How to Verify a Backup System Carries What It Claims

Why this matters

Almost every backup system in the field has been tested, and almost none of them have been verified. The monthly exercise cycle runs the engine with no load on it, the controller logs a successful run, and everyone involved reads that log as proof the system will carry the building. It proves the engine starts. Whether the system carries what it claims is a separate question, answered by different observations, and the outage is a bad place to ask it for the first time.

This card gives you the test as a record you fill in. The record is the deliverable, not the run - a run nobody wrote down has to be repeated by the next person.

Four separate claims, four separate observations

A backup system makes four claims, and they fail independently. Verify them as four, because a system can pass any three and fail the fourth.

1. It starts. The engine or inverter comes alive on the loss-of-source signal, within its stated delay.
2. It transfers. The switch actually moves and the emergency side goes live. A set that starts and runs while the switch stays in normal has passed claim one and failed claim two, and from the parking lot the two look identical.
3. It carries. The connected load rides through the transfer and runs at steady state without the source sagging, overheating, or shutting down on a protective function.
4. It sustains. It does that for as long as the site needs, on the fuel or battery capacity actually present, with cooling that holds up once everything is hot.

The no-load exercise addresses the first claim and touches the second only if the controller is set to transfer during exercise, which many are not. Claims three and four are invisible to it entirely.

Before you drop the source

The test creates the hazard. You are deliberately taking a building's power away, so the permissions come before the procedure.

• Get written permission from someone with authority over the site, and ask specifically what is on the emergency side. Life safety, medical, refrigerated stock, servers and any process that cannot be interrupted are each a reason to change the plan rather than proceed. If the system serves a legally required or emergency load, testing it is governed work, not a favor you do on a maintenance visit.
• Engine exhaust is carbon monoxide, and it is the hazard on this job that gives no warning. Wear a personal CO monitor for the whole test, confirm the exhaust terminates outdoors and away from every intake and opening before the engine cranks, and never run a set inside a building, a partly open enclosure, a garage or a loading dock. If you cannot confirm where the exhaust goes, you do not start the engine.
• Treat the set as ready to crank at all times. An automatic controller will start it on a signal you did not send. Put the starting circuit out of service by the manufacturer's stated method before you put a hand anywhere near a belt, a fan or a coupling, and keep hands off the exhaust manifold and radiator piping, which reach burn temperature within minutes and stay there long after shutdown.
• Any meter reading on energized conductors runs through the same gate as every other live reading. Under 29 CFR 1910.333(a)(1), the parts are de-energized unless your employer can demonstrate that de-energizing introduces additional or increased hazards or is infeasible. Measuring a load under transfer is one of the genuine cases where the measurement cannot be taken dead, so it is performed as energized work under your employer's electrical safety program, with boundaries and PPE established per NFPA 70E-2021, 130.5 and 130.7 in the edition that program adopts. Where the work is not measurement but contact, lock out per 29 CFR 1910.333(b)(2) - not 1910.147, which excludes electric utilization work at 1910.147(a)(1)(ii)(C) - and prove dead with the live-dead-live sequence at NFPA 70E-2021, 120.5. On a construction site, the electrical lockout counterpart is 29 CFR 1926.417.
• Batteries vent hydrogen and hold acid. Check the starting battery with eye protection on and no source of ignition at the cell caps, and do not lean over a battery while cranking.

The record, field by field

Each field below is on the sheet because a blank in it makes the result unusable. The reasoning matters more than the form.

Site and system identity. Set nameplate rating (standby and prime, if both are given), transfer switch rating and pole configuration, fuel type and on-site capacity, and the date of the last service. Without the pole configuration you cannot interpret anything you later measure on the neutral or the grounding conductors.

Coverage. The count of branch circuits on the emergency side against the building's total, and the specific loads that matter to the owner. A coverage count that disagrees with the owner's belief is a finding in itself and often the most valuable line on the sheet.

Baseline before transfer. Voltage on each leg at the emergency panel and the running load, with the site on normal power and the normal complement of equipment running. This is your comparator, and it has to be taken under the same conditions as the reading you will compare it to, or the comparison is meaningless.

Start and transfer timing. Time from loss of source to engine start, and from start to switch transfer. Both come off the controller's own delays, so a value that disagrees with the setting points at the sensing, not the engine.

