Layered Economic Loss Function for Electricity Endurance Risk

The Categorical Failure of VAR for Outage Risk

Value at Risk (VAR) and its successor Conditional Value at Risk (CVaR) are built on a continuity assumption: small changes in the underlying variable produce proportionally small changes in portfolio value. For electricity price exposure — the exposure a manufacturer faces when spot prices spike — this assumption holds approximately. If electricity costs rise 50%, operating margins compress by a calculable amount.

Physical outage risk violates the continuity assumption in three distinct ways.

State transition, not price change. A grid under stress does not gradually reduce supply — it maintains nominal voltage until it cannot, then drops abruptly. The economic damage function is not smooth; it has hard thresholds at the moment supply fails. A firm with uninterruptible processes faces zero marginal cost from the first hour of high prices and catastrophic cost from the first second of lost supply. These are not on the same curve.

Duration dependence is nonlinear. Two hours without power is an operational disruption. Twenty hours is a process catastrophe for any continuous manufacturing operation. The damage does not scale proportionally — it accumulates through qualitatively different phases as successive tolerance thresholds are breached. A paper mill that shuts down cleanly at hour two faces a different cost structure than one that runs its process into an uncontrolled stop at hour six.

Timing heterogeneity is invisible to price models. A stress hour at 03:00 on a Sunday in May has approximately zero economic consequence for most commercial actors. The same stress hour at 14:00 on a Tuesday in January, during a cold spell, with industrial loads at maximum and hospital systems under peak demand, carries orders-of-magnitude higher systemic cost. Standard energy risk models assign identical weight to both.

The Layered Economic Loss Function (LELF)

The LELF maps outage duration to cumulative economic damage through discrete threshold layers. Each layer represents a qualitatively distinct damage category that becomes active when a duration threshold is crossed.

Layer definitions

The layer thresholds are sector-specific. The table below shows the kernel layer structure; §02.1 details subsystem threshold profiles for each infrastructure category.

Finnish empirical reference: VTT and Energiateollisuus ry cost-of-interruption studies provide sector-specific loss rates in €/kWh unserved. These are linear averages which systematically understate L3–L5 costs as they are derived from short-duration survey data. The LELF framework uses these as L1–L2 baselines and applies threshold multipliers for L3–L5 based on process engineering tolerances and the subsystem profiles in §02.1.

Subsystem Response Profiles

The following profiles specify buffer capacity, threshold dynamics, and recovery asymmetry for six critical infrastructure subsystems. These feed into the LELF layer calculation as sector-specific θᵢ(s) values and inform the dependency overlay described in §02.2.

District heating

District heating has one of the largest buffer capacities of any electricity-dependent system, but the buffer size varies by three orders of magnitude depending on system scale. Large urban systems (Helsinki, Vantaa) operate massive hot-water accumulator tanks — Helen's Salmisaari facility holds 10,000 m³, providing approximately 48–72 hours of heating at normal winter demand before supply temperature begins falling. Smaller municipal systems typically operate with 6–12 hours of thermal mass. Rural and building-scale systems have 2–4 hours of radiator and pipe thermal storage.

Recovery asymmetry: once district heating pipe temperature drops below operational threshold, restart requires pressurisation, venting, and sequential reactivation across the distribution network — typically 4–12 hours after power is restored. L3 threshold is therefore: Helsinki/Vantaa ~48h; mid-size cities ~6–12h; rural/small systems ~2–4h.

Water supply

Water towers and pressure vessels provide 2–6 hours of buffer at normal consumption. The failure mode is not purely a pressure event — it is a contamination event. When network pressure drops below a threshold, external pressure can drive contaminants into the distribution network. This activates a post-restoration protocol: network flushing, water sampling, and laboratory confirmation before the network is declared safe. This protocol typically requires 12–48 hours after power restoration regardless of outage duration.

Recovery asymmetry is severe: a 6-hour outage may produce 48–72 hours of post-restoration unavailability. The LELF L3 threshold for water supply is therefore not symmetric — it should be expressed as a function of both outage duration and post-restoration recovery time. Pumping stations in smaller municipalities have limited generator capacity and fuel reserves, creating L4 exposure at 6–12 hours.

Wastewater management

Wastewater pumping stations are fully electricity-dependent with limited buffer capacity. Collection network storage — the volume held in pipes and lift station wet wells — typically provides 2–6 hours of buffer before overflow conditions develop, depending on inflow rates and network topology. Unlike water supply, where pressure loss is the primary failure mode, wastewater failure produces an active environmental hazard: untreated sewage discharge to waterways, streets, or basements. This makes wastewater one of the fastest-escalating LELF categories.

Finnish regulatory requirement (Water Services Act) mandates controlled overflow to designated discharge points before uncontrolled overflow occurs. This requires active management — operators must be reachable and able to respond — which in turn depends on telecommunications remaining functional. The cascade: telecommunications degradation at ~3 hours impairs wastewater operator response precisely when buffer exhaustion is approaching.

Recovery asymmetry is severe and environmentally extended. After power restoration, network decontamination, pump inspection, and environmental sampling are required before normal operation resumes. Regulatory reporting and remediation obligations may extend the effective recovery period by days to weeks. Finnish environmental law (Ympäristönsuojelulaki) triggers mandatory notification and liability assessment from confirmed overflow events.

Biological treatment processes (activated sludge) at wastewater treatment plants do not survive extended shutdowns — microbial communities die within 12–24 hours of aeration failure, requiring 1–2 weeks of biological recovery before the plant reaches normal treatment efficiency. This creates a post-restoration discharge quality problem independent of the overflow events during the outage itself.

Empirical recovery rule: if outage duration is d hours, total wastewater system impairment (outage + recovery) is approximately 3–5 × d hours. The LELF loss function for wastewater takes the form:

L3 threshold: 2–4 hours (overflow risk). L4 threshold: 6–12 hours (confirmed environmental discharge, remediation liability). Smaller municipalities with limited generator capacity face L3 exposure significantly earlier than urban systems.

Healthcare

Healthcare has among the most robust backup power of any sector — major hospitals operate diesel generators sized for 24–72 hours at full load, with priority fuel resupply agreements. However, the failure profile is not binary and the recovery asymmetry is significant. The sector also has the highest unit cost of failure of any LELF category: an interrupted intensive care procedure or delayed emergency response has no economic analogue.

L1 threshold (0–4h): Elective procedures paused, generators running, critical care unaffected. L2 threshold (4–12h): Smaller health centres approach generator fuel limits; patient transfer decisions begin. L3 threshold (12–48h): Larger hospitals on fuel consumption alert; non-critical wards may lose power sequentially as fuel is rationed to ICU and operating theatres. L4 threshold (48h+): Only the largest facilities with dedicated fuel reserves remain fully operational; widespread patient evacuation required for mid-tier hospitals.

Recovery asymmetry: elective surgery backlog, equipment recertification, staff fatigue from extended emergency protocols, and patient record system restoration typically add 6–24 hours of reduced-capacity operation after power restoration. The primary dependency is fuel logistics — healthcare endurance is ultimately bounded by diesel resupply chains, not generator capacity.

Fuel distribution — Core System Variable

Fuel distribution is the hidden cascade amplifier in the LELF framework. Most petrol stations have no backup generation — pumps, payment terminals, and monitoring systems operate on UPS for 0–2 hours, then stop. This creates a supply constraint that progressively limits the effective duration of all diesel-dependent backup systems across every other LELF sector.

The cascade timeline: at L1 (0–2h), fuel stations begin failing. By L2 (2–6h), approximately 95% of retail fuel stations are non-operational. Backup generators across hospitals, data centres, telecommunications base stations, and water pumping stations begin drawing down their stored diesel reserves. By L3 (6–12h), only facilities with dedicated fuel contracts and pre-positioned reserves (major hospitals, large data centres, critical telecoms nodes) retain meaningful fuel security. All other backup-dependent systems begin entering forced shutdown as their stored diesel is exhausted.

