Cold Storage Backup Power - What Happens in the First Hour of an Outage

Most cold store operators have a generator. Fewer have one that has been tested with the refrigeration plant actually restarting under it.

The gap between those two things is where stock losses happen. This article walks through what physically occurs in the first hour of an outage, why several of those things surprise people, and what to specify so the answer is boring rather than expensive.

Minute zero: the power fails

Your ATS detects mains failure, waits a short confirmation delay to make sure it is real, signals the generator to start, and transfers the load. On a healthy installation this takes somewhere between five and fifteen seconds.

For those seconds, everything is dark. That includes your control PLC, your temperature monitoring, your alarm dialler and your emergency lighting if it is not on its own battery.

Two consequences people do not plan for:

• A PLC that reboots on every transfer may come back in a default state, lose its sequence position, or require a manual acknowledgement before it will run anything. In a site with nobody on shift at 2am, that is the whole outage lost.
• A temperature data logger that loses power creates a gap in your records at precisely the moment you will later need to prove what happened.

Both are solved cheaply with a small UPS on the control and monitoring supplies. It is the highest-value few hundred pounds in the whole installation.

Minutes one to five: nothing is cooling

Here is the part that catches people out. The generator is running, the load has transferred, and your refrigeration is still off.

Refrigeration compressors have anti-recycle or minimum-off timers, typically five to ten minutes, built into the controls to protect the motor and equalise system pressures. They will not restart on demand, and overriding them is how you destroy a compressor.

So there is a period after the generator has taken the load where nothing is removing heat. This is normal and designed. It matters because it means your real recovery time is not fifteen seconds. It is closer to ten minutes, and longer if the sequence is staged.

Plan and communicate around the true figure, not the transfer time.

Minutes five to fifteen: the restart surge

This is the crunch point, and it is where undersized or badly configured installations fail.

When the timers expire, the compressors want to start. A direct-on-line compressor motor draws six to eight times its running current during start, at a very poor power factor. If three compressors come off their timers at the same moment and all attempt to start together, the generator sees an enormous inrush.

What happens next is a voltage dip. If it is deep enough, contactors drop out, the PLC undervoltage trips, other motors stall, and in the worst case the generator itself trips on overload or underspeed. The result is a site that has a working generator and no refrigeration.

The fix is sequencing, not a bigger generator. A properly configured restart sequence brings compressors on one at a time with a delay between each, so the generator only ever sees one start surge at once. This is a controls exercise, and it needs to be designed and proven, not assumed.

Where sequencing alone is not enough, soft starters or variable speed drives reduce starting current dramatically and are usually far cheaper than the extra generator capacity they save. If you have VSDs, note that they bring harmonics with them, which affects alternator sizing in a different way.

What must be on the generator besides the compressors

The most common real-world failure in cold store backup is not the generator. It is the schedule of what got connected to it.

A compressor without its condenser fans will run for a few minutes, build head pressure and trip on high pressure. A compressor without its evaporator fans moves no air across the coil and cools nothing. Every one of these needs to be on the essential supply:

• Compressors
• Condenser fans and, where fitted, condenser water pumps
• Evaporator fans
• Refrigerant pumps on pumped systems
• Control panel, PLC and HMI
• Temperature monitoring and data logging
• Alarm dialler or BMS link
• Gas detection and emergency ventilation on ammonia or CO₂ plant
• Emergency lighting and escape routes
• Door heaters on freezer doors
• Dock levellers and shutters if goods movement is essential
• The ATS control circuit itself

That gas detection line is not a stock protection measure. On an ammonia plant it is life safety, and it belongs on the essential supply for that reason alone. Where a site falls under DSEAR or COMAH duties, the backup arrangements for detection and ventilation should be explicitly addressed in the safety case rather than inherited from the electrical design.

Minutes fifteen to sixty: what the temperature actually does

Once refrigeration is running again, the question is how much ground you lost. The answer depends enormously on what kind of store you have.

A full frozen store is remarkably forgiving. Thousands of tonnes of product at −18°C is an enormous thermal mass. With doors closed, a well-insulated full freezer store typically rises somewhere in the region of half a degree to a degree per hour. You have hours, not minutes.

A chilled store is far less forgiving. Less thermal mass, a much smaller gap between operating temperature and the limit, and higher air change rates. A chill room running at 2°C with a legal ceiling of 8°C has very little margin.

The worst cases are the part-loaded store and the blast freezer. A half-empty freezer has lost most of its thermal ballast. A blast freezer contains warm product actively giving off heat, and an interrupted blast cycle is both a product quality problem and a food safety one.

