The statement says there were two successive power interruptions, and that the first was resolved immediately, without relevant consequences. It was the second one that left hospitals and health centres across Portugal without systems for about five hours. We do not know what failed inside that room and we are not going to invent it. What that sentence does have is a recognisable shape, and that is reason enough to stop and look at what changes, in any room, between the first cut of the day and the second.
What happened on 19 October
At around ten in the morning that Monday, electronic prescribing, the national patient registry, the electronic health record and the SNS24 app stopped working. Clinicians could not look up histories or issue prescriptions; according to the medical federation FNAM, thousands of patients were left without appointments and without medication. By about three in the afternoon "practically everything" was back. SPMS, the body that runs the Portuguese Health Ministry's shared systems, attributed the episode to two consecutive power cuts at its northern data centre — the one operating in Porto — and added that "this failure has a different origin from the one that occurred last 12 June".
That last sentence is what changes the size of the story. On 12 June 2026, at 08:45, the same systems had gone down because of an external supply cut lasting a few minutes. And in July, explaining that one, the head of SPMS, Luís Goes Pinheiro, said it had surprised them, because the installation had already been "tested by reality" during the April 2025 blackout and "tested by SPMS" in a power-cut drill on 6 September 2025. Put differently: the system had passed two exams and then fell twice in four months, for different reasons.
It is worth saying straight away what we do not know, which is almost everything: SPMS has not published which element failed. We do not know whether there were batteries, a generator or a transfer switch, nor how they were configured. We are not saying the batteries failed there. What can be done, and what we will do here, is take the shape of the account — harmless first cut, lethal second cut — and look at what changes, in any room, between one and the other. You can apply that arithmetic to your own installation this afternoon.
What changes between the first cut and the second
A UPS is not a tank that empties and refills at the same rate. It empties fast and fills slowly, and the asymmetry is brutal. Eaton's knowledge base sums it up with a rule anyone can check against their own equipment's datasheet: "on average, it takes 10 times the discharge time for the UPS batteries to recover. A 30-minute battery discharge requires about 300 minutes to recharge". And the sentence that follows is the important one: while recharging, the load stays protected, but if the batteries are needed during that time, the holdover available will be less than it would have been with full batteries.
Eaton does not specify a chemistry; the rule fits the sealed lead-acid batteries most units carry, and lithium does considerably better. It is a rule of the trade, not a law of physics, but it is enough to do the sum, which is what almost nobody does. Take an ordinary room: a UPS with ten minutes of autonomy at its real load. A cut arrives and the grid takes four minutes to come back. You ride it out comfortably, nobody notices, the log says "no incidents". But for the next forty minutes your reserve is no longer ten: it starts at six and climbs. If the second cut lands in the first ten minutes of that window and lasts seven, you go dark with equipment that was, on paper, sized to handle it.
A caveat that cuts against our own argument: recharging is not linear. The initial stage replaces charge quite quickly and the final stretch crawls, so the first minutes of reserve come back sooner than the proportional split above suggests. The dangerous window is therefore shorter than forty minutes and sharper at the start. What does not change is the substance: nobody signs a contract that reads "autonomy: ten minutes, except right after any cut". The datasheet describes the first event of the day. The second event of the day is not on any datasheet.
The generator also has an in-between state
If the room has a generator, the battery no longer has to carry the load: it has to cover the start-up and, if the start fails, the retry. The figure engineering guides on emergency and standby power repeat, attributing it to IEEE Std 446, is that a well-maintained, pre-warmed set comes online in 8 to 15 seconds; NFPA 110's 10-second criterion for critical installations points the same way. With that, ten minutes of autonomy looks like a luxury and the arithmetic above barely matters. Almost.
Because the generator does not jump from "running" to "ready" either. When the grid returns, the transfer switch hands the load back and tells the engine to keep turning unloaded for a cool-down period, configured in minutes. During that stretch the set is running but feeding nothing, and the switch has just performed two operations in a few minutes. It is the moment with the most moving parts and the least margin, and it is the moment you can least afford it. We wrote this already when the zone that went down in London was a power panel: in power, what fails is almost never the path, it is the change of path.
The indicator that measures your supply does not count the cuts that take you down
This is where it gets uncomfortable for anyone who trusts the paperwork. In Spain, supply quality is measured with two indices defined in Royal Decree 1955/2000: TIEPI, the equivalent interruption time for installed medium-voltage capacity, and NIEPI, the equivalent number of interruptions. These are the indices used to regulate, benchmark and penalise distribution companies.
