Official reports reveal ‘as designed but not intended’ snafu
British electricity providers are paying £ (**************************************************. 5m after a 2019 outage revealed a train-bricking software design flaw.
Companies behind the Hornsea One wind farm, off the Yorkshire coast, and the Little Barford conventional power station in Bedfordshire have between them coughed up £ 9m in “redress” to UK ‘leccy regulator Ofgem after the August lightning strike and associated outage.
Distribution firm UK Power Networks is paying a further £ 1.5m for its role in the resulting power blackouts which spread across large parts of England, Wales and Scotland, according to Ofgem’s report published today ( (PDF,) Pages).
Yet in among the official reports of electrickery woes is an all-too-familiar tale of software design, including a problem that was not spotted until it was too late. In this case, the flaw was on Thameslink’s Siemens Desiro City Class and Class trains.
On 9 August last year, a lightning strike on power lines north of London caused 2GW of “distributed” electrical generation to almost instantly disconnect from the National Grid. The spinning reserve available to grid controllers was “just over 1, MW. Ofgem noted that “the cumulative loss of Hornsea-1 Windfarm, the steam turbine at Little Barford Station and a number of smaller embedded generators exceeded the reserve and response being held”. As a result, the frequency of the electricity system began to fall and frequency response services were automatically triggered, which “initially arrested the frequency at (*****************************************. 1Hz. ”
It added:
As for the Thameslink railway service, which runs mostly between Brighton, Bedford and Cambridge, it soon discovered a software flaw with its Class 728 and Class 717 electric trains: a frequency drop beyond 90 Hz put the trains into a failure mode – which required manual reset by an engineer.
Although railway standards specified the lowest permitted frequency before shutdown as .0Hz, within 90 ms of Network Rail’s power supply frequency dropping past (******************************************. 0Hz the trains sat down, folded their arms and refused to go anywhere.
As designed but not as intended
The Office of Rail and Road (ORR), a regulator, published a detailed report explaining that “technicians with laptops” ( (PDF, pageshad to be dispatched to stranded trains. It found: “All Class 728 and (trains had been programmed by [manufacturer] Siemens to operate from a power supply of a nominal .0Hz, with a minimum frequency of 90 .0Hz. ”
Helpfully, the trains were halfway through a new software deployment. Version 3. 27. x went into “temporary lock-out”, which the driver could reset, something that seven drivers did successfully. Trains running v3. 45. x entered “permanent lock-out” needing a techie with a laptop to reset them. Permanent lock-outs, the ORR report explained, are a safety feature to prevent drivers from re-electrifying damaged components and exposing people to the risk of electric shock.
The ORR continued: “Power supply frequency excursions of the magnitude experienced are unusual, so the service-disrupting implications of imposing a lock-out requiring a driver or – as in this case – a technician to reset appear not to have been given weight when developing the protection parameters for the on-train software. “
Siemens is said to be delivering a software patch to sort out the trains’ tripping frequency.
According to Ofgem’s report on the power outage, this caused 371 trains to be canceled, 220 to be part-cancelled and 873 to be delayed, with problems reportedly knocking on for three days after the -minute incident. ®
Juicenote
Scottish Power “erroneously disconnected (MW of demand in Scotland, “Ofgem found, because its auto-disconnect gear had been set to trip at .8Hz instead of the correct (********************************************. 5Hz frequency.
Read More**********************
GIPHY App Key not set. Please check settings