In short. A system is proven by what it does when parts fail. Failure simulations test the technology and the people: a utility loss, a generator that does not start, a breaker that fails, a recovery after a blackout. Run them in stages, from paper to live, with clear safety controls and recorded results.
Levels of simulation
| Level | Description | Risk |
|---|---|---|
| Tabletop | Walk through a scenario with the team on paper | None |
| Simulated signals | Inject a fault signal into controls without real power loss | Low |
| Load-bank test | Real power, dummy load | Low to moderate |
| Live partial | Real loads on one path or zone | Moderate |
| Full live (“pull the plug”) | Real utility loss with real loads | Highest; most informative |
Scenarios to simulate
- Utility loss with normal start.
- Utility loss with generator start failure.
- Transfer switch fails to operate.
- UPS inverter or module failure.
- Loss of control power.
- Generator overload and load shedding.
- Loss during maintenance of one path.
- Utility restored while on generator.
Recovery testing
Recovery is where many sites struggle. Test the restoration of loads, recharge of batteries, return to utility, resetting of alarms and returning controls to auto. Ask whether staff can complete the steps without the designer present. See restoration sequencing.
Preparing a live test
- Write a method statement with steps, abort criteria and rollback.
- Check the readiness of all sources and the state of redundancy beforehand.
- Notify all affected parties and have support standing by.
- Place recorders at key points.
- Choose a time with low business risk.
- Have a go or no-go decision with named authority.
What to measure
- Time from loss to generator on load.
- Voltage and frequency at the generator and critical loads.
- UPS state: battery time used, transfers.
- Alarms and notifications, and whether they were clear.
- Staff response and time to recovery.
After the test
Hold a review with all participants, record deviations and fix them, update procedures and training, and decide when to retest. Keep the results as the baseline for the next test.
Worked illustration
A tabletop exercise asks what happens if the generator fails to start during a utility outage at 2 a.m. The team finds the on-call engineer’s contact list is out of date and the rental generator connection point has no documented procedure. Neither would have been found by testing equipment. Fixing both took a day and cost nothing compared with the outage they would have prolonged. A later live test then confirms the technology works too.
Why simulate failure
A plan that has never been exercised is a theory. Failure simulation shows how the real plant and its people behave when something goes wrong.
| Simulation | What it proves |
|---|---|
| Utility failure with generator success | Standard path works |
| Utility failure with generator start failure | UPS autonomy, alarms, call-out, rental plan |
| Single UPS or path loss | Redundancy holds |
| Loss of control power | Safe state achieved |
| Fuel supply interruption | Autonomy and delivery arrangements |
| Communication loss | Local control works |
Progression
- Tabletop exercise: walk through the scenario with all staff.
- Simulated signals: inject alarms without moving power.
- Live test on a non-critical section.
- Live test on the critical system under controlled conditions.
Recovery measures
Track time to detect, time to respond, time to restore, and whether the procedures were followed. Update the procedures after each exercise.
Frequency
Run a full exercise at least annually and after major changes; tabletop exercises more often. Include night and weekend shifts when staffing is thin.
Post-test review
Hold a blame-free review, record lessons and assign corrective actions with dates. See integrated systems testing.
Common mistakes
- Running only the easy scenarios.
- No abort criteria.
- Failing to test recovery and people.
What to send us
Send your current test procedures and recent test results. Send your application details. See also integrated systems testing.
Questions engineers ask
Is a pull-the-plug test safe?
It can be, with preparation, redundancy verified, rollback and clear authority. Start with lower-risk tests.
How often should simulations run?
Drills at least annually, and live tests on a schedule agreed with the business, plus after major changes.
What if a test fails?
That is useful information. Record it, fix it and repeat the test.
Do tests include people?
Yes. Procedures, contact lists and training are part of the system.
This guide gives general principles. Live tests must follow your site’s safety rules.