Two controllers, one failure
VAt 07:00 BST on 20 October 2026 the facility hosting Google Cloud zone europe-west2-b in London lost power. The UPS battery banks took the load. Google's Preliminary Incident Report, posted on 22 October, says the automation system that starts the generators, both primary and backup controllers, failed to start them. When the batteries ran out, servers, network and storage in the zone went offline1.
VThe harm spread beyond the zone. Google says customers in the two unaffected London zones also saw errors, because of sudden demand on the remaining capacity and control-plane checks that depended on the zone that was down. The incident ran for 6 hours 10 minutes, and a final report with preventative actions is still to come1.
RCustomers of Revolut, Lloyds, HSBC and Bank of Scotland, and users of Royal Mail, DPD and Rightmove, were reported disrupted. The FCA said it was engaging with Google and affected firms, and the Treasury Committee wrote to the Bank of England and the FCA3.
The same shape, three months earlier
VOn 15 July 2026 a 3 ms voltage drop hit both utility feeds of zone europe-west4-a in the Netherlands. Google's final report says the side A backup power unit failed to take the load, one row of racks tripped, the chiller controller went offline so the pumps did not restart, and the redundant cooling source was unavailable because of known construction work. The data hall reached 44°C and the incident lasted 14 hours 55 minutes2.
AEach site had redundancy on its drawings. In each, one step in the chain did not happen when it was called: a controller, a backup unit, a pump restart, a cooling source taken out for works. A chain is as available as its least proved link.
Duplicated controls can share one failure
AA primary and a backup controller that fail together behave as one asset. Duplication protects against a single component failing; it gives no protection against a shared design, shared logic or a shared trigger. The asset register should show which protective layers are truly independent and which only look it.
APlanned works change the design in force. A cooling source taken out for construction is a temporary loss of redundancy, and it belongs on the risk register with an owner and an end date, as any other change would.
RFor the users of cloud services, the London incident adds a second lesson: a design spread across zones still shared control-plane dependencies. Financial regulators were reported to be asking questions within a day3.
Date every chain, then test it whole
AKIS PLUS LTD's view is that every protective chain an owner relies on should carry a date: the last time it was made to work end to end, under realistic load, with the record kept. Component tests and maintenance logs matter, and they answer a smaller question. The board question is whether grid, batteries, generators, controllers and cooling worked together on a named day.
IGoogle's final report may find a specific defect in the London controllers. Whatever it finds, an owner that can show a recent whole-chain test is far better placed than one that can show only that two controllers were installed. This article draws no conclusion on the cause.
OUR PERSPECTIVETwo controllers on the drawing are one asset if they fail the same way.
Three questions to ask this week
- For each protective chain we rely on, when was it last made to work end to end under load, and where is the record?
- Which of our duplicated controls share a design or a trigger that could make them fail together?
- What redundancy is out of service today for works, who owns that risk, and when does it return?