The US power grid operates at roughly 50% of its physical transmission capacity. This is intentional: it is the direct consequence of how the grid's reliability requirement is implemented. This post explains the mechanism, why it was the correct design given the technology available when it was built, and what changes when sub-second computation and control become available.
No power systems background is required. Where a grid concept has a close analog in distributed systems, I use it. The interactive models below solve the real power flow equations on small networks. One caveat before we start: everything here is deliberately reduced to the principal idea. The real system carries more detail (more constraint families, messier dynamics, thousands of elements instead of five), but nothing essential is lost in the reduction. Treat this as a solid base on the first principles; reality adds complexity on top of them, not exceptions to them.
The central concept is a reliability criterion called N-1.
Part 1: Power flow is not routed
In a data network, a control layer decides the path of each packet. The grid has no equivalent layer. When a generator injects power toward a load, the power divides across all available paths simultaneously, in proportions determined by the impedance of each path (Kirchhoff's laws). The operator chooses injections and topology; the resulting flows are determined entirely by physics. A path cannot be logically removed from service. If a conductor is connected, current flows through it.
Every property described below follows from this fact: flows are solved by physics, not assigned by an operator.
Part 2: The N-1 criterion and its cost
The grid's core reliability requirement, N-1, states: with all N elements in service, the system must withstand the loss of any single element (any line, transformer, or generator) without overloading the remaining elements or interrupting load. The criterion exists because single failures are routine events (lightning, ice, vegetation, equipment faults), and a single failure must never propagate.
The cost of the criterion becomes visible in the simplest case: two identical parallel lines between a generation source and a load center, each rated 100 MW. Physical corridor capacity: 200 MW.
Consider the loss of line 1. Because flows are solved by physics, all of line 1's flow redistributes onto line 2 instantaneously, at electrical speed, before any measurement or control system can respond. If the corridor was carrying 160 MW, line 2 now carries 160 MW against a 100 MW rating, with no remediation possible in the interval.
The N-1 criterion therefore requires that line 2 be able to absorb the full corridor flow at all times. The corridor limit is 100 MW, 50% of the installed capacity, as a standing condition.
In distributed-systems terms, this is an active-active configuration sized so that any single node failure leaves the survivors within their limits, under the assumption of zero-time failover with no rebalancing step, because in this system, load redistributes at electrical speed and no controller participates.
Real grids are meshed networks, so the general form of the constraint is: every line must carry its own flow plus sufficient headroom to absorb the worst-case redistribution from the failure of any other element, at every moment. Aggregated over thousands of elements, this places usable network capacity far below installed physical capacity.
It is worth stating precisely what the reserved margin is. N-1 does not actually require idle conductors. It requires that a survivable path exist after any single failure. Idle physical capacity is one way to guarantee that path: the redundant element is copper. It is not the only way, and recognizing that is the core of this post. The standing margin implements one specific assumption: no corrective action will occur between the failure and the consequence. When the criterion was codified, that assumption was accurate. Corrective action meant human operators and telephone coordination, on a timescale of minutes. Whether it still holds is a quantitative question, and answering it requires knowing how much time is actually available after a failure.
Part 3: Limits are deadlines
A rating is commonly treated as a fixed threshold, but no element fails at 101% of its rating. Failure occurs when a physical process, driven by the violation, runs to completion. Different processes have different time constants, and the industry has always known this. It is visible in the standards themselves, as shown below. This post covers the two constraint families that dominate transmission capacity; a third, frequency (the balance between total generation and total load, with its own failure modes and time constants) is a large topic that this post does not cover.
Thermal
Current flowing through a conductor dissipates heat (I²R). The conductor's temperature is a balance between that heating and cooling from the surrounding air, which is why a line's true capacity depends on ambient temperature, wind speed, and solar radiation, not just its construction. Consequences of overheating arrive in stages: the conductor elongates and sags toward whatever is beneath it (vegetation, roads; sag-induced faults, not melting, are the typical first failure), and sustained high temperature permanently anneals the aluminum, degrading its strength.