Article 100 defines the key piece: "interruptions may be long, lasting more than three minutes, or brief, lasting three minutes or less". And immediately after: "the interruptions to be considered in calculating TIEPI shall be those lasting more than three minutes". The same applies to NIEPI.
Read that again thinking about your own room. A two-and-a-half-minute cut is, officially, a brief interruption: it does not add to TIEPI, it does not add to NIEPI and it appears in no quality statistic. And a two-and-a-half-minute cut starts your generator, drains your battery and puts you inside the recharge window from the sum above. The three-minute threshold makes sense for what it was designed to do, which is to bound interruptions that are perceptible and measurable consistently across an entire grid. Your installation works an order of magnitude below that threshold, and down there the regulation simply does not look.
Seven cuts a year are within the rules
Two things get confused here and need separating. Article 106 sets limits per zone: these are aggregate indices, weighted by installed medium-voltage capacity, measuring how the grid behaves across a whole municipality. They are not your connection's allowance. Your supply can take ten cuts with the zone comfortably within the rules.
These are those annual zonal limits, counting unplanned interruptions only:
The limit that is actually yours sits two articles earlier. Article 104 obliges the distributor to keep "the time and number of unplanned interruptions longer than three minutes in each calendar year" on your supply below a cap set by zone and voltage level. At medium voltage in an urban zone, that cap is 3.5 hours and seven interruptions a year. At urban low voltage, five hours and ten interruptions.
Seven. Seven long cuts a year on your own connection, and the distributor is compliant. Spread across twelve months, seven cuts are paperwork: the UPS fully recharges between them and nobody in the office notices. Bunched into one morning, they still add up to seven, they are still within the rules, and they stop your business. And on top of those seven come all the sub-three-minute ones, which count towards no article at all but do count against your battery.
The variable that decides which of those two stories you live through is not the number of cuts, nor their total duration. It is the interval between them, and the interval is not in article 104, nor in 106, nor in your supply contract, nor on the UPS datasheet. It is the one number that governs your reserve and the one nobody publishes.
When NOT to: buying more autonomy
The natural reaction to all this is to ask for more batteries. People do ask us, and we almost always say no, for two reasons worth saying out loud even though they cost us the sale.
The first requires a correction that pulls the brake on this post's own argument. Doubling the battery bank does not lengthen the recharge window for a cut of the same duration: the energy to be replaced is the same, so the replacement time is too. What doubles is the full recharge, the one that follows emptying the whole bank. And for the second event, a bigger bank is honestly better: you start the window at sixteen minutes of reserve instead of six. That said, what attacks the problem head-on is recharging faster — a higher charge current, or a chemistry that accepts one — because that shortens the window rather than making it more bearable. And what usually decides is the price: batteries, floor space, raised flooring and replacement every five or six years.
The second reason is more awkward. In a room with a generator, the battery is there to cover the start and a retry, not to replace the generator. When somebody asks for thirty minutes of autonomy in a room that has a generator, what usually sits underneath is distrust of the generator, and batteries do not fix that. Maintenance, load testing and pre-warming fix it. A huge bank in front of an engine that will not start buys you a while and nothing else.
There is one case where extending does make sense: when the autonomy is not there to ride out the cut but to shut down cleanly. If what you need is eight minutes for the hypervisors to bring machines down in order and for storage to flush its cache, you are buying a shutdown procedure rather than redundancy, and there the battery is the right tool.
This afternoon's check: the event log
Because brief cuts do not make it into the official statistics, there is only one place where they are written down: your own UPS event log, and the transfer switch log if you have it managed. That history is, literally, the only document that knows how many times the power went out in your building last year and how long passed between one time and the next.
Download it, filter the transfers to battery over the last twelve months and build three columns: date and time, discharge duration, and interval since the previous transfer. That third column is the one almost nobody looks at. If two events show up less than an hour apart, you have already had your dress rehearsal and you passed it by luck, not by design.
Six questions for whoever hosts your machines
If your hardware lives in somebody else's data centre, these are the ones worth asking. They are not trick questions: a serious provider answers them without blinking, and what matters is whether the answer comes in numbers or in adjectives.
- How much autonomy is there at my real load, not the rated one? Catalogue autonomy is measured at a load your room probably does not have. Ask for the minutes at last month's measured load.
- How long does the UPS take to get back to 100% after a five-minute discharge? "A few hours" is not an answer. The unit's recharge current is, and it is on the datasheet.
