A Tier III claim undermined by single points of failure

Classification: Class 1–2, not Class 3. EN 50600-2-2 classes are cumulative - the weakest subsystem sets the overall class. Concurrent maintainability (Class 3) requires that every component serving the IT load can be removed from service for maintenance without interrupting the load. That test fails in more than one place here.

Single points of failure that break the claim

1. Cooling plant is N, not N+1 in capacity or in path. Two 400 kW chillers against a 640 kW load means both must run; loss or planned shutdown of either leaves a 240 kW deficit. Pumps, towers and manual changeover valves add further path-level single points: isolating a pump requires a manual valve operation during which the plant is not available. The 29 °C incident is the empirical proof.
2. Single generator and single ATS. The generator cannot be serviced, load-tested at full load, or repaired while the site is protected. The two start failures show this is a live probability, not a theoretical one. A single ATS is a single transfer path for the whole facility.
3. Single transformer and single utility feed. Depending on the edition of the reference standard used, a single utility entrance may be tolerated with a documented risk assessment, but a single transformer with no isolation and no second path is not concurrently maintainable.
4. Fuel supply. Eight hours of on-site fuel with a single transfer and polishing arrangement limits ride-through and cannot be maintained under load.

What does pass. The UPS architecture: 330 kW on a 600 kW frame built from 200 kW modules needs two modules, leaving one redundant, so module-level maintenance is possible - provided the UPS maintenance bypass is genuinely make-before-break and has been tested. That single subsystem does not rescue the overall rating.

Sequence by cost-effectiveness - probability first, then redundancy.

1. Generator reliability (weeks, low cost). Replace the failed battery chargers, add a second charger, institute weekly no-load and monthly load-bank tests with logged results, and add remote annunciation of generator ready/fail status to the NOC. This does not add redundancy but attacks a demonstrated failure mode with a two-in-twelve-month history.
2. Fuel resilience (weeks, low cost). Fuel polishing contract, tank level telemetry, and a supplier priority agreement with a documented refuelling time.
3. Cooling isolation and redundancy (1–2 quarters, medium cost). Install isolation valves and dual headers so each chiller, pump and tower can be maintained independently, then add a third chiller or uprate so that N+1 capacity is available against the 640 kW load. This is the single change that converts the most serious operational exposure into a maintainable design.
4. Second generator and ATS, or a second independent transfer path (2–3 quarters, high cost). Required for a genuine Class 3 power path.
5. Second transformer and utility entrance (long lead, highest cost). Often the last item, and the one for which a documented risk assessment is the accepted interim answer.

What can be sold today. Not 99.982% with concurrent maintainability. That figure allows roughly 1.6 hours of unplanned downtime a year; the facility has already had a cooling excursion of that order and two generator start failures. The honest position is to sell the current capacity against a documented availability figure derived from actual incident history, with a contractual improvement roadmap and service credits, and to sign the new tenant only after items 1–3 are complete and witnessed. Selling the Tier III claim as-is creates a contractual liability larger than the revenue.

Yes, mostly - within the existing shell, with two caveats.

Feasible inside the building

• Cooling: add a third chiller and duplicate pumps/towers within the existing plant room if floor space and structural loading allow, and convert the headers to a ring main with isolation valves so any single unit can be valved out under load. Check the electrical capacity of the plant distribution and the condenser water routing before committing.
• Power: add a second generator and a second ATS outside the building on a new pad with its own fuel connection; route the second path through a different fire compartment and, ideally, a different cable route to avoid a shared physical hazard. Review the existing busway and cable routes - a second path that runs in the same trench or the same riser as the first is redundant on paper only.
• UPS: already module-redundant; verify that maintenance bypass is truly make-before-break and test it during the next window. Add a spare module on site.
• Fuel: add a second tank or a guaranteed refuelling SLA if space does not permit a second tank.

Constraints that may not be solvable in the existing building

• A second utility entrance with a physically diverse route. If the local distribution network operator cannot provide diversity, the site cannot honestly claim fault tolerance against a utility-side event, only against internal failures.
• Physical space for a third chiller and second generator; roof loading for additional cooling towers.

Residual risks to document. Utility diversity, fuel logistics in a regional event, and common-mode failures such as a single fire suppression system, a single security entrance, or a single network entry room. A Class 3 claim should be accompanied by a documented list of accepted common-mode risks and the mitigation for each, not by a marketing statement.