IT White Paper

PROTECTING CRITICAL SYSTEMS

DURING UTILITY OUTAGES:
THE ROLE OF UPS TOPOLOGY
 SUMMARY
The year 2003 may well be remembered as the year of the blackout. And not just for the
major outage that occurred in the eastern half of the United States in August. In Europe,
a single downed line in Switzerland caused a widespread blackout that left virtually all of
Italy without power for as long as 18 hours. And, in late September, Hurricane Isabel caused
extended outages in the mid-Atlantic region, including Washington DC.

This has increased the attention on the power grid and its vulnerabilities. Some of this
attention may result in actions that ultimately improve the reliability of electrical power, but
the grid is complex and it will take a massive investment and many years to create significant
improvements in power reliability. Until then, the onus is on the private sector to protect
business critical systems from interruptions in utility power—and the dramatic fluctuations
in power quality that often precede them.

An important part of that protection is the Uninterruptible Power Supply (UPS) system. In
short term outages the UPS system provides backup power to mask the outage. During
long-term outages the UPS ensures systems are shut down properly or, in situations where
a generator is available, the UPS ensures the protected loads continue to receive stable,
regulated power throughout the outage. UPS systems also perform an equally valuable
function by protecting equipment from fluctuations in power quality.

How the UPS handles incoming power – the UPS topology – determines how effective the
UPS can be in shielding sensitive electronics from power fluctuations. It also determines
how frequently the UPS has to go to battery to protect the load, impacting battery life and
performance.

In 1999, the IEC, released standards to ensure consistency in how UPS topologies are
identified. The IEC defined three types of UPS:
• Passive Standby
• Line Interactive
• Double Conversion

There are substantive differences in how each of these three topologies handles incoming
power and these differences have a direct impact on UPS performance. Double conversion
systems provide the highest level of protection. The double conversion topology more
effectively isolates the load from power problems, including frequency transients and input
AC source faults, does not have to go to battery as frequently, and is better able to handle
the sags and surges that occur during transition to generator power. Consequently, double
conversion UPS systems are better able to handle the extreme conditions that occur before,
during and after a power outage.

1
 Trouble on the Grid What is perhaps most alarming about this
chain of events is how inevitable they seem
At 3:32 P.M. on August 14, an overheating
in retrospect. The way the grid is designed,
electrical transmission line sagged into a
and power is shared, a problem in one area
tree just outside Cleveland, Ohio. The fail-
can easily create a ripple effect that has the
ure of that single line may have triggered
potential to create significant power prob-
a chain of events that left more than 50
lems across a wide region.
million people without power in the largest
blackout in the history of the United States. And the U.S. is not alone in this vulnerabil-
ity. Europe has suffered from a number
According to the theory from independent
of similar, if less lengthy events this year.
consultants at Cambridge Energy Research
Italy experienced a nationwide blackout in
Associates, the line failure in Cleveland
late September that left 55 million Italians
caused more power to be drawn from
without power for as long as 18 hours. In
southern Ohio to meet the demand in
this case, the problem began when a tree
the north. This sharp increase in demand
branch fell on power lines in Switzerland,
caused the utility that serves southern Ohio
causing a disruption that moved through
to disconnect from the grid to protect its
France, which provides Italy with its major
equipment and customers.
source of electricity. Scandinavia also had
To meet the demand in northern Ohio, its largest outage in twenty years in 2003,
power flowed up from Indiana and through when southern Sweden and eastern Den-
Michigan. But this unexpected shift in mark went black, affecting up to five million
power caused lines in Michigan to overload people.
and fail, shutting down plants and disrupt-
Add to that problems from Hurricane Isabel,
ing the flow of power from Michigan into
which left large parts of the U.S. mid-Atlan-
Ontario.
tic in the dark for as long as a week and it
Energy that had been flowing into Ontario becomes clear that, for now, outages must
then had to change direction and travel be accepted as a “fact of life.”
back into Michigan, exasperating problems
This is a reality few organizations can afford
there. Ontario, in turn, attempted to meet
to ignore, particularly considering the ever-
its demand from New York, causing New
increasing dependence on digital systems.
York to shut itself off from Ontario, creating
The loss of power can shut down everything
excess power surging across the grid in New
from telephone switches to police commu-
York. These surges shut down more plants
nication networks to the electrically actu-
and caused the blackout to spread.
ated valves and pumps that move water, oil,
These events caused massive fluctuations in and gas.
the quality of power being delivered to busi-
In short, blackouts no longer just “cripple”
ness and industry immediately prior to the
a business. Today they can cause complete
blackout, wreaking havoc with systems that
paralysis over a very widespread area.
were not adequately protected.

