Commissioning On-Site Generation & Microgrid Controls

For most of the industry's history, on-site generation meant a yard of standby diesels that started, took the block load, ran for an hour during the monthly test, and went back to sleep. Commissioning was a checklist: crank it, transfer to it, load-bank it, prove the ATS. That world is gone for the AI build. Sites go behind the meter to escape interconnection queues that can run three to seven-plus years. Cleanview's mid-2026 tracker lists about 90 GW of behind-the-meter generation announced for 59 US data centers, largely gas turbines and engines. About 82 GW of it was announced since January 2025 and only about 2 GW is operating. The grid cannot energize that much in time. Behind the meter your generators are prime, not standby: they run the building, and the utility, if present at all, is the backup. That inversion changes what acceptance means. You are no longer commissioning a transfer switch. You are commissioning a power system: generation, synchronization, protection, storage, and a controller that must do what a utility control room does, autonomously, in milliseconds.

The job here is to prove that power system before a single GPU depends on it. It sits deliberately in the sequence: after electrical power acceptance (Chapter 13.3) has energized and characterized the switchgear, UPS and BESS as components, and before Integrated Systems Testing (Chapter 13.6) pulls the plug on the whole building. The engineering being validated is paralleling and load-sharing, fuel-gas conditioning and dual-fuel changeover, islanding transitions, microgrid-controller tuning, black start, and inertia/transient support. It is designed in Chapter 4.8 (electrical integration), Chapter 4.9 (fuel and gas process) and Chapter 4.10 (grid-interactive behavior toward the point of interconnection). Here we prove it works, and mark where a wrong acceptance decision strands the most capital.

The first acceptance gate is mechanical and electrical at once: getting several prime movers to share a load without fighting each other. A single 35 MW aeroderivative turbine does not run a 200 MW hall. GE Vernova's LM2500XPRESS is the 2025 reference point: Crusoe has ordered 29 of them for its AI data centers, about 1 GW in total, and each is rated 35 MW, starts in five minutes and can start without the grid. Eight or ten units do run a hall that size, in parallel on a common bus. They must synchronize (match voltage, frequency and phase angle within tight windows before the breaker closes) and then load-share (split real and reactive power proportionally, with no unit hogging kW or VARs).

The load-sharing philosophy you commission decides how the plant behaves the instant a GPU cluster steps load. Isochronous control holds frequency dead-flat at 60 Hz and is the natural mode for a true island, but it needs a master controller or a robust load-sharing line and does not tolerate communication faults. Droop control lets frequency sag with load (on a 60 Hz island, 4% droop = 2.4 Hz across 0–100%) and shares load locally without a communication link. It is the usual grid-parallel choice, though not the only one, and stability depends on gains, impedances and operating point. Base-load / import-export control keeps an isochronous governor with a load-control bias while paralleled to the utility, and hands over to island duty more gracefully. Against a stiff utility the droop curve sets the unit's power dispatch, not the bus frequency, so state the nominal frequency before quoting any droop band, and commission the mode you will actually run.

Most AI microgrids commission both: isochronous load-sharing when islanded, droop when grid-parallel. The acceptance test must prove the controller hands off cleanly between them. Skip that and you discover, the first time the utility drops, that the plant hunts (units oscillating against each other) or dumps load because the mode transition was never exercised.

The prime-mover class changes the acceptance list, so commission the plant you bought, not the aeroderivative case this chapter mostly describes. Reciprocating-engine plants (INNIO Jenbacher, Wärtsilä, Caterpillar) parallel dozens to hundreds of units, so the tests shift to many-unit load sharing and block loading. ISO 8528-5 grades a generating set's transient response by performance class (G1 to G4). The load step an engine can accept shrinks as its mean effective pressure rises, so prove block sizes on the gas engines you bought rather than borrowing a diesel rule of thumb. Losing one engine is a small N-1 step; the larger risk is a common-mode trip, such as a fuel-pressure dip that reaches every engine at once.

Solid-oxide fuel cells, which Bloom's 2024–26 agreements with AEP, Brookfield and Oracle took to gigawatt scale (Chapter 3.5), deliver power through inverters. They add no rotating inertia, follow load only as fast as their stacks and controls allow, and have no liquid-fuel changeover to test. In a fuel-cell island the grid-forming BESS or inverters form the bus, carry the fast load steps and perform the black start, so those become the acceptance tests. Chapter 4.8 covers the electrical design for each class.

