In short. A refinery or process plant rarely asks a generator to keep production running. It asks the generator to bring the plant to a safe, recoverable state: lubrication and seal oil pumps, instrument air, flare and firewater systems, control rooms and emergency lighting. The emergency generator is sized for that defined shutdown load, starts within seconds, feeds a dedicated emergency switchboard, and is tested against the written shutdown sequence rather than the plant’s total demand.
Full production or safe shutdown
The first decision in any process plant is the objective of backup power. A refinery drawing 40 MW from the grid and its captive power plant will not carry production on diesel generators, and it does not need to. What it needs is to protect rotating equipment, prevent product loss, keep the flare and fire systems available and preserve the operator’s view of the plant while the process is brought down in a controlled way. Wellsite and gathering station power is a different problem, covered on the upstream oil and gas page. Smaller process plants, such as a bulk drug unit in the Hyderabad pharmaceutical belt or a speciality chemical plant near Visakhapatnam, may define a wider objective that keeps a reactor cooling train or a critical batch running, but the principle is the same: the process owner states the operating condition the generator must support, and the generator is sized for it. Sizing for the full plant load produces a set that is too large, lightly loaded during real events and never tested properly.
| Load group | Purpose during an outage | Typical supply | Interruption tolerated |
|---|---|---|---|
| DCS, ESD, safety instrumented systems | Keep the plant visible and shutdown logic alive | UPS with generator behind it | None |
| Lube oil, seal oil, barring gear | Protect compressors and turbines on coast-down | DC or UPS for emergency pumps, generator for AC pumps | Seconds |
| Instrument air compressor | Hold control valves in a controllable state | Emergency generator | Until receiver pressure decays |
| Firewater jockey pump, flare pilots, gas detection | Fire and emergency readiness | Emergency generator, often with diesel-driven main pumps | Seconds |
| Emergency lighting, communication, control room HVAC | Safe egress and operator working conditions | Emergency generator | 10 to 15 seconds |
| Process heating, main pumps, utilities | Production | Not supported | Shut down |
Start time and the emergency switchboard
Process plants normally define the emergency generator as the source for a dedicated emergency switchboard, fed in normal operation from the main plant board and transferred to the generator on loss of supply. The transfer time is driven by the most sensitive emergency load, typically the lube oil pumps on large machines, and emergency sets are specified to accept load within 10 to 15 seconds of the supply failing. That requirement shapes the set: jacket water heaters so the engine starts warm, duplicated starting batteries with chargers, a controller that attempts several start cycles, and a weekly automatic test run. The AMF panel page describes the start and transfer logic, and the emergency and standby architecture guide covers how the emergency board is separated from the normal distribution so that a fault on the normal side cannot take the emergency supply with it.
Emergency set kW = Σ (connected emergency loads × demand factor) + largest motor starting allowance
Here the demand factor reflects which emergency loads genuinely run together during a shutdown, and the starting allowance is the extra capacity needed to start the largest emergency motor, usually the instrument air compressor or a firewater jockey pump, without an unacceptable voltage dip. For an emergency board with 420 kW of connected load, a demand factor of 0.7 and a 55 kW compressor started direct-on-line, the set lands around 500 kVA at 0.8 power factor (illustrative), confirmed against the alternator’s motor-starting data. The generator sizing guide explains the method in full.
Hazardous areas and plant integration
A refinery is divided into classified zones under IS/IEC 60079-10, and the emergency generator belongs outside them, usually in or beside the substation that houses the emergency switchboard. Where the only available location is close to process units, the project will specify spark arrestors, air intake shut-off valves and gas detection interlocked to the generator, and the installation will be reviewed by the plant’s electrical safety authority and, for petroleum installations, under OISD practice. The generator also has to fit the plant’s protection and earthing philosophy. Many refineries use resistance-earthed systems at 6.6 kV or 11 kV and solidly earthed systems at 415 V; the generator’s neutral earthing must match the system it feeds so that earth-fault protection and the existing relay settings remain valid. The earthing and neutral architecture page covers the options.
UPS, DC systems and restart sequencing
The control system and safety instrumented systems sit on UPS and station battery supplies, which must bridge the generator start and continue through the whole shutdown if the generator fails. UPS battery autonomy in process plants is therefore specified in tens of minutes to hours, not the ten minutes common in commercial buildings, and the generator must be able to carry the UPS rectifier load, which is nonlinear and presents a step when the batteries begin recharging. Restoration is as important as the outage. When grid supply returns, loads are brought back in a documented order: control power and lighting first, then lubrication and cooling, then utilities, and only then process equipment under the process team’s authority. The restart sequencing guide explains how to keep a large block load from tripping the generator or the restored supply.
Testing against the shutdown scenario
An emergency generator that has only ever been run on no-load test is not a proven system. Process plants should test the full sequence at acceptance and at planned intervals: fail the normal supply to the emergency board, record the start and transfer time, confirm each emergency load picks up in sequence, run under real load long enough to reach stable temperature, and confirm the return transfer. Between integrated tests, a monthly load run on a resistive load bank at 50 to 70 per cent of rating prevents wet stacking in a set that otherwise idles. The load bank testing page describes the procedure and the records to keep for the plant’s safety audit.
Common mistakes
- Sizing the emergency generator for the whole plant because the load list was never classified. The set is three times too large, runs lightly loaded during real events and is never properly tested.
- Feeding the emergency board through the same switchgear section as the normal supply. A busbar fault on the normal side removes the emergency supply at the moment it is needed.
- Specifying UPS autonomy at ten minutes as in an office building. The batteries are flat before the shutdown is complete if the generator fails to start.
- Changing the generator neutral earthing to suit the set rather than the plant system. Earth-fault relays stop coordinating and a fault clears by tripping the whole emergency board.
What to send us
Send the emergency load list with the shutdown objective agreed by the process owner, the required transfer time for the most sensitive load, and the single-line diagram showing the emergency switchboard and its normal feed. Include the area classification around the proposed generator location, the plant’s neutral earthing arrangement and voltage levels, and the UPS and DC system ratings the generator must support. Send your refinery or process plant requirement.
Questions engineers ask
How fast must a refinery emergency generator start?
Most process plants specify that the emergency generator accepts load within 10 to 15 seconds of supply failure, driven by lubrication and firewater systems. Loads that cannot wait even that long, such as control systems and emergency lube oil pumps, are carried by UPS or DC systems during the gap.
Should the emergency generator carry production load?
Usually not. The generator is sized for the loads that bring the plant to a safe, recoverable state. Supporting production through a long outage is a job for captive power or a paralleled generator plant, which is a different and much larger system.
Can the emergency generator be installed near process units?
Only outside classified zones, or with the additional protective features the project specifies and formal review by the plant safety authority. The preferred arrangement is to place the set at the substation and run cable to the emergency board.
How often should an emergency generator in a process plant be tested?
A weekly automatic start, a monthly run under load, and a full integrated test of the transfer and shutdown sequence at acceptance and at a planned interval agreed with operations. The integrated test is usually scheduled annually during a turnaround.
Does the generator need to match the plant earthing system?
Yes. The generator’s neutral earthing must match the system it supplies, whether solidly earthed at 415 V or resistance earthed at medium voltage, otherwise earth-fault protection and existing relay coordination become invalid.
Technical content reviewed by Srinivas Reddy, Managing Partner, Reddy Generators. Last updated 19 October 2026.