2
 And, blackouts represent only one of the topologies and the precise meaning of
threats to critical system availability. The some of these terms has become muddied
majority of power problems still originate over the years as they were applied to prod-
The only way an internally, rather than externally. uct designs that didn’t fit the generally
organization can be accepted definition.
sure it is protected The only way an organization can be sure
from the damage and it is protected from the damage and down- Consequently, the International Electro-
downtime caused by time caused by power outages and other technical Commission (IEC), the leading
power outages and anomalies is to systematically identify criti- global organization that prepares and pub-
other anomalies is to cal systems and ensure the appropriate level lishes international standards for all elec-
systematically of protection is provided for each system as trical, electronic and related technologies,
identify critical close to the system as possible. The UPS is a addressed the issue to provide clarity and
systems and ensure key component in this protection strategy. consistency. In 1999, the IEC issued its
the appropriate level And the topology of the UPS determines, to standard 62040-3 covering UPS topologies.
of protection is a large extent, how it will handle day-to-day This has become the accepted standard for
provided for each aberrations as well as how it will perform defining UPS topology and performance.
system as close to the in the extreme conditions that exist before, It defines three types of UPS topology:
system as possible. during and after a blackout. • Passive Standby
The UPS is a key • Line-Interactive
component in this • Double Conversion
protection strategy. Defining UPS Topologies

The topology of a UPS system refers to the

Passive Standby
internal design of the system. This deter-
Passive Standby is the term the IEC adopted
mines the relationship between the UPS
to more accurately describe the topology
and incoming utility power. A variety of
that has traditionally been referred to as
terms have been used to define UPS
“offline.” The IEC defines passive standby as
follows:

In normal mode of operation, the

load is supplied with AC input power
via the UPS switch. When the AC
input supply is out of UPS preset
tolerances, the unit enters stored
energy mode of operation [battery
power] by activating the inverter,
and the load is transferred to the
inverter directly or via the UPS
switch. The battery-inverter combi-
Figure 1. Passive standby topology. nation maintains continuity of load
power for the duration of the stored

3
 energy time or until an acceptable and/or battery charging. The output
AC input supply returns to within frequency is dependent upon the AC
UPS preset tolerances and the load is input frequency. When the AC input
transferred back supply voltage is out of the UPS preset
tolerances, the inverter and the bat-
This is a relatively inexpensive UPS to pro-
tery maintain continuity of load power
duce, but due to limitations in how it condi-
in stored energy mode of operation
tions incoming power, is typically limited to
and the power interface disconnects
applications that are not mission critical and
the AC input supply to prevent back
are smaller than 3 kVA.
feed from the inverter. The unit runs
in stored energy mode for the dura-
tion of the stored energy time or
Line Interactive until the AC input supply returns
Line interactive systems utilize a trans- within UPS design tolerances, which-
former or inductor between the utility ever occurs sooner. In the event of a
power source and the load to correct or UPS functional unit failure, the load
filter some variations in input power. The may be transferred to bypass.
IEC defines the operation of a line interac-
tive system as follows: This topology provides some degree of
power conditioning, but does not effec-
In normal mode of operation, the load tively isolate the load from major power
is supplied with conditioned power via problems, such as input frequency tran-
a parallel connection of the AC input sients and certain types of input faults. In
and the UPS inverter. The inverter or addition, it is much more dependent on bat-
the power interface is operating to tery power for conditioning than a double
provide output voltage conditioning conversion topology

Double Conversion
What was traditionally referred to as an
“online” topology was redefined by the
IEC as a double conversion UPS to more
accurately distinguish between this topol-
ogy and the line interactive approach,
which some manufacturers tried to label as
“online.” The IEC defines the double conver-
sion topology as follows:

In normal mode of operation, the

load is continuously supplied by the
Figure 2. Line Interactive topology. rectifier/inverter combination. When