An electron-side island is only as firm as its molecule-side supply, and the electrical team is most tempted to wave this gate through because it lives on a different P&ID. Don't. The prime movers will not start, hold load or pass an emissions stack test if the fuel gas is out of spec, and every aeroderivative turbine is fussy about its inlet. Commissioning the fuel chain (engineered in Chapter 4.9) means accepting the conditioning train end to end: filtration and coalescing (no liquids, no particulates); dew-point control and inlet heating (superheat above the hydrocarbon dew point so nothing condenses in the fuel skid); Wobbe-index verification (the interchangeability number the turbine's combustion map is tuned to, where an excursion forces a derate or a trip); and on-site boost compression for aeroderivatives that need higher fuel-gas pressure than the pipeline tap provides.

The decision with the longest tail is firmness: firm vs interruptible pipeline transport, plus the dual-fuel hedge. Interruptible gas is cheaper and faster to contract, but a winter curtailment lands exactly when the grid is also stressed and your island is doing real work. The hedge is dual-fuel changeover, gas to distillate (diesel) with on-site liquid storage, and the changeover is a commissioning test in its own right. Prove the turbine transfers fuels under load, without a trip, within the changeover window. Then check that the on-site distillate inventory covers the curtailment case selected in Chapter 4.9 (typically a multi-day correlated cold snap), within the run hours the air permit allows on the secondary fuel. Accept the gas path on paper and you will find the gap at the worst time: a Wobbe trip or a failed changeover during the one curtailment event the whole island exists to survive.

The islanding choice maps directly onto the IT load's tolerance for a power interruption. Break-before-make islanding opens the utility breaker, lets the bus de-energize, then closes onto generation. The sequence is simple and well understood, with one fatal property for AI: a dead-bus interval. For every millisecond of it the GPU racks ride on UPS or rack-level BBU, and a synchronous training run that loses power mid-step restarts from its last checkpoint. Seamless ('no-break') islanding keeps the bus energized. (Make-before-break describes a breaker sequence and is not a synonym.) A grid-forming source, whether a BESS inverter, an already-paralleled synchronous machine or both, is already holding the bus in parallel. The controller detects the grid anomaly and opens the utility breaker, and either the SOO-designated synchronous machine retains the reference or the tested grid-forming inverter takes it. Done right, the measured voltage, frequency and transient at the acceptance bus and IT terminals stay inside the ride-through limits of the equipment there, though downstream UPS, BBU and capacitance may still absorb a measurable event. Test the opposite case as well. Inside the grid's ride-through curve the campus should stay connected, and outside it the island should form cleanly. The distinction matters because the load losses of 2024 and 2026 (described below) were backup transfers that worked as designed during grid faults (method in Chapter 13.6, rules in Chapter 4.10).

The consequences cascade. Choose break-before-make and you have implicitly sized UPS/BBU autonomy to cover the dead-bus interval plus generator pickup, and a tightly coupled job restarts only if the downstream ride-through fails to cover the disturbance. Choose seamless and you have committed to a grid-forming source that can hold the bus through separation: a grid-forming BESS, an online synchronous generator carrying the reference, or a hybrid. Size it against the residual mismatch at the instant of separation (the import or export you lose, the generation already synchronized, the reactive demand, the load's own response), not against the whole campus load. A planned separation at near-zero power exchange and an unplanned one at heavy import are different sizing cases. Seamless also needs a faster, more sophisticated controller and a far more demanding commissioning test: you must prove the island forms with the load online, not on a dead bus you re-energize at leisure.

The acceptance criterion is exact: measure voltage and frequency at the acceptance points fixed in the Cx plan through the transition, and show each trace stays inside the ride-through limits of the equipment at those terminals. The ITI (CBEMA) curve is an AC voltage-envelope application note written for 120 V, 60 Hz single-phase equipment, and it says of itself that it is not a design specification. It supplies no frequency-versus-time envelope and does not transfer to an arbitrary facility bus or a DC rack. Take frequency and RoCoF against the protection settings instead, and fix the sampling, aggregation and measurement uncertainty before the test, not after reading the traces. This test, more than any other in microgrid Cx, determines whether the building is goodput-grade or merely available.

The microgrid controller is the brain, and IEEE 2030.7-2017 defines what it must do: the control functions above component level, meaning dispatch, unplanned and planned islanding, reconnection, and black start. Its companion, IEEE 2030.8-2018, defines how to test those functions, and a disciplined microgrid Cx plan cites both as the acceptance basis. Both are under revision, and NRECA reports the 2017 controller standard is scheduled to go inactive in December 2027, so name the edition in the contract. Tuning is real engineering because the loops interact. Droop coefficients set steady-state power sharing, secondary voltage/frequency regulation restores nominal after a droop excursion, and dispatch logic decides, second by second, which generators run, which idle, and how the BESS charges and discharges against the campus load and the GPU power profile.

