On September 17, 1985, at 3:45 PM, the heart of Brazil's power grid stumbled, and eight states along with the federal district went dark. A sheet of paper was blamed.
The version sounded absurd, but it was repeated in dozens of retellings: somewhere in the equipment chain at Itaipu — the young hydro-giant on the border with Paraguay, which had yet to become the largest hydroelectric plant on the planet — a foreign object interfered with the operation of a contact or relay. Paper. A scrap of insulation. Something light and accidental, capable of disrupting the operation of a machine that powered an entire country.
Itaipu came online in 1984 on the Brazil-Paraguay border and by the mid-decade was rapidly gaining weight in Brazil's power system. The connection to the rest of the grid was provided by a high-voltage direct current line at ±600 kV, stretching more than 800 kilometers to the Ibiuna substation near São Paulo — each of the two bipoles was rated for 3,150 MW. The converter transformers, converting alternating current to direct and back, were the weak link: the first years of operation passed under the sign of numerous failures — such was the price of pioneering technology. Brazil's power system was growing faster than the infrastructure could strengthen.
In September 1985, the system was living on the edge. It was precisely this fragility that played the main role. When something went wrong at the São Roque substation, at the junction of the DC line with the grid, the automation didn't localize the fault — it amplified it. The failure of one element dumped gigawatts of power onto neighboring lines, overloaded them, forced protection systems to disconnect them too. Then the cascade began: loss of generation changed the frequency in the grid, sharp power flows forced relay protection to trigger one after another. By that same evening, eight states and the federal district remained without power, including São Paulo and Rio de Janeiro, and electricity was restored in several stages over the course of about three hours.
The sheet of paper became a convenient symbol. But the actual chain of events was more complex and more troubling.
Brazil's power system of the 1980s resembled a building where upper floors were being added before the foundation was reinforced. The country was experiencing an energy boom: after the commissioning of Itaipu, the connection of dozens of new generating capacities was planned. But transmission lines lagged behind. Power line construction was delayed for years. Transformer substations operated at their limit. In conditions of capacity deficit, any accident turned into systemic stress.
On April 18, 1984, a defect at the Jaguara substation in Minas Gerais blacked out six central-southern states — São Paulo, Rio, Espírito Santo and others; 12 million people were left without power then. On September 17, 1985, the same disease struck again and harder: an overload at the substation in São Roque, right at the Itaipu DC line, triggered a cascade at the Paranaíba basin hydroelectric plants. Each accident exposed the same problem: the system didn't know how to stop the dominos. Relay protection triggered too quickly and too aggressively, disconnecting not only the damaged section but also healthy lines to which the load was being redistributed.
The physics of the process is brutal. When a large generating station suddenly drops out of the grid, the remaining generators try to compensate for the power deficit. The frequency in the system drops — in Brazil it's 60 Hertz, and even a noticeable deviation causes automation at other stations to shut down turbines to protect equipment. Simultaneously, power rushes through the remaining transmission lines, overloading them. Relay protection sees the overload and disconnects the line. The load redistributes to the next one. That one also disconnects. The dominos fall in seconds.
Itaipu wasn't the only station, but it was the most promising. Each new unit added capacity to the system — and simultaneously dependence on a single transmission corridor. The other stations simply couldn't pick up the slack when an entire bipole dropped out. In September 1985, at the peak of daytime demand, the system's safety margin was minimal, and its sensitivity to failures was maximal.
The story about the paper sheet is repeated in power engineers' tales, but almost always without reference to a primary source. Documented explanations are far more prosaic: official investigations of the time spoke of "emergency disconnection of the DC line's connection to the substation" and of an overload that generated a protective grid response — no technical report names the nature of the "foreign object."
Most likely, the actual cause was complex: contact wear, insufficient equipment sealing, accumulation of contamination in switching nodes. A sheet of paper could have been the last straw, but not the only factor. The problem is that HVDC systems — high-voltage direct current transmission — were new technology for Brazil. The Itaipu converter transformers were supplied by a European firm, and there was little experience operating them in a tropical climate with high humidity and dust. The first years the station lived from failure to failure — such was the price of pioneering technology. On May 29, 1989, a fire that started with a cooling water leak destroyed an entire four-valve bridge in the Foz do Iguaçu converter, and half the ±600 kV line was down for almost a year — the converter was only returned to service after 14 months.
A sheet of paper is convenient for headlines. It turns catastrophe into a parable about civilization's fragility. But the real vulnerability wasn't in the leaf, but in the system's architecture: one critically important transmission line, one conversion node, insufficient redundancy, lack of inertia in the grid. When Itaipu fell, everything fell.
At 3:45 PM, the loss of connection between the HVDC line and the São Roque substation triggered a protective chain. Converters and lines shut down. Generators in the Paranaíba basin, left without power outlet, dropped one after another. The grid was losing node after node.
Simultaneously, the power that the Itaipu line had just been carrying was redistributed to the remaining transmission lines connecting the southeast with the center and north of the country. Overload. Relay protection sees the threshold exceeded and disconnects lines. The load redistributes again. The next lines also disconnect. Dominos.
Less than an hour after the first failure, São Paulo was dark — the country's largest metropolis; in the suburb of Taubaté, electricity returned last, at 6:50 PM. Rio de Janeiro got off with eighteen minutes of darkness, Belo Horizonte and Brasília flickered longer. In total — eight states and the federal district. Power delivery wasn't a solid blackout but a ragged rhythm of connections and disconnections: restoration proceeded zonally, major cities got electricity faster, the periphery slower.
Cascading failures don't stop themselves. They're stopped by people: dispatchers who manually disconnect damaged sections and isolate them from healthy ones, engineers who restart generators one by one to avoid overloading the grid again. On that September day in 1985, Brazilian operators worked in semi-darkness, without a complete picture of the grid's state. Each station restart could trigger a new cascade if frequency or phasing didn't match. Restoration stretched over several hours not because equipment was broken, but because the system had to be reassembled from scratch, like a puzzle where each piece must fit exactly in its place.
The 1985 blackout was neither the first nor the last in Brazil's history, but it was a turning point. After it began modernization of relay protection: implementation of differential schemes that distinguish internal faults from external overloads, installation of automatic frequency load-shedding systems, construction of new transmission lines to reduce dependence on a single transmission corridor.
Itaipu remained a critical node but ceased to be the only one. By the end of the 1980s, new hydroelectric plants in the north and northeast entered the system, diversifying generation. The HVDC converter transformers went through several modernization cycles; after the 1989 fire, their protection was strengthened and operating modes were revised.
Maintenance culture changed more slowly than technology. The problem wasn't that engineers didn't know how to work, but that the system didn't give them time for preventive maintenance. The energy deficit of the 1980s forced keeping equipment in operation even when it needed to be shut down for inspection. Sheets of paper, worn contacts, contaminated insulators — all symptoms of one disease: insufficient reserve, when stopping one unit meant risk of blackout, and therefore shutdowns were avoided until the last moment.
Modern power systems are designed with margin. The N–1 criterion — the system's ability to withstand the loss of any single element without cascade — has become standard. But margin costs money. Reserve lines, reserve generators, reserve transformers — all are capital expenditures that don't pay off until an accident happens. The 1985 blackout in Brazil, like the 2003 blackout in the US and Canada, like the European blackout of 2006, proves one thing: large systems break not from one cause, but from a combination of minor error and insufficient resilience. A sheet of paper might have interfered with a contact, but the cascade was triggered by the absence of a second line, a second substation, a second chance.