D1.2 · How power and cooling preserve the computing service
Having learned what the computing service needs, we now examine how a facility keeps it operating when supply changes or equipment is maintained. The important question is not how many backup devices exist, but whether each essential dependency has a complete, usable path through every relevant operating state. We will follow normal supply, a grid outage, extended backup operation and restoration before evaluating a worked case.
Read the concepts and system relationships in sequence before attempting the workshop. Key terms are explained in the context of their function. If a task is unclear, return to its section and explain the reasoning before calculating.
What should you be able to judge after this lesson?
- Explain the different duties of utility supply, switchgear, UPS, batteries, generators and cooling.
- Trace normal, outage, maintenance and restoration states from the load back to its sources.
- Distinguish redundant equipment from an independent and testable service path.
- Check converter power, usable energy and interruption time without confusing one for another.
1. Read the single-line from the load back to its sources
A single-line diagram is a simplified representation of electrical connections, not a floor plan. Buses collect or distribute power; breakers and switches establish or interrupt paths; transformers change voltage; protection detects specified abnormal conditions and isolates equipment. The drawing is useful only when it shows which devices are normally open or closed and what changes during a transfer.
Begin at a service such as an IT distribution board and move upstream. Identify the server power supplies, rack distribution, UPS output, essential bus and normal and standby sources. Then repeat for the network switches, storage and cooling supporting that service. A shared upstream bus, control supply or pump can defeat apparent downstream duplication.
The figure below deliberately shows an IT branch protected by UPS and a cooling branch connected directly to the essential bus. This is not a recommended final design. It creates a visible question: when the bus is dead during generator start, which part of the service remains supported and which does not?
2. Understand what a UPS does and what its battery does
UPS means Uninterruptible Power Supply. In a typical online double-conversion arrangement, incoming AC is converted to a DC link and then back to controlled AC for the load. A connected energy store can sustain that link when the normal input is unavailable. Other UPS topologies and operating modes exist, so the actual topology, settings and load performance must be confirmed rather than inferred from the name.
The converter establishes the supported output duty; the battery establishes how long stored energy can support that duty. Their ratings answer different questions. Output active power in kW or MW is not the same as apparent power in kVA or MVA; the accepted load power factor and reactive duty can matter. A sufficient MWh figure does not prove that a converter can accept the connected load or a recovery surge.
A UPS may also have bypass arrangements that let power reach the load around the conversion path. Bypass can support maintenance or particular fault handling, but may change the power conditioning and battery support available in that state. Ask which maintenance operations preserve the required service, and what happens if a utility disturbance occurs while bypass is in use.
3. A generator provides sustained energy only after a successful sequence
Following loss of utility supply, a standby sequence may detect the loss, isolate the unsuitable source, start the engine, confirm acceptable voltage and frequency, close the appropriate path and accept load. Those are distinct events. Some can overlap; others must wait for interlocks or stability checks. An engine start time alone is not the interruption at the customer’s load.
Continuous MW rating also does not settle step-load acceptance, motor starting or performance under the intended ambient conditions. The generator needs available fuel, starting energy, ventilation, controls and an operable connection path. Its cooling and fuel auxiliaries can themselves depend on electricity. An extended-outage plan must account for those dependencies and realistic refuelling.
Not every grid-connected generator can energise a dead system without external support. Black start means starting and building the required electrical system from a de-energised condition under a defined sequence. Island operation also requires a suitable voltage/frequency reference, protection and load balance. These capabilities need a designed and tested arrangement, not a marketing statement that generation is on site.
4. Cooling continuity must match electrical continuity
IT power becomes a heat-removal obligation. Servers may remain energised on UPS while pumps, fans, control valves or heat-rejection equipment stop. Thermal inertia can provide some tolerance, but its amount depends on the actual system, initial conditions and permitted temperatures. Do not assign a universal number of cooling-free minutes to all AI facilities.
In liquid-cooled arrangements, trace both the facility-side heat rejection and the equipment-side circulation. A coolant distribution unit, or CDU, transfers heat between appropriate loops and may include pumps and controls. A spare chiller does not preserve service if a shared circulation component loses power or if controls cannot restore flow. The exact arrangement must come from the mechanical design.
