I recently had the honour of being the first woman to deliver the annual David Gunn Memorial Lecture for the Combustion Engineering Association. Here is the text of my lecture…
.
Britain’s electricity grid: are we confusing keeping the lights on with keeping the system secure?
Ladies and gentlemen, Thank you for inviting me to deliver today’s lecture. I want to talk about something we tend to take for granted: the security of Britain’s electricity system.
Electricity is unusual among essential services because it must be produced and consumed almost instantaneously. We can store gas, oil and water in substantial quantities. But cannot store electricity on anything like the scale needed to support the national grid for an extended period. All the batteries currently on the grid could meet demand for about 20 minutes, which gives some indication of the gap.
Every second of every day, generation and demand must be kept in balance. The system must also remain stable, with frequency and voltage controlled within acceptable limits, and power flows managed so that transmission equipment is not overloaded. And it must do all of this while retaining sufficient protection against things going wrong.
A power station can trip. An interconnector can disconnect. A transmission line can fail. A forecasting error can leave the system unexpectedly short of generation. Increasingly, large numbers of smaller generating assets can respond in ways the system operator cannot see or anticipate.
A secure electricity system is not one in which nothing ever goes wrong. It’s one designed and operated so that reasonably foreseeable failures don’t develop into widespread disruption. This distinction is fundamental to everything I want to discuss today.
The fact that the lights stayed on yesterday does not demonstrate that the grid was secure yesterday.
This is increasingly the argument we hear from those responsible for operating and overseeing Britain’s electricity system. The absence of a blackout is taken as proof the grid is secure.
Warnings about blackouts are dismissed as scaremongering. We’re told the grid is robust, that security standards are being maintained and that the transition to clean electricity is progressing successfully. I am not convinced that these reassurances are justified.
Indeed, recent events suggest that the challenges facing the National Energy System Operator, NESO, are becoming more serious exactly when the electricity system is becoming harder to manage.
So what does grid security actually mean?
To understand the problem, we need to distinguish between three concepts that are frequently confused.
The first is adequacy: whether there’s enough generation and other capacity available to meet demand.
The second is operational security: whether the system can withstand credible failures without unacceptable consequences.
The third is resilience: whether the system can recover when something serious does go wrong.
These are related but not interchangeable.
A system can have ample generating capacity in aggregate while being unable to transport electricity to where it is needed. It can have enough generation to meet demand but not enough in reserve to replace a large generator that suddenly trips. It can have adequate reserve but insufficient inertia or frequency response to prevent frequency falling too quickly after a disturbance. It can be stable under normal conditions but vulnerable to cascading failures if protection systems don’t behave as expected.
And it can appear perfectly secure according to conventional adequacy measures while becoming extremely difficult and expensive to balance in real time.
This is why I’m increasingly concerned by the reliance placed on headline measures such as de-rated capacity margins and loss of load probability. They are useful indicators, but they don’t provide a comprehensive assessment of operational security.
A healthy capacity margin can’t tell us whether a transmission constraint is about to be breached, whether reserves are physically deliverable, whether voltage stability is adequate or whether the system will survive the sudden loss of its largest infeed. Nor does it tell us whether the system operator has the software, communications infrastructure, operational procedures and staff needed to manage an increasingly complicated electricity system.
23 June this year provides a good example of the risks
That day during a period of exceptionally hot weather, Britain’s electricity system came under considerable strain. Grid frequency fell below its normal operating range of 49.8 to 50.2 hertz for an extended period, reaching a minimum of 49.657 hertz. NESO sought emergency support from neighbouring countries. Five transmission network constraints were breached.
And, according to NESO’s subsequent preliminary report, the system operator took all available and commercially accessible balancing actions while frequency remained outside its normal operating limits.
NESO and ministers have repeatedly emphasised that no customers lost supply – well, no British ones did. We cut off exports to the Netherlands under an Emergency Instruction meaning it was mandatory and Tennet, the Dutch system operator was simply told supplies would be cut. But this doesn’t answer the central engineering question.
Was the system capable of surviving another credible failure at the point when it was already under such severe stress?
Suppose a major generator had tripped. Or an interconnector had disconnected. Or a transmission circuit had suffered a fault. Would the system have remained secure? That is what matters.