- What happens if the second cut lands twenty minutes after the first: have you calculated it or tested it? Both answers are acceptable. "We had not considered it" is also an answer, and it is information.
- How many cool-down minutes is the generator configured for, and what happens if the grid drops during that period? That is the gap the section above describes, and it is almost never in the sales documentation.
- How many hours of diesel are in the tank, and with what committed refill time? A long cut is a different scenario, and this is the number that governs it. Without a refuelling contract with a stated time, the tank is the real limit.
- Can you give me the last year's transfer log, with dates and times? It is the most revealing question, because whoever keeps that log tends to be whoever reads it.
And the question no battery answers
Everything above is single-room electrical engineering, and it has a low ceiling. The Portuguese ending says so itself: the answer SPMS has announced is not a bigger UPS but a second data centre in Évora, fifteen million euros of investment funded by the Recovery and Resilience Plan, to guarantee "real-time redundancy of the main systems" before the end of 2026. It is the right decision and we have no complaint about it.
The catch is in the calendar, and it is the part worth looking at for anyone with a redundancy project open. That data centre was announced in late 2022; the then head of SPMS said the servers would be installed before the end of the first quarter of 2023. Three years and two outages have passed between that date and this one. SPMS cites technical complexity and public procurement timescales, and that is a reasonable explanation: these things genuinely do take time. What does not negotiate with procurement timescales is the grid. While the second site is under construction, the only thing standing between you and the headline is the first room's installation, which is exactly what we have been talking about.
We host our own and our clients' hardware in data centres, and the colocation conversation usually starts with kilowatts and rack units. The part that actually decides whether you notice anything on a Monday morning is this other one: how many consecutive events the installation survives, and what happens to your services if the whole room goes. The second is no longer an electrical problem: it is disaster recovery, and it starts with having machines in two places. And before all of that there is the cheap thing, the one we have seen fail most often, which is the last metre inside the rack: both power cords on your server go to the same strip.
If you want us to go through your UPS event log with you and build the interval column — it takes a while, and it produces a number you did not have — let us talk. And if it turns out there have not been two consecutive transfers in twelve months, we will tell you and that is that: knowing your building has good power is worth something too.
Sources. The 19 October 2026 outage (starting around 10:00, with electronic prescribing, the national patient registry, the electronic health record and SNS24 affected, restored around 15:00), the attribution to "two successive interruptions" at the northern data centre with the first resolved "immediately, without relevant consequences", the SPMS statement about the origin differing from 12 June, and the announcement of infrastructure funded by the Recovery and Resilience Plan: Observador and healthnews.pt (19 and 20 October 2026) and Datacenter Dynamics. The thousands of patients left without appointments or medication is a statement by the medical federation FNAM reported by Diário de Notícias, not by the SPMS communiqué, and it is attributed as such in the body. The 12 June 2026 failure at 08:45 caused by an external cut of a few minutes, Luís Goes Pinheiro's remarks about being surprised after the April 2025 blackout and the 6 September 2025 drill, and the Évora data centre with a fifteen-million-euro investment: Observador, 9 July 2026. That the Évora centre was announced in late 2022 with servers expected in the first quarter of 2023, and that real-time redundancy with the Porto centre is expected by the end of 2026: Observador and eco.sapo.pt (16 June 2026) plus the December 2022 coverage. The recharge rule ("on average, it takes 10 times the discharge time for the UPS batteries to recover; a 30-minute discharge requires about 300 minutes to recharge") and the warning that holdover is reduced while recharging: Eaton's knowledge base, which does not specify a chemistry. The 8 to 15 seconds for a well-maintained, pre-warmed generator to come online is the figure engineering guides on emergency and standby power attribute to IEEE Std 446; we have not consulted the text of the standard, and we say so. The 10-second criterion is NFPA 110's. The definitions of long and brief interruptions, the three-minute threshold and the TIEPI and NIEPI indices: article 100 of Royal Decree 1955/2000; the individual per-supply limits (3.5 h and 7 interruptions at urban medium voltage; 5 h and 10 at urban low voltage): article 104; the zonal limits in the table: article 106, which also sets an 80th-percentile TIEPI we do not reproduce here. The sums involving ten minutes of autonomy, forty of recharge and the resulting window are ours, derived from the Eaton rule, and are stated as an arithmetic example, not as a measurement of any specific installation. About what failed at the SPMS data centre we claim nothing, because it is not public. All verified on 24 October 2026.
Microsoft 365
ES 
CAT 
EN