NESO admits constraints breached and large forecast errors in interim grid security report

On 19 October, two important reports were published concerning the events of 23 June, when the frequency of the GB electricity grid fell below its normal operating limits for an extended period and the National Energy System Operator (“NESO”) was forced to seek emergency assistance from neighbouring countries.

The first was the final report of an independent investigation by Eversheds Sutherland into whistleblower allegations that NESO had deliberately avoided creating auditable records and that its Corporate Affairs function had interfered with operational decisions to protect the organisation’s reputation. The second was an update from Ofgem on its separate technical investigation into the operation of the electricity system during the June heatwave, accompanied by a detailed preliminary report prepared by a ringfenced team within NESO.

The headline from the Eversheds investigation was that none of the four specific allegations had been substantiated. This is clearly an important finding and should not be dismissed, but anyone who reads beyond the executive summary will discover that this statement is stronger than the evidence described within the report supports.

Eversheds identified significant weaknesses in record-keeping, a culture of reputational sensitivity, concerns that staff were not listened to by senior management, and uncertainty about whether the correct operational escalation procedures had been followed on 23 June. It also recorded that five network constraints had been breached with no available pre- or post-action mitigation options, with confusion about whether the largest loss was covered, and even what the impact of a single fault would have been.

If engineers cannot say what a fault would do to the grid at any moment, it’s hard to see how NESO can claim with any certainty that the grid was secure.

Meanwhile, Ofgem has explicitly declined to conclude that the electricity system was secure during the June events. It is still investigating whether NESO complied with the relevant security standards, whether appropriate operational decisions were taken and whether market warnings should have been issued.

These are important distinctions. The absence of a blackout does NOT demonstrate that the grid was secure, whatever NESO and DESNZ might claim. Equally, the failure to prove that someone improperly influenced a decision does not demonstrate that the decision was correct, or that the governance arrangements surrounding it were adequate.

I have been raising concerns about NESO’s management of the grid for some time. In July, I wrote about the prolonged low-frequency event on 23 June and the risks associated with. Later that month, I questioned whether Ofgem was adequately discharging its regulatory responsibilities in its regulation of NESO.

The new reports answer some of the questions I raised, but unfortunately, they also provide reasons to be more concerned.

What did the whistleblowers allege?

The controversy began after control room whistleblowers approached Claire Coutinho, then Shadow Secretary of State for Energy Security and Net Zero, with allegations concerning operational practices within NESO’s control room. Four allegations were subsequently investigated by Eversheds:

• That Corporate Affairs personnel interfered in operational decisions to discourage actions that might damage NESO’s reputation.
• That NESO deliberately altered or suppressed operational records to avoid scrutiny under Freedom of Information legislation.
• That senior managers instructed operators to maintain live documents without version histories to avoid creating an audit trail.
• That these practices were in operation during the events of 23 June.

The investigation was overseen by a panel comprising Jayne Scott, a NESO non-executive director, Akshay Kaul of Ofgem and Siobhan Duffy of UK Government Investments. Eversheds interviewed 36 witnesses and examined more than 300 documents. NESO has 2,700 staff of which 130 work in the control room, so this indicates that a large number of people chose not to give evidence to the investigation which concluded that none of the four allegations was substantiated.

Energy Minister Michael Shanks wrote to his Shadow, Andrew Bowie saying “The report found no evidence to substantiate the allegations reported by the former Shadow Secretary of State”. This is not true. Eversheds said its “investigation has not substantiated any of the allegations” – that is not the same as finding no evidence. As I describe below, there was evidence of undue influence over operational decision-making, and Eversheds seems to have dismissed certain irregularities with documentation.

The wider findings are serious enough to call into question the effectiveness of some of NESO’s most important governance arrangements.

Interference in operational decisions by Corporate Affairs

One of the central whistleblower allegations was that the Corporate Affairs team was involved in the decisions in the control room that day, something NESO itself confirmed on X although it insisted its influence was not inappropriate.