In July, control-room whistleblowers raised concerns about the events of 23 June with Claire Coutinho, then Shadow Secretary of State for Energy Security and Net Zero. Their allegations concerned operational decision-making, the integrity of records and the possibility that reputational considerations were influencing decisions about market warnings.
Two reports published on Monday shed important new light on these events. The first was an investigation by Eversheds Sutherland into the whistleblower allegations. The second was an update from Ofgem on its separate technical investigation, accompanied by a preliminary report prepared by a ringfenced NESO review team.
Eversheds concluded that none of the four specific whistleblower allegations had been substantiated. That is an important finding, but the report repeatedly touches on problems it does not then investigate – it cannot substantiate claims records were overwritten to hide evidence but admits records are kept in forms that are routinely overwritten with no version control. Some important logs were apparently not kept that week – Eversheds does not appear to have explored why this was.
The report identifies weaknesses in operational record-keeping, concerns about organisational culture, evidence of reputational sensitivity around market warnings and conflicting accounts of the system’s security position. Ofgem, meanwhile, has not concluded that the grid was secure. Its investigation is ongoing.
Misconduct may not have been proven but the question of whether the grid was operated securely remains. One of the most significant findings concerns transmission constraints. NESO confirms that between six and nine pm on 23 June, flows exceeded established constraint limits in five parts of the network. The Eversheds report records that there were no available pre- or post-action mitigation options for the breaches.
This is serious. Breaching a transmission constraint means that a single grid fault could potentially bring down the entire nationwide grid. When there are no available mitigation options, the system operator has lost an important degree of control over the consequences of a fault.
Even more troubling is the question of reserve. The electricity system must have enough reserve to withstand the sudden loss of major generation or interconnection. The largest credible infeed loss today is 1,400 megawatts. This is a fundamental requirement and part of NESO’s transmission licence.
Yet Eversheds records conflicting accounts of whether enough reserves were available on 23 June. Some witnesses maintained that the control room could cover the largest loss. Others said almost no reserve remained.
There was also disagreement about the meaning of system stability and uncertainty over the potential consequences of a single fault. This is extraordinary. There should be absolutely no ambiguity about this. Either sufficient reserve was available and physically deliverable, or it wasn’t. NESO should be able to demonstrate which was the case using contemporaneous records.
If NESO itself cannot reliably establish whether it maintained the required security standards, how can Ofgem independently assure itself that those standards are being met, which is a condition of NESO’s transmission licence.
Its preliminary report states that it had taken all available and commercially accessible balancing actions. Which raises the obvious question: was any additional reserve available to respond to cover the largest loss as the licence requires? If sufficient reserve remained available on 23 June, NESO should identify how much was deliverable, where it was located and how quickly it could have responded. If it did not, then there is a serious compliance issue. Ofgem must establish whether NESO met its licence obligations or not.
The Eversheds report also reveals something I find almost as worrying as the events of 23 June themselves. NESO relies extensively on manually maintained spreadsheets for important operational decisions. Some of these are used to calculate electricity margins, support shift handovers and determine whether thresholds have been reached for issuing market warnings.
On 23 June, a Power System Manager’s report recorded adjustments to a spreadsheet used to assess whether warnings were required for the following day’s conditions. A 500-megawatt hot-weather reserve requirement was removed, along with a further 100-megawatt reserve requirement. Without those adjustments, the spreadsheet would have indicated that a High Risk of Demand Reduction warning was necessary.
Eversheds accepted the explanations that these adjustments were technically justified. That may be correct. But it leaves a much bigger question unanswered.
Why are critical decisions about electricity security being supported by manually adjusted Excel spreadsheets?
Engineers must be able to exercise judgement. They must be able to override assumptions when circumstances justify it. But those decisions should be made within properly controlled operational systems, with validated calculations, version histories and complete records of what was changed, by whom and why.
A spreadsheet that is updated only once or twice during a shift, with operators maintaining separate notes in the meantime, is not an adequate substitute for a modern real-time operational system. The problem isn’t simply that a spreadsheet can be accidentally overwritten.
It’s that incorrect or outdated information can influence decisions about whether additional capacity is needed, whether a market warning should be issued and whether the system is secure. Eversheds approached much of this as a question of document management. I see it as a fundamental operational risk.