The key property is thermal mass. A conductor at equilibrium takes minutes to reach a damaging temperature after an overload begins. The industry already encodes this as tiered ratings: a normal rating for continuous operation, and emergency ratings (long-time and short-time) that permit substantially higher loading for bounded windows, typically 15 to 30 minutes and shorter, precisely because the metal needs time to heat. The time-dependence of limits is not a novel claim; it is printed in every facility ratings sheet. What the static implementation does is assume the worst weather and the longest exposure simultaneously, forever.
The industry's current improvement on this front is Dynamic Line Ratings (DLR): computing the actual thermal rating in near real time from weather data, instead of assuming the worst case. It is a real improvement, and it composes with everything described below. But DLR is sometimes presented as the fix for the capacity problem, and it is not, for two reasons. It is informational: a better number, with no response attached to it. And it is weather-dependent: the capacity it grants appears and disappears with wind and temperature, which is of limited use to loads like data centers that require firm, steady power regardless of what the weather decided to do today. DLR raises the thermal rating on favorable days. It does not produce dependable capacity.
Voltage
Voltage is the grid's pressure. Moving real power across a network also consumes reactive power, a second quantity that does no useful work but is required to hold voltage up, and which is expensive to transport over distance. As power transfer through a corridor increases, the reactive losses grow roughly with the square of the flow, and voltage at the receiving end sinks.
The dangerous property is the shape of that relationship. Plotting receiving-end voltage against power transferred produces the well-known P-V ("nose") curve: voltage declines gently at first, then the curve bends, and beyond the nose point no operating solution exists at all. The equations stop having an answer. Physically, the system collapses: voltage falls, motor loads stall and draw even more reactive power, generators hit their reactive limits and drop their support, and each effect accelerates the others. The process completes in seconds, and unlike thermal overload it gives little margin between "degrading" and "gone." Voltage limits therefore bind hard and fast, and they are a function of the whole network state (how much reactive support is online, where, and how loaded), not a property of any single line.
The response deadline for any given contingency is the minimum over the applicable time constants: minutes when thermal binds, seconds when voltage does.
This is also why monitoring alone cannot substitute for margin: SCADA, the grid's standard telemetry system, polls on a 2 to 4 second cycle. A voltage event can begin and complete within a single polling interval.
Part 4: What a corrective action is
Before discussing response systems, it's worth being concrete about what "responding" physically means, because you cannot route power, so the levers are not what a network engineer would expect.
Since flows are fully determined by injections and topology (Part 1), those are the only two things a corrective action can change:
Change the injections. Reduce or shift consumption at a load (load shedding or curtailment), raise or lower a generator's output (redispatch), or command a battery to absorb or inject. And the lever is not only active power: the same devices can inject or absorb reactive power, which props up voltage exactly where it is sagging (the constraint from Part 3). Any change in the injection pattern re-solves the flows everywhere. Shedding 80 MW at the right node can relieve an overloaded line hundreds of kilometers away: the physics does the routing you can't.
Change the topology. Open or close breakers to reconfigure the network. Removing or adding a path changes the impedance pattern and redistributes every flow. (Counterintuitively, opening a line sometimes relieves an overload elsewhere.) This also includes disconnecting a generator or a load entirely for a bounded time: large loads increasingly carry backup power precisely so they can ride through such an interval without noticing it.
The relevant question is how fast these levers move. Traditional levers were slow: a thermal generator ramps over minutes. Modern levers are not. A battery inverter reverses full power in milliseconds. A breaker operates in 2 to 5 cycles (33 to 83 ms). A large computing load with power-electronic infrastructure can shed a controlled block of demand in well under a second. The actuation layer capable of acting inside the windows from Part 3 already exists and is connected to the grid in growing quantity, notably in exactly the facilities currently waiting in interconnection queues.
So the physical response fits the deadline. What remains is the decision: knowing which lever, by how much, at which node, for the specific failure that just occurred. That is where the problem gets interesting.
Part 5: The response path cannot include computation
Assume the actuators from Part 4 and a system with perfect knowledge: at every moment it knows the correct corrective action for the current state. This is still insufficient, because the post-failure interval contains other actors.
The grid's protection layer consists of thousands of relays: fast, simple, local devices, each monitoring one element, each authorized to disconnect that element within 16 to 80 ms if measurements indicate it is endangered. Relays do not coordinate and hold no global state. (The circuit breaker pattern in software is named after these devices, and the analogy is structurally exact: local, fast, stateless with respect to the rest of the system.)