Behavior at transfer. What dropped out and what rode through. Acceptance here comes from two places, and the tighter of the two governs: the set's own transient limits from its spec sheet, which are stated against a performance class in the standard the manufacturer references, and the ride-through of the most sensitive load on the emergency side. Control boards and contactor coils drop out somewhere below nominal in a band the component data gives you; take that band from the data rather than from a rule of thumb, because it varies by device.

Steady-state load as a percentage of the set's rating. Not the connected total, the measured running load. This is the number that tells you whether the set is loafing or working.

The largest single step the site can present. Measure it, do not calculate it from the general section's assumption. A compressor or a pump starting is a multiple of its running current, and the multiple depends on the motor and its starting method rather than on any figure that travels.

Sustained run. Duration, load, and the temperatures and voltages at the end rather than at the start. Things that pass at minute three fail at minute ninety.

Retransfer. What happens when the utility returns and everything restarts at once. The retransfer step load is frequently larger than the transfer step load, because on transfer the loads are already off and on retransfer some of them are running.

Worked example: a small commercial site, filled in

Say the set's nameplate standby rating is 30 kW and the transfer switch is 100 A, three-pole on a 120/240 V single-phase service, so the neutral is switched and the set is a separately derived system. The emergency panel carries 12 of the building's 40 branch circuits. Fuel is a 120-gallon tank, last serviced within the year.

Baseline before transfer, with the normal complement running: legs within a couple of volts of each other, measured load 11.4 kW. Against the 30 kW nameplate that is 38 percent, which is a comfortable place to sit but tells you nothing yet about the steps.

Transfer: start at 9 seconds after the source dropped, transfer at 20 seconds. Both agree with the controller's programmed delays, so the sensing is doing its job.

At transfer, the walk-in cooler condensing unit was off and started 40 seconds later. That single start was the largest step of the whole test, and it is the one that matters: the voltage dip it produced recovered well inside the set's stated transient window, but one control board on the emergency side reset during it. The set passed its own spec and the site still lost a load, which is exactly why the tighter of the two criteria governs. On this site the governing criterion was the board, not the set, and the finding on the ticket says so.

Sustained run of 2 hours at 38 to 46 percent of rating, the range depending on which refrigeration was cycling. Coolant temperature stabilized inside the first 40 minutes and held. Voltage at the end was within a volt of the reading at minute five.

Retransfer produced the biggest event of the day. Utility returned, the switch went back after its programmed delay, and three refrigeration loads that had been staggered by their own cycling all restarted inside the same few seconds because they had all been off during the retransfer break. Nothing tripped, but the dip was deeper than anything the transfer produced.

Two hours of one technician's time converted four unknowns into four written answers, one of which - the board that resets on the cooler's start step - would otherwise have surfaced during the next real outage with product on the line. That is the trade the test is making.

Reading the record after the fact

A finished sheet answers a question the customer will ask in a different form: is this system good enough? Three patterns come up repeatedly and they mean different things.

Steady-state load well under the rating, with a step that misbehaves. The set is not undersized in the sense the owner means. The problem is the transient, and the fix is usually at the load: soft starting, staggering the restarts, or moving one load off the emergency side.

Steady-state load approaching the rating. Now the sustained run is the important half of the test, because a set that holds voltage at minute five and cooks at minute ninety is a summer callback waiting to happen. Do not accept a short run as evidence here.

Everything passes and the fuel does not last. Claim four failed alone. Runtime is the on-site capacity divided by the consumption at the measured load, and the consumption figure comes from the manufacturer's curve at that load, not from a nameplate maximum. This is a planning finding, not a repair.

References

• 29 CFR 1910.333(a)(1) and 1910.333(b)(2), electrical work practices and lockout for electrical work; 29 CFR 1926.417 for the construction counterpart; 29 CFR 1910.147(a)(1)(ii)(C) for the carve-out
• NFPA 70E-2021, 120.5, 130.5 and 130.7, as adopted by your employer's electrical safety program
• NFPA 110, in the edition your authority having jurisdiction has adopted, where the system is a legally required or emergency power supply system: it sets a monthly operation under load with stated criteria and an annual test where the monthly runs do not meet them
• Manufacturer spec sheet transient limits, stated against the performance class in the standard the sheet references, and the manufacturer's fuel consumption curve at the measured load
• See related: What a Transfer Switch Decides; Generator Sizing + Selection Reference