← Back to news 29.10.2026 Series: Machine room, part 5

The emergency power chain is only as good as its last test run

Machine room, part 5: UPS, standby generator, switchover, cooling. Every link can be maintained and ticked off on its own, and the server room still goes down in a real power cut. What Grundschutz++ and the previous Kompendium say about load tests and function tests, and why the chain has to be tested as a whole.

A power cut on a Tuesday afternoon. The UPS takes over as planned. The standby generator starts, but the switchover hangs. The UPS batteries are four years old and last six minutes instead of the planned fifteen. After seven minutes, the server room is dark. Every single device had been maintained, every maintenance had its report.

Emergency power is not a single installation but a chain: detecting the outage, bridging with the UPS, starting the generator, switching over, carrying the load, keeping cooling running and finally returning cleanly to the grid. It is as strong as the link nobody has seen under load recently.

What Grundschutz++ requires

In the Grundschutz++ user catalogue (as of 24.09.2026), requirement GEB.9.2 is simply called "load test": building management for sites can regularly check the resilience of the power supply. The guidance gives examples, such as a monthly UPS self-test or a six-monthly full-load run of the generator for at least 30 minutes. In German:

„Beispiele sind ein monatlicher USV-Selbsttest oder ein halbjährlicher Volllastbetrieb des Generators für mindestens 30 Minuten.“

The classification is notable. In Grundschutz++, GEB.9.2 is a KANN (may) requirement at the elevated level. The previous IT-Grundschutz Kompendium, edition 2023, was stricter where a standby generator exists. INF.2.A14 stated that load and function tests as well as test runs under load MUST be carried out during maintenance. Anyone operating a generator without running it under load therefore does not carry less risk just because the new wording sounds softer.

Why the chain has to be tested

The decisive sentence was in Kompendium INF.2.A19, function tests of the technical infrastructure: in particular, entire reaction chains SHOULD be subjected to a real function test. In German:

„Besonders ganze Reaktionsketten SOLLTEN einem echten Funktionstest unterzogen werden.“

That is exactly where it fails in practice. The UPS self-test runs monthly, the generator is started idle during servicing, the transfer switch has its own test interval. Every test is passed. But nobody ever tested whether the links work together in the right order and under real load.

Batteries age quietly. The autonomy on the data sheet applies to new batteries at rated load. Anyone who has never measured it with a capacity test only knows the figure from four years ago.
The load grows. Every new server draws from the same UPS. An autonomy that was sufficient at acceptance may no longer be enough three years later.
Cooling is missing from the calculation. Air conditioning is often not on the UPS. If the servers keep running but cooling only restarts after the switchover, it gets warm quickly.
The starter is the weakest link. A generator with a flat starter battery is a piece of metal.

How isidaten handles this

In DCIM, isidaten keeps standby generators with target autonomy, the last test run and its result, the next test due and the state of the starter battery; overdue test runs are flagged in the evidence report. UPS battery strings have capacity, rated autonomy, the date of the last capacity test and the expected end of life. UPS operating values such as remaining runtime and load come in via the standardised UPS MIB under RFC 1628.