The central trade is response speed vs stability. Tune the controller too aggressively and it overshoots and oscillates against the turbine governors and inverter controls, a multi-loop instability. Tune it too softly and it cannot arrest the frequency excursion from a GPU load step before protection trips.

The training load is a tuning input too: synchronized training swings power between compute and communication phases. Researchers from Microsoft, OpenAI and NVIDIA, working from production telemetry, find the swing energy concentrated at 0.2–3 Hz, close to the resonances of turbine-generator shafts and long transmission lines. Matched to a utility's critical frequencies, those swings can do physical damage to grid equipment (arXiv 2508.14318, August 2025). On an island your own turbines are those shafts, so check the closed-loop response at the workload's swing frequencies, not only against a single step. There is no generic setting: the loops must be tuned against the measured dynamics of this plant, which is why tuning is a commissioning activity and not a factory pre-set. The deep dive below walks the sequence.

Black start shows that the island can come back from nothing, with no utility, no running generation and a dead campus, under its own power. It is the most demanding test in the program and the one most likely to be deferred to 'analysis' under schedule pressure. For each restoration state, decide and record the method: a test on the installed plant, or injection, HIL or validated analysis. The black-start source (an aeroderivative turbine with on-board black-start capability, or a grid-forming BESS energizing a starting bus) must cold-start, energize a dead bus, then sequence the restoration: bring up auxiliaries and fuel-gas compression, parallel additional generation, and pick up load in blocks small enough that no single step exceeds the running generation's transient capability.

Block size trades restoration speed against transient risk. Large blocks restore the campus faster but risk a frequency excursion that trips the nascent island and restarts the whole sequence. Small blocks soften each transient but restore load more slowly, and slow restoration is lost goodput. The acceptance test must prove the sequence, not just the start: cold-start the source, energize the bus, and walk the documented block-loading steps with the BESS bridging each step's transient, showing frequency stays inside the protection window at every block. The cooling plant must restore in lockstep too, because there is no point energizing GPU racks faster than the CDUs and pumps can take heat. That coupling becomes the IST problem in Chapter 13.6, and it is why this test comes before integrated testing, not during it.

An island built on inverter-based generation and aeroderivative turbines is low-inertia: it lacks the large spinning masses of a utility grid that resist frequency change. Frequency therefore moves fast under a load step, and an AI load steps hard. A synchronous cluster can swing tens of megawatts in milliseconds as a training step begins or ends. Inside the island, low inertia and hard load steps make the transient-support stack mandatory, and commissioning must validate every layer of it.

The stack is layered by timescale, and the acceptance plan must test each layer. Synchronous condensers (free-spinning synchronous machines), with or without an added flywheel, add real rotating inertia and short-circuit strength; validate by measuring the rate of change of frequency (RoCoF) the island survives. A flywheel behind a power converter does not: its response is synthetic and capped by the converter rating. Grid-forming BESS provides synthetic inertia and sub-second power injection; validate against measured load steps. Increasingly the GPU rack power shelves carry the fastest storage layer. NVIDIA's Vera Rubin power-smoothing system holds ~400 J of rack-level energy storage per GPU, roughly 6× the GB300's 65 J, with a closed-loop controller that tracks capacitor state of charge and cuts peak current demand by up to ~25% against sub-second transients (NVIDIA, March 2026). The prior generation's measured result is a different metric on a different platform: up to ~30% lower peak power on an instrumented GB200 rack running Megatron with the GB300 power-shelf features (NVIDIA, 2025). Carry the two separately. The more workload controls, power-shelf capacitance and BESS smooth the transient, the less inertia the island must carry, but you can bank that relief only if you measure it at acceptance rather than assume it. Validate the layers bottom-up. The load-bank-vs-real-workload realism gap, whose canonical home is Chapter 13.6, is where you confront what the test load could and could not reproduce.

Faults on the utility grid are a separate hazard from these workload steps. In July 2024, a six-fault, 82-second sequence in Virginia saw roughly 1,500 MW of data-center demand leave the grid as sites transferred to backup. NERC issued its rare Level 3 alert in May 2026. On 22 July 2026, after the alert, a single normally cleared fault at Ashburn took about 3.8 GW off the grid. Both load losses were ride-through and protection-coordination events, which is why the islanding test above must show the campus staying connected inside the grid's ride-through curve.

