- October 21, 2026
- Posted by: editor
- Category: RECD & Emission Control Devices
Every RECD installation eventually forces a design question that nobody enjoys answering: if something goes wrong with the emission control device, what should the generator do about it?
There are two easy answers, and both are wrong. “Trip the generator on any RECD fault” turns a dirty filter or failed sensor into a blackout during a grid outage. “Never let the RECD affect the generator” can leave an engine running against back-pressure far above its maker’s limit until a turbocharger pays the price.
The right answer differs for each condition. This post gives a framework: four response levels, consequence ranking, decision ownership, critical-load adjustments, interlock design and testing, and an illustrative classification of ten conditions.
One principle runs through all of it. RECD conditions are mostly about emissions performance and equipment health, and they should usually produce alarms. A small number touch engine protection, and those limits belong to the engine maker and the DG maintainer, not to the RECD supplier alone.
The Four Response Levels
First agree on vocabulary. Many site arguments come from people using “trip” and “shutdown” to mean different things.
| Level | Name | What happens to the DG | Who acts | Typical time scale |
|---|---|---|---|---|
| 1 | Alarm | Nothing automatic. DG keeps running at its current load | Operator acknowledges, investigates, logs | Minutes to days |
| 2 | Load reduction | DG keeps running, but non-essential load is shed manually or by load management | Operator or automatic load shedding | Minutes |
| 3 | Controlled shutdown | Load transferred or shed, DG unloaded, cool-down run, then stop | Operator, or DG controller sequence | 5–15 minutes |
| 4 | Trip | Immediate stop, breaker opens, no cool-down | DG controller protection, automatically | Seconds |
Level 1: Alarm
An alarm tells a person something needs attention. It does not change the machine’s state. Most RECD conditions belong here: rising back-pressure that is still within engine limits, a sensor out of range, a missed regeneration, a heater fault, a communication loss. Good alarm practice, as summarised in the ANSI overview of ISA-18.2, says each alarm should need a defined operator response. If no one would do anything, it should not be an alarm.
Level 2: Load reduction
Exhaust back-pressure and temperature both rise with load. If back-pressure is climbing towards a limit during a long outage, shedding non-essential load (chillers, lifts in standby groups, non-critical HVAC, EV chargers) can hold it below that limit and keep critical loads supplied. This is often the most useful response for RECD conditions, yet it is the one most often forgotten in design.
Level 3: Controlled shutdown
The generator is stopped deliberately and gracefully. Load is transferred to grid or another set if available, the engine is unloaded, a cool-down run protects the turbocharger, and then it stops. This is right when continued running risks damage, but not so suddenly that a few minutes matter.
Level 4: Trip
An immediate protective stop. Trips exist for conditions where seconds count: low oil pressure, overspeed, high coolant temperature, generator electrical faults. Very few RECD conditions justify a trip. A sudden extreme rise in back-pressure, far above the engine maker’s maximum, is the main candidate, and even then many engineers prefer a fast controlled shutdown.
Step 1: Rank Each Condition by Consequence
The response should match the consequence of doing nothing. Ask three questions about each condition.
What is harmed if the DG keeps running?
- Nothing physical, only data or compliance evidence
- Emissions performance (filter bypass, poor regeneration)
- RECD hardware (filter overheating, heater damage)
- Engine hardware (turbocharger, valves, gaskets, fuel efficiency)
- People or property (fire risk, hot gas leak into a room)
How fast does the harm develop?
- Days or weeks (gradual soot loading)
- Hours (sustained high load against a part-blocked filter)
- Minutes (rapid temperature rise during uncontrolled regeneration)
- Seconds (exhaust leak into an occupied space)
What does stopping the DG cost?
- On a test run with grid available: very little
- During an outage at an office: inconvenience and lost work
- During an outage at a hospital, data centre or water pumping station: potential harm to people or very high cost
Combine these into a simple score. The following model is illustrative; adapt the weights to your site.
| Factor | Score 1 | Score 2 | Score 3 | Score 4 |
|---|---|---|---|---|
| Harm if DG keeps running | Data or compliance only | Emissions or RECD hardware | Engine hardware | People or property |
| Speed of harm | Days | Hours | Minutes | Seconds |
Multiply harm by speed to get a consequence score from 1 to 16. Then read across a default response:
| Consequence score | Default response |
|---|---|
| 1–3 | Alarm |
| 4–6 | Alarm, with load reduction guidance |
| 8–9 | Load reduction, escalating to controlled shutdown if not resolved |
| 12 | Controlled shutdown |
| 16 | Trip |
Then adjust for the cost of stopping (see critical-load sites below). The score is a thinking tool, not a substitute for engineering judgement; its value is forcing each condition to be argued on its merits.
