infrastructures and construction projects and enabling a fair distribution of the burdens can contribute to maintaining the social acceptance of the energy transition and can thus help to prevent protests.
  • Since investments in energy infrastructure always have a long-term outlook, potential investors need planning security with regard to legislation and framework conditions. Hence, a forward-looking and stringent governance is necessary. Frequent changes in energy policy and conflicting decisions at regional, national and European levels tend to hamper the infrastructure expansion.

Why resilience is useful

Digitally interconnected infrastructures are vulnerable. This includes modern, digitally controlled energy systems. The global cyberattack in May 2017 has shown what may happen if hackers find a security gap in the operating system: At least 200,000 computer systems in 150 countries were disabled by means of a malware in order to extort ransom. Were criminals or terrorists to succeed in manipulating a critical infrastructure like the energy supply system, the damage to society and the economy would be immense. Fixed and mobile telephones would fail, trains would no longer run, hospitals, surgeries and pharmacies would be closed, food shortages might occur.

Snow storms, floods or heat waves resulting from climate change could likewise trigger serious blackouts. If the energy system is to cope with such dangers, it needs to be robust and flexible. It must be able to maintain essential functions at all times, or at least to quickly restore them. Ideally, the energy system is so adaptive that it is better prepared for future disturbances after an incident has occurred and been dealt with. In short, the energy system should be as resilient as possible.

In order to identify risks and weaknesses in time, the energy system requires a comprehensive, systematic monitoring. The methods and criteria for such an instrument, however, remain to be developed.

New risks

Climate change, but also the transformation of the energy supply system, harbour new risks for the security of the energy supply.

  • In late 2015, hackers succeeded in separating several Ukrainian substations from the grid. There is likewise the risk of terrorist attacks on the energy infrastructure, such as the attack in February 2014, when separatists blew up three important gas pipelines in Pakistan, leaving millions of people without gas for a day.
  • Experts expect extreme weather conditions to occur more frequently due to climate change. In recent years, floods have caused damages on a broad scale in Germany and elsewhere. The snow chaos that raged in the German region Münsterland in November 2005 left around 250,000 households without electricity for days. During long-term heat waves, on the other hand, cooling systems are running near breaking point. If at such times overheated rivers can no longer supply sufficient cooling water for power plants and if photovoltaic cells are less productive, a power shortage can ensue.
  • In 2010, China cut back on exports of rare earths. The result was a sharp rise in prices and supply shortages. The rare earths and other metals being indispensable for renewable energy plants, storage systems and grids, this would bog down the energy transition.
  • How political decisions can jeopardise supply security already became clear in the 1990s “Californian energy crisis”: In the context of the deregulation of the electricity market, the energy suppliers in California had to sell numerous power plants. In order to increase their profits, many producers artificially cut back the energy supply by shutting down power plants. This resulted in large-scale black-outs and economic damages amounting to more than 40 billion US dollars.
  • The energy transition cannot succeed without the support of the population. If citizens feel disadvantaged or reject a new technology, they may take action against energy policy decisions. Examples include the protests against the construction of new wind parks or power lines. A current example is the planned SuedLink power line.

Resilient infrastructures

  • A wide diversity of generation technologies makes the energy system more robust against the effects of extreme weather conditions. Wind turbines, for instance, are not affected by heat waves, while gas power plants can generate electricity when wind and solar radiation are scarce.
  • If more power lines, generators or transformers are installed than are necessary for normal operation (installed overcapacity), the supply can still be kept up if individual elements fail.
  • Double structures are also apt to cushion supply disruptions; for instance, underground cables and overhead lines can be used simultaneously. This would offer the further advantage that underground cables are better protected against extreme weather conditions and terrorist attacks. However, since such measures are very expensive, the costs must be weighed against the benefits. In any case, unassigned resources should be kept available in case of bottlenecks. This applies to technical installations such as reserve power plants as well as to any necessary task forces.
  • If the energy system were designed as the sum of interconnected, but separately functional elements, blackouts could not spread so far. Regional, cellular power grids, for instance, are self-sustaining, thus supplementing and relieving the transmission grid. Pilot projects are currently being conducted to test how they could maintain the supply in “isolated grids” in the case of disturbances.
  • Today, only spatial units (streets, city districts, etc.) can be separated from the grid. If the distribution grids were modified in such a way that the power demand could be throttled according to relevance, it would be possible, in a crisis, to switch out illuminated advertisements or street lamps, while hospitals, police stations and fire brigades would continue to be supplied with electricity.

Cyber attacks

  • If different software is used to control grids and other infrastructures, cyberattacks cannot easily spread to other systems. After all, most viruses and trojans are designed specifically for those programmes with the highest market share.
  • If possible, information technology should likewise be set up redundantly: GPS data used to connect grids can be transmitted twice and using different means, e.g. via radio channels and telephone lines. This could also help detect hacker manipulations.

Resource shortages

  • Since Germany has to import metals from partly unsafe and/or unreliable supplier countries, raw material efficiency should be pushed ahead, also with regard to the components of the energy infrastructure. A further approach implies substituting critical metals with other materials. Possible substitutions therefore need to be further researched.
  • It is also important to increase the recovery rates in the recycling of critical metals such as rare earths. There is still a lot of potential along the entire recycling process chain, e.g.: labels for recyclable product designs, more consumer-friendly collection systems, uniform recycling regulations across Europe, or more effective action against illegal scrap exports.


Energy policy and acceptance

  • Information and education can prepare the population for emergencies. The Concept for Civil Protection issued by the German Federal Ministry of the Interior is a case in point. It contains guidelines to protect the population in the event of a disaster and to ensure their continuous provision with energy, water, telecommunications and food. It would also be helpful to use according teaching material in schools.
  • Involving the citizens early on in the planning of energy infrastructures and construction projects and enabling a fair distribution of the burdens can contribute to maintaining the social acceptance of the energy transition and can thus help to prevent protests.
  • Since investments in energy infrastructure always have a long-term outlook, potential investors need planning security with regard to legislation and framework conditions. Hence, a forward-looking and stringent governance is necessary. Frequent changes in energy policy and conflicting decisions at regional, national and European levels tend to hamper the infrastructure expansion.

Chairman