The Tier III lease clause versus a plant with no standby pumps
An operator is building a 1.6 MW hall in Singapore for a customer that has written third-party Tier III certification into the lease. The design pack shows: a single 22 kV utility feeder from one substation; two 1,000 kW UPS modules configured 2N, each with its own battery string; one overhead busway per row with no A/B distribution to the racks; three 500 kW water-cooled chillers in N+1 on common headers; chilled-water pumps configured N with no installed standby; and the whole chilled-water plant fed from a single low-voltage switchboard. Cooling is air-cooled with adiabatic assist, sized for a 34 degrees C design ambient, predicted annualised PUE 1.38. The commissioning schedule allows four weeks for integrated systems testing. The customer's IT estate is dual-corded, and the lease states in plain language that the facility will have 'no single point of failure'. The customer's technical adviser has asked you, as the reviewing engineer, for a position before the design freeze.
1. Identify which elements of the described design breach concurrent maintainability, rank them by urgency, and state the test you apply to each.
Read the worked answer
Apply one test to every element: remove it, or fail it, and ask whether the IT load is unaffected.
1. Chilled-water pumps configured N. Losing the duty pump stops cooling immediately, with no automatic recovery. This is the clearest single point of failure and the most urgent fix; a standby pump with automatic changeover and proven controls logic is required.
2. Single low-voltage switchboard feeding the whole chilled-water plant. Even with N+1 chillers, one switchboard fault removes all cooling. This breaches both fault tolerance and concurrent maintainability, and it is easy to miss because the chillers look redundant on the schedule.
3. Single busway per row with no A/B. The IT load being dual-corded is irrelevant if both cords land on the same busway. The distribution itself is a single path and cannot be maintained without a rack outage.
4. The single 22 kV feeder is not automatically a breach. Tier III permits one active distribution path; what matters is that the path is concurrently maintainable and that the load is protected by the generator and transfer arrangement. Verify the 72-hour fuel and the switchgear maintenance method rather than rejecting the feeder out of hand. Four weeks of integrated systems testing is tight for a plant this interdependent; confirm the script covers every failure and maintenance scenario above.
2. The project director argues the single 22 kV feeder is fine because 'the generators cover it'. How do you reconcile that with the customer's plain-language 'no single point of failure' lease clause, which is stricter than the standard?
Read the worked answer
Separate three things that are being conflated: the certification standard, physical reality, and the contract.
Against the standard, a single utility feeder can be acceptable at Tier III, because the requirement is one active path that is concurrently maintainable, with the load protected during utility loss. Against physical reality, the feeder is a single point of failure in the ordinary sense: the load survives only if the generators start, transfer, and carry for the duration of the outage. Against the contract, the lease says 'no single point of failure' without qualification, so the literal wording is breached the moment the utility is lost and the generators have to work.
The practical resolution is not to argue that the director is wrong on engineering, but to fix the mismatch. Either amend the lease to reference the specific certification scheme and its defined terms, so the obligation is measurable, or accept the stricter obligation and fund a second feeder or a utility handover scheme. Leaving a plain-language clause in place while designing to a standard that permits the condition creates a guaranteed dispute at the first utility outage, regardless of who is technically correct.
3. The customer says 'our servers are dual-corded, so we are protected'. Give the response, covering power and cooling.
Read the worked answer
Dual cords only protect the load when the two cords follow independent paths all the way back to independent sources. Here they do not. Both cords land on the same row busway, fed from the same UPS output path. A busway fault, a busway maintenance task, or a single upstream breaker operation takes out both cords at once, so the redundancy the customer has paid for on the server side is not delivered by the facility.
Cooling has no equivalent of a dual cord at all. The IT equipment depends on a single airflow path and a single chilled-water distribution. With pumps configured N and one switchboard feeding the plant, a single failure produces a temperature rise in the hall within minutes. Dual-corded servers do not survive a hot hall any better than single-corded ones.
The correct answer to the customer is that cord redundancy is a necessary condition, not a sufficient one, and that the facility's topology has to be traced from the utility to the rack inlet before any claim of 'no single point of failure' is made. Show them the single-line diagram with the actual paths coloured in; the conversation changes immediately.