4
 Topology and UPS Performance

There are significant differences in perfor-

AC AC to DC DC DC to AC AC AC
Converter Inverter
Filter mance between each of these topologies.
Utility UPS
Input Output The passive standby topology provides lim-
AC ited, if any, power conditioning capabilities
and is generally used only in non-critical
Battery Battery
Charger Bank desktop applications.
DC
The line interactive topology does provide
some degree of power conditioning and
consequently has been promoted as a solu-
Figure 3. Double conversion topology. tion for mission critical applications by
some UPS manufacturers. However, the
difference between a line interactive and
…the difference the AC input supply is out of UPS double conversion system is as significant
between a line preset tolerances, the unit enters as the difference between a passive standby
interactive and double stored energy mode of operation, and line interactive system. The double
conversion system is where the battery/inverter combina- conversion system provides significantly
as significant as the tion continues to support the load greater protection.
difference between a for the duration of the stored energy
passive standby and time, or until the AC input returns The advantages of the double conversion
line interactive to UPS design tolerances, whichever configuration include.
system. The double is sooner. In the event of a rectifier/ • The critical load is completely isolated
conversion system inverter failure or the load current from the incoming AC input power.
provides significantly becoming excessive, either transiently
greater protection. or continuously, the unit enters • The critical load is always being supplied
bypass mode where the load is tem- by the output inverter, which is always
porarily supplied via the bypass line being supplied from the internal DC
from primary or secondary power. bus. When input power fails, there is
no transitional sag in the output voltage
Because of the isolation and degree of because the inverter is already operat-
power conditioning this topology delivers, ing from DC.
it is preferred for applications that have low
tolerance for downtime and those that uti- • Fluctuations in input voltage and fre-
lize redundant UPS systems and a backup quency don’t affect the load, since
generator. It is sometimes referred to as the rectifier is only making DC power
“online double conversion” because many to feed the DC bus. This gives the
people still know this topology by the term double conversion UPS the ability to
that was commonly used for it prior to the operate indefinitely at full load and even
creation of the IEC standards. recharge its batteries with input volt-

5
 ages of 15% below nominal. It can con- the generator voltage and frequency
tinue to operate, without discharging sags during the transition. This causes
the batteries, through voltage sags of the UPS to go back to battery opera-
20% below nominal. Likewise if input tion. Soon thereafter, the UPS senses
frequency is fluctuating in and out of stable generator output, transfers the
specification, the rectifier will continue load back to the generator, then trans-
to make DC power and the output fers back to battery operation when
inverter will continue to make 60 Hz generator output dips again.
power without using the battery.
The lack of these capabilities in other topol-
• The double-conversion UPS is inherently ogies results in a weaker solution, particu-
dual-input, meaning that it has separate larly in times of extreme stress, such as a
inputs for the rectifier and bypass cir- blackout. And, these weaknesses are often
cuits. Single-input models are available transparent to the end user – until the UPS
if required but dual-input UPS products fails to perform as expected and equipment
are incrementally more fault-tolerant. shuts down unexpectedly or gets seriously
damaged.
• A true double-conversion UPS can be
used in a dual-bus power system, where There is a place for other topologies –
the UPS will sync to the designated ref- Liebert manufactures all three types of UPS
erence source in all operating modes: system – but they should not be used to
on utility, on batteries, or while on protect mission critical systems.
backup generator.

• A fault on the input line causes the UPS

Real-World Experience
to go to battery power, but the UPS rec-
tifier will not allow power from the DC The large-scale blackout that affected the
bus to flow upstream. Eastern and Midwestern United States in
August 2003 served as a real-world test of
• The double-conversion UPS eliminates
UPS systems under extreme conditions. Fol-
problems with generator compatibility
lowing are four examples of the problems
that can occur with line interactive sys-
that existed during the blackout and how
tems. When supporting power from
various UPS topologies handled them.
a generator, line interactive systems
may switch to battery every time other
loads on the generator are started as
this causes the generator’s output fre- NLX Corporation
quency to vary, which these systems NLX is an internationally recognized pro-
sense as an interruption. This can sig- vider of simulation and training simulators.
nificantly shorten battery life. They may Simulators developed by NLX are used by
also experience problems when the UPS the U.S. Army to test avionics equipment
load is transitioned to the generator as and provide visual imagery for crews using
the simulators.

