In short. A master generator controller turns several independent diesel sets into one managed plant. It decides how many sets run for the load, which starts next and which stops, how much spinning reserve is kept, how a lost set is replaced and how loads are shed. It sits above the genset controllers without taking over engine protection. As a shared dependency, its failure behaviour is designed and tested, and each set must still run safely without it.
What a master controller does that set controllers cannot
Each genset controller knows about its own engine, its own alternator and its own breaker. None of them knows the plant load, how many sets are available, or what the facility needs in ten minutes. The master controller, also called a plant controller or the generator part of a power management system, provides the plant-level view.
| Function | Decision made | Information needed |
|---|---|---|
| Capacity management | How many sets must be online for the load plus reserve | Plant kW, set ratings, availability status |
| Start and stop sequencing | Which set starts next and which stops first | Priority order, running hours, fault status, maintenance selection |
| Reserve supervision | Whether the plant can survive loss of the largest running set | Online capacity, largest set rating, load trend |
| Contingency response | What to do when a set trips under load | Breaker feedback, frequency, shedding priority table |
| Load shedding and restoration | Which feeders open on deficit and in what order they return | Feeder priorities, feeder kW, available capacity |
| Utility interface | Import, export or islanded operation where paralleling is permitted | Tie-breaker status, utility limits, interconnection approval |
Capacity, reserve and the contingency question
The central question the master asks continuously is what happens if the largest running set trips now. Online capacity minus plant load is the spinning reserve, and if that reserve is smaller than the largest set’s output, a trip produces an immediate deficit that the remaining sets must absorb until another set can start, synchronise and take load, which takes 15 to 40 seconds. During that window the plant either rides through on the overload capability of the remaining sets, sheds load, or collapses.
Reserve = Σ P_rated,online × k − P_load
Here P_rated,online is the rating of each set that is connected, k is the permitted loading fraction, often 0.8 to 0.9 for continuous running, and P_load is the plant demand. Worked example (illustrative). Four 500 kW sets are available and plant load is 1,050 kW. With three sets online at a 0.9 loading limit the usable capacity is 1,350 kW and the reserve is 300 kW. If one of the three trips, the remaining two have 900 kW usable against 1,050 kW of load, a deficit of 150 kW. The master should therefore either run all four sets, accept a short overload on two sets while the fourth starts, or have a shedding table that drops at least 150 kW of low-priority load within a second of the trip. Which is chosen is a facility decision that belongs in the functional description. The underlying architecture choices are discussed in N+1 power engineering.
Start and stop logic
A master controller starts the next set when plant load rises above a threshold, commonly 80 to 85 percent of online capacity, for longer than a set delay, and stops a set when load falls below a lower threshold, perhaps 40 to 50 percent of the capacity that would remain, for a longer delay. The gap between the two thresholds, and the delays, prevent hunting in which a set is started and stopped repeatedly as load fluctuates. Priority can be fixed, rotated on running hours, or set manually for maintenance. When a stop is ordered the master opens the set’s breaker only after its load has been ramped down to the others, and then lets the genset controller run its own cooldown before shutdown. Emergency shutdown is a separate, independently wired path. The sequencing options are covered in multi-DG sequencing and dispatch control.
What stays local
A master controller coordinates; it does not replace. Engine protection, cranking, crank disconnect, local metering, the set’s own voltage and frequency proving, its own synchroniser and its share of the load-sharing loop normally remain in the genset controller. The master issues a start request, a stop request, a breaker close or open request, and perhaps a load setpoint, and reads back status. The genset controller then continues to protect the engine whatever the master does, and each set can still behave sensibly when the master or its network fails.
Failure philosophy
A master controller is a single device on which every set depends, which is the definition of a common-mode risk. The design must answer what happens when it fails, when its power supply fails, and when the network between it and the sets fails. Acceptable answers differ by facility. A factory might accept that sets fall back to individual AMF operation in droop. A data centre might require a redundant master. What is not acceptable is a plant that cannot start automatically because one PLC has lost its program. The fallback mode must be tested by switching the master off during a load test and watching what the sets do. Redundant options are set out in redundant PLC and high-availability control architecture.
Availability is more than mechanical health
The master’s capacity arithmetic is only as good as its knowledge of which sets can really be used. A set that is mechanically perfect but has its selector in manual, has a latched alarm, is locked out for maintenance, or has a flat starting battery contributes nothing. Each should be a distinct input so that the reserve calculation excludes the set. Shared fuel systems are the other blind spot. Four sets on one day tank are four sets only while the tank lasts, and the master cannot reason about fuel unless tank level and pump status are signals.
Utility paralleling changes the problem
Where the plant is permitted to run in parallel with the DISCOM supply, the master takes on import and export limits, interconnection protection coordination and a controlled transition between grid-connected and islanded modes. Enabling this because the set controllers happen to have a synchroniser is a mistake; it needs the utility’s approval and a protection study. Plants that go further and coordinate storage or solar alongside the diesel sets move into the territory of a microgrid controller. The broader controller hierarchy is set out in power management system architecture.
Common mistakes
- Routing engine protection or cranking through the master PLC. A PLC fault or a network cable break then stops every set from starting or protecting itself.
- Setting start and stop thresholds too close together. Sets are started and stopped every few minutes as load fluctuates, wearing starters and wasting fuel.
- Counting a set as available because it is mechanically healthy. A selector in manual or a flat battery leaves the reserve calculation wrong at the moment it matters.
- Never testing the plant with the master switched off. The fallback mode is discovered, or found not to exist, during a real outage.
What to send us
Send the number and rating of the sets, the make of each genset controller, a single-line diagram of the generator bus and tie, the plant load profile or at least typical and peak kW, and your continuity objective in plain words, for example whether the plant must survive loss of one set without shedding. If an existing master or PMS is misbehaving, include its alarm and event logs. The application engineering enquiry is the right channel for plant-level control schemes.
Questions engineers ask
Do I need a master controller for two generators?
Not always. Two sets with modern genset controllers can synchronise and share load between themselves with built-in load-demand start and stop logic. A separate master becomes worthwhile from three or four sets upwards, or where load shedding or utility paralleling is required.
What happens if the master controller fails during an outage?
That depends entirely on the design, which is why it must be specified and tested. In a well-designed plant the sets revert to local automatic operation, start on mains failure, and share load in droop without optimisation. In a poorly designed plant nothing starts. Ask for the fallback mode to be demonstrated at commissioning.
How much spinning reserve should a generator plant keep?
Enough that the loss of the largest running set does not overload the rest beyond what they can carry until another set connects, or enough that an agreed amount of load can be shed in that interval.
Can a master controller manage generators of different makes?
Yes, through hardwired start, stop and breaker signals and standard load-share interfaces, or through Modbus and CAN links where the controllers support them. Mixed plants need an interface schedule that defines each signal for each set, and the integration is commissioned set by set.
Technical content reviewed by Srinivas Reddy, Managing Partner, Reddy Generators. Last updated 19 October 2026.