Smart tricks to improve power supply reliability

White paper series

UPS

UPS installation safety requirements

Janne Paananen
Technology Manager, Large Systems Group, Eaton
Martijn Imming
Business Development Manager Data Centers, Eaton

Executive summary
In a 24/7 ‘Always On’ business, reliability and resilience are always the top
priorities for mission-critical facilities. But even above these, the biggest priority
has to be maintaining safety and eliminating risk to people and equipment when
dealing with the hazardous voltages within a data center.

This is why there are international and European regulations that businesses – and
their data center facilities – must comply with. These distinct safety requirements
of backfeed protection and fault currents have some commonalities, not least that
they are both commonly misunderstood.

The primary purpose of backfeed protection in a UPS system is to prevent

conducting hazardous voltages upstream when the supply has been removed from
a UPS. Meanwhile, the IEC regulations in Amendment 1:2013 protect personnel
and equipment from fault currents that could otherwise cause arcing or fires
within the UPS.

This white paper looks at the major regulations and the differences between
external and internal backfeed protection, as well as the IEC regulations on
Amendment1:2013, their impact on the UPS and the benefits from protection built
into the UPS.
Backfeed protection

Legislation
Backfeed protection is required by IEC 62040-1:2008
Uninterruptible power systems (UPS) – Part 1: General and safety
requirements for UPS. The standard is also a European Normative
and sets a legal mandatory requirement to ensure the safety of
service personnel in UPS installations. The standard allows for two
alternative implementations of backfeed protection; installing an
Figure 2: Warning label as described in IEC 62040-1:2008, to be used with
internal backfeed isolation device within the UPS, or installing an
external backfeed protection devices and when 4-pole switches are used
external input line isolation device, with only backfeed detection
upstream of a permanently connected UPS.
and control implemented within the UPS while having required
warning labels in the associated switchgear as described in the
safety standard.
Some UPS models have internal backfeed protection as standard,
When the incoming supply is lost, the backfeed protection device but others do not. In some cases, the presence or otherwise of an
must isolate the output of any permanently connected UPS from internal device varies with different versions of a single UPS model
the supply by means of separation within 15 seconds, to prevent from one supplier. Accordingly, care is essential in selecting the
conducting possibly hazardous voltages upstream. Note that the UPS product and verifying whether backfeed protection must be
term “backfeeding” and the requirement in this context relate to installed into the UPS supply.
personnel safety and hazardous voltage or energy, not to a reverse
For some UPS models, relying on external backfeed protection
power flow as is sometimes mistakenly understood.
can impact the UPS supply configuration. It can compel the use
It is important to understand that a static switch comprising of a dual feed, separate supply for the rectifier and bypass, instead
semiconductors and thyristors together with associated control of a single feed that may be acceptable in many cases while
and snubber circuits may not provide adequate isolation for safe saving cost.
maintenance of the upstream electrical network, even when it
It is also worth mentioning that having the backfeed protection
is working as expected. When the gate signals for static switch
device external to the UPS will add ”hidden cost” to a UPS
thyristors are off and it is not passing power through, the electrical
system. The device will need the same or similar components as
circuits may leak some voltage and current upstream; enough
the UPS within the switchgear, to control its switching in response
to be hazardous for personnel. Therefore, backfeed protection
to mains power status. A motor operated circuit breaker or a
is primarily for UPS systems under normal operating conditions,
contactor in series with overcurrent protection are typical ways
not just for fault scenarios as often believed.
to achieve this.
These can have a possible impact on type approval of the
switchgear, with some additional cost involved. There will also
be the costs associated with design, coordination, labor and
materials when installing the external backfeed protection device
and associated control wiring.
Using UPS products with a ready-installed and factory tested
internal backfeed protection device ensures that safety requirements
are fulfilled by the UPS supplier rather than relying on others to
handle; this makes the solution easier for everyone.

