Your Backup Generators Are Redundant. Your Fuel Isn't.

If multiple generators draw from the same bulk diesel supply—or from separate tanks containing fuel of similar age and condition—fuel contamination or degradation can become a common-mode failure. Instead of losing one generator and transferring the load to another, you can have multiple generators experience the same fuel-related problem during the same outage.

And one of the biggest things they have in common is their fuel.

That is why generator redundancy has to include a plan for maintaining the reliability of the stored fuel those generators depend on.

Why N+1 redundancy doesn't protect against fuel problems

There is an assumption built into redundancy that is easy to overlook: the redundant components need to have some degree of independence from one another.

If one generator experiences a mechanical failure, another generator is there to pick up the load. That's exactly what an N+1 design is supposed to accomplish.

But what happens when the problem isn't the generator?

Consider three generators supplied by the same bulk storage tank. Mechanically, you have redundancy. From the standpoint of fuel, you don't. All three generators are dependent on the condition of the same stored diesel.

Even separate day tanks don't necessarily eliminate the problem. They may have been filled from the same bulk tank or fuel delivery, contain fuel of roughly the same age, and operate under the same maintenance practices.

That creates the potential for what reliability engineers call a common-mode failure: one condition capable of defeating multiple supposedly redundant systems at the same time.

Fuel contamination is a good example.

Adding another generator gives you additional protection against the failure of a generator. It doesn't give you another source of clean fuel.

What happens to diesel while it sits in storage

Backup generator fuel spends most of its life doing exactly what you want it to do: sitting there.

Unfortunately, stored diesel doesn't remain unchanged while it waits.

Over time, oxidation can contribute to the formation of gums, sediments and other degradation products. Water can enter a tank through condensation, fuel deliveries and other sources. Where sufficient water is present, microbial contamination can become established at fuel-water interfaces.

Now you have the ingredients for problems that may not become obvious until the generator is asked to operate for an extended period.

Water and sediment can accumulate in the lower portions of the tank. Microbial growth can produce biomass. Fuel degradation can contribute additional insoluble material.

And much of that material has the same eventual destination: the generator's fuel filters.

This is where the redundancy problem comes back into the picture.

If three generators depend on fuel with the same contamination problem, there is no reason to assume that only one generator will be affected. The same condition can begin restricting fuel flow to multiple engines as they continue operating.

Your redundant generators aren't really redundant against that particular failure mode.

Why a successful generator exercise doesn't prove the fuel is ready

This is another important distinction.

A generator can start successfully and run through its scheduled exercise while the facility still has a fuel-quality problem.

That isn't a contradiction. The exercise and the outage aren't necessarily putting the fuel system through the same conditions.

During routine operation, a relatively small amount of fuel may be consumed from a tank that has spent most of its time undisturbed. Water, sediment, and biomass can remain concentrated in other portions of the storage system.

An extended outage changes the equation.

Fuel consumption continues for hours instead of minutes. Tank levels fall. Fuel circulation and return can disturb material in the tank. And if an emergency fuel delivery becomes necessary during the outage, filling the tank can agitate contamination that had been sitting relatively undisturbed.

That's when a generator that started perfectly can begin losing fuel pressure as its filters load with contamination.

So a successful generator exercise tells you something important: the generator was capable of starting and operating under the conditions of that test.

It does not, by itself, establish that thousands of gallons of stored diesel are in suitable condition for an extended emergency.

NFPA 110 recognizes that distinction. NFPA 110 Section 8.3.7 requires a fuel quality test at least annually using appropriate applicable ASTM standards or the manufacturer's recommendations. The accompanying guidance also specifically addresses monitoring diesel fuel for water at the bottom of the tank and testing for degradation and contamination.

In other words, exercising the generator and evaluating the fuel are two different parts of emergency-power reliability.

You need both.

What outage data tells us about the risk

The broader outage data gives some useful perspective.

Uptime Institute's Annual Outage Analysis 2026 found that power continues to be the leading cause of impactful data center outages. Within power-related failures, UPS systems, transfer switches and generators remain important contributors.

That's significant because these are facilities where redundancy isn't an afterthought. Data centers routinely spend substantial amounts of money designing electrical systems specifically to prevent a single equipment failure from becoming a facility outage—which is exactly why data center fuel quality management belongs in the same reliability plan as the electrical design.

