Tier III Certification Bid on a Hall With Shared Single Points
A colocation provider has completed a 1.2 MW white-space hall and is assembling the documentation package for a Tier III Certification of Design Documents. The sales brief already describes the facility as 'Tier III ready'. The design shows a single 11 kV utility service; two 1,250 kVA diesel generators operating in parallel on a common paralleling bus with one shared output breaker feeding the main LV switchboard; two 500 kW UPS modules arranged 2N with dual-corded IT loads; a chilled water plant with two 600 kW chillers in N+1 but a single duty/standby chilled water pump set with no isolation valves; and one fuel line from the bulk tank to a common day tank. The mechanical room has space for an additional pump set. In a design review the client asks whether the hall as drawn can be certified, and if not, which items must change before submission. Capital budget currently covers changes to two systems only.
1. State whether the hall as designed can achieve Tier III, and identify every element in the setup that conflicts with the tier objective, explaining the test you are applying.
Read the worked answer
The controlling definition is concurrent maintainability: every component and every distribution path supporting the IT load must be capable of planned maintenance without taking the IT load down. Tier III is explicitly not fault tolerance (that is Tier IV), so a single utility service is not automatically disqualifying - the question is whether the electrical path can be maintained while the load runs.
Apply that test item by item:
- UPS modules in 2N: acceptable in principle. But both are fed from a single main LV switchboard with one incoming breaker. Switchgear maintenance therefore means either UPS A or UPS B loses input - a single point of failure for a maintenance activity. Breach.
- Generators on a common paralleling bus with a shared output breaker: the bus and the breaker cannot be maintained while the site is on generator, and there is no way to remove one set from the bus while the other carries load. Breach unless the bus is sectionalised and each set has its own output breaker.
- Chillers N+1 but a single pump set with no isolation valves: pump or chiller maintenance requires a plant shutdown, which removes all cooling. Breach.
- Single fuel line to a common day tank: fuel-system maintenance removes fuel from both generators. Breach.
So the answer is no, not as drawn. The deliverable is a defect list written against the concurrent-maintainability test, plus the SOPs, MOPs and EOPs that the certification also requires - design documents alone do not demonstrate maintainability.
2. Only two systems can be funded now. Which two should be fixed first, and what compensating controls would you document for the rest?
Read the worked answer
Rank by consequence multiplied by the likelihood that the maintenance activity will actually be performed, not by cost alone.
First: split the UPS input path. Sectionalise the LV switchboard or provide independent feeds from the generator bus to UPS A and UPS B. This is the largest single exposure in the design - it is the only defect that puts the whole IT load at risk from routine switchgear work, and switchgear maintenance is frequent and long. Nothing else on the list has the same combination of total consequence and routine trigger.
Second: provide pump redundancy with isolation valves. At modern densities a total loss of chilled water raises rack inlets to shutdown levels in minutes, well before any generator or fuel issue would bite. The room already has space for the pump set, so this is a contained fix.
Compensating controls for the remaining items, to be written as MOPs and accepted as temporary:
- Generators / paralleling bus: restrict work on the shared bus to periods when the site is on utility and the utility risk is assessed; obtain a written risk acceptance; consider a temporary mobile generator connection point as an interim measure.
- Fuel line: a documented temporary hose or portable day tank procedure with a second person verifying, plus fuel-level monitoring during the work.
Document all of this as time-bound deviations with an expiry date. A certification body will not accept 'the operator is careful' as a control.
3. How would your assessment change if the client were targeting Tier IV instead of Tier III?
Read the worked answer
Tier IV changes the question from 'can I maintain it' to 'will it survive any single failure without human intervention and without losing the IT load'. Several items that are merely defects under Tier III become fundamental design failures under Tier IV:
- The single 11 kV utility service becomes disqualifying. Fault tolerance requires two independent, diversely routed utility supplies (or an equivalent arrangement), because a utility failure is itself a single fault. Under Tier III it only had to be maintainable.
- Compartmentalisation becomes mandatory. Tier IV requires that a fire or flood in one area cannot take out both paths. The shared paralleling bus and the single LV switchboard fail this even if sectionalised, unless they sit in separated compartments.
- Cooling must be continuously available with no shutdown of any part of the path. Chillers and pumps would need to be fully 2N on separate power sources with automatic response, not N+1 on a common loop.
- The certification path changes. Tier IV requires both a design document review and a constructed-facility witness, and the failure-mode-and-effect analysis becomes far more demanding.
The practical guidance to the client is that most enterprise halls do not need Tier IV and the cost step is large; if Tier III is what they actually need, the honest answer is to fix the two single points and correct the sales language rather than chase a tier the business case does not support.