Define the interruption tolerance at the service being protected, including temperature rise, throttling, trip and recovery behaviour. Then identify which cooling and control loads need ride-through and which can wait for generator restoration. DOE’s 2024 guide treats IT environmental conditions, air management, cooling and electrical systems together, reinforcing the need for a coordinated design. [1]
In direct-to-chip liquid cooling, cold plates remove part of the chip heat into an equipment coolant loop. A CDU can exchange that heat with a facility loop while maintaining the required separation and conditions. Facility pumps and heat-rejection equipment then transfer the heat outward. Air-cooled components and residual room heat still need a complete air path; “liquid cooled” does not mean every watt is captured by liquid.
For a transparent water-only teaching estimate, heat transfer is Q̇ = ṁ c_p ΔT. At 1 MW of liquid heat, water c_p = 4.18 kJ/(kg·K) and a 10 K rise, mass flow is 1,000/(4.18×10) ≈ 23.92 kg/s. Assuming density 1,000 kg/m³, this is about 86.12 m³/h. Glycol mixtures and actual operating temperatures change the fluid properties; manufacturer flow, pressure and water-quality limits still govern.
Pump electrical power is approximately Δp×volumetric flow divided by the combined pump/motor efficiency. With only a hypothetical 50 kPa differential, 0.02392 m³/s flow and 70% combined efficiency, it is about 1.71 kW. This is the selected pump duty alone, not total cooling power: chillers, other pumps, fans, controls and redundancy are outside that calculation.
Design the hydraulic and thermal path as well as its power supply. Check pressure drop, minimum flow, coolant chemistry, leak detection, condensation conditions, isolation and the consequence of a failed pump or CDU. A low annual PUE cannot establish that these local conditions remain acceptable during a grid transfer or a rapid IT load change.
A liquid and residual-air heat path
How to read this figure: The CDU is not the final heat sink. Facility heat rejection and the remaining air path must also operate; their power and controls are separate dependencies.
5. Redundancy is a capacity arrangement, not proof of independence
If three modules are required to carry a stated duty, N is three for that duty. N+1 adds one spare module under the defined assumptions. A 2N arrangement describes two full sets of required capacity. These labels do not specify all switching paths, controls or maintenance states; changing the protected duty can also change what N means.
A dual-cord server can draw from two supply paths only if the server, rack distribution and upstream arrangements actually support the intended failure. If both paths share a switchboard, room hazard, control supply or cooling dependency, a common event may still remove both. Spare capacity addresses a failed module; independence addresses common causes and paths.
To assess resilience, choose explicit events: one UPS module fails, a bus is isolated for maintenance, a generator does not start, or a cooling loop becomes unavailable. Follow the surviving path for each event and measure the effect on the service. A numerical redundancy label alone cannot establish an availability promise, design certification or fault tolerance.
6. Describe four operating states, including recovery
In normal operation, record the energised sources, open/closed paths, battery SOC policy and spare capacity. In outage operation, record which loads ride through, which interrupt, which are shed and how a stable supported system is established. A diagram for normal conditions is not enough to describe the outage sequence.
In maintenance operation, identify which equipment is deliberately unavailable and whether the specified service still has a complete path. Maintenance can remove the very spare equipment assumed in a failure study. The relevant combination is the agreed operating condition plus the credible event, not an unlimited promise to survive every imaginable simultaneous failure.
Recovery deserves its own plan. Restoring utility input can coincide with battery recharge, cooling restart and IT job recovery. Their combined demand may exceed the original operating demand. Define transfer/synchronisation permissions, staged restoration, recharge priority and criteria for returning backup reserve to normal. “Grid returned” is not the same as “site fully ready for the next event”.
7. Separate power, energy, time and quality checks
The power check asks whether the surviving equipment can carry the actual duty, including relevant reactive demand, starting and recovery. The energy check asks how long the available stored energy or fuel can maintain that duty. The time check compares the load’s interruption tolerance with the full sequence at its measurement point. Failure of any one can defeat the service even when the others pass.
A battery estimate should distinguish beginning-of-life DC nameplate energy from AC energy available above a protected SOC floor at the chosen life condition. For a simplified constant load, duration equals usable AC energy divided by AC load. Temperature, discharge rate, battery controls and manufacturer limits can change actual performance, so the estimate requires an equipment-specific review.
Power quality and dynamic behaviour form another set of questions: voltage/frequency excursions, harmonics, converter interactions and response to rapid changes. A constant-power energy calculation does not answer them. Assign the study method and acceptance criteria to appropriate specialists, and avoid presenting a runtime result as proof that the electrical service will remain acceptable.
8. Turn a design claim into a testable event
A meaningful acceptance case states initial conditions, an event, expected actions, measurements and a pass/fail criterion. For example: at the agreed IT and cooling duty and initial SOC, lose normal supply, record interruption at each critical load and verify the backup sequence. The criterion must come from the approved service requirement, not from whichever result the test happens to produce.