Step 2: Decide Who Owns Each Decision
The most common mistake is letting one party decide everything. The RECD supplier knows the device, the engine maker knows what the engine tolerates, the DG maintainer knows the controller, and the facility owner knows the loads and what an outage costs.
| Decision | Owner | Must be consulted | Notes |
|---|---|---|---|
| RECD alarm thresholds (soot loading, regeneration, sensor faults) | RECD supplier | Facility owner | Based on RECD design and test data |
| Maximum permissible exhaust back-pressure | Engine maker (via DG OEM or dealer) | DG maintainer, RECD supplier | Taken from engine data sheet |
| Whether any RECD signal can stop the DG | DG maintainer and facility owner | Engine maker, RECD supplier | Must consider critical loads |
| Load shedding priorities | Facility owner | Electrical consultant | Linked to building load schedule |
| Wiring and logic in the DG controller | DG maintainer | RECD supplier | Changes may affect OEM warranty |
| Operator response procedures | Facility owner | RECD supplier, DG maintainer | Feeds the alarm response matrix |
Two points deserve emphasis.
First, engine-protection limits are not the RECD supplier’s to set. A supplier can and should tell you the expected back-pressure range for its device, and recommend alarm thresholds. But the decision that the engine must stop at a certain back-pressure, and how, depends on the engine maker’s allowable maximum and on the DG maintainer’s control design. See how exhaust back-pressure affects a DG set for why these limits exist.
Second, changes to DG controller logic can affect the generator’s warranty. Involve the DG OEM or authorised dealer before adding shutdown inputs. See whether an RECD affects the generator’s OEM warranty. Once agreed, protect the settings so nobody quietly changes a threshold or bypasses an interlock.
Step 3: Adjust for Critical-Load Sites
A response that is sensible at a factory on a weekend test run can be dangerous at a hospital during a monsoon grid failure.
The general rule for standby sets during an outage
For emergency standby generators serving life-safety or critical loads, the default for RECD conditions should be alarm and load reduction, not shutdown. Shutdown should be reserved for conditions where continued running creates a greater risk than losing power, and ideally where another source can pick up the load.
Hospitals
Operating theatres, ICUs, ventilators and blood banks cannot lose supply. A partially blocked filter causing higher fuel use and some engine stress is a far smaller problem than a power loss. Many hospital engineers choose to allow the engine to run above the RECD’s alarm thresholds during a genuine emergency, accepting accelerated wear, while escalating urgently. See RECDs for hospitals around critical backup loads.
Data centres
N+1 or 2N designs change the calculus. If a redundant set can take over, a controlled shutdown of the affected set is more acceptable, provided the remaining capacity covers the IT and cooling load. The logic should check that a healthy set is available before initiating a shutdown on RECD grounds. See RECDs for data centres and redundancy testing.
Unattended sites
At telecom shelters or remote pumping stations, nobody is there to shed load, so automatic responses look attractive. But a shutdown there means no power until someone travels to site. Remote alerting and automatic load reduction are often better. See RECDs for telecom sites with unattended operation.
Test runs versus real outages
Mode-dependent logic helps. On a test run with grid available, high back-pressure can trigger a controlled shutdown at almost no cost; during an outage, the same condition triggers alarm and load reduction. The DG controller usually knows mains status, so this is easy to implement.
| Condition severity | Test run, grid healthy | Grid outage, non-critical site | Grid outage, critical site |
|---|---|---|---|
| Warning level | Alarm | Alarm | Alarm |
| High level, below engine maximum | Controlled shutdown | Load reduction | Load reduction, escalate |
| Above engine maximum | Controlled shutdown | Controlled shutdown | Load reduction, controlled shutdown only if backup source available or risk of damage is imminent |
| Extreme, sudden | Trip | Trip or fast controlled shutdown | Decision agreed in advance with engine maker and facility owner |
Step 4: Design the Interlocks So They Fail Predictably
Once you know which conditions do what, the signals have to be built so they behave correctly when something breaks.
Separate warning signals from stopping signals
Alarm and warning signals can be numerous and can travel over Modbus or other serial links. Signals that can stop the engine should be few, hardwired, and engineered deliberately. Never let a serial message alone stop an emergency standby generator. Our companion post on what happens when RECD communication with the DG controller fails explains why.
Choose fail-safe direction carefully
For alarm contacts, normally closed wiring means a broken wire shows as an alarm, which is good. For a stopping signal, the same wiring would mean a broken wire stops the generator, which may not be acceptable. Many designs use normally closed for alarms and a supervised, normally open circuit with wire-break monitoring for any stop input, so a broken wire raises an alarm rather than stopping the set.
