Building Resilient Energy Systems

Current Situation

Geopolitical events in recent years have demonstrated how vulnerable energy supply can become. Following the war in Ukraine, European and global energy prices rose sharply. The closure of critical maritime routes has revealed the fragility of global fuel markets. Energy infrastructure has proven to be a target of sabotage, cyberattacks, and military aggression. Meanwhile, climate change continues to bring natural disasters that threaten both energy supply and distribution infrastructure.

For critical entities - hospitals, data centers, communication infrastructure - the question of energy supply security thus becomes existential. The ability to remain operational during grid outages or component failures is not just an economic consideration but a public safety issue.

But what does resilient energy design look like in practice? With LEC ENERsim, different resilience configurations can be set up, optimized, and compared side by side. This article walks through a series of scenarios for a virtual application.

The Reference Microgrid

For this study, we define a virtual critical infrastructure site representative of a mid-sized medical care facility, government complex, or operational command center. The site has three energy demands:

• Electricity: 1,200 MWh/year - fed by a dynamic load profile based on the BDEW G0 (general business) standard load profile
• Heat: 1,100 MWh/year at 80 °C supply temperature - using a residential-business heat load profile, scaled with heating degree days
• Cooling: 330 MWh/year - modeled as a load proportional to peak outdoor temperature

In the baseline configuration, the site draws electricity from the public grid to cover both electrical demand and cooling (via an air-cooled chiller), while heat is provided by an air-source heat pump. A 800 kWp PV system (rooftop+parking) provides partial on-site generation.

Figure 1: The LEC ENERsim user interface showing the baseline microgrid topology: grid connection, PV, heat pump, chiller, and demand components.

Baseline Results

ENERsim simulates the complete year at hourly resolution. The energy balance shows that most energy is drawn from the grid, with PV covering a significant share during daytime hours:

Figure 2: Annual energy flow Sankey diagram for the baseline configuration.

To assess resilience, ENERsim calculates the degree of autarky — the share of total energy demand that is supplied from on-site sources, not from external grids. The chart below shows the autarky profiles for two representative weeks: the last week of January (low PV) and the last week of May (high PV):

Figure 3: Hourly autarky profiles for the last week of January (left) and May (right).

The baseline autarky closely follows PV production: zero at night, low in winter, up to 100 % during sunny midday periods. The annual average autarky is approximately 39 %. Any grid interruption during non-PV periods, however, would leave the site entirely without energy supply, representing a significant vulnerability for a critical entity.

Scenario 1: Designing for Full Autarky

The most rigorous resilience requirement is complete independence from the public grid, meaning an off-grid system capable of supplying all demands at all times throughout the year. ENERsim optimizes both the sizing and operation of all components to meet this requirement at minimum total cost.

Figure 4: System topology for the full-autarky scenario, adding battery storage, diesel generator, and fuel tank to the baseline.

The off-grid system adds three technologies to the baseline, parametrized with technological (efficiencies) and economic (investment) parameters:

• Battery energy storage for day-night balancing of PV generation
• Diesel generator as backup during extended low-PV periods
• Diesel fuel tank sized to cover the complete year with a single fill

With grid import excluded, ENERsim selects the following optimal component sizes:

The annual energy balance shows the altered supply structure: PV contributes the dominant share, the battery handles short-term buffering, and the diesel generator covers extended winter periods:

Figure 5: Annual energy flow Sankey diagram for the full-autarky configuration.

Looking at the time-resolved energy flows for the two weeks confirms the system behavior: in May, PV and battery together are sufficient; in January, the diesel generator bridges the extended low-generation periods. Per design, autarky reaches 100 % throughout the year.

Figure 6: Hourly energy supply breakdown for the full-autarky scenario: last week of January (left) and last week of May (right). Stacked areas show PV generation (dark green), PV curtailment (light green), battery discharge (blue), and diesel generator output (orange). The dashed line is total electrical demand.

A notable feature of this design is the significant PV curtailment visible during the summer week (light green area). To guarantee supply through the worst-case winter days, the optimizer sizes the PV array well above what is needed for day-to-day demand in summer. In a grid-connected system, this surplus could instead be fed into the public grid. For this standalone off-grid scenario, however, grid export was excluded by design.

Note on full autarky: This scenario is an extreme design point. A full-year 74 m³ diesel tank and 2,000 kW PV array are significant infrastructure investments, and need significant space, which might not be available. For most critical entities, full autarky over an entire year is however not required. Realistic grid outages last hours to days, not months. The following scenarios address this more practically.

Scenario 2: Resilience Testing — Simulated Grid Outages

ENERsim provides a resilience testing function that temporarily deactivates selected components to simulate outages or failures. This allows the system to be sized specifically for the outage duration and season that matters — rather than the worst-case year-round scenario.

We model a two-day grid outage occurring during the representative January and May weeks. The optimizer determines the minimum-cost backup equipment (battery, PV, and optionally a diesel generator) required to bridge the outage without any demand reduction.

The optimized component sizes differ between seasons:

In January, the limited PV yield during the winter outage period requires a diesel generator to complement the battery and guarantee full supply. The fuel tank needs to hold only around 1,268 liters — a fraction of the 74 m³ required for full-year autarky. In May, PV and battery alone are sufficient to bridge the two-day outage — no diesel is needed at all. Note that PV and battery are sized rather large for both scenarios. The reason lies in the very good economics of these technologies, also without resilience-requirements. Renewable energies therefore combine low-cost energy supply, CO₂ emissions reductions, and increased self-sufficiency: win-win-win.