The investigation established that Corporate Affairs staff were not directly involved in control room decisions, but it did not conclusively exclude the possibility of indirect interference through senior management. Indeed, the report itself identifies a possible route by which this could have occurred, although the relevant witness account was not corroborated.

One plausible explanation, consistent with that possibility, is that a senior manager spoke to Corporate Affairs on a mobile phone and then instructed, or strongly discouraged, the Power System Manager (“PSM”) from issuing a High Risk of Demand Reduction (“HRDR”) warning. Such an intervention would not appear in the control room’s recorded telephone conversations or operational logs. The report refers to mobile phone communications involving senior management and the possibility of indirect pressure. It also refers to another day on which a senior manager may have influenced a decision not to issue an HRDR warning.

Eversheds reviewed the PSM’s mobile phone records but does not establish that it examined those of senior managers, even though it acknowledges a possible route for indirect interference through senior management. Without examining these records, the only way to verify whether a senior manager discussed operational matters with Corporate Affairs on their mobile phone before issuing verbal instructions to the PSM would be if either the PSM or the senior manager confirmed it.

But while most witnesses would benefit from anonymity, that would not be true for the PSM – everyone in the control room as well as the executive team know who that was. So how likely is it that this individual would volunteer information to the effect that their line manager or other senior individual pressured them in this way?

Given the report’s separate findings about staff concerns over speaking up, management responsiveness and the consequences of challenging senior colleagues, this is a serious weakness in the investigation. Eversheds places considerable weight on the absence of corroboration and on assurances from those involved, without adequately considering whether the PSM could realistically have contradicted a senior manager without potentially career-limiting consequences. The report identifies a credible mechanism for inappropriate influence but then discounts it largely because the people involved didn’t confirm that it happened – that is a weak basis for such a definitive conclusion.

Instructions to shield communications from FOI requests

There is also a degree of naivety in the investigation’s treatment of the allegations concerning Freedom of Information requests. Eversheds relies heavily on witnesses denying that documents were deliberately kept in draft form or maintained without version histories to avoid disclosure. But how likely is someone who gave such an instruction to admit it to external lawyers investigating potential misconduct?

Nor can it be assumed that other witnesses told the whole truth. How likely is it that staff who received inappropriate instructions would implicate their managers, particularly given the problems identified by Eversheds around the speaking-up process. Some witnesses may have withheld information, others may have given incomplete accounts, and it is possible that some were deliberately untruthful. This is why the investigations into these matters should have been conducted entirely independently of NESO and in a context where witnesses could have full confidence that their participation would remain confidential.

“Whilst there were no voltage or stability logs produced for the week of 22 June 2026, the thermal log was populated by the night shift on 23 June 2026 by reviewing the online transmission analysis logs against the documented actions. The event on 23 June 2026 was recorded as amber against the above criteria. We are therefore unable to find any suggestion, on the face of the documents, that these documents had been altered or in any way misrepresented the “live” position, as it was happening.” (Eversheds report)

The missing operational logs are troubling. Eversheds could not establish why some records had not been completed, yet accepted explanations or made assumptions that were favourable to NESO. The absence of these documents could in itself alter the impression of the status and stability of the grid on 23 June. Eversheds says these logs were not produced – did it explore the possibility that they were produced but were subsequently deleted once the day began to attract scrutiny?

“A further source of record-keeping was the suite of internal advice documents known as the “CRAIG” (Control Room Advice and Information Guide), a weekly document providing short-term policy and guidance to the Control Room, supplemented by daily updates and a standing advice section for particularly important matters. The CRAIG is, by its nature, regularly edited and updated, but does not give granular-level instructions or directions to the Control Room and nor does it record real-time Control Room activity, meaning that it was not considered a relevant document for the purposes of our review.” (Eversheds report)

Eversheds excluded the CRAIG from its review. This is hard to understand when record-keeping and record integrity have been called into question. Perhaps the CRAIG for the week of 22 June would have explained why no voltage or stability logs were kept that week, although it seems extraordinary since the Eversheds report says that “the PSM Handover Log for the week commencing Monday, 22 June 2026 noted… that a “watching brief” would be adopted and extra reserve scheduled, as “margins could be tight””. If the week was expected to be difficult surely it would be more rather than less important that logs were kept, and this compounds suspicions that deletion rather than a failure to produce them in the first place was the real truth.