Use a measured value, not a single switch, for stop decisions
A pressure switch gives one bit: above or below a set point. A transmitter gives a continuous value that can be plausibility-checked, trended and compared with load, reducing false stops from a failed sensor. See pressure sensors vs pressure switches in RECD monitoring.
Add delays and confirmation
Back-pressure spikes briefly during load steps and during regeneration. A stop decision should require the condition to persist, for example for 30 to 120 seconds, and ideally be confirmed by a second indicator such as rising exhaust temperature or falling load acceptance. DieselNet’s overview of DPF regeneration explains why temperature and pressure behave differently during regeneration, which affects how you set these confirmations.
Provide an override, and control it
Critical sites often need an “emergency run” override that suppresses RECD stop inputs during a declared emergency. That override must be physically controlled (a key switch, for instance), logged, and alarmed while active, so it is never left on by accident.
Make the operator screen clear
When an RECD condition escalates, the operator must see at a glance what level has been reached and what happens next. HMI good practice described in ISA-101 supports showing alarm priority clearly and avoiding clutter, so that a load reduction prompt is not buried under minor notifications.
Step 5: Test the Responses Before You Need Them
A response matrix that has never been tested is a hope, not a design.
- Factory or bench test. Simulate each RECD signal at the controller and confirm it reaches the right DG controller input with the right label. This is part of a good factory acceptance versus site acceptance test plan.
- Site test, DG stopped. Inject signals (using a calibrator or by simulating contact states) and confirm the DG controller shows the correct alarm and that stop inputs act as intended, with the engine not running.
- Site test, DG running on test load, grid available. Confirm alarm and load reduction behaviour. If a controlled shutdown is part of the design, confirm the sequence, including cool-down.
- Mode test. Simulate mains failure and confirm the logic switches to outage behaviour (for example, a high back-pressure condition no longer causes shutdown).
- Wire-break test. Disconnect each signal wire and confirm the result is an alarm, not a silent loss or an unwanted stop.
- Override test. Operate the emergency run override and confirm it suppresses the agreed inputs, raises its own alarm and is logged.
- Document. Record every result, with date, IST time, people present and any deviation, in the commissioning file and the RECD event log.
Retest after any change to controller programs, firmware, thresholds or wiring, and at least annually.
Worked Example: Classifying Ten Conditions at a Hospital (Illustrative)
This example is illustrative. It describes a hypothetical 300-bed hospital in Noida with two 1010 kVA DG sets in an N+1 arrangement for a peak critical load of about 700 kW. Each set has an RECD. The engine maker’s data sheet gives a maximum exhaust back-pressure of 10 kPa (an assumed figure for this example). The RECD supplier recommends a warning at 7 kPa and a high alarm at 8.5 kPa under normal running load.
The team (facility engineer, DG maintainer with input from the engine dealer, and the RECD supplier) scored each condition for harm and speed, then adjusted for the hospital’s critical loads and N+1 redundancy.
| # | Condition | Harm (1–4) | Speed (1–4) | Score | Test run response | Outage response | Decision owner |
|---|---|---|---|---|---|---|---|
| 1 | Back-pressure above 7 kPa (warning) | 2 | 1 | 2 | Alarm | Alarm | RECD supplier |
| 2 | Back-pressure above 8.5 kPa (high) | 3 | 2 | 6 | Alarm, stop test after cool-down | Alarm, shed non-critical HVAC and laundry | RECD supplier, facility owner |
| 3 | Back-pressure above 10 kPa for over 60 s (engine max) | 3 | 3 | 9 | Controlled shutdown | Shed load; if second set healthy and can carry load, controlled shutdown of affected set; otherwise keep running and escalate | Engine maker, DG maintainer, facility owner |
| 4 | Back-pressure above 14 kPa rising fast | 3 | 4 | 12 | Trip | Fast controlled shutdown if second set available; otherwise run, escalate, emergency call-out | Engine maker, DG maintainer, facility owner |
| 5 | Back-pressure sensor out of range or failed | 1 | 2 | 2 | Alarm | Alarm, manual checks every 15 min | RECD supplier |
| 6 | Missed or incomplete regeneration | 2 | 1 | 2 | Alarm | Alarm | RECD supplier |
| 7 | Filter outlet temperature abnormally high (possible uncontrolled regeneration) | 2 | 3 | 6 | Controlled shutdown | Alarm, shed load to reduce exhaust temperature, inspect | RECD supplier, DG maintainer |
| 8 | Exhaust leak detected in DG room (smell, smoke, CO alarm) | 4 | 4 | 16 | Trip | Controlled shutdown if second set available; evacuate room; fire safety procedure | Facility owner, fire safety lead |
| 9 | RECD controller communication lost | 1 | 1 | 1 | Alarm | Alarm | RECD supplier, BMS integrator |
| 10 | RECD heater or controller supply failure | 2 | 2 | 4 | Alarm | Alarm | RECD supplier |
What the team learned
Most conditions stayed at alarm. During an outage, five of ten produce only alarms and two more add load shedding, because RECD conditions are mostly about performance and maintenance.
