Hospitals and Data Centres in Blackout: When Digital Infrastructure Turns Physical

In the canon established by Dr. Raphael Nagel and Marcus Köhnlein in KRITIS: Die verborgene Macht Europas, a single observation cuts through the usual debate about digital sovereignty: when the grid fails, digital infrastructure becomes physical again. Hospitals and data centres are the two sites where this transition is most visible and most consequential. Both appear, on paper, to be prepared. Both run notstrom. Both have contingency plans. And both are constructed around assumptions that begin to erode somewhere between hour twelve and hour thirty-six of a sustained blackout. This essay, written from the operational perspective of Quarero Robotics, examines what actually happens to these facilities across a 48 to 72 hour window, and why the perimeter, rather than the core, is where resilience quietly breaks.

Notstrom Is Not Normal Operation

The canon is explicit on this point. Hospitals possess emergency power aggregates that enable limited continued operation, but notstrom is not a substitute for normal operation. It supplies prioritised areas, not the entire infrastructure. Operating theatres, intensive care units, critical laboratory equipment and selected IT systems remain on the protected circuit. Corridor lighting, non-essential diagnostics, administrative systems, ventilation in peripheral wings and much of the building management layer drop out of full service or run in reduced mode.

The practical consequence is a facility that contracts physically. Staff, patients and activity migrate toward the protected zones. Outer wings, service corridors, logistics docks, parking structures and technical buildings move from actively managed space to partially supervised space. Within the first twelve hours this contraction is manageable. By hour thirty-six it has produced a geometry of presence that would not pass a normal security review, because the people who would normally walk those corridors are now holding clinical or technical positions inside the core.

Data centres face a structurally similar problem expressed through different variables. Diesel reserves, cooling capacity and fuel resupply logistics define the operational envelope. Redundant generators handle the electrical load, but cooling demand does not decrease, and refuelling cycles depend on road access, driver availability and the stability of regional logistics, each of which degrades in parallel with the blackout itself.

The 48 to 72 Hour Resource Curve

A realistic resource curve for a mid-sized hospital under sustained power loss shows three distinct phases. In the first six to twelve hours, notstrom performs as designed and internal morale remains high. Between twelve and thirty-six hours, staff fatigue accumulates, fuel consumption tracks close to projection, and the first external dependencies begin to fail: deliveries arrive late, relatives seeking information appear at entrances, and communication with regional coordination centres becomes irregular. Between thirty-six and seventy-two hours, the facility is no longer operating a plan. It is managing a situation.

Data centres follow a comparable curve with a sharper inflection. Diesel reserves sized for seventy-two hours assume scheduled refuelling. If the first tanker does not arrive on hour forty-eight as planned, the remaining margin collapses quickly. Cooling systems running at elevated ambient temperatures consume more energy than baseline calculations suggest. Technical staff who would normally rotate through shifts begin to exceed safe working hours, and external specialists cannot always reach the site.

In both environments, the internal staff capacity available for perimeter tasks drops precisely when the external environment becomes less predictable. The canon describes this as the moment when digital infrastructure turns physical: access control, delivery verification, identification of unauthorised approach and documentation of incidents cease to be background functions and become determinants of whether the site remains operational.

Why the Perimeter Fails First

Perimeter security in normal operation relies on a combination of electronic systems, patrolling personnel and centralised monitoring. Under blackout conditions, each of these three layers degrades at a different rate. Electronic systems on the protected circuit may continue, but cameras on non-priority feeds, networked sensors in outlying buildings and automated gate systems often do not. Central monitoring depends on communication links that become intermittent. Patrolling personnel are the most flexible layer, and therefore the first to be redirected to internal tasks when clinical or technical demand rises.

The result is a perimeter that is nominally intact but functionally thinned. Fences, signage and locked doors remain, yet the observational layer behind them has contracted. This is not a failure of planning in the narrow sense. It is the predictable outcome of plans that assume human staff will hold both the inner and outer ring simultaneously across a three-day window. In the experience documented across European incidents referenced in the canon, this assumption does not survive contact with a real event.

