Chapter 75 · Security Advisory

Power Resiliency

The foundation of all technology. Blackouts, brownouts, and surges. UPS types (offline, line-interactive, online/double-conversion). Generators for long-term backup. The UPS-generator partnership that bridges the startup gap.

POWER-2024-001
Power Resiliency Fundamentals and Power Disturbance Types
Severity: High

Power Is the Foundation — And We Do Not Control It

Every piece of technology in a data center — every server, every switch, every storage array, every router — requires continuous electrical power to operate. Power is not one dependency among many; it is the single foundational resource that makes everything else possible. Without it, no amount of redundant hardware, backup software, or geographic dispersion matters. The servers are off. The network is down. The data is inaccessible.

The fundamental challenge of power resiliency is that most organizations do not generate their own electricity. Power is provided by a third-party utility company — the local grid — and the organization has essentially no control over its availability. A transformer failure two miles away, a severe storm, a grid overload during a heat wave, or maintenance activity on the utility infrastructure can all result in a power outage affecting the data center. The organization did nothing wrong; it simply cannot control what happens outside its property boundary.

This dependency makes power resiliency engineering a necessity rather than an option. Outages must be planned for, and the response must be proportional to the outage duration. A brief interruption of seconds to minutes is very different from an outage lasting hours or days. The technologies used to address these scenarios — Uninterruptible Power Supplies for short-term coverage and generators for long-term coverage — are designed for different parts of the outage duration spectrum and are most effective when deployed together.

Three Types of Power Disturbances

Not all power problems are the same. The three main categories of power disturbance — blackouts, brownouts, and surges — have different causes, different effects on equipment, and require different protective responses.

Blackout — complete loss of power. The utility feed to the building drops to zero. Servers shut down abruptly. Network connectivity is lost. Storage writes in progress may be corrupted. In a modern data center without power backup, a blackout is a full service outage. Duration can range from seconds (a brief grid fault that self-corrects) to days (a major storm or infrastructure failure requiring repair). The blackout is the scenario most people picture when they think about power outages, and it is what UPS systems and generators are primarily designed to address.

Brownout — voltage drop below normal. The utility feed does not go to zero — it just drops below the normal operating voltage. "Brown" refers to the dimming of incandescent lights at reduced voltage. For computing equipment, a sustained brownout causes system instability: servers may reboot unexpectedly, hard drives may behave erratically, and hardware may be damaged over time by sustained operation below rated voltage. Brownouts are common in areas with high electrical demand relative to grid capacity, or during extreme weather when everyone runs air conditioning simultaneously. Line-interactive UPS systems specifically address brownouts by actively compensating for voltage drops.

Surge (spike) — sudden voltage increase above normal. While brownouts represent too little voltage, surges represent too much — and too much voltage even briefly can permanently damage electronic components. Surges can originate from lightning strikes (even nearby ones), from utility switching operations, from large loads (like elevator motors) switching off suddenly, or from faulty electrical systems. The energy delivered by a surge can exceed what a component's power supply is designed to tolerate, burning out circuits instantly. Surge suppression is a standard feature in UPS systems, protecting equipment from spikes that come through the power lines.

UPS — Short-Term Power Bridge

An Uninterruptible Power Supply (UPS) is a device that sits between the utility power and the equipment it protects. It contains a battery (or battery bank) that can supply power when the utility feed is interrupted, lost, or degraded. The term "uninterruptible" refers to the goal: even when utility power fails, the connected equipment experiences no interruption — power simply continues flowing from the battery.

A UPS serves four distinct purposes in a power resiliency strategy. First, it maintains power during blackouts for as long as the battery capacity allows — minutes to hours depending on the UPS size and the load. Second, it protects against brownouts by detecting low voltage and compensating with battery power or voltage regulation. Third, it suppresses surges so that voltage spikes from the utility are absorbed by the UPS rather than passed through to the equipment. Fourth — critically — it bridges the startup gap when a generator is activating, providing battery power during the ~60-90 seconds it takes for a generator to start, stabilize, and take over the load.

UPS capacity is measured in volt-amperes (VA) or watts, and runtime depends on both the battery capacity and the connected load. A larger load drains the battery faster. Organizations size their UPS systems based on the total connected load and the required runtime — enough to cover the generator startup delay, or longer if generator coverage is not available.

POWER-2024-002
UPS Types and Features
Severity: High

Offline (Standby) UPS — The Basic Option

An offline UPS, also called a standby UPS, is the simplest and least expensive UPS type. During normal operation, the connected equipment runs directly from utility power — the UPS is essentially a pass-through with the battery in standby, waiting but not engaged. When utility power fails, an internal switch activates and transfers the load to battery power.

The limitation of this design is the transfer time. The switch from utility power to battery power is not instantaneous — it takes a brief moment (typically a few milliseconds to tens of milliseconds) to detect the outage and complete the transfer. For most modern equipment with power supplies that can tolerate a brief gap, this is acceptable. For highly sensitive equipment, this brief interruption can cause a visible glitch or, in rare cases, a reboot.

Offline UPS systems provide basic blackout protection and some surge suppression. They do not actively regulate voltage, so a brownout that stays above the switch-over threshold will pass through to the connected equipment unmodified. The offline UPS is appropriate for personal computers, small office environments, and non-critical equipment where cost is a primary constraint and the power environment is generally stable.

Line-Interactive UPS — Voltage Regulation Added

A line-interactive UPS improves on the offline design by adding active voltage regulation. While it still runs connected equipment from utility power during normal operation (like the offline UPS), it continuously monitors the incoming voltage and uses an autotransformer to boost it if it drops (brownout) or reduce it if it rises (overvoltage) — without switching to battery. The battery is reserved for actual outages, not for routine voltage fluctuations.

