0% found this document useful (0 votes)
5K views75 pages

Kelly Review Report May 2025

The Kelly Review Report investigates the closure of Heathrow Airport on March 21, 2025, due to a fire at a nearby electricity substation, which caused significant disruption for approximately 200,000 passengers. The report concludes that while Heathrow's response was effective in ensuring safety and restoring operations, there were opportunities for improvement in preparedness and resilience against such incidents. Recommendations include enhancing power supply resilience and better engagement with stakeholders to address future risks.

Uploaded by

max
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
5K views75 pages

Kelly Review Report May 2025

The Kelly Review Report investigates the closure of Heathrow Airport on March 21, 2025, due to a fire at a nearby electricity substation, which caused significant disruption for approximately 200,000 passengers. The report concludes that while Heathrow's response was effective in ensuring safety and restoring operations, there were opportunities for improvement in preparedness and resilience against such incidents. Recommendations include enhancing power supply resilience and better engagement with stakeholders to address future risks.

Uploaded by

max
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 75

Kelly Review Report

Heathrow Airport Holdings Limited

Kelly Review into the circumstances related to the closure of Heathrow


Airport on 21 March 2025

May 2025

1
Kelly Review Report

TABLE OF CONTENTS

INTRODUCTION BY RUTH KELLY……………………………………………………………………………….…3

EXECUTIVE SUMMARY…………………………………………………………………………………………….…5

SECTION 1 – INTRODUCTION……………………………………………………………………………………….8

SECTION 2 - CHRONOLOGY OF EVENTS…………………………………………………………………...…..10

SECTION 3 – CONTEXTUAL MATTERS……………………………………………………………………………16

SECTION 4 – ISSUES DURING THE EVENT………………………………………………………………………26

SECTION 5 – HEATHROW’S PREPAREDNESS FOR THE INCIDENT…………………………………………50

CONCLUSION………………………………………………………………………………………………………….63

APPENDIX 1 – SUMMARY OF KEY FINDINGS AND RECOMMENDATIONS………………………………..64

APPENDIX 2 – GLOSSARY…………………………………………………………………………………………..70

APPENDIX 3 – TERMS OF REFERENCE…………………………………………………………………………..72

APPENDIX 4 – REVIEW COMMITTEE BIOGRAPHIES……………………………………………………….….74

APPENDIX 5 - RESERVED MATTERS……………………………………………………………………..………75

2
Kelly Review Report

1. INTRODUCTION BY RUTH KELLY

The fire at North Hyde and closure of Heathrow

In the late evening of Thursday 20 March 2025, a fire started at a National Grid 275kV High
Voltage electricity substation, which supplied a nearby 66kV substation operated by SSEN,1
in North Hyde in West London, outside but close to the perimeter of Heathrow Airport.

The National Grid 275kV substation contained three supergrid transformers,2 two of which
we have subsequently learned were either completely destroyed by the fire or so badly
damaged that their repair will take many months. We have also learnt that the third
transformer’s connection was also temporarily lost to the transmission network because it
had been connected to the same circuit as one of other transformers directly impacted by
the fire.3

The incident at the National Grid substation was unprecedented. The Chief Executive of
National Grid stated after the event that they could not remember a transformer failing like
this in his 30-plus years in the industry and described a fire taking out an entire substation
as incredibly rare.

The overriding objective of the Heathrow teams responding to the outage was to ensure the
safety of everyone affected by the power loss at Heathrow and this was achieved. But
significant disruption was experienced by approximately 200,000 passengers, including
those planning to depart from Heathrow on Friday 21 March and those who were already
travelling to Heathrow on long haul flights, which had to be diverted. There were many
other impacts too, not least financial losses caused to airlines and other businesses within
Team Heathrow who operate at the Airport and to the Airport itself.

In the aftermath of the outage, Heathrow Airport Holdings Limited commissioned this review
to establish a clear, fact-based account of what occurred, assess the response, and identify
what lessons must be learned. Our objective has been to establish a robust timeline of
events and to conduct a rigorous evaluation of decision-making processes, communication
strategies and governance structures relevant to the incident, as well as Heathrow’s
preparedness for an event of this kind.

1
Scottish and Southern Electricity Networks.
2
These transformers have been referred to as SGT 1, SGT 2 and SGT 3 in the North Hyde Review Interim Report, of the
National Energy System Operator (“NESO”), dated 6 May 2025 (“Interim NESO Report”)
3
Interim NESO Report, para 5.11

3
Kelly Review Report

This report sets out our findings and provides a series of recommendations intended to
strengthen the Airport’s resilience and its ability to respond effectively to future incidents. It
is essential that Heathrow remains one of the most reliable and trusted transport hubs in
the world, and that passengers, staff, and stakeholders can be confident in its ability to
operate safely and securely and to respond effectively to challenges such as this one.

We have marked in the Report where matters are reserved (because they contain
information within them that might present security risks to Heathrow or others if published).
We have kept these reserved sections to a minimum. We understand these reserved
matters will be discussed in full with Heathrow’s regulator the Civil Aviation Authority and
key public bodies, including the Department for Transport and NESO.

Acknowledgements

I would like to thank all Heathrow colleagues who were interviewed and helped us during
the Review to gather facts and provide us with their suggestions on areas for improvement.
Those suggestions have informed our recommendations.

I would also like to thank my fellow Review Committee members and independent non-
executive board members of Heathrow Airport Holdings Limited, Joan MacNaughton and
Mark Brooker, for their insights and depth of contribution throughout this process - from the
questions they posed in the fact-finding, constructive challenges they have raised to test
initial findings, through to their help forming the conclusions we have jointly reached.

We would also like to extend our collective thanks to our external lawyers Pinsent Masons
LLP and in-house legal colleagues who aided us in this review.

Ruth Kelly

Chair, Kelly Review Committee of Heathrow Airport Holdings Limited Board

Independent Non-Executive Board Member

May 2025

4
Kelly Review Report

2. EXECUTIVE SUMMARY

2.1 Our central conclusions about the incident

2.2 We have reached the following conclusions about the events on 21 March 2025:

2.2.1 The decision taken by the Airport, approximately 90 minutes after the power outage, to stop
operations immediately was correctly made and essential to protect the safety and security
of people, as well as the integrity of the Airport and the UK border.

2.2.2 In the early hours of 21 March, it was also reasonable to decide to stop operations until
23:59 that day, especially as decision-makers had in mind that if operations at the Airport
could safely resume sooner, the timetable could be brought forward – as in fact did happen.

2.2.3 After consultation with airlines, Heathrow began accepting limited types of flight arrivals
from 16:00 into select terminals and permitted a limited number of departures from 20:00.
It then reopened fully on 22 March 2025. There may have been opportunities to open parts
of the Airport slightly sooner (but for limited operations only) than in fact occurred on 21
March. This likely would have been only by a maximum of a couple of hours or so because
of the time needed for critical systems to be checked and confirmed as operational after
power was restored.

2.2.4 The timing and extent of reopening on 21 March was impacted by other highly relevant
factors running in parallel throughout that day. Principally, these related to whether it would
be possible for the Airport to restore connection to a resilient supply of power from North
Hyde during that day (so the Airport could return to its original three electricity supply
points), while not jeopardising a full resumption of operations the next day, 22 March.
Although the decision to attempt to restore such a connection may have extended the time
in which operations were stopped, this was the correct decision.

2.2.5 Due to the challenging nature of recommencing a full flight schedule in the course of the
day, we do not consider an earlier reopening of parts of the Airport would have had a
significant impact on passenger disruption. The vast majority of flight cancellations and the
impact to passengers would likely still have occurred.

2.3 Preparedness and resilience

2.4 On the question of whether Heathrow was adequately prepared, we have concluded that:

2.4.1 There was a well-established Command & Control structure for major incidents which
overall worked well. We have made a number of recommendations on opportunities for
improvements. They would not have altered the outcomes for this incident, whether to
prevent the closure or enable the Airport to restart its operations sooner.

2.4.2 There were a large number of pre-prepared contingency plans which were used in the
response and sped up the return to full recovery.

2.4.3 There was a strong organisation-wide response and team effort, which assembled highly
competent personnel to tackle complex technical and operational challenges posed by the
power outage.

(a) Leadership gave important strategic direction at the right times and Heathrow’s
incident response teams were enabled, expert and well-drilled, prioritising
passenger and colleague safety at all times.

(b) Although there was very significant disruption caused by the power outage on 21
March, Heathrow’s response collectively delivered outcomes which enabled

5
Kelly Review Report

operations to resume efficiently and smoothly in what were unprecedented


circumstances.

2.5 We have made several recommendations designed to facilitate maximum effectiveness in


responding to future disruptive events, including those relating to power supply to the Airport.

2.6 On whether the Airport should have anticipated the incident better, we have considered aspects of
the Airport’s High Voltage electricity resilience in outline. We recommend further work in this area.

2.7 We make the following initial observations in that context:

2.7.1 Heathrow had assessed its High Voltage electricity supply as resilient due to it having three
separate intakes from the National Grid, all with multiple connections to the Airport and
multiple transformers at the National Grid/SSEN substations providing redundancy in the
event of failure. Heathrow therefore viewed this type of power outage (entire loss of power
from one intake) as a low likelihood event for the purposes of its risk assessment.

2.7.2 It was known within Heathrow at a technical level that the structure of the Airport’s own
internal High Voltage electricity network meant that loss of power from one intake would
result in a suspension of operations for a significant period (for at least eight hours) while
the internal network was reconfigured to run the Airport using the two remaining intakes.
This is a result of the way the infrastructure at the Airport has been developed over 75
years. There is no immediate fix to this problem, in part because the Airport is operating at
full capacity with only limited operational overnight windows (about six hours) to carry out
works to improve resilience and within a highly constrained footprint.

2.7.3 Whilst the overall risk of a loss of supply had been appropriately understood, details about
the length of the possible outage and precise impact on systems in this scenario were less
well-known by those outside the technical team. Enhancements to processes are already
underway so that low likelihood but high impact risks of this kind can be subject to increased
oversight by functions and leadership.

2.7.4 We have noted that investments relating to resilience of assets, infrastructure and power
at the Airport are regularly part of larger programmes of work (for example, to reduce fossil
fuel usage or to expand capacity). Prior to the incident, projects had commenced, which
are ongoing, that will increase the resilience of High Voltage electricity supply at the Airport.
We have not found evidence of any recent investment proposals specifically relating to
electrical power resilience being declined by the Airport.

2.7.5 Certain programmes that would have included elements to improve resilience of electricity
supply have been delayed (most notably Airport expansion and certain projects impacted
by the COVID-19 pandemic).

2.7.6 Based on the evidence we have been able to consider in this Review, none of these
delayed programmes would have avoided the need to close Airport operations for a period
of time on 21 March.

2.7.7 Heathrow has identified the need to develop at a system / subsystem level five-to-seven
year masterplans for critical utilities, including power, in a model which does not depend
on further significant infrastructure developments.

2.7.8 We recommend a detailed review of opportunities to invest in areas that would further
shorten the time for recovery from a critical incident of this type. This should include a
review into whether there are additional sources of backup power that can be
proportionately retrofitted into an airport like Heathrow in the short to medium term as well
as part of longer-term strategies for energy resilience, growth and net zero.

6
Kelly Review Report

2.7.9 We also recommend that Heathrow prioritises its engagement with its airline partners and
the CAA and other stakeholders around the need for investment in resilience, so that a
shared understanding can be reached on this topic as soon as possible, taking account of
the features of the Airport’s current infrastructure assets, its location and intensity of
operations as well as the various legitimate but competing needs for further investment.

7
Kelly Review Report

SECTION 1 – INTRODUCTION

3. PURPOSE OF REVIEW AND TERMS OF REFERENCE

3.1 When confirming the launch of the Kelly Review process into closure of the Airport on 21 March,
Heathrow Chairman Lord Paul Deighton said:

“To fully understand what happened, I have asked Ruth Kelly, former Secretary of State for
Transport and an independent member of Heathrow’s Board, to undertake a review. The
Kelly Review will analyse all of the relevant material concerning the robustness and
execution of Heathrow’s crisis management plans, the airport’s response during the
incident and how the airport recovered the operation with the objective of identifying any
improvements that could be made to our future resilience.”

3.2 On 27 March 2025, the Board of Heathrow Airport Holdings Limited (“HAHL”) agreed Terms of
Reference for the Review. Following this, these were supplied to the House of Commons Transport
Select Committee, the Civil Aviation Authority, the Department for Transport and NESO.4

3.3 The Terms of Reference were published on Heathrow’s website on 10 April 2025 and can be found
at Appendix 3.

4. PROCESS OF REVIEW

4.1 Review Committee

4.2 The biographies of the Review Committee have been set out in Appendix 4. The Review Committee
members are all Independent Non-Executive Directors of HAHL.

4.3 Evidence received during Review

4.4 Contemporaneous and other relevant data was requested by the Review Committee from Heathrow,
which was reviewed by the Review Committee.

4.5 Over the period 2 April 2025 to 17 April 2025, Pinsent Masons LLP (“Pinsent Masons”), engaged
as external lawyers to assist the Review, held an initial round of information gathering discussions
with multiple Heathrow employees, who provided information about Heathrow’s systems and
processes and about Heathrow’s response to the power outage. Pinsent Masons then held follow-
up meetings with a number of those Heathrow employees to gain additional information. Pinsent
Masons provided detailed feedback from those meetings directly to the Review Committee.

4.6 Ruth Kelly and other members of the Review Committee met with several key Heathrow employees
over the period 28 April 2025 to 2 May 2025 with Pinsent Masons.

4.7 In addition, Pinsent Masons and the Review Committee have considered a substantial amount of
documentation relevant to the incident and the Chair of the Committee and Pinsent Masons visited
the relevant operational sites.

4.8 In accordance with the annex to the Terms of Reference, the personal details of the Heathrow
employees who were involved in the incident response and who spoke to the Review will not be
published in this Report. The exceptions to this are the Chief Executive Officer Thomas Woldbye
and the Chief Operating Officer Javier Echave, who cannot be anonymised due to the relevance of
their roles. We appreciate their willingness to be named in this Report, given the high-profile nature
of the incident and its aftermath.

4
National Energy System Operator, established under the Energy Act 2023

8
Kelly Review Report

4.9 A summary of our key findings and our recommendations is included as Appendix 1.

4.10 A glossary of terms used in this Report is included in Appendix 2.

9
Kelly Review Report

SECTION 2 – CHRONOLOGY OF EVENTS

5. SUMMARY OF EVENTS OF 20 – 22 MARCH 2025

5.1 We have set out below a detailed chronology of the events of 20 – 22 March from the point of the
fire to Heathrow’s full recovery of operations. In summary:

5.1.1 During the half hour period between the power outage being identified and the decision to
activate the Command & Control structure, the Duty Airport Operations Manager (“AOM”)
coordinated with Heathrow specialists in the Airport Operations Control Centre (“APOC”)
and across the Airport to gather the necessary information to build situational awareness,
essential to managing the critical incident. The Duty AOM also coordinated with emergency
services, including Aviation Police and the London Fire Brigade. This enabled the Duty
AOM, and shortly afterwards, the Chief Operating Officer, to make a thorough assessment
of the risks to safety and security, based on the information known at the time.

5.1.2 The decision at approximately 01:15 to stop operations at the Airport until 23:59 on 21
March 2025 was made on the basis that Heathrow did not have confidence that the Airport
could be operated safely and securely and the security of the border maintained. Heathrow
engineers then worked to reconfigure Heathrow’s power supply network so that the
remaining two High Voltage supply points powered the parts of the Airport that had lost
power from Intake A (the intake in Heathrow’s network that is connected to North Hyde).5
This was a complex process requiring many hours of work. Once power was restored,
Heathrow’s systems had to be brought online in a controlled manner (to prevent further
local outages) and then tested. The critical systems were confirmed as tested and validated
in Terminals 3 and 5 by 13:00 and in Terminal 4 by 17:00.6 Terminal 2 returned to
operations by the start of the following day.

5.1.3 The resumption of operations on 21 March occurred in three distinct phases (in consultation
with airlines):

(a) From 16:00 Heathrow opened for repositioning of aircraft (crew members only)
so that aircraft could be in the correct positions when the Airport expected to open
fully on 22 March.

(b) From 18:00, Heathrow opened for repatriation flights (crew and passengers) so
that previously diverted aircraft could land at Heathrow and disembark
passengers and unload baggage.

(c) From 20:00, Heathrow opened for a small number of flight departures facilitated
by the Airport in coordination with airlines.

5.1.4 In parallel, other work progressed which was designed to restore equivalent levels of
resilience in the High Voltage power supply to the Airport as it had had prior to the fire at
North Hyde. At 13:15, based on information from SSEN, which Heathrow’s engineers
assessed as meaning that a resilient power supply was again available at North Hyde,
Heathrow decided to reconfigure its network back to the three-supply configuration. Having
made this decision, Heathrow began the complex process of reconfiguring its network
again. However, at approximately 22:00 on 21 March, Heathrow received additional
information from SSEN that led Heathrow’s engineers to assess that the North Hyde supply
was not in fact resilient, contrary to Heathrow’s earlier understanding. Heathrow therefore
cancelled the plan to switch back the supplies. For the remainder of 21 March and through

5
Further explanation of this can be found at paragraphs 8.3 - 8.7.
6
Heathrow’s Terminal 1 has been permanently closed to passengers since 2015 and has been used since then as a facility to
warehouse the baggage system that serves the Terminal 2 operation. More information about the terminals is below at
paragraph 7.7.

10
Kelly Review Report

the night of 22 March, the Airport prepared for full operations starting at 04:30 on 22 March,
on the basis of power being supplied by its two other High Voltage sources.

5.2 Throughout the incident, Heathrow decision-makers set the following objectives which the Review
was told guided their response:

5.2.1 ensuring people, colleagues and staff are safe and secure;

5.2.2 ensuring that the environment and assets are safe, including integrity of the UK Border;

5.2.3 minimising disruption to passengers;

5.2.4 being in operation by opening time at 04:30 on 22 March; and

5.2.5 resuming operations earlier than that on 21 March if possible.

5.3 Having partially resumed operations on 21 March, Heathrow fully opened on 22 March at 04:30 with
all terminals in operation.

6. THE INITIAL RESPONSE AND CHRONOLOGY OF LATER KEY EVENTS

6.1.1 20 March 2025, 23:40 – Fire first identified by Heathrow – members of the Heathrow
team in APOC first saw the fire on CCTV. The fire was not on the Heathrow site, but at
this time its precise location was not known.

6.1.2 20 March 2025, 23:55 to 21 March 2025, 00:21 – Multiple systems lose power – the
Duty AOM, located in APOC, received reports that multiple systems had lost power. It was
not known at this time that the fire had caused the power outage. The systems reported
as lost or running on back-up power included:

(a) Critical safety systems. For security reasons we have not specified the details of
these systems in the unreserved sections of this Report, which can be found in
Reserved Appendix 5. Using the anonymised names given in the Reserved
Appendix, the critical safety systems that were identified as having lost power at
this time were: Critical Safety Systems 1, 2, 3 and 4.

(b) Loss of lights in Terminal 4;

(c) Loss of power to the majority of the Central Terminal Area, including Location A7
which houses critical communications servers for safety systems and also the
back-up control room;

(d) Loss of power to traffic lights around the Airport;

(e) Loss of critical safety systems in the main vehicle tunnel (Tunnel Critical Safety
Systems);8

(f) The Air Traffic Control Tower and runway lights were operational but running on
back-up supply (and as such would enable emergency landings);

(g) The Airside Operations Facility had lost power but was running on back-up
supply;

(h) Fire East, one of two fire stations at the Airport, did not have power. This would
not impact the ability of the Airport to land aircraft in emergencies (because of the
7
The name of this location has been reserved for security purposes.
8
The details of these systems have been reserved for security purposes.

11
Kelly Review Report

other airside fire station) but immediately reduced the Airport’s ability to run full
operations;

(i) The baggage systems were not powered in Terminals 2 or 4, but at this time the
baggage systems were powered in Terminals 3 and 5.

The Duty AOM immediately identified contingency plans that needed to be put in place to
mitigate the risks from the systems that had been lost.

The Duty AOM was shortly afterwards informed by the Aviation Police that the London Fire
Brigade had declared a major incident in relation to a substation in Hayes. The Duty AOM
was told that London Fire Brigade estimated it would be six hours before they could tackle
the fire, as the electrics at the substation needed to be isolated first. The Duty AOM was
informed that circa 70,000 homes were affected, as well as hospitals.

The Duty AOM liaised with the ACE (the Airport Control Engineer) about the substation fire.
At this point, the engineers began to assess what they needed to do to reconfigure
Heathrow’s power network. The timescale they gave the Duty AOM at this point was a
minimum of two hours until power was back.

The Duty AOM liaised with the Airfield Duty Manager, who provided a status update on
airfield systems. The Duty AOM also received updates from the Security Operations
Manager regarding systems that had been affected and the contingencies they had put in
place.

6.1.3 21 March 2025, 00:03 – Heathrow makes first contact with SSEN – the Heathrow
Engineering Team called SSEN, who reported that they had lost the whole of North Hyde.
SSEN said they had heard reports of a fire and Heathrow informed SSEN that it could see
the fire on the CCTV.

6.1.4 21 March 2025, 00:13 – AOM receives update on critical systems - at 00:13, with a
member of the Aviation Police now co-located in APOC, the Duty AOM held a meeting with
those in APOC to receive a situation report on the status of systems and contingencies. At
this time, it was still estimated to be six hours before London Fire Brigade could start to
tackle the fire, critical safety systems had been lost (including Critical Safety System 2,
Critical Safety System 1, Critical Safety System 4, and Critical Safety System 5), and
certain buildings including Location A (which, as noted above, houses critical servers),
Airfield Operations Facility9 and Fire East (one of two fire stations at the Airport) did not
have power. The traffic lights around the Airport had also been affected. Terminals 2 and
4 had also lost power to their baggage systems.

6.1.5 21 March 2025, 00:21 – Command & Control (Silver and Bronze) activated – the Duty
AOM activated the Command & Control structure at this time by activating the F24 alarm
system. This activates Silver Command and Gold Command is placed on standby. See
paragraphs 9.1 - 9.10 for details of the Command & Control structure.

Following the issuing of the F24 notification, the Duty AOM spoke to the Silver Commander
and a senior member of the Operations team to update them on the situation.

