The auditor asked for two years of power-interruption records. We handed her a thick folder — every monthly start test, every load bank run, every battery check, all signed and stamped. She flipped through it, nodded once, and asked: “And the cleanroom recovery qualification records after each event?”
Silence. The expensive kind.
That was the day I finally understood pharmaceutical backup power. In this industry, the generator isn’t the product. The evidence is.
Most facilities I’ve worked with treat a diesel generator like insurance: buy it, test it, forget it until the grid dies. In a warehouse or a shopping mall, that works. In a pharmaceutical plant, it’s a slow-motion audit failure.
GMP — Good Manufacturing Practice — doesn’t care that your generator starts. It cares that you can prove, in writing, that every part of your operation stayed under control when the power went out. The generator, the transfer switch, the fuel, the restart sequence, the cleanroom recovery: all of it is supposed to be a documented, qualified system. Most plants have a machine. They don’t have a system.
I’ve told clients this straight: a diesel generator without validation records is a rumor, not a backup system. Auditors don’t argue with machines. They argue with paperwork. And they win.
Here’s the part that catches almost everyone. The cleanroom got qualified — IQ, OQ, PQ, the full alphabet — under utility power. Then somebody added a diesel generator and an ATS two years later, and nobody ran the qualification through it.
That matters more than it sounds. IQ/OQ/PQ qualification is supposed to prove the facility performs as designed under its real operating conditions. If generator power is part of your real operating conditions — and for any site with a standby genset, it is — then the qualification is incomplete without it.
What does qualifying the backup path actually look like? Transfer tests under real cleanroom load. HVAC restart profiles recorded and documented. Pressure cascade recovery timed and trended. Particle recovery after a power event, verified against the same acceptance criteria the cleanroom was qualified with.
Almost nobody does this. And here’s the quiet killer: change control. Swap the ATS controller for a newer model, update the generator controller firmware, change fuel supplier — in a GMP facility, every one of those is a change to a qualified system. Do it without change control and the qualification status of your backup power quietly evaporates. I’ve seen plants with a perfectly maintained generator sitting on top of a completely unqualified backup-power system. The machine was fine. The status wasn’t.
This is the mistake I see most often, and it’s the one that makes operators wince when I say it out loud.
When the grid dies, the cleanroom HVAC stops. Air handling units coast down, the pressure cascade between zones collapses, and differential pressure alarms light up like a Christmas tree. Then the generator takes the load and the HVAC restarts. Power’s back. Crisis over?
Not even close. A cleanroom isn’t “clean” because the lights are on. It’s clean because the air is controlled — and the air takes time to recover. ISO 14644-3 describes recovery testing: after a disturbance, you measure how long it takes for particle concentrations to return to the classified level. For a Grade B filling zone, that recovery is not a formality. It’s the whole point.
I once watched a shift supervisor restart a filling line about forty minutes after a power event because “the generator worked fine.” The environmental monitoring data told a different story: particle counts in the critical zone hadn’t returned to grade. The product made in that window became a deviation report, a CAPA, and six weeks of investigation. All because someone confused a running generator with a recovered cleanroom.
The rule I give every pharma client now: your power-interruption SOP should define two separate events. Event one: power transfer. Event two: cleanroom recovery, with its own documented acceptance criteria. The generator handles the first. Your qualification handles the second.
During the transfer window — the seconds between grid failure and generator takeover — something else goes dark: your monitoring.
Continuous particle counters, temperature and humidity probes, differential pressure sensors — all of them feed the environmental monitoring system. If that system rides through on a UPS, great. If it doesn’t, you have a gap in your records. And in pharmaceutical manufacturing, a gap in monitoring records is not a technical detail. It’s a data integrity problem.
Regulators expect complete, consistent, enduring records. That’s the ALCOA idea — attributable, legible, contemporaneous, original, accurate — and it applies to your environmental data as much as to your batch records. An auditor doesn’t have to prove your cleanroom went out of spec during the gap. She just has to find a gap you can’t account for. The burden is on you.
This is where the UPS and the generator have to be designed as a pair, not as two separate purchases. The UPS covers the monitoring system and the critical controls through the transfer. The generator covers the long haul. I’ve audited plants where the generator was flawless and the monitoring UPS was an afterthought — dead batteries, no alarms, and a two-minute hole in the environmental record from a test nobody planned for. The generator passed. The data failed.
Standby fuel sits in a tank for months, sometimes years. In most industries, stale fuel is a maintenance problem. In pharma, it’s a change-control problem too.
If your backup power system is part of your qualified facility, then the fuel that runs it is part of the system. Switch fuel suppliers without documentation, let the fuel degrade past its usable life, skip the fuel quality checks — and you’ve introduced an uncontrolled variable into a controlled process. Diesel doesn’t keep forever, and “the generator started fine last month” is not a fuel quality record.
Same story with spare parts. A non-OEM fuel filter in a validated backup system is a change. A replacement AVR from a different manufacturer is a change. Plants that keep meticulous GMP records for their production equipment sometimes treat the generator room like a garage — parts swapped, no records, no evaluation. Then the auditor asks for the maintenance history of the backup power system, and the folder has three years of oil changes and nothing else.
Maintenance logs for a GMP facility’s generator aren’t facility scribbles. They’re GMP records. Treat them that way.
After enough of these conversations, I’ve boiled the auditor’s expectations down to a short list. If you have these five things, the generator conversation goes well:
Notice what’s on that list: four of the five are paperwork. That’s not an accident. It’s the whole lesson.
A diesel generator does exactly what it’s told. It cranks, it syncs, it takes the load. It doesn’t forge records, skip qualifications, or forget the change control form. Every failure I’ve described in this article was a human failure wearing a machine’s costume.
Hospitals learned a version of this lesson years ago — their backup power is governed by law, not luck. Pharma is governed by documentation, which is stricter in its own way. The machine gets you through the blackout. The records get you through the audit. And in my experience, the audit is the one that keeps people up at night.
Get it wrong, and you’ll learn what I learned in that conference room — that the audit hurts worse than the blackout. If you’re setting up or reviewing backup power for a cleanroom facility, talk to us before the auditor does.
Email：[email protected]
Work：Monday to Friday,9:30-18:30
