Emerging Power Topologies: Cyber-Physical Resilience of BESS, SMRs, and Microgrids

J. McKenney

This paper is part of the WG-04-CF Cascading Failures body of work, addressing the cyber-physical resilience of the on-site microgrids that hyperscale compute campuses are building to bypass transmission interconnection delays. It sits alongside WG-04-CF-Death Wobble-The Grids Precarious Pulse Frequency Instability, which examines the same inertia-decline and RoCoF mechanism at bulk-grid scale, and WG-04-CF-ERCOT-WECC-IBR-Reliability, which examines inverter-based-resource reliability within specific US interconnections. Where those papers examine the bulk grid, this paper takes the microgrid as its unit of analysis and traces the same physical mechanism through battery storage thermal runaway, small modular reactor trust boundaries, and the actuarial structuring of the resulting risk.

Licence: CC BY 4.0. 17 September 2026.

Executive Abstract#

Hyperscale AI data centers need more electrical power than the regional grid can connect in time, so operators build their own on-site power plants, called microgrids, combining battery storage, small modular nuclear reactors, hydrogen fuel cells, and fast-starting generators. This paper examines the safety and security of that arrangement once it is running.

These microgrids are built almost entirely from power electronics rather than the heavy spinning machinery that gives a traditional grid its physical stability. That makes them quick to respond and quick to fail. A compromised battery controller can drive a fire in minutes, and a frequency disturbance can cross the whole facility in a fraction of a second, faster than software safeguards alone can be trusted to catch.

The paper works through three hazards: battery thermal runaway set off by a manipulated control system, the boundary between a reactor's safety systems and the facility's ordinary computer networks, and the swing in electrical frequency a lost generator or battery can cause. It argues that dependable protection comes only from hardware acting independently of software, such as mechanical trip relays and one-way optical links. It closes on how the risk belongs in insurance and reinsurance terms, including where it cannot be engineered away no matter how well the facility is hardened.

Abstract#

Hyperscale compute campuses require electrical power beyond what regional transmission interconnection queues can deliver on their build-out timelines, with single facilities scaling past 100 MW and gigawatt-scale clusters in active development. To bypass multi-year backlogs, operators deploy on-site microgrids combining utility-scale Battery Energy Storage Systems (BESS, 100 to 400 MWh), behind-the-meter Small Modular Reactors (SMRs), hydrogen fuel cell banks, and fast-starting reciprocating generators. Replacing spinning mass with inverter-based interfaces causes rapid synthetic inertia decay, and the Rate of Change of Frequency (RoCoF) accelerates by an order of magnitude relative to a bulk grid. Operational technology networks running unauthenticated Modbus TCP, DNP3, and IEC 61850 MMS link substations directly to enterprise cloud management. This paper models the non-linear Arrhenius kinetics of cyber-induced BESS thermal runaway, where manipulated Modbus charge registers trigger cell-to-cell propagation and toxic hydrogen fluoride (HF) off-gassing. It formulates the nuclear-to-electric trust boundary for on-site SMRs under IEC 61513, derives the swing equation governing inverter-induced frequency instability, and sets out actuarial loss parameters for property catastrophe and business interruption underwriting, including the state-backed cyber-attack exclusion that Lloyd's Market Bulletin Y5381 requires and that no engineering control here removes.

1. The Energy Bottleneck and the Microgrid Transition#

Hyperscale AI training clusters have outpaced regional transmission infrastructure:

• The Interconnection Crisis: In major data center corridors, regional transmission operators (RTOs) report interconnection study backlogs extending from four to eight years.
• The On-Site Generation Pivot: To energize facilities immediately, hyperscale operators are building dedicated on-site generation islands. Facilities decouple from the bulk electric system, operating as autonomous islanded microgrids.

1.1 The Collapse of Mechanical Inertia#

Traditional utility power grids rely on multi-ton rotating steam and gas turbines. This physical rotational mass provides physical kinetic energy storage; mechanical inertia; that resists sudden frequency shifts. When a generator trips, the system frequency drifts gradually over seconds, allowing automatic governor responses to stabilize the grid.

In an inverter-dominated microgrid, mechanical inertia is replaced by synthetic inertia synthesized via software phase-locked loops (PLL). If a cyber adversary compromises inverter firmware or manipulates frequency setpoints, software synthetic inertia collapses instantaneously. The grid enters a catastrophic high-frequency oscillation known as 'death wobble', triggering sub-station breaker trips and total campus blackout within cycles.

2. Multi-BOM and DEXPI Structural Mapping#

To model cascading electrical and thermal hazards, the microgrid architecture is structured across the DEXPI 2.0 piping and instrumentation standard, classed against the ISO 15926-4 reference data library, and the CycloneDX 1.6+ multi-BOM specification:

Integrating the DEXPI electrical schematic with CycloneDX bills of materials ensures that software controllers cannot issue inverter gating or contactor commands that breach physical mechanical and electrical limits.

3. Battery Energy Storage Systems (BESS): The Thermal Runaway Cascade#

Utility-scale BESS installations (Node N15, IEC 62443 Zone 6) provide fast frequency response and peak shaving. However, lithium-ion battery chemistry introduces an unprecedented cyber-physical catastrophe archetype: the self-sustaining thermal runaway cascade.

3.1 NFPA 855 and UL 9540A Safety Mandates#

What follows are code requirements and test-protocol requirements, not measured results. UL 9540A is a test method that characterizes how a cell, module or unit behaves once thermal runaway starts; NFPA 855 is an installation standard that sets rules referencing those test results. A design meeting both has satisfied a specification. It has not been shown to survive an attack, and no test in either document contemplates an adversary writing to the battery management system.

Under NFPA 855 (Standard for the Installation of Stationary Energy Storage Systems) and UL 9540A testing protocols, BESS installations require:

• 15-Meter Setback Distances: Minimum physical separation from data hall structures unless unit-level testing proves zero fire propagation.
• Continuous Off-Gas Detection: Electrochemical sensors detecting trace hydrogen fluoride (HF) and off-gas hydrocarbons prior to thermal runaway onset.
• Hardware-Enforced Contactors: Independent over-voltage and thermal shunt-trip breakers that disconnect the battery bank mechanically, bypassing the digital BMS.

4. Small Modular Reactors (SMRs): Cyber-Nuclear Interconnection#

To achieve carbon-free baseload power, hyperscalers are entering power purchase agreements with Small Modular Reactor developers (100 to 300 MWe). SMRs integrate directly into campus microgrids, creating an unprecedented cyber-nuclear operational boundary:

4.1 The Nuclear Boundary Invariant#

Under international nuclear safety standards (IEC 61513, IAEA NSS-17), the Reactor Protection System (RPS) must remain entirely isolated from external software networks. The data center can receive real-time power generation telemetry across a hardware-enforced unidirectional optical data diode. However, under no circumstances can data center compute workloads or AI load schedulers possess reverse write access to SMR control rod systems or primary coolant valves.

5. Mathematical Formulations Governing Microgrid Dynamics#

To quantify cyber-physical stability and catastrophic tail-risk, the microgrid power system is governed by five mathematical formulations.

5.1 The Microgrid Swing Equation and Synthetic Inertia Decay#

The dynamic frequency response of the campus power system following a cyber-induced generation trip is governed by the rotational swing equation:

Where:

• $H_{\text{sys}} = \frac{\sum_j H_j S_{n,j}}{S_{\text{base}}}$ is the effective system inertia constant (seconds).
• $\Delta f(t) = f(t) - f_0$ is the frequency deviation from nominal $60.0\text{ Hz}$.
• $D_{\text{load}}$ is the load damping factor ($\% \Delta P / \% \Delta f$).