The spreadsheet problem is part of a wider technological challenge. Some of the core systems used to operate Britain’s electricity market are very old. The balancing software known as SORT has its origins in the 1980s and is a literal relic of privatisation. Its replacement has been delayed repeatedly. When systems fail, operators can be forced to fall back on manual processes, including spreadsheet-based tools.
Communications systems are another concern.
The Electronic Dispatch Logging and Electronic Data Transfer arrangements — EDL and EDT — allow power stations to exchange operational information and instructions with NESO. When these systems are unavailable, control-room engineers revert to telephone instructions. That was manageable when the system consisted largely of a small number of large conventional power stations, each with experienced staff available around the clock. It’s far harder when the system includes thousands of smaller batteries and other assets, many of which have no permanently staffed control room.
NESO has itself highlighted problems with maintaining accurate contact information for Balancing Mechanism units. The implications are obvious. An electricity system that is becoming faster, more decentralised and more complicated is being managed using ageing communications infrastructure and labour-intensive fallback procedures.
That’s the opposite of what should be happening. We should be moving towards greater automation, better visibility and stronger operational controls. Instead complexity is increasing faster than the tools available to manage it.
The events of June also exposed weaknesses in NESO’s forecasting.
During the heatwave, actual electricity demand was substantially higher than forecast. On four of the business days that week demand exceeded the forecast by 1,846 MW, 1,643 MW, 2,055 MW and 2,087 MW. Wind generation was at times around 1,500 megawatts below expectations. The preliminary report also identified a discrepancy of approximately 5,000 MW between different sources of generation availability information.
These are huge differences. Forecasting errors matter because they effectively consume available reserve which is a huge problem when the size of the error is comparable with or larger than the reserve held in respect of the largest loss.
The growing contribution of embedded solar generation adds another complication. Solar panels connected to distribution networks reduce the demand visible to the transmission system. But as the sun sets, that demand reappears. Underlying electricity consumption may not have changed at all but the proportion supplied by the transmission network can change dramatically during the rapid solar ramps.
Distributed batteries introduce further uncertainty. They may respond to wholesale prices, local conditions or automated control signals in ways that are difficult for NESO to anticipate. The result is a system in which forecasting has become both more important and more difficult.
It would be reassuring if 23 June was an isolated event.
Unfortunately, the first half of October suggests otherwise. On 6 October, low wind generation contributed to tight margins and NESO issued an Electricity Margin Notice. It took expensive balancing actions, with prices approaching £1,000 per megawatt-hour to resolve it and breached intraday trading limits on the interconnectors
But high wind output has also proved problematic. On 9 October, frequency fell to around 49.74 hertz and remained below its normal operating range for 9 consecutive minutes. NESO requested emergency assistance from France and paid close to £700 /MWh in the BM. On 12 October, NESO again sought emergency assistance from France, in two stages totalling almost 2,000 MW. These were record volumes. Demand that day was the highest of the winter so far at 35.5 GW but still well below the 45 GW that can be expected in mid-winter. NESO paid £1000 /MWh in the BM.
On 14 October, intraday interconnector trading limits were repeatedly exceeded – NESO traded against the flow for 14 consecutive settlement periods (7 hours) with several hours at 2,700 MW (against the limit of 1,500 MW). The cost of balancing the day was just under £52 million against a daily average of £2.3 million. This was the most expensive day ever in the BM. Frequency that day went both above the upper operational limit and below the lower operational limit.
The following day, interconnector trading limits were breached again, and again frequency went both above the upper operational limit and below the lower operational limit. Balancing costs were lower but still over £23 million – 10x the daily average.
For most of this period, conventional capacity adequacy indicators did not indicate anything was wrong. De-rated margins were healthy. Loss of load probability was zero. Yet the system operator was struggling to maintain frequency within normal limits, repeatedly exceeding trading limits and spent a fortune balancing the grid.
One of the fundamental challenges of Britain’s energy transition is geographical.
Much of our wind generation is located in Scotland, offshore or in other areas distant from the largest centres of demand. Demand, meanwhile, remains heavily concentrated in England, particularly the south-east.
Interconnectors are also concentrated in particular parts of the network. When wind output is high, wholesale electricity prices can fall, encouraging exports to neighbouring countries. But the electricity available in Scotland cannot necessarily be transported freely to interconnectors in southern England. Transmission constraints may prevent power moving south. Other constraints may restrict its movement into the south-east.
