Prove Emergency Plant Recovery Before Accepting Resilience

Design Decision

For a large institutional building with continuously occupied critical areas, make integrated emergency recovery—not individual equipment operation—the acceptance basis for principal cooling plant. Define the essential load, permitted interruption, surviving equipment capacity and safety overrides in the Owner’s Project Requirements (OPR), then demonstrate their delivery through the Basis of Design (BOD).

Compare two realistic architectures:

• Simultaneous restart: restores cooling quickly but creates a large electrical load step. Select only where generator transient performance, motor acceleration and chiller restart constraints support it.
• Staged restart with thermal storage: limits electrical steps but extends the cooling interruption. Select only where usable stored energy bridges the demonstrated recovery profile, including one unavailable duty component.

Neither architecture may defeat protective trips to achieve faster recovery. Establish an explicit cause-and-effect matrix: equipment protection remains effective; authorised emergency commands override normal optimisation; fire-related shutdowns follow the approved fire strategy. Define which functions remain available without the building management system (BMS).

Calculation & Example

Consider an essential cooling demand of 1,200 kW, served by three chillers, each delivering 800 kW at the emergency design conditions. With one unavailable, two provide 1,600 kW: sufficient steady-state capacity, but not proof of uninterrupted service.

Assume each operating chiller draws 250 kW, essential pumps and controls draw 60 kW, and other emergency loads draw 200 kW. The running demand is:

P = 2 × 250 + 60 + 200 = 760 kW.

A generator delivering 1,000 kW at site conditions has 240 kW of steady-state headroom. This arithmetic does not establish acceptable voltage or frequency excursions: verify kVA, power factor, nonlinear loads and each restart step against generator transient capability.

Suppose a dedicated buffer provides 20 m³ of usable water volume across an allowable 3 K temperature rise. Using water density of 1,000 kg/m³ and specific heat of 4.18 kJ/(kg·K):

E = 20 × 1,000 × 4.18 × 3 = 250,800 kJ.

At zero cooling output, ideal ride-through is 250,800 / 1,200 = 209 s. A 180 s recovery consumes 216,000 kJ, leaving only 29 s equivalent reserve; a 300 s interruption requires 360,000 kJ and fails this basis.

For staged recovery, integrate the actual deficit: E_required = ∫ max[0, Q_load − Q_delivered(t)] dt. Count delivered cooling, not a compressor “run” signal. Effective volume, mixing, hydraulic availability and terminal temperature limits require verification. This ideal calculation is a screening check, not an acceptance margin.

Failure Consequences

A credible common-mode failure is simultaneous chiller restart after power restoration, causing generator voltage collapse and another plant trip. Repeated restart delays can exhaust the buffer despite adequate installed cooling capacity, interrupting critical institutional services.

A separate hazardous failure is a retained BMS restart command overriding an emergency shutdown. Reject any sequence that restores cooling by bypassing proven flow, equipment protection or the approved fire-related interlocks.

Design Verification

Agree numerical acceptance criteria before testing: maximum interruption, terminal temperature limit, permitted electrical excursions and required capacity with one chiller unavailable. These are project-specific criteria requiring verification, not universal limits from the commissioning references.

Execute an authorised integrated test with risk controls and abort thresholds:

• Establish a measured representative load, or document how supplementary testing validates the design-load response.
• Initiate normal-power loss and record transfer, pump recovery, proven flow, chiller release and delivered cooling using synchronised instruments.
• Repeat with one chiller inhibited and with BMS communications lost; verify the documented independent emergency functions.
• Challenge each critical interlock through approved safe simulation. Confirm command priority, trip response, reset conditions and prevention of unintended restart.
• Restore normal power, verify stable retransfer, correct deficiencies and repeat affected tests.

Applicable Standards

Use ASHRAE Guideline 0 for the commissioning process and ASHRAE Standard 202 for commissioning requirements where adopted or contractually invoked. Applicable statutory obligations and contracted acceptance requirements are mandatory; the numerical example is not. Neither reference substitutes for project-specific emergency-mode or fire-strategy criteria.

Practical Takeaways

• Specify delivered-capacity and temperature acceptance limits.
• Check restart transients separately from running kW.
• Size buffers against integrated cooling deficit.
• Accept resilience only after integrated failure-mode testing.