Google London data centre outage: faulty PLC config and generator failure

What happened

A power failure at Google's London data centre in October was caused by a faulty programmable logic controller (PLC) configuration, and the site's backup generators did not take over as expected, according to reporting by The Register.

The incident occurred while maintenance work had already reduced the facility's resilience. In a well-designed site, a loss of mains power is meant to be absorbed by generators. The reporting indicates that this safeguard did not operate in this case.

The Register frames the outage less as a single failed component than as a combination of a configuration error and planned work that had narrowed the margin for error. Coverage so far comes from this one outlet, so details such as duration and customer impact are not addressed here.

Why it matters

For organisations that run services on cloud infrastructure, the episode is a reminder that resilience depends on the whole chain: the control logic that manages power, the change process that touches it, and the backup systems meant to cover failure. A backup that has not been proven under real conditions is, in practice, only a design assumption.

Automation amplifies the risk. PLCs and similar control systems apply configuration quickly and at scale, so one faulty change can have consequences far beyond the team that made it. As more digital services depend on automated facility operations, leaders need to ask how changes are validated before they reach live infrastructure, and how periods of reduced resilience are governed. For customers, an outage at this layer is experienced as a service failure, whatever its technical origin.

The Renascence take

Most coverage of incidents like this will focus on the cause. The more useful lesson concerns the window in which the failure happened.

Most readers will fixate on the bad configuration, but the more telling failure is arguably the decision to run a site with reduced resilience and no margin for a single bad change. Resilience is a customer promise rather than a facilities metric: customers never see the PLC, they only see the service go dark. Behavioural economics would describe this as normalised risk, where teams stop treating a degraded state as a state at all. A customer-obsessed operator should treat every maintenance window as a planned outage risk, with explicit customer-impact reviews, pre-change validation of control logic, and regular failover tests that prove the generators actually start.