This creates a structural revision to all other subsystem θ(s) values: the nominal backup duration (e.g., hospital 72h, data centre 48h) applies only if fuel resupply logistics function. Under an extended outage with simultaneous road network disruption (weather, traffic management failure), effective backup duration collapses to stored-diesel capacity only — typically 12–24 hours for most facilities. The fuel distribution subsystem is therefore not a LELF category in its own right but a time-dependent modifier R_fuel(d) applied to all backup-dependent subsystems:

Cold chain (food and pharmaceutical)

Retail cold chain has minimal buffer: supermarket refrigeration operates on UPS for 0–4 hours, after which perishables begin degrading. Large cold storage warehouses retain temperature for 12–24 hours through insulation. Pharmaceutical cold chain (insulin, vaccines) follows supermarket timelines for retail pharmacies but hospital pharmaceutical stores typically have 24–48 hours of managed storage. Economic loss scales steeply: L2 (4–6h) produces significant fresh produce loss; L3 (12–24h) produces near-total warehouse inventory loss with mandatory disposal under food safety law. Recovery requires regulatory inspection and restocking — typically 2–5 days of reduced availability. Finnish food retail concentration (S-group, K-group) means that central warehouse losses cascade directly to retail availability.

Payment systems

Bank data centres maintain backup power comparable to large data centres (48–72h). However, retail payment infrastructure — card terminals, ATMs, point-of-sale systems — has minimal backup. UPS provides 0–2 hours; thereafter, only cash transactions are possible. ATM networks typically have 4–8 hours of UPS backup but cannot be restocked without functioning logistics. At L2 (2–6h), cashless payment fails across most retail and service locations. This creates social friction that compounds all other crisis responses: fuel cannot be purchased for generators, emergency supplies cannot be bought, logistics cannot be coordinated through normal commercial channels. Payment system failure is not a direct economic loss in the LELF sense — it is a friction multiplier that degrades the efficiency of every other crisis response by 20–40%.

SCADA and industrial control systems

SCADA and remote control systems are not an independent LELF sector — they are a cascade accelerator. Power grid SCADA, district heating remote control, water utility monitoring systems, and traffic management operate on 4–12 hours of backup power but are often disabled earlier by telecommunications failure. When SCADA systems lose visibility, operators cannot monitor or adjust connected equipment even if the physical infrastructure (pump, valve, substation) remains functional. Recovery requires manual site visits — a process that is extremely slow under simultaneous road network degradation.

Practical consequence: SCADA failure shortens the effective threshold for all dependent subsystems by 20–40% — a water pumping station rated for 6-hour manual operation under outage conditions effectively becomes a 4-hour system if operators cannot remotely diagnose fault conditions. This coefficient is already incorporated into the dependency overlay in §02.2.

Airports

Helsinki-Vantaa Airport has robust backup power (48–72h). However, approach lighting, radar, and instrument landing systems are sensitive to power quality — any voltage irregularity or transition to generator power triggers safety protocols that temporarily halt landings and departures. An outage exceeding 2 hours suspends all flight operations. Air freight (pharmaceuticals, critical components, mail) and passenger evacuation capacity are unavailable during this period. Recovery requires system recertification — typically 4–12 hours after power restoration. Regional airports have significantly weaker backup systems and may face extended closure.

Metro and trams

Helsinki Metro operates on a dedicated 110 kV feed with backup power for pumping stations and safety systems only — not for train traction. An outage exceeding 15 minutes halts the entire metro network. Helsinki, Tampere, and Turku trams follow the same logic. Electric bus charging infrastructure fails immediately; battery-powered buses continue for 2–4 hours on stored charge before the urban bus network reverts to diesel buses — subject to fuel availability under the R_fuel(d) constraint described above. Combined, urban public transport capacity collapses to approximately 30–50% within 4 hours and to diesel-only within 6 hours.