6
 NLX was testing new systems when the As a result, NLX is re-evaluating its power
power disturbances caused by the blackout protection systems and increasing its
hit their facility in upstate New York. React- dependence on the Liebert Npower system.
ing to the huge disturbances, the local util- “We need to have all our critical systems
ity islanded itself from the regional grid. protected by the Liebert system,” said
…a small number of
This kept the power on, but resulted in Wightman. “This event showed us just how
PCs were protected by
extremely erratic power for about 90 min- important the added protection of a double
non-Liebert, passive
utes. The first clue that problems were conversion system can be. I think the per-
standby UPS systems.
occurring came when the metal halide formance of the Liebert UPS impressed
These UPS systems all
lights in the facility shut down because of everyone who realizes its capability.”
suffered either
low voltages.
premature shut down
due to battery failure Matt Wightman, an electrical engineer at
New York Stock Exchange
or catastrophic NLX, checked the readings on the facility’s
Fortunately for the New York Stock
failures… Power main UPS, a 50 kVA Liebert Npower. Matt
Exchange, the blackout hit shortly after
supplies burned up in observed incoming voltages ranging from
trading had ceased for the day on August
five of the computers 130V to 260V – dramatic deviations from
14, 2003. But that didn’t mean the
and one motherboard the 208V nominal. He also observed fre-
Exchange could afford to lose power to its
caught fire. quency variations from 52 to 80 cycles
critical systems, which hold transactional
per second. Despite these fluctuations, the
data from the day’s trading. Like many
test equipment protected by the Liebert
organizations with zero tolerance for down-
Npower rode through the disturbances
time, The New York Stock Exchange relies
without a problem. The Npower not only
on Liebert UPSs to protect critical systems.
isolated the equipment from the distur-
But unlike other organizations with high
bances, but also provided consistent power
availability requirements, the Exchange is
quality throughout the episode, only going
unable to keep a generator on-site due to
to battery for several seconds the entire
environmental restrictions. Consequently, a
time. The Liebert-protected systems contin-
diesel generator had to be trucked into
ued to perform testing until the test proto-
the Exchange to provide power during the
col was shut down because of the possibility
blackout. Critical systems were kept up and
of an extended blackout.
running on UPS battery power while the
By contrast, a small number of PCs were generators were in transport. The UPS sys-
protected by non-Liebert, passive standby tems then managed a seamless transition
UPS systems. These UPS systems all suf- to generator power and, when power was
fered either premature shut down due restored, back to utility power. According
to battery failure or catastrophic failures. to Robert Britz, president of the New York
These failures allowed bad power to reach Stock Exchange: “The UPS systems oper-
the computers, causing irreparable ated as they should, which helped the
damage. Power supplies burned up in five Exchange conduct business without inter-
of the computers and one motherboard ruption and, thereby, fulfill our obligation to
caught fire. America’s 85 million investors.”

7
 Equinix • Batteries in the line interactive UPSs
Equinix is the leading global provider of did not have the capacity to support
network-neutral data centers and Internet the connected load while the back-up
Batteries in the line
exchange services for enterprises, content generators were started and stabilized;
interactive UPSs did
companies and network services providers. many shut down well before their rated
not have the capacity
The company maintains data centers in back-up time and dropped critical loads
to support the
Secaucus, N.J., and Newark, N.J. Like all unexpectedly.
connected load while
of the company’s facilities, these centers
• The line interactive UPS units were
the back-up
are designed for zero downtime. And they
unable to support start-up on
generators were
experienced zero downtime during the
exhausted batteries. When the utility
started and stabilized;
blackout, thanks in part to Liebert double
restarted with “dirty” power, the line
many shut down well
conversion UPS systems. According to
interactive UPSs attempted to go to
before their rated
Margie Backaus, chief business officer at
their already-spent batteries, causing
back-up time and
Equinix, “We had zero interruptions. Abso-
the units to shut down unexpectedly
dropped critical loads
lutely none.”
and drop the load.
unexpectedly.
• After the blackout, the incoming power
Time-Warner lost its neutral and voltage jumped to
Time Warner’s operations in Manhattan 150 on one pole and dropped to 90 on
were in the heart of the area most affected the other. The line interactive UPSs let
by the blackout. The data center at this this anomaly through, destroying the
location manages a number of complex power supplies on seven servers.
content delivery services, both locally and
The Liebert double conversion GXT UPSta-
nationally, including Road Runner high-
tions performed flawlessly throughout
speed cable modem service, video-on-
these conditions. None of the disturbances
demand, and commercial insertion servers
– including the loss of neutral – affected the
that place local, regional and national com-
output power from the Liebert systems.
mercials on dozens of cable channels.
“Battery maintenance has been an ongoing
For Time Warner, data center downtime
problem with the line interactive systems
translates directly into lost revenue.
because of the frequency that these sys-
Time-Warner uses both room-scale and tems have to go to battery,” said Scott
rack-scale UPS systems at its Manhattan Widney, IT manager at Time Warner. “It is
facility. The rack-scale systems include a problem we have lived with until now
Liebert GXT UPStations, a double conver- by stockpiling extra batteries on site. But
sion UPS, and non-Liebert, line interactive seeing the performance of the Liebert sys-
systems. The blackout highlighted signifi- tems has convinced me that all of our criti-
cant performance differences between the cal systems need to be protected by double
Liebert and non-Liebert systems, including: conversion UPS systems.”