This produces the grid's principal failure mode. A line trips; flow redistributes instantaneously onto neighboring lines; a neighbor becomes overloaded; if the overload persists, that neighbor's relay disconnects it, a correct local action, which redistributes additional flow onto the remaining lines, triggering further disconnections. This is a cascading failure in which every component operates as designed. The 2003 Northeast blackout followed this structure: ordinary initiating faults, then a sequence of individually correct protective disconnections, ultimately interrupting service to roughly 50 million people.
System-level corrective action must therefore complete within the binding time constant, and before local protection reclassifies the disturbance as its own problem. The end-to-end budget (detect, decide, communicate, actuate, across hundreds of kilometers) is well under a second in the binding cases.
One step does not fit in that budget: computing the corrective action. Contingency analysis on a real network takes orders of magnitude longer than the window. The design conclusion is a control plane / data plane separation:
Corrective actions are computed before failures occur: for every credible contingency, against every applicable time constant, re-solved continuously as system conditions change. When a contingency occurs, the response path executes a pre-armed plan. No computation occurs on the response path.
The latency slider isolates the variable that matters: with identical knowledge and an identical plan, response time alone separates an absorbed contingency from a cascade.
Part 6: The industry's first iteration: remedial action schemes
The industry reached this conclusion decades ago, and built it. The result is called a Remedial Action Scheme (RAS, also called a Special Protection Scheme): an automatic system that detects a predefined condition (a specific line loss, a specific overload) and executes a predefined response, typically within cycles. RAS are fast, they are real, and hundreds of them operate on the North American grid today. Some transfer paths owe a substantial fraction of their usable capacity to a RAS standing behind them.
The idea was right. The implementation was bounded by the computation available when it was designed:
The plans are static. A RAS is engineered offline: months of studies produce a fixed decision table (if line X trips while flow exceeds Y, shed Z) or, in more sophisticated schemes, a fitted polynomial that interpolates between studied operating points. The polynomial versions are better than tables, but both share the same defect: they are frozen approximations of a moving system, valid only within the envelope of conditions studied at design time. Between revisions, often years apart, the grid changes daily, and the scheme answers every state with the same frozen logic. It must therefore be designed for the worst state it might encounter, which reintroduces conservatism: static margin, relocated into a static automaton.
The scope is local, and the interactions are unstudied. Each RAS watches a handful of elements and acts on a handful of elements. It cannot see that the wider network state has made its programmed response insufficient, excessive, or, in unlucky combinations with neighboring schemes, counterproductive. This is not hypothetical: RAS acting on incomplete information can themselves initiate or accelerate cascading failures, and the interaction problem grows combinatorially. Past roughly ten schemes on one system, exhaustively studying their joint behavior becomes intractable: each new RAS must be checked against every credible state of all the others. The industry manages this with conservatism and review boards, which is to say: with more margin.
The schemes don't follow the grid. A RAS is designed against a specific topology. Add a line, retire a plant, reconfigure a substation, and the scheme's studies are invalidated, triggering months of re-engineering, during which the scheme runs degraded, disabled, or wrong. On a grid that is now changing faster than at any point since its construction, logic frozen at design time ages in months, not decades.
The actions are blunt. A RAS lever is usually a breaker, so its response comes in large fixed blocks: trip this plant, drop that load block. If a contingency creates a 1 MW overload, a granular system like DCM (the system we build at Splight) can resolve it by ramping a single resource down by exactly 1 MW. A RAS resolves it by disconnecting whatever block it was wired to disconnect, often tens or hundreds of megawatts, and that oversized action is itself a new disturbance the rest of the system has to absorb. Blunt corrections at scale are not a rounding error; they perturb frequency, voltage, and the flows on every neighboring path.
What changed is not the concept but the available computation. It is now feasible to run the full network model (every credible contingency, checked against thermal and voltage constraints, using live system state and live topology) and regenerate the entire response table on a cycle of roughly 500 milliseconds, continuously. In RAS terms: instead of a fixed table for a few scenarios on a few paths, designed for the worst case and revised every few years, the table covers all credible contingencies network-wide, absorbs topology changes as just another input, and is recomputed before the ink on the previous one is dry. The execution layer stays as fast and simple as a RAS. The intelligence behind it becomes global and current. And because every armed plan is re-verified against the whole network state on every cycle, the scheme-interaction problem is solved by construction rather than by committee.