Telecommunications (4G/5G)

Finnish regulatory requirement mandates 3-hour battery backup at base stations. This can be extended to approximately 20 hours with mobile generator units, but generator deployment requires logistics coordination and fuel. The failure profile is non-binary: voice calls and SMS function until battery exhaustion; data services degrade earlier as backhaul links lose power. The critical dependency is that telecommunications degradation impairs remote monitoring and control of other infrastructure systems — district heating, water pumping, hospital coordination — creating a cascade multiplier on other LELF layers.

L2 threshold: ~3 hours (statutory battery exhaustion). L3 threshold: ~6–8 hours (data backhaul degradation, mobile generator deployment window closing). Timing multiplier f(t,s) is particularly high for telecommunications because control system dependencies are constant across diurnal cycles.

Data centres

Data centres operate with UPS systems providing 10–15 seconds of seamless transition to diesel generator. Well-operated facilities can sustain full load indefinitely given fuel supply. The critical vulnerability is fuel logistics: a 48-hour outage in a major weather event may exhaust diesel reserves and disrupt resupply if road access is compromised. L1 threshold is effectively zero — UPS handles the transition. L2 threshold is fuel-supply dependent, typically 48–72 hours for well-equipped facilities. Smaller or older facilities may face L2 at 12–24 hours.

Rail transport

Electrified rail has essentially zero buffer capacity — trains stop immediately on power loss. The recovery profile is asymmetric and slow: safety systems (switches, signals, level crossings) require sequential reset and manual inspection before resuming operations. A 2-hour outage may produce 4–6 hours of operational disruption during recovery. Rail's primary LELF contribution is indirect: it impairs emergency logistics, fuel resupply, and personnel mobility during extended events, amplifying damage in other sectors. L1 threshold: immediate (minutes). Recovery multiplier: 2–3x outage duration.

Traffic management and emergency access

Traffic signal UPS systems provide 15–60 minutes of buffer. After exhaustion, dark signals significantly increase accident risk and create congestion that impairs emergency vehicle access. The cascade effect: impaired emergency access slows response to all other infrastructure failures. L1 threshold: 15–60 minutes. The timing multiplier f(t,s) is highest during peak traffic hours — a 14:00 weekday outage carries 3–5x higher cascade cost than a 03:00 weekend outage for this subsystem.

Buildings (non-district-heating)

Buildings with electric heating (heat pumps, resistance heating) lose heating immediately. Thermal mass provides 12–48 hours of temperature retention depending on insulation quality, external temperature, and building type. Modern well-insulated buildings retain heat significantly longer than older stock. Below −15°C external temperature, poorly insulated buildings may face freeze damage to pipes and pumping equipment within 24–48 hours. Recovery asymmetry: freeze damage to pipework requires repair before heating can be restored, creating extended post-restoration downtime. L3 threshold: 24h (poorly insulated, −15°C); 48h (modern insulated, −10°C).

Dependency Overlay

The subsystem profiles in §02.1 interact through dependency relationships that amplify LELF damage beyond the sum of individual sector losses. The primary cascade chains are:

Electricity → Telecommunications → Infrastructure control. Telecommunications degradation (L2, ~3h) impairs remote monitoring and control of district heating substations, water pumping stations, hospital systems, and rail infrastructure. This accelerates the threshold crossing for all dependent systems — effectively reducing their θᵢ(s) values by 20–40% under telecommunications failure conditions.

Electricity → Fuel distribution → All backup systems. This is the dominant cascade in extended outages. Fuel station failure at 2–6 hours initiates progressive collapse of backup-dependent systems across all sectors. The fuel cascade converts nominal backup durations (hospital 72h, data centre 48h, telecoms 20h) into actual stored-reserve durations (12–24h for most facilities without dedicated fuel contracts). Under compound stress with simultaneous road network disruption, effective backup duration across the system collapses to approximately 12 hours regardless of nominal generator ratings. R_fuel(d) is the most important time-dependent modifier in the LELF framework — it should be applied to all backup-dependent subsystem calculations.

