When the Mains Fails: Generators, ATS and UPS

Part 8 of 11 in Cobler's Building Electrical Fundamentals course. New here? See the course page.

Picture a weekday afternoon in the office tower, when a grid fault cuts the TNB (Tenaga Nasional Berhad) supply. The office lights go out, the air conditioning stops and most lifts halt. But the emergency lights in the corridors and stairs come on at once, and the server room doesn't notice at all. A short time later, a diesel engine starts in the plant room. Then an automatic transfer switch gives the fire lift, security and the other essential services their power back. The office floors and chillers stay off until TNB's supply returns.

So one power cut gives three results: some loads never stop, some stop for a short time, and some stay off. Why? It comes down to four pieces from Part 1. They're the essential switchboard (EMSB), the standby generator, the automatic transfer switch (ATS) and the uninterruptible power supply (UPS). The storm in Part 7 pushed the voltage too high for a moment, but this time the supply disappears altogether.

Normal and essential loads

You'd think the simplest answer would be a generator big enough for the whole building. But a standby generator usually can't carry the whole load, so the design decides in advance which loads it must keep running.

The office tower shows why. At its maximum demand, the building draws about 1,739 kVA, and the chiller plant alone uses about 35% of the building's electricity. Its standby generator is rated 1,000 kVA, well below what the whole building needs. The unit kVA measures the total load a generator or transformer must carry, and kW, kVA and kVAR explains it.

So the loads are divided between two kinds of board:

• Normal boards feed loads that can wait for the mains to return. These are office lighting and sockets, most air conditioning, the chiller plant and most lifts.
• The essential switchboard (EMSB) feeds loads that must keep working. In the office tower, these are the fire systems, the fire lift, the stairwell pressurisation fans, emergency lighting, security and the server room.

Fire-safety loads are on the essential board because they must work during a fire, even if the fire has also cut the mains. Security and the server room are there because the building's owner has decided they must keep running. The list for a real building comes from its approved fire-safety design and the owner's requirements. It's shown on the single line diagram, where the generator is the G in a circle (Part 3).

The automatic transfer switch

So how does the essential board get from the mains to the generator? That's the job of the automatic transfer switch (ATS). It watches the mains supply to the essential board. When the mains fails, it starts the generator and moves the essential board from the mains to the generator. The lesson How Generators Make Electricity, in the Electricity Fundamentals course, explains the machine itself.

The sequence runs like this:

1. The mains is lost, or its voltage moves outside set limits.
2. The ATS waits for a short, deliberately set time, to confirm the supply has really failed.
3. The ATS signals the generator to start.
4. The diesel engine starts and speeds up. The generator can't take load until its voltage and frequency settle at their correct values.
5. The ATS disconnects the essential board from the mains and connects it to the generator.

Why wait in step 2? Because it might be only a brief dip that will recover by itself.

In a common design, an interlock stops the ATS from connecting the mains and the generator to the essential board at the same time. This keeps the generator from feeding power back into TNB's network.

Steps 2 to 5 take time, so the essential loads lose power for a short gap, usually measured in seconds. The exact time depends on the design and the settings. So that's the "stop for a short time" group from the opening.

The ATS selects the mains or the generator for the essential board, and the UPS keeps the server room running through the changeover.

Adding a generator also changes the building's electrical paths, including the path fault current takes. We met the same point about earthing in Part 6. Sites with generators or multiple supplies need a design that accounts for each operating arrangement.

The UPS

So what about the server room, which didn't notice anything? Some loads can't tolerate even a few seconds without power. Servers and network equipment would shut down and could lose data. So these loads are fed through an uninterruptible power supply (UPS), which has three main parts:

• A rectifier turns the incoming alternating current (AC) into direct current (DC) to charge a battery.
• A battery stores energy.
• An inverter turns DC back into AC for the load.

In the common online type of UPS, the load always runs from the inverter. When the mains fails, the battery takes over feeding the inverter, so the load sees no break at all. The office tower has a 60 kVA UPS for the server room, which is why the server room didn't notice the power cut. Rectifiers and inverters and how batteries store energy, in the Electricity Fundamentals course, explain the parts.

In the office tower, the server room is also on the essential board. So once the ATS has transferred, the UPS is fed from the generator. That means the UPS battery only has to cover the gap until the generator takes over, not the whole outage.

Emergency lighting has a similar need, because people must be able to see the way out the moment the lights fail. So emergency light fittings commonly have their own batteries, or are fed from a central battery. They light up straight away and don't wait for the generator.

Autonomy

But no backup lasts forever. How long a backup source can keep supplying its load is called its autonomy.

