Backup Power in Data Centers: UPS, Generators, Fuel

When the utility feed into a data center drops, the sequence that follows is the same in every building even when the building is not. A UPS module switches to battery power in milliseconds, a transfer switch signals the generator to start, the generator starts and synchronizes, and within about ten seconds the emergency power system carries what the grid carried a moment earlier. That outage is really the story of three separate systems working in sequence: the UPS bridges the gap measured in seconds, the generator owns the hours, and the fuel that feeds the generator owns everything after that. Utility outages are rare, but they are not gentle events, and they are the moment when every sizing margin, every skipped test, and every fuel level that was estimated instead of measured shows up at once.

The catch is that the three layers are almost always planned independently. The UPS gets sized by electrical engineers against a nameplate load, the generators get procured by facilities against a peak demand figure, and the fuel plan is whatever the tank capacity turned out to be. This article treats backup power as the single chain it actually is: how to size a UPS against the real load, how to test a diesel generator so it fails in the yard rather than under load, and how to plan fuel volumes, burn rates, and refueling so the chain holds for the duration of a genuine outage.

Sizing the UPS: kW, kVA, and Headroom

The first question in UPS sizing is not how many kilowatts you want to protect but what your equipment actually draws, and the two numbers routinely differ by more than half. Nameplate ratings on power supplies reflect worst case capacity, not production load, so a server that says 1,200 watts on the label typically measures 350 to 550 watts in production, and a rack full of them carries the same gap. Sizing against nameplate produces a plant that is dramatically oversized, expensive, idle, and inefficient for years, while sizing against measured draw produces a plant with room to work. Start from real data, metered PDU readings or power distribution records, never from the sticker on the power supply.

The second variable is the difference between kW and kVA. A UPS is rated in both because it must carry the real power that does the work and the apparent power that combines voltage and current, and the ratio between the two is the load’s power factor. A module rated 100 kVA delivers 100 kW only to a load with a power factor of 1.0; with the 0.8 power factor profile common in older equipment it supports about 80 kW. Check both limits against your load, because overshooting either one pushes the module toward alarm and eventually offline, and manufacturers derate their own published figures with the same assumptions.

Once you have the real number, the sizing arithmetic is the buffer discipline used everywhere else in the plant. Continuous loads must stay within 80 percent of a breaker’s rating under the National Electrical Code, and a UPS running above that line both ages its batteries faster and risks hitting its limit at precisely the wrong moment. On top of derating, add a growth margin of 15 to 25 percent so the module you buy today still fits the hall you will have in three years. A hall that measures 400 kW of real draw, carries a 25 percent growth margin, and respects the 80 percent continuous limit needs at least 625 kW of usable capacity, which lands on a 750 kVA module delivering 675 kW to a 0.9 power factor load: the example the sizing flow above walks through case by case.

Runtime: Batteries Are for Seconds, Not Hours

Data center UPS batteries are built to measure minutes, not hours, and sizing them beyond that buys cost and floor space without buying reliability. In a facility with a generator, the UPS exists to make the transition invisible: the moment the utility fails, the inverter takes over with no drop, the transfer switch signals the generator to start, and the batteries carry the load only until the generator is ready, typically ten seconds under the NFPA 110 Type 10 classification that data centers use. The common exception is single path facilities, where the batteries also fund an orderly shutdown if the generator fails to start, and those designs deliberately specify 15 to 30 minutes so operators can stage a controlled power down rather than a crash.

Three battery realities belong in every sizing decision. First, rated runtime is a fresh battery at rated conditions, and a bank at end of life typically delivers only about 80 percent of its rated capacity, with ambient temperature moving the number further. Second, UPS batteries fail more often than any other component in the power chain, so the runtime you plan around should be the runtime at a known state of health, which is what periodic impedance testing measures and what a battery replacement program protects. Third, the runtime target should come from a deliberate decision, grid ride through for transient dips, transfer switch operation, generator failure contingency, or orderly shutdown, never from an inherited specification that nobody remembers the origin of.

Generators: Rating, Start, and Load Acceptance

A generator’s rating is a promise with fine print. The standby rating, the number printed on the data plate, assumes the set runs only for the duration of an outage under stated ambient conditions, while the prime rating, roughly ten percent lower, covers continuous and variable load operation. A 1,000 kW standby set is more honest as an 800 to 900 kW continuous machine, and sizing a plant against the standby number without understanding the duty cycle is how a fleet ends up overloaded during exactly the extended outages the fuel plan is meant to cover. The 30 percent exercise load in NFPA 110 is computed against the standby nameplate rating, which makes the difference between the two ratings operational rather than academic.

The start and transfer requirement is where data center generators earn their price. A Type 10 classification means the set must accept load within ten seconds of the normal source failing, which requires a diesel engine, redundant battery start systems, a jacket water heater that keeps the engine warm between starts, and a transfer switch that closes and holds under inrush. The acceptance problem is block load: when the switch closes, the generator must swallow the entire connected load at once, including the inrush of compressors, chilled water pumps, and cooling fans that draw several times their running current for the first cycles. Generators are therefore selected on voltage dip under sudden load as much as on steady state kW, and a load bank test at the factory and again on site at stepped loads is the evidence that the set can actually do what its classification claims. Monthly fuel level checks and battery state tests keep that promise current, but only loaded testing proves the full chain, which is what the next section covers.