Heathrow’s Aircraft Flow Manager also spoke to air traffic control services about the impact
if Heathrow had to stop operations. The view reported from air traffic control services was
that if Heathrow was going to make the decision not to accept arrivals, it would need to do
so sooner rather than later in order to give long-haul flights a chance to divert.

9
Further details relating to this location have been reserved for security purposes.

12
Kelly Review Report

6.1.6 21 March 2025, 00:30 – AOM receives further update - the Duty AOM received a further
update from Heathrow teams that Fire East, Airfield Ops, Terminal 2 and Terminal 4 were
without power.

6.1.7 21 March 2025, 01:08 – COO arrives at Heathrow - the COO arrived at Heathrow, having
been notified of the incident by the F24 alarm system.

6.1.8 21 March 2025, about 01:15 – Meeting starts during which the decision is made to
stop Airport operations until 23:59 – a call was held with senior individuals, including the
COO of Heathrow. The COO received a situational report from the Duty AOM. The Duty
AOM (1) [part of this sentence has been reserved for security purposes] and (2) considered
that Heathrow could not safely operate for passengers and colleagues. It was reported in
this meeting that Terminals 2 and 4 were without power, and Terminals 3 and 5 were
powered but certain Airport-wide critical safety systems had lost power. Based on this
information, the COO determined that he did not have confidence that he could operate a
safe and secure Airport. The COO decided to stop operations until 23:59 on 21 March
2025.

6.1.9 21 March 2025, 01:44 - Notice to Aviation issued – Notice to Aviation (“NOTAM”) was
issued, confirming operations at Heathrow suspended until 23:59. Via Air Traffic Control,
this NOTAM has the effect, amongst other things, of alerting aircraft already travelling to
Heathrow that the Airport has suspended its operations.

6.1.10 21 March 2025, 01:52 – Gold Command activated – Gold Command was activated via
F24 notification.

6.1.11 21 March 2025, 02:14 – Heathrow issues first media statement – Heathrow issued a
media statement confirming that it was experiencing a significant power outage across the
airport. The statement confirmed that the Airport was closed until 23:59 on 21 March.

6.1.12 21 March 2025, 02:41 – 06:25 – Engineering team undertake plan to switch over
power supply from the Intake A substation (where outage has occurred from
National Grid, via SSEN substation) – having developed a switching schedule to
reconfigure the network from the Intake A to the other two supplies to the Airport, the
Engineering team undertook the required switching activities with the support of UK Power
Network Services (“UKPNS”), Heathrow’s private network service provider contracted to
maintain Heathrow’s internal High Voltage electricity distribution network (who were
already on site for other purposes). These switching activities are described in further detail
below at paragraphs 8.13- 8.19. The Engineering team’s actions were based on existing
contingency plans and switching schedules in the event of power loss.

6.1.13 21 March 2025 – 07:43 – Engineering team commence reconfiguring and re-
energising of wider Heathrow network - this involved controlled re-energising of 11kV
and other lower voltage substations.

6.1.14 21 March 2025, about 09:00 to 10:56 – Power to Terminals 2 and 4 restored – the
power was restored to Terminals 2 and 4 as a result of the switching being completed. The
Engineering and IT teams then proceeded to systematically check systems.

6.1.15 21 March 2025, 10:00 to 12:31 - SSEN informs Heathrow it can return to North Hyde
supply – at 10:00 SSEN called Heathrow engineers to inform Heathrow that SSEN was
ready to put Heathrow back on its regular supply. SSEN said it had two transformers
available. At 12:31 SSEN confirmed that North Hyde was being fed by a substation at Iver,
at which there were four transformers available. SSEN confirmed there were no single
points of failure with this supply or capacity issues. Reconnecting to North Hyde would
now require Heathrow to reconfigure its internal network, effectively reversing the process
described above at paragraph 6.1.12.

13
Kelly Review Report

6.1.16 21 March 2025, 13:00 – Critical safety systems restored in Terminals 3 and 5 – at this
time, checks of Critical Safety Systems 2, 3 and 4 were completed, with critical systems
established in Terminals 3 and 5. This enabled decisions at 13:15 to allow repositioning
flights to start from 16:00.

6.1.17 21 March 2025, 13:15 – Decision made to reconfigure network back to three supplies
/ Confirmation that critical systems in Terminals 3 and 5 are operational – following
discussions between senior leadership and the Engineering team and a Gold Command
call, the decision was made to reconfigure the network back to Intake A to achieve a
business-as-usual state. At this time, it was estimated this would take 10 – 12 hours.
Separately, on this call it was confirmed that critical systems were operational in Terminals
3 and 5. The systems were still coming back on in Terminals 2 and 4. It was estimated
that repositioning flights could start from 16:00.

6.1.18 21 March 2025, 14:00 – Community Call10 confirms partial reopening of Terminals 3
and 5 – at the Community Call, Heathrow confirmed that repositioning flights would begin
from Terminals 3 and 5 from 16:00 and repatriation flights would be accepted from 18:00.
At this time, Heathrow stated there would be no departure flights on 21 March. Heathrow
confirmed it was planning full operations for 22 March.

6.1.19 21 March 2025, 14:30 – BA requests slots for eight departures post 20:00 - Heathrow
began to communicate with British Airways regarding the possibility of those flights
departing and further assessments are carried out by the Command & Control team.

6.1.20 21 March 2025, 16:30 – Confirmation provided to Gold Command that Terminal 5 will
be open for passengers at 17:00 – to allow for the 20:00-onwards departures.

6.1.21 21 March 2025, 17:00 – Terminal 4 confirmed as operational – on Community Call,


Terminal 4 was confirmed as able to be operated safely to receive repatriation arrivals.
Heathrow also confirmed on this call that eight departure flights would be operated from
20:00.

6.1.22 21 March 2025, 18:01 – First repositioning flight lands at Heathrow – the first
repositioning flight landed at this time (Heathrow having reopened for repositioning flights
at 16:00).

6.1.23 21 March 2025, 20:00 – Departures from Terminal 5 – the first of eight departures with
passengers began from Terminal 5.

6.1.24 21 March 2025, 21:52 to 21:58 – Heathrow seeks and is given further information
from SSEN regarding resilience of supply available - the Engineering team called SSEN
to inform them that they were going to start reconfiguring their network to reconnect to
Intake A (having spent the time since the decision was made at 13:15 undertaking the
preparations for this). On this call SSEN advised they were about to carry out switching
activities with the National Grid. SSEN informed Heathrow that the Iver supply would not
be available until 22 March and the supply from North Hyde would be from a single
transformer (and therefore a single point of failure) until the following morning. As noted
below, following this, the Engineering team and Silver Command concluded at 22:30 that
this single transformer did not provide a resilient power option for the Airport to restore its
Intake A supply.

6.1.25 21 March 2025, 22:19 – First repatriation flight lands at Heathrow – having reopened
for repatriation flights from 18:00, the first repatriation flight landed at this time. The three
repatriation flights that arrived at Heathrow were processed through Terminal 4.

10
See paragraph 17.16.

14
Kelly Review Report

6.1.26 21 March 2025, 22:30 – Decision made to stay on two-supply configuration – based
on the information from SSEN provided at 21:58, Engineering team concluded that North
Hyde was not a sufficiently resilient supply and the decision was made to remain with the
two-supply configuration.

6.1.27 22 March 2025, 04:30 – All Heathrow terminals operational – all Heathrow terminals
were open and fully operational.

15
Kelly Review Report

SECTION 3 – CONTEXTUAL MATTERS

7. POWER IN THE CONTEXT OF THE OPERATIONS OF AN AIRPORT

Overview of Heathrow

7.1 A number of Heathrow employees referred to Heathrow as a small city. Heathrow is the UK’s only
hub airport and in 2024 was the most connected airport in the world.11 It has two runways, which are
the busiest in the world. As a hub airport, Heathrow combines direct passengers, transfer
passengers and freight to enable long-haul aircraft to fly to destinations all over the world. Heathrow
is the busiest passenger airport in Europe and the fifth busiest airport globally.

7.2 Heathrow is regulated by the Civil Aviation Authority (“CAA”) under the Civil Aviation Act 2012.
Under this regime, the CAA establishes what the Airport can charge per passenger and the Airport’s
capital expenditure is agreed on a periodic basis through a process involving both the CAA and
airlines. Capital projects are also subject to extensive scrutiny and controls by both airlines and the
CAA. Additionally, the CAA also sets service quality standards that Heathrow must meet.

7.3 In 2024 a record 83.9 million passengers used Heathrow Airport. Heathrow typically operates
approximately 1,300 flights per day and welcomes approximately 200,000 passengers per day.

7.4 Heathrow is not only a hub for passengers. It is also the largest UK port by value with 1.6 million
tonnes of cargo valued at over £215 billion passing through it in 2024.

7.5 Despite the significance of these operations, Heathrow operates on a relatively small geographic
footprint, compared to other airports. In total, Heathrow is 12.3 square kilometres in size, having
gradually expanded over the last 75 years.

7.6 Heathrow works with a number of partners and stakeholders to deliver the full functionality of the
Airport, as illustrated in the diagram below in respect of a passenger journey through a terminal:

Diagram 1

7.7 Heathrow has four operational terminals:

7.7.1 Terminal 2 was opened in 2014. It measures 40,000 square metres.

7.7.2 Terminal 3 was opened in 1961. It measures 98,962 square metres.

11
According to OAG Megahubs Index 2024, as reported in Heathrow’s annual report 2024.

16
Kelly Review Report

7.7.3 Terminal 4 was opened in 1986 and underwent a major refurbishment in 2009. It measures
105,481 square metres.

7.7.4 Terminal 5 opened in 2008. It measures 353,020 square metres.

7.8 There are multiple ways for passengers to access the Heathrow terminals, including via the Heathrow
Express and the London Underground, and via a road tunnel to the Central Terminal Area for
Terminals 2 and 3. For periods during the incident response the Heathrow Express was limited to
Heathrow staff only. Heathrow also worked with the police to put road closures in place to prevent
people coming to the Airport, including via the M4 spur. Power to the CTA tunnel was also critical to
be re-established safely and resiliently before Terminals 2 and 3 could be fully operational.

7.9 Heathrow operates two parallel runways. These are generally operated so that arriving aircraft are
allocated to one runway and departing aircraft to the other. Heathrow’s Long-Term Growth
Programme includes a third runway.

7.10 As Heathrow has grown gradually over the last 75 years, so has its IT infrastructure. Today, for
example, there are approximately 1,250 data centres and Network Node locations at Heathrow.

Heathrow’s safety culture

7.11 Heathrow has a very well-developed specialist safety function. Over a number of years, that function
has provided a second line of support to those in operational roles on safety issues. During the
incident, members of the safety team were also members of incident response teams so could
provide specialist input on safety topics if needed.

7.12 Heathrow measures its safety culture in a number of ways. It works with an external organisation,
Safe365, to measure its scores against a Safety Culture Index and the safety team has promoted
the adoption of this measurement tool to Team Heathrow partners (i.e. those operating at the Airport
who are not directly employed by Heathrow). Heathrow’s own most recent score exceeds industry
comparators. A separate recent external audit under ISO 45001:2018 (the international standard for
occupational health and safety management systems) concluded that the Airport “once again
confirmed its position as a best-in-class organisation, demonstrating an unwavering commitment to
occupational health and safety excellence”. The audit also recognised a culture of continual
improvement in a safety context.

Safety systems for operation

7.13 During the Review, we have heard from Heathrow employees about various different modes in which
an airport can operate safely. There are contingency plans to enable the Airport to close safely (e.g.
evacuation plans), as well as to enable limited operations, such as to allow aircraft to land on the
airfield. Different levels of safeguarding are required depending on the mode of operation the Airport
wishes to achieve. In relation to the different modes of operation over 21 – 22 March 2025 (discussed
below at paragraph 13.8) the following considerations for safety systems apply:

7.13.1 Repositioning flights - this is a process to enable aircraft to move their locations so that
they are in the right place for the start of their schedules the next day. It requires fewer
systems to operate safely because it does not involve passengers, only air crew. By
reference to Diagram 2 below, it requires safety systems for some but not all of the
processes running across the bottom of the diagram.

7.13.2 Repatriation flights - these enable the return of passengers to Heathrow following
diversions to other airports and need safety systems in operation across the whole of the
bottom of the diagram.

7.13.3 Full operations – this requires safety systems to operate across the whole of the diagram.
Heathrow personnel will also assess wider considerations. For example, in the early hours

17
Kelly Review Report

of 21 March, traffic lights on roads used to travel to and from the Airport were not working
because of the North Hyde power outage affecting the surrounding area. Even if the Airport
had retained full power, this would have affected safety considerations about whether full
operations were possible to commence on the morning of 21 March.

7.14 As discussed in further detail below, North Hyde powered a number of these critical safety systems
across multiple terminals, impacting the time it took to open any mode of operation at terminals which
otherwise had power.

Diagram 2

7.15 There are multiple logistics considerations to reopening the Airport. When full power was restored
during the course of 21 March 2025, safe processes needed to be adopted to enable critical people
for the Airport’s functioning to return to relevant parts of terminals or elsewhere on the Airport campus
– for example: ground handlers, security staff, baggage handlers and others – many of whom had
either previously been evacuated from facilities or advised to stay at home until they received
instructions to attend work. The Review has concluded that this inevitably extended the period
between the point power was restored to a terminal (or its safety systems) and it being possible to
operate safely.

Type of Aircraft Movements at Heathrow

7.16 The below diagram shows how Heathrow compared in 2024 with other international airports in
relation to its ratio of long-haul flights (in Diagram 3 below, “LH”) to its short-haul (“SH”) operations.
Long-haul flights are categorised as those over 6 hours.

7.17 37% of Heathrow’s flights are long-haul. Operationally this means decisions need to be taken with
sufficient certainty about how well the Airport will function many hours ahead. The risk of projecting
the safe reopening of an airport too soon will be that long-haul flights might leave their points of origin
and, should the airport not in fact be safe to open as those flights are on their journeys, they will need
to be diverted to alternative airports or return to their points of origin, causing additional passenger
disruption. The Review considers that Heathrow’s high percentage of long-haul flights means that
more weight should be placed on this consideration compared with some other airports.

18
Kelly Review Report

Diagram 3

7.18 39% of flights arriving or departing from Heathrow are on Wide Body Aircraft (in Diagram 3, “WB”),
as opposed to Narrow Body Aircraft (“NB”). WB planes are typically those used for long-haul flights
but they require special terminal stands to accommodate their size. The total number of those stands
across the UK and Europe is limited. As a consequence, operationally if an airport opens
prematurely, a large number of WB aircraft may have commenced their journeys to the airport but
there will be limited capacity for them to safely disembark at other airports if the airport in fact cannot
accommodate their arrival. This is another feature of Heathrow’s flight movements that is a relevant
consideration in respect of some issues in this Review.

Standard Operating Hours

7.19 Heathrow’s usual operating hours for flight departures are between 06:00 and 22:50 and for arrivals
between 04:50 and 22:55 each day.

7.20 As a consequence, there is only about a six-hour night-time window in each 24-hour period where
critical systems to operate the Airport ordinarily can be offline, restarted or re-energised (or certain
High Voltage switching can take place – see paragraphs 8.13 - 8.19 below). Major construction and
maintenance interventions are also constrained to this narrow window, which impacts both the
deliverability and cost of projects.

8. OVERVIEW OF HEATHROW ELECTRICAL POWER SUPPLY

8.1 We outline in this section how Heathrow received its electrical power, up until the power outage at
North Hyde in the late evening of 20 March 2025. Understanding this power configuration has
informed our assessment of the decisions taken by Heathrow personnel after the power loss, as well
as driven a number of our related enquiries into Heathrow’s preparedness. Please also see
paragraphs 20.1 - 20.18.3 below.

8.2 Heathrow’s power requirements are significant. During our meetings with Heathrow employees,
those employees emphasised to us the importance of having a resilient power supply – meaning, in
simple terms in relation to each of Heathrow’s three separate power supplies, that if part of that
supply failed, it had a secondary electrical supply source at that relevant supply point to continue to
supply Heathrow (see paragraphs 20.15 - 20.18.3 for further detail). For this reason, at the time of
the incident, Heathrow’s three separate power supplies each had multiple transformers connected
to the National Grid and each had multiple points of connection (provided by interconnectors) from
those transformers to Heathrow. The original power design of the Airport relies on third-party
electricity suppliers for the resilience of the power supply (rather than building full self-sufficiency with
electricity systems solely controlled by the Airport). Many employees that we spoke to confirmed
their belief that this provided Heathrow with a resilient supply of electrical power into the Airport and
in fact gave the Airport an over-availability of supply, with built-in contingency, appropriate for its
operations.

19
Kelly Review Report

8.3 High Voltage Electricity supplied to Heathrow

8.4 Heathrow has three main high-voltage (“HV”) electricity supply points or power sources (also known
as Bulk Supply Points (“BSPs”)), all of which are ultimately connected to the National Grid via three
grid supply points (“GSPs”). The high voltage transmission system is operated by the National
Electricity System Operator (“NESO”), using wires owned by National Grid Electricity Transmission
PLC (“NGET”). NGET is responsible for the operation of the GSPs. The voltage of that electricity
is then reduced at substations by step-down voltage transformers, such that it can then be supplied
to Heathrow via the lower voltage distribution system owned and operated by SSEN. SSEN and
NGET’s wires are used for the purpose of facilitating this supply. To illustrate this further, and as
explained in NESO’s Interim Report, the North Hyde site has four substations, all of which are owned
by NGET.12 There is a 275kV substation which is operationally controlled by NGET, as well as three
lower-voltage substations which are operationally controlled by SSEN.13 The 275kV substation has
three supergrid transformers (“SGTs”) which are owned by NGET and which step down the voltage
to the lower voltage substations.

8.5 One of these lower voltage (66kV) substations (operationally controlled by SSEN) feeds Heathrow’s
Intake A, as shown in Diagram 4 below.

8.6 Diagram of Heathrow campus and its HV supply points (3 power sources)

Diagram 4

8.7 To ensure continuity and resilience of supply in accordance with recognised UK network engineering
standards,14 SSEN provides power to Heathrow from North Hyde via two electricity supply cables

12
NESO Interim Report, paragraphs 5.2 – 5.8.
13
While the SSEN compound is located on the same site as the NGET Substation, SSEN does not have any control or ownership
of the assets operated by National Grid Electricity Transmission.
14
Engineering Recommendation P2/8

20
Kelly Review Report

(known as busbars) (as shown in the Diagram above). One is the primary cable and the second
provides redundancy in the case of an outage on the primary electrical supply, providing N-1
contingency, or resilience, to Heathrow (see paragraph 20.17 below). Resilience in power distribution
terms means that there should not be a single point of failure – there is back-up provided – such as
via multiple transformers and multiple busbars, each with adequate capacity to continue to supply.

8.8 Details about the electricity supply resilience that Heathrow understood was being provided by the
North Hyde substation are discussed further in paragraphs 20.15 - 20.18.3 below. In summary,
each of the three supply points in Diagram 4 above has resilience built in both at the National Grid
level and relevant substation level (because these are fed by multiple transformers – in the case of
North Hyde, there are three transformers as shown in the diagram above)15 and by having separate
busbars from each such supply into the relevant part of the Airport.

8.9 The unprecedented nature of the North Hyde fire (from an electrical infrastructure perspective) is that
all three of the supergrid transformers failed at the 275kV National Grid substation. This meant that
there was no supply to the lower voltage substation that feeds Heathrow.

8.10 The details of how power came to be restored via North Hyde is also key to understanding certain
decisions taken by Heathrow personnel during the day and evening of 21 March. These decisions
were not based only on whether there was supply available from North Hyde, but also whether there
was supply available that Heathrow assessed to be sufficiently resilient. This resilience was
considered essential for the safe running of the Airport so there was no risk of a single point of failure
and possible repeat loss of power causing further disruption. Some key details are as follows:

8.10.1 As discussed in NESO’s Interim Report,16 SSEN was able to re-energise its North Hyde
substation by 09:49 on the morning of 21 March using an interconnection to another
substation at Iver. This meant there was supply available, but not necessarily (for
Heathrow) resilient supply. On its own, the Iver interconnection would be a single point of
failure for the North Hyde supply. The Iver interconnection might also have had insufficient
capacity (a measurement in electrical supply terms known as MVA (megavolt-amperes))
to power both Heathrow and the other customers reliant on the North Hyde supply.

8.10.2 By lunchtime on 21 March, however, Heathrow engineers understood from their


counterparts at SSEN that resilient power was available at North Hyde again. The
information provided to Heathrow engineers at that stage was that the Iver interconnection
and a transformer at the National Grid substation at North Hyde were both available. This
led the Heathrow team to prepare to reconfigure back to three supply points during the
afternoon and evening of 21 March.

8.10.3 Following the calls that Heathrow engineers had with SSEN engineers on the evening of
21 March, issues emerged which informed the decision of Heathrow at 22:30 on 21 March
not to switch the configuration of its network back to North Hyde.

(a) SSEN confirmed that the HV supply from North Hyde would be reliant on a single
point of failure until the morning of 22 March.

(b) SSEN confirmed that there would be ongoing network switching activities by
National Grid. Heathrow engineers considered that these activities carried a risk
of interruption of the supply to the Airport. These activities have been
subsequently confirmed in NESO’s Interim Report.17

15
The details of the substations feeding the other intakes have not been included in the diagram.
16
See paras 5.21 and 5.22 of the NESO Interim Report.
17
See para 5.22 of the NESO Interim Report.

21
Kelly Review Report

8.10.4 As has become known subsequently, it was not until 00:55 on 22 March that the only
operational National Grid transformer at North Hyde was in fact energised and connected
to the wider transmission system.18

8.10.5 When the North Hyde transformer was re-energised, the interconnector circuits from the
Iver substation were switched out, leaving the North Hyde 66kV substation being fed from
a single transmission circuit. Subsequently, from 19:22 on 22 March, NGET and SSEN
made an additional circuit available via Iver to supply the North Hyde 66kV substation.19
The other two transformers at North Hyde remain out of service as at the date of issuing
this Report.