This makes the line-interactive UPS the right choice for environments with frequent brownouts or voltage sag. Organizations in regions with unreliable utility infrastructure, where voltage fluctuates regularly without completely failing, benefit most from this type. The battery is preserved for actual blackouts rather than being drained by routine voltage corrections.

The line-interactive UPS still has a transfer time (slightly faster than offline), but it is used less frequently because most voltage events are handled by the voltage regulation circuit without a transfer. This type is commonly deployed for small servers, network equipment, and mid-sized business environments — anywhere that basic blackout protection is insufficient but the full cost of an online UPS is not justified.

Online (Double-Conversion) UPS — Maximum Protection

An online UPS, also called a double-conversion UPS, takes a fundamentally different approach. Rather than passing utility power through to the equipment (with battery as backup), it continuously converts incoming AC power to DC, charges the battery from that DC power, and then inverts the DC back to AC to power the connected equipment. The equipment always runs from the battery — utility power is constantly charging the battery, and the battery constantly powers the equipment.

This design eliminates the transfer time entirely — there is no switching event when utility power fails. When the utility feed drops out, the battery simply continues powering the inverter without interruption, because nothing changed from the equipment's perspective. The equipment has zero awareness that utility power failed. This is the "zero transfer time" property that distinguishes online UPS from the other types.

The double-conversion design also provides the cleanest power: because the output comes from a controlled inverter rather than directly from the utility feed (even via regulation), all noise, frequency variation, and electrical anomalies from the utility are completely isolated. The equipment receives precisely regulated AC power regardless of what is happening on the utility feed.

The tradeoff is cost and efficiency. Running through two conversion stages (AC→DC→AC) continuously wastes some energy as heat, making online UPS systems slightly less efficient than the other types. They are also significantly more expensive. For these reasons, online UPS systems are reserved for environments where maximum protection is required: data centers, healthcare systems, financial trading infrastructure, and any mission-critical operation where even a millisecond of power interruption is unacceptable.

UPS Features

Automatic graceful shutdown: When the battery depletes to a configured threshold (e.g., 20% remaining), the UPS sends a signal to connected servers instructing them to shut down gracefully — saving open files, closing database transactions, and powering off cleanly. This prevents the data corruption that results from an abrupt power loss when the battery is fully exhausted. The shutdown happens automatically, without requiring anyone to be present.

Battery capacity selection: UPS systems come in a range of battery capacities, and organizations select based on the runtime required. A small UPS might provide 5 minutes of battery — enough to bridge generator startup. A large UPS might provide 30–60 minutes — enough to ride through brief outages without needing a generator at all. The battery capacity must be matched to the connected load; running a larger load reduces runtime proportionally.

Outlets: The number and type of outlets on the UPS determines what can be connected. Some outlets are battery-backed; others may be surge-only. Organizations plan which equipment receives battery backup (servers, network switches) vs. which receives only surge protection (monitors, printers).

Line conditioning for communication circuits: UPS systems often include suppression for ethernet or telephone lines in addition to power lines. Surges can travel through network cables and phone lines just as they can through power lines, damaging equipment connected to those cables. This protection is especially relevant for equipment with both power and network connections.

POWER-2024-003
Generators and the Integrated Power Resiliency Strategy
Severity: Medium

Generators — Long-Term Power Independence

When an outage extends beyond minutes — hours, days, or longer — a UPS cannot sustain operations. Battery capacity is finite; even large UPS systems run out of charge eventually. Generators provide long-term backup power that can continue as long as fuel is available, making them the appropriate solution for extended outages caused by major storms, infrastructure damage, or regional disasters.

A generator is an engine-driven device that converts mechanical energy (from burning fuel — diesel, natural gas, or propane) into electrical energy. The generator's output is routed to the building's electrical system, either replacing the utility feed entirely or supplementing it for specific circuits. Large generators can power an entire building; smaller ones power specific circuits. In many facilities, critical circuits are specifically designated as generator-powered: server rooms, emergency lighting, medical equipment, network infrastructure. These generator-backed outlets are often marked distinctly in the building so that during an outage, staff know which outlets will remain functional.

Fuel management is a critical operational consideration. A generator that runs out of fuel stops immediately — providing no more protection than having no generator at all. Organizations must maintain adequate fuel reserves (often sizing for 24–72 hours of continuous operation) and have contracts with fuel suppliers for emergency refueling during extended outages. Diesel generators require periodic testing under load to ensure the engine starts reliably when needed and to prevent fuel degradation.

The Generator Startup Gap — Why UPS and Generator Work Together

The most important operational characteristic of generators for power resiliency design is the startup delay. When utility power fails, the generator detects the outage, its engine must start, reach operating speed, and stabilize its electrical output before it can supply power to the building. This process typically takes 30 seconds to several minutes depending on the generator type and temperature conditions.

During that startup window, the generator is running but not yet providing usable power. Without a UPS, the building loses power for the entire startup duration — servers experience an uncontrolled power loss, network connections drop, storage writes may be corrupted, and applications fail ungracefully. Even if the generator successfully starts, the damage from the uncontrolled shutdown during startup can require significant recovery effort.

The UPS bridges this gap precisely. When utility power fails, the UPS instantly switches to battery power — covering the equipment while the generator warms up. Once the generator stabilizes and begins supplying clean power to the building, the load transfers from UPS battery back to generator power. The entire transition — from utility failure through generator startup through UPS-to-generator transfer — is managed without the equipment ever losing power. The servers never knew the utility failed.

This is the standard layered power resiliency architecture: utility power as the primary source, UPS as the immediate short-term bridge (handling seconds-to-minutes outages and generator startup), and generator as the sustained long-term source for extended outages. Each layer handles a different time horizon; together they provide continuous power coverage across the full outage duration spectrum.