Air temperature rises before product temperature. Your sensors read air. Product core lags behind, sometimes by hours. This works in your favour: the alarm fires while the product is still well within spec. It also means you should not condemn stock on an air temperature reading alone. Probe the product core before making that call.

The legal lines you are protecting

In England, Wales and Northern Ireland, food that needs refrigeration because it could support the growth of harmful bacteria must be kept at or below 8°C under the Food Safety (Temperature Control) Regulations 1995. Most operators run chilled space at around 5°C or lower to keep working headroom below that line.

Frozen food should be held at −18°C or below, with a limited tolerance for brief upward fluctuations during distribution. Chilled food that goes above 8°C can be tolerated for a single period of up to four hours, and "single" is doing real work in that sentence. It is not a clock you can reset by putting the product back in the chiller.

Two practical consequences for your backup design:

1. Your temperature records are your due diligence defence. If logging stops during the outage, you have a gap exactly where an environmental health officer or an insurer will look. Put the loggers on the essential supply.
2. Document what happened. Outage start and end, generator run time, temperatures throughout, product core checks, and the disposition decision for any affected stock. Insurers ask for this, and claims are refused for lack of it more often than for lack of cover.

Hour one onward: fuel

If your outage was a local fault, you are finished. If it was a storm or a regional event, you are not.

A canopied generator's base tank typically holds around eight hours at 75% load. Refrigeration load is fairly steady once recovered, so that figure is reasonably predictive, unlike a site with a peaky profile.

Eight hours is not enough for a regional outage. What you need is a bulk tank with an automatic transfer system and level alarms, plus a fuel supply contract with a stated response time that you have actually checked. Storm-driven outages create simultaneous demand across a whole region, and the operator who arranged delivery in advance gets served first.

A separate detail worth checking: defrost cycles. Electric defrost is a large resistive load. If your controls fire scheduled defrosts while running on generator, you can add substantial unplanned load. Many sites configure the controls to suspend or stagger defrost during generator operation.

What to write into your outage procedure

The engineering only works if the people do the right things.

• Doors stay shut. No picking, no goods-in, no goods-out unless a manager authorises it. An open dock door undoes hours of thermal reserve in minutes.
• Nobody overrides the compressor timers.
• Someone physically checks that condenser fans are running and the plant has actually restarted, rather than trusting a screen.
• Record temperatures manually at set intervals as a backup to the logging.
• Know who to ring for fuel, for refrigeration callout, and for generator callout, with the numbers on the wall rather than in someone's phone.

Testing: the part almost everyone gets wrong

A monthly off-load generator run proves that the engine starts. It proves nothing at all about whether your cold store survives an outage.

What you need to test, at least annually:

• A genuine transfer with the refrigeration plant losing supply and restarting on generator
• The sequencing working as designed, with no simultaneous starts
• The plant running long enough for temperatures and pressures to stabilise, not just long enough to look alive
• The alarms and monitoring behaving correctly through the transfer
• Transfer back to mains working cleanly, which is a separate sequence with its own failure modes

Schedule it when stock is at its lowest, have the refrigeration engineer present as well as the generator engineer, and treat the first one as a fault-finding exercise. Sequencing problems are common on installations that have never been tested this way, and they are cheap to fix on a planned Tuesday and very expensive to discover at 3am in February.

Specifying the generator

Three things drive the size, and only one of them is the running load.

1. Steady running kW for the refrigeration plant once recovered
2. Starting current for the largest motor that has to start against the generator, which frequently dominates the calculation
3. Step loading capability, meaning how much load the set can accept in one block, which determines how aggressive your restart sequence can be

Get a load study rather than adding up nameplates. Refrigeration plant rarely runs at rated, and oversizing brings its own problems: a generator running permanently below about 30% load suffers wet stacking, where unburnt fuel deposits in the exhaust system.

And check the thermal input. If your set reaches 1 MWth, which arrives somewhere around 400 to 500 kVA of electrical output, UK environmental permitting applies and the permit must be in place before commissioning.

The summary

The first hour of a cold store outage is not a race against temperature. Your frozen stock has hours of margin. It is a race against sequencing, controls and the things nobody connected to the essential supply.

Sites lose stock because the PLC rebooted and stayed down, because the condenser fans were on the wrong board, because three compressors tried to start at once, or because the fuel ran out on day two. Almost none of it is the generator's fault, and almost all of it is preventable at design stage.

We publish full specifications, step load data and pricing across our diesel generator range, and we hold a wide selection in UK stock for sites that cannot wait on factory lead times. If you are sizing backup power for a cold store and want help working through the motor starting figures, talk to our team.

This article is general guidance. Refrigeration controls, electrical design and food safety management must be specified by competent professionals for the specific site.