Ritom hydropower plant explosion: two deaths and the engineering questions around commissioning and electrical energy

Two deaths in a historic plant under transition

Shortly after 9:30 a.m. on 9 September 2026, Ticino's joint alarm centre received a report of fire inside the old Ritom hydropower plant in Piotta. The Cantonal Police's initial reconstruction says an explosion, for reasons still to be established, struck the two workers at the site. Both later died.

The victims were AET employees: a 55-year-old Swiss worker from the Lugano area and an 18-year-old Swiss apprentice from Val Leventina. The apprentice's age makes the loss particularly painful but does not establish his task, authorization, supervision or position relative to equipment.

Police, three fire brigades, Tre Valli Soccorso and Rega responded. Significant structural damage was reported, and public prosecutor Valentina Tuoni coordinates the investigation. Cause and exact dynamics remained undetermined at the final check.

Fire, explosion and damage: sequence unknown

Fire was the first alarm. The later police account confirmed an explosion and significant damage. Early reports mentioned partial collapse, but the technical order connecting fire, explosion and structural damage has not been publicly established.

It would therefore be premature to state that fire caused the explosion, the explosion started the fire, or one mechanism produced a particular collapse. Preserving the sequence as an open question protects the investigation from a story written ahead of the evidence.

Facts, hypotheses and technical learning

Confirmed facts are the explosion, two AET fatalities, the initial fire alert, significant damage and an open investigation. The wider new Ritom project was also demonstrably at an advanced construction and commissioning stage.

Swiss reporting raised initial electrical hypotheses during testing. RSI mentioned a transformer; other reports referred to a frequency converter. Police, prosecutors, SBB and AET had confirmed neither. A transformer and a converter perform different functions, and repeated reporting does not turn a hypothesis into a cause.

Old plant does not mean dead plant

The historic station dates from the electrification of the Gotthard railway around 1920. Project documents indicate that the existing building would remain partly in service for switchgear and auxiliary services. It cannot simply be called abandoned or de-energized.

An old asset can remain electrically alive while a new project advances beside it. Which circuits were live during the accident is unknown. The general lesson is that a brownfield energy map rarely follows the visible line between old building, new plant and construction area.

Why the new Ritom is technically unusual

Ritom SA, 75% owned by SBB and 25% by Canton Ticino, is managing an investment of about CHF 350 million. The project runs from 2018 to 2027, with commercial service planned for 2027.

Its configuration combines a 60 MW, 16.7 Hz railway unit; a 60 MW, 50 Hz cantonal-grid unit; a 60 MW pump; and frequency conversion between the networks, plus a 100,000 cubic-metre compensation basin and roughly two kilometres of pressure shaft. Water, rotating machinery, power electronics, automation and two grids meet at one critical infrastructure interface.

The old plant has historically supplied Gotthard traction power. That strategic role does not prove the accident interrupted supply or changed the project schedule.

Was commissioning under way?

The overall project was in an advanced assembly and commissioning phase. AET reporting records work across commissioning stages, completion of the 16.7 Hz unit assembly in 2025 and dry tests on the 50 Hz unit and pump. Reporting in February 2026 likewise described assembly and commissioning in progress.

The two workers' exact task inside the old plant has not been officially described. It is not established that they were energizing equipment, running a commissioning test or working on either device cited in press hypotheses.

Commissioning is when hazards leave the drawings

Commissioning is a structured programme of inspections, tests, energizations and demonstrations that verifies installation against design, protection and interlock performance, control signals, system interfaces and operational handover. It is not switching on a machine to see whether it works.

During construction, many systems are inert. Commissioning progressively introduces voltage, fault current, stored energy, pressure, rotation, pressurised water, automation and remote movement. Hazard enters circuit by circuit and system by system.

Construction areas, energized systems, isolated equipment, test configurations, suppliers and operations may coexist. The boundary between worksite and live plant is therefore an operational state that everyone must share, not merely a line on the floor.

A test is not normal operation at smaller scale

Tests may involve protection under verification, temporary instruments, local and remote control, provisional connections and frequent energy-state changes. These are generic commissioning characteristics, not findings about Ritom.

Each state needs deliberate control: who authorized it, which boundary was released, which protections are available, how communication works and how the plant returns to safe condition. If construction, commissioning and operations use different references, one switch can mean three different states.

Risk lives at the old-new interface

Brownfield risk may sit where new equipment meets existing busbars, auxiliary systems, earthing, controls, protection logic and alternative sources. An apparently isolated section may receive backfeed; an outdated drawing may hide a source; a physical boundary may not be an electrical boundary.

Investigators and readiness teams must ask which side was energized, what sources could feed the circuit, who held switching authority and whether as-built documents matched reality. Asking does not allege these controls failed at Ritom.