Load Testing That Finds Real Failures

The purpose of the test program is to make the generator fail in the yard under controlled conditions, not under load during a real outage. NFPA 110 drives the cadence for Level 1 systems, and a data center power plant is Level 1 by any reasonable reading. The baseline is a weekly visual inspection: fuel level, battery state, leaks, and alarm status on the generator and its transfer switch. Monthly, the set must run under load for at least 30 minutes at not less than 30 percent of standby nameplate kW, or at the minimum exhaust gas temperature the manufacturer specifies, with a cold start, an automatic transfer, and a cool down of roughly five minutes after the loaded run. Below that load, diesel engines wet stack, unburned fuel and carbon build up in the exhaust and on the cylinders, and an engine that finally fails in an outage fails because of the routine that was meant to protect it.

The 30 percent threshold is where most mains powered data centers discover a problem, because a facility that normally runs on utility power rarely has 30 percent of its generator rating available as building load at test time. When the monthly exercise cannot reach the load requirement, NFPA 110 requires an annual supplemental test using a load bank. Under the 2025 edition of the standard the annual protocol is 50 percent of nameplate rating for 30 minutes followed by 75 percent for one hour, replacing the earlier 25, 50, and 75 percent stepped profile, and Level 1 systems additionally need a four hour full load run every three years. The test records, date, duration, applied load, voltage and frequency stability, oil pressure, and fuel consumed, are the paper trail that proves the plant was ready, and they are exactly what an inspector, an insurer, or a customer asks to see after the outage you just survived. Test the transfer switch as part of the same exercise, on both the A and the B side, because a generator that starts but fails to transfer is a generator that did not help.

Fuel: Autonomy and Burn Rate Math

Fuel is the part of the backup power story that converts a four hour outage into a four day one, and it is also the part most teams stop thinking about once the tank is full. The planning unit is autonomy, the hours the plant can run at its real load without refueling, and data centers commonly target 24 to 96 hours, with 48 to 72 hours the de facto standard for enterprise and colocation plants and higher figures for mission critical facilities. The autonomy number is a contract promise and a design target, so it belongs at the top of the fuel plan, defined before tank capacity is chosen, not recovered later from whatever the tanks happened to be.

The tank math is straightforward once you have a burn rate. A diesel generator burns roughly 0.07 gallons of fuel per kilowatt-hour at loads from half to full, a rule of thumb that holds surprisingly flat until load drops below about half, where the set burns more fuel per kilowatt-hour and wet stacking returns as a fuel problem as well as an engine problem. From there it is multiplication: 700 kW of average load burns about 49 gallons per hour, and 72 hours of autonomy needs roughly 3,500 usable gallons, before adding 10 to 20 percent for the fuel you cannot draw from the bottom of the tank and the load that will exceed your average estimate during a severe outage. Critical facilities often run the calculation against the full load figure rather than the average, because the outage that empties a tank is rarely the outage with a mild load.

Fuel Quality and Refueling Under Stress

Stored diesel is a perishable asset, and fuel quality disciplines are part of emergency readiness, not janitorial detail. Modern diesel contains biodiesel blends that oxidize over months in storage, microbial colonies grow at the water layer that condenses in any tank, and degraded fuel leaves gum and varnish that clog filters and injectors at the moment of demand. The standard defense is an annual fuel sample tested against ASTM D975, a biocide and stabilizer program, fuel polishing that recirculates and filters the stored tank on a schedule, and routine draining of water and sediment from the lowest point of the tank. A fuel plan without a fuel quality plan is a plan to run your generators on whatever the bottom of the tank became.

Refueling is where the autonomy numbers meet regional reality. When a storm takes the grid down across a whole region, every facility within a hundred miles asks the same fuel suppliers for delivery at the same time, truck routes become blocked or restricted, and the 72 hour autonomy that seemed generous in a spreadsheet becomes a countdown waiting for a truck that has a queue ahead of it. The hedge is a refueling contract with a guaranteed response window, contracted reserve capacity with the supplier, and ideally a second supplier as a fallback, plus a monitoring layer that shows fuel level and burn rate live so you know precisely when the countdown starts. Facilities that have lived through regional outages also question the single source assumption itself, which is why larger plants treat generator capacity, fuel storage, and refueling contracts as one variable purchased together rather than three variables acquired separately.

A Backup Power Plan That Holds Through the Outage

The backup power chain holds when its three layers are engineered as one system instead of purchased as three. The UPS is sized against measured draw with a growth margin and a deliberate runtime decision, so it covers the seconds that the transfer switch and the generator work on. The generator is rated for the duty cycle, starts fast enough for its classification, and is exercised at the load that keeps the engine clean, supplemented by load bank testing whenever the building cannot provide that load itself. The fuel plan is an autonomy calculation built on your real burn rate, protected by fuel quality work, and backed by a refueling contract that responds when every other facility in the region is asking for the same truck. None of it is exotic. It is a set of numbers, a schedule, and a set of records, and the facilities with the shortest outages are the ones that kept all three current. Verify the two numbers you can check this week, the measured draw at your power feeds and the fuel level in every tank, and let the records do the rest.