8.10.6 Throughout 21 March and into the early hours of 22 March, Heathrow personnel also
needed to factor in that the fire at North Hyde was not fully contained. This inherently raised
doubts as to the resilience of the North Hyde BSP. The London Fire Brigade later confirmed
it had ceased firefighting at 17:13 on 26 March.20

8.11 The allocation of HV Power across the Heathrow campus

8.12 As illustrated in Diagram 4 above, one intake primarily feeds Terminal 5 (marked as Intake C),
another Terminal 3 (Intake B), and another Terminals 2 and 4 (Intake A, supplied by North Hyde).
Each supply point also powers many other buildings and areas, and, between them, they power
central Airport-wide systems. In the case of the North Hyde supply point at the time of the fire, it
meant power was lost to geographic locations (such as Terminal 2 and part of Terminal 4) and also
lost to some of the IT networks that operate across locations or critical servers or systems that enable
them to function safely.

8.13 Switching between supplies

8.14 Any change to the configuration of where a part of the Heathrow campus receives its HV power
requires a process of switching across Heathrow’s internal distribution network, within which there
are approximately 250 substations. UKPNS provide operation, repair, replacement and maintenance
services to the internal distribution network as Heathrow’s expert service provider.

8.15 As explained below at paragraphs 12.1 - 12.24, on 21 March Heathrow undertook switching of its
internal distribution network to restore power to those parts of the Airport which had lost power from
North Hyde. Heathrow has detailed contingency plans for these types of scenarios, which were
implemented in response to the power outage as discussed below at paragraphs 16.1 - 16.8.3.

8.16 We have heard from Engineering employees in the course of the Review what the switching process
involves. It is complex and requires control engineers physically to attend multiple locations and
follow specific sequences to ensure the process is safe for people and does not cause damage to
assets or infrastructure (which are significant risks if HV power is rerouted across a network in an
uncontrolled manner). Heathrow has a system to undertake remote switching, however this still
requires a person to go to the relevant internal substation to carry out checks on the area prior to
switching and to confirm with the control room before each switch.

8.17 Ordinarily systems would be powered down in a safe and controlled way before the switching
sequence starts. That could not happen on 21 March because the power loss occurred suddenly.
After the switching, Heathrow’s internal distribution network is re-energised and systems must be
powered up again in a controlled way and tested to ensure they are safe. In the event of a sudden
loss of power, there are greater uncertainties over the powering up process because systems may
not have been powered down in a controlled way and may have suffered damage. It may increase

18
Referenced as transformer SGT2 in the NESO Interim Report.
19
See para 5.23 of the NESO Interim Report.
20
See para 5.19 of the NESO Interim Report.

22
Kelly Review Report

timescales too, if systems need to be reconfigured once power is restored after a sudden
uncontrolled loss of power.

8.18 One Engineering employee illustrated this process by comparing it to the fuse box in a domestic
home. If every appliance in the house were on and the main breaker tripped, when power is turned
back on the breaker may trip again because all the appliances are still on. Applying this analogy to
Heathrow, the Engineering team had to switch everything off before restoring power and then switch
all systems back on again and test that the uncontrolled powering down had not impacted the
systems.

8.19 The time that it takes to undertake the switching depends on the switching sequence that is required.
Switching is something that can happen in the ordinary course of business. However, switching to
enable the reconfiguration of Heathrow’s electrical power network away from one of its three supplies
is a significant and time-consuming undertaking. As we explain in more detail at paragraphs 6.1.12,
6.1.13, and 6.1.14 above and at paragraphs 12.2 - 12.7 below, on 21 March the entire process of
powering down, switching, powering on and testing systems took between 10 – 12 hours.

8.20 What about back-up power?

8.21 Heathrow has a range of back-up power systems to ensure uninterrupted power to critical parts of
the Airport for it to operate safely for periods of time in the event of a temporary disruption to power
provided via Heathrow’s internal distribution network (and SSEN and National Grid upstream).

8.22 For example, diesel generators provide instantaneous back-up power supply to the Airfield lighting
and the Control Tower for up to seven days – providing the longest period of emergency back-up
within the Airport to enable aircraft to land that need to. There is also battery back-up to provide
Uninterruptible Power Supply (“UPS”) to certain systems across the Heathrow campus, such as
escape lighting. These back-up systems at Heathrow are safety systems and many are designed to
allow Heathrow to land aircraft and evacuate passengers safely, rather than operate as usual for any
length of time. In the event of a power loss, the time that back-up power is available depends on the
systems and type of back-up each has. Some systems may have back-up power for 90 minutes,
others for four hours. This may also vary by location across the Airport, as well as by the age of the
asset and the back-up power source.

8.23 When the fire at North Hyde started, Heathrow was told it would be at least six hours before the
London Fire Brigade would be able to start tackling the fire. By this point, almost all emergency back-
up power sources which supported systems or locations powered by North Hyde would have been
exhausted (with the exception of the Airfield-related back-up systems). See also paragraphs 16.1 -
16.8.3 and 20.36 below in relation to back-up power sources at the Airport.

9. HEATHROW’S CRITICAL INCIDENT RESPONSE: COMMAND & CONTROL

9.1 Command & Control structure

9.2 In responding to the power outage, Heathrow activated its Command & Control Structure. To provide
context to our findings, this section of our Report provides an overview of Heathrow’s critical incident
response processes. We assess the effectiveness of these later in the Report at paragraphs 15.1 -
15.28.

9.3 Heathrow Command & Control is constructed of three teams: Bronze, Silver and Gold Command.
Each team has a specific remit. Each works on a shift rotation system. The Gold Command team
focuses on strategic level decision-making, external communications and actions. Silver Command
focuses on the tactical level and Airport-wide communications. Bronze Command focuses on the
operational level, with the Bronze roles aligned with operational business units and the Command
structure providing additional coordination and resource to manage the incident.

23
Kelly Review Report

9.4 An incident is typically divided into two phases: the Initial Operational Response, which occurs in the
first 90 minutes of an incident (summarised in Part 1 of this Report at paragraph 5.1.1), and Response
and Recovery, which occurs after that first 90 minutes (where our core findings are in Section 4 of
this Report at paragraphs 12ff - 19ff). The decision whether to stand up Command & Control and
the level of activation (Gold, Silver, Bronze) is decided by the Duty AOM.

9.5 The AOM is a rostered role and based permanently at APOC. APOC is a 24/7 facility from which
Heathrow conducts its operational planning, monitoring and day-to-day oversight of operations.
APOC is a central command room, which was implemented following the Report of the Heathrow
Winter Resilience Enquiry, which was published in March 2011, following a review chaired by
Professor David Begg (“Begg Report”).

9.6 Other critical post-holders sit alongside the AOM in APOC. Notably in this incident the AOM was
supported by the Airport Control Engineer and other electrical engineers, who are also permanently
rostered in APOC.

9.7 Command & Control is activated by the AOM via an F24 phone alarm system.21 Once a command
team is activated, they have 90 minutes following the activation to convene (but are expected to
convene as soon as possible).

9.8 The key roles within the Command & Control structure include the following:

9.8.1 Gold Commander – Guidance Document 122 describes the Gold Commander as being in
command of the strategic tier of Heathrow’s response, by reference to a list of strategic
imperatives. This includes a strategic imperative to protect passenger and colleague
welfare, safety, and security. The Gold Commander’s role includes being responsible for
prioritising and facilitating necessary resources, while empowering the Bronze and Silver
tiers to execute their respective actions.

9.8.2 Silver Commander – the Silver Commander is the primary link between the Silver
Command Team and the Gold Command Team. They should provide regular high-level
updates to the Gold Commander, support and enhance the operational response to an
incident, make tactical decisions and steer the recovery strategy. The Silver Command
Team includes other specific roles, such as Silver Communications. Other specialist
functions will be called into Silver Command roles depending on the nature of the incident.
For this incident, Silver and Bronze Command included Engineering and IT specialists.
Specialist cells were formed for different aspects of the handling of the incident.

9.8.3 Bronze Command - the leadership of Bronze Command is the Duty AOM.

9.9 Command & Control Plan 123 identifies that the Command & Control structure empowers operational-
level teams to make decisions, carry out tasks, and ask for support where needed, delegating
upwards where necessary.

9.10 The Gold Command team is comprised of some members of the Heathrow Executive Committee, as
well as certain other experienced individuals, often with many years of experience handling critical
incidents at Heathrow. Heathrow employees explained that the CEO and COO are not rostered on
to the Command & Control structure, because these roles sit separately from and above the
Command & Control structure. The CEO is not on the Gold roster because they also need to be
available to liaise with the Board, Department for Transport and other stakeholders. As the

21
The F24 phone alarm system is an emergency notification system that when activated calls the phone numbers of individuals
listed for incident response purposes (including those who hold Command & Control responsibilities). It can be activated at
different levels, such as only to Silver and Bronze command level.
22
The name of this document has been reserved for security purposes.
23
The name of this document has been reserved for security purposes.

24
Kelly Review Report

accountable person with ultimate responsibility for aerodrome safety under the Airport’s CAA licence
and functional responsibility to run the operation, the COO is therefore also not on the Gold roster.

9.11 Heathrow Decision Model

9.12 Heathrow trains those in the Command & Control structure on the use of the Heathrow Decision
Model. The Decision Model provides the following steps, which can be repeated as more information
is gathered:

9.12.1 Gather information and intelligence

9.12.2 Assess risks and opportunities and develop objectives

9.12.3 Consider powers, policies and procedures

9.12.4 Identify options and contingencies

9.12.5 Take action and review.

9.13 The Decision Model is intended to align with the Emergency Services Joint Emergency Services
Interoperability Principles (“JESIP”) Joint Decision Model, to enable Heathrow to better coordinate
with external partners in emergency services so that there is a consistent structure. The Decision
Model is intended to provide a common approach and language for decision-making and to empower
decision-makers and to ensure that they make the best of their experience and intuition by providing
balance and structure.

9.14 Heathrow makes template A3 pads available in APOC with the Decision Model printed on them, for
employees to use during incidents. Multiple Heathrow employees who were involved in the incident
response referred to using these pads or the Decision Model.

25
Kelly Review Report

SECTION 4 – ISSUES DURING THE EVENT

Note: This section contains details of a number of critical safety systems, the names of which have been
redacted for security reasons in the body of the Report.

10. DECISION TO STOP OPERATIONS AT AIRPORT

10.1 As noted in the chronology above, the decision to stop operations was made at a meeting that began
at about 01:15 on 21 March 2025, attended by the COO and others.

10.2 The decision to stop operations was taken by the COO, Javier Echave. At this time, Gold Command
had not been activated, but Silver and Bronze had. As explained below, at paragraphs 14.1 - 14.4,
the CEO, Mr Woldbye, was not involved in the decision-making. Mr Echave confirmed to the Review
that the decision whether to stop operations is within his authority as the accountable manager on
the Airport’s CAA operating licence with responsibility for aerodrome safety. In making this decision,
Mr Echave had the benefit of expertise from Engineering and Operations personnel present
(including the Silver Commander) and the latest situational awareness update from the Duty AOM in
APOC.

10.3 Mr Echave explained that the fundamental question for him was whether he could have confidence
in Heathrow’s ability to operate the Airport safely and securely and maintain the integrity of the
border. The other individuals who were involved in the decision-making confirmed that these were
the primary considerations. The relevant factors at this time were:

10.3.1 A significant number of systems across the Airport had failed. These included critical safety
systems, including Critical Safety Systems 2, 3 and 4, and a large number of units of Critical
Safety System 1. Heathrow employees who spoke to the Review emphasised that
Heathrow needs certainty that its systems are working, which means these systems must
be tested and validated as operational. If it does not have that certainty, it must assume
they are not.

10.3.2 Systems such as the runway lights and Air Traffic Control Tower were operating on
generator back-up power. See paragraph 8.22 for more information on these back-up
systems. Other back-up power systems had been automatically activated, including
escape lighting in the terminal buildings.

10.3.3 London Fire Brigade were estimating that it would take them six hours to begin fighting the
fire (although it appears subsequently this meant fighting the fire within the perimeter of the
substation, pending it being safe to do so from an electrical safety perspective).

10.3.4 Fire East, one of two fire stations at the Airport, did not have power.

10.3.5 Baggage systems were not operating in Terminals 2 or 4.

10.3.6 The Engineering team had reported it would take a minimum of two hours to get power
back. As noted above at paragraph 8.17, this would require all systems to be powered
down, restarted and tested.

10.3.7 Approximately 130 flights were at that time already travelling to Heathrow. The number of
flights on their way would continue to grow exponentially. Prior to the 01:15 meeting,
Heathrow had spoken to air traffic control services about the impact if Heathrow were to
close and was told that if Heathrow was to zero-rate itself, i.e. not accept arrivals, it would
need to do that sooner rather than later to allow long haul flights a chance to divert.

10.4 No Heathrow employee reported to the Review that they disagreed with the decision to close the
Airport, including members of the Executive, members of the Engineering team and members of the
Operations team. Mr Woldbye reported that he agreed with the decision taken to stop operations,

26
Kelly Review Report

due to the enormous uncertainty and the risk of personal injury if passengers were allowed to come
to the Airport.

10.5 Based on the above factors, the decision taken to stop operations was the only reasonable decision
available in the circumstances. It was supported by information gathered by the Duty AOM. This
enabled senior leadership to make a prompt decision, with safety and security the foremost
considerations.

Key finding 1: the Review Committee considers that the decision to stop operations was the only
reasonable decision available in the circumstances. It was made with safety and security as the
foremost considerations. Given these are reasonable considerations and it was correct for them to
be prioritised, it follows that there was no alternative to closing the Airport.

11. DECISION ON LENGTH OF CLOSURE OF OPERATIONS

11.1 The decision made at about 01:15 on 21 March was to stop operations until 23:59 that day. The
Review has considered whether the decision to stop operations for that length of time was
reasonable.

11.2 The COO explained that the rationale for the decision to stop operations for that length of time was
to prevent aircraft arriving and people coming into the terminals when the Airport was not ready to
hold them.

11.3 The scenarios discussed at the 01:15 meeting were either to stop operations until midday on 21
March or until 23:59. The decision-makers were aware that the fire at North Hyde had not been
contained and any recovery of electrical power would take some hours. They were concerned that
if passengers were told the Airport would be opening at midday, they would begin to travel to the
Airport in the morning and they would not be able to be held safely either inside or outside the
Terminals. Given the volumes of passengers arriving and departing on any day, the Airport can only
operate safely if they flow through the Airport at a rate sufficient to prevent backlogs, which would
otherwise quickly overwhelm the facilities available and pose safety and security problems.

11.4 The decision was taken to stop operations until 23:59 on the basis that the Airport could resume
operations earlier if possible.

11.5 A number of Heathrow employees, including the COO, referred to lessons that had been learnt from
an earlier snow event in 2010:

11.5.1 Snowfall on 18 December 2010 resulted in the closure of Heathrow, with the Airport
operating on significantly reduced capacity until 22 December 2010. This resulted in the
cancellation of over 4,000 flights.

11.5.2 The snow event was the subject of a review that culminated in the publication of the Begg
Report in March 2011. In particular, the Begg Report found that there had been failures in
communication and coordination within Heathrow and between Heathrow and the airlines,
and that confusing and conflicting messages caused incorrect signals to go to airlines and
passengers. In addition, there had been a slow reaction to terminal congestion.24

11.5.3 As a result of this experience, a number of the Heathrow employees that we spoke to noted
the importance of giving certainty in communications to airlines and passengers, rather
than giving an earlier time and having to push it back, which would create uncertainty and
lead to people travelling to the Airport, thereby increasing the risk to safety. We were told
that Heathrow was expecting approximately 1,300 flights and 200,000 passengers to be
using the Airport on 21 March. We heard from Heathrow employees that the airlines had

24
The Begg Report also made recommendations in relation to Heathrow’s emergency planning, response and recovery which
we understand have since been enacted.

27
Kelly Review Report

provided positive feedback on this communication (discussed further below at paragraph


17).

11.6 The decision to stop operations until 23:59 on 21 March was made with the primary objective of
preventing risks to the safety of passengers. The decision-makers were careful to avoid creating
expectations that flights would operate from an earlier point when Heathrow did not have confidence
that this would be possible. We also consider that it was reasonable for the decision to include a
qualification so that an earlier opening time could be later announced if it transpired it was possible.
This appears to be a well-reasoned decision, demonstrating lessons learned from the snow event.

Key finding 2: The decision to stop operations until 23:59 on 21 March was a prudent and well-
reasoned decision based on the circumstances at that point in time. It was made with safety as the
primary objective.

12. DECISIONS ON RESTORING AIRPORT OPERATIONS – POWER SUPPLY DECISIONS ON 21


MAY

12.1 Initial decision to switch to two-supply configuration

12.2 Following the power outage the Engineering team began work on developing a schedule of switching
activity to reconfigure the network to operate without the supply from North Hyde (which supplied
Heathrow Intake A). While the Engineering team had the benefit of pre-existing contingency plans
relating to switching, they described the development of the necessary sequence for switching as a
very complex task, requiring the switching to be done in a very specific order - with approximately
250 substations there are numerous permutations of how the supply could be reconfigured.

12.3 Although the initial conversation between the Heathrow Engineering team and SSEN happened
shortly after midnight and the Engineering team began development of the switching plan, the
Engineering team allowed a short time for SSEN to resolve the problem if possible, rather than
proceeding immediately into the task of reconfiguring the networks, which as noted above takes
several hours.

12.4 The Heathrow team had additional support on 21 March from UKPNS who coincidentally had extra
resource on site that night for planned works on the internal distribution network. Developing and
executing the switching plan took a number of hours. In summary, everything connected to North
Hyde had to first be switched off (see explanation above at paragraphs 8.17 - 8.18 above). Part of
the switching sequence, relating to the Airport’s primary substations on the Airport’s internal
distribution network, took place between 02:41 – 06:25. Other switching steps were necessary
thereafter to re-energise the wider network systems in a controlled manner. The systems then had
to be tested as they began to come back online from about 09:00 on 21 March.

12.5 At 03:30 on 21 March Heathrow lost partial access to Remote Access System 125 relied upon by the
Engineering team to connect remotely to certain systems (including the systems to remotely switch
HV breakers). The system was affected by overheating at Location A itself caused by loss of power
to air conditioning “chillers” used to cool servers. The impact on the Remote Access System 1 only
affected two or three of Heathrow’s internal network substations, which had to be switched using the
local (rather than remote) controls. As noted at paragraph 8.16, in any event, the switching process
requires a person physically to visit the relevant sites to carry out checks. The switching locations
are widely distributed across the Airport campus. Had Remote Access System 1 or chillers in
Location A been on UPS, the ability to carry out remote switching at the affected sites may have
slightly reduced the time the switching took (although it was estimated to us that this would have
been by less than an hour).

12.6 The decision to switch supplies was made in light of information from SSEN that they would not have
power restarted at Intake A for hours. At this time, the feedback from London Fire Brigade (as noted

25
The details of this system have been reserved for security purposes.

28
Kelly Review Report

above at paragraph 6.1.2) was that they would not be able to start to tackle the fire for six hours. The
focus for the Engineering Team at this time was to restore power to Terminals 2 and 4 and to other
critical systems that had been powered by Intake A.

12.7 The decision to switch to two supplies was made at a time of considerable uncertainty and after
allowing time for SSEN to resolve the situation if possible. The decision was made by those with
expertise in the power systems, including highly experienced senior personnel who attended
Heathrow in the early hours of the night having seen the F24 activation. We were told by several
members of the Heathrow team that the back-up power for some systems may have only lasted a
matter of a few hours. Based on the evidence we received, the decision to reconfigure the network
to two supplies was unavoidable in the circumstances, not least that the fire at North Hyde was still
not under control.

Key finding 3: The decision to reconfigure Heathrow’s electricity distribution to two supplies was the
only reasonable decision available in the circumstances given the need to restore resilient power to
the Airport. The decision was then executed as promptly as possible.

12.8 Decision-making relating to reverting to normal configuration

12.9 At 10:00 on 21 March SSEN contacted Heathrow to inform them that Heathrow could reconnect to
its regular supplies, i.e. North Hyde, and have power supplied by two transformers. However,
Heathrow employees reported that it was not until 12:31 that Heathrow had clarity on how the supply
available from North Hyde would be resilient (i.e. with sufficient capacity and not a single point of
failure). At that time, SSEN confirmed that they had resilient power supply for Heathrow at North
Hyde via two interconnectors to another substation at Iver, which itself had four transformers.

12.10 The opportunity to revert to the three-supply configuration was discussed by Gold and Silver
Command at 13:15 on 21 March, following the confirmation from SSEN that a resilient supply was
available from North Hyde. The decision was taken to revert to the three-supply configuration
because this would mean that the Airport was more resilient with three independent HV power
supplies before restarting full operations on 22 March. It would also be less disruptive and safer to
undertake that switching while the Airport was currently closed (as the switching would take longer
than the usual overnight closure window). It was estimated it would take another 10 hours to revert
to the three-supply configuration (because of the additional time to safely power down systems that
had been re-energised from the earlier switch to the two-supply configuration).

12.11 While the decision-makers recognised that reverting to the three-intake configuration would extend
the time in which operations were stopped in parts of the Airport by a matter of a few hours, they
considered the added resilience offered by the three-intake configuration was worth this time and
would avoid a further suspension of operations in the future. The decision to revert to the three-
intake configuration mainly impacted Terminal 2.26 As a result of the decision, Heathrow’s engineers
ceased starting up systems in Terminal 2 and instead began powering down the systems in a
controlled way in order to prepare for the switching. The decision may therefore have impacted the
ability to reopen Terminal 2 on 21 March (as we discuss further below at paragraph 13.19). However,
at the time this decision was made, Terminal 2, in any event, was not expected to reopen in time for
any significant level of operations on 21 March due to the time required to test and validate all
systems in the Terminal as safe and to recharge all UPS batteries. It had been communicated to the
airline community prior to this decision that Terminal 2 (and Terminal 4) would not operate on 21
March.

12.12 We were told that the decision-makers viewed this decision as separate to the decision to reopen
Terminals 3 and 5 for repatriation and repositioning flights. Based on the evidence presented to us,

26
This is because the Engineering team reconfigured the network (during the process described above) so that Terminal 4 was
not dependent on North Hyde, so that reconfiguring back to three supplies would be simpler in the event that the supply from
North Hyde was reinstated.

29
Kelly Review Report

we conclude that the two decisions were possible to execute in parallel during the timeline of 21
March, so there was no conflict between them.