Transformer and frequency converter are different

A transformer changes AC voltage levels through electromagnetic coupling. A frequency converter changes frequency and power form and may include power semiconductors, DC links, capacitors, filters, controls, cooling and fast protection.

Ritom's planned converter links 50 Hz and 16.7 Hz systems. Its detailed architecture and the accident equipment remain unconfirmed. Generic CIGRE material explains how internal arcs can rapidly create gas and pressure in some liquid-filled transformers, while converters may retain stored electrical energy. Neither mechanism is evidence of what occurred here.

De-energized is more than switched off

A safe condition considers electrical, capacitive, mechanical, hydraulic, gravitational, pressure and rotational energy. A stopped command does not automatically remove pressurised water, stored charge, motion or supply from another network.

Isolation and LOTO apply when absence of energy is required. Some commissioning tests genuinely need energy, shifting the strategy from elimination to tightly controlled exposure: a defined test zone, access control, authorization, communication, protection and a planned safe return.

Protection is a race against time

A high-energy electrical fault can evolve in milliseconds. Protection must detect, decide, trip and interrupt. Available current, clearing time, topology, source contribution, equipment and geometry influence damage.

Without settings, single-line diagrams, oscillography and event records, no one can calculate Ritom incident energy or declare protection failure. Relay targets, alarms and logs may become critical evidence.

Readiness review before energization

The U.S. Bureau of Reclamation's hydropower commissioning guide organizes responsibilities, documentation, inspections, interfaces and tests. It is an international reference, not Swiss or Brazilian law.

A pre-energization review seeks evidence that design, installation, drawings, protection settings, interlocks, temporary conditions, earthing, boundaries, authorizations and emergency arrangements are coherent for the specific test. Energizing is an engineering decision; re-energizing after an abnormal event is one too.

Swiss prevention context

Suva's five vital electrical rules call for clear responsibilities, suitable and authorized personnel, safe tools, appropriate PPE and commissioning only after required verification. Its five de-energized-work steps cover isolation, prevention of reconnection, proving dead, earthing and short-circuiting where applicable, and protection from adjacent live parts. Uncertainty calls for STOP.

The Swiss High-Voltage Installations Ordinance addresses competent personnel, coordination, work preparation, re-energization and energized or test installations. The exact task is unknown, so this article does not claim which provision applied or that any was violated. ESTI offers institutional prevention context, but it has not been publicly confirmed as the Ritom investigator.

The apprentice: learn without inventing blame

Every high-energy organization should ask how competence, authorization, supervision and task allocation are managed as young professionals enter the field. That is a legitimate systemic question.

The public record does not show that the apprentice was alone, inadequately trained, performing electrical tests or assigned work outside his authorization. Respect means leaving those gaps open.

Brazilian bridge: NR-10

Brazilian NR-10 does not apply in Switzerland. The current text remains in force through 31 May 2027; the revision approved by Ordinance 737/2026 takes effect on 1 June 2027.

The future text explicitly includes commissioning alongside design, construction, assembly, operation and maintenance. The useful lesson is conceptual: commissioning is its own life-cycle phase and needs its own risk model. This does not turn NR-10 into a finding about Ritom.

Questions investigators must answer

A technical question is not an accusation. It is the path from event to evidence.

• Which equipment and area were involved?
• What task and test, if any, were under way?
• What was the energization state and what sources could feed it?
• What was the sequence among fire, arc, pressure and explosion?
• Was the device a transformer, converter, switchgear or something else?
• Which protections operated, and when?
• Were relay records, alarms and logs preserved?
• Were temporary test configurations present?
• Where was the old-new boundary?
• Who held energization and stop authority?
• What must change before restart?

Energization readiness checklist

Educational reference only; it does not replace design, commissioning procedures or a task-specific risk assessment.

• Approved test scope and sequence
• Current single-line and as-built drawings
• Known energization boundary and all possible sources
• Backfeed assessment
• Verified protection settings and interlocks
• Controlled temporary states
• Documented earthing and stored energy
• Restricted test area and access
• Named test and switching authorities
• Working communication and stop authority
• Compatible emergency plan
• Defined safe return
• Formal construction-commissioning-operations handover

What remains unknown

The root cause, exact equipment, voltage, type of test, origin of fire, event sequence, failure mode, protection response, each worker's activity and temporary configuration remain publicly unknown. There is no basis to assign design, assembly, operational, equipment or personal responsibility.

It is too early to say what exploded and why. What can already be learned is that commissioning is not the end of construction: it is when hazards that existed on paper become physical. After energization, the system responds to electricity, mechanics and stored energy—not to the schedule.