Electricity → Rail → Emergency logistics. Rail disruption impairs fuel resupply for generators at hospitals, data centres, and telecommunications base stations. This converts fuel-dependent L2 tolerances into L3 exposures if the outage duration approaches generator fuel reserves.

Electricity → Traffic management → Emergency response. Dark traffic signals slow emergency vehicle access, increasing response time to all L3+ events across all sectors. This is a timing multiplier on cascade damage rather than a direct damage source.

The dependency overlay does not require separate LELF curves for each cascade chain. It is incorporated as a threshold reduction factor applied to dependent subsystems when a triggering subsystem has crossed its own threshold.

Conditional Endurance Loss (CEL) — A CVaR Analogue

Financial risk management moved from VAR to CVaR because VAR answers the wrong question: it tells you the maximum loss at a given confidence level but says nothing about the distribution of losses beyond that threshold. CVaR — the expected loss given that the VAR threshold is exceeded — is more informative for fat-tailed distributions.

The electricity endurance analogue follows the same logic. The relevant question is not "what is the probability of a stress hour?" (this is SP in WEM). It is: "given that a stress event occurs, what is the expected economic damage as a function of the duration distribution of that event?"

Linkage to EENS and VoLL literature

The CEL framework is compatible with — and extends — the standard power systems reliability metric Expected Energy Not Served (EENS). The relationship is:

SP_cluster already exists in WEM §11 as T₁₆₈ — the longest single stress episode in the 168-hour window. WEM v2.7.2 also incorporates a persistence premium P(T₁₆₈) directly into the EPP calculation (+0.05 for T₁₆₈ ≥ 6h, +0.12 for T₁₆₈ ≥ 24h), which provides a real-time endurance signal that feeds naturally into CEL estimation. It currently reports the longest stress episode duration and episode count. What is missing is the mapping from SP_cluster values to the LELF threshold layers — and the sector weight vector that translates system stress into economic damage estimates.

For operational use, CEL is most informative in two concrete forms:

The Financial Sector Blind Spot

Finnish pension funds, banks, and insurance companies hold significant exposure to electricity endurance risk through their portfolios — directly via energy infrastructure investments, and indirectly via industrial and commercial lending books. This exposure is currently assessed through two instruments, both of which are structurally blind to physical outage risk.

Spot price exposure models track electricity cost as a function of market price. They correctly identify the risk that high prices compress industrial margins. They do not model the risk that supply fails entirely, because supply failure is not a price event — it is a physical event that removes the market signal before it can be observed.

Climate risk stress tests (EBA 2025, NGFS scenarios) focus on transition risk — stranded asset exposure, carbon price trajectories, green investment requirements. Physical risk in these frameworks means weather damage to assets, not grid endurance failure. A prolonged cold-still period that stresses the Finnish electricity system does not appear in standard NGFS scenarios because it is a compound infrastructure event, not a climate variable.

The consequence: a Finnish pension fund's exposure to a 48-hour winter grid stress event is effectively zero in its risk models, because the event has no representation in any standard financial risk framework. The physical exposure is real; the modelled exposure is zero. This is the measurement gap in SM-009 applied to financial risk management.

Calibration Requirements

Duration distribution from Fingrid data 2010–2025. The historical frequency of stress episodes by duration bracket (1–4h, 4–12h, 12–48h, >48h) is calculable from Fingrid open data DS 124/192 using the same SP methodology as WEM. This provides the empirical base for p(d | system state).

LELF threshold values from Finnish cost-of-interruption research. VTT Technical Research Centre and Energiateollisuus ry have published interruption cost estimates for Finnish industry. These require extension from linear averages to threshold-based functions — specifically, the L3–L5 multipliers require engineering-based estimates of process tolerance rather than survey averages which undersample long-duration events.

Sector weight vector from Statistics Finland. Industrial structure data provides the relative economic weight of continuous manufacturing, district heating, cold chain logistics, and critical infrastructure in Finnish GDP. This allows CEL to be expressed as an aggregate economic figure rather than a sector-specific engineering estimate.