There are three possibilities in relation to the missing logs: they were never created, they were created but then deleted, or they were created but were not supplied to Eversheds. The investigators should have established which was the case, particularly given that the allegations concerned deliberate suppression of records.

Fears over reputational risk driving operational decisions

One of the most revealing sections of the Eversheds report concerns the influence of NESO’s reputation on operational decisions. The report records evidence of an organisational culture in which reputational considerations were communicated to operational staff, whether directly, through management or through staff perceptions of leadership expectations.

One witness said that Electricity Margin Notices (“EMNs”) should be issued without fear, but that this wasn’t the case in practice. EMNs are reportedly regarded as almost a last resort because of their potential to generate negative publicity, with engineers being “realty risk averse now” around their use.

An EMN is a market warning whose purpose is to inform market participants that margins are tight and encourage them to make additional capacity available or reduce demand. A system operator should not be reluctant to issue such a notice because of reputational worries.

Elsewhere in the report there was an account of a manager discussing a possible High Risk of Demand Reduction (“HRDR”) warning that was subsequently not issued with the implication being that the manager dissuaded the engineer from issuing it.

“500MW Hot Weather Reserve modelled in SOP but removed in EMN spreadsheet. Also removed 100MW PAS reserve as EMN spreadsheet looked was showing HRDR with this in,”
– PSM report for 23 June

According to Eversheds, the PSM report for 23 June indicates that engineers removed a 500 MW hot-weather reserve requirement and a further 100 MW reserve requirement from the EMN spreadsheet and that without their removal an HRDR warning would have been needed. Eversheds says witnesses told it this decision was made for legitimate engineering reasons, but acknowledges that the latter adjustment would normally have been made through the scheduling process – here it was apparently made directly in the spreadsheet for convenience.

Eversheds appears to have taken this at face value without exploring alternative explanations. An HRDR is a far more serious and rare warning than an EMN – only two were issued between 2008 and 2016 and none since – so its issuance would attract significant attention. Yet the investigation doesn’t seem to have explored whether the exceptional nature of these warnings created an incentive to avoid it.

This is why the distinction drawn by Eversheds between direct interference and a culture of reputational sensitivity is unsatisfactory. There doesn’t need to be an explicit instruction from Corporate Affairs or senior management telling an engineer not to issue an EMN or warning of HRDR for organisational pressures to affect a decision. If engineers believe that issuing warnings will attract criticism from executives, or that management would prefer them to avoid alarming the market, those perceptions can influence behaviour. In this case, operational decisions are subject to improper influence even if that was not the intention of managers.

The question isn’t just whether Corporate Affairs instructed the control room to take or avoid particular actions, it’s whether operational decisions were made independently, on technical grounds, without inappropriate organisational pressure or not.

Why is NESO relying on spreadsheets to operate the electricity system?

Eversheds identified significant weaknesses in operational record-keeping. In addition to missing logs described above, some documents were maintained in Word or Excel on shared drives without automatic version histories, meaning that subsequent saves could overwrite earlier versions. Logging practices were inconsistent between desks, and some operational information was not recorded systematically. Some logs were written by hand.

Eversheds focuses on governance and audit trails, but seems to overlook the fact that Excel spreadsheets are inherently insecure and not appropriate for use in mission critical applications. The report exposes the extent to which NESO engineers rely on Excel spreadsheets for operational decision-making. These are not only administrative records, they are used in handovers between shifts, for calculating electricity margins and to assess whether thresholds for EMNs and HRDR warnings have been reached.

This raises much bigger issues than document version control: why is a spreadsheet being used for operational calculations that can influence decisions about the security of Britain’s electricity system? Why are these functions not performed within properly designed and tested operational software, using approved models, controlled inputs, automated calculations and a complete audit trail of any adjustments?