The result can be a peculiar situation in which Britain has substantial wind generation available, yet NESO must take emergency action to prevent or reverse exports because electricity cannot be delivered to the relevant part of the network. At the same time, generators elsewhere may be instructed to increase output. Consumers pay for these balancing actions.
But cost is not the only concern. The system operator must manage large and sometimes rapidly changing power flows while maintaining network security. And the greater the reliance on geographically concentrated weather-dependent generation, the more important these constraints become. Building additional transmission infrastructure is necessary. But it is expensive, slow and disruptive.
Meanwhile, the electricity system continues to evolve.
The transition away from conventional generation is changing the physical behaviour of the grid.
Traditional large generators are synchronously connected to the system. Their rotating masses provide inertia, which slows the rate at which frequency changes following a disturbance. Wind turbines, solar panels and batteries generally connect through power electronic inverters. These technologies can provide valuable services, including very fast frequency response. But they don’t behave like conventional synchronous machines.
As synchronous generation declines, the grid’s physical inertia falls. Following a major loss of generation, frequency can therefore change more rapidly. That makes the speed, availability and coordination of frequency response increasingly important.
Batteries can respond extremely quickly. But their contribution depends on available power, state of charge, control settings and whether they are already delivering other services. A battery that has responded to one disturbance might not be able to provide the same response to a second disturbance. So the system needs not only fast response to arrest frequency changes, but enough other reserve to restore frequency and maintain protection against further failures.
Voltage stability is another concern. Conventional generators provide important voltage support and short-circuit strength. Inverter-based generation can support voltage, but its performance depends on design, settings and control interactions. A system can have enough generation to meet demand and still suffer a voltage collapse. The Iberian blackout last year demonstrated the danger of treating the behaviour of inverter-based resources as a secondary consideration.
The failure of generating assets to withstand disturbances, including failures of fault ride-through performance, can amplify an initial problem and turn it into a cascading event. These are system-wide engineering challenges that can’t be addressed by adding more MWs of generation.
This brings me to another concern: whether generators and other connected assets behave as their technical specifications say they should.
Grid Code compliance is essential. The system operator must know how assets will respond to changes in frequency, voltage and other disturbances. That requires testing and verification. Yet recent evidence suggests that compliance assurance has not kept pace with the changing generation fleet.
Following concerns about generator performance, a programme of retesting was proposed. A Freedom of Information request I submitted last year showed that only 20 sites had been retested in the previous six years, rather than the comprehensive programme originally envisaged.
That raises an obvious question. How confident can we be in the system’s response to a major disturbance if the behaviour of connected assets hasn’t been adequately verified? This’s particularly important when many resources use different inverter technologies, control systems and protection settings. Individually, each installation may appear satisfactory – collectively, their interactions may be more complicated. A secure system requires confidence not merely in the existence of generating capacity, but in how that capacity will behave when something goes wrong.
Imports are not guaranteed
Britain is also becoming increasingly dependent on electricity imports. Interconnectors provide valuable flexibility allowing electricity to flow between markets, improve access to generation and reduce costs. But they are not equivalent to generation that Britain can dispatch under its own control.
Neighbouring countries cannot be compelled to export electricity to us simply because we need it. They have their own security requirements. They may face shortages of generation, low hydroelectric reservoir levels, transmission constraints or political pressure to prioritise domestic consumers. Norway is a particularly important example – its electricity system depends on hydropower, and reservoir conditions can constrain export availability. When water levels are low, the willingness and ability to export electricity may change.
Weather conditions can also be correlated across neighbouring countries. A cold, still winter period in Britain may coincide with low wind output elsewhere in northern Europe just like the summer heatwave extended across a very wide area. This is the very moment when Britain might most want to import is also when neighbouring countries could have the least surplus available.
There’s a further concern around how NESO has used interconnectors operationally. Recent incidents have involved cutting off exports, asking for emergency assistance, restrictions on transfer capacity and other actions affecting flows to neighbouring markets. These measures may provide short-term relief, but they can create tensions with neighbouring system operators.
Britain cannot assume that neighbouring countries will always accommodate our needs, particularly if they believe those interventions compromise their own operational arrangements. Proposals for closer alignment with European electricity market rules may affect the flexibility NESO currently has to impose certain cross-border restrictions.
