Andy Garcia · freelance dev
FRENES
Back to the blog
Energy

About 1,500 MW of Data Centers Left the Grid at Once. Their Own Protection Did It, Not the Grid's.

October 20, 2026 8 min read

At about 7:00 p.m. Eastern on July 10, 2024, a lightning arrester failed on a 230 kV transmission line in the Eastern Interconnection. A later draft from a NERC working group places the line in Dominion Energy's Virginia service territory. The fault was permanent, and the line's breakers did what they were configured to do: reopen, then try again, three times at each end, before locking the line out. That made six faults in 82 seconds. The protection system detected and cleared every one of them properly, the longest in 66 milliseconds.

In the same local area, about 1,500 MW of load vanished. None of it was disconnected by utility equipment, and the grid operators had not anticipated it. It was all data center load, taken off the grid by the customers' own protection and controls.

NERC, which writes and enforces grid reliability standards under FERC's oversight, published its incident review on January 8, 2025. On July 16, 2026, FERC ordered NERC to file the first mandatory standards for "computational loads" by December 31, 2026. On October 15, NERC announced that its proposed standards had passed their final industry ballot. In between, a bigger event hit the same region.

I read the incident review, the FERC order, the draft standards and the grid operator's slides on the July 2026 event. Apart from the hardware fault that started each event, none of them describes a protection failure. On the grid side, every fault was cleared as designed. On the customer side, in 2024, NERC traced most of the loss to a rule doing what it is built to do.

Six faults, three dips, one rule

Automatic reclosing is the grid's retry: if a fault was temporary, the line comes back by itself. During each of the six faults, voltage in the load area fell to between 0.25 and 0.40 per unit, a quarter to 40% of normal, for 42 to 66 milliseconds.

Data centers ride through dips like these on uninterruptible power supplies. NERC describes three designs: centralized UPS units of 2 to 5 MW, rack-level units of 3 to 4 kW, and diesel rotary UPS, a flywheel that carries the load while a diesel engine starts. Battery UPS hands the load back to the grid once voltage recovers. The rotary kind does not; transferring back is typically manual.

Then there is a rule on top of them. Discussions with the data center owners, NERC writes, identified a scheme that counts voltage disturbances. In NERC's words: "The typical number of voltage disturbances that trigger this scheme is three, and a typical time is one minute." Once triggered, the site moves to backup power and stays there until someone manually reconnects it.

Now the timestamps. The first dip came at 19:00:23.351. The instantaneous reclose at both ends caused the second at 19:00:23.883. The second reclose at one end caused the third at 19:00:39.211, 15.86 seconds after the first. Three dips in under 16 seconds, well inside a one-minute window.

At that third dip, about 1,260 MW dropped off the grid "and did not return for hours." NERC attributes most of the event's load loss to "the interaction between the automatic reclosing sequence" and the dip-counting scheme.

What the grid felt

When load disappears, generation briefly exceeds demand and frequency rises. With less current flowing through the lines, voltage rises too. Frequency peaked at 60.047 Hz and settled back in about four minutes. Voltage reached 1.07 per unit, 7% above nominal, and operators removed shunt capacitor banks to bring it down.

NERC is clear that neither level was a reliability risk this time. Its concern is scale: the grid "has historically been planned for large generation losses but not for such significant simultaneous load losses." It also flags the return trip: "Ramp rates for load connection are just as critical to system operations as generation ramping."

July 22, 2026: the same shape, bigger

At 07:56 on July 22, 2026, a 230 kV line faulted in the Dominion zone of PJM, the regional grid operator. Dominion's preliminary findings, presented to PJM's Operating Committee on August 6, say a sub-conductor pulled free from a compression sleeve, the apparent cause being overheating of the sleeve due to improperly torqued bolts. The fault and every reclose cleared in 2 to 3 cycles, about 33 to 50 milliseconds at 60 Hz. "All protection systems worked as designed, isolating the faulted line."

A first wave of about 2,970 MW moved to backup power. PJM's slide describes the next step: "The load transfer caused high voltage conditions and triggered the transfer of additional load to back-up generation." A second wave of 1,099 MW followed. PJM put the total at about 3,800 MW in August and at about 3,900 MW in its October 6 slides: either way, the largest load transfer it has experienced. Its system load fell from 99,984 MW to 96,205 MW, about 3.8%. Frequency reached 60.092 Hz. PJM brought its balancing error back within limits in 9 minutes, against a 30-minute requirement, and the load came back within 30 minutes.

