Emergency power and UPS — what stays alive when the supply does not

When the supply fails, most of a plant stops and that is acceptable. A small part of it must not stop, and a smaller part must not even flicker. Emergency power is the arrangement that decides which is which.

Three categories, decided at design

Power supply categoriesSource: General plant design practice. Category names vary between operators — vital, uninterruptible and emergency are often used interchangeably, so read the project definition rather than assuming.


Normal	Unlimited — it stops with the supply	Main distribution only	Process pumps, compressors, general lighting, workshops, HVAC
Essential	Seconds, while a generator starts and takes load	Main, with automatic changeover to a standby generator	Lube oil pumps, some cooling, control room HVAC, selected process pumps
Emergency / vital	None at all	UPS, backed by the generator once it has picked up	Control system, ESD, fire and gas, escape lighting, communications
DC control	None, and it must work when AC has gone	Dedicated battery and charger	Switchgear closing and tripping coils, protection relays, indication

Every load is assigned a category at design and the assignment is recorded. What drifts is reality: sockets appear on the wrong board over the years, so the installed load is worth measuring rather than reading off the original schedule.

Normal loads stop when the supply does, and the plant accepts it.

Essential loads can tolerate a break of seconds while a generator starts and takes over. Lube oil pumps on large machines, some cooling, control room air conditioning, key process pumps.

Emergency — sometimes called uninterruptible or vital — cannot tolerate any break at all. The control system, the emergency shutdown system, fire and gas detection, escape lighting, communications.

A UPS and a generator solve different halves

They are routinely spoken of as alternatives. They are not.

A UPS has no starting delay because its energy is already stored and already flowing. The load never sees the interruption. What it cannot do is last — the battery holds minutes, not hours.

A generator can run indefinitely on fuel, but it takes time to start, reach speed and accept load. Seconds at best, and that is seconds during which everything on it is dead.

So a plant needing continuity for hours has both: the UPS carries the load through the gap, and the generator takes over before the batteries run down.

Autonomy is a calculation, not a property

Thirty minutes at commissioning is not thirty minutes today

That figure was computed from a new battery at a stated load and a stated temperature. Three things erode it, all silently:

Batteries age. Capacity falls with cycles and with time, and a battery at the end of its life may hold a fraction of its rating while still showing a healthy float voltage. Terminal voltage says almost nothing about capacity.

Heat destroys them. Battery life roughly halves for every 10 °C above the design temperature, which matters enormously in a Gulf switchroom whose air conditioning has been marginal for years.

The load grows. Equipment is added, nobody recalculates, and the autonomy quietly shortens in proportion.

The only honest answer is a discharge test — putting a real load on the battery and measuring how long it holds up. It is disruptive, which is why it is deferred, which is why so many UPS systems would not deliver half of what their label claims.

The DC system

Separate from the UPS, most plants run a 110 V or 220 V DC battery system for switchgear control: closing coils, trip coils, protection relays, indication.

The reason is the same one that justifies everything else here. A protection scheme has to open a breaker during a fault, which is precisely when the AC supply is disturbed or absent. A battery answers only to itself.

Interior of an indoor high voltage switchroom with a long lineup of metal-clad switchgear cubicles, each carrying a mimic diagram panel, breaker status indicators and a control handle. — Every trip circuit in this room is fed from a battery, not from the board it protects. The protection has to work on the day the supply does not.

Trip circuit supervision watches that path continuously, because an open trip circuit is invisible until a trip is demanded — at which point the relay operates correctly and nothing happens.

Load shedding

If the surviving source cannot carry what is connected, frequency and voltage collapse and everything is lost rather than some of it.

Load shedding drops the least important loads fast enough to prevent that — in a fraction of a second, on a priority order decided at design and implemented in the protection or the power management system.

Testing, and the illusion of a monthly start

And the part nobody tests: the changeover. An automatic transfer switch that has not operated in three years is a mechanism that may not move. Along with the batteries, it is what actually fails on the day.

A UPS battery room with long tiered racks of sealed cells connected in series by short copper links, a charger cubicle at the end of the row, ventilation ducting overhead and an eyewash station on the wall. — Every cell here reads a healthy float voltage. That tells you almost nothing about how long the room would actually carry the load — only a discharge test does.

What to take away

Normal, essential, emergency — every load is assigned at design, and the assignment drifts unless somebody checks.
A UPS covers the gap, a generator covers the duration. They are halves of one answer.
Autonomy is a calculation eroded by battery age, heat and load growth. Only a discharge test tells you the truth.
The DC system exists so protection can trip a breaker when the AC supply is gone.
Load shedding is designed in advance and must be revisited whenever the plant changes.
Test generators on load. No-load running proves little and actively harms a diesel.
The changeover switch and the batteries are what fail on the day, not the engine.