Electricity imports are useful, but cannot be relied on and are just not the same as domestic generation capacity.
There’s another irony in the transition to clean electricity.
As the system becomes more dependent on wind and solar generation, conventional gas-fired power stations remain essential during periods of low renewable output. Yet much of Britain’s gas fleet is ageing. A third of our large combined-cycle gas turbines was built in the 1990s and another third in the 2000s. Some are approaching the end of their lives.
And the way these stations are being operated is changing – instead of running continuously for long periods, they increasingly start, stop and cycle in response to renewable output. That imposes additional mechanical and thermal stresses on equipment originally designed for different operating patterns. Low utilisation can also undermine the economics of maintaining ageing plant.
The system is becoming more critically dependent on power stations whose financial incentives to remain available are weakening and are approaching their expected retirement dates.
So far, I have concentrated on preventing failures.
But resilience also requires us to consider what happens if prevention fails. Restoring the electricity system after a widespread blackout is a hugely complex process. The grid can’t simply be switched back on. Generation must be restarted in stages and transmission networks re-energised. Demand must be reconnected carefully, while maintaining voltage and frequency within acceptable limits. Historically, restoration arrangements relied heavily on conventional generating stations with well-understood operating characteristics alongside predictable demand.
But as the grid moves away from centralised conventional generation to more distributed inverter based generation and batteries traditional restoration processes may not work. In particular the system operator may not have the accurate demand information needed to safely restore the system. A significant error in estimating the load being reconnected can cause the restored section to trip again. In extreme circumstances, equipment damage could complicate further restoration attempts.
This is why restoration planning deserves far more attention than it generally receives. A blackout lasting an hour is an inconvenience – a widespread blackout lasting days or weeks, particularly in winter, could become a national emergency. And I have heard engineers suggest 2 weeks is not an unreasonable estimate of the restoration time after a full nationwide blackout.
Modern homes depend on electricity for heating controls, communications, water supply and many other basic services. Hospitals and other critical infrastructure have backup arrangements, but those arrangements are not unlimited and can fail. The consequences of prolonged electricity loss extend far beyond the inconvenience of sitting in the dark.
A modern electricity system is also dependent on digital infrastructure.
The control room needs reliable data. It needs communications with generators, storage operators, transmission companies and distribution networks. Software systems must remain available and accurate. Cyberattacks are an obvious threat. But ordinary failures can be equally disruptive. Damaged telecom cables, software faults, data corruption or failures of backup arrangements can all reduce NESO’s ability to observe and control the network.
A communications outage that forces manual telephone instructions may be manageable under ordinary conditions. The same outage during a period of severe system stress could be far more serious. And that’s at the heart of the challenges we face: multiple failures can occur together.
Extreme weather can simultaneously increase demand, reduce generation availability, damage network assets and disrupt communications. Cyberattacks may be deliberately timed to coincide with periods of vulnerability. Resilience therefore requires us to consider not only individual component failures, but combinations of failures.
Technology is only part of the picture.
The Eversheds investigation identified serious organisational concerns within NESO. It recorded high levels of stress among control-room staff. It described weaknesses in communication between operational engineers and senior management. And it referred to a culture in which experienced operators had either left or disengaged from raising concerns.
This should alarm anyone responsible for critical national infrastructure. The knowledge and judgement of experienced control-room engineers are among the electricity system’s most valuable resources. And they cannot be replaced overnight.
The ability of engineers at the coal face of managing the grid to raise concerns without fear of reputational or career consequences is essential to safe operation. The report records evidence that engineers have become reluctant to issue margin warnings because of the negative publicity they often generate.
But these warnings are intended to alert the market to tight conditions and encourage additional capacity to become available. It’s a routine operational tool, but one that could, in some circumstances, be the first signal of a blackout. It should be issued when the engineering assessment warrants it, and not regarded as an embarrassment to the organisation.
A High Risk of Demand Reduction warning is more serious, but the same principle applies. If a warning is justified, it must be issued. The reputational interests of NESO cannot take precedence over the security of the electricity system.