Impact on fault tolerance

The primary purpose of backfeed protection in a UPS systems
is to prevent conducting hazardous voltages upstream when the
supply has been removed from a UPS, and the UPS is operating
in stored energy mode. Since, in practice, the backfeed protection
isolates the UPS system output from incoming supplies, and
is in series with a static switch, it can also be used for another
purpose; specifically, to isolate a faulty static switch from a system.
This secondary function for backfeed protection can help to
increase system resiliency and is often a more widely discussed
subject, when backfeed protection in UPS systems is considered.
Nevertheless, it should be emphasized that backfeed protection
is there for personnel safety and a mandatory requirement as
explained previously.
Figure 1: UPS with internal backfeed protection device in series with The ability to isolate the faulty bypass circuit can keep the
static bypass switch on left; principle of external input line isolation device UPS system on-line and protect critical loads, even with a faulty
implementation on the right. static switch; eliminating a single point of failure from the system
and increasing fault tolerance. Therefore, this secondary use of
backfeed protection in UPSs, to reduce the impact of a faulty
If relying on an external device, the requirement relates to static switch, is highly welcome.
the installation rather than the product itself. In this case the
responsibility for fulfilling the minimum legislation requirements
lies with the electrical contractor or installation owner, who may
not have adequate knowledge of the product-specific safety
standard requirements for the UPS equipment and installation.
An externally connected backfeed protection device may be
subjected to hazardous voltages from the UPS if it is operating in
stored energy mode. To notify service personnel of this risk, the
UPS product safety standard requires the user to fit warning labels
on all switchgear access points and switching devices between
the UPS and the external backfeed protection device.
Backfeed protection in a single UPS system Backfeed protection in a parallel UPS system
Eaton offers three-phase UPS equipment that includes an internal UPSs are paralleled to gain higher availability or larger capacity in a
backfeed protection device as standard, as shown in Figure 3. UPS system. Figure 4 shows a parallel UPS system in a distributed
It includes an internal backfeed contactor (K5) that automatically bypass configuration with internal backfeed contactors K5.
protects against fault situations within the static switch.
A fault developing in one of the static switches would potentially
If a static switch develops a fault that drives it into an unwanted allow the paralleled inverters to feed or draw current between
conductive state, power will be fed between the UPS output system output and the mains. Accordingly, a failure in a single
and its supply; the power can be transferred in either direction, static bypass switch can eventually cause a critical failure in the
depending on voltage difference and phase shift between inverter system. However, the current flow caused by a faulty circuit can
and incoming supplies. be detected and the internal backfeed contactor in the associated
UPS module opened automatically, allowing the system to remain
This unintended current flow can cause the UPS system to be
in double conversion operation to protect the loads.
overloaded, activating inverter current limits, and, for various
reasons, to be tripped to bypass or even to shut down. Therefore, The static bypass lines of the parallel system have redundancy,
the fault can have a significant impact on system operation and since a failure of one static bypass does not prevent the other
reliability. bypass lines from operating. In a redundant parallel system, a
static bypass failure does not affect the bypass capability of the
system in any way; in capacity paralleled systems, however, the
bypass capacity would be slightly reduced.
Some parallel UPS systems use centralized bypass topology,
where the system bypass module (SBM) provides a common
bypass line for all paralleled UPS units, as shown in Figure 4.
The SBM, like the UPS’s internal bypass switch, comprises
antiparallel-connected thyristors. Accordingly, the same safety
hazards exist for service personnel and similar failure mechanisms
may occur; therefore, backfeed protection is an equally important,
and mandatory, requirement for centralized bypass systems.
In a parallel UPS system, internal backfeed protection means
that each static switch in the distributed bypass system includes
a backfeed contactor, so the configuration’s redundancy is
preserved. By contrast, having an external backfeed contactor
often means installing only one contactor for multiple static
switches, so a failure of one of the switches results in total loss
of all the static bypass lines connected to the common backfeed
contactor. Similar implementations are used in some modular UPS
designs where one backfeed contactor is used for multiple or all
static switches. The impact on systems redundancy and resilience
can be far greater.
There is a view that a backfeed protection device itself may reduce
system reliability, since it is a component and it can fail as well.
This is very true, but there are many factors to consider. These
include how the component typically fails, how it is used in the
system and the possible implications.
If the backfeed contactor fails closed, and does not open on loss
of supply, it would not impact UPS system operation until a static
bypass switch failed; a second failure would be needed to impact
the UPS system operation. The system would act almost like one
that had no backfeed protection at all. In any case, this type of
failure is rare.
Another, more typical, failure mode is for the backfeed contactor
to open or not to close when it should. In practice this means
that the bypass line is not available for use if needed. Systems
with just one static bypass line lose all their bypass capacity;
those with multiple static bypasses, each with their own backfeed
contactors, lose some capacity.
Figure 3: UPS with a static switch and internal back-feed
protection (K5) Note that the UPS bypass line is available only when the mains
bypass supply is available - and the bypass line availability cannot
be higher than that of its supply. Clearly, the reliability of backfeed
Backfeed detection circuitry and UPS firmware can detect protective devices with associated control circuits is far higher
this current in the bypass line when the UPS is not in bypass than the mains supply’s, and therefore has negligible impact on
mode and the static bypass switch is not turned on. The internal bypass line overall availability.
backfeed contactor is then opened to isolate the fault and to A UPS with backfeed protection and shorted static switch
prevent power flowing between the UPS output and supply, thus detection can isolate a faulty static bypass switch, which is a
allowing the UPS to continue operation in dual-conversion mode critical failure for a system at any time, and eliminate a single
even with a static switch failure. point of failure from the system. This benefit outweighs the
An alarm will inform site personnel, or a remote monitoring station marginal impact on bypass availability caused by backfeed
beyond the premises if used, of the defect in the unit to activate a protection, and improves overall system resiliency.
sequence of planned corrective actions. And finally, personal preference is not the deciding factor. Ensuring
the safety of service personnel is a mandatory requirement for
UPS equipment and installations. Safety must be designed in to
UPS systems; the only question is how to implement the safety
design to achieve the maximum additional benefits in the form
of improved system level resiliency.
Figure 4: Parallel UPS system in distributed bypass configuration on the left and centralized bypass system on the right. Both examples have internal
backfeed protection devices; contactors (K5) inside the UPS units and a motor operated air circuit breaker (FBP) as an isolator/switch (no trip unit) for large
centralized bypass.

