Clarification on the use of RCDs with Automatic Transfer Switches in industrial server panels

I'm involved in a back-and-forth with a customer over the design of an industrial server panel using an APC AP4421A rackmount Automatic Transfer Switch. The purpose of the ATS is to keep the server running should one of the two incoming 230 V AC supplies fail.

The current schematic, which goes back to before my time started at this job, has the RCD on the single output of the ATS. The reasoning behind this is as follows:

  • Should an operator touch a live conductor, the imbalance between the two phases would trip the RCD and the whole circuit is then isolated.

The customer is insisting that the RCD should be at the input to the ATS and on each supply. The reasoning as to why this shouldn't be implemented and why the original circuit was designed as it is, is thus:

  • Should an operator touch a live conductor, the imbalance between the two phases would trip the RCD. The ATS would then detect the first supply dropping out and switch to the second supply, continuing the exposure of the operator to the live circuit before the second RCD would trip.

Now I understand that the scenario above where the first RCD trips, the ATS would switch and then the second RCD trips would take tens of milliseconds, and the function of the RCDs would still be as intended.

A couple of important points: the panel is locked during normal operation and access restricted to qualified personnel. We are not privy to any safety devices that are installed upstream on the dual incoming supplies and neither are we in control of that.

I don't have access to any standards to refer back to, hence I'm looking for knowledge here (and in the background enquiring if we can purchase the standards below, which I believe are correct in this instance).

  • IEC 60364: Low voltage electrical installations
  • IEC 61439: Low‑voltage switchgear and controlgear assemblies.

Any practical advice is greatly appreciated and if any clarification is required, I can help with that.

Thank you for reading.

Parents
  • I wonder if there's any need for RCDs at all (presuming it's not a TT installation) - ADS can usually be provided by overcurent protective devices and large racks often have protective conductor currents high enough to make 30mA RCDs a non-starter.

    I'd agree dual redundant PSUs are usually the better approach - although that's not always an option - there's usually some little item (usually network related) that only had one power inlet. ATS can also be useful for allowing supplies to be switched for maintenance and the like. I used to make a lot of use of a system that was a combined ATS and sequential start - solved a lot of inrush problems.

    If you are wanting an RCD for additional protection, then two that have to trip one after the other seems dodgy to me. At 250mA (or 150mA in some cases) it's required to trip in 40ms - and although when tested an RCD will usually do so within half that time, there's no guaranteed it'll do reliably under all conditions (say different ambient temperatures or slightly different supply voltages) - the manufacturer will only guarantee 40ms for one. Plus there's the unknown effect of shock-gap-another-shock pattern on the human body as the ATS changes over - as far as I know there's no research on the effect of that - so the normal assumptions to prevent ventricular fibrillation may not even hold.

       - Andy.

  • I wonder if there's any need for RCDs at all

    I started considering this, because from what I understand is in IEC 60364, shock risk can be managed through:

    • Controlled access
    • Safe systems of work
    • Isolation procedures
    • Competent persons

    I'm not sure if this would be the correct route to go down.

  • Depends what kind of shock risk you're talking about - if it's "normal" people without tools just pressing buttons or handling flexes or plugging in or unplugging things, or someone with a screwdriver talking lids off things and gaining access to hazardous live parts.

    If it's the latter case then RCDs are of limited help since a screwdriver gives access to pre-RCD conductors as well the ability to get a shock between downstream live conductors (e.g. L+N) which is equally fatal but won't trip the RCD. You need other measures to deal with those cases (competence, isolation etc.), by which point you've normally covered hazards from L-PE shocks in such cases as well.

    30mA RCDs can be useful where damage to flexes or appliances is likely and won't necessarily be spotted in time - the classic example being lawn mowers or hedge clippers cutting though flexes. These days we expect RCDs on general purpose socket outlets too - helps cover the cases where flexes might be damaged or cores exposed (e.g. get pulled out through plug cord grips), appliances suffering significant damage to their cases or general user stupidity. I would have thought that in a rack mount environment such risks could be mitigated in other ways (e.g. no sharp edges, flexes routed/dressed so they can't get caught in sliding rails or doors), general work procedures so that damaged equipment is identified and not used.

    Besides if you have a rack with multiple items of Class I equipment (each of which can have leakage currents of anything up to (from memory) 3.5mA per item) - a 30mA RCD will be as much use as a chocolate fire guard (as it's liable to trip at anything over 15mA and BS 7671 demands leakage currents kept below 9mA).

    Also if it's resilience you want, not only do you not want a common RCD for multiple items of equipment, you don't want them sharing overcurrent protection either. (The main failure I saw in rack mounted servers was the PSUs failing and shorting out the supply). So power distribution units with individually fused output definitely have their place - especially where single PSU network gear is involved (and even then be wary of small rated fuses still not discriminating with higher rated MCBs upstream).

      - Andy. 

Reply
  • Depends what kind of shock risk you're talking about - if it's "normal" people without tools just pressing buttons or handling flexes or plugging in or unplugging things, or someone with a screwdriver talking lids off things and gaining access to hazardous live parts.

    If it's the latter case then RCDs are of limited help since a screwdriver gives access to pre-RCD conductors as well the ability to get a shock between downstream live conductors (e.g. L+N) which is equally fatal but won't trip the RCD. You need other measures to deal with those cases (competence, isolation etc.), by which point you've normally covered hazards from L-PE shocks in such cases as well.

    30mA RCDs can be useful where damage to flexes or appliances is likely and won't necessarily be spotted in time - the classic example being lawn mowers or hedge clippers cutting though flexes. These days we expect RCDs on general purpose socket outlets too - helps cover the cases where flexes might be damaged or cores exposed (e.g. get pulled out through plug cord grips), appliances suffering significant damage to their cases or general user stupidity. I would have thought that in a rack mount environment such risks could be mitigated in other ways (e.g. no sharp edges, flexes routed/dressed so they can't get caught in sliding rails or doors), general work procedures so that damaged equipment is identified and not used.

    Besides if you have a rack with multiple items of Class I equipment (each of which can have leakage currents of anything up to (from memory) 3.5mA per item) - a 30mA RCD will be as much use as a chocolate fire guard (as it's liable to trip at anything over 15mA and BS 7671 demands leakage currents kept below 9mA).

    Also if it's resilience you want, not only do you not want a common RCD for multiple items of equipment, you don't want them sharing overcurrent protection either. (The main failure I saw in rack mounted servers was the PSUs failing and shorting out the supply). So power distribution units with individually fused output definitely have their place - especially where single PSU network gear is involved (and even then be wary of small rated fuses still not discriminating with higher rated MCBs upstream).

      - Andy. 

Children
No Data