Engineers should be able to exercise judgement, including overriding assumptions when circumstances justify it, but such overrides should be made inside a controlled system that records what was changed, why, by whom and with whose authority. The software should then automatically calculate the consequences, rather than relying on manually maintained spreadsheets which may contain outdated information, be vulnerable to accidental changes, or be more exposed to becoming corrupted.

Eversheds records evidence that the EMN spreadsheet was so cumbersome that operators would only update it once or twice a shift, keeping separate notes in the meantime. This is a clear operational risk in a control room that is managing a fast-changing electricity system that goes far beyond governance – it raises fundamental questions about the adequacy of NESO’s operational systems. An error in a spreadsheet used to assess system margins could be far more serious than an incomplete audit trail. Ofgem should explore not just whether spreadsheets were altered improperly, but why they are being used for these functions in the first place, whether their calculations have been independently validated, and whether control room engineers have adequate software tools to manage the increasingly complex electricity system.

Was the grid secure on 23 June?

At the heart of all these investigations is whether the grid was secure on 23 June when system frequency fell below the normal operating range of 49.8–50.2 Hz for an extended period. Frequency reached a low of 49.657 Hz.

NESO has emphasised that frequency remained above the statutory lower limit of 49.5 Hz, and consumers did not lose supply, citing this as proof the grid was secure. The absence of a blackout does not prove grid security – a secure system must be capable of withstanding specified credible contingencies, such as the sudden loss of a major generator, interconnector or transmission circuit, without unacceptable consequences. An insecure system might avoid a blackout through luck – nothing tripped on the day so the lights stayed on. But if something had tripped, or there had been a fault on the grid, would the result have been the same?

The Eversheds report records, and the Ofgem interim report accepts that five network constraints were breached during the incident, with no available pre- or post-action mitigation options. This is among the most concerning findings in the entire Eversheds report. A network constraint can reflect thermal limits, voltage limits or stability requirements. Limits are often set conservatively, and exceeding an internal operating limit doesn’t automatically mean that equipment has been damaged or a statutory security standard has been breached.

NESO describes the implications of breaching constraints: “if too much electricity flows over a constraint, a fault on the network can cause equipment to carry more electricity than it can safely tolerate, potentially damaging infrastructure”. While NESO admits constraints in Scotland were breached later that week, it does not report that any were breached on 23 June.

On 17 July the Times reported that an internal NESO report showed that five separate transmissions constraints were breached on 23 June, with the largest breach reaching 700 MW. The report said these breaches occurred with “no available pre or post-action mitigation options”. A second report seen by the Times, described as a “NESO Significant Event Report” written hours after the low frequency events on 23 June, states: “During the incident, system constraints were breached and system security was compromised.”

NESO confirmed the authenticity of these reports at the time, but described them as preliminary. As I said in my analysis at the time – if five constraints were breached that is a serious issue, but if they were not but control room systems said they were, that is also a serious issue. Lose-lose for NESO. In fact it admits “Between 18:00 and 21:00, there were a number of instances of different durations where power flows on parts of the transmission network exceeded the established Constraint Limits. These included flows across Scotland (up to 300MW), North England (up to 400MW), in Humber area (up to 300MW), in South East England (up to 800MW) and South West England (up to 100MW).”

While NESO did not explicitly deny that constraints were breached in its comment to the Times, it strongly implied they had not been. Clearly they had.

Then we come to the question of reserve. The SQSS requires NESO to hold enough reserve to protect against the single largest infeed loss which is typically 1,400 MW. There are multiple references in the Eversheds report to there being insufficient reserve left on 23 June.

“…several witnesses described how on the Tuesday evening the Control Room had to react to a sudden swing in IFA, which “turned and fully changed direction with one hour’s notice” – meaning that IFA went from importing fully into Great Britain, to exporting towards France. Most of this change happened in the final hour before real time, leaving the Control Room without enough reserve for the evening peak – because the reserves and trades planned on the Monday and through the Tuesday day were no longer available when needed in the evening…”

“One witness, who worked in the Control Room but was not on shift on the day, when hearing of the situation, felt strongly that warnings and demand control notices should have been issued on the Monday (22 June), as the Control Room knew margins were inadequate. This witness questioned whether such warnings were not issued by the Control Room due to discussions with senior management outside of the Control Room and Corporate Affairs, although the witness had no direct evidence to confirm this was the case. The witness explained that the energy desk knew that it could not cover the largest loss, and that this is fundamental to the decision that should be taken:

“you cannot cover your first fault. You cannot. That’s an absolute crystal clear black and white thing. We went well beyond that. We couldn’t even meet 50. That means all the warnings should now have gone out. All 3, EMN, high risk of demand control, and demand control imminent”.

