Follow one incident, from the first alarm to the report the regulator gets
A lightning strike trips a feeder at a substation. Here is how the energy pack and the people on shift handle it, step by step. All names and data are fictional.
Step by step
- 01 · 06:12 · Alarm
Fourteen alarms become one incident.
Protection relays and the control system raise alarms within seconds. The pack groups them into one incident and starts the NIS2 clocks.
AI: grouped 14 alarms, opened INC-0412, started the 24-hour and 72-hour clocks.Shift lead: Ciarán Hughes
grid · incidents · INC-0412Sample dataINC-0412 · Feeder tripKilbride 110 kVOpenAlarmCausePlanReportMarketSealedClocks- Early warning
- 23 h 59 m left
- Notification
- 71 h 59 m left
Grouped- Alarms
- 14
- Feeders out
- 1
- Customers
- about 18,000
Time Alarm Source 06:11:58 Line section 4 trip Relay R-14 06:11:58 Breaker CB-14 open SCADA 06:12:03 Undervoltage feeder 4 SCADA - 02 · 06:20 · Cause
The AI says what most likely happened.
It reads the relay log, the lightning data and the line's history, and shows each source. It also says what it could not rule out.
AI: read 14 alarms, a lightning feed and 3 maintenance records; suggested a lightning strike on section 4.Reviewed by Aoife Brennan, control-room engineer
grid · incidents · INC-0412Sample dataLikely causeINC-04123 sourcesAlarmCausePlanReportMarketSealedAnswerA lightning strike on line section 4 at 06:11:57 1 tripped the relay as designed 2. The line was last inspected in May with no faults 3. A cyber cause is not indicated, but the security log review is still open.
1Lightning detection feedDATA2Relay R-14 event logLOG3Line inspection, MayPDFThings the AI could not check are listed, not hidden.
- 03 · 06:35 · Plan
An engineer approves the switching plan, with one change.
The pack drafts a plan to restore supply through feed B and checks every step against network limits. Aoife adds a step to send a crew to inspect the line.
AI: drafted 4 switching steps and checked loading at 71%.Aoife Brennan: added a crew inspection step, then approved.Decided by Aoife Brennan, control-room engineer
grid · incidents · INC-0412Sample dataSwitching plan SP-2231for INC-0412Approved with a changeAlarmCausePlanReportMarketSealed# Step Check 1 Open CB-14 at Kilbride Isolated 2 Close tie switch TS-7 Load 71% 3 Confirm voltage, feeder 4 Within limits 4 Added: crew to inspect section 4 By Aoife Approved 06:41 by Aoife Brennan. Supply restored to all customers by 07:52.
- 04 · 09:41 · Report
The early warning goes out on time.
The pack drafts the early warning in the national CSIRT's format. The security officer checks the facts, edits one line and sends it.
AI: filled the early warning from the incident file and marked it significant.Tomasz Wolski: confirmed it was significant, edited the cause line and sent it.Decided by Tomasz Wolski, security officer
grid · incidents · INC-0412Sample dataNIS2 early warningINC-0412Sent 09:41AlarmCausePlanReportMarketSealedClocks- Early warning
- Sent, 3 h 29 m
- Notification
- Due in 68 h
- Final report
- Due in one month
What was sent- Significant
- Yes
- Cause
- Natural, no cyber cause found
- Cross-border
- No
Every edit Tomasz made is kept with the report.
- 05 · 10:30 · Market
Is the outage inside information?
The inspection crew needs the Moyle link at reduced capacity for six hours. The pack drafts a market notice and asks whether it must be published.
AI: found a 200 MW capacity cut and drafted a notice.Niamh Doyle: agreed it was inside information and published it.Decided by Niamh Doyle, market compliance
grid · incidents · INC-0412Sample dataUnavailability noticelinked to INC-0412Published 10:52AlarmCausePlanReportMarketSealedNotice- Asset
- Moyle interconnector
- Unavailable
- 200 MW
- From
- 14:00 CET
- Until
- 20:00 CET
Published 10:52. The reason and the approver are sealed with it.
- 06 · 13:58 · Sealed
The notification is sent and the record sealed.
The pack drafts the notification with the cause, the impact and what was done. Tomasz approves it, and the whole incident is sealed.
AI: drafted the notification and gathered the record.Tomasz Wolski: approved the notification.Sealed at 14:02 · checked by anyone with the open verifier
grid · incidents · INC-0412Sample dataINC-0412 · ClosedKilbride 110 kVSealedAlarmCausePlanReportMarketSealeddecided Restore via feed B by Aoife Brennan reports 09:41 · 13:58 notice Moyle, 10:52Sealed 14:02:17 · timestamp witnessed outside Lowland Grid
- Early warning
- 23 h 59 m left
- Notification
- 71 h 59 m left
- Alarms
- 14
- Feeders out
- 1
- Customers
- about 18,000
| Time | Alarm | Source |
|---|---|---|
| 06:11:58 | Line section 4 trip | Relay R-14 |
| 06:11:58 | Breaker CB-14 open | SCADA |
| 06:12:03 | Undervoltage feeder 4 | SCADA |
A lightning strike on line section 4 at 06:11:57 1 tripped the relay as designed 2. The line was last inspected in May with no faults 3. A cyber cause is not indicated, but the security log review is still open.
Things the AI could not check are listed, not hidden.
| # | Step | Check |
|---|---|---|
| 1 | Open CB-14 at Kilbride | Isolated |
| 2 | Close tie switch TS-7 | Load 71% |
| 3 | Confirm voltage, feeder 4 | Within limits |
| 4 | Added: crew to inspect section 4 | By Aoife |
Approved 06:41 by Aoife Brennan. Supply restored to all customers by 07:52.
- Early warning
- Sent, 3 h 29 m
- Notification
- Due in 68 h
- Final report
- Due in one month
- Significant
- Yes
- Cause
- Natural, no cyber cause found
- Cross-border
- No
Every edit Tomasz made is kept with the report.
- Asset
- Moyle interconnector
- Unavailable
- 200 MW
- From
- 14:00 CET
- Until
- 20:00 CET
Published 10:52. The reason and the approver are sealed with it.
One record, from alarm to notification.
Everything that happened is in one sealed record: the alarms, what the AI read and suggested, the plan as approved, the reports sent and who signed each one.
Change one word of a sealed record and the check fails. Try the seal check →
The AI read and drafted. People decided.
Here is the split, step by step.
What the AI did
- Grouped 14 alarms into one incident and started the NIS2 clocks
- Read the relay log, lightning data and line history, with sources
- Drafted a switching plan and checked it against network limits
- Filled the early warning and the notification from the incident file
- Found a capacity cut and drafted the market notice
- Gathered and sealed the record
What people decided
- Aoife Brennan approved the switching plan, adding a crew inspection
- Tomasz Wolski judged the incident significant and approved both reports
- Niamh Doyle decided the outage was inside information and published the notice
- Ciarán Hughes, the shift lead, closed the incident
Keep going
Walk through one of your own incidents.
We will run a past incident through the pack with you, on the compute you choose.