Automatic Transfer Switches & Changeovers

The core job of a standby controller is Auto Mains Failure (AMF): detect that the grid has failed, start the generator, prove it is healthy, transfer the load, and then reverse all of that cleanly when the grid returns. The sequence is deliberately timed — a short start delay ignores momentary dips so the set does not crank for a one-second flicker; a warm-up lets oil pressure and frequency stabilise before the load is applied; and on return, a return delay confirms the grid is genuinely back before transferring, followed by a cool-down run so the engine sheds heat before stopping.

Each of those timers exists for a reason, and badly set ones cause real problems: too short a start delay wears the starter on every flicker; no cool-down cooks the turbocharger. We commission these settings to the engine and the site, not to factory defaults, because the controller's timing is the difference between a set that lasts and one that is quietly abused on every outage.

The automatic transfer switch (ATS) physically moves the load between the grid and the generator, and it must be break-before-make on a standby system — never connecting the two sources together unless the controller is deliberately synchronising. A standard open-transition transfer accepts a brief dead gap (covered by a UPS on critical loads). A closed-transition transfer momentarily parallels a synchronised generator with the grid for a bumpless changeover — useful for sensitive process loads, but it requires the utility's agreement and proper protection because it ties into the grid.

A subtle but critical point: a redundant UPS behind a single, unproven transfer switch is not redundant — the ATS becomes the single point of failure. We design the transfer scheme, its interlocks and its maintenance bypass as part of the whole power system, so the changeover is something you can rely on and service safely while live.

When one generator is not enough — or when you want N+1 redundancy in the generation itself — multiple sets run in parallel, and that demands synchronisation: matching voltage, frequency and phase angle before the breaker closes. Close out of sync and the resulting current surge can damage alternators and trip breakers; modern controllers do this automatically in a fraction of a second. Once paralleled, the controllers share the work, balancing real power (kW) by trimming each engine's fuelling and reactive power (kVAr) by trimming each alternator's excitation.

Paralleling also enables smart operation: bringing sets on and off line as the load rises and falls so each running set stays in its efficient, wet-stacking-safe band rather than idling. For growing sites this is how capacity scales without throwing away the original investment — add a set and parallel it, rather than replacing the lot.

The brains come from a few well-proven families. DeepSea Electronics (DSE) modules are the workhorse across much of Kenya for AMF and paralleling; ComAp controllers are common on larger and more complex multi-set installations; Woodward/PowerWizard ships on many engine-OEM sets. They all do the same fundamental jobs — engine control, protection, metering, AMF and (on the right models) synchronising — but their configuration, fault codes and communication differ, which is why controller-specific expertise matters when a set will not start or a transfer misbehaves.

Beyond running the engine, these controllers are also the protection layer: over/under-voltage and frequency, over-current, oil-pressure and temperature shutdowns, over-speed, and battery monitoring. A correctly configured controller protects the asset and tells you exactly why it tripped — an incorrectly configured one either nuisance-trips or, worse, fails to protect.

Modern controllers expose their data — engine hours, fuel level, battery health, fault history, load — over cellular or network links, so a fleet of sets across many sites can be watched from one screen. That turns maintenance from reactive to predictive: a falling battery voltage, a creeping coolant temperature or a fuel level dropping faster than expected raises a flag before it becomes a failed start on the day of an outage.

For multi-site organisations this is transformative — instead of discovering a flat starting battery during a blackout, the system flags it days earlier on a routine alert. We integrate remote monitoring into the SLA so the generator that matters most is the one we already know is healthy, not the one we hope is.