In a conventional grid, $H_{\text{sys}} \approx 4.5\text{ to }6.0\text{ s}$. In an inverter-based microgrid, physical inertia collapses to $H_{\text{sys}} < 0.8\text{ s}$. The maximum Rate of Change of Frequency ($\text{RoCoF}$) immediately following an instantaneous generation dump $\Delta P_{\text{dump}}$ is:

For a $100\text{ MW}$ facility ($S_{\text{base}} = 100\text{ MVA}$) experiencing a cyber-induced $30\text{ MW}$ BESS inverter trip with $H_{\text{sys}} = 0.75\text{ s}$:

Standard under-frequency load shedding relays trip at $1.5\text{ to }2.0\text{ Hz/s}$. A $\text{RoCoF}$ of $12.0\text{ Hz/s}$ trips every protection relay across the campus in less than $120\text{ milliseconds}$, causing an instantaneous, uncoordinated blackout before backup diesel generators can initiate cranking cycles.

5.2 Arrhenius Thermal Runaway Chemical Kinetics#

The temperature escalation inside a compromised lithium-ion battery cell is governed by coupled non-linear Arrhenius heat generation equations:

Where:

• $\Delta H_i$ is the enthalpy of reaction for cell component $i$ (SEI layer, anode, cathode).
• $E_{a,i}$ is the activation energy ($120\text{ to }140\text{ kJ/mol}$).
• $C_{\text{cell}} = 980\text{ J/K}$ is the cell heat capacity.

When an adversary modifies BMS holding registers to force continuous overcharge ($V_{\text{cell}} > 4.25\text{ V}$), internal Joule heating $\dot{Q}_{\text{joule}} = I^2 R_{\text{int}}$ drives $T_{\text{cell}}$ past $80.0^\circ\text{C}$. Once the Arrhenius exponential terms ignite, heat generation scales exponentially, driving cell temperature past $650^\circ\text{C}$ at a rate of change exceeding $45^\circ\text{C/s}$.

5.3 Convective Heat Removal Collapse and Silicon Thermal Trip#

Simultaneously, compute racks drawing power from the microgrid experience cooling failure if water pumps trip:

Where volumetric flow collapses from $122\text{ L/min}$ PG25 coolant to zero, and a silicon heat flux of $75\text{ W/cm}^2$ drives junction temperature to the $94.0^\circ\text{C}$ emergency hardware shutdown trip point within $14.8\text{ seconds}$, dropping every accelerator package in the rack off power at once.

5.4 Probable Maximum Loss (PML) for Campus Microgrid Collapse#

For property catastrophe and cyber business interruption underwriting, the total Probable Maximum Loss resulting from a coordinated BESS thermal runaway and substation explosion is formulated as:

Where:

• $C_{\text{BESS}} = 45{,}000{,}000\text{ USD}$ (complete replacement of 200 MWh containerized battery facility).
• $C_{\text{substation}} = 18{,}000{,}000\text{ USD}$ (lead-time replacement of two 230 kV transformers).
• $\dot{L}_{\text{BI}}(t) = 18{,}500\text{ USD/hour}$ continuous business interruption loss.
• $T_{\text{restore}} = 52\text{ weeks} = 8{,}736\text{ hours}$ (substation transformer lead time).

This represents a classic Table B Extremistan catastrophe. The financial consequence of a cyber-physical failure dwarfs traditional IT breach losses by over an order of magnitude.

5.5 Return on Security Investment (ROSI) for Microgrid Safety Interlocks#

Deploying hardwired analog over-voltage relays, physical synchrocheck interlocks, and optical data diodes ($C_{\text{control}} = 680{,}000\text{ USD}$) reduces annual loss expectancy from $\text{ALE} = 17{,}980{,}000\text{ USD}$ to $\text{ALE} = 360{,}000\text{ USD}$, delivering $\text{ROSI} = 2{,}491\%$ (modeled: the arithmetic recomputes exactly from the three stated inputs, and this working group chose all three).

The control cost, the unmitigated annual loss expectancy and the residual loss expectancy are scenario parameters for the reference microgrid of section 4. No claims population, vendor quotation or operator record stands behind any of them. The ratio is a statement about the model rather than a measured return on a real deployment, and it moves proportionally with whichever input a reader disputes. Halve the avoided loss and the figure halves. The only published benchmark this working group holds for control effectiveness is the Dragos and Marsh McLennan 2025 OT Security Financial Risk Report, which measures average risk reduction per control class in the range of 12 to 18 percent, and it measures reduction in risk rather than return on investment, so it does not bound this number in either direction.

6. The Three Architectural Invariants of Microgrid Resilience#

To eliminate Table B catastrophe risks across emerging power topologies, facility operators must implement three non-negotiable architectural invariants:

6.1 Invariant 1#

Hardwired Analog Safety Isolation (SIL-3)

Every BESS container must incorporate an autonomous, analog safety loop conforming to IEC 61508 / NFPA 855. Snap-action thermal fuses and off-gas sensors must be wired directly to shunt-trip coils on the primary DC disconnect switch. Under excessive voltage or temperature, the contactor opens by spring release in $< 40\text{ milliseconds}$, physically interrupting the fault current independently of the digital BMS.

6.2 Invariant 2#

Unidirectional Generation Telemetry (Optical Diode)

All telemetry passing between on-site generation sources (SMRs, utility substations) and the facility building management network must cross an optical data diode enforcing physical unidirectional transmission ($C_{\text{reverse}} \equiv 0.000\text{ bps}$). SCADA networks cannot inject setpoint writes or breaker trip commands into the generation control domain.

6.3 Invariant 3#

Electromechanical Synchrocheck Interlocks

To prevent out-of-phase breaker closure attacks (which physically destroy substation transformers and generator shafts), all grid-tie breakers must incorporate hardwired electromechanical synchrocheck relays (Device 25). The breaker closing coil cannot receive electrical current unless the phase angle, voltage magnitude, and frequency differences across the contacts are verified to be within safe mechanical synchronization tolerances.

7. Actuarial and Reinsurance Treaty Structuring#

Underwriting emerging microgrids and BESS installations requires aligning policy language with the physical invariants set out in section 6. Those three invariants are this working group's own synthesis. No insurer has been shown to underwrite against them, and no treaty is known to reference them.

The table below is a proposed treaty structure rather than observed market terms. Every deductible, waiting period and loading in it is set by this working group to show the shape of the argument, not quoted from a reinsurer:

8. Summary of Engineering Principles#

Emerging power topologies demand five immutable engineering principles:

1. Inverter Grids Have No Inertia: Replacing spinning mass with power electronics accelerates frequency decay. Protection systems must operate in milliseconds, not seconds.
2. Lithium-Ion Fire is a Chemical Event: Once thermal runaway ignites, software cannot extinguish it. Safety systems must physically prevent the initial cell breach.
3. Nuclear Demands Absolute Unidirectionality: SMRs provide tremendous baseload energy, but reactor protection systems must remain completely isolated from enterprise IT networks.
4. Mechanical Interlocks Trump Digital Commands: Never allow a software algorithm exclusive authority to close an electrical breaker or open a cooling valve.
5. Actuarial Grounding Enables Capital Growth: Transparently modeling lead times and Probable Maximum Loss transforms uninsurable microgrid risks into an underwritten, capital-efficient asset class.

9. References#

The technical claims above rest on the standards and specifications applied in the body text: the DEXPI 2.0 piping-and-instrumentation standard, the ISO 15926-4 reference data library, the CycloneDX 1.6+ multi-BOM specification, NFPA 855 and UL 9540A for battery energy storage installation and testing, IEC 61513 and IAEA NSS-17 for nuclear instrumentation and control, IEC 61508 for functional safety, and IEC 62443 for industrial automation and control system security. The reinsurance treaty structure in section 7 and the mathematical parameters in section 5 are this working group's own modeled scenarios rather than figures drawn from a published source, and are disclosed as such where they appear.