You may have seen that
Ofgem have issued their final report on this event, and announced some voluntary fines to be paid by the operators of the two generators that disconnected and one
DNO▸ (UKPN, for reconnecting before being asked to). They seem uncertain whether they have a clear right to impose such fines, but a bit of arm-twisting of the emabarrassed has had the same effect.
Their analysis of what happened changes NGET's original story very little. However, some more poor performance has shown up in the operation of the low-frequency response process (LFDD). Not only did less than 5% of the load get shed, but two DNOs reconnected some load before
NG▸ told them to. LFDD disconnected some of the generators contracted to supply reserve power too, which was unintended. And the total of distributed generation lost in the event is now estimated at 1300-1500 MW (and the exact figure isn't knowable).
ORR» have also published
their report on ... well Siemens, mainly. They do document all the minor loss of power incidents too, none of which was serious.
The background at Siemens was much as reported earlier; a concern that some genuine failures produce a trip that could be reset and cause more damage led to some trip conditions being moved across to the list causing permanent lock-out. Low frequency was one of those, and should not have been. ORR's explantion is that, such events being rare, the risks of doing this were not considered - potentially the whole fleet could shut down out on the network and need a technician to attend.
Siemens admit this. A couple of quotes:
Most permanent lock-outs are triggered by events relating to the train itself, which are unlikely to arise simultaneously on multiple trains. Variations in the power supply frequency, however, affect many trains at the same time and result in the same response from all trains that have the same software. It appears therefore that the collective response of the Class 700 and 717 trains to the out-of-specification supply frequency was in accordance with the software design, but was not an explicit intention. Siemens accepts that the temporary reduction in frequency should not have been considered a situation that requires a permanent lock-out.
In an interim email to ORR, Siemens stated, “The original design of the class 700 is for the 4QCs to stop pulsing when the line frequency is out of range and automatically restart when the frequency come back in range. This does not require driver action. With the hysteresis implemented, the 4QCs lock when line frequency drops below 49Hz and they restart when the frequency rises above 49.5Hz.”