12.13 The decision to revert at this time to the three-supply configuration was a reasonable decision made
on the basis of the information supplied by SSEN. It was correct for the Airport to have sought to
secure the most resilient medium to longer-term power solution (which would also avoid the risk of a
later further disruption to passengers, airlines and other businesses and stakeholders as a result of
carrying out another reconfiguration of the electricity supply to the Airport on a different date). By
the time the decision could be reached to switch back to the three-supply configuration, it is highly
unlikely that a different decision (to stick with two supplies) would have enabled significantly more
flights to be reinstated on 21 March than in fact occurred.

Key finding 4: The decision to reconfigure the network to revert to the normal three-supply
configuration was reasonably made with the objective of ensuring the Airport had the most resilient
power supply available, including over the longer term. While this decision may have extended the
time in which operations were stopped for parts of the Airport by a matter of a few hours, a different
decision would not have resulted in a significantly larger number of flights being operated on 21
March 2025. We consider the decision was nevertheless the correct one.

12.14 Decision to stay with two-supply configuration

12.15 Following the decision to switch back to three supplies, the Engineering team enacted the plan to
reconfigure the network. They ceased the work of starting up systems in Terminal 2 (the other
terminals at this time already being operational or undergoing safety testing) and began shutting
down systems to allow the switch over in the evening. By 21:52 on 21 March, the Engineering team
were almost ready to switch the network over (after which they would begin bringing everything back
online, re-energising the network, and then testing it). The timeframe for carrying out the switching
had been moved back to this point to allow for a generator to arrive to be used as a back-up power
supply for Heathrow’s main tunnel in case the switching affected it. The main tunnel is critical for safe
access to and from the Central Terminal Area of the Heathrow campus (see further below at
paragraph 13.3.3).

12.16 At 21:52 a member of the Engineering team called SSEN to notify them that they would be switching
the network. On this call SSEN informed Heathrow that they were going to be conducting separate
HV switching themselves. Heathrow called SSEN back at 21:58 to confirm further details. On this
call SSEN said that the other substation supply into North Hyde would not be available until the
following morning and that Intake A, if reconnected, would therefore have a single point of failure –
the single remaining transformer at North Hyde, at the site where the fire had started the previous
evening. The two other supergrid transformers at North Hyde were not in operation.

12.17 This new information about the lack of a resilient supply was escalated by the Engineering team to
Silver Command and the decision was made to cancel the planned switch and remain with two
supplies. The window of time was also reducing for Heathrow to carry out the switching and enable
the Airport reliably to resume full operations at the start of the following morning on 22 March.

12.18 While the decision to cancel the planned switch was not escalated to Gold Command or the CEO or
COO, all the Heathrow employees the Review spoke to confirmed they believed that this was the
correct decision because of the lack of resilient power from North Hyde (and in light of the decision
to reconnect to North Hyde having been made by Gold Command earlier in the day on the basis that
the supply from North Hyde was resilient). The decision also aligned with the directive that had been
set by Gold Command to reopen full operations on 22 March. It was necessary at this point to make
a quick decision. Very shortly after the decision was made the Gold Commander was updated and
the Silver and Gold Commanders continued to check in regularly throughout the remainder of the
night.

12.19 Subsequently, at 00:24 on 22 March SSEN informed Heathrow that they thought the fire at North
Hyde had restarted.

30
Kelly Review Report

12.20 We are of the view that the decision taken to cancel the switch back was reasonable in the
circumstances, given that SSEN could not confirm that the North Hyde power supply would be
resilient. Additionally, although this information was only known after the decision was made, the
fire at North Hyde was not fully under control.

12.21 We observe that Heathrow and SSEN personnel were not in contact about power configuration
issues during the afternoon and early evening on 21 March (a period between about 14:00 and the
call between control rooms at 21:52). We do not consider this gap in communications had any
material impact on the decisions ultimately taken in the late evening of 21 March to remain on two
power sources, because it became clear to Heathrow personnel that a change back to three power
sources would not provide the resilient power Heathrow needed for the next day’s operations.
However, given the significance of the configuration work being undertaken by Heathrow and the
potentially changeable situation at North Hyde, we consider it may have been helpful as a further
safeguard during this complex process for the Heathrow team and SSEN to liaise regularly to confirm
nothing had changed from SSEN’s perspective on the re-supply of resilient power from North Hyde.
As the Review has not gathered information from SSEN on this point, we are not able to comment
on whether SSEN were in a position to pass information sooner to Heathrow which may have
assisted decision-making.

Key finding 5: the decision to cancel the planned reversion to the three-supply configuration and
maintain the two-supply configuration was reasonably made on the basis of a lack of availability of a
resilient supply at North Hyde.

Recommendation 1: the Review Committee recommends that where the Airport is facing a critical
incident that involves a third-party supplier, and there is a significant impact to Heathrow, there should
be regular communication between relevant Heathrow contact points and that supplier over the
course of the critical incident, as a precaution in case additional information from the supplier impacts
situational awareness. This may also help to ensure they are receiving timely updates from the
relevant supplier of any change of position.

12.22 A lesson learned from the incident is the need for more regular communications with the critical
supplier(s) involved during the incident – in this case the communications with SSEN and potentially
further upstream with National Grid. Whilst there were good working relationships between the
control engineers at Heathrow and their counterparts at SSEN, there were times during the incident
where more interaction between SSEN and Heathrow could have been useful. The problems faced
by Heathrow engineers related to information their counterparts at SSEN were able to provide during
the incident about whether and when a resilient HV supply of electricity would be restored from North
Hyde on 21 March. This may have been as a result of the information available to those SSEN control
engineers at different points in the incident (for example, if information available to them was
contingent on updates they received from National Grid). See above at paragraph 8.10.

12.23 We consider a broader relationship between Heathrow and its critical energy supplier SSEN (and
upstream with National Grid) highly desirable in relation to issues that might impact supply of HV
electricity, any potential interruptions to supply and related resilience topics. Better commonality of
understanding, and a more developed relationship at senior level, might not have prevented the
unprecedented nature of this incident nor materially impacted the time taken to recover the Airport
to full operations. However, it may be beneficial for various types of incident in future. Specific areas
for the Heathrow Executive team to consider include:

12.23.1 Regular bilateral management communications between Heathrow and SSEN and
National Grid.

12.23.2 Requesting more detailed information about resilience issues affecting the upstream supply
of electricity by SSEN (including enquiries as appropriate with National Grid) as well as
sharing information about Heathrow’s own risk assessments relating to interruption in the
supply of HV power and its impact on the Airport.

31
Kelly Review Report

12.23.3 A shared understanding of each other’s critical incident plans, so these might achieve an
equivalent level of interoperability between Heathrow and SSEN (and with National Grid
too in appropriate circumstances) to that which Heathrow has developed with its
emergency services partners.

12.23.4 Reviewing whether any similar enhancements might be useful for the relationship with
other key utility suppliers to ensure a good working knowledge of those supplies and
Heathrow’s needs respectively.

12.23.5 Guidance to the relevant levels in the Command & Control chain about establishing
effective communications with senior counterparts in key suppliers during an incident,
including requesting a lead point of contact.

12.24 As indicated by our remarks above, we consider that equivalent considerations to those described
above should apply to Heathrow’s relationship with National Grid, to the extent appropriate and
where this improves all parties’ overall understanding and preparedness for critical incidents where
each are impacted. Equivalent considerations should also apply to Heathrow’s relationship with all
other critical suppliers.

Recommendation 2: the Heathrow Executive Team should consider enhancements to the


commonality of understanding between Heathrow and SSEN and development of the relationship
with SSEN at a senior level, including the considerations set out in paragraph 12.23 of the Report.
Equivalent considerations should apply to Heathrow’s relationship with National Grid and all other
critical suppliers, to the extent appropriate and where this improves all parties’ overall understanding
and preparedness for critical incidents where each are impacted.

13. COULD TERMINALS 3 AND 5 HAVE REOPENED EARLIER?

13.1 The Review has considered the information available to it to assess whether Terminals 3 and 5 could
have been opened earlier.

13.2 From the start of the incident, when the power outages occurred at 23:55 on 20 March, it was
apparent that Terminals 3 and 5 were not affected in the same way as Terminals 2 and 4. This is
because Terminals 3 and 5 were primarily powered by supplies other than Intake A. However, the
Heathrow employees who were spoken to during the Review explained that, while Terminals 3 and
5 appeared powered, certain critical safety systems were affected Airport-wide.

13.3 The following relevant factors informed the decisions around timing of reopening Terminals 3 and 5:

13.3.1 Objective set to restore flight operations – at an early stage of the incident and then
again at 10:00 on 21 March, the Command & Control leadership teams had set objectives
which included restoring flight operations within the day of the incident. The priority in the
objectives was maintaining safety for passengers and colleagues alongside security
considerations and compliance with other essential obligations. It was agreed on the 10:00
Gold Command Call that the priority for reopening would be repositioning and repatriation
and then the restart of scheduled departures, reflecting what was understood about airline
priorities. From approximately 07:30 on 21 March Heathrow had created a dedicated
scheduling team to consider what flights could be facilitated on 21 and 22 March, and also
to track the diversions of aircrafts and passengers. Heathrow also established a dedicated
team to focus on scheduling for the days following the incident.

13.3.2 Critical safety systems not operating and tested until 13:00 – as noted above, when
the power outage occurred, this affected certain Airport-wide critical safety systems as well
as the visibility of the effectiveness of others. This included a large number of units of
Critical Safety System 1, and Critical Safety Systems 2, 3 and 4. Manual contingencies
were available to be put in place for these systems. Two Heathrow employees in
operational roles commented that the manual contingencies for these systems are very

32
Kelly Review Report

resource heavy and there were not sufficient people available throughout the night to put
so many contingencies in place at the same time. Heathrow relied on support from Police
in relation to certain of these manual contingencies. Having lost multiple systems requiring
complex and time-consuming manual contingencies, Heathrow took the view (which we
consider was the reasonable and only view to take) that it needed to have these critical
systems operating and tested before it could restart operations in Terminals 3 and 5.
Operating multiple systems on back-up contingencies increases the risk to safety.

These systems began returning to power at approximately 10:30. The checks on these
systems were confirmed as completed at 13:00.

13.3.3 Central Terminal Area tunnel – critical safety systems were also lost in the Central
Terminal Area tunnel, which provides access to (among other areas) Terminal 3. The
power outage affected systems in the tunnel for which Heathrow has minimum operating
standards, including Tunnel Critical Safety Systems. A pump used to remove surface water
from the tunnel also failed. The inability to use the tunnel affected the ability to use Terminal
3 because the tunnel is the main access route for passengers to reach Terminal 3. A
decision was made to operate the tunnel on a restricted basis due to manual contingencies.
As at 17:00 on 21 March the tunnel was still operating on a restricted basis. Because of
the impact on the tunnel’s systems, the incident response teams identified a risk that the
critical systems in the tunnel could again be affected by the planned switch back to three
supplies. Therefore, Heathrow arranged for a generator to be brought to the tunnel to
supply back-up power (see further at paragraphs 21.11 - 21.15. As noted above, the switch
did not go ahead and the tunnel was opened at 00:45 on 22 March.

13.3.4 Ongoing discussions about switching network configuration – as noted above, at


10:00 on 21 March, SSEN informed Heathrow that it could reconnect to the North Hyde
supply, from which two transformers would be available. Heathrow then queried with SSEN
whether it could put in a short-term parallel connection between two of its substations,
which would allow it to switch supplies without interrupting the supply to the Airport. There
were then a number of internal discussions with Heathrow’s incident response teams
regarding the opportunity to switch back to three supplies, how this could be achieved, and
whether they were comfortable that the supply was resilient. It was not until 12:31 that
SSEN confirmed to Heathrow the nature of the supply from North Hyde such that Heathrow
was comfortable this would be a resilient supply (although SSEN later provided additional
information to Heathrow, leading Heathrow’s engineers to conclude the supply was not in
fact resilient at 22:00). Based on our review of the chronology of events and our
discussions with Heathrow employees, it is possible that there may have been some delay
(a maximum of a couple of hours or so) caused to the reopening of Terminals 3 and 5
during the window while the opportunity to revert to the original network configuration was
being discussed and considered. However, given the complexity of this issue, we do not
consider the time spent on these discussions was unreasonable. This enabled good
decisions to be taken, based on the best available information at that point in time during
the incident, which needed to be appropriately tested. Any delay in this respect may have
ultimately had no impact, because the critical safety systems described above were still
being brought online and tested during this time.

13.4 Having assessed all the factors above, we consider the key issue affecting the timing of reopening
Terminals 3 and 5 was the restoration of the critical safety systems, including Critical Safety Systems
1 , 2 and 3. The loss of critical safety systems in the Central Terminal Area tunnel provided further
complication to the reopening of Terminal 3 for any operations beyond repositioning and repatriation,
as discussed below at paragraphs 13.8 - 13.14.

13.5 We discussed with Heathrow employees the relevant critical safety systems, the details of which
have been reserved for security reasons. These are IT systems, which also have an engineering
aspect. [These sentences has been reserved for security purposes.] Multiple Heathrow employees
commented on the lack of visibility over which of these critical safety systems were affected and this
made responding to the incident more challenging. For the avoidance of doubt, we understand that

33
Kelly Review Report

the loss of power to these critical safety systems did not affect the ability for aircraft to land in
emergency situations. However, these systems were assessed as required to be in place to operate
any flights on a normal operations basis.

13.6 We consider it reasonable to have taken the decision that Terminals 3 and 5 could not be safely
operated for passengers while multiple complex contingencies were being operated in parallel on
critical safety systems (Critical Safety Systems 1, 2 and 3). Those critical systems were confirmed
as restored and tested at the 13:15 Gold Command call.

13.7 As we have noted above, the decision to reopen Terminals 3 and 5 for select flights was
communicated on the Community Call at 14:00 on 21 March. Heathrow began accepting
repositioning arrivals from 16:00 and repatriation flights from 18:00. We have referred above to the
logistical arrangements required to restaff the Airport at paragraph 7.15. There are clearly also
equivalent considerations for airlines to ready themselves (and, in the case of repatriation and
departures, passengers) for flights. In our view, the length of time between the decision to partially
reopen and the accepting of arrivals was reasonable in the circumstances.

Key finding 6: the time taken to restart operations at Terminals 3 and 5 was driven by the need to
restore critical safety systems, on the basis it was not considered safe to operate the Airport with
manual contingencies in place. These systems were confirmed as tested and restored by 13:00 and
at 14:00 Heathrow announced on a Community Call that it would begin accepting flights from 16:00.
Between 10:00am and 12:30pm, discussion and consideration of the opportunity to convert back to
the three supply configuration may have delayed the reopening of Terminals 3 and 5 by a maximum
of a couple of hours or so. We do not find the time spent on this assessment to be unreasonable,
given the complexity of this issue. Any such delay may not have impacted the time taken to test and
restore the critical safety systems, which were the key issue in reopening Terminals 3 and 5. Standing
up cumulatively a number of manual contingencies had practical and risk consequences – especially
in order to handle any normal volume of passengers through a terminal building.

Recommendation 3: the Review Committee recommends that Heathrow review and, if possible,
enhance its ability to monitor whether critical safety systems are operational following a power
outage.

Recommendation 4: due to the importance of these critical safety systems if there is a major
disruptive event at the Airport, the Review recommends that Heathrow implements a review into the
effectiveness of back-up power supplies for these systems (including how long the supplies last) to
establish if enhancements are reasonably practicable. Heathrow should also review which similar
enhancements to UPS (or the recharging of UPS) are proportionate and practical to implement for
any other operational systems. (For further discussion of the impact of UPS, see below at
paragraphs 21.2 - 21.10.)

The results of these review(s) should be reported to SORC.

Recommendation 5: the Review Committee recommends that Heathrow develop a list of all critical
safety systems for which power is supplied by each High Voltage intake, building on the lessons
learned from this incident for North Hyde.

13.8 Why were repositioning and repatriation flights prioritised?

13.9 As noted above, Heathrow chose to prioritise repositioning and repatriation flights ahead of
scheduled departures. An explanation of these flights is given at paragraph 7.13. We have
considered whether it was reasonable to prioritise these flights above other operations. It is clear
that repositioning flights are much simpler to operate as they do not have passengers, and do not
require baggage or security lanes. For flights with arriving passengers, Heathrow must ensure
security of the border, as well as the safety and security of people moving through the Airport. We
were also told that if Heathrow did not prioritise repositioning flights, this could lead to passengers
having their flights cancelled multiple times due to ongoing scheduling disruption.

34
Kelly Review Report

13.10 At a 10:00 Gold Command team call, it was agreed that repatriation flights would be a priority
because of the importance of helping passengers get back to their intended destination. Heathrow
was also in discussion with airlines throughout the day on when flights would be able to operate and,
for example, received inputs on British Airways’ preferences for the sequence of flights.

13.11 Heathrow accepted the arrivals of seven repositioning flights on 21 March, with the first arriving to
Heathrow at 18:01 (although Heathrow was able to (and advised it could) accept arrivals from 16:00).
Heathrow accepted the arrivals of three repatriation flights, with a total of 628 passengers, with the
first repatriation flight arriving at 22:19 (although Heathrow had communicated that it could accept
repatriation arrivals from 18:00). The repatriation flights were all processed through Terminal 4
(which by this time had been tested and confirmed as operational).

13.12 Following the reopening of Heathrow for repositioning flights at 16:00 and for repatriation flights at
18:00, Heathrow did not decline any requests by airlines to operate such flights. The number of
repositioning flights and repatriation flights operated was determined by the airlines, most of whom
had by this point cancelled their schedule for the day. Heathrow consulted with airlines and took
account of their operational needs as far as possible, in terms of scheduling preferences, once
resumption of services on 21 March became a viable option.

13.13 Although Heathrow had previously announced it would not be operating departures with passengers
on 21 March, it ultimately operated eight British Airways outbound flights with passengers that day,
beginning at 20:00. This followed inputs from the Airport’s CEO earlier in the day, who had asked
Command & Control leadership to consider whether there was an opportunity to open safely and
securely for some outbound flights. The CEO had emphasised that whether it was safe and secure
to do so was a technical operational decision. The Command & Control leadership reviewed the
position on outbound flights and confirmed they could safely operate a number of outbound flights.
Heathrow was able to operate these outbound flights in a controlled environment. We were told that
this helped to give the airlines confidence that they would be able to operate a full schedule the
following day. A total of 1,009 passengers travelled on these flights on 21 March.

13.14 In our view, it was reasonable in the circumstances to prioritise repositioning and repatriation flights.
Heathrow also operated some departure flights when it was confirmed that it was safe to do so. In
circumstances where parts of the Airport were still being tested and some manual contingencies still
in operation, it was reasonable in our view not to open the Airport for full operations immediately from
the time at which individual terminals were confirmed to be safe. When these flights were operated
some Airport systems were still being tested, for example systems in Terminal 2. Members of the
Heathrow Technology team (who had been responding to the issues with the critical systems
described above) also had reported that they could not be certain that the planned switch over to the
three-supply configuration (intended for later that evening) would not affect IT systems in Terminals
3 and 5. It was reasonable in those circumstances to operate only limited flights. This would mean
fewer passengers and the ability, for example, to ensure, if manual contingencies needed to be
deployed, there would be sufficient resources to protect passenger safety at all times.

Key finding 7: the decision to prioritise repositioning and repatriation flights was a reasonable
decision in the circumstances and was coordinated with airlines as far as practicable. While it was
reasonable in light of the safety objective not to open for full operations, Heathrow kept under review
whether it could operate additional flights, which it did by operating eight departure flights with
passengers.

13.15 Terminals 2 and 4 and return to full operations

13.16 From an early stage on 21 March discussions at Command & Control level reflected that Terminals
2 and 4 would not be able to be operated that day. The systems in Terminals 2 and 4 were in a more
uncertain state than in Terminals 3 and 5, because they had been shut down when power was lost.
As this was not a “clean” shutdown there was potential risk of damage to those assets, which needed
to be tested as they were brought online.

35
Kelly Review Report

13.17 From the time power went out, Terminals 2 and 4 had escape lighting operating on UPS (see above
at paragraphs 8.21 - 8.23). However, back-up systems are designed to allow safe evacuation, not
for full operations. By 09:00 on 21 March, the batteries in the back-up supplies for emergency lighting
had been drained. There was therefore a risk that, if power was lost to these areas, they would have
no escape lighting. Those UPS systems needed to be recharged before the assets in those terminals
could be checked by the specialist teams. The process of bringing these terminals back to operational
status therefore took longer than Terminals 3 and 5. However, by 17:00 Terminal 4 had been
approved for full operation and accepted three arrival repatriation flights, which all landed after 22:00
on 21 March.

13.18 The planned switching back to the three-supply configuration would have affected the power supply
to which Terminal 2 was connected and therefore required systems to be powered down in a
controlled way to prepare for the switch on the evening of 21 March. There would then be a brief
power outage, after which the systems would be brought back online and tested. The Engineering
team assessed that the switch back would not risk a power interruption to Terminals 3, 4 or 5 and so
the systems in these terminals did not need to be powered down before switching (see above at
paragraph 12.11). There was, however, a risk identified that switching could affect critical systems
in these other terminals.

13.19 One Heathrow employee reported that, had SSEN confirmed there was no resilient supply available
at North Hyde at 12:31 on 21 March, the Engineering team would have continued to restart systems
in Terminal 2 (rather than powering them down to prepare to switch back to the North Hyde supply)
with the result that the systems would have been operational again from approximately 18:45.
Although passenger movements may have been able to restart in the hours afterwards, given this
would have been relatively late in the day (with all airline slots having already been cancelled earlier
that day) in our view this would not have enabled a significant number of flights to operate. We note
our findings at paragraphs 13.11 - 13.13 above that after reopening Terminals 3, 4 and 5, Heathrow
accommodated all requests for slots from airlines which resulted in the operation of 18 flights. We
have set out our conclusions at paragraph 12.11 above about the competing considerations that
applied to the decision to revert to the three-supply configuration.

Key finding 8: Heathrow relied on information from SSEN to make a reasoned decision to revert to
its most resilient network configuration. This may have delayed the point at which Heathrow could
resume full operations because of the work required to prepare for this reconfiguration. We have
addressed the reasonableness of the decision to revert to the three-supply configuration in our
findings above at Key Finding 4.