Timing correction factor f(t). Diurnal and seasonal demand profiles from Fingrid DS 124 provide the empirical basis for the timing multiplier. A stress event during peak winter industrial demand carries a timing multiplier of approximately 2.5–3.0 relative to a summer night baseline.

Proposed WEM Extension: CEL Display

CEL can be integrated into WEM §11 as a fourth component alongside SP_cluster, FS(p), and MD_proxy. The display would show:

The CEL display would make the WEM instrument legible to financial actors who currently have no entry point into electricity endurance risk. An EPP value of 0.75 is technically precise but communicates nothing to a risk officer at a pension fund. "Estimated conditional economic loss: €500M–2B if current stress pattern persists to 36-hour threshold" communicates directly.

Open Questions

Recovery dynamics

Dominant term beyond L3. Total system loss has two components: direct outage damage (LELF) and recovery cost. Beyond the L3 threshold, recovery cost becomes the dominant term — which explains why 72 hours costs approximately the same as 48 hours in direct damage but significantly more in total loss. This is the mechanism behind the nonlinearity that standard models miss.

Sector-specific β values for the recovery cost term: A critical additional component is recovery cost — the damage incurred after power is restored but before the system returns to normal operation. Recovery costs are nonlinear and in several sectors exceed direct outage costs for events beyond L3 threshold.

Reserve capacity adjustment. The LELF as specified does not account for backup generation (hospital generators, industrial UPS systems, district heating emergency boilers). A reserve capacity discount factor R(s) should be incorporated: LELF_adjusted(d,s) = LELF(d,s) · (1 − R(s,d)) where R(s,d) = P(backup generation operational at duration d, sector s) This is time-dependent: a hospital generator rated for 72h has R(hospital,24h)≈0.95 but R(hospital,96h)≈0.20 as fuel reserves are exhausted.. Estimating R(s) requires survey data on backup generation penetration by sector — partially available from HVK strategic reserve assessments.

Interdependency multipliers. L4–L5 damage is amplified by infrastructure interdependencies: telecommunications failure impairs emergency response, which amplifies district heating failure, which amplifies hospital stress. These cascade effects are structurally excluded from sector-by-sector LELF estimates. Modelling them requires a network dependency graph that is beyond the scope of this working draft.

Insurance market data. Finnish business interruption insurance claims from major winter stress events would provide direct empirical validation of L1–L2 estimates and partial validation of L3 estimates. This data exists within the insurance sector but is not publicly available. Finanssiala ry would be the natural counterpart for accessing aggregated claims data.

CEL vs. EENS. The power systems literature uses Expected Energy Not Served (EENS) as its standard reliability metric. CEL is economically more informative than EENS because it weights unserved energy by sector-specific damage rather than treating all MWh equally. The relationship between the two metrics requires explicit articulation — CEL should be expressed as a function of EENS with sector-specific loss-of-load cost coefficients.

Scenario Analysis: 24h, 48h, and 72h Compound Events

The following scenarios apply the LELF framework to a compound winter event: OL3 unplanned outage, T = −18°C (five-day cold spell), wind <400 MW, NVE ~32%, SE1→FI at capacity. Not a full national blackout — approximately 40% of load affected through rolling outages, giving 8–16 hours effective outage per customer in the 24h scenario and 24–48 hours in the 72h scenario. Finnish winter load approximately 14,000 MW; affected load ~5,500 MW.

24-hour event (L2–L3 threshold)

48-hour event (L3–L5 threshold)

R_fuel cascade contribution: approximately €500M–1B of the 48h total would be avoided if fuel resupply logistics remained functional (generators holding nominal duration). This is the single largest avoidable cost component.