These findings are preliminary, and the wave figures do not add up exactly to the total. Dominion's timeline places the first wave in the middle of the reclosing sequence. PJM calls the transfer "likely due to voltage ride-through performance"; the slides do not say a dip counter was involved. What they do show is a feedback loop: one group of sites protecting itself created the overvoltage that tripped the next group. "This was a normally cleared fault," said PJM Operating Committee chair Emanuel Bernabeu. "They should not disconnect from the grid."

What the first standards do, and what they leave out

FERC's order asks NERC for "essential actions" standards and registration criteria by December 31, 2026, and a workplan for a second phase by March 1, 2027, "with greater certainty than provided by voluntary timelines."

The package, whose final ballot closed on October 14, would create three new standards, CLO-001-1, CLO-002-1 and CLO-003-1, for sites of 50 MW or more connected at 100 kV or above. NERC's FAQ says it will seek its Board's approval in December, then file with FERC. CLO-001-1 makes the trip logic part of the planning model: modeling data must include "parameters, settings, and capabilities related to cessation, tripping, Ride-through, and post-Disturbance recovery," and owners must re-verify their models within 180 days of a hardware, software, firmware or setting change that alters the site's dynamic response. CLO-003-1 requires disturbance recorders at the site's main transformer, continuous recording sampled at least 960 times per second, and clocks within 1 millisecond of UTC. Existing sites get 36 months after the effective date for the recorders.

What the package does not set is an industry-wide minimum ride-through. NERC's FAQ says it "is not addressing any industry-wide, minimum voltage and frequency ride-through performance requirements." A draft request from NERC's Large Loads Working Group, posted for comment on August 26, proposes a performance envelope (for example, riding through at least 0.5 seconds at 0.5 to 0.8 per unit) and contains one sentence that reads like an answer to July 2024: a dip counter's "threshold should accommodate the automatic reclosing sequence expected on the transmission system serving the site." It also notes that sites on the same substation, hit by nearly identical dips, behaved differently, so planners "cannot presently predict how much load a credible fault will remove from service." NERC's Q3 update says the group planned to take a final version to NERC's committees on October 20 and 21; the words quoted here are from the August draft. PJM proposed its own ride-through requirements on September 8.

What I take from it

I do not design substations. As CTO of a LegalTech built on Claude, I ship software that depends on other people's services, and the shape is familiar. As an analogy only: reclosing is a retry policy, the dip counter is a client-side circuit breaker. Each is reasonable alone. Owned and tuned by different parties, the retry policy satisfied the breaker's trip condition in under 16 seconds, at every site that used it and saw the same dips.

What I would copy:

  1. Put the numbers side by side. Write each dependency's retry schedule next to your own trip threshold. The working group's draft asks for exactly that: size the counter to the reclosing sequence.
  2. Test the fleet, not the unit. NERC's May 4, 2026 alert asked planners to find the credible contingencies where the aggregate loss of computational load, customer-initiated included, would violate planning criteria. In software, replay a dependency's real failure sequence against all clients at once.
  3. Treat settings as code. CLO-001-1 treats a setting change like an equipment change. A timeout deserves the same review as a commit.
  4. Record at the boundary, on one clock. In 2024, the cause came out of discussions with data center owners. Synchronized recorders at the interface would let the next review check the sequence against data.
  5. Plan the return. Rotary UPS and dip counters typically need a manual transfer back, and NERC warns about reconnection ramps. Every client reconnecting at once is its own incident.

The evidence has limits. NERC's review names no operator and publishes no site's settings, and Dominion's 2026 findings are preliminary: its slides announced a formal root cause analysis for September 2026. PJM says the grid saw no significant reliability impacts on July 22, 2026. The risk is the trend: about 1,500 MW in July 2024, about 1,800 MW in February 2025 and about 3,900 MW in July 2026 by PJM's October count, and existing sites, not future ones, behind every documented event so far, according to the draft request.

The grid kept its promise to retry. The data centers kept their promise to protect themselves. Nobody on the grid side had anticipated what the two promises would do together.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk