andrelaszlo 9 hours ago

Funny, similar patterns are super common in API traffic. A large spike at midnight UTC, a smaller one every hour, even smaller ones every 15 minutes, and a little bump every minute if your metrics have enough resolution. Of course, if someone calls your API every minute you should probably consider some kind of streaming, or at least include make the request cheap by requiring a cursor of some kind.

  • pumba_noob 8 hours ago

    Same here. We see this kind of spikes in our tunnel traffic also - every hour and specially at midnight UTC. Cron jobs everywhere :)

  • catlifeonmars 6 hours ago

    > and a little bump every minute if your metrics have enough resolution

    Amusingly, you can also observe periodic bumps if your metrics don’t have enough resolution, due to aliasing effects dominating signal (guestures vaguely at Nyquist frequency).

    • IAmBroom 6 hours ago

      By definition, if you can see effects then the metrics have enough resolution.

      The specific resolution is the Nyquist frequency - that part is accurate.

      • formerly_proven 6 hours ago

        Sampling metrics is sampling and leads to aliasing.

        Similarly, sample count/interval limits in tsdbs like prometheus are not downsampling. They're just skipping samples. This also creates aliasing. Can be very noticeable especially if you combine it with rate/derivative functions.

  • nottorp 5 hours ago

    I've just convinced my team to be nice and add a random delay for all those periodic checks in our software last week :)

    Yes of course, there was the check at 2 am local time before ...

    • InsidiousWombat 4 hours ago

      Just adding random shift of the duration of the check already will get you uniform distribution

  • cortesoft 3 hours ago

    Yeah, adding 'jitter' for periodic tasks that make remote requests was standard procedure when I worked for a large CDN. Every cron entry on every server would run with a delay of between 0 and 59 seconds, based on a hash of the server name. You basically 60x your internal infrastructure capacity by doing this (depending on how long the request takes to serve, of course, as well as a few other factors)

    That, exponential backoffs, and local cache for external resources needed to operate the CDN (such as configuration) were the foundation of running a large network reliably.

  • sehugg 3 hours ago

    Even more important if your devices are dialing into a modem bank. We spent a lot of time designing retry schedules and such when I worked on these (ironically for energy storage/demand management devices)

schobi 14 hours ago

The press release is rather light on details. They found that it is every 60seconds (duh!) and generators (or such). So what exactly is it? (Make and model?)

Seems like they did not find the exact manufacturer or the exact devices and were not able to change firmware then?

  • manarth 13 hours ago

    The paper has a little more details:

      "following our communication with the manufacturer, a software update was issued that removed the strict periodicity of the current peaks in one battery block of the investigated UPS system"
    

    https://www.nature.com/articles/s41560-026-02144-0

    Given the issue is so widespread (international, affecting pretty much every grid), it's likely that multiple manufacturers use similar approaches.

    • hyperman1 11 hours ago

      You see the same thing with e.g. cron jobs, where everyone schedules on xx:00 or xx:30. No communication needed, it's just natural. More senior people recognize this and add randomness to their start times or skew a bit.

      • truekonrads 10 hours ago

        You ought to use RandomizedDelaySec=xxx

        • IAmBroom 6 hours ago

          Depends. If you want a breadcrumb trail, use primes. If you want no noticeable effect at all, or cannot imagine a traffic bump that you'll want to decipher, use random offsets.

      • tetha 9 hours ago

        I always recommend to use weird numbers for different tasks. That way, you can see "oh my system is under severe load at *:13 (or 17, 23, 42, ...). That must be this cron job"

        • catlifeonmars 6 hours ago

          I do a similar thing with ping payload sizes to be able to fingerprint the traffic: I’ll use prime numbered packet sizes so that they can be detected even when the packet sizes are summed.

          Btw, one of those numbers is not like the others (has more prime factors that evenly divide 60).

          • IAmBroom 6 hours ago

            Good point. 7,11,13... do not repeat every hour.

      • greggsy 8 hours ago

        It’s entirely possible the battery controllers are running linux too

      • InsidiousWombat 3 hours ago

        It's often failing of the tools used, cron (and various other OS equivalents) just doesn't have good facilities to it.

        Systemd timers have some, for example RandomizedOffsetSec=30m on 30m job will spread it nicely.

        I'd also like if schedulers just had option "just fit it in with other jobs and fire it with this rough interval when there is least amount of other jobs running"

Arn_Thor 8 hours ago

Excellent sleuthing. Witthaut these fellas we'd still be in the dark

peesem 14 hours ago

i'm confused, why would a system simply checking its own power state be taking so much electricity as to show up on grid measurements? unless they mean that the systems are choosing to start charging the batteries, but then it's a continuous load and not a spike at the start of the minute, right?

  • theo939eirn 14 hours ago

    It can be that part of battery is disconnected, to estimate cells voltage. You can not measure voltage while another source is chsrging battery. Or capacitors are charging.

    • deepsun 14 hours ago

      I think you can. RC toys do that all the time. Maybe the measurement is less precise, but you usually don't need super precise voltage, especially if you know your capacitance and measure current.

      • LoganDark 11 hours ago

        Current doesn't tell you if the battery is leaking charge, or otherwise failing to store it though. Vastly increased losses could be a sign of failure, for example. In any case it's important to be sure.

        • wolfi1 10 hours ago

          temperature is also a problem

          • LoganDark 9 hours ago

            Temperature probes shouldn't require disconnecting cells, though.

            • wolfi1 9 hours ago

              no the temperature changes the voltage reading

              • deepsun 36 minutes ago

                A few microvolts difference, well under 1 milli-volt. I'm pretty sure power grid storage doesn't need that precision.

    • InsidiousWombat 3 hours ago

      That wouldn't require dropping from power network, just disconnecting battery from load/charging

  • ROOFLES 9 hours ago

    The Frequency is actually increasing at every event which means grid load is reduced for a short while every minute. Those UPS installations basically briefly switch to Battery every Minute to test Capacity/internal resistance and so on. This so called "load dump" is visible in grid frequency since a lot of these systems work synchronous thanks to NTP

  • kzrdude 6 hours ago

    If they are checking the charging at exactly the minute, then start of charge will happen then too, which will create a spike if it's synchronized with many others doing the same thing.

Blackarea 16 hours ago

> It really was years of detective work

Doesn't seem that complicated from the article though. They say that they immediately knew it was clock based due to the strict interval. With REA etc. it might become easier to proof, but I guess it's a measurement problem that only appears in large networks?

Can someone with more understanding explain why this was apparently so difficult to find out?

  • nomel 14 hours ago

    There are many millions of devices connected that draw power, and increasingly so, supply power.

  • iofiiiiiiiii 14 hours ago

    If it were not a substantial research effort spanning years, it would not get funded. This motivates academic researchers to ensure that every topic is explored thoroughly and at great length.

  • Animats 13 hours ago

    The effect is apparently small enough that they had to use Fourier analysis over many minutes to see it in the noise.

    • sidewndr46 8 hours ago

      That's not really telling us anything. The way you convert a time domain signal to a frequency domain signal, that is fourier analysis. There are other uses for it too, but that is the primary use.

      • danadam 6 hours ago

        By increasing the length of the FFT you lower the apparent noise floor in the FFT magnitude plot and are able to detect smaller signals. That's called "FFT processing gain". The formula is:

        FFT gain = 10*log(M/2)

        where M is the number of points processed in the FFT. Doubling the number of points, lowers the apparent noise floor by 3 dB.

        (I don't know if that's what the researchers actually did. I'm just explaining what the comment presumably meant.)

  • sandworm101 8 hours ago

    >> explain why this was apparently so difficult to find out?

    Likely because the source of the noise was a class of energy providers that themselves react to fluctuation in the grid. Electricity may travel at the speed of light but all the little switches and transistors that connect/disconnect suppliers do not. It would have been noise within noise.

    • Y_Y 8 hours ago

      Not quite the speed of light (in a vacuum) if your watching signals propagate along a conductor:

      https://en.wikipedia.org/wiki/Velocity_factor#Typical_veloci...

      • sandworm101 7 hours ago

        Well ya, nothing on earth moves that fast, but the speed of power/signal in a grid is a speed described using direct reference to c, as opposed to the frequency of AC current which is measurable in frequencies we can actually appreciate with our own ears/eyes. They are in different leagues.

  • myself248 8 hours ago

    When you monitor a power line, you don't get a tcpdump showing who's producing and who's consuming the power. You can't just jump straight to the culprit.

    It's just bulk flows, so when a weird flow shows up, you've got to move up or down the line, past a few producers or consumers, and see if the flow changes. For a subtle effect, that might not even be so clear.

    Worse, for an effect that's most visible at the medium-voltage transmission level, simply placing a monitor might take weeks. These are planned installations with incredible safety considerations -- you don't just plug in.

    Finally they found a research campus with a bunch of battery storage systems, AND the ability to install a bunch of monitors, and persuaded them to install dozens of monitoring points. Finally a high-resolution view of the effect allowed them to confirm the behavior.

  • mschuster91 7 hours ago

    > Can someone with more understanding explain why this was apparently so difficult to find out?

    Because the grid as a whole is dumb as fuck. Sure, you got measurement stations doing very fine frequency analysis, to the point you can use grid hum to timestamp audio recordings [1].

    But you rarely have realtime insight at individual busbar level for each substation or heaven forbid consumers. Best chance you get is 15-minute consumption pings and voltage/frequency metering at large plants.

    That means if you want to track down bad actors like the batteries here or the Kosovo/Serbia bullshit [2] that dragged down the frequency on the entire ENTSO-E grid (which is quite the challenge!), it takes months if not years.

    [1] https://en.wikipedia.org/wiki/Electrical_network_frequency_a...

    [2] https://www.entsoe.eu/news/2018/04/03/frequency-deviations-c...

    • sandos 6 hours ago

      "But you rarely have realtime insight at individual busbar level for each substation"

      This is kind of understandable, the amount of data would be huge. When faults happen though, recordings are automatically made available.

      Some of these measurements can have surprisingly high frequency sampling, even though the grid itself feels "slow".

      • mschuster91 5 hours ago

        > When faults happen though, recordings are automatically made available.

        Depends on the fault. Without dedicated measurement in place it's still a lot of (literal) legwork to install current and voltage loggers.

        > Some of these measurements can have surprisingly high frequency sampling, even though the grid itself feels "slow".

        Sure. But especially in a world dominated by more and more solar and wind, where something like a cloud passing by can easily shed hundreds of kilowatts in a matter of seconds, the grid needs much, much more data across the board and everywhere - and much, much more battery storage, both centralized at substations and decentralized in people's basements.

pseudohadamard 1 day ago

The water-hammer effect, or in this case electron-hammer effect, is why you don't reboot every Windows server in the data center at exactly 2am, to stagger the load shift over time. Surprised that the power guys didn't realize that switching a presumably multi-hundred-MW load in and out at the top of each minute would cause a problem.

  • metalman 1 day ago

    power guys got surprised as rest of the grid load is human randomised and even huge factories will come on one chonk at a time, vs miilisecond co ordinated load switching at scale, with batteries as the load of the initial surge into even fully charged batteries can be almost infinite, and the whole calculation around grid scale turbines is that they run at very precise rpm's for stability and longevity, but worse, and a big fail, as battery storage is supposed to help with that, not be the problem. bet it gets fixed realy fast as those grid guys definitly get listened to.

    • dylan604 16 hours ago

      > as the load of the initial surge into even fully charged batteries can be almost infinite

      There was an post a couple of days ago about a telco debrief of an interesting outage that happened. Several things went wrong like the audible bell was manually silence from being heard as a step in routine working but was forgotten to put back into normal mode once work was complete. The actual loss in power triggered the automatic switch to the batteries, but something else seemingly benign happened at the same time so that when power was restored, the batteries had been depleted to the point the charging process could not start because of something similar to this. I wish I could remember the write up, as it was really well written about the cascades of failures that occurred.

    • rswail 13 hours ago

      > grid scale turbines is that they run at very precise rpm's for stability and longevity

      The turbines/generators set the grid frequency itself.

      Having the batteries disconnect/connect would cause the generators to slow down and then speed up (or vice versa) which makes the rest of the grid frequency fluctuate as well.

      It may also trigger the FCAS part of the grid that is paid to keep the frequency within the required range which is +/- 10mHz-200mHz.

      https://mainsfrequency.com/frequ_info_en.php

  • dylan604 16 hours ago

    Sounds like they've been set up as cron tasks. I've always been unhappy with the 1 minute granularity of cron tasks. Only thing I could come up with was putting a sleep(random()) type of line to avoid a thundering herd type of issue.

    • compumike 16 hours ago

      Yes it’s a real effect. I’ve just hardcoded offsets on various jobs:

        * * * * * sleep 17 && …
      

      etc.

      That way I still maintain a per-job 60-second cadence consistently (which random would not), but don’t do it right on the top of the minute.

      • dylan604 16 hours ago

        That's interesting as it is also visible with a crontab -l so that new scripts can avoid using the same second. However, if you have a farm of machines with the same hardcoded value, they will all still stampede at the same time just not at the top of the minute. By allowing a random value, their start times are slightly offset with in the minute. Is the precise 60s consistent interval really that critical or just that each machine checks once per minute-ish?

        • InsidiousWombat 3 hours ago

          Our configuration management system(Puppet) has function for that, fqdn_rand

          give it number and you will get random value up to that number, same every run for a given host, but different per host (basically, hashed host fqdn)

          add a label and you will get different number but similarly consistent. Makes it real easy to randomize run across the fleet.

          Would be easy script to make.

          Also systemd timers have the randomization builtin, just need to specify time

              RandomizedDelaySec=12h
      • Magniquick 15 hours ago

        Systemd timers do this natively btw, no need to hardcode And imho are also friendlier.

        • Cyph0n 15 hours ago

          But systemd bad :[

          • falserum 11 hours ago

            People slowly are getting used to it. (Less so with journalctl)

            • InsidiousWombat 3 hours ago

              journalctl is good idea executed terribly. It's builtin data format is massively wasteful and not even good at searching for data you want (often need to go thru all the files anyway)

              Journalctl with SQLite or a columnar embedded database would be amazing for sysadmins. Current format is entirely useless

        • stonogo 15 hours ago

          BSD cron has supported jitter for decades. This is strictly a linux problem.

          • fch42 8 hours ago

            It's a human problem. Noone "expects" their own "minimal" checks to compound. And everyone (re)implements periodic checks in ever-more-inventive ways. BSD cron solves this ? Alright. Does prometheus use it to schedule its periodic polling ? Do OTel collectors use it to smear their backend metrics uploads ? Does your own code use cron jobs for its "periodic" heartbeating ?

            If the answer to that is all-yes, then my compliments to you. Alas ... at least my experience says that's not how things are done.

      • ahoka 10 hours ago

        Yes, using prime numbers are a good way to reduce the risk of multiple timers coinciding, for example a 10s, 30s, 60s period on a freshly restarted node / process.

    • nlehuen 15 hours ago

      The Google internal equivalent to cron has a ? placeholder in the scheduling spec syntax letting the scheduler deterministically pick an arbitrary valid value within the field range. So ? 2 ... will pick any minute between 02:00 and 02:59 (and I suspect any second within that minute). The value is derived from a hash of the job definition, so overall this spreads the cron load within the hour.

      Obviously cron jobs are not all equal in terms of load and duration, and hours are not all equal in terms of usage, but that still helps prevent trivial spikes similar to the one mentioned in the article (disclaimer: I'm not aware of a recent counterfactual experiment proving this, but that seems a fair assumption).

      • sdenton4 14 hours ago

        I suppose one would end up with checks happening on a random second instead of a random minute - reducing the size of the spike by a factor of 60, but still spiky.

      • Maxion 9 hours ago

        That still lands it at the top of the minute, which is AFAIK the pattern the researchers found.

    • raverbashing 9 hours ago

      Yeah, and it's not cron, it's "everything running on a digital schedule"

      Analog systems naturally have a dispersion to them, digital ones, especially with everybody on NTP, much less so

    • cdot2 5 hours ago

      By default, systemd timers activate at a random interval within 60 seconds of when the timer is actually set in order to solve that potential issue. It's weird when you set a 60s timer and it activates twice within a few seconds.

  • 0xbadcafebee 15 hours ago

    In computer/systems/distributed engineering this is called request smoothing or traffic shaping, and it's implemented by adding jitter, which is a random time offset/pad added to the interval.

    The funny thing is, modern electrical codes already account for this phenomenon. In order to implement Net Metering (selling your power to the grid), modern standards implement two kinds of jitter:

    - Sandia Frequency Shift: a minute shift in the power frequency generated by inverters. If the grid is connected, this is effectively eliminated; if the inverter is disconnected from the grid, it detects the frequency has shifted and disconnects the inverter from the grid.

    - Slip-Mode Frequency Shift: basically the same thing, but phase shift (which I don't understand).

    Both of these are used for anti-islanding (don't create an island of power). When the inverter detects it's isolated and stops outputting current, it then has to check every 5 minutes, with jitter, for whether the grid is restored or not. It has to add random jitter, because otherwise all the mini battery/solar installs will come online at the same time and swamp the grid, causing another outage.

  • hobofan 13 hours ago

    It seems more like one or multiple suppliers of battery systems not taking into account that the decentralized deployments of their system could have that effect. If it's not regulated and an open market, this was bound to happen sooner or later.

  • InsidiousWombat 3 hours ago

    It's not a multi-hundred-MW load

    It's thousands of few kW's of load

SV_BubbleTime 15 hours ago

>unusually regular

Oh I’m sure there is a German phrase for this.

  • jgilias 14 hours ago

    uhrwerksmäßig

    • Someone 13 hours ago

      That doesn’t capture the “unusually” in “unusually regular”

      • aa-jv 10 hours ago

        Ungewöhnlichregelmäßig or Hyperregelmäßig works for me, but then there is Regelmäßigkeitsmonsterhaft.

        Still, I think we can push the limits to Bürokratieapokalyptischhyperregelmäßigkeitsgötterungeheuerhaft and feel pretty comfortable with it.

  • quink 14 hours ago

    Thinking about it tactically, I’ll go with taktisch. :) Takt-isch.

    • moi2388 14 hours ago

      Surely you mean Tick-Tacktisch?

    • wolfi1 10 hours ago

      rather tak-tisch if we are talking hyphenation

  • Jakob 12 hours ago

    I would go with “allzuregelmäßig”.

    Similar to “allzuschön um wahr zu sein”, “allzugroß” etc.

    • donutdonot 12 hours ago

      However this is not a single word, but would be split as "allzu regelmäßig" cf. https://www.korrekturen.de/wortliste/allzuoft.shtml

      • Jakob 10 hours ago

        Oh interesting that got reformed, too! Strange choice to split it in two instead of three words (the latter which would have mimicked English: “all too”).

        Well, then it seems we don’t have any single German word for all too regular anymore :(

        • mkesper 9 hours ago

          This never was one word actually.

          • Jakob 8 hours ago

            Until the reforms in 1996, allzu… was one word: allzuoft, allzuschön, allzugroß, allzuviel, etc. But yeah, probably would have written such a long word in two words even then.

            My new proposal would be überregelmäßig. Über+adjective is still one word only, post-reform. Sounds strange, but grammatically correct, and still conveys the “unusual” part.

  • loehnsberg 11 hours ago

    Not a scholar of languages, but maybe something like "mit unheimlicher Regelmäßigkeit" (with un-home-ly regular-like-ness, read "home" like in "family" -> "familiar").

snthpy 14 hours ago

You'd think they'd randomise offsets to avoid a thundering herd effect, like anyone scheduling multiple processes does?

  • heisenbit 14 hours ago

    To anyone herding a herd this is obvious. To people crafting animals less so.

  • cman1444 6 hours ago

    A better solution might be to make the intervals coprime with 60. 59 or 61 seconds should work fine.

    https://shoppress.dormanproducts.com/hunting-tooth-gearsets/

    • InsidiousWombat 3 hours ago

      no, you hash your node ID or get a random number, and then just add offset. That guarantees on average uniform load, not synchronized-wave-pattern-that-happens-to-be-59.

      You have to consider that when power goes down and everything goes back up at same time you get same pattern back, just spike every 59 seconds instead of 60.

neuroelectron 6 hours ago

It's really surprising to me this took years to solve.

  • pizzafeelsright 4 hours ago

    Cha...ya know neuron, Dave is out and Jenny is on maternity leave - let's reschedule for 2 week okay?

    No good. I am out that week. How about the 3rd week of November?

    That's no good. Second week of December should work for all of us.

    --near actual conversation with (State) government coordination team to have a 20 minute discussion.

  • InsidiousWombat 3 hours ago

    Shows they didn't had sysadmin to look at it, it's very common pattern on IT systems

vachina 14 hours ago

> turbines slow down momentarily before accelerating back to their original rotational speed. This increases wear and tear.

Why though? Due to increased torque?

  • toomuchtodo 13 hours ago

    When the battery storage systems all temporarily pause providing grid inertia due to the state of charge check they’re performing, grid synchronized spinning mass has to compensate, which slows it down (transferring the kinetic energy to electrical energy), and then is sped back up as battery storage resumes inertia support.

    Broadly speaking, it’s a collective momentum problem. If part of the system inertia sags, another part needs to step in to compensate for the inertia loss, otherwise you have brownouts and eventually, a blackout.

    https://neutrino-energy.com/technology/grid-inertia/

    • EdwardDiego 11 hours ago

      I wish that article wasn't written entirely in Claude speak, it has some useful information, but the obvious AI voice will repel readers.

  • bajard 13 hours ago

    Because a variation in force is a cycle of stress, which is more destructive than constant force. It's called hysteresis, leading to material fatigue.

  • rocqua 10 hours ago

    The grid frequency is set directly by 3 phase generators. So if the grid frequency drops, there is indeed a very strong torque trying to decelerate the turbines.

    To some extent, this is a good thing. Because it means the spinning mass of all turbines in the grid actually provide a buffer for sub-second mismatches in demand and supply. But it does mean that big demand spikes (or drops) put some wear on the systems. They are made for this, but if it gets very periodic it might be more than designed for.

    Note that this means that all turbines in a power network are perfectly synchronized. And if they are not, they are subject to massive torques. This is why a cold start is so hard. You need to bring on generators from one central point to keep everything in sync. And as you bring on new generation capacity you also need to bring on new consumption, that electricity has to go somewhere.

    The reason for this synchronization is because the generators are spinning a magnet past 3 coils, and those coils are directly wired into the power network. If your magnets are out of phase then effectively the entire power network will use those coils to generate a field to get that magnet back in sync. All of those coils on all those generators really are all hard-wired together, it still kind of blows my mind.