Microgrid Cx earns its place by demonstrating failure, not just function. A credible island acceptance covers three outcome families. Loss of utility is the planned and unplanned islanding test: prove the seamless or break-before-make transition holds the IT bus. Loss of the largest generator is the N-1 contingency: prove the BESS bridges and the controller re-dispatches without a frequency violation. Black start: prove the campus comes back from dead. Choose a method for each from installed controlled tests, injection/HIL and validated analysis, and record what each method leaves untested. Each installed demonstration costs schedule and carries the risk of a real trip, but each buys a tested restoration sequence and a characterized transient response that the IST in Chapter 13.6 can build on rather than re-discover.

For a first-of-its-kind low-inertia island feeding a novel AI load, let model uncertainty decide where to test: use staged test sources, injection/HIL and approved isolated demonstrations. An untrusted model is a reason to get better test data, not licence to improvise a live failure. The utility letting go, a turbine tripping off the bus and a cold black start are the events where a wrong assumption strands a gigawatt of capital. Witness them here, with a load bank standing in for the GPUs, and hand a stable, characterized bus to integrated testing.

A second witness appears on grid-parallel sites: the transmission owner (TO). NERC's 4 May 2026 Level 3 alert is not an enforceable standard, but its Essential Action 4 asks TOs to run a commissioning process for computational loads. The pre-energization checklist, where possible, includes functional tests of on-site generation running in parallel with the grid and of any remedial action scheme that stops behind-the-meter generation from exporting. The TO may accept an alternate to a test that is not feasible, so settle tests, witnesses and alternates when you write the Cx plan. The tests that need the computing equipment installed sit in Chapter 13.6; Chapter 4.10 covers the alert's status.

Separation trace. Lose 4.0 MW of import at t = 0: the BESS supplies 4.0 MW for 0.50 s, then declines at 1.0 MW/s as generation rises from 6.0 to 10.0 MW at t = 4.50 s. At every instant generator + BESS = 10.0 MW. Output energy = 4.0×0.50 + ½×4.0×4.0 = 10 MJ, under the 20 MJ reserve. Peak converter duty √(4.0²+1.0²) ≈ 4.1 MVA < 5.5 MVA, and real demand 4.0 MW < 5.0 MW. With uncertainty applied, the bus bounds are 0.95–1.04 pu and 59.4–60.5 Hz, inside the 0.90–1.10 pu and 59.0–61.0 Hz limits, with no trip or reference loss.

Recharge before reconnection. At t = 4.50–5.50 s, ramp generation 10→11 MW while charging rises 0→1 MW; generation minus charge stays 10 MW. Hold generation at 11 MW and charge at 1 MW for 11.50 s, then ramp both down together for 1.00 s to 10 MW generation and zero charge at t = 18.00 s. Charge input = ½×1×1 + 1×11.50 + ½×1×1 = 12.50 MJ; 0.80×12.50 = 10 MJ restores the spent reserve to 20 MJ. Charging with 1 Mvar needs about 1.4 MVA, below converter capacity. The assumed bus extrema cover this entire sequence, but energy balance alone does not prove stable control.

Keep reconnection inhibited until reserve is restored, the utility grants permission, and all synchronism and interlock checks pass. The assumed 0.02 pu/0.08 Hz/8° results fit the gates above. On reconnection, ramp generation back to 6 MW while import rises to 4 MW, keeping total supply at 10 MW. Planned zero-interchange separation, largest-generator loss and black start each get their own record, including auxiliary, fuel and cooling restoration. A failed reference, channel or permissive stops the sequence at its pre-approved isolated or source state.

Result and flip. The simulation passes, but it is only a candidate: the installed test is not released until the controls lead, protection engineer, CxA and operations sign off the source and power-quality, breaker, mode, dispatch, reserve and restoration records. Hold load at 10 MW for the flip: 5.0 MW import means 5.0 MW initial generation, 15 MJ bridge energy and the real-power ceiling reached. At 5.1 MW import, initial generation is 4.9 MW; the 5.1 s ramp ends at 10 MW after 5.6 s, energy = 5.1×0.50 + ½×5.1×5.1 = 15.555 MJ (about 16 MJ), converter duty about 5.2 MVA. Energy and MVA fit, but 5.1 MW exceeds the 5.0 MW real-power limit, so the case fails. Reduce the import or raise the BESS's real-power discharge headroom; more stored energy alone cannot clear it. IEEE 2030.8 supplies the controller-test method; integration design is in Chapter 4.8 and test coverage in Chapter 13.6.