And yet power-system failures still happen.

Uptime also reported that 57% of respondents to its 2025 annual survey said their most recent major outage cost more than $100,000. One in five reported costs greater than $1 million.

The lesson isn't that redundancy doesn't work. It does.

The lesson is that redundancy only protects you against the failure modes the redundant design actually addresses.

If the generators share a vulnerability somewhere upstream—fuel quality being one example—adding another generator does not necessarily remove that vulnerability.

Taking fuel off the common-mode-failure list

There isn't one test, additive or service that solves every stored-fuel problem.

That's why an effective fuel-management program has to do three different things: find problems, correct the problems that are present, and physically remove contamination when necessary.

Start by finding out what is actually in the tank

Testing gives you the information you need before deciding what treatment or service is appropriate.

For mission-critical generator fuel, Bell Fuel & Tank Services uses a Mission Critical ASTM slate that includes:

• D86 Distillation
• D93 Flash Point
• D130 Copper Strip Corrosion
• D287/D4052 API Gravity
• D976 Cetane Index
• D2709 Water & Sediment
• D6304 Water by Karl Fischer
• D2622 Sulfur Content

Together, those tests provide a much better picture of whether the stored fuel remains within specification and whether water, sediment or other fuel-quality issues require attention.

Microbial testing adds another layer. ATP testing can identify microbial activity quickly enough to make it practical to monitor changes in fuel condition over time rather than waiting until plugged filters provide the first indication of a problem.

The important point is this: test first.

Don't polish fuel because the calendar says it's time to polish it. Don't add a biocide because somebody assumes there must be microbes in the tank.

Find out what problem you actually have.

Treat the problem the testing identifies

Different fuel problems require different chemistry.

If the concern is long-term oxidative stability, Dee-Zol Life is used at approximately 1:2000 to help stabilize stored diesel.

If testing confirms active microbial contamination, an EPA-registered fuel biocide such as Bellicide can be used to kill the organisms.

Tank Treatment SDF can be used to help break up accumulated petroleum sludge and microbial biomass while also providing corrosion protection.

Those products perform different jobs because the problems themselves are different.

And there is an especially important point with microbial contamination: killing microbes does not make the dead material disappear.

A successful biocide treatment can leave dead microbial biomass behind. That material can still contribute to filter plugging.

Which brings us to the third part of the program.

Remove contamination when it needs to be removed

When testing shows that a tank contains significant water, sediment or biomass, mechanical fuel polishing or tank cleaning may be necessary.

Fuel polishing circulates the fuel through equipment designed to separate water and filter suspended contaminants before returning the fuel to the tank. That is also why fuel polishing after a shock treatment is often the step that finishes the job—the biocide kills the organisms, and the polishing removes what the biocide leaves behind.

But polishing and chemical treatment aren't interchangeable.

Polishing can remove contamination. It doesn't stabilize oxidizing fuel, and filtration by itself isn't a reliable way to eradicate an established microbial population.

Likewise, a biocide can kill microorganisms, but it doesn't physically remove all of the resulting biomass from the system.

The right approach depends on what the testing shows.

That's the reason for combining testing, targeted chemical treatment and mechanical service when conditions require it.

Your generators are only as redundant as the systems they depend on

N+1. 2N. Paralleled generators. Multiple transfer paths.

All of those things have value because they eliminate individual points of failure.

But redundancy has to be looked at as a system.

If every generator ultimately depends on fuel with the same water, the same contamination and the same degradation problems, then the fuel itself may be the single point of failure that the electrical design was supposed to eliminate.

That's why fuel quality belongs in the same reliability conversation as generator maintenance, transfer equipment and load testing.

Start by testing the fuel in the primary storage tank. If it's in good condition, you now have documentation supporting something that otherwise would have been an assumption.

If it isn't, you've found the problem while utility power is still available.

Bell Fuel & Tank Services' Fuel Secure program combines scheduled ASTM and microbial testing with the reporting and technical guidance needed to track fuel condition over time. Programs range from $875 to $1,475 per tank per year, depending on the level of monitoring.

Because when the grid goes down, that isn't the time to find out whether your redundant generators all have the same problem.