The energy flow profiles during each outage week confirm this behavior: the grid supply trace drops to zero for the two outage days, while backup components take over.

Figure 7: Energy supply during the outage weeks: last week of January (left) and last week of May (right). The shaded band marks the two-day grid outage. In January, the diesel generator provides additional cover alongside PV and battery; in May, PV + battery alone cover all demand.

Scenario 3: Cellular Architecture — Core and Shell Systems

Full autarky and single-outage resilience testing treat the site as a monolithic unit. A more sophisticated approach, particularly relevant for complex sites with mixed load criticalities, is a cellular energy system with hierarchical priority layers.

The concept: the site is divided into a CORE (mission-critical loads, here ~15 % of total demand) and a SHELL (secondary loads, here ~85 % of total demand). Examples of core loads might include intensive care units, server rooms, communication nodes, or command posts. Shell loads include accommodation, general offices, logistics areas, or cafeteria operations. The CORE is designed for 100 % self-sufficiency over the full year; the SHELL connects to the grid normally. For simplicity, cooling demand is excluded in this scenario.

Disconnected Design

In the first step, the two sub-systems are optimized independently:

Figure 8: Disconnected CORE-SHELL topology in ENERsim. The CORE (lower system) is fully off-grid; the SHELL (upper system) connects to the public grid.

ENERsim optimizes each sub-system to its own objective (100 % autarky for CORE; minimum cost for SHELL), yielding the following system:

The annual energy balance for the separated system shows the CORE operating fully autarkically, while the SHELL uses the grid:

Figure 9: Annual energy flow Sankey diagram for the disconnected CORE-SHELL configuration.

Connected Operation

In practice, connecting the CORE and SHELL systems during normal operation creates mutual benefits. ENERsim simulates the combined system, allowing bi-directional energy exchange between cells, while keeping the diesel backup reserve fully intact:

Figure 10: Connected CORE-SHELL topology. An inter-cell link allows energy exchange between CORE and SHELL during normal operation, reducing overall costs.

Net annual costs separated: 319 kEUR vs. connected: 310 kEUR, a saving of approximately 9 kEUR/year from better PV integration and reduced grid usage. The strategic fuel reserve remains in place, ready for emergencies.

Outage Resilience with Connected Architecture

Now consider a two-day grid outage in January. The SHELL, designed without dedicated backup, cannot fully supply all its loads. ENERsim models this by assigning a demand-reduction penalty (500 EUR/MWh for SHELL, 2,000 EUR/MWh for CORE), which determines the economic priority of load shedding.

Figure 11: Left: energy supply to the CORE during the January outage (PV, battery, genset, and inter-cell link). Right: demand fulfillment — dashed lines show total demand (electricity + heat in electrical equivalent), solid lines show the supplied share. CORE demands are fully met; SHELL shows partial shedding during the outage.

The CORE, designed with full-year autarky, fulfills all its demands throughout the outage. The SHELL partially sheds electrical demand during the outage period, since it was sized without dedicated backup. However, the CORE generator runs much more than would be needed only for the CORE demand and partially supplies also the SHELL loads, increasing overall system resilience.

Compound Failure — May Outage with CORE Battery Failure

The most demanding test: a grid outage in May combined with a CORE battery failure occurring two days before the outage, representing a compound N+2 scenario. Without its battery, the CORE would normally be vulnerable overnight. However, because PV generation is abundant in May and the SHELL's battery can supply the CORE through the inter-cell link, even this extreme scenario is managed without demand shedding of the CORE, whereas only marginal demand reduction is visible in the SHELL:

Figure 12: Left: energy supply to the CORE during the May worst-case scenario. The amber shading marks the CORE battery failure period; the red shading marks the subsequent grid outage. The SHELL battery supplies CORE via the inter-cell link. Right: demand fulfillment (electricity + heat in electrical equivalent).

This scenario illustrates a key advantage of the cellular architecture: the SHELL acts as a hidden redundancy layer for the CORE under summer conditions, even though it was not explicitly designed for this purpose.

Summary

Four resilience strategies have been demonstrated for a virtual critical infrastructure microgrid:

ENERsim's integrated optimizer determines the cost-optimal component sizes for each scenario in a single run, avoiding the conservatism of manual sizing while guaranteeing that resilience requirements are met.

Outlook

The scenarios presented here are a starting point. Planned and ongoing extensions to the ENERsim resilience framework include:

• Stochastic resilience testing: automated generation of randomized outages across multiple weather years, component availabilities, and demand fluctuation scenarios, producing robust resilience scores compliant with CER-type assessment requirements
• Predictive operational control: integrating weather forecasts and threat predictions into real-time dispatch optimization, pre-charging storage ahead of forecast outages and adapting dispatch to predicted conditions
• Multi-vector resilience: extending the cellular architecture to heat and cooling grids, enabling combined electricity-heat resilience analysis for district energy systems
• Regulatory reporting support: automated generation of resilience documentation compatible with national CER / KRITIS requirements