Maintenance changes the plantso the protection must be proved for the state the work leaves behind

VAt about 23:52 on 15 September 2026 an infrastructure monitoring train running under ETCS Level 2 came to a stand near Welshpool, Powys, at the block marker that ends its movement authority. Its on-board equipment was still telling the driver there were 610 metres to go. RAIB says a component of that equipment had stopped the correct wheel diameter being stored after routine maintenance, and neither the independent speed measurement nor the trackside balises corrected the distance¹.

VRAIB found weaknesses in the on-board protection arrangements, chose not to run a full investigation, and wrote to Network Rail, copied to the Office of Rail and Road and the train's operator¹.

VIn London, Google's final Incident Report of 27 October 2026 explains the outage of zone europe-west2-b. A generator load test on 14 October found problems, so engineers opened and locked out the breaker on utility feed B and ran the site on one feed. When feed A failed at 06:53 BST on 20 October, the generators were never told to start, the batteries ran out at 07:00 and the zone lost power for an impact window of 6 hours 8 minutes².

VGoogle says the undervoltage sensing for the generator controls was wired upstream of the isolated feed B breaker. The sensors saw voltage on a path that was disconnected, and the logic, which did not check breaker position, concluded a healthy supply was available².

AEach system was protected well enough for the configuration it normally runs in. Each job created a different configuration, a stored parameter in one case and an open breaker in the other, and the protection went on reading signals that were only true for the normal state.

AIsolations, lockouts, temporary feeds and changed parameters are configurations the asset genuinely runs in, sometimes for days. They belong in the safety case as states with their own proof, and on the risk register with an owner and an end date.

AIndependent checks can share the blind spot. At Welshpool two separate means of correcting the distance existed and neither did. Return to service should confirm the values and positions the protection relies on, rather than infer them from the work order being closed.

VGoogle's own response points the same way: it is freezing planned maintenance at sites with similar layouts, adding elevated approvals for configuration changes outside standard designs, and validating the generator controls at those sites, with an estimate of 15 November².

AKIS PLUS LTD's view is that every maintenance plan should carry a protection check for two moments: the configuration the work creates, and the asset's return. The question is simple to put to any team: with this breaker open or this value changed, what will the protection read, and what will it do? Asset management systems already treat change as a risk to be assessed; routine maintenance is the change that happens most often.

INetwork Rail may find a specific cause in the component at Welshpool, and RAIB's earlier report on the same line suggests support systems deserve close attention¹. This article draws no conclusion on the component itself.

OUR PERSPECTIVE

The work changes the plant, and the protection has to be told.

1. For our most common isolations and adjustments, has anyone shown what the protection reads and does in that configuration?
2. On return to service, who confirms the stored values and positions our protection depends on, and where is the record?
3. Which of our independent checks would miss the same wrong value, and how would we know?