14. ROLE OF CEO OVERNIGHT ON 20/21 MARCH 2025

14.1 Heathrow’s CEO Thomas Woldbye is not on the Command & Control roster, however he is on the
list of persons who are notified when an F24 alarm is issued. We are aware of commentary in the
media surrounding Mr Woldbye’s role in relation to the incident.

14.2 F24 alarms were sent on 21 March to relevant personnel, including Mr Woldbye, at 00:21 (to activate
Bronze and Silver Command and to place Gold on Standby) and at 01:52 (to activate Gold). The
Chief Operating Officer, Mr Javier Echave, also attempted to call Mr Woldbye several times during
the early hours of 21 March.

14.3 Although his phone was on his bedside table, Mr Woldbye reported that it did not alert him to the F24
alarms or to Mr Echave’s other calls because the phone had gone into a silent mode, without him
being aware it had done so and he was asleep at the time. Records also reflect that his phone was
not switched off and that the F24 calls were not answered. Mr Woldbye first became aware of the
incident at approximately 06:45 on 21 March, and received a debrief from Mr Echave. As noted
above at paragraph 10.2, although Mr Woldbye was therefore not involved in the decision to suspend
operations, it was within Mr Echave’s authority to make this decision, being the named individual on
the CAA operating licence for the Airport. Neither Mr Woldbye nor Mr Echave considered the
decision to stop operations would have changed had Mr Woldbye been involved.

36
Kelly Review Report

14.4 We are aware of some comments in the media that indicate that on the night of 21 March Mr Woldbye
appointed Mr Echave in charge of the incident and then went to sleep. Both Mr Woldbye and Mr
Echave confirmed to us that this was not correct. Mr Woldbye expressed to us his deep regret at
not being contactable during the night of the incident.

Key finding 9: Heathrow’s CEO Mr Woldbye was not aware of the incident in the early hours of 21
March as he was not alerted to the F24 notifications or to Mr Echave’s calls, but this had no impact
on the decisions made between 00:21 – 06:45.

Recommendation 6: the Review Committee recommends that Heathrow consider enhancements


that can be made to the notification process of a critical incident (in addition to F24 calls), including
options for notifying key individuals via a second means of contact for significant incidents. Heathrow
has already taken steps to implement these enhancements since the incident.

15. DID THE COMMAND & CONTROL STRUCTURE OPERATE EFFECTIVELY DURING THE
INCIDENT?

15.1 All employees spoken to by the Review reported that the Command & Control structure worked
effectively throughout the incident. The Command & Control leadership empowered those with
technical and operational expertise to make decisions. At all levels of decision-making, it was clear
that the primary guiding objective was to ensure safety of passengers, colleagues and assets.

Key finding 10: the Command & Control structure operated effectively during the incident by
empowering those with technical and operational expertise to make decisions. The primary guiding
objective for these decisions was ensuring safety.

15.2 As part of the continual improvement of Heathrow’s Command & Control processes and operational
resilience plans, we recommend a number of enhancements to the existing processes and
procedures.

15.3 The areas for further enhancement can build on existing initiatives that we were told commenced last
year to refresh aspects of the Command & Control structure. We do not consider that any of the
areas identified for further enhancement would have had any impact on decisions taken during the
incident or timeframes for recovery of the Airport on 21 March, had these recommendations been
implemented prior to the incident.

15.4 Rostering of Gold Command

15.5 Rostering appeared to work well during the incident at the Silver and Bronze levels, with members
of these teams working shifts of approximately 12 hours before being relieved. For Silver
Commanders, two people also alternated the responsibility in 12-hour shifts. This flowed from the
operation of a “shadow” roster, meaning that an individual is on-call for a week, and then after that
week they are in a “shadow” role for a week. For an extended incident of this kind, it meant that two
Silver Commanders (one rostered to be on-duty and one rostered to be on “shadow”) were expected
to automatically alternate responsibilities in 12-hour shifts between them.

15.6 It appears that this approach to rostering had not been developed for Gold Commanders, where
rostering was handled by a separate administrative process, rather than the Operational Resilience
team responsible for all other aspects of Heathrow’s Command & Control processes.

15.7 At present, Gold Command level operates on a one-week roster. There are not, however, the same
contingencies in place to automatically provide shift cover in the event of a prolonged incident,
equivalent to what operates at Silver Command level.

37
Kelly Review Report

15.8 This meant that one person held the role of Gold Commander for a 24-hour period during a critical
time in the incident response before an eight-hour shift pattern was agreed between Gold
Commanders for the remainder of the incident.

15.9 We recommend that Heathrow determine the most appropriate model for rostering Gold Commander
shifts that ensures adequate resilience in Gold Command during incidents of longer than 12 hours
duration. This may involve a similar approach to that currently operated by Silver Command. This
would enhance the resilience of the Gold Command function in prolonged critical incidents.

Recommendation 7: the Review Committee recommends that Heathrow determine the most
appropriate model for rostering Gold Commander shifts that ensures adequate resilience in the event
of an incident of longer than 12 hours duration.

15.10 Training

15.11 All Gold Commanders had received training in relation to Command & Control processes. This had
also recently been increased prior to the incident to support recently appointed Gold Commanders.

15.12 However, training records for Gold Commanders are not kept as a matter of course by the
Operational Resilience team. This should be formalised. Compulsory elements of the training
programmes should also be clarified.

15.13 In the periods prior to being rostered Silver Commanders are expected to attend decision gyms run
weekly by the resilience team at Heathrow. Gold Commanders are also able to join these sessions,
but are not expected to do so. We recommend that Heathrow ensure that Gold Commanders receive
training on a regular basis. Minimum levels of compulsory training or refreshers might take account
of relative levels of experience of different Gold Commanders.

15.14 Because of the relevance of the impact on technology systems during the incident, we consider it
would be beneficial for Heathrow to incorporate programmes to upskill those in Command & Control
on technology systems. We recommend that Heathrow consider whether this can be incorporated
into training programmes.

Recommendation 8: to enhance training, the Review Committee recommends that:

a) Gold Commander training records are formalised and held by the Operational Resilience
team;

b) compulsory elements of training programmes for postholders in Gold Command are


clarified and Gold Commanders should attend regular training;

c) Heathrow consider whether measures to upskill those in Command & Control on


technology systems can be incorporated into training programmes;

d) compulsory training is provided on recording minutes of meetings.

15.15 Administrative support for Command & Control

15.16 Heathrow’s Command & Control processes can also roster Support Officers (including Gold
Command Support Officers, “GCSOs”). Their role is to provide administrative support during a critical
incident to log key decisions and minute meetings and calls, such as (in the case of GCSOs) Gold
Command meetings.

15.17 We recommend that training is provided to all Support Officers performing various Command &
Control roles so that consistent formatting of minutes is achieved. This should follow a similar or
equivalent format to the template agenda for Gold Command meetings in the current version of the
Guidance Document 1, with key decisions taken and actions allocated during Command & Control

38
Kelly Review Report

meetings set out in separate sections of the minutes for additional clarity. We refer to
Recommendation 8(d) above.

15.18 We also recommend that relevant policy documentation is updated so that it is clear that applicable
draft minutes should be provided to relevant Commanders as soon as practicable and in any event
within 24 hours of an incident’s conclusion for finalisation as an agreed record. We refer to
Recommendation 9(d) below.

15.19 Updates to existing manuals available to those on the Gold Command roster with updated
guidance on different roles and postholders and respective responsibilities

15.20 Existing policy documentation for Gold Command includes Guidance Document 1 and a summary
Guidance Document 2.27 These provide helpful guidance in advance of and during a critical incident.

15.21 We recommend:

15.21.1 Enhancements are made to guidance on the relationships and respective decision-making
responsibilities of the Gold Commander, CEO and COO in critical incidents.

15.21.2 Guidance is included in policy documentation on maintaining the resilience of Gold


Command in prolonged incidents. This might include examples of when a qualified Gold
Commander should not attend APOC in a serious critical incident (if they are not rostered
and back-up support has not been requested), so that resilience is maintained for handling
an incident that might last more than one day.

15.21.3 Guidance is included in policy documentation on the subject-matter expertise a Gold


Commander might wish to have available as support in respect of different types of incident,
where they may be less familiar with the underlying subject matter area. This would have
the effect of formalising what happened in practice during the course of this incident –
where one Gold Commander with less operational expertise had the benefit of support from
two qualified Gold Commanders who did.

Recommendation 9: the Review Committee recommends that policy documentation is updated:

a) to enhance guidance on the decision-making responsibilities of Gold Commander, CEO


and COO in critical incidents

b) to provide guidance on identifying subject-matter expertise that may be beneficial during


an incident.

c) to include guidance on maintaining resilience in Gold Command during prolonged


incidents.

d) to clarify that draft minutes should be provided to Gold Commanders as soon as


practicable and in any event within 24 hours of an incident’s conclusion for finalisation as
an agreed record.

15.22 Ensuring that the environment in APOC enables Command & Control teams to work in most
effective way possible

15.23 We heard from some employees who were working in APOC during the incident that APOC became
very busy and at times noisy. This is of course understandable in an incident like this that required
so much resource. However, we recommend that Heathrow consider whether enhancements can
be made to procedures relating to the number of people permitted into APOC during an incident and

27
The name of this document has been reserved for security purposes.

39
Kelly Review Report

the designation of break-out spaces for specific recovery aspects. This is intended to ensure that
the Command & Control teams can work in the most effective way possible.

Recommendation 10: the Review Committee recommends that Heathrow review its procedures
relating to the number of people permitted into APOC during an incident and the designation of break-
out spaces for specific recovery aspects to ensure that the Command & Control teams can work in
the most effective way possible.

15.24 Updating of the Command & Control Plan 1 and Operational Plan 1

15.25 Each of these documents provide useful guidance and context for Gold Commanders and others in
senior roles in Command & Control functions. We recommend that the Operational Resilience team
refreshes each of these policy documents.

Recommendation 11: the Review Committee recommends that relevant incident management and
operational resilience plans are reviewed and updated as necessary to take account of learnings
from the incident and as part of continual improvement of policy documentation.

15.26 Ongoing engagement with law enforcement and other emergency services at Heathrow to
maintain the coordinated and consistent approach with these agencies on Command &
Control processes.

15.27 Our Review found that there was strong connectivity and communication (including co-location)
between the Heathrow personnel in Command & Control functions and relevant emergency services.

15.28 Heathrow’s Command & Control processes were originally modelled on JESIP principles used by
emergency services for handling critical incidents. We recommend that the Heathrow Operational
Resilience team consider whether amendments are required to Heathrow’s Command & Control
framework based on any relevant amended and updated JESIP guidance since Heathrow’s
processes were last reviewed and any consultation with Heathrow’s stakeholders in emergency
services as appropriate.

Recommendation 12: the Review Committee recommends that Heathrow considers whether
amendments are required to Heathrow’s Command & Control framework based on any relevant
updates to best practice guidance and any consultation with Heathrow’s stakeholders in emergency
services as appropriate.

16. CONTINGENCY PLANS

16.1 We were told a large number of contingency plans were activated across the Airport throughout the
incident, representing almost 40% of all the contingency plans Heathrow has developed.

16.2 Engineering

16.3 There was a plan specifically for Loss of High Voltage Power, which could be used by the ACE to
respond to a loss of power, including a loss of power from Intake A. This plan identified steps that
the ACE should take in the event of loss of external supply. The plan also identified key assets that
would operate on back-up generators in the event of a total power failure. In addition, the
Engineering team had a contingency plan specific to switching activities for the Airport’s 33kV
substations, prepared by UKPNS, which was used during the incident response.

40
Kelly Review Report

16.4 Other

16.5 We were told other specific contingency plans used during the incident included plans for losses of
specific critical IT systems (such as Critical Safety System 2), welfare protocols for both passengers
and staff, and extended delay and mass schedule cancellation plans.

16.6 These guided Heathrow’s various teams in responding to the incident. Because of the dynamic
implications of a loss of power event, contingency plans were deployed according to the impacted
systems and operations of the Airport. The employees we spoke to did not consider the lack of a
single plan had any impact on the response to the incident because practically speaking there were
so many different issues that required contingency planning due to the unprecedented nature of the
power outage. Combining the contingency plans for all these issues into a single plan would likely
have been unworkable and not sufficiently flexible. Heathrow relied on its teams to identify which
contingency plans needed to be activated, under the oversight of the Command & Control structure
at Bronze and Silver level. We consider this worked well.

16.7 None of our findings on contingency plans suggests there could have been a different outcome on
the day or a different timeframe for recovery had there been any additional plans. However, given
the extended and unprecedented nature of this critical incident, we have recommended that all
lessons learned are fully documented from the feedback and evaluation sessions that respective
teams have had following the incident. Specific feedback should also be sought on contingency plans
deployed and any enhancements to points of detail should be incorporated into revised versions. We
have recommended that a report on those sessions and specific enhancements to written
contingency plans should be provided to Heathrow’s Sustainability and Operational Risk Committee
(“SORC”) in due course.

Key finding 11: a large number of contingency plans were activated during the incident and in
general these worked well, although we found some areas where improvements would be possible
in the light of lessons learned. Lessons learned from different teams should be collated and
presented to SORC. None of our findings on contingency plans suggests there could have been a
different outcome on the day or a different timeframe for recovery if there had been any additional
plans.

Recommendation 13: the Operational Resilience team, together with the COO, should coordinate
the preparation of a single report to SORC on the different incident response teams’ post-event
feedback and evaluation sessions and any specific enhancements to written contingency plans that
have been identified as lessons learned.

16.8 We have the following additional observations on contingency plans:

16.8.1 The Engineering team should consider whether a contingency plan for wider internal
network switching activities (in the situation where the UKPNS 33kV substation switching
plan has been enacted) would be useful and possible to document, taking account of any
lessons learned during this incident. In essence, these were the steps taken after the initial
High Voltage switching completed at 06:25, in order to reconfigure and re-energise the
remainder of Heathrow’s internal network.

16.8.2 A checklist for APOC personnel of the situational awareness enquiries needed during a
loss of power event should be prepared to assist duty AOMs in the management of the first
90 minutes of the incident response in respect of power or other utility failures. Using
Heathrow’s Command & Control Decision Model, the duty AOM executed numerous
enquiries in the first 90 minutes of the incident. This relied on the skill and experience of
the AOM and the on-duty teams in APOC. It is worthwhile ensuring that this is now
documented for future use.

16.8.3 Challenges arose during the incident because multiple systems failed simultaneously,
requiring multiple contingencies.

41
Kelly Review Report

(a) Some of the contingency plans for individual systems were manual
contingencies, complex to execute and adequately resource at the same time.

(b) As noted above, Heathrow relied on support from Police in relation to certain of
these manual contingencies, some of which had significant security implications.
We have set out further detail on this in a reserved section of this Report. [The
remainder of this paragraph has been reserved for security purposes.]

(c) We were told that operating multiple complex and resource intensive
contingencies at the same time carried inherent logistical and safety risks.28 We
conclude that correct decisions were taken in managing the resumption of
operations in the afternoon and evening of 21 March in a phased manner. This
had the effect of also de-risking the return of operations, if multiple manual
contingencies had needed to be stood up. This is principally because the flow of
passengers and air crew was kept at reasonable levels in the immediate period
after the resumption of operations.

(d) We have made reserved findings elsewhere in this Report on IT matters (see
reserved paragraphs 21.16 - 21.21). We recommend that the post-event
evaluation work undertaken by IT personnel (which we understand is in progress)
considers (amongst other matters):

(i) whether IT contingency plans relevant to a loss of power event could


be strengthened. These might include plans:

(1) that are jointly developed with supply chain partners who are
likely to be involved in handling critical incidents;

(2) that identify which High Voltage intakes power the various IT
systems;

(ii) how information retained on the status of UPS assets and their back up
lifespan can be updated or enhanced (including on any registers,
schedules and other records); and

(iii) whether there are particular learning points for specific IT systems that
were impacted by the power outage.

Recommendation 14: the Engineering team should consider whether a contingency plan for wider
internal network switching activities (after the UKPNS 33kV substation switching plan is enacted)
would be useful and possible to document, taking account of any lessons learned during this incident.

Recommendation 15: following the work undertaken by the Duty AOM and others in APOC during
the first 90 minutes of the incident response, consideration should be given to whether the steps
taken and situational awareness enquiries made on the night can be documented into a useful
checklist or guidance document for APOC personnel for future use, either in the event of a power
failure or other equivalent incidents (such as utility failures).

Recommendation 16: we recommend the ongoing post-incident review being undertaken by IT


personnel considers, amongst other matters:

a) whether IT contingency plans relevant to a loss of power event could be strengthened.


These might include plans:

28
[This footnote has been reserved for security purposes.]

42
Kelly Review Report

i. that are jointly developed with supply chain partners who are likely to be involved
in handling critical incidents;

ii. that identify which High Voltage intakes power the various IT systems;

b) how information retained on the status of UPS assets and their back up lifespan can be
updated or enhanced (including on any registers, schedules and other records); and

c) whether there are particular learning points for specific IT systems that were impacted by
the power outage.

17. COMMUNICATIONS

17.1 Communications – general

17.2 Heathrow recognised in its immediate handling of the power outage that it would significantly impact
passengers, airlines and other stakeholders, whose respective travel, operations and businesses
would be severely disrupted.

17.3 Interviewees have relayed to the Review the need for clear and consistent communications, as a
lesson learned from the 2010 snow event (see above at paragraph 11.5).

17.4 We have reviewed the communications across the different phases of the crisis.

17.4.1 As noted above at paragraph 6.1.9, the NOTAM was issued at 01:44 on 21 March. The
first media statement by the Airport was 30 minutes later at 02:14 as follows:

“Heathrow is experiencing a significant power outage across the airport due to a large
fire at a nearby electrical substation. Whilst fire crews are responding to the incident,
we do not have clarity on when power may be reliably restored. To maintain the safety
of our passengers and colleagues, we have no choice but to close Heathrow until 23h59
on 21 March 2025. We expect significant disruption over the coming days and
passengers should not travel to the airport under any circumstances until the airport
reopens. We will provide an update when more information on the resumption of
operations is available. We know this will be disappointing for passengers and we want
to reassure that we are working as hard as possible to resolve the situation.”

17.4.2 This messaging was repeated when the statement was reissued at 09:40.

17.4.3 A further update was provided at 12:24, which explained work being done to redirect power
to affected areas of the Airport and mentioned the related critical safety issues. It also
explained that the Airport’s back-up systems were safety systems, which allowed the
Airport to land aircraft and evacuate passengers safely but were not designed to allow it to
run a full operation. This statement reconfirmed that the Airport would remain closed for
the day. Given the multiple issues being dealt with at that juncture by the Command &
Control teams, we consider the rationale for this to be robust.

17.4.4 Once decisions were taken to restart operations on 21 March with repatriation and
repositioning flights, a further communication was released at 15:34 as follows:

“Our teams have worked tirelessly since the incident to ensure a speedy recovery.
We’re pleased to say we’re now safely able to begin some flights later today. Our first
flights will be repatriation flights and relocating aircraft. Please do not travel to the airport
unless your airline has advised you to do so. We will now work with the airlines on
repatriating the passengers who were diverted to other airports in Europe. We hope to
run a full operation tomorrow and will provide further information shortly. Our priority
remains the safety of our passengers and those working at the airport. As the busiest

43
Kelly Review Report

airport in Europe, Heathrow uses as much energy as a small city, therefore getting back
to a full and safe operation takes time. We apologise for the inconvenience caused by
this incident.”

17.5 This last communication on 21 March continued to make clear that Heathrow would not be providing
full operations that day and that passengers should only travel if advised to do so by their airlines.

17.6 Overall, we conclude that these communications on the day were clear and transparent. They
avoided additional disruption and safety risks being caused by passengers and others travelling to
the Airport when it was not ready to accommodate them. The communications were careful not to
create expectations that the Airport would be open to passengers before 22 March.

17.7 Finally, once the Airport restarted its full operations on 22 March, the following communication was
released at 05:35:

“We can confirm that Heathrow is open and fully operational today. Teams across the airport
continue to do everything they can to support passengers impacted by yesterday’s outage
at an off-airport power substation. We have hundreds of additional colleagues on hand in our
terminals and we have added flights to today’s schedule to facilitate an extra 10,000
passengers travelling through the airport. Passengers travelling today should check with their
airline for the latest information regarding their flight.”

17.8 These public communications were well-managed by those within the Gold and Silver Command
structures, which included communications specialists.

17.9 Consistency between external and internal Heathrow communications

17.10 A decision was taken by the Communications team, approved by Gold Command, to ensure internal
and external communications were consistent with one another. This was done to avoid a risk that
messages would become blurred. This prevented similar consequences that had arisen in the prior
snow incident at the Airport, where communications had created expectations that the Airport would
be opening imminently.

17.11 We consider this rationale was correct overall and generally worked well. We make observations
below in relation to internal communications, and in relation to possible enhancements for the Airport
to consider in future, where this might improve guidance to passengers arriving in terminals.

17.12 Communications with airlines and other stakeholders: Senior Leadership

17.13 The COO, Mr Echave, contacted several stakeholders from airlines, the Heathrow Airline Operators
Committee Ltd (“AOC”), the CAA, the Department for Transport, and Traffic Control at 02:00 on 21
March, shortly after the NOTAM was issued. Mr Echave then continued conversations with several
stakeholders throughout the morning. The CEO, Mr Woldbye, also had conversations with the CAA
and Department for Transport, as well as with airlines during the day on 21 March. We understand
that feedback received from these communications was positive.

17.14 Communications with airlines and other stakeholders: Community Calls

17.15 Community Calls were set up at an early stage, with the first at 03:30 on 21 March.

17.16 These are calls which members of the Airport community can join, including airlines, retailers,
members of the supply chain, transport operators and other members of Team Heathrow. They were
also open to Heathrow employees.

17.17 Community Calls were held approximately every three to four hours throughout the incident (at 07:00,
10:30, 14:00, 17:00, 21:00 on 21 March and at 00:00 on 22 March). We have been told that Heathrow
Command & Control personnel provided an update for 10 – 15 minutes at the start of each call and

44
Kelly Review Report

then answered questions on each call for as long as there were questions, so that no question from
the community was left unanswered by the end of the call.

17.18 The Review has identified the following issues with the Community Calls:

17.18.1 The Community Calls were held on Teams and had a maximum joining capacity of 999.
This meant for the 10:30 and 14:00 Community Calls certain people who wanted to join
were not able to. We understand the Airport has increased Teams capacity post-incident.

