Systemic Failure Archive and Research

National Grid Blackout of 9 August 2019 (Great Britain)

6 min read

Summary

On the afternoon of Friday 9 August 2019, a lightning strike on a 400 kV transmission line north of London set off a chain of events that, within about ninety seconds, removed more generation from the grid than the system was secured to withstand. The strike itself was cleared correctly — it was one of many that day — but coincident with it, two large generators, the Hornsea One offshore wind farm and the Little Barford gas power station, unexpectedly de-loaded or tripped, and the disturbance knocked out a swathe of smaller embedded generation. System frequency fell far enough to trigger, for the first time in over a decade, the automatic Low Frequency Demand Disconnection (LFDD) scheme, which shed close to a gigawatt of demand and cut power to roughly 1.1 million customers in order to save the rest of the network. Supplies were restored within about forty minutes.

The grid’s own protection, in other words, worked. What did not work — and what makes this a systemic rather than a merely technical failure — was everything the system did not know about its own downstream dependencies: protection settings on trains and on a hospital that shut them down at a frequency they were supposed to tolerate, turning a forty-minute power event into a day of disruption. It is a near-companion to the Northeast Blackout of 2003, but with a distinctly modern moral: the failure was not the grid collapsing, but the grid not understanding where it ended.

Systemic Features

  • Tight coupling and vanishing inertia. As synchronous generation is displaced by converter-based renewables, the grid carries less physical inertia, so frequency falls faster for a given loss. The rate of change of frequency on the day (around 0.16 Hz/s) exceeded the 0.125 Hz/s threshold and itself tripped further generation. Less inertia is less slack: it shortens the interval between fault and consequence, running the clock faster against the system’s ability to respond (see tight coupling).
  • Interactive complexity: an “impossible” coincidence. Generation is not supposed to trip or de-load in response to a lightning strike. Two large stations effectively doing so within moments of each other — plus embedded generators disconnecting on Loss-of-Mains protection when the voltage angle shifted — was exactly the kind of unplanned, hard-to-foresee interaction that defines a complex, tightly-coupled system.
  • Latent conditions in protection settings. The deepest cause sat at the blunt end. Protection relays on generators and on consumer equipment were configured to disconnect at thresholds those assets were actually specified to ride through — dormant design and compliance decisions, unchecked across manufacturers, operators and the system operator, that lay in the system until a frequency excursion aligned them (see latent conditions).
  • A system that did not know its own boundaries. The grid’s operational self-model effectively stopped at the meter, yet the real system extended into a fleet of modern (Class 700) trains whose protection shut them down and which required a technician to attend and manually restart each one, and into a hospital that lost power despite backup arrangements. No one had represented these couplings; the distribution operators’ pre-set disconnection blocks took out rail supplies without the consequence having been mapped. In the terms used across this site, the system’s representation of itself was incomplete at precisely the interfaces that mattered (see organisations as cognitive systems).
  • Diffusion of responsibility across interfaces. The system operator, the distribution operators, the generators, Network Rail and the equipment manufacturers were each responsible for their own component and its settings; none owned the interaction between them. The order of demand disconnection was the distribution operators’ to set, so the downstream harm to rail was, formally, no single party’s responsibility.
  • Automatic protection as double-edged. LFDD did its job, sacrificing about 5% of demand to arrest the fall in seconds, faster than any human could. But the same fast, automatic protection philosophy, applied piecemeal in rolling stock and hospital switchgear without coordination, is what produced the long tail of disruption. The right principle, uncoordinated in its implementation.

Cascading Systems Affected

  • Electricity supply (around 1.1 million customers, roughly 5% of GB demand)
  • Rail transport (Govia Thameslink / Network Rail — the largest knock-on, extending into the following day)
  • Healthcare (a hospital lost power despite backup provision)
  • Aviation and local infrastructure (an airport, traffic signals, a water-treatment site)
  • Public and regulatory confidence in grid resilience during the low-carbon transition

Impacts

  • Around 1.1 million customers were disconnected (close to 1 GW of demand, roughly 5% of the total) — the first activation of LFDD in more than a decade. Frequency was restored to 50 Hz within about five minutes and supplies within about forty.
  • The cumulative generation lost (approximately 1,481 MW, rising to about 1,691 MW as further units tripped) exceeded the 1,000 MW largest-single-infeed the system was secured against under the Security and Quality of Supply Standard.
  • Rail disruption far outlasted the power cut, extending into the following day, because affected trains had to be reset manually on site — the clearest instance of the hidden downstream coupling.
  • Investigations followed from National Grid ESO (an interim report within a week and a final Technical Report in September 2019), the Energy Emergencies Executive Committee (E3C), and Ofgem. Ofgem judged that the ESO had operated within the standards but secured voluntary redress payments: £4.5 million each from Hornsea One and RWE (Little Barford), and £1.5 million from UK Power Networks for reconnecting customers without instruction.
  • The event prompted work on system inertia, on the review and replacement of Loss-of-Mains and RoCoF protection settings, and on the resilience of critical loads such as rail and hospitals to short, recoverable frequency excursions.

Further Reading / Sources

Graph View

Backlinks