Integrated Systems Test: 14-Second Transfer and Dead Equipment-Branch Circuits
A hospital is commissioning a new 24-bed ICU tower served by a 1,250 kW diesel generator configured as a Type 10, Level 1 emergency power supply system. During the integrated systems test, the automatic transfer switch transferred 14 seconds after simulated utility loss. Two ventilators on the critical branch alarmed for low battery, the nurse call system's UPS carried the load for 8 minutes and then shut down, and a pharmacy refrigerator on the equipment branch lost power entirely while the ICU's red receptacles stayed energized. The general contractor says the 14-second transfer 'meets the 10-second rule with margin' and asks clinical engineering to sign the electrical commissioning checklist so the floor can open Monday. A Joint Commission survey is eight weeks away.
1. Which findings are deficiencies, and should you sign the checklist?
Read the worked answer
Do not sign. The contractor's statement misreads the requirement: a Type 10 system means the load must be capable of being supplied within 10 seconds, so 14 seconds is a failure, not margin. Everything else on the list compounds it.
- Transfer time. 14 seconds exceeds the Type 10 criterion and the 10-second restoration expectation that critical-care areas are designed around. Confirm whether the delay is an ATS setting, a generator start sequence, or a load-shedding design, but the observed performance is the finding.
- Ventilator low-battery alarms at 14 seconds. Ventilators on the critical branch should ride through a compliant transfer on internal battery. Alarms at 14 seconds indicate either a battery that was not fully charged (a commissioning and maintenance issue) or a device not actually on the branch it is labeled for.
- Nurse call UPS, 8 minutes. Verify the design requirement and the code basis for the required duration; 8 minutes is very likely short of it, and nurse call is a critical-branch load. A UPS that dies during an outage removes the call system at the worst moment.
- Pharmacy refrigerator dead while red receptacles are live. This is a labeling or branch-assignment error. In an outage, staff will trust the red receptacles and will assume the refrigerator is backed up. Both assumptions must be made true or clearly corrected.
Clinical engineering signs that the systems are safe and functional, not that the paperwork is complete. Signing converts a known commissioning defect into a patient-safety exposure that the survey eight weeks out will not excuse.
2. If leadership will not delay the opening, what interim measures would you require and how would you document the risk acceptance?
Read the worked answer
Recommend delay first and quantify why: a 24-bed ICU opened with a sub-10-second failure and no reliable nurse call backup will eventually experience an outage at night with intubated patients. A delay is a schedule cost; the alternative is a clinical event.
If leadership overrides, interim controls should be specific and time-bound:
- A temporary generator or UPS sized for the nurse call system and the ventilator loads, with a documented runtime and refueling plan.
- Verification of battery capacity and charge status on every ventilator and every critical device in the tower, plus a spare-battery inventory and a defined swap procedure.
- Receptacle-by-receptacle verification with a plug tester and panel schedule, with corrected labels before occupancy, so staff know which outlets are backed up.
- Temperature monitoring and an alternate storage plan for refrigerated drugs, or relocation of the refrigerator to a verified critical-branch circuit.
- A daily generator test with recorded results and a written trigger for evacuating or transferring patients if a subsequent test fails.
The risk acceptance must be in writing, signed by the CMO and COO, with clinical engineering's objection attached, a named owner for each interim control, an expiration date, and the remediation date for the underlying defects. Verbal assurances do not transfer the risk to the people who accepted it. Copy the safety committee and the accreditation readiness lead so the survey team sees the issue being managed rather than discovered.
3. What should the retest and commissioning documentation include before the tower is accepted?
Read the worked answer
The retest should reproduce real conditions rather than re-run a script that already failed.
- A witnessed integrated systems test starting from a fully loaded generator, with utility loss simulated at the service entrance, timing recorded by an instrument rather than a stopwatch. Require the transfer to meet the 10-second criterion at rated load.
- Individual branch verification: life safety, critical, and equipment branches each tested separately, with a walk-through of every patient room confirming which receptacles and which loads are energized from which branch. Update the panel schedules, as-builts, and room labeling to match.
- UPS runtime test under actual connected load, not nameplate load, with the measured runtime recorded against the design requirement for nurse call and any other supported system.
- Generator testing per NFPA 110 expectations, including loading and the monthly test procedure the facilities team will actually follow after occupancy, with the first several monthly results reviewed by clinical engineering.
- Manufacturer and contractor certifications, a punch list with closure evidence for each item, and the results entered into the CMMS so the tower's equipment history starts complete.
- A briefing for ICU staff on what is and is not backed up, which is the practical output of all the testing.
Clinical engineering's signature should come only after the punch list is closed and the retest is witnessed. Anything signed earlier is a promise to test later, and later never has the same leverage.