17.18.2 Initially, summary notes were not sent out after the Community Calls. This was remedied
later in the day on 21 March. In this respect, the update email provided after the 17:00
Community Call gave the latest operational status to recipients, including the following
terminal-by-terminal information:

 Terminal 3 and Terminal 5 - power has remained stable, both are fit for purpose and
local teams can access for readiness checks.

 Terminal 4 - now operational and local teams can access for readiness checks. Note
there is no rail connectivity to or from this terminal.

 Terminal 2 - remains out of service.

The email following the 17:00 call also provided details on: how airlines should route slot
requests via ACL in the usual way; London Underground and Heathrow Express services
then running to terminals; and Border Force resources for the rest of the day and the
weekend (for Immigration). Where there was not full functionality, this was also noted: the
Central Terminal Area Tunnel remained in restricted contraflow and the FIDS (the flight
information displays) in terminals were still not working, so there were contingencies of
mobile digital units and manual whiteboards being used.

17.19 We have considered whether Heathrow should have operated separate calls for particular members
of the community, for example a separate call for airlines, Team Heathrow representatives and
others. On balance, we consider having a single Community Call strategy worked best given the
intensity of managing this incident. Opinions of people spoken with by the Review varied concerning
the benefits of separate communication lines, which may have targeted information to those different
communities quicker. However, this would have taken resources away from other essential
Command & Control activities and may have led to a risk of misinterpretation if key messages were
being expressed in different ways across different parallel calls.

17.20 Additional communication facilitated with airlines

17.21 Heathrow also invited members of the AOC and British Airways into APOC during the incident, in
order to facilitate communication and allow for those representatives to provide constructive
challenge to Heathrow’s decision-making during the incident. Interviewees were strongly in favour
of the decision to have airline representatives co-located in APOC during an incident for these
reasons.

17.22 A number of Heathrow employees reported that they had received positive feedback from airlines
about how they had communicated during the incident and had received personal messages of
thanks.

17.23 Possible enhancements to Heathrow’s internal communications during the incident

17.24 The decision to ensure internal and external messaging was consistent had some unforeseen
consequences.

45
Kelly Review Report

17.24.1 This may have impacted a small number of passengers, who arrived at terminals on 21
March when the Airport was closed or for departures rescheduled for later in the evening.
Here to Help29 staff had general communication guidance but consideration might be given
to a separate channel of communications to update Here to Help staff on specific
information useful for passengers

17.24.2 For example, an employee who volunteered as a Here to Help staff member in Terminal 5
for part of the day on 21 March also mentioned that they were not provided with detailed
information on flight departures or repositioning and repatriation flights to relay guidance to
members of the public. Because of the employee’s seniority they were able to seek out this
information quickly by making additional enquiries.

17.24.3 Some personnel reported that there was a delay in some Heathrow staff members who
were operating in the terminals being told that Terminal 5 was reopening, with some staff
members hearing this from British Airways rather than from Heathrow.

Key Finding 12: communications during the incident were clear and consistent and built on lessons
learned from the 2010 snow event.

Recommendation 17: we recommend that the Operational Resilience team consider if there is a
proportionate solution to provide specific real-time updates to Here to Help and other Heathrow staff
members in the recovery phase of critical incidents. This might be done on a location-by-location
basis for different Terminals so the most up-to-date information can be provided to passengers and
other members of the public in terminal buildings, when other systems such as flight information
display systems may not yet have been restored to full functionality.

18. IMPACTS OF THE OUTAGE ON PEOPLE

18.1 People at the Airport during the incident

18.2 Because the focus of our Review is on what happened within the perimeters of Heathrow, we have
not been able to survey the full range of disruption that approximately 200,000 people experienced
on 21 March and the days that followed, for example, in respect of their travel arrangements and
onward plans. The Review is conscious its findings should be read in that context and is in no way
intended to minimise those significant wider impacts. Our findings in this section collate key relevant
data available to the Airport and supplied to the Review.

18.3 As a result of the outage:

18.3.1 No injuries were reported as a result of the incident to any passengers, Heathrow
employees or employees of other organisations operating at the Airport.

18.3.2 At the time of the power outage, passengers and Heathrow employees were in the terminal
buildings. No passengers were airside due to the time of night the incident occurred.

18.3.3 Terminal staff used contingency protocols to ensure that everyone in the terminals was
safe. [This sentence has been reserved for security purposes.]

18.3.4 There were also people in hotels next to certain terminal buildings, whom the Airport
understands were evacuated in line with the hotels’ own policies and procedures.

18.3.5 There was emergency lighting in Terminals 2 and 4 (the terminals that lost power), which
activated on back-up power supply. This automatic contingency is time-limited. A number
of people were in Terminal 2 where lighting was off while moving through corridors in the

29
Here to Help is Heathrow’s programme to assist passengers in their journeys through terminals at the Airport, where typically
Heathrow’s non-operational staff volunteer hours to assist the programme.

46
Kelly Review Report

course of the early hours of 21 March. This included several of Heathrow’s security team,
who needed to use torch functions on their phones. For a period, these individuals were
also without access to toilet facilities, as these were impacted by the power loss. Since the
incident, the COO has met with some of the individuals affected to understand more details.
Immediate interim adjustments were made after the incident to contingency plans, including
issuing all security team members with battery powered torches. We recommend that a
review is completed by the COO to understand how many people were impacted, whether
emergency lighting was working as it should or whether the UPS had become drained, as
well as to check whether there are gaps in emergency lighting coverage in corridors. We
recommend that a copy of the COO’s report should be provided to SORC.

Key finding 13: no injuries were reported as a result of the incident, however reports were received
of Heathrow employees operating in Terminal 2 without access to lighting and other facilities during
the night of 21 March.

Recommendation 18: we recommend that the COO conducts a review to understand how many
people were impacted by the lack of lighting and other facilities in Terminal 2, whether emergency
lighting was working as it should or whether back-up power supplies had drained, and whether there
are gaps in emergency lighting coverage in corridors. A copy of the COO’s report should be provided
to SORC. The report should consider whether any amendments are required to any contingency
plans in respect of evacuation protocols or if any enhancements are needed on welfare checks during
critical incidents.

18.3.6 Some passengers continued to arrive at Heathrow on 21 March either because their flights
had not been cancelled by the airlines or because they had been transported to Heathrow
by coach after their flight was diverted. For example, passengers arrived at Heathrow
Terminal 5 by coach after having their flight from Australia diverted to Paris. Those
passengers were exhausted and were provided with guidance by Heathrow employees on
onward travel into central London. Other passengers had already been travelling for many
hours by the time their connecting flights from Heathrow were cancelled.

18.3.7 Many Heathrow employees volunteered for Heathrow’s Here to Help service to assist
passengers on 21 and 22 March. One Heathrow employee who volunteered for a Here to
Help shift on the afternoon of 21 March described passengers having been caused
considerable stress by the disruption but also commented that the volunteer response from
Heathrow employees was very strong.

18.3.8 Heathrow also received excellent support from Team Heathrow colleagues throughout the
incident and supply chain partners in respect of handling technical aspects of the response,
including UKPNS and Heathrow’s IT service providers and partners.

18.4 Details of disruption from Heathrow’s records

18.5 The suspension of operations on 21 March caused 1,273 flight cancellations and resulted in
disruption to approximately 200,000 passengers.

18.6 At an early stage on 21 March, Heathrow suspended its usual rule that if a flight is cancelled due to
a technical fault it can be automatically rebooked for the next day. This would have been
unmanageable with 1,273 flights in this situation. In the afternoon of 21 March airlines booked slots
for the following day. Heathrow’s planning team monitored this against capacity, with Airport
Coordination Limited on site to assist with this process. Heathrow liaised with airlines that had
smaller operations at Heathrow to ensure they understood the processes.

18.7 Heathrow returned to business-as-usual operations on 22 March. The following table shows the
cancellations on 21 – 23 March, with the days either side for context:

47
Kelly Review Report

Date Flights cancelled Flights cancelled on Total cancellations


in advance the day
19 March 2025 1 3 4
20 March 2025 1 3 4
21 March 2025 1,273 1,273
22 March 2025 93 14 107
23 March 2025 13 13
24 March 2025 4 3 7

18.8 On 22 March Heathrow also operated an extra 74 flights and reported that punctuality of flight
operations was at over 80% throughout the day. It was reported to us that most airlines were running
a normal operation on Sunday 23 March.

19. ORGANISATIONAL RESILIENCE - PEOPLE

19.1 Managing a critical incident successfully relies on highly trained, capable and expert people
communicating effectively and working collaboratively at pace. Those people also need resilience
and back-up support in extended incidents.

19.2 The Review has considered whether Heathrow had the requisite numbers of its people engaged in
the response to the incident; whether there were any gaps in knowledge or experience that impacted
the handling of the incident; and if there were any deficiencies in the organisational culture. We have
dealt with specific comments on Command & Control elsewhere in this Report (see above at 15 and
in parts of reserved paragraphs 21.16ff of this Report).

19.3 Throughout the Review, we have heard of a strong organisational culture of collaboration across
different teams and functions. We consider this supported the incident response and recovery of the
Airport to full operations on 22 March. Safety was a common thread through the descriptions
employees gave of decisions they took or how they and colleagues handled the incident.

19.4 In terms of capabilities and resourcing, we found:

(a) On-duty APOC personnel in the first 90 minutes of the incident gathered and
interrogated situational updates from multiple human and system sources at
pace, to enable later decision-making on the suspension of operations at the
Airport. Their work in the “golden [i.e. first] hour” or so30 of the incident also
enabled swift later decisions to suspend operations at the Airport, preventing an
exponential escalation of disruption caused to passengers and airlines.

(b) Leading the recovery of the Airport to restore operations were a large number of
technical experts in the engineering, IT solutions and resilience functions. This
included individuals with decades of experience across different roles at
Heathrow.

(c) There were multiple postholders in Command & Control leadership roles and in
different incident response teams with considerable prior relevant experience of
handling previous critical incidents at the Airport and from relevant operational or
similar roles. Other very experienced Command & Control personnel offered
additional support to those rostered during the incident.

(d) The senior leadership team worked collaboratively during the incident alongside
the Command & Control structure, enabling good strategic decisions at various
junctures and making important contributions throughout the incident to help

30
The period between 23:55 on 20 March and 01:20 on 21 March.

48
Kelly Review Report

minimise the impact of the incident and provide appropriate support and
challenge.

(e) There was a strong awareness of effective, clear and real-time engagement with
relevant stakeholders throughout the incident – see our section on
Communications at paragraph 17ff.

(f) Heathrow’s people worked very collaboratively with a large number of Team
Heathrow personnel supporting the Airport with its recovery, including on areas
of technical challenge throughout the incident.

19.5 Work was highly pressured over long hours for those involved in the incident. This level of effort was,
however, instrumental in enabling the Airport to operate almost as usual on 22 March.

Key finding 14: Heathrow had a sufficient number of highly qualified and trained staff available to
deal with the incident on 21 March. Their efforts prevented the disruption from being worse and
lessened the effect on the operation of the Airport in the days that followed.

Recommendation 19: the Review Committee recommends that the Chief People Officer consider
whether any action is needed in relation to post-incident wellbeing. We recommend that the Chief
People Officer seeks views from those involved on 21 March on whether there are changes that
Heathrow could appropriately make to support them more effectively during such an incident.

See also observations elsewhere in this Report on team resilience in Command & Control
functions.

49
Kelly Review Report

SECTION 5 – HEATHROW PREPAREDNESS FOR INCIDENT

20. COULD INVESTMENT RELATING TO HEATHROW’S ELECTRICAL POWER RESILIENCE HAVE


PREVENTED OR MITIGATED THE IMPACT OF THE NORTH HYDE POWER OUTAGE ON 21
MARCH?

20.1 Investment at Heathrow – General remarks about decisions affecting electrical power
resilience

20.2 As a significant consumer of electrical power Heathrow is inevitably reliant on third party suppliers,
most notably SSEN and ultimately National Grid. Heathrow, like any customer seeking a connection
to the National Grid, has paid for a connection and for a certain amount of electrical capacity to be
available via the North Hyde supply. Heathrow has paid for a “firm” connection at North Hyde,
meaning one that provides resilience (or redundancy). If a disruption to that firm supply occurs, there
are obligations on electricity suppliers to reconnect firm power to a consumer like Heathrow (within
24 hours as a backstop). In these circumstances, the obligations remain with the electricity supplier
to provide resilient power to Heathrow.

20.3 With those expectations and safeguards in mind, there is a question of how far Heathrow needed to
prepare for the eventuality that those obligations were not fulfilled by its suppliers, for whatever
reason. This question goes to how far an organisation in these circumstances can and should invest
to have back-up power systems in the event of a failure upstream in its electricity supply. In
Heathrow’s case, there are wider considerations, including what the Airport is required to have in
order to be compliant, for example, with its CAA and other obligations. Within those parameters,
there is then a further question of how to balance the competing investment requirements at an
airport like Heathrow.

20.4 The Airport is not presently in a position to be self-sufficient for its normal day-to-day energy needs
nor has it sought to be. In lay terms, that would likely require it to build its own power station. The
infrastructure supplying electricity to the Airport has been designed with multiple layers of
redundancy to provide resilience. Much of this redundancy sits within the National Grid and SSEN
owned network infrastructure and Heathrow has relied on this redundancy to ensure resilient power
supply.

20.5 We recognise that on rare occasions there are failures that lead to interruptions in power supply as
occurred on 21 March. Our Review has therefore given initial consideration to how much additional
back up coverage Heathrow did have and could (or should) have had in order to cover for those
occasions where the suppliers are unable to provide power despite the redundancy built into their
network infrastructure.

20.6 A full review of all past investment decisions is beyond the scope of this Review. However, from the
investigations we have commissioned we are not aware of any instance in which the HAHL Board
has rejected investments related to the Airport’s power infrastructure or energy resilience since at
least 2014.31

20.7 We are also mindful that investment in infrastructure at Heathrow has been significant in recent years
and currently is over £1bn per year, which includes investment into asset maintenance and
resilience.32

31
The review commissioned considered information as far back as 2014 in order to encapsulate relevant periods of expansion
planning, COVID-19 and prior reviews of operational resilience.
32
Heathrow announces £2.3bn accelerated investment plan to upgrade the UK’s international gateway to growth

50
Kelly Review Report

Recent context for investments in relation to electricity resilience: the impact of COVID-19, past
airport expansion plans and Airport operations at-capacity

20.8 We have heard accounts from colleagues of how Heathrow’s approach to investment in asset- and
infrastructure-related resilience was significantly impacted by the COVID-19 pandemic. In
Heathrow’s Strategic Business Plan of June 2020,33 the then CEO of Heathrow wrote:

“Our industry is struggling. It’s hard to imagine that 2019 was our busiest year ever with 81
million passengers. Now only six months into 2020, we’re operating from a single runway,
we’re consolidating our operations into only two terminals and our daily passenger numbers
have shrunk to the thousands. This is a major crisis for global aviation, and no one can be
sure of how fast we will recover from it. Heathrow is a business that has safety and sound
future planning wired into its DNA. …

“The cost savings we are making now will help us to secure as many jobs as possible whilst
maintaining the agility to return to growth when passenger demand increases.”

20.9 We heard how Heathrow, with few exceptions, paused capital expenditure during the pandemic
across all areas of the Airport, wherever this would not compromise safety or security. Over the 2020
and 2021 financial years, Heathrow reported losses before tax of approximately £3.68 billion and as
noted in the comments above from the then CEO, had to prioritise its own financial survival.

Previous planning on infrastructure linked to third runway

20.10 Previous Master Plans at Heathrow have often been linked to plans for a third runway or other major
airport development. Witnesses have described how this meant proposals for investment in relation
to significant assets, such as for energy resilience, were similarly linked to the expansion plan. Some
people highlighted to the Review the challenges faced by larger, strategic infrastructure projects.
These include that the Airport is operating at full capacity with only limited operational windows to
carry out works to improve resilience or replace or upgrade assets and within a highly constrained
footprint.

20.11 As expansion plans did not progress, combined with the effects of the COVID-19 pandemic, this has
resulted in some of Heathrow’s assets not being upgraded or replaced as quickly as would otherwise
have been the case. Since the pandemic the Airport has faced an accelerated need to replenish
certain ageing assets.

New approach to planning for investment

20.12 As part of forward planning since the pandemic, Heathrow is now in the process of strengthening its
Master Plan, independently of the third runway expansion. This Master Plan is still focused at a high
level, rather than considering detailed plans for systems such as fuel, water and energy. The
ambition is for master planning to be further improved at a system and subsystem level to reflect
detailed plans for the next five to seven years across different parts of the business. This is an
initiative of the CEO, which is intended to ensure that improvements in infrastructure (and other areas
including resilience) at Heathrow are not dependent on a third runway being built.

20.13 Prior to the incident on 21 March, we understand there was already an intention to start developing
a new utilities master plan. We recommend that this work continues as a priority, with appropriate
additional resources being given to relevant teams for this exercise, in light of the incident of 21
March.

33
https://www.heathrow.com/content/dam/heathrow/web/common/documents/company/investor/reports-and-
presentations/other-business-reporting/Strategic_Capital_Business_Plan_2020.pdf

51
Kelly Review Report

Recommendation 20: we recommend that the planned work to develop a utilities masterplan is
undertaken as a priority with appropriate additional resources being given to relevant teams for this
exercise.

20.14 We consider below some specific areas relating to High Voltage power resilience that we have
discussed with employees in the course of this Review.

20.15 Resilience of Heathrow’s Electrical Power Supply – What Heathrow contracted to receive via
North Hyde

20.16 There were a number of levels to the resilience of Heathrow’s electrical power supply. The first level
of resilience for Heathrow was that (as described above at paragraph 8.3) it had three separate High
Voltage power supply points (or BSPs) to the Airport campus.

20.17 HV power distribution in the UK has a concept of N-1 contingency. This means if power is lost via
one asset, there is another asset that can immediately replace it to supply power. This is also known
as redundancy. Overall, Heathrow understood it had more than N-1 contingency at North Hyde – in
fact it understood that North Hyde BSP had N-2 contingency, because there was resilience both by
having multiple SGTs and multiple busbars in the way the HV supply point was configured.

20.18 Overall, Heathrow had assurance over its power supply from the North Hyde BSP before the incident
in the following ways:

20.18.1 First, Heathrow contracted to receive an import capacity (which is the amount of HV power
that could be supplied) from North Hyde that significantly exceeded what Heathrow needed
to power the parts of the Airport fed by this High Voltage power supply point.

20.18.2 The North Hyde BSP also offered resilient power to Heathrow in two key ways. First, it had
the benefit of three National Grid supergrid transformers (“SGTs”) feeding the SSEN
substation. Second, it had two 66kV busbars from the SSEN substation into the Heathrow
internal distribution network. This meant if one transformer failed another transformer
would be available to supply, in full, the power Heathrow needed from its Intake A; and if
one bar failed, the second bar had the capacity, in full, to facilitate the delivery of the HV
power into the Heathrow network.

20.18.3 Heathrow’s understanding of its North Hyde supply at the time of the incident is
summarised in the following diagram:

52
Kelly Review Report

Diagram 5

20.19 Would investment in completion of a 33kV High Voltage ring around Heathrow’s internal
distribution network have prevented or mitigated the effects of the outage on 21 March?

Switching activities on 21 March

20.20 Elsewhere in this Report our findings have explained how different BSPs or HV power supplies
supply power to different parts of the Airport campus. We have also examined the various switching
activities that took place on Heathrow’s internal distribution network on 21 March – first, to re-
energise the Airport on two of the BSPs in the morning of 21 March, when North Hyde was lost;
second, to prepare to re-energise the Airport on all three of the BSPs, when it appeared after about
13:00 on 21 March that North Hyde might return to a supply Heathrow considered sufficiently
resilient; and finally, to revert the configuration back to two of the BSPs after 22:30 on 21 March,
when Heathrow concluded that they could not be confident there would an adequate, resilient three
High Voltage Power Supply solution ready for the start of operations on 22 March.

20.21 Such reconfigurations of Heathrow’s internal distribution network inevitably impacted the time it took
for the Airport to be able to restore its full operations.

A 33kV HV Ring – Summary of issue

20.22 An alternative configuration to Heathrow’s internal electrical power distribution network would be the
completion of a full 33kV HV ring. This would feed the three current BSPs into a single distribution
circuit, which would power the entirety of the Heathrow campus. The advantage of this configuration
is that if there is a loss of power from one BSP, it is easier to pull additional power into the HV Ring
from the other BSPs.

20.23 Several Heathrow employees mentioned to the Review that the completion of the 33kV HV ring
formed part of Heathrow’s long-term energy resilience strategy, particularly related to the expansion
plan, but it was paused during the COVID-19 pandemic.

20.24 In light of our findings on the switching activities necessary on 21 March, the Review has undertaken
a preliminary examination of whether there were any missed opportunities to invest in the completion
of a 33kV High Voltage ring across its internal distribution network. Our comments on the 33kV HV

53
Kelly Review Report

Ring should be read in the context of our findings on Heathrow’s understanding of the resilience of
its existing network, as set out above at paragraphs 20.1 -20.7 and 20.15 - 20.18.3.

20.25 The Review has also considered the question of whether, had Heathrow had a full 33kV HV Ring,
this would have prevented or mitigated the effects of the outage at North Hyde on 21 March.

A 33kV HV Ring – Initial conclusions in relation to 21 March outage

20.26 Our initial conclusion is that a HV Ring would not likely have prevented the effects of the outage,
though it would likely have mitigated them by reducing the time the Airport would need to spend
switching between the BSPs.

20.27 For the purposes of this Review, over a condensed fact-finding period, we have not commissioned
technical reports on the level of additional resilience a HV Ring might have offered the Airport on 21
March based on its current configuration.

20.28 We have been provided with a provisional view from Heathrow’s technical team that a complete HV
Ring – based on how Heathrow is configured now with three intakes each supplied with power from
different BSPs - would not allow for an automatic or immediate switch between the current three
BSPs, partly because of the need to balance different voltages from these BSPs. If a power outage
occurred to one of the BSPs (such as occurred on 21 March), even if Heathrow had a full HV Ring it
is likely that some switching processes would still be required. However, we were told that the
switching required in such a case would be less complex and time-consuming than that required on
21 March in the absence of a complete HV Ring.

