Generator load-test trip on a Tier III claim
At 02:10 a scheduled generator load test trips a 2,000 kVA generator on overcurrent after 38 seconds at 1,650 kW. The UPS transfers to battery and recovers; no customer load is lost. The site has 2N UPS but N+1 generation: three 2,000 kVA generators, two running. Actual IT load is 1,420 kW against a 1,100 kW design load. Battery strings are four years old; the last capacity test gave 9 minutes at 1,500 kW against a 10-minute design. The maintenance provider's method statement says to test at 80% nameplate on UPS maintenance bypass, but the bypass panel is interlocked with the generator breaker. No change record exists for the interlock. The account manager has promised a customer a 'no-risk' test next week. Two previous tests were aborted, and the facility markets itself as Tier III concurrently maintainable.
1. State the immediate actions and decide whether next week's test should proceed. Justify the decision in terms of safety, load risk and change control.
Read the worked answer
Do not proceed with the customer-promised test. The generator tripped at 1,650 kW, only 250 kW above the actual 1,420 kW IT load; the N+1 generation is not proven for the real load. The UPS is carrying 1,420 kW with battery runtime of about 9 minutes, and the generator start sequence is not the issue-the generator breaker opened. Immediate: freeze the test schedule, declare an incident or asset risk, verify generator protection settings and fuel, and run a load-bank test at the switchgear rather than on UPS bypass. Keep the UPS on battery if a test is unavoidable, but only with a written MOP, a spotter at the bypass panel, and customer notification. The interlock change without a change record is a stop-work finding: no bypass until the interlock is traced, documented and approved. The 'no-risk' promise is unsupported because the facility cannot demonstrate concurrent maintainability of generation. Next week is acceptable only for a no-load generator check, not a loaded test.
2. What root causes and compliance gaps should the investigation cover, and what interim capacity limit would you set?
Read the worked answer
Root causes: generator sizing and settings against a 1,420 kW load, protection coordination, and whether the 80% test method was ever valid for this topology. Also battery degradation: 9 minutes at 1,500 kW is below the 10-minute design with no margin for ageing; that is an operational risk even if the test passes. Compliance gaps: the Tier III concurrent-maintainability claim is not supported if the UPS bypass cannot be used with the generator, and the undocumented interlock defeats change control. Check MOP review, switching authority, and whether the design load of 1,100 kW was ever updated after growth. Interim limit: cap IT at the highest load that can be carried by one generator plus the other generator's firm capacity with one unit out-given the trip, I would not exceed 1,100 kW until protection is re-set and a full load test passes. That means deferring or migrating about 320 kW. Battery strings should be replaced or load-tested to an accepted standard before any further bypass test.
3. Draft the customer communication and the internal governance actions.
Read the worked answer
Customer: state that the scheduled test is postponed because a protection setting did not perform as expected; no customer load was lost; the site remains on UPS with generator backup; provide a date for a witnessed test after remediation. Avoid 'no-risk' language and avoid claiming Tier III until the bypass and generation paths are proven. Internal: open a major incident or risk record, assign an owner, quarantine the MOP, and require engineering approval for any bypass. Update the capacity plan to reflect 1,420 kW actual load. Brief sales that contractual claims must be evidence-based. Set a 30-day gate: protection study, battery test, revised MOP, and a witnessed load test at the interim limit. If the gate slips, move load or invoke the customer continuity plan. This is a governance failure as much as a technical one: the interlock changed without a record, and the account manager made a commitment outside change control.