In short. A master controller runs a group of generators as one power plant. Each generator controller still starts, protects and regulates its own engine and alternator, but the master decides how many sets run, when the next one starts or stops, how much reserve is held, which loads are shed and how breakers and operating modes are coordinated. It must be designed so that its own failure leaves the plant running in a safe local mode, not dark.
Two layers of control, two different jobs
Every modern diesel generator has its own controller. It cranks the engine, watches oil pressure and coolant temperature, drives the AVR and governor, trips on its own protections and, in a paralleling set, synchronises and shares kW and kVAr with its neighbours. It knows one machine well and the plant not at all.
The master layer sits above those unit controllers. It sees total plant load, the sets available, the state of every breaker, the utility incomer and the priority of each feeder. In industrial projects it is called a plant master, a power management system (PMS) or a generator master controller, and it may be a dedicated master module from the same controller family or a PLC running project-specific logic. Either way, the functions below belong to it and should not be duplicated inside the unit controllers.
What the master actually decides
| Function | Decision the master takes | Information it needs | Consequence without it |
|---|---|---|---|
| Generator sequencing | Which set starts next and which stops first | Running hours, availability, priority list | Uneven hours, sets left running at low load |
| Reserve management | How much spare online capacity to hold | Plant load, online capacity, largest load step | Overload trips on the next motor start |
| Load management | Which feeders to shed and when to restore them | Feeder priorities, breaker status, load trend | Whole-plant blackout on loss of one set |
| Breaker coordination | Dead-bus arbitration, close permissives, tie control | Breaker positions, bus voltage, sync-check | Two sets closing onto a dead bus together |
| Mode selection | Island, utility parallel, test, manual | Utility status, operator selection, permits | Settings valid in one mode applied in another |
| External interfaces | What SCADA, BMS or BESS may read or command | Protocol mapping, permissions | Uncontrolled remote commands |
Sequencing and reserve: how the logic works
Sequencing is driven by reserve, not by load alone.
Reserve = Online capacity (kW) minus Plant load (kW)
Online capacity is the sum of the prime ratings of the sets whose breakers are closed, after site derating; plant load is the measured kW on the common bus. The master starts another set when reserve falls below a start threshold for a set time, and stops a set when the reserve remaining after its removal still exceeds a stop threshold for a longer time. Separate thresholds and delays prevent hunting.
Worked example (illustrative). Four sets, each 400 kW prime at site conditions, supply a plant whose load climbs from 500 kW to 650 kW in the afternoon shift. With two sets online the capacity is 800 kW and the reserve 150 kW. If the largest load step is a 110 kW compressor started direct-on-line, a start threshold near 25 percent of online capacity, 200 kW, is reasonable. The master starts the third set, synchronises it and closes its breaker, raising reserve to 550 kW. When night load falls to 350 kW, it confirms that removing one set leaves 800 kW online, unloads the set with the most hours, opens its breaker, runs the cooldown and stops it. See load management for how feeder priorities fit in.
Starting from a blackout
After a complete loss of supply every available set wants to be first onto the dead bus. The master arbitrates: one set closes onto the dead bus and the rest synchronise to it in turn. Starting all sets together and closing the first healthy one shortens restoration; sequential starting is gentler on batteries but slower. The choice depends on how fast the critical load must return and is covered in black start and dead-bus restoration.
Operating modes change the rules
In island mode the plant regulates its own voltage and frequency and the master manages sharing between sets. In utility-parallel mode the grid fixes both, and the master instead controls import or export at the point of connection, enforces any export limit and supervises reverse-power and loss-of-mains protection. Do not enable utility paralleling just because the unit controllers can synchronise; the protection and the DISCOM agreement are separate work, described in utility paralleling. A test mode and a manual mode at the synchronising panel should both exist and both be interlocked.
Designing for the master’s own failure
A master concentrates intelligence, and that is a single point of failure unless the fallback is designed. Settle these questions at design stage.
- If the master loses power or halts, do the unit controllers keep the running sets online and sharing load over their own peer link? They should.
- If the network between master and units fails, do the units hold their last state or revert to a defined local mode? Holding is usually safer than acting on stale commands.
- If the bus kW measurement fails, does the master flag the bad quality, or does it shed load on a zero reading?
- Can an operator start, parallel and transfer by hand at the LV switchgear with the master out of service?
Where outage consequence justifies it, a redundant master pair is specified. For most industrial plants in Telangana a single master with a tested local fallback is proportionate, and the fallback should be exercised at every annual test.
What the master should not do
It should not replace the unit controller’s engine protections, override emergency stops, or hold a breaker closed through a protection trip. Nor should it judge plant health from kW alone: a plant can have ample capacity while one set quietly takes too much reactive load and heads for an overcurrent trip, so sharing-deviation alarms belong in the master. It also cannot cure shared weaknesses it does not control. Four sets on one day tank with one transfer pump have one fuel system. Architecture options are set out in plant master control architecture and the wider integrated power systems guide.
Common mistakes
- Setting the start threshold from average load instead of the largest load step. The next motor start lands on a plant with no transient margin and the frequency dips far enough to trip sensitive loads.
- Giving the master authority over emergency shutdowns. A genuine engine fault is forced through a slow unload sequence while the damage spreads.
- Leaving the fallback mode untested after commissioning. The first time the master fails is during a real outage, and nobody knows which breakers to operate.
- Copying island-mode settings into utility-parallel mode. Reverse-power and voltage control behave differently against a stiff grid and the plant trips or exports without permission.
What to send us
Send the single-line diagram, the make and model of each generator controller, the number and rating of the sets, and a 24-hour load profile or at least the daily maximum demand and the largest motor started direct-on-line. Tell us whether utility paralleling is wanted and whether a SCADA or BMS needs read or write access. Photographs of the existing synchronising panel and controller fascias help us judge what can be reused. Use the application engineering enquiry page.
Questions engineers ask
Do I need a master controller for two generators in parallel?
Not necessarily. Two unit controllers from the same family can synchronise, share load and run simple load-dependent start and stop between themselves. A master earns its place with three or more sets, with load shedding or priority restoration, with utility paralleling, or when SCADA or BMS needs a plant-level interface.
What happens to the running generators if the master controller fails?
In a correctly designed plant nothing dramatic happens. The unit controllers keep the running sets online and continue sharing load over their own link, and an alarm tells the operator the master is out. What is lost is automatic sequencing, reserve management and shedding, so an operator must watch the plant until the master is restored.
How much reserve should the master hold?
Enough to absorb the largest expected load step within the frequency and voltage limits of the connected loads, plus a margin for ambient derating. For many industrial plants that is 20 to 30 percent of online capacity, but the figure comes from the load list and the generator transient data, not a rule of thumb.
Can the master controller equalise running hours between sets?
Yes, this is a standard duty. It keeps a priority list and rotates it on hours or on a calendar, so the set with the fewest hours starts first and the one with the most hours stops first. The rotation should be configurable, because sites often want one set held back as a maintenance spare.
Technical content reviewed by Srinivas Reddy, Managing Partner, Reddy Generators. Last updated 19 October 2026.