For hospitals, the exposed outer ring includes logistics yards, oxygen and medical gas storage, morgue access, staff parking and technical buildings housing transformers and emergency generators. For data centres, it includes fuel storage, cooling infrastructure, fibre entry points and the perimeter fence line itself. In both cases, an adversary or simply a confused civilian reaches critical infrastructure by walking, not by hacking.

Autonomous Robotics as Outer-Ring Presence

Quarero Robotics approaches this problem from a specific angle. The company does not argue that autonomous systems replace human judgement or clinical staff. It argues, consistent with the structural logic in the canon, that autonomous security robotics are suited to exactly the function that degrades first under blackout conditions: continuous outer-ring presence, documented patrol paths, sensor-based detection across large and partially lit areas, and reliable reporting back to whatever command structure remains operational.

A mobile robotic platform operating on the perimeter of a hospital or data centre does not become fatigued at hour forty. It does not need to be pulled inward to support a clinical escalation. Its patrol pattern is documented, its sensor coverage is defined, and its energy requirements are modest compared with the facility load. When integrated with a control room or a distributed monitoring architecture, it provides the observational continuity that human patrols can no longer sustain once internal demand rises.

This is the point at which the Robot-as-a-Service model becomes relevant rather than fashionable. Operators of critical infrastructure rarely have the capital budget, the internal expertise or the appetite to own and maintain robotic fleets as conventional assets. A service model shifts the responsibility for availability, updates and operational readiness to the provider, which is the correct allocation under KRITIS logic. Quarero Robotics treats the robot not as a product but as a contracted capability whose measure is presence maintained, incidents documented and outer ring integrity preserved across the exact window when human capacity contracts.

Integration, Not Replacement

The argument is deliberately narrow. Autonomous robotics do not resolve fuel logistics, do not restore cooling capacity and do not substitute for clinical or technical personnel. They address one specific failure mode: the thinning of the outer observational layer during the hours when internal demand is highest. Within that scope, they are a rational component of a resilience architecture, not a marketing proposition.

Integration matters more than the platform. A robotic patrol disconnected from the control room, from existing sensor networks and from documented escalation paths is an isolated asset. A robotic patrol integrated with leitstelle operations, with camera infrastructure on protected circuits and with the facility incident log becomes part of the system that the canon describes as resilience architecture. Quarero Robotics designs its deployments around this principle, because the alternative is a technology that looks modern on a site visit and underperforms in an actual event.

The same logic applies across the two sectors discussed here. Hospitals and data centres differ in almost every operational detail, but they share the structural feature that defines the KRITIS perimeter problem: critical internal functions pull human attention inward, and the outer ring becomes the first place where observation fails. Autonomous systems from Quarero Robotics are built to hold that ring.

The honest conclusion is that no single technology resolves a 72 hour blackout. The canon is clear that resilience is an architecture, composed of infrastructure, redundancy, organisation and responsibility. Within that architecture, the perimeter of hospitals and data centres is a known weak point, and it is weak for reasons that are structural rather than accidental. Staff contract inward because the core demands it. Electronic systems on non-priority circuits fail because the design prioritised other loads. External support degrades because the surrounding logistics chain degrades. The outer ring is not forgotten. It is simply the layer that has to be sacrificed when everything else is held together manually. Autonomous security robotics, deployed as a service and integrated into existing command structures, address this specific gap. They do not restore normal operation and they do not replace the people who run these facilities. They maintain observational continuity across the window when human presence cannot, and they document what happens during that window in a form that is useful afterwards, both for operational review and for the regulatory evidence that KRITIS operators are required to provide. For operators of hospitals and data centres preparing for a scenario that is increasingly treated as realistic rather than theoretical, the question posed at the end of chapter one of the canon remains the right one to ask. Is what you are doing today sufficient to hold the outer ring for 72 hours when the inner ring takes all of your people. If the answer is uncertain, the architecture is incomplete, and the perimeter is the place to begin.