Load reduction did the heavy lifting. For conditions 2, 3 and 7, shedding about 150 kW of non-critical HVAC and laundry load (illustrative) was expected to bring exhaust flow and back-pressure down meaningfully. Because back-pressure rises with exhaust flow, cutting load from 700 kW to 550 kW could lower it noticeably, often enough to stay under the engine maximum while the problem is investigated. Check the real effect on a test run, using comparing RECD pressure readings at different generator loads.
Redundancy changed two answers. For conditions 3 and 4, the response depends on whether the second set can carry the load. With an N+1 pair and a 700 kW peak, either set could carry the critical load alone, so a controlled shutdown of the affected set was acceptable if the other was healthy. The logic was written to check the second set’s status before permitting it.
Only one condition justified a trip in all modes in principle, and that was not really an RECD condition at all. An exhaust leak into the DG room (condition 8) is a fire and life-safety hazard. Even there, the hospital chose a controlled shutdown during outages when the second set was available, with an evacuation procedure, because an instant trip without load transfer would itself put patients at risk.
Ownership was written down. Conditions 3 and 4 required the engine dealer’s written confirmation of the maximum back-pressure figure.
Common Mistakes
| Mistake | Why it hurts | Better approach |
|---|---|---|
| Wiring the RECD common alarm to a DG shutdown input | Any sensor fault or dirty filter can black out the building | Common alarm to a warning input only |
| Using the same threshold for test runs and outages | Either too cautious during outages or too lax during tests | Mode-dependent logic based on mains status |
| Letting the RECD supplier set engine stop limits alone | Engine limits belong to the engine maker | Get the maximum back-pressure in writing from the DG OEM or dealer |
| No delay on back-pressure stop inputs | Load steps and regeneration cause short spikes and false stops | Persistence delay plus confirmation |
| Uncontrolled emergency override | Left on after an emergency, protection silently disabled | Key switch, alarm while active, logged |
| Too many alarms with no defined response | Operators learn to ignore them | Each alarm must have an action; see the nuisance alert guidance |
| Never testing in outage mode | First real test is a real emergency | Simulate mains failure during commissioning |
FAQ
Should an RECD ever trip a generator?
Rarely. Most RECD conditions should raise alarms. The main exception is exhaust back-pressure far above the engine maker’s maximum, and even then the response and limit should be decided with the DG maintainer and engine maker, with critical loads in mind.
Who decides the back-pressure limit at which the DG stops?
The engine maker sets the maximum permissible exhaust back-pressure, usually communicated through the DG OEM or authorised dealer. The DG maintainer and facility owner decide how the controller responds. The RECD supplier advises on expected values and alarm thresholds.
Can a dirty RECD filter damage the engine?
If back-pressure stays above the engine maker’s limit for long periods, it can increase fuel use, raise exhaust temperatures and stress components such as the turbocharger. That is why high back-pressure should trigger early alarms and maintenance, long before it reaches engine limits.
What is the difference between a controlled shutdown and a trip?
A controlled shutdown transfers or sheds load, unloads the engine, runs a cool-down and then stops. A trip stops the engine immediately. Controlled shutdowns are gentler on the engine and give time to transfer critical load.
Does GRAP change how alarms should be handled?
GRAP does not change engine protection, but during restricted periods in Delhi NCR you may need clearer evidence that the RECD is working. Logged alarms and responses help. See GRAP rules for DG sets in Delhi NCR.
Should the response be different on prime power sets?
Often yes. Prime power sets run long hours under load, so filter loading builds faster and a load reduction may affect production. Review thresholds and responses with your duty cycle in mind; see standby vs prime power generators.
Related Reading
- What Happens When RECD Communication with the DG Controller Fails?
- How to Reduce Nuisance RECD Alerts Without Hiding Real Faults
- Who Should Have Access to RECD Controller Settings?
- Sequencing RECD Installations on an N+1 Generator System
- How Exhaust Backpressure Affects a DG Set
Plan Your RECD Control Response with Aceget
Aceget supplies CPCB type-approved Retrofit Emission Control Devices for DG sets from 25 kVA to 2500 kVA. If you are working out which RECD conditions should alarm, reduce load or stop the generator, we can work alongside your DG maintainer and engine dealer to agree a clear response. Review our certifications and contact our team to discuss your site.