For the generator, autonomy is set by the fuel. The time it can run is the usable fuel in its tanks divided by the rate it burns fuel at its actual load. The more load it carries, the faster it uses fuel. So a long outage depends on how much fuel is stored and how quickly more can be delivered. The fuel level is one of the most useful readings an operator can take during an outage.

For the UPS, autonomy is set by the battery and the load. UPS batteries are usually sized to cover minutes, not hours. That's enough to bridge the gap until the generator runs. In many designs, it's also enough for an orderly shutdown of the servers if the generator doesn't start.

Worth knowing: Battery capacity falls as batteries age. So a UPS's autonomy on the day of a real outage can be shorter than when it was new. Regular testing by the UPS service provider shows whether the batteries still meet the design.

How long the fire-safety loads must be supported is set by the building's approved fire-safety design, not by the operator on the day.

Fire-safety loads first

The fire-safety loads are the main reason the essential board exists, so they have priority over every other backed-up load.

During a fire, the fire lift carries firefighters, and the stairwell pressurisation fans keep smoke out of the escape stairs. The fire alarm and fire-fighting systems must keep working too. Their supplies are designed to stay available when the normal supply is lost. Their cables are also commonly routed and protected so that they keep working in a fire.

Two rules follow for the operating team:

• Never switch off or isolate a fire-safety supply to save fuel or for convenience.
• Any planned work that affects these supplies is arranged by the competent person, together with the building's fire-safety procedures.

When the mains returns

So what happens when TNB's supply comes back? The building goes back to normal in steps, not all at once.

1. The ATS waits until the mains has been steady for a set time.
2. The ATS moves the essential board back to the mains.
3. The generator keeps running without load for a cool-down period, then stops and returns to automatic standby.
4. The normal boards are supplied again, and large loads are restarted in a planned order.

Step 1 stops the ATS switching back onto a supply that fails again a moment later. Step 2 matters for the server room. In a common design, it causes a second short break for the essential loads, so the UPS covers the server room again. The emergency light batteries start recharging, and after step 3 the generator is ready for the next failure.

The last step matters for the big motors. Large motors, such as those on chillers and pumps, can draw a high current while they start. If they're started directly, that's several times their running current (How Electric Motors Work explains motors). Starting them one after another instead of all together keeps these starting currents from adding up. The restart order for a real building, including when to bring back the chillers and the lifts, is set in its written operating procedure.

During an outage, each group of loads behaves differently. UPS loads never stop, essential loads have short gaps at each transfer, and normal loads wait for the mains.

Who does what during a power cut

During an outage, our job as operators is to observe, record and report. Switching, resetting and repairs are for the authorised competent person, such as the building's chargeman, and for the generator and UPS service providers.

Don't bypass the ATS, operate a switchboard or reset protection unless you're trained and authorised for that task under the site's procedure. If people are trapped in a lift, follow the building's emergency procedure and call the lift service provider.

The outage record stays useful long after the event. It shows whether the transfer worked as designed, how long the essential loads were off, and how much fuel was used. In Part 11, we'll turn records like these into a clear fault report.

Some buildings also run their generators to cut their demand charges. That's an economic question, separate from keeping the building safe, and Genset Peak Shaving in Malaysia discusses it as optional later reading.

The panels that restart the pumps

So when the mains comes back, the big loads restart in a planned order. But think about what actually starts a chilled-water pump or a fan. Each one is switched on and off by a control panel, and after a power cut, those panels decide what restarts. So what's inside an electrical control panel? And how does a small control circuit switch a large pump motor on and off? That's Inside an Electrical Control Panel.

Check your understanding

1. Why is the chiller plant in the office tower not on the standby generator?

2. The building has a standby generator. Why does the server room also need a UPS?

Recap

• When the mains fails, a building's loads fall into three groups.
• Loads on a UPS never stop, because a battery and inverter carry them through.
• Loads on the essential board stop for a short gap while the ATS confirms the failure, starts the generator and transfers to it.
• Loads on normal boards wait for the mains.
• Each backup has a limited autonomy: fuel for the generator, battery capacity for the UPS. Fire-safety loads have priority.
• When the mains returns, loads come back in steps, and large motors are restarted in a planned order.
• The operator observes, records and reports. The competent person switches, resets and repairs.

This is Part 8 of 11 in Cobler's Building Electrical Fundamentals course. Previous: Lightning and Surge Protection: Why the Router Dies. Next: Inside an Electrical Control Panel.

Cobler builds CobiNeural, a platform that shows a facility team its building's energy, water and indoor air data as live numbers across the whole site. To see how your building performs, talk to us.