The correct answer, of course, is a transfer switch that physically decouples the backup power and the grid power from the building, and does not allow them to be connected at the same time -- no matter how the operator might manage to fuck it up.