There has been a response by ministers and NESO that it’s problematic that these notices are front-page news as if transparency was somehow a bad thing. It’s not – it IS newsworthy if these notices are becoming more frequent. They ARE an indication the grid is becoming harder to manage. This is something that should be subject to scrutiny however uncomfortable that may be.
Which brings me to a wider governance question.
If operational engineers believed that the grid was insecure on 23 June, did senior management recognise that those concerns raised a potential licence compliance issue? Was there an appropriate internal investigation? Was the matter proactively escalated to Ofgem? And if not, why not? Because it very much appears that without the interventions of former Secretary of State Claire Coutinho, these events would not have been investigated at all.
An effective regulatory system cannot depend on an opposition politician bringing whistleblower allegations into the public domain before serious operational concerns receive independent scrutiny. Ofgem must be able to examine the underlying evidence, rather than relying solely on assurances from NESO’s executives. And NESO must have effective arrangements for identifying and reporting potential breaches of its licence.
The Secretary of State is NESO’s shareholder. Ofgem is its regulator. Both have responsibilities here. If a serious breach is established, the response should focus on correcting the underlying deficiencies and ensuring meaningful management accountability.
I have discussed a long list of concerns today, which should worry everyone in the room.
This is not about scaremongering, it’s about risk management and governance. It’s about dealing with risks before they become too big to manage and it’s about keeping people safe. We face challenges from Ageing operational software. Vulnerable communications systems. Manual spreadsheets. Poor demand and wind forecasting. Limited visibility of distributed assets.
Transmission constraints. Falling inertia. Declining frequency and voltage stability. Uncertain inverter behaviour. Incomplete compliance testing. Dependence on imports. Ageing gas-fired generation. Restoration challenges. Cybersecurity. Operational culture. And weaknesses in regulatory oversight.
Not all these risks are equally serious and not all will materialise. Some can be mitigated effectively. But they don’t exist in isolation. And a control room operating under severe stress, with inadequate tools and poor organisational support, may have less ability to respond effectively. This is the nature of systemic risk.
The probability of a serious event cannot be assessed simply by looking at each individual problem separately – we must consider how potential failures could interact. And as the electricity system becomes more complex, those interactions become more important.
So what should change?
Security must be treated as a primary design requirement, not an inconvenient constraint on policy.
First, NESO needs modern operational systems. Critical calculations should be performed within controlled, validated software rather than relying on manually maintained spreadsheets. Communications infrastructure and fallback arrangements must be robust enough for a system containing thousands of increasingly automated assets.
Second, forecasting and visibility must improve. NESO needs better real-time information about distributed generation, storage and demand. The growing influence of low-voltage assets cannot remain largely invisible to the national system operator.
Third, the physical security of the system must be independently demonstrated. That means adequate and deliverable reserves, sufficient frequency response, voltage stability, appropriate inertia or equivalent services, and comprehensive testing of generator behaviour.
Fourth, electricity import assumptions must be realistic. We should recognise the value of interconnection without treating imports as guaranteed capacity.
Fifth, the reliability of conventional generation must be taken seriously. The system will continue to need dispatchable capacity, particularly during periods of low wind. We must ensure that the capacity counted in security assessments will actually be available when needed.
Sixth, restoration capability must be tested against the electricity system we are building, not merely the system we used to have.
And finally, NESO needs a culture in which engineers can raise concerns and issue operational warnings without fear of embarrassing senior management. That requires effective independent oversight and genuine accountability.
I began by asking whether we are confusing keeping the lights on with keeping the electricity system secure.
I believe that distinction has become dangerously blurred. The events of 23 June exposed serious questions about reserves, transmission constraints, operational procedures and the adequacy of the tools available to control-room engineers. The reports published this week have not resolved those questions – In some respects, they have made them more pressing. And the incidents so far in October demonstrate that the difficulties are not confined to the summer heatwaves.
Britain’s electricity system is undergoing an enormous transformation. And the system operator is being asked to manage this increasingly complex network using some infrastructure and processes that are long overdue for replacement.
We must not mistake a lack of blackouts for proof the risks have been adequately controlled. If we wait until a serious blackout to discover that those standards were not being met, we will have waited too long – people may die as they did in last year’s Iberian blackout. With so many identifiable risks, worrying about blackouts is not scaremongering.
Dismissing those concerns without properly addressing them is the bigger danger.
Thank you.
Leave A Comment