A municipal pump station in a coastal city lost mains power for eleven minutes during a storm, and the standby generator never started — because the transfer control panel had been "tested" the way everyone tests them: by pressing the test button, not by pulling the mains. Eleven minutes without pressure in a water network means air in the pipes, complaints at 8:00 AM and a repair crew that hates everyone.
Automatic transfer is not a wiring problem. It is a logic problem, and the logic has to handle the boring cases: the momentary dip that does not need a changeover, the generator that starts but does not produce voltage, the load that must not hit the generator before it is ready. A Micro PLC with a handful of timers does this better than a purpose-built ATS relay, because you can see the sequence and change it without rewiring anything.
The Sequence Nobody Should Trust to Memory
Mains fails. First, an Off-Delay timer confirms the loss is real — a 3–5 second window kills the changeover on a simple grid flicker, which is the single most common false-trip cause in transfer panels. Second, the controller closes the start contact to the generator and waits. Third, a voltage presence check (read from the generator's auxiliary contacts or a phase monitor) confirms the alternator is alive and settled. Fourth, the load transfers. Fifth — and this is the part everyone forgets — when mains returns, the controller holds the load on the generator for a stable 30–60 seconds before transferring back, so the machine does not ride a bouncing grid.
The transfer timing should be a parameter, not a mystery. Write the mains-loss delay, the generator settle time and the return delay into the program with named constants, and put them in the manual. When the site engineer asks why it took eight seconds to transfer, the answer is on the LCD and in the file, not in somebody's head. That is the difference between a panel the site trusts and a panel the site is afraid of.
That whole sequence fits in about fifteen function blocks in xLogicSoft. The SR-22AC-R runs it happily with eight relay outputs to drive the contactors, and the F flags (F0 to F63) keep the state of each step visible on the front LCD so a maintenance man can read the sequence position without a laptop. If that is not maintainability, I do not know what is.
Load shedding is the ATS feature that saves the generator, not just the load. When the generator is smaller than the full plant demand — which is most standby installations — the controller should drop non-essential loads in a defined order before transferring, and re-close them only after the generator is stable. The sequence is a set of timers and relay outputs: mains fails, generator starts, essential loads transfer first, then pumps, then the rest after a settle delay. Without it, the generator staggers under full load and the voltage dips exactly when the plant needs it most.
Why not just buy the dedicated ATS controller everyone else uses? Because a dedicated ATS module is a sealed box with fixed behavior — you recieve the vendor's sequence, the vendor's timings, and a phone call to the vendor when you want something different. The Micro PLC gives you the same relays, the same timers, and a sequence you can read and change. When a site adds a second generator or wants the load-shedding sequence altered, the change is a program edit, not a new board. That flexibility is worth more than the price difference the first time it saves a rewire.
Generator Testing That Actually Tests Something
Here is the upgrade worth stealing: instead of a manual test button, schedule a monthly no-load generator run with a Weekly Timer. The controller starts the generator, runs it for twenty minutes, loads it briefly through a changeover, then shuts it down — on a quiet Sunday night, logged in the counter. The generator gets exercised, the panel gets proven, and the eleven-minute storm scenario is tested for real every month instead of every "sometime."
Add a dry-run and fuel consideration: if the generator is diesel, a running-hours counter tells you when the oil change is due, and a low-fuel alarm (a simple float or switch input) pages the operator before the tank is empty. Generators do not die of old age; they die of neglected test runs and empty tanks.
Put a three-position switch on the panel — MANUAL / AUTO / TEST — and wire it properly. MANUAL puts the changeover under direct pushbutton control for maintenance, with the interlock logic still active so two sources can never close together. AUTO is the sequence described above. TEST does the monthly exercise automatically: start the generator, prove voltage, transfer, run under load for the programmed minutes, transfer back, stop. The switch position is read as a digital input, and the controller logs how long the panel spent in each mode, which settles the argument about whether the generator was ever actually exercised. Believe me, that argument happens at every site, usually after the storm.
The Paranoia That Pays
Transfer logic should fail safe in the direction of keeping the load alive. If the controller itself dies, the load should sit on whichever supply was last healthy — that means the contactors must be mechanically interlocked, the changeover must be wired so that the de-energized state is "mains," and the generator start contact must drop out on any controller fault. A $90 controller protecting a $40,000 pump set is only worth anything if its failure mode does not kill the plant.
Test the panel the way it will fail. Pull the mains breaker, watch the clock, and see how long the water pressure actually holds. Then fix the timing untill the transfer is invisible to everyone except the data logger. That is the difference between an ATS that exists on paper and an ATS that works in a storm.