20.29 If a sudden power outage occurred and systems were not powered down in a controlled way (which
would not be possible in the event of a sudden outage unless every single relevant system was on
UPS), those systems would still need to be powered down before being re-energised in a controlled
way and then tested. Therefore, there could very well have been disruption to the Airport’s
operations, even if it had had a full HV Ring at the time of the 21 March incident.

Current investments and Heathrow’s status

20.30 Completion of the HV Ring has been a consideration across Heathrow’s strategies for additional
capacity, expansion and carbon, and how to meet the associated energy (and particularly electricity)
requirements. Work to provide a complete HV Ring at Heathrow would be a major project, requiring
significant network upgrades. Nevertheless, we have also received evidence that significant
preparatory work has recently been sanctioned which includes initial investment (approved in
November 2024 as part of the Airport’s carbon strategy) and planning activities.

20.31 Further feasibility work by Heathrow’s engineering and resilience teams should consider the
commercial and operational viability of a project of this kind. We refer to our recommendation that
the development of Heathrow’s utilities masterplan for the next five to seven years is undertaken as
a priority (see above at paragraph 20.13 and Recommendation 20). Initial very preliminary internal
estimates by the Airport have suggested costs in the order of or exceeding £1bn might be needed to
provide a complete HV Ring (in conjunction with future plans for the Airport to have a direct
connection onto the National Grid referenced below at paragraph 20.35). Further technical studies
on a HV Ring should be commissioned to report on the extent to which it might mitigate risks for the
Airport of a total loss of power from one of its High Voltage Power Supplies or reduce the time the
Airport would need to close in such an event.

Recommendation 21: further technical studies on an HV Ring should be commissioned to report on


the extent to which it might mitigate risks for the Airport of a total loss of power from one of its High
Voltage Power Supplies or reduce the time the Airport would need to close in such an event.

54
Kelly Review Report

20.32 Would investment in a direct connection to the National Grid have prevented or mitigated the
effects of the outage on 21 March?

20.33 Since 2023, the Airport’s long-term energy strategy has identified the need for a direct connection to
the National Grid and extension of the HV network. This is both to achieve net-zero goals and also
to future-proof operations against the anticipated substantial increases in electricity demand by the
mid-2030s as a result of increased electrification. In its risk assessments over the last year, the
Airport also recognised the need for significant work on energy network projects to address these
needs.

20.34 We were told that direct connection to the National Grid will enhance the Airport’s future energy
resilience. Based on evidence we have heard, we understand that the combination of a full HV ring
and a direct National Grid connection may enable Heathrow’s power networks to automatically
reconfigure in the event of a power outage to one HV power supply, thereby mitigating the risk of a
power outage and consequential disruption.

20.35 It has been explained to the Review that, in furtherance of its long-term energy strategy, Heathrow
has submitted an application to join the queue for a direct connection to the National Grid. This was
recommended to the HAHL Board in January 2025 and the HAHL Board approved the steps needed
for Heathrow to join the queue for this direct connection. However, it is understood that, under the
current process,34 a direct connection for Heathrow onto the National Grid may not become available
until 2037. In this context, Heathrow does not receive any priority treatment in relation to
enhancements to its energy resilience. Its protected site status will only apply in the highly unlikely
event of a national electricity supply emergency, where the Energy Secretary may implement the
Electricity Emergency Code.

20.36 Whether as part of future expansion plans or under Heathrow’s energy resilience and carbon
strategies generally, the HAHL Board will wish to consider the quantum and timing of investments to
increase resilience, including in relation to installing a full HV Ring. We note that any plans for
significant investments to upgrade or enhance the Airport’s electricity infrastructure will also need to
be included in a capital programme which has the overall approval of the CAA and the agreement of
airlines to individual projects.

Recommendation 22: we also recommend that Heathrow prioritises its engagement with its airline
partners and the CAA and other stakeholders around the need for investment in resilience, so that a
shared understanding can be reached on this topic as soon as possible, taking account of the
features of the Airport’s current infrastructure assets, its location and intensity of operations as well
as the various legitimate but competing needs for further investment.

21. COULD INVESTMENT RELATING TO HEATHROW’S BACK UP POWER (UPS AND


GENERATOR BACKUPS) AND OTHER IT RELATED INVESTMENTS HAVE MITIGATED THE
IMPACT OF THE NORTH HYDE POWER OUTAGE ON 21 MARCH?

21.1 This section contains our conclusions and recommendations about back-up power systems.

21.2 Uninterruptible Power Supply backups

21.3 In the early phases of the incident, as already noted, Command & Control personnel did not have a
full understanding of how some critical safety systems, such as Critical Safety System 1, Critical
Safety System 2 and Critical Safety System 3, had been affected by the power outage. These are
systems that have both an engineering and IT component.

34
Ofgem has recently approved a decision to reform the electricity grid connection process.

55
Kelly Review Report

21.4 We were told that some components of these systems have UPS. However, in relation to some
systems, either the failure of the network meant they could not be monitored remotely or power to
another component of the system was lost, and that component was not supported by UPS.

21.5 There was also a level of uncertainty in later stages of the incident, when power started to be
restored, on the extent to which Critical Safety System 1 systems continued to be affected in Terminal
5. Because incident response teams could not confirm that Critical Safety System 1 was safely
operating in Terminal 5, significant manual contingencies would have been required if Terminal 5
were to re-open fully. It appears to us that full reopening would have been impractical to achieve for
any significant volume of passenger operations on 21 March.

21.6 At about 03:30 on 21 March, Heathrow lost access to the capability to remotely connect to certain
systems (including parts of Remote Access System 1 that would have allowed the Engineering team
to remotely switch some parts of the high voltage system, which was a critical activity to restore
power to the whole Airport). This system may have been lost owing to overheating in a server room,
which was itself caused by loss of power to coolers and fans (see paragraph 12.5 above).

21.7 This is an example of the interdependencies between the assets for which IT and Engineering are
responsible. The IT team relies on the Engineering team for assets that keep Heathrow’s data centres
operational, such as power and air-conditioning chillers. The Engineering team relies on the IT team
for assets required for its operations, such as the network and servers. A lesson learned from this
incident is the need for systemised processes to ensure the continued sharing of knowledge of their
systems between the two teams (in particular relating to their respective risks). We were told that
this work is already underway.

21.8 Our overall conclusion on UPS is that further technical assessment is necessary. Having more
systems supported by UPS may have allowed those systems to be shut down in a controlled way
and mitigate the need for significant testing of those systems, potentially saving a small amount of
time. UPS on systems that gave visibility to APOC on which critical safety systems are functioning
and which are not (such as Critical Safety System 2 and Critical Safety System 2) may also have
aided decision-making during the incident.

21.9 However, we understand there may be practical challenges with installing further UPS. The Review
heard that due to the scale of Heathrow’s IT network, it would not be possible to have UPS on every
part of it, on an end-to-end basis. That would require an additional maintenance schedule that we
were told would not be possible to carry out. It might also require additional cooling systems to
facilitate the UPS, which existing infrastructure might not be able to accommodate. As we indicate
above at paragraphs 8.20 - 8.23, additional UPS on technology and engineering systems would not
likely have been sufficient to enable the Airport to operate on those power sources alone.
Nevertheless, we consider a study should be undertaken into the level of UPS at the Airport to identify
where enhancements can be achieved proportionately in relation to critical systems. This is included
in Recommendation 4.

21.10 We have also referred above to the time required to recharge UPS batteries during the incident (see
paragraphs 12.11 and 13.17). We recommend that Heathrow consider enhancements that can be
made to the recharging process for back-up power supplies, where applicable. This is included in
Recommendation 4.

21.11 Other sources of back-up power: diesel generators and other solutions such as large
industrial batteries

21.12 Given the scope of this Review, we have not considered from a technical perspective whether the
installation of additional diesel generators or large industrial battery back-ups would have mitigated
the impacts of the incident.

21.13 As noted above at paragraph 8.22, diesel generators already provide instantaneous back-up power
supply to the Airfield lighting and the Control Tower for up to seven days, which enables aircraft to
land in emergency situations. [This sentence has been reserved for security purposes.] As soon as

56
Kelly Review Report

a failure is detected in the power supply, the diesel generators engage. This allows the control
engineers to switch to the other supply without a power outage.

21.14 As described above at paragraph 13.3.3, to mitigate the risk of a power outage affecting critical safety
systems on the night of 21 March, Heathrow arranged for a generator to be brought to the Central
Terminal Area tunnel to supply back-up power. Given the importance of the Central Terminal Area
tunnel to the Airport, we recommend that, subject to assessment of feasibility and proportionality of
costs, consideration is given to the back-up generator for the tunnel being retained on a permanent
basis.

21.15 We heard from one engineering employee that the feasibility of installing diesel generators to cover
the entire energy needs of Heathrow would require careful consideration. As above, a detailed
technical assessment of the feasibility of diesel generators or other battery solutions as a back-up
power supply is beyond the scope of this review. However, we recommend that Heathrow
incorporate consideration of diesel generators and all other viable solutions as back-up power supply
in its utilities master planning, as described above at paragraphs 20.12 - 20.13. This should include
consideration of whether generator back-ups should be installed permanently at the Airport for
particularly critical infrastructure.

Recommendation 23: the Review Committee recommends that consideration is given to the
retention of the current back-up generator for the CTA Tunnel; and a report made to SORC on any
other areas of the Airport where further diesel generator or other battery back-ups could improve
resilience during critical incidents.

21.16 Ongoing IT Investment

21.17 This section of the Report addresses Heathrow’s ongoing investment in IT and has been reserved
for security purposes.

21.18 [This paragraph has been reserved for security purposes.]

21.19 [This paragraph has been reserved for security purposes.]

21.20 [This paragraph has been reserved for security purposes.]

21.21 [This paragraph has been reserved for security purposes.]

Recommendation 24: The Review Committee recommends that Heathrow proportionately


prioritises the areas for additional IT investment as set out in our Reserved Findings at paragraphs
21.18 - 21.21.

22. WAS THIS TYPE OF INCIDENT COVERED BY HEATHROW’S RISK ASSESSMENT


PROCESSES?

22.1 Introduction

22.2 Heathrow reports on its organisation-wide ‘Principal Risks’ in its Annual Report and Accounts for the
financial year ending 2024 (“ARA”). A Principal Risk is one that is identified as fundamentally
affecting the ability of the business to deliver on its overarching objectives. Heathrow assesses the
likelihood and impact of a Principal Risk materialising.

22.3 Risks are also identified at a functional level across Heathrow’s teams, for example, in the
Engineering team.

57
Kelly Review Report

22.4 Reporting of relevant risks at the time of the incident

22.5 The 2024 ARA statement on Principal Risks included a Principal Risk relevant to this incident, under
“Organisational Resilience”. The ARA noted that the potential causes of an organisational resilience
risk include a major critical event that leads to significant operational and business impact, as well
as resulting in significant disruption and potential closure of the Airport. The ARA identified that this
could result from one of many causes, including loss of resource and loss of a critical supplier or
service.

22.6 The incident on 21 March was a major critical event that involved the loss of a critical supply of
electricity. We have received confirmation from the business in the course of our Review that this is
therefore covered under the Organisational Resilience Principal Risk with the relevant cause set out
in the ARA being “'loss of a critical supplier or service”.

22.7 Heathrow’s internal risk assessment scoring for a major critical or disruptive event of this kind was
to rate it as having a high impact but low likelihood.

22.8 Further initial commentary on major critical event risks

22.9 The key controls and mitigations relating to a major critical event are listed in the ARA. These mirror
to a significant extent those that were deployed in this incident or enabled Heathrow’s successful
response to the incident. We discuss a number of these relevant controls and mitigations in other
sections of this Report. A summary of how the ARA lists these controls and mitigations is as follows:

(a) Mitigation and contingency planning with development of a series of plans that
can be deployed in the event of a disruption.

(b) Exercising (i.e. scenario-based practice exercises) and post incident review,
which supports increased preparedness and continuous improvement of
Heathrow’s incident response.

(c) Command & Control aligned to the UK standard of Integrated Emergency


Management for disruptive events and aligns with industry best practice by
adopting the JESIP Principles (as discussed elsewhere in this Report).

(d) Collaboration with key partners to develop joint contingency plans.

(e) The APOC facility which brings together the operational planning, monitoring and
day-to-day oversight of Heathrow with its service partners.

(f) End-to-end understanding by taking a holistic approach to resilience, considering


the upstream and downstream impacts of a disruption to support wider
organisational resilience.

22.10 We note that Heathrow’s published risk reporting does not specify all potential vulnerabilities that
may relate to its assets, operations and supply arrangements where there could be a major critical
event. We observe this might be impractical because the Airport has such a large asset base and
complex operations, as well as there being assets or events outside of its direct control or ownership
that could lead to a major critical event. However, we also understand that a key reason the Airport
does not share specific areas in detail in its ARA is because the security and safety considerations
inherent in reporting on the potential root or underlying causes of major critical events. For similar
reasons, we understand details of the Airport’s specific controls and mitigations are not published.

Key finding 15: the risk of a power outage as a result of the configuration and resilience of
Heathrow’s internal distribution network had been identified by Heathrow and appropriate mitigations
and contingency plans had been in place at the time of the incident on 21 March.

58
Kelly Review Report

22.11 Summary of further observations on awareness of risks relating to a power outage at time of
incident

22.12 The Review heard from colleagues about Heathrow’s awareness of the risk of a loss of HV electricity
supply to the Airport.

22.13 In summary, the risk of a major disruptive event was categorised as a high impact but low likelihood
risk. One person we spoke to described it as a one in 100-year type of event. The risk of a total loss
of supply from North Hyde was considered a low likelihood risk for a number of reasons. The Review
heard that the source of HV power at North Hyde was considered to be resilient (see above at
paragraphs 20.15 - 20.18.3). There would need to be an unprecedented failure of that entire power
source for a major disruptive event to arise for the Airport. Some personnel considered North Hyde
should not be categorised as a single point of failure for the Airport because of the resilient supply it
provided via multiple SGTs as well as the two busbar lines into Heathrow’s internal power distribution
network.

22.14 The high impact of a total HV power supply failure was understood by relevant functions.

22.15 The full consequences of a total HV power supply failure through one intake were less well-known
by other relevant Heathrow personnel in advance of the incident. In particular:

22.15.1 With the exception of some specialists in relevant Engineering functions, most personnel
with whom we spoke were not aware prior to the incident that a total loss of power from an
HV intake might involve the Airport losing operations for at least eight hours whilst switching
processes, re-energising of assets and systems and safety testing were carried out. Given
the large number of functional risks that exist across a business like Heathrow, there may
be practical questions relating to whether the precise timing consequences of all types of
those functional risks can be more widely understood outside of the functions to which
those Principal Risks relate. However, we consider there is a need to facilitate greater
focus at Executive and Board level on “red flag” risks, i.e. those that are low likelihood but
which could have a significant disruptive effect on the Airport’s operations. More in depth
discussions of the risk of power outage could have identified the length of time that
operations would be disrupted. See our outline recommendations for enhancements here.

22.15.2 The precise interdependencies between Engineering and IT assets that would be affected
during a power outage of this scale were also less well known prior to the incident, which
informs some of our outline recommendations too.

22.16 Our outline observations and recommendations on risk-related topics are as follows:

22.16.1 Heathrow’s risk and assurance team should continue their planned work to enhance the
visibility of functional risks up to and including board level. In particular, Heathrow should
further elevate high impact, low likelihood functional risks to the Executive Committee for
periodic discussion of the overall operational consequences involved and decision on
whether current controls and mitigations are adequate. Additional resources should be
allocated to this as necessary.

22.16.2 Within Heathrow’s risk management processes, there should be enhanced visibility at the
Audit Committee and SORC levels of high impact functional risks as a further line of
defence (including those with low likelihood). We were told this work is already underway.

22.16.3 To build on ongoing and planned work, we would recommend:

(a) Consideration is given to processes between functions to share insights into each
other’s functional risks horizontally where these might impact wider parts of the

59
Kelly Review Report

Airport outside of one function. This will help to better evaluate the operational
consequences of a risk and to identify enhancements to risk mitigation measures
for critical assets, services or operations where there are interdependencies,
similar to those seen in this incident in relation to engineering and IT related
assets.

(b) Central collation of key potential single points of failure across the Airport so the
existing controls and mitigations for these are quickly visible to everyone involved
in the Airport’s risk management processes. These can then be regularly kept
under review through the appropriate structures in Heathrow’s risk management
system.

(c) Similar to the joint contingency arrangements it has with emergency services, the
Operational Resilience team should consider opportunities to apply similar
principles to arrangements with critical utility suppliers. Part of this work may also
enable a deeper mutual understanding of each entity’s dependencies and risk
assessments, controls and mitigations. We do not consider these steps would
have avoided the consequences of the outage on 21 March but they may help to
ensure alignment and to enhance suppliers’ understanding of Heathrow’s needs
in respect of the resilience of its utilities supply and to enhance Heathrow’s
understanding of suppliers’ own resilience to deliver the supplies upon which
Heathrow is reliant. They may also improve how the Airport responds to critical
incidents collaboratively with relevant members of its supplier base.

Engineering functional risk register

22.17 The Engineering functional risk register at the time of the incident captured a large volume of risks.
Some of those relevant to the incident were highlighted to the Review in our fact-finding. Because
the functional risk register contains details of specific assets and locations this has been reserved
for security purposes.

22.18 One of these functional risks related to the Airport’s incomplete HV 33kV Ring:

22.18.1 [This paragraph has been reserved for security purposes.]

22.18.2 [This paragraph has been reserved for security purposes.]

22.18.3 The risk was included on the Engineering team register and rated as having a high impact
and a high likelihood. However, following enquiries made within the Engineering team, the
Review has been told that the risk was scored and described incorrectly at the time it was
identified in November 2024 and entered on to the register in March 2025 and should have
been recorded as a high impact but low likelihood risk.

22.18.4 We are therefore satisfied that this entry on the functional risk register does not contradict
the other evidence we have received in the Review that categorised a loss of HV power as
a high impact, low likelihood event.

Earlier identification of risks relating to the HV Ring

22.19 In the course of our Review, we have considered the findings of a prior internal review of Heathrow’s
resilience, across all areas of its assets, infrastructure and operations. A paper on the internal review
was presented to the Executive Committee in November 2021. It included a section entitled “Utility
resilience for the future”. Part of this considered forward-looking trends related to the Airport’s
resilience of HV electrical supply. A relevant extract of the review (part of which has been reserved
for security reasons) on this is as follows:

60
Kelly Review Report

“The resilience of our HV electrical supply is likely to be more important as the national
grid shifts from a centralised generation network to decentralised. Specifically, further
work is needed to complete the 33kv ring to allow switching of the airport load between
diverse incoming supplies. [The remainder of this paragraph has been reserved for
security purposes.]

22.20 Following the presentation to the Executive Committee in November 2021, a simplified version of the
internal review findings was circulated to the HAHL Board in April 2022 and it was also considered
by SORC in May 2022. Papers prepared for the SORC meeting reflect that there was ongoing
consideration at the time of the electrical resilience questions raised by the 2021 internal review. An
appendix to a paper on next steps following the internal review noted the following on the utilities
resilience topic:

“There are many opportunities to increase the resilience of the airport, many of which
were due to be explored through Expansion. Whilst all current risks are believed to be
mitigated, the work on Masterplanning and Resilience should consider these
opportunities which would then need to be prioritised within the existing Asset
Management Programme.”

22.21 SORC minutes for the May 2022 meeting record a number of next steps in relation to investment
decision-making on matters relating to the 2021 internal review.

22.22 See also our commentary above on investment issues relating to the completion of the 33kV Ring
as part of ongoing work by the Airport on its energy resilience, carbon strategy and master planning
at paragraphs 20.19 - 20.31.

22.23 Other preparedness for a power outage event

22.24 We have referred above at paragraph 16ff to the contingency plans that were deployed on 21 March
to deal with the incident. These plans were critical to Heathrow’s ability to recover in the way that it
did.

22.25 Heathrow also ran an in-depth resilience training exercise in 2023 on the risk of a National Power
Outage (“NPO”), which in addition to Heathrow employees was attended by stakeholders from the
Airport community and emergency services. This exercise was designed by engineering resilience
specialists at Heathrow.

22.26 A report relating to the NPO was produced in November 2024 as a result of this exercise, containing
recommendations on communications, technology and other resilience measures.

22.27 This exercise had raised the profile of power resilience issues at the Airport, although the scenario
of an NPO was very different from the nature of the incident on 21 March.

22.28 We recommend the Executive Committee considers that the NPO report’s recommendations
alongside those from this Review.

22.29 Opportunities should continue to be sought by the Heathrow Operational Resilience team to design
and carry out similar preparedness exercises with Heathrow’s stakeholders and suppliers as part of
ongoing best practice and in line with mitigations identified to manage the risk of future major
disruptive events.

Recommendation 25: we recommend that Heathrow’s risk and assurance team continue their
planned work to enhance the visibility of functional risks up to and including board level, and that
additional resources are allocated to this as necessary. In particular, we recommend:

a) Heathrow further elevate high impact, low likelihood functional risks, as well as any high
impact risks that might involve potential single points of failure, to the Executive Committee

61
Kelly Review Report

for periodic discussion of the total operational consequences involved and decision on
whether current controls and mitigations are adequate;

b) there should be enhanced visibility at the Audit Committee and at SORC of the above
assessments, so this information can inform wider decision-making by these committees
as appropriate;

c) consideration is given to establishing processes between functions to share insights into


each other’s functional risks horizontally where these might impact wider parts of the Airport
outside of one function.

Recommendation 26: we recommend that the Operational Resilience team consider opportunities
to share information relating to risk identification with critical utility suppliers.

Recommendation 27: we recommend the Executive Committee considers recommendations


arising from a prior multi-party power outage preparedness exercise to review whether there are any
additional relevant learnings that fall outside the recommendations of this Report and that it updates
SORC on any proposed next steps. Opportunities should continue to be sought by the Heathrow
Operational Resilience team to design or participate in similar preparedness exercises with internal
and external stakeholders and suppliers as part of ongoing best practice and in line with mitigations
identified to manage the risk of future major critical events.

General Recommendation 28: Certain recommendations in the Report have referred to the need
for additional resources. These references are non-exhaustive. The Executive team should consider
this Report in full and provide a report to the Board on Heathrow’s resource requirements to carry
out all of the Recommendations.