72-hour event (L4–L5 regime)

Nonlinearity: 72h ≠ 3 × 24h

The marginal cost from 48h to 72h is dominated by recovery and permanent losses, not direct outage damage — which is why the two figures are nearly identical (€2.4B vs €2.5B) despite the 50% longer duration. The step change is entirely at the 24h→48h boundary, where threshold crossings, R_resupply collapse, and cascade activation combine. The 10× jump between 24h and 48h — not 2× — is the central empirical finding of this scenario analysis. Three mechanisms drive it: threshold crossings (θᵢ) that activate new damage categories sequentially; R_resupply(d) collapse that invalidates all backup duration assumptions; and recovery cost β > 1 that makes system restoration superlinearly expensive with duration. The 72h event is not meaningfully more expensive than 48h in direct costs — it is more expensive in recovery costs and systemic disruption, but the major step change occurs at the 48h boundary.

Comparison with traditional models: Standard €/MWh interruption cost models applied to the same 48h event produce approximately €500M–1B — an underestimate of 2–3× relative to the LELF result. The gap arises because traditional models capture L1–L2 direct costs but miss L3–L5 threshold crossings, recovery asymmetry, and cascade effects. The LELF result is not "pessimistic" — it correctly accounts for the physical mechanisms that make outages expensive.

DC Load Impact and Curtailment Optimisation

Adding 2,000 MW of flat DC load to the compound 72h scenario raises total CEL from approximately €2.5B to €5B — a doubling driven by three mechanisms: increased load shedding across the rest of the economy; DC diesel generators competing with hospitals, water systems, and telecommunications for the same fuel pool; and accelerated threshold crossings as all subsystem endurance timelines shift left by 20–40%.

The generator switch problem

The intuitive response — switch DCs to backup generators, freeing grid capacity — is counterproductive under compound stress. DCs switched to generators consume approximately 450 m³/hour of diesel at 2,000 MW load. This competes directly with hospitals, water pumping stations, and telecommunications base stations for the same limited fuel supply. R_resupply(d) deteriorates faster, collapsing from 24 hours to 12–18 hours of effective system backup. The net effect: grid load is partially relieved, but the diesel crisis is accelerated. DC-to-generator switching is always worse than maintaining DC on grid under compound stress conditions.

Curtailment optimisation results

The optimal strategy is partial load reduction (50–80% sleep mode) executed at 10–14 hours into the event — early enough to prevent cascade progression, late enough that DC direct losses (SLA, workload migration) are bounded by time remaining. The optimisation surface is non-convex with a saddle point near t = 12h.

Non-intuitive findings

Finding 1: DC→generator switching is always worse than keeping DCs on grid under compound stress — and the reason is marginal utility, not simulation artefact. During compound stress, diesel fuel is a scarce resource with a clear social priority ordering:

Finding 1 (restated): DC→generator switching is always worse than keeping DCs on grid under compound stress. The grid load relief does not compensate for the diesel pool competition it creates.

Finding 2: Early (t=0h) full sleep or offline is also suboptimal — DC direct losses exceed cascade savings when action is taken before threshold crossings have begun.

Finding 3: The optimal window is approximately t=10–14h — after L2 thresholds have crossed (justifying action) but before L3–L4 cascades are fully established. Net system saving is approximately €300M against no-action baseline.

Finding 4 (the policy implication): Pre-emptive action triggered by CAT=1 (before the compound event reaches t=12h) outperforms reactive action. CAT condition (C) — NVE <35% AND EPP* >0.50 AND OL3 unavailable — is the natural trigger for DC demand response protocols. A mandatory "CAT-1 sleep protocol" (50% load reduction within 2 hours of CAT trigger) is a coordination instrument requiring grid connection agreement terms, not a technical constraint. It is currently absent from Finnish data centre regulatory framework.

Linkage to TN-009: Expected System Loss

TN-009 provides compound event probabilities. TN-010 provides conditional loss functions. The linkage is the expected system loss calculation — the figure that financial actors can directly compare against other portfolio risks:

CAT → Action Mapping

The Compound Alert Trigger (TN-009 §03.1) becomes operationally meaningful only when mapped to specific response actions. The following table provides a starting framework; thresholds require calibration against institutional mandates:

This mapping is illustrative. The thresholds, responsible actors, and specific actions require formal mandate assignment — the measurement gap identified in SM-009 §09. The framework provides the instrument; institutional design provides the mandate.