8
 Four Steps to Better Protection ical systems are protected by a true
double conversion system.
In light of the reliability problems with
the grid, it is likely there will be a repeat Some organizations may also re-evalu-
If a generator is to
of the situation that created the events ate the feasibility of a generator in light
be added to an
these organizations had to deal with. Con- of the costs of the blackout. If a genera-
existing power
sequently, many organizations are re-eval- tor is to be added to an existing power
system, ensure
uating their disaster recovery systems and system, ensure compatibility between
compatibility
processes. Following is a four-step process the existing UPS and the generator. Line
between the existing
for conducting a systematic audit of power interactive systems can perform poorly
UPS and the
protection systems. when used with a generator because
generator. Line
they are overly sensitive to frequency
interactive systems 1. Are the right systems protected? changes that occur when new loads are
can perform poorly Virtually every organization has some started on generator power.
when used with a degree of protection for critical systems
generator because in the data center. However, when the Finally, the level of redundancy built into
they are overly costs of a widespread, extended black- the power system should be evaluated.
sensitive to frequency out are calculated, many organizations Dual-bus systems provide redundancy
changes that occur discover just how far their networks across the entire power path, including
when new loads are have spread beyond the corporate data redundant backup generators. Organi-
started on generator center. Today, business critical systems zations with a dual-bus system in place
power. are as likely to be located on the were able to overcome the failure of any
plant floor, in distribution centers or in single component in the system, includ-
remote offices, as in the data center. ing a generator.
Many of these systems lack the protec-
tion their importance to the business
warrants. 3. How well did the systems that are
in place perform before, during and
after the event?
2. Do systems have the right level How well did existing systems handle
of protection? the extreme fluctuations in power qual-
Regarding the type of protection for ity that preceded the blackout itself?
each system, consider the UPS topol- Was facility-level surge protection ade-
ogy, whether or not a generator is quate to protect critical systems from
required and the degree of redundancy damage? Was the UPS able to provide
in the power protection system. adequate power conditioning to protect
systems and data prior to and during
Business critical systems need to be the blackout? Any damage to protected
protected by a double conversion UPS systems that occurred is likely the result
system. An audit of UPS topologies of the failure of the UPS system to
should be conducted to ensure all crit- isolate the load from incoming power

9
 quality problems. During the blackout, Conclusion
was battery capacity adequate to pro-
Future blackouts are probably unavoidable
vide a controlled shutdown or transition
Ensuring all critical considering the complexity and interdepen-
to backup power? Was the transition to
systems are protected dency of the power grid. However, orga-
backup power accomplished smoothly?
by a true double con- nizations can minimize the lost revenue,
version UPS is one of equipment damage and downtime asso-
the most important ciated with blackouts through increased
4. Is a service strategy in place to ensure
steps an organization attention to critical system protection.
equipment is properly maintained?
can take to minimize
One of the most common problems Double conversion UPS systems have
the financial impact of
reported during blackouts involve gen- proven their ability to provide the pro-
the next blackout.
erator failure. The New York Daily tection required before, during and after
News reported that about half of that extended outages. They deliver consistent
city’s 58 hospitals had generator prob- power quality to the load, despite wide
lems during the August 2003 blackout. swings in voltage and frequency, provide
Increased emphasis on service may have more effective use of batteries and operate
prevented many of these failures. Look more reliably in conjunction with a gener-
for a service organization that can coor- ator. Ensuring all critical systems are pro-
dinate UPS and generator maintenance tected by a true double conversion UPS is
into a single program. In addition, poor one of the most important steps an orga-
battery maintenance can contribute to nization can take to minimize the financial
problems. Battery maintenance can be impact of the next blackout.
complicated by having too many small
UPS systems in operation, as opposed
to fewer, larger systems.

10
 LIEBERT CORPORATION
1050 D EARBORN DrIVE
P.O. B OX 29186
COLUMBUS, O HIO 43229
800.877.9222 (U.S. & C ANADA O NLY)
614.888.0246 (O UTSIDE U.S.)
FAX: 614.841.6022
www.liebert.com

While every precaution has been taken to ensure accuracy and

completeness in this literature, Liebert Corporation assumes no
responsibility, and disclaims all liability for damages resulting from
use of this information or for any errors or omissions

© 2004 Liebert Corporation. All rights reserved throughout the

world. Specifications subject to change without notice.

Trademarks or registered trademarks are property of their

respective owners.

® Liebert and the Liebert logo are registered trademarks of the

Liebert Corporation

® Keeping Business in Business is a registered trademark of the

Liebert Corporation.

The Emerson logo is a trademark and service mark of the Emerson

Electric Co.

Printed in U.S.A. V2 0104

11