However, the alleged decision not to issue such warnings was, the witness believed, because of the “optics” and because the Control Room was “already in the mess””.

“Whilst another witness suggested they may also have considered issuing a HRDR if they had been the PSM on duty that evening, others disagreed, saying that whilst margins were tight “they were always able to cover their largest loss”, and that the EMNs issued “weren’t anywhere close to HRDRs”.”

“The point around “largest loss” was explained as being fundamental because, at this point, the Control Room does not know what the impact of just one fault would be on the stability of the system as a whole.”

“One witness felt that “people have different views on what stable means” – and that when it comes to operating outside the operational limits (of 49.8Hz and 50.2Hz), some might consider that situation to be unstable, whilst others might not, because the system is arguably still within statutory limits.”

These statements are extraordinary. Some witnesses said they were always able to cover the largest loss while others said they had almost no reserves left. The admissions that the control room didn’t know what the impact of a single fault would be and that people disagree about what stable means are shocking – people die in blackouts so the public would surely expect control room engineers to know whether they had enough reserve, know what impact faults would have, and agree on what stable means in practice.

Of course, we do not know who the witnesses were – perhaps the engineers said there were no reserves and their managers said otherwise.

NESO’s preliminary report says it had taken “all available and commercially accessible” balancing actions while frequency remained significantly below its normal operating range despite automatic frequency response services responding to prevent further falls. So what reserve was left, and why was it not deployed? If reserves were not available or commercially accessible then they would be useless – did NESO retain enough usable reserve to cover the largest loss or not?

NESO has described the problem of “stranded” or “sterilised” reserve — capacity procured but rendered unusable by transmission constraints. If reserve remained available on 23 June, NESO should identify how much was actually deliverable, rather than simply contracted, and explain why it wasn’t used. Otherwise, it’s hard to see how the system could have retained enough reserve to withstand a major generation or interconnector loss.

It’s hard to read these documents and come away with a belief that the grid was secure on 23 June. Either the system was not demonstrably secure, or the control room lacked the situational awareness necessary to demonstrate its security. Neither interpretation is comforting.

Demand forecasting remains a major weakness

I have repeatedly criticised NESO’s demand forecasting capabilities (here and here). In my July analysis, I showed that forecast errors had increased substantially, with average day-ahead errors reaching around 800 MW during the first half of 2026 and individual errors exceeding 5 GW. These are very large errors relative to the capacity held to manage major system losses.

Forecasting uncertainty and contingency requirements have to be managed together – if the system is short because demand has been underestimated, the reserve that would otherwise be available to respond to a generator or interconnector trip might already have been used. The fact that frequency deviations outside the operational limits are significant and growing may very well be a consequence of the deteriorating demand forecasts along with poor wind forecasting.

The preliminary report confirms that actual demand exceeded day-ahead forecasts by over 2 GW during the June heatwave week (the largest errors on each day were Monday actual demand 1,846 MW higher than forecast, Tuesday actual demand 1,643 MW higher than forecast, Wednesday actual demand 2,055 MW higher than forecast, Thursday actual demand 2,087 MW higher than forecast, Friday actual demand 1,037 lower than forecast). The timing of the demand peak was also inaccurate by between 25 minutes and around an hour except on Friday when it was broadly in line with the expected time. Wind generation was at times 1,500 MW lower than expected, while a 5,000 MW discrepancy in generation availability data was identified (a difference between available generation notified via the Balancing Mechanism versus that notified via REMIT).

These errors had a material impact on system margins.