IEC 62040-1:2008 – Amendment1:2013 selected must equal or exceed fault current levels found in the
UPS installation and these declared values must not be exceeded
IEC 62040-1:2008 (EN 62040-1:2008-11) Uninterruptible power
under any conditions.
systems (UPS) – Part 1: General and safety requirements for UPS
gives the mandatory safety-related requirements for UPS products When the conditional short-circuit current ICC rating is used,
and installations. Compliance with this standard is required for the fault current is reduced by a short circuit protective device
CE marking and is legally enforceable. The latest requirement, (SCPD), typically a fuse, to a safe level for UPS internal circuits
Amendment1:2013 to IEC 62040-1:2008, became mandatory and components. The SCPD can be either an internal part of the
on February 2016. This requires the UPS manufacturer to UPS, or external in the UPS’s upstream supply.
declare either:
The requirements given in the standard only apply to the UPS’s
low impedance path, assuming that such a path exists. This low
impedance path is either the UPS’s internal bypass circuit, or for
• Rated short-time withstand current (ICW):
multiple UPSs, a large common bypass. It includes the static bypass
The r.m.s. value of short-time current, as declared by the
switch circuit from the bypass input terminals to the UPS output
UPS manufacturer, that can be carried without damage under
terminals; it also extends to the UPS mechanical (maintenance)
specified conditions, defined in terms of current and time
bypass circuit if this is an integral part of the UPS or sold as a
UPS system component under the UPS product standard. When
or
an external maintenance bypass is used as part of the low voltage
switchgear assembly, it automatically falls into the switchgear
• Rated conditional short-circuit current (ICC): product category and associated requirements.
The r.m.s. value of prospective short-circuit current, as declared
The standard also requires that each bypass circuit must be
by the UPS manufacturer, that can be withstood for the total
independently safe at available fault current levels. Safety cannot
operating time (clearing time) of the short-circuit protective
be evaluated at system level assuming all circuits will share the
device (SCPD) under specified conditions
fault current, since product and personnel safety must also be
guaranteed during service activities and commissioning, or when
part of the system has failed or is not in operation. In other words,
In practice, a UPS supplier must state the maximum allowed fault having more UPS units or static switches in parallel does not reduce
current level at the UPS input terminals to maintain the safety the requirements for individual static switches or UPS units.
of the UPS product and installation. The rating of any equipment
Figure 5: The withstand current rating of a UPS must match or exceed available fault current in the installation. In the above example the UPS withstand
current requirement is based on the fault current available from the mains feed. If the generator is operated in parallel with the transformer, resulting in
higher fault current levels, ratings must be selected to accommodate this condition and UPS compliance must be verified together with possible future
changes in the installation.