RAS, 1985
8 months
recomputed every 500 ms
Part 7: Redundancy moves from copper to control
Combining the pieces. In the models above, the corridor operated at up to 90% of installed capacity while still satisfying the N-1 criterion. The criterion was not relaxed; its implementation changed. N-1 requires a survivable path after any single failure, and a verified, pre-armed response, checked continuously against every applicable time constant is such a path. The redundant element is no longer a conductor held in reserve. It is a control action held in reserve. Redundancy migrated from hardware to control, the same migration storage made from RAID mirrors toward erasure coding and software-defined replication: the guarantee is preserved; the idle physical duplication is not.
Two further observations.
Speed is capacity. The relationship between response time and usable capacity is direct and monotonic. A guaranteed response inside the thermal window (minutes) lets operation consume the thermal margin, because emergency ratings become genuinely usable rather than theoretically available. A response inside the voltage window (seconds) unlocks the margin held against voltage collapse. Every reduction in guaranteed end-to-end latency converts another tranche of standing margin into usable transfer capability. This is the quantitative sense in which faster control is more grid.
Security doesn't expire after the first failure. This one comes free, and it is easy to miss. A static implementation is engineered against the first contingency only. Once an element is actually lost, the grid is in a new configuration that the design studies may never have examined, and the standards acknowledge this openly: after a contingency, operators are given a window, on the order of 30 minutes, to manually redispatch the system back to a state that can survive the next single failure. Between the failure and the redispatch, the criterion is effectively suspended; the grid is secure against the failure that already happened, not the one that might come next. A system that regenerates the full contingency plan every 500 milliseconds has no such gap. Within one cycle of losing an element, it has verified and armed responses for every credible failure of the network as it now stands, and again after the second failure, and the third. The criterion stops being "survives one failure from the healthy state" and becomes "survives the next failure from whatever the current state is," enforced continuously through arbitrary sequences. Usable throughput steps down as elements are lost, as it physically must. Reliability does not. And for the rare deep event, the once-in-several-years sequence where post-contingency capacity temporarily dips below connected load, fast storage can carry the affected loads through the reduction until the system re-secures. That mechanism deserves its own post; here I'll only note that it exists and composes with everything above.
The result is a higher constant, not a fluctuating one. A reasonable objection: if the limit now depends on computation, does capacity become variable, here today, gone tomorrow? No, and the distinction matters. The physical limit of the corridor is a constant, set by the conductors. The static N-1 rating is a much lower constant, set by the no-response assumption. What continuous computation and fast execution deliver is a new, higher constant, as close to the physical constant as your guaranteed response time allows, because the armed response is verified against every credible contingency on every cycle, in all conditions, including the worst ones. The computation doesn't make the limit wobble; the computation is what makes the higher firm number safe to promise. That firmness is the property that matters to real loads: a data center cannot run on capacity that depends on the weather. (For completeness: this firm limit can be composed with DLR to gain an additional weather-dependent increment on favorable days. It is a marginal refinement and not the point of this post.)
Closing
The N-1 criterion is sound engineering and should remain the standard. Its original implementation (standing physical margin) was the correct design for a system whose fastest control loop was a human being, and the industry's own RAS programs show it has been reaching toward the computed alternative for decades, as far as each era's computation allowed. What is different now is that the computation fits: a full-network contingency plan, verified against thermal and voltage constraints, regenerated every 500 milliseconds, with an execution path measured in milliseconds.
Under that implementation, the same reliability standard is satisfied with substantially less idle capacity, which matters at a moment when interconnection queues hold terawatts of pending load and new transmission takes a decade to build.
The way I think about it: the grid has been running the same operating system for fifty years. A good one, written for the hardware of its time. But this machine is the backbone of every industry we have, and now of the AI buildout on top of them; it is too important to keep running on assumptions about what computers couldn't do in 1975. It is time to write it a better operating system. That is the problem Splight works on: the control plane that computes armed responses continuously, and the execution path that carries them out in sub-seconds on live grid infrastructure. It is the most demanding real-time systems problem I have worked on, and the reason I find the field worth the years it will take.