The problem is exacerbated due to the impact of embedded solar generation which appears as negative demand on the transmission system. NESO has to forecast not simply how much electricity consumers will use, but how much of that consumption will be met by generation behind the meter and therefore not appear as demand on the transmission system. During a sunny summer afternoon, embedded solar can significantly reduce apparent grid demand, but as solar output declines into the evening, that demand reappears. Underlying consumption may not have changed at all, but the transmission system must suddenly supply a much larger proportion of it. This makes the evening ramp increasingly important, even in summer.

Summer grid chaos has extended into the autumn

The first couple of weeks of October demonstrated a range of grid disruptions that are a further cause for concern. On 6 October wind output was low and an EMN was issued – the first of the winter after five were issued over the summer. NESO resolved the shortfall by breaching intraday trading limits on the interconnectors and paying £1,000 /MWh in the Balancing Mechanism.

On the 9 October wind output was high yet frequency sagged consistently, dipping to 49.74 Hz and remaining below the operational limit for 9 consecutive minutes. NESO was forced to request Emergency Assistance from France and paid close to £700 /MWh in the BM.

On 12 October again wind output was high, but NESO was unable to balance the grid in the SE England and was forced to request huge amounts of Emergency Assistance from France: 700 MW and then another 1,200 MW. These were record volumes. Demand that day was the highest of the winter to that point at 35.5 GW but still well below the 45 GW that can be expected on a typical midwinter’s day. NESO also paid £1000 /MWh in the BM.

On 14 October it was windy, nothing tripped, demand was nothing special, but NESO blew through the intraday interconnector trading limits – NESO traded against the flow for 14 consecutive settlement periods (7 hours) with several hours at 2,700 MW (against the limit of 1,500 MW). The cost of balancing the day was just under £50 million against a daily average of £2.3 million. This was the most expensive day ever in the BM. Frequency that day went both above the upper operational limit and below the lower operational limit.

On 15 October the trading limits were breached again. And again frequency went both above the upper operational limit and below the lower operational limit. Balancing costs were lower but still over £23 million – 10x the daily average.

Despite all of these extra-ordinary actions, the de-rated margin and loss of load probability for the week were both perfectly fine. The margin was healthy at all times and the LOLP was always zero. So, in a well supplied market, NESO struggled to keep the frequency inside the operational limit and repeatedly breached intraday interconnector trading limits.

This is not evidence of a system operating securely. It’s evidence of a system that’s being held together with expensive last-minute actions. Yes, the lights stayed on, but conditions were really benign. I’m not sure we can be confident of the same outcome when demand is higher later in winter.

Can the grid be credibly described as secure?

Throughout its report Eversheds identifies circumstances that warrant further investigation, yet fails to adequately follow up. Too often it accepted explanations from the people involved, and then treats the absence of contradictory evidence as grounds for rejecting the whistleblower allegations. I am not satisfied that NESO’s governance arrangements are appropriate – too often it pays lip service to transparency but is actually obscuring key information. For example the way it reports constraint costs – there are four different ways this is done through the NESO Portal that I have found and none of them reconcile with each other in any discernible way. I describe this in the Appendix to my recent gas security report.

I can easily see a scenario where a senior manager has discussed a potential market warning with the comms team in person or on a private mobile phone and then given a verbal instruction to the PSM. I can also easily see a scenario where the PSM would be reluctant to disclose this to an investigation knowing their identity would be readily discoverable by the manager in question and indeed other executives.

I can also see a scenario where the missing logs were missing because they were deleted rather than not being kept that week. Given control room engineers were aware the week of 22 June was going to be difficult, deciding not to keep important system logs that week of all weeks is bizarre and if true should itself be investigated – why would you decide not to keep logs in a challenging week? Who decided this and on whose authority?

While the Eversheds report is very generous to NESO on the subject of governance, it ironically does the opposite on system security. It highlights the use of insecure Excel spreadsheets, identifies confusion over operational processes, whether enough reserves were held, whether the largest loss was covered, and even what is meant by “secure”.

The NESO report exposes how bad its demand and wind forecasts were in the week in question. These were very large errors, and material in relation to the sixe of reserves held. It also admitted for the first time that grid constraints were violated, despite strongly implying to the media that they were not.

The list of risk factors around system security is significant:

• SORT, the balancing software dates back to the 1980s and should have been replaced years ago. When this system fails engineers revert to CLOGS which is a spreadsheet based tool
• EDL/EDT the communications software that allows power stations to send technical parameters and Bid-Offer ladders to NESO and receive BM Acceptances and other instructions back is similarly old and subject to frequent outages – when these outages occur control room staff must revert to telephone instructions. This wasn’t difficult when the grid was dominated by a small number of large power stations with experienced operational staff. It is far harder now there grid contains thousands of small batteries many of which have no operational staff at all. This is made worse by issues with correct contact information not being provided to NESO, something that used to be maintained by the business continuity team whereas now generators are expected to proactively provide it
• Spreadsheets are routinely used in the control room for margin calculations and important decision-making including relating to the issuance of margin and demand control warnings. They are also used to exchange certain information with market participants. Many process are highly manual which creates obvious risks
• Standards around Grid Code compliance testing have fallen as evidenced by recent reports of windfarms having meters installed in reverse. MY FOI request last year into the progress of re-testing revealed that rather than re-testing all transmission-connected assets as planned, NESO had tested just 20 sites
• NESO is not aware of the location of smaller assets on the grid. It also cannot see or control assets connected to low voltage networks. This makes demand forecasting harder as solar and batteries on low voltage grids materially impact transmission system demand. In summer excess solar causes disturbances on the transmission system that NESO cannot prevent
• NESO is bad at forecasting. Both demand and wind forecasts are poor and deteriorating. These errors can be material and use up reserves leaving less or potentially none to cover the largest loss
• The grid is increasingly reliant on imports which cannot be controlled or compelled. This summer NESO has used an Emergency Instruction to disconnect supplies to the Netherlands without agreement or notice. It also used Net Transfer Capacity restrictions to limit cross-border capacity limiting interconnector exports. NESO confirmed that these restrictions are used for operational reasons rather than simply security concerns, something that is not permitted for European TSOs. There are risks our neighbours may become unable (due to domestic shortages) or unwilling (due to cost or other concerns) to export to us, and the Government’s plans for dynamic alignment with the EU could force NESO to comply with the same rules as European TSOs removing its ability to use NTC restrictions
• Meeting demand on low wind days is increasingly difficult. Without access to imports capacity margins would become extremely thin
• High levels of wind generation can cause regional balancing challenges. A forecast for high wind output the following day causes the GB day ahead electricity price to be low, encouraging exports to Continental Europe. However, due to grid constraints it is hard to transport the electricity to the interconnectors in SE England – there are difficulties getting the electricity out of Scotland and other difficulties getting it into the SE England. This can force NESO to take emergency actions on interconnectors and breach trading limits as it seeks to halt or reverse exports to avoid imbalances in the SE region
• Transmission assets are aging – 30% of switchgear, almost two thirds of overhead lines and just over a third of transformers were built prior to 1980 and are more than 45 years old
• Falling levels of inertia are creating stability challenges. The Eversheds report heard that “the challenges of the net zero transition… noting that conventional generation had been easier to manage because of better system inertia, whereas increased reliance on renewables, which are less flexible, makes the job more difficult”
• Reserves may exist on paper but not be physically deliverable for example ramping rates, minimum stable generation levels, temperature-related derating and transmission constraints all affect how much capacity is genuinely available
• While low inertia increases the initial rate of frequency change following a disturbance, the system also needs enough fast frequency response to arrest that change and slower reserves to restore frequency. Batteries can provide extremely fast response, but their contribution depends on available power, state of charge, control settings and how much response has already been activated. There are questions about whether the system can remain secure against a further major loss after responding to a disturbance
• Replacing conventional generation with inverter-based generation can reduce voltage security as seen in Iberia last year. Long-distance power transfers and heavily loaded transmission circuits also make voltage management more difficult. Voltage instability can develop even when aggregate generation is enough to meet demand
• A system can appear secure under normal operating conditions but become unstable when multiple inverter-based resources disconnect in response to a disturbance. Protection settings, frequency and voltage ride-through behaviour, and the interaction between different manufacturers’ controls need to be understood and tested – these issues were also observed in the Iberian blackout
• As conventional power stations close, the availability and geographical distribution of restoration (black start) resources change. Restoring a system containing large numbers of inverter-based generators, batteries and distributed assets may require different procedures and capabilities, and the process contains more uncertainties due to the difficulties forecasting distribution-connected solar and battery behaviour as well as underlying demand. If regional demand is incorrectly estimated by too large an amount the grid will immediately trip when load is reconnected, and if the error is very large there is a risk of equipment damage that would threaten the ability to repeat the attempt
• The Eversheds report identified organisational risks within NESO including pressure on engineers, weaknesses in record-keeping, and concerns about communication between the control room and senior management. The report identified “a culture in which experienced operatives have either left or disengaged from raising concerns”
• There are growing concerns over cyber security and the potential for disruption either by hostile states or by individual bad actors. Shared telecoms infrastructure, software dependencies, cyber incidents and failures of backup arrangements could all affect the control room’s ability to observe and control the grid. The June 2025 EDL/EDT disruption which was caused by damage to the communications cables rather than a software issue illustrates the vulnerabilities affecting primary and secondary communications methods
• There is high reliance on the gas fleet particularly in low wind conditions, however much of the fleet is aging. A third of the large gas generators were built in the 1990s and another third in the 2000s, with the older units approaching end of life. Several report expected decommissioning dates in the late 2020s/early 2030s, and one – South Humber Bank unit 1 may actually have already closed without anyone realising. It last generated on 3 April and has submitted a REMIT notice of a planned outage until 2043 while the company accounts say it is expected to decommission in 2029. It may well be this plant has already generated its last MWs
• As more generation and storage connects to distribution networks, local voltage fluctuations and interactions between inverter controls and protection systems may become harder to manage. NESO has limited visibility of these assets, creating risks that disturbances originating on distribution networks could affect the transmission system, while transmission-level disturbances could trigger unexpected responses from large numbers of distributed assets
• As the grid becomes more reliant on weather-based generation, weather risks will increasingly compound. Cold weather drives high demand in winter but is also associated with low wind output. High temperatures can coincide with low wind output, while lowering the efficiency of thermal and solar generation and increasing line and transformer losses. Transformers are also at higher risk of catching fire – UK transformers are not rated to high temperatures in the way those located in hotter countries are. With several of out neighbouring countries also relying on wind, high weather correlation can threaten the availability of imports at the time they are most needed ie when wind output in GB is low

Not all of these risks will result in adverse outcomes, and they do not all carry the same weight. But it’s a long list, and many of the items individually have the potential to cause blackouts. The longer this list of risks is, the greater the chance that several of them may occur at the same time, greatly increasing the threats to system security.

It’s not scaremongering to worry about blackouts when there’s such a long list of identifiable risks to the security of the electricity system, particularly when several of those risks have already materialised. Nobody is suggesting a blackout is inevitable, but neither is it reasonable to dismiss the possibility simply because the lights have stayed on so far. Electricity system security is about ensuring the grid can withstand credible failures, not celebrating the fact that no such failure happened yet.

The insistence of ministers and NESO executives that the grid is robust, and the casual dismissal of concerns raised by whistleblowers and others is difficult to comprehend when the risks to grid security are considered carefully. To address some of these NESO would need more powers (for example to see real time data for distribution-connected assets and having the ability to instruct them to turn up or turn down) but it will struggle to seek these powers while telling the market that everything is completely fine and the grid is totally secure.

The pursuit of Clean Power 2030 is diverting attention away from addressing many of the challenges faced by the grid, with issues relating to legacy systems being most at risk of being overlooked.

Yesterday’s reports identify some very serious concerns about how NESO is managing the grid. It’s time Ofgem and DESNZ, and Michael Shanks set aside their complacency and considered the real threats we face to electricity security, not least because the consequences of failure would be very severe.