Minimum requirements for the fault current levels are given in the d) any enclosure door shall not open rapidly (so causing injury),
standard, but these can be somewhat lower than typically seen in prevented only by its normal latch
actual installations, especially within larger UPS units.
e) no conductor shall have pulled out of its terminal
The UPS supplier can in any case declare higher figures than
connector and there shall be no damage to the conductor
required; these may also be desirable from an application
or conductor insulation
perspective.
f) the UPS shall successfully pass the electric strength tests
Compliance with safety requirements for a UPS product must be
verified by testing, conducted by a UPS supplier (manufacturer).
Testing is mandatory with two exceptions; either the declared When conditional ICC rating is used, the UPS supplier shall test
withstand current rating is ≤ 10 kA or the peak let-through current the product with the selected SCPD. It is the UPS supplier’s sole
is limited by the SCPD to ≤ 17 kA. responsibility to select the protective device and verify the design
by testing as required. If external protective devices are used, the
Compliance is verified when, at the conclusion of the test, the
UPS supplier shall state the device type. Only the protective devices
following criteria are satisfied:
stated by a UPS supplier, and verified by testing if required, can
a) the UPS shall not have emitted flames, molten metal or burning be used.
particles, other than, e.g., metal particles normally emitted from
If the UPS supplier relies on external short-circuit protective
a circuit breaker when it clears a fault
devices in the UPS supply switchgear, this requirement for
b) there shall have been no arcing from live parts to the UPS UPS system safety falls onto the installation and becomes
chassis or enclosure the responsibility of its designer, electrical contractor and
owner. These individuals may not have sufficient knowledge
c) components, e.g. busbar supports, used for mounting live of product-specific standards and requirements to ensure correct
parts, shall not have broken away from their initial position protective devices are used, and never replaced with a device
giving less protection and having higher let-through energy.
Figure 6: The withstand current rating of a UPS applies to a UPS static bypass circuit, either within the UPS or as a centralized system level bypass as
highlighted above. It also applies to a mechanical bypass if this is an integral part of the UPS (system). Often, an external maintenance bypass is used; if
so, it must follow LV switchgear requirements.
The UPS fault current rating must exceed the worst-case Conclusions
scenario on site, from day one onwards. For multiple feeds,
There are two major, yet distinct, safety requirements for a UPS
possible parallel operation of supplies as well as future changes
installation to protect equipment and personnel from faulty and
and upgrades to the upstream electrical infrastructure must be
dangerous electrical currents. Both are equally important but often
allowed for. Having multiple devices in parallel does not reduce the
equally misunderstood.
fault current requirements for each individual unit. UPS compliance
must be re-assessed following any changes in installation that The first is backfeed protection, which is primarily a safety
affect fault current levels. This is especially important if external mechanism. It is mandatory, as specified by IEC standards, but it
SCPDs are used to protect the UPS. These must only be approved can also increase system resiliency. Beyond the legal and safety
types and should not be replaced with other types in the future, requirements that the UPS ‘shall prevent hazardous voltage or
for example when changes and upgrades are performed on the hazardous energy from being present on the UPS input terminals
switchgear assembly. after interruption of the input power’, a UPS can detect backfeed
current and open an internal backfeed connector while sounding
As legal requirements, these must be fulfilled for a UPS installation,
an alarm, which enables the UPS to continue in dual conversion
for both personnel and infrastructure safety. However, few people
mode, significantly improving system operation and reliability.
are aware of UPS product-specific safety requirements, creating a
Backfeed protection can be applied to both distributed and central-
risk that these aspects may be neglected.
ized multiple UPS configurations, while maintaining the same
To reduce the risk of mistakes in safety related requirements, it levels of safety, system redundancy and availability.
can be beneficial to specify and use products which have internal
The second is Amendment 1:2013, which requires a UPS supplier
SCPDs and have been laboratory tested with high fault current levels.
to state the maximum allowed fault current level to ensure that
UPS products with internal SCPDs and up to 100 kA ratings are it does not emit flames, molten metal or burning particles or arc
available on the market. These exceed the standard’s minimum flash and to maintain the safety of the UPS and its installation.
requirements, and allow their use in practically any installation Some UPSs use external short-circuit protection, which passes
without special requirements for feeders in supply panels on the responsibility for system safety onto the designer, electrical
day one, or after future changes. This way the UPS supplier, contractor and owner.
as the expert on product technology, will protect himself by
Using UPS products with ready-installed and factory-tested
having a safe and verified design built into the product. He will
internal protection device against backfeed and tested up to 100
be assured that the product and installation comply with all
kA fault currents, which is sufficient in practically any installation,
mandatory requirements.
ensures that safety requirements are fulfilled by the UPS supplier
rather than relying on others to handle it; this makes the solution
easier for everyone.
Overall, consultation with a well-established UPS supplier is highly
recommended. This eliminates users’ exposure to legislation
transgressions arising from a lack of knowledge of all relevant
requirements, while ensuring that they take advantage of every
benefit offered by modern UPS technology; personnel and equip-
ment enjoy the safety they are entitled to during normal operation,
maintenance and fault conditions, while system resiliency and
availability are maintained at maximum levels.

Eaton
EMEA Headquarters
Route de la Longeraie 7
1110 Morges, Switzerland
Eaton.eu
Follow us on social media to get the
© 2018 Eaton Eaton is a registered trademark. latest product and support information.
All Rights Reserved
Publication No. WP153020EN / CSSC-1217 All other trademarks are property
May 2018 of their respective owners.