Heathrow’s North Hyde fire exposes hidden vulnerabilities in critical infrastructure

When there’s a failure, people’s first response is to blame equipment. That was the case after fire broke out at the North Hyde electricity substation in west London, cutting supply to Heathrow Airport and more than 70,000 customers.

But quite often the heart of the problem is not equipment, it’s people. Failing equipment is the result of human failing.

The North Hyde outage illustrates how connected our economic and social infrastructure systems have become, and how interdependent they are. It indicates that systems assumed to be robust can be surprisingly vulnerable. And it shows that the weakest links in many systems are those individuals and teams who design, deliver, manage and oversee them.

There are people-related questions that NESO, the National Energy System Operator, could have asked when it reviewed the North Hyde outage, but didn’t. On 18 November the government published a response to NESO’s report, ‘Developing an energy resilience strategy and setting the North Hyde Implementation Plan’, that maps out steps to be taken over the coming year intended to reduce the risk of future cascade failures. It mentions “operators” more than 50 times, but “people” not once.

Mitigate or tolerate?

When faced with a known, critical risk, you can choose either to mitigate it – acting to reduce its probability and severity – or tolerate it. It’s a human decision and, for critical national infrastructure (CNI), should be a board-level decision.

>> Also read: Building Systems Thinking Explainer: Lessons from North Hyde on systemic risk

Like Heathrow Airport itself, power supply is a form of CNI. You aim to keep CNI running 24/7 every week of the year, but that can’t be guaranteed.

Heathrow’s management team knew that the airport was reliant on three electricity supply points. If any one of them failed, it would result in the loss of power to operationally critical systems. Restoring supply would take 10-12 hours. Yet Heathrow apparently elected to tolerate the risk. Why?

The answer likely lies in part with the system’s legacy. North Hyde substation was built in 1968 when Heathrow was still relatively small, handling just 5M passengers a year. The substation had provided over half a century of reliable performance as Heathrow grew. Indeed, Heathrow told NESO that they simply didn’t reckon on it failing.

This is one of the watch-outs for all engineers: it is a human tendency to accept the status quo, but when we fail to challenge, we miss opportunities to mitigate risk.

NESO’s review noted that three large data centres are located in the area affected by the outage, but all managed to avoid disruption by powering-up generators. Heathrow was criticised for failing to do the same. In fact, back-up generators were used during the first two hours of the outage, but then switched off – Heathrow did not tell NESO why and did not respond to a request for clarification.

It can be the case that, when systems are not expected to fail, detailed contingency planning is neglected

It can be the case that, when systems are not expected to fail, detailed contingency planning is neglected. Heathrow’s power demand is comparable to that of many large towns. Meeting that with diesel generators requires a non-stop convoy of fuel bowsers. The airport’s reserves would have been quickly exhausted without the right supply contract.

Running out of fuel seems the most likely scenario. If that was not the reason for switching off the generators, the next most likely explanation – failure of the generators themselves – also points to weak contingency planning.

Sadly it is all too easy to understand how such a scenario could arise. In all large organisations, those responsible for risk management review a long list every year. In the main, they are the same risks, with the same probability and severity every time.

And therein lies a danger. The first time someone reads the risk register it’s interesting, but if they don’t intervene at that point, the opportunity quickly passes. Year on year the risks become familiar; nothing much changes; the decision to mitigate or tolerate becomes almost automatic. Tick. Things continue as they are for another year.

Incentivised deferral

The North Hyde substation fire was caused by a shortcircuit in one of the substation’s three transformers, SGTs 1, 2 and 3. The shortcircuit occurred because water had penetrated into one of the oil-filled bushings on SGT3 – bushings provide electrical insulation as well as mechanical support to the transformer. The shortcircuit caused electricity to arc, which ignited the oil, causing it to blaze like a giant chip pan fire.

Moisture ingress is a well understood risk, and National Grid has four classifications from 1 (be aware) to 4 (remedy immediately). In 2018 the moisture content in the SGT3 bushing was classified at level 4. The transformer should have been isolated (switched off) and the bushing should have been replaced then. But it was not – according to National Grid, due to a procedural error.

Likely there was a human behind that miss. And there were certainly people behind other missed opportunities to reduce the risk of failure.

Basic servicing was scheduled for 2021 but had been postponed annually.

When the substation was designed in the late 1960s, it was good practice to reduce the risk of fire spreading from one transformer to the next by compartmentalising them. By 1990 isolating walls were standard practice. National Grid told NESO that there was not enough space between the North Hyde transformers to build walls. The more likely case is that two transformers would have had to be switched off simultaneously to allow a wall to be safely constructed. It would have been logistically complex but nonetheless practicable.

Instead, National Grid installed a deluge system. However, it was known to have been inoperable since 2022.

Rather than incur the cost of properly sorting out potential problems, whole industries and their value chains were encouraged to think ‘we’ll be all right for a bit longer’

Privatisation of utilities in the 1980s and 90s saw the introduction of price cap regulation, under a formula championed by economist Stephen Littlechild. Set out in the 1983 Littlechild Report, pricing was based on the retail price index (RPI), minus an efficiency factor, ‘X’.

RPI-X effectively required network operators to cut their costs year on year and spending less on maintenance was the easiest win. Rather than incur the cost of properly sorting out potential problems, whole industries and their value chains were encouraged to think ‘we’ll be all right for a bit longer’.

RPI-X has been replaced in the energy sector by RIIO, emphasising revenue (total allowed income), incentives (performance-based financial rewards and penalties), innovation (encouragement to adopt new technologies and practices) and outputs (explicit service targets like reliability, environmental performance and customer satisfaction). RIIO is having a positive effect on industry behaviours and culture, but change is slow.

Doing what we’re paid for

Heathrow didn’t recognise that the grid could fail. National Grid didn’t recognise the potential impacts if it any part of it did. Who else was in the frame?

The operation of Heathrow’s electrical network is subbed out to UK Power Network Services, the unregulated contracting arm of distribution network operator UK Power Networks.

It is human nature to assume that, if nothing bad has happened, everything is fine

Straddling between the two organisations and their systems, UKPN Services may have been in a position to see and call out the risks. In such a scenario the organisations on either side may think that the one in the middle will plug any gaps. But most contractors will only ever do what they are paid to do. Every client organisation needs to know who is responsible for what. Ownership of information, processes and actions must be clear.

The North Hyde substation fire shows that nobody in charge of CNI can be reactive. It is human nature to assume that, if nothing bad has happened, everything is fine. That is not the case. You’ve got to be proactive and manage the risks.

Chris Glover is director, energy at Buro Happold