Sign inBook a briefing
Walkthrough · Energy and grids

Follow one incident, from the first alarm to the report the regulator gets

A lightning strike trips a feeder at a substation. Here is how the energy pack and the people on shift handle it, step by step. All names and data are fictional.

Lowland Grid, a fictional operatorEngineer, security officer, market complianceAbout eight hours

Step by step

  1. 01 · 06:12 · Alarm

    Fourteen alarms become one incident.

    Protection relays and the control system raise alarms within seconds. The pack groups them into one incident and starts the NIS2 clocks.

    AI: grouped 14 alarms, opened INC-0412, started the 24-hour and 72-hour clocks.

    Shift lead: Ciarán Hughes

  2. 02 · 06:20 · Cause

    The AI says what most likely happened.

    It reads the relay log, the lightning data and the line's history, and shows each source. It also says what it could not rule out.

    AI: read 14 alarms, a lightning feed and 3 maintenance records; suggested a lightning strike on section 4.

    Reviewed by Aoife Brennan, control-room engineer

  3. 03 · 06:35 · Plan

    An engineer approves the switching plan, with one change.

    The pack drafts a plan to restore supply through feed B and checks every step against network limits. Aoife adds a step to send a crew to inspect the line.

    AI: drafted 4 switching steps and checked loading at 71%.Aoife Brennan: added a crew inspection step, then approved.

    Decided by Aoife Brennan, control-room engineer

  4. 04 · 09:41 · Report

    The early warning goes out on time.

    The pack drafts the early warning in the national CSIRT's format. The security officer checks the facts, edits one line and sends it.

    AI: filled the early warning from the incident file and marked it significant.Tomasz Wolski: confirmed it was significant, edited the cause line and sent it.

    Decided by Tomasz Wolski, security officer

  5. 05 · 10:30 · Market

    Is the outage inside information?

    The inspection crew needs the Moyle link at reduced capacity for six hours. The pack drafts a market notice and asks whether it must be published.

    AI: found a 200 MW capacity cut and drafted a notice.Niamh Doyle: agreed it was inside information and published it.

    Decided by Niamh Doyle, market compliance

  6. 06 · 13:58 · Sealed

    The notification is sent and the record sealed.

    The pack drafts the notification with the cause, the impact and what was done. Tomasz approves it, and the whole incident is sealed.

    AI: drafted the notification and gathered the record.Tomasz Wolski: approved the notification.

    Sealed at 14:02 · checked by anyone with the open verifier

The record at the end

One record, from alarm to notification.

Everything that happened is in one sealed record: the alarms, what the AI read and suggested, the plan as approved, the reports sent and who signed each one.

Change one word of a sealed record and the check fails. Try the seal check →

record INC-2026-0412 what Feeder trip, Kilbride 110 kV decided Restore via feed B; test T2 within 30 days by Aoife Brennan, control-room engineer reports Early warning 09:41 · Notification 13:58 approved Tomasz Wolski, security officer read 14 alarms · 3 maintenance records · 1 weather feed model local model, this installation time 2026-10-12 14:02:17 UTC
Sealed 14:02:17 · timestamp witnessed outside Lowland Grid
Who did what

The AI read and drafted. People decided.

Here is the split, step by step.

What the AI did

  • Grouped 14 alarms into one incident and started the NIS2 clocks
  • Read the relay log, lightning data and line history, with sources
  • Drafted a switching plan and checked it against network limits
  • Filled the early warning and the notification from the incident file
  • Found a capacity cut and drafted the market notice
  • Gathered and sealed the record

What people decided

  • Aoife Brennan approved the switching plan, adding a crew inspection
  • Tomasz Wolski judged the incident significant and approved both reports
  • Niamh Doyle decided the outage was inside information and published the notice
  • Ciarán Hughes, the shift lead, closed the incident
Book a briefing

Walk through one of your own incidents.

We will run a past incident through the pack with you, on the compute you choose.