In short. A critical load is served by a hierarchy of sources: preferred, alternate and last resort. Each hands over to the next in a defined order and time. The continuity chain is the set of transfers and conditioning steps that make those handovers invisible to the load. Design it as a sequence with times, not as a list of equipment.
A typical hierarchy
- Preferred source: usually the utility, for economy.
- Alternate source: a second utility feed or a generator.
- Bridging source: UPS or BESS that carries the load while the alternate starts.
- Last resort: manual crossover, rental connection point or a portable unit.
Each level should have a defined trigger, a defined time and a defined return condition.
The chain in time
| Moment after loss | What carries the load | What is happening |
|---|---|---|
| 0 s | UPS or battery | Loss detected; inverter continues |
| Within seconds | UPS or battery | Generator starts, reaches voltage and frequency |
| Seconds to tens of seconds | Generator through ATS | Transfer after stability checks |
| Minutes | Generator | Loads restart in stages; UPS recharges |
| On utility return | Generator, then utility | Retransfer after stable supply is proven |
Check the UPS battery covers the start and transfer time with margin, including the case where the first start attempt fails.
Priority and permissive logic
- The controller decides which source is healthy using voltage, frequency and time delays.
- Interlocks stop two sources being connected without synchronising.
- Retransfer should wait until the preferred source has been stable for a set time, to avoid repeated switching.
See ATS, STS and UPS coordination.
Where chains break
- Shared dependencies: one DC supply for controls, one fuel path, one cooling circuit.
- Undetected standby failure: the alternate source is silently unavailable until needed.
- Time mismatch: battery autonomy shorter than generator start plus a failed attempt.
- Hidden single path: one breaker or busbar section that every source passes through.
Worked illustration
A UPS has 10 minutes of battery at full load. The generator normally takes 15 seconds to take load. The margin looks generous. But if the generator fails its first start, a second attempt after a retry delay may take 45 seconds, and a manual start 5 minutes. The design question is what happens at minute 10: either another source must be ready, or the loads must shut down in an orderly way. The hierarchy needs an answer for each step.
Designing the hierarchy
- List loads and tolerable gaps.
- Choose sources that can fail independently.
- Assign transfer devices and times.
- Add the last-resort connection.
- Test the chain end to end, including failure of each step.
Return to normal
Recovery needs as much design as failure. When the utility returns, the system should retransfer without a second interruption where the loads need it, recharge batteries at a controlled rate so the generator is not overloaded, and return the controls to auto. Record the sequence so operators know what normal recovery looks like.
Verification
- Time each handover with a recorder and compare with the design.
- Repeat with one element failed, such as a generator that does not start.
- Confirm alarms reach the people who must act.
Sources in order of response time
| Source | Response | Duration |
|---|---|---|
| Utility | Continuous | Unlimited, until it fails |
| Flywheel or UPS battery | Instant | Seconds to minutes |
| BESS | Instant to seconds | Minutes to hours |
| Generator | Seconds to start | Hours to days with fuel |
| Rental or mobile generator | Hours to connect | Extended |
The UPS protects the instant; the generator protects the duration. Each source covers the gap that the faster one cannot.
Gap analysis
Draw a time line from the outage start. At 0 s the UPS carries the load; at 10 to 15 s the generator is ready; at the end of the UPS autonomy the system is at risk if the generator has not taken over. The design is sound only if each handover has margin. Illustratively, with 10 minutes of UPS autonomy and a 15 second start, margin is large. If the generator fails to start, the 10 minutes is the time available to bring in a rental unit or shut down safely.
The continuity chain
- Detection of failure.
- Transfer to the next source.
- Stable operation on the new source.
- Return to normal and recharge.
Check each stage for single points of failure. See resilience architecture and transfer coordination.
What to send us
Send your supply arrangement and current transfer sequence. Send your application details. See also dual-utility architecture and standby generator architecture.
Questions engineers ask
What is a continuity chain?
The ordered set of sources, transfers and conditioning steps that keeps a load powered from the moment of loss to full recovery.
Why wait before retransferring to the utility?
Utility supply often flickers after restoration. A stability delay avoids repeated transfers that stress equipment and interrupt loads.
How do I know the standby source is healthy?
Monitor battery, fuel level, controller state and readiness signals, and test on a schedule. A source that cannot start is not a source.
Should there be a manual last resort?
Yes for important sites. A pre-wired connection point for a rental generator is a common and effective last resort.
This guide gives general principles. Actual times and settings must come from detailed design and testing.