62
Kelly Review Report

23. CONCLUSION

The incident on 21 March involved a fast-moving and unprecedented set of circumstances.

We have concluded that the Airport responded well on the day and was able to restore full operations smoothly
the following day. The Review has, however, identified a number of lessons learned and makes several
recommendations on how the Airport should now further enhance its ability to respond to major incidents such
as this one.

These are also designed to assist Heathrow to fulfil its stated commitments in relation to the renewal
and enhancement of its infrastructure resilience, within the constraints of how the Airport has developed over
75 years, the relative challenges of Heathrow, particularly in relation to its size and very high use, compared
with other airports, and the various other priorities for investment.

There is clearly an opportunity for the Airport to engage in greater depth with airlines and its other key
stakeholders on these questions and others. The Airport owes gratitude to passengers, to its airline customers,
to Team Heathrow (including those partners who worked with Heathrow colleagues during the incident) and
to its other stakeholders for all their patience and assistance, which no doubt contributed to reducing the impact
of the disruption on aviation across the world.

Finally, the Review Committee also would wish to recognise the efforts and hard work of all Heathrow
employees who supported the Airport on 21 March and its subsequent return to full operations.

63
Kelly Review Report

APPENDIX 1 – LIST OF KEY FINDINGS AND RECOMMENDATIONS

KEY FINDINGS

Decision to stop operations

1 The decision to stop operations was the only reasonable decision available in the circumstances.
It was made with safety and security as the foremost considerations. Given these are reasonable
considerations and it was correct for them to be prioritised, it follows that there was no alternative
to closing the Airport.

2 The decision to stop operations until 23:59 on 21 March was a prudent and well-reasoned decision
based on the circumstances at that point in time. It was made with safety as the primary objective.

Decisions regarding restoring power supply

3 The decision to reconfigure Heathrow’s electricity distribution to two supplies was the only
reasonable decision available in the circumstances given the need to restore resilient power to the
Airport. The decision was then executed as promptly as possible.

4 The decision to reconfigure the network to revert to the normal three-supply configuration was
reasonably made with the objective of ensuring the Airport had the most resilient power supply
available, including over the longer term. While this decision may have extended the time in which
operations were stopped for parts of the Airport by a matter of a few hours, a different decision
would not have resulted in a significantly larger number of flights being operated on 21 March
2025. We consider the decision was nevertheless the correct one.

5 The decision to cancel the planned reversion to the three-supply configuration and maintain the
two-supply configuration was reasonably made on the basis of a lack of availability of a resilient
supply at North Hyde.

Reopening of the Airport

6 The time taken to restart operations at Terminals 3 and 5 was driven by the need to restore critical
safety systems, on the basis it was not considered safe to operate the Airport with manual
contingencies in place. These systems were confirmed as tested and restored by 13:00 and at
14:00 Heathrow announced on a Community Call that it would begin accepting flights from 16:00.
Between 10:00am and 12:30pm, discussion and consideration of the opportunity to convert back
to the three supply configuration may have delayed the reopening of Terminals 3 and 5 by a
maximum of a couple of hours or so. We do not find the time spent on this assessment to be
unreasonable, given the complexity of this issue. Any such delay may not have impacted the time
taken to test and restore the critical safety systems, which were the key issue in reopening
Terminals 3 and 5. Standing up cumulatively a number of manual contingencies had practical and
risk consequences – especially in order to handle any normal volume of passengers through a
terminal building.

7 The decision to prioritise repositioning and repatriation flights was a reasonable decision in the
circumstances and was coordinated with airlines as far as practicable. While it was reasonable in
light of the safety objective not to open for full operations, Heathrow kept under review whether it
could operate additional flights, which it did by operating eight departure flights with passengers.

8 Heathrow relied on information from SSEN to make a reasoned decision to revert to its most
resilient network configuration. This may have delayed the point at which Heathrow could resume
full operations because of the work required to prepare for this reconfiguration. We have

64
Kelly Review Report

addressed the reasonableness of the decision to revert to the three-supply configuration in our
findings above at Key Finding 4.

Role of CEO overnight on 20/21 March 2025

9 Heathrow’s CEO Mr Woldbye was not aware of the incident in the early hours of 21 March as he
was not alerted to the F24 notifications or to Mr Echave’s calls, but this had no impact on the
decisions made between 00:21 – 06:45.

Whether Heathrow Command & Control operated effectively

10 The Command & Control structure operated effectively during the incident by empowering those
with technical and operational expertise to make decisions. The primary guiding objective for
these decisions was ensuring safety.

Contingency plans deployed during incident

11 A large number of contingency plans were activated during the incident and in general these
worked well, although we found some areas where improvements would be possible in the light of
lessons learned. Lessons learned from different teams should be collated and presented to SORC.
None of our findings on contingency plans suggests there could have been a different outcome
on the day or a different timeframe for recovery if there had been any additional plans.

Communications

12 Communications during the incident were clear and consistent and built on lessons learned from
the 2010 snow event.

Impact on people in terminal buildings during incident

13 No injuries were reported as a result of the incident, however reports were received of Heathrow
employees operating in Terminal 2 without access to lighting and other facilities during the night
of 21 March.

Organisational resilience - people

14 Heathrow had a sufficient number of highly qualified and trained staff available to deal with the
incident on 21 March. Their efforts prevented the disruption from being worse and lessened the
effect on the operation of the Airport in the days that followed.

Identification of risks

15 The risk of a power outage as a result of the configuration and resilience of Heathrow’s internal
distribution network had been identified by Heathrow and appropriate mitigations and contingency
plans had been in place at the time of the incident on 21 March.

65
Kelly Review Report

RECOMMENDATIONS

Communications during critical incident involving third-party supplier

1 Where the Airport is facing a critical incident that involves a third-party supplier, and there is a
significant impact to Heathrow, there should be regular communication between relevant
Heathrow contact points and that supplier over the course of the critical incident, as a precaution
in case additional information from the supplier impacts situational awareness. This may also help
ensure they are receiving timely updates from the relevant supplier of any change of position.

Relationships with critical suppliers

2 The Heathrow Executive Team should consider enhancements to the commonality of


understanding between Heathrow and SSEN and development of the relationship with SSEN at a
senior level, including the considerations set out in paragraph 12.23 of the Report. Equivalent
considerations should apply to Heathrow’s relationship with National Grid and all other critical
suppliers, to the extent appropriate and where this improves all parties’ overall understanding and
preparedness for critical incidents where each are impacted.

Critical Safety Systems and Uninterruptible Power Supply back-ups

3 The Review Committee recommends that Heathrow review and, if possible, enhance its ability to
monitor whether critical safety systems are operational following a power outage.

4 Due to the importance of these critical safety systems if there is a major disruptive event at the
Airport, the Review recommends that Heathrow implements a review into the effectiveness of
back-up power supplies for these systems (including how long the supplies last) to establish if
enhancements are reasonably practicable. Heathrow should also review which similar
enhancements to UPS (or the recharging of UPS) are proportionate and practical to implement for
any other operational systems.

The results of these review(s) should be reported to SORC.

5 The Review Committee recommends that Heathrow develop a list of all critical safety systems for
which power is supplied by each High Voltage intake, building on the lessons learned from this
incident for North Hyde.

System for notification of incidents to key individuals

6 The Review Committee recommends that Heathrow consider enhancements that can be made to
the notification process of a critical incident (in addition to F24 calls), including options for notifying
key individuals via a second means of contact for significant incidents. Heathrow has already
taken steps to implement these enhancements since the incident.

Command & Control

7 The Review Committee recommends that Heathrow determine the most appropriate model for
rostering Gold Commander shifts that ensures adequate resilience in the event of an incident of
longer than 12 hours duration.

8 To enhance training, the Review Committee recommends that:

a) Gold Commander training records are formalised and held by the Operational Resilience
team;

66
Kelly Review Report

b) compulsory elements of training programmes for postholders in Gold Command are


clarified and Gold Commanders should attend regular training;

c) Heathrow consider whether measures to upskill those in Command & Control on


technology systems can be incorporated into training programmes;

d) compulsory training is provided on recording minutes of meetings.

9 The Review Committee recommends that policy documentation is updated:

a) to enhance guidance on the decision-making responsibilities of Gold Commander, CEO


and COO in critical incidents

b) to provide guidance on identifying subject-matter expertise that may be beneficial during


an incident.

c) to include guidance on maintaining resilience in Gold Command during prolonged


incidents.

d) to clarify that draft minutes should be provided to Gold Commanders as soon as


practicable and in any event within 24 hours of an incident’s conclusion for finalisation as
an agreed record.

10 The Review Committee recommends that Heathrow review its procedures relating to the number
of people permitted into APOC during an incident and the designation of break-out spaces for
specific recovery aspects to ensure that the Command & Control teams can work in the most
effective way possible.

11 The Review Committee recommends that relevant incident management and operational
resilience plans are reviewed and updated as necessary to take account of learnings from the
incident and as part of continual improvement of policy documentation.

12 The Review Committee recommends that Heathrow considers whether amendments are required
to Heathrow’s Command & Control framework based on any relevant updates to best practice
guidance and any consultation with Heathrow’s stakeholders in emergency services as
appropriate.

Incident response feedback and evaluation and contingency plans

13 The Operational Resilience team, together with the COO, should coordinate the preparation of a
single report to SORC on the different incident response teams’ post-event feedback and
evaluation sessions and any specific enhancements to written contingency plans that have been
identified as lessons learned.

14 The Engineering team should consider whether a contingency plan for wider internal network
switching activities (after the UKPNS 33kV substation switching plan is enacted) would be useful
and possible to document, taking account of any lessons learned during this incident.

15 Following the work undertaken by the Duty AOM and others in APOC during the first 90 minutes
of the incident response, consideration should be given to whether the steps taken and situational
awareness enquiries made on the night can be documented into a useful checklist or guidance
document for APOC personnel for future use, either in the event of a power failure or other
equivalent incidents (such as utility failures).

16 We recommend the ongoing post-incident review being undertaken by IT personnel considers,


amongst other matters:

67
Kelly Review Report

a) whether IT contingency plans relevant to a loss of power event could be strengthened.


These might include plans:

i. that are jointly developed with supply chain partners who are likely to be
involved in handling critical incidents;

ii. that identify which High Voltage intakes power the various IT systems;

b) how information retained on the status of UPS assets and their back up lifespan can be
updated or enhanced (including on any registers, schedules and other records); and

c) whether there are particular learning points for specific IT systems that were impacted by
the power outage.

Communications

17 We recommend that the Operational Resilience team consider if there is a proportionate solution
to provide specific real-time updates to Here to Help and other Heathrow staff members in the
recovery phase of critical incidents. This might be done on a location-by-location basis for different
Terminals so the most up-to-date information can be provided to passengers and other members
of the public in terminal buildings, when other systems such as flight information display systems
may not yet have been restored to full functionality.

People in terminal buildings during incident

18 We recommend that the COO conducts a review to understand how many people were impacted
by the lack of lighting and other facilities in Terminal 2, whether emergency lighting was working
as it should or whether back-up power supplies had drained, and whether there are gaps in
emergency lighting coverage in corridors. A copy of the COO’s report should be provided to
SORC. The report should consider whether any amendments are required to any contingency
plans in respect of evacuation protocols or if any enhancements are needed on welfare checks
during critical incidents.

Organisational resilience – people

19 The Review Committee recommends that the Chief People Officer consider whether any action is
needed in relation to post-incident wellbeing. We recommend that the Chief People Officer seeks
views from those involved on 21 March on whether there are changes that Heathrow could
appropriately make to support them more effectively during such an incident.

Planning for investment

20 We recommend that the planned work to develop a utilities masterplan is undertaken as a priority
with appropriate additional resources being given to relevant teams for this exercise.

21 Further technical studies on an HV Ring should be commissioned to report on the extent to which
it might mitigate risks for the Airport of a total loss of power from one of its High Voltage Power
Supplies or reduce the time the Airport would need to close in such an event.

22 We also recommend that Heathrow prioritises its engagement with its airline partners and the CAA
and other stakeholders around the need for investment in resilience, so that a shared
understanding can be reached on this topic as soon as possible, taking account of the features of
the Airport’s current infrastructure assets, its location and intensity of operations as well as the
various legitimate but competing needs for further investment.

68
Kelly Review Report

Generator or battery back-ups

23 The Review Committee recommends that consideration is given to the retention of the current
back-up generator for the CTA Tunnel; and a report made to SORC on any other areas of the
Airport where further diesel generator or other battery back-ups could improve resilience during
critical incidents.

Ongoing IT investment

24 The Review Committee recommends that Heathrow proportionately prioritises the areas for
additional IT investment as set out in our Reserved Findings at paragraphs 21.18 - 21.21.

Risk processes

25 We recommend that Heathrow’s risk and assurance team continue their planned work to enhance
the visibility of functional risks up to and including board level, and that additional resources are
allocated to this as necessary. In particular, we recommend:

a) Heathrow further elevate high impact, low likelihood functional risks, as well as any high
impact risks that might involve potential single points of failure, to the Executive
Committee for periodic discussion of the total operational consequences involved and
decision on whether current controls and mitigations are adequate;

b) there should be enhanced visibility at the Audit Committee and at SORC of the above
assessments, so this information can inform wider decision-making by these committees
as appropriate;

c) consideration is given to establishing processes between functions to share insights into


each other’s functional risks horizontally where these might impact wider parts of the
Airport outside of one function.

26 We recommend that the Operational Resilience team consider opportunities to share information
relating to risk identification with critical utility suppliers.

27 We recommend the Executive Committee considers recommendations arising from a prior multi-
party power outage preparedness exercise to review whether there are any additional relevant
learnings that fall outside the recommendations of this Report and that it updates SORC on any
proposed next steps. Opportunities should continue to be sought by the Heathrow Operational
Resilience team to design or participate in similar preparedness exercises with internal and
external stakeholders and suppliers as part of ongoing best practice and in line with mitigations
identified to manage the risk of future major critical events.

Resourcing

28 Certain recommendations in the Report have referred to the need for additional resources. These
references are non-exhaustive. The Executive team should consider this Report in full and provide
a report to the Board on Heathrow’s resource requirements in order to put the Recommendations
into effect.

69
Kelly Review Report

APPENDIX 2 – GLOSSARY OF TERMS USED IN REPORT

ACE Heathrow Airport Control Engineer

Airport Heathrow Airport

AOC Heathrow AOC Limited (also known as Airline Operators


Committee)

AOM / Duty AOM (Duty) Airport Operations Manager

APOC Airport Operations Control Centre.

ARA Heathrow Airport Holdings Limited’s Annual Report and Accounts


for the financial year ending 2024

Begg Report Report of the Heathrow Winter Resilience Enquiry (2011), chaired
by Professor David Begg

Bronze Command The command team in Heathrow’s Command & Control structure
that focuses on the operational level

BSP Bulk Supply Point

CAA UK Civil Aviation Authority

CEO Chief Executive Officer, Thomas Woldbye

Command & Control The Heathrow structure to manage an incident

Community Call Calls held on Microsoft Teams during Heathrow incidents, which
members of the airport community can join

COO Chief Operating Officer, Javier Echave

CTA Tunnel The Central Terminal Area Tunnel, connecting the Central
Terminal Area to the M25 and M4 spur

JESIP Emergency Services Joint Emergency Services Interoperability


Principle

F24 The system used to carry out the activation of on call teams in
Heathrow’s Command & Control structure

Gold Command The command team in Heathrow’s Command & Control structure
that focuses on the strategic level decision-making, external
communications, and actions

GSP Grid Supply Point

HAHL Heathrow Airport Holdings Limited

Here to Help Volunteer initiative organised by Heathrow by which Heathrow


employees attend terminals to liaise with, and provide assistance
to, passengers

70
Kelly Review Report

HV High Voltage

NESO National Energy System Operator

NGET National Grid Electricity Transmission PLC

NOTAM Notice to Aviation, a notice containing information concerning the


establishment, condition or change in any aeronautical facility,
service, procedure or hazard

Review Committee The Kelly Review Committee comprising Ruth Kelly, Joan
MacNaughton and Mark Brooker

SGT Supergrid transformer

Silver Command The command team in Heathrow’s Command & Control structure
that focuses on the tactical level and airport-wide communications

SORC Heathrow’s Sustainability and Operational Risk Committee

SSEN Scottish and Southern Electricity Networks

Team Heathrow Collective name for Heathrow partners including airlines, ground
handlers and retailers

UKPNS UK Power Networks Services

UPS Uninterruptible Power Supply

71
Kelly Review Report

APPENDIX 3 – TERMS OF REFERENCE

TITLE: Kelly Review Board Committee

FREQUENCY: Temporary committee to meet as determined by the Chair

CHAIR: Ruth Kelly, Independent Non-Executive Board member

MEMBERS: 1. Ruth Kelly, Independent Non-Executive Board member

2. Joan MacNaughton, Independent Non-Executive Board member

3. Mark Brooker, Independent Non-Executive Board member

TERMS OF REFERENCE:

Authority:

1. HAHL has commissioned an internal review (the “Review”) of circumstances related to the closure of
Heathrow airport (the “Airport”) on 21 March 2025.

2. The Board of Directors of HAHL (the “Board”) has authorised that the Review be carried out by a
special committee of the Board (the “Committee”) chaired by Ruth Kelly, an Independent Non-
Executive Board Member and, inter alia, former Secretary of State for Transport.

Objectives:

3. The outcomes of the Review will be:

a) to determine the chronology of events leading to the closure of the Airport, the immediate and
identifiable impact on stakeholders on the day of the closure and then the chronology of events
leading to the Airport’s subsequent recovery after the incident;

b) to determine the causes of the closure of the Airport;

c) to determine and evaluate the decision-making processes that led to the closure of the Airport;
and whether any reasonable steps were available that might have prevented the Airport from
closing or otherwise have mitigated the impact of the power outage;

d) to determine whether any immediate improvements are recommended to the Airport’s


preparedness, response planning and wider resilience in the event of any future serious power
outage; and

e) to provide such other recommendations as the Committee considers practicable, in the context of
this Review and with regard to potential improvements at the Airport, to enable more detailed
further consideration, planning and/or follow up actions (as might be applicable) after the
conclusion of the Review.

Reporting:

4. At the conclusion of the Review, the Committee shall produce a written report (the "Report") which
shall be provided to the Board which it is anticipated will be within 4 weeks of the commencement of
the Review.

72
Kelly Review Report

5. The Committee and Chair will be supported by Heathrow’s in-house legal team and Heathrow’s
external lawyers, Pinsent Masons LLP.

These Terms of Reference will be kept under review and may be amended by agreement of the Board.

Annex to the Terms of Reference – Confidentiality, Privacy and Privilege

1. To discharge legal duties under data protection law and the duty of trust and confidence owed by
employer to employee, the Committee shall keep confidential all confidential information disclosed as
a result of the Review and shall not use nor disclose the same save as provided in this Annex or as
required by law.

2. Any legal advice or reports from in-house or external lawyers are privileged and it is a matter for HAHL
whether privilege is asserted or waived.

3. Subject to the approval of the Board, the findings of the Review may made public subject to any
relevant legal considerations.

4. Personal data (i.e. data from which a person may be identified) will not be included in any published
report without the express consent of the person in question.

5. Persons providing information to the Committee for the purposes of the Review are encouraged to do
so in an open and "on the record" basis. This will help the Committee to reach fully informed
conclusions by enabling the Committee to put information and concerns to other persons for their
consideration and comment.

6. Should a person who wishes to provide information request to speak with the Committee and/or the
Chair in confidence, the Committee will proceed on a confidential basis but in the event that civil
proceedings or an inquiry (governmental, public or regulatory) concerning any matter that was the
subject of the Review, HAHL and the Committee may be required to disclose the information provided.

73
Kelly Review Report

APPENDIX 4 – REVIEW COMMITTEE BIOGRAPHIES

Rt. Hon Ruth Kelly

Rt. Hon Ruth Kelly has previously held UK Government roles including Secretary of State for
Transport; Secretary of State for Communities and Local Government; and Secretary of State for
Education and Skills. She has also held ministerial roles at the Cabinet Office and HM Treasury.
Following her political career, Ms Kelly has held positions as Global Head of Client Strategy at HSBC
Global Asset Management and as Pro-Vice Chancellor for Research and Enterprise at St Mary's
University, Twickenham.

Ms Kelly was appointed as an Independent Non-Executive Director at Heathrow in April 2019. Ms


Kelly is Chair of the Audit Committee and also sits on the Sustainability and Operational Risk
Committee and Finance Committee. In addition, Ms Kelly is Chair of Water UK and Chair of Thames
Freeport.

Joan MacNaughton CB

Ms MacNaughton has extensive board experience in industry, government, academia and the third
sector. After a career in government culminating as the senior official responsible for energy policy
in the UK, she spent five years in a power sector company. She has wide international experience,
including as Chair of the International Energy Agency and Chair of the World Energy Council
Trilemma. She is currently a non-executive member of the Thames Freeport Governing Board,
where she chairs the Innovation and Net Zero committee; and Chair of the Clean Growth Leadership
Network. She has public procurement, health and safety, regulatory and ED&I experience at Board
level.

Ms MacNaughton was appointed as an Independent Non-Executive Director at Heathrow in June


2021. Ms MacNaughton is Chair of the Sustainability and Operational Risk Committee.

Mark Brooker

During his executive career, Mr Brooker held roles including Chief Operating Officer for Trainline,
and Chief Operating Officer of Betfair Group plc. Prior to these roles, Mr Brooker spent 17 years in
investment banking, working for Morgan Stanley, Merrill Lynch, NatWest and NM Rothschild & Sons.
Mr Brooker’s currently holds non-executive roles at: eCogra (as Chairman); Resi (as Chairman);
Future plc; and Paysafe. Prior to these roles, Mr Brooker’s held non-executive posts at: Equiniti,
William Hill, the AA, and Findmypast. Mr Brooker holds a Master’s Degree in Engineering,
Economics and Management from Oxford University.

Mr Brooker was appointed as an Independent Non-Executive Director at Heathrow in April 2022. Mr


Brooker sits on the Remuneration Committee and the Sustainability and Operational Risk
Committee.

74
Kelly Review Report

APPENDIX 5 - RESERVED – KEY TO REFERENCES TO RESERVED MATTERS

[This appendix has been reserved for security purposes.]

75

You might also like