Integrated testing should check the dependencies across electrical, mechanical and IT operations, under an authorised and safely planned procedure. Include unsuccessful starts, relevant unavailable equipment and restoration where they fall within the agreed scope. A factory test of one UPS cannot prove the behaviour of the installed cooling and generator chain.
The final output is a defensible explanation of which service survives which event, for how long and under what conditions. Keep unresolved conditions visible, assign an owner and set a closure requirement. This is more useful than a page that lists equipment without demonstrating how it works together.
Workshop: form a decision from the given inputs
Attempt these tasks before opening the reference answers.
- Explain why UPS, generation and cooling duties cannot be substituted for one another in this case.
- Identify the UPS-protected boundary and the load that loses supply during transfer.
- Calculate IT ride-through and compare the cooling interruption with its limit.
- Assess the proposal to move cooling onto the existing UPS and identify the next design actions.
- Does the figure establish N+1 redundancy, independent A/B paths or fault tolerance? State what evidence is still required.
Concept answer · Protect the service, not only the server supply
UPS supports the IT branch through the bus interruption; it does not energise the separately connected cooling branch. The generator restores sustained bus supply only after its starting and transfer sequence. Cooling must continue or recover within its own approved tolerance so that electrically powered IT remains usable. None of these facts establishes the others.
A suitable remedy starts by tracing the cooling pumps, controls and heat rejection. It might require a revised supported-load arrangement or a validated thermal strategy, but the exercise does not provide enough design evidence to select that remedy. Merely increasing the existing IT battery MWh leaves the cooling interruption path unchanged.
The output from this step should be: An electrical/thermal dependency map for the protected service.
Answer 1 · The protected boundary is downstream of the UPS
The UPS protects the stated 1.2 MW IT branch. It does not protect the 0.3 MW cooling branch because that branch is connected directly to the essential bus. On grid loss, the bus and cooling lose supply until the generator transfer is complete, while the UPS battery can continue serving IT if its equipment and controls remain available.
Mark the switching and isolation devices on the actual single-line before claiming an island boundary. The teaching diagram does not establish neutral-earthing arrangements, fault current or a permitted parallel transition.
The output from this step should be: Submit an annotated single-line showing normal supply, battery support, generator supply and each load's interruption limit.
Answer 2 · IT energy is sufficient for this timing screen, but cooling fails
Delivered EOL energy is 0.6 × 0.80 × (0.90−0.20) × 0.95 = 0.3192 MWh. At 1.2 MW, ideal energy-limited endurance is 0.266 hours, or 15.96 minutes. The stated IT load is below the 1.3 MW continuous active-power limit. These arithmetic checks do not prove a successful transfer or account for unmodelled faults.
The cooling branch experiences 12 + 3 = 15 seconds of interruption under the stated sequential timing. That exceeds its 5-second limit by 10 seconds. Having nearly 16 minutes of IT battery endurance does not correct the missing cooling supply path.
The output from this step should be: Submit separate power, energy and load-point timing checks, with the cooling gap clearly recorded as unresolved.
Answer 3 · Moving cooling requires more than a cable change
Moving the entire 0.3 MW cooling load behind the UPS would raise supported continuous load to 1.5 MW, exceeding the existing 1.3 MW limit by 0.2 MW. The proposal therefore fails the stated power limit even though the same battery would have an ideal 0.3192/1.5 = 0.2128 hours, or 12.768 minutes, of energy. More battery MWh alone cannot close the converter power gap.
Possible next studies include increasing or redistributing UPS capability, adding a separately designed cooling bridge, reducing the supported cooling load where the process permits it, or shortening the validated transfer sequence. None is selected automatically. Confirm cooling restart current, its control supply, protection and the effect of a failed generator start before choosing equipment.
The output from this step should be: Issue a design-action register identifying the responsible designer, evidence needed and acceptance test for each proposed change.
Design answer · A functional drawing is not a redundancy assessment
The simplified figure does not define the number of required modules, a spare module, independent A/B chains or all switching/protection arrangements. It therefore establishes none of the named redundancy or fault-tolerance claims. Even adding a second UPS box would not by itself demonstrate independence from the shared bus, controls or cooling.
Request the installed single-line and mechanical diagrams, equipment ratings and dependencies, approved maintenance states and service interruption limits. For each agreed event, identify the surviving path and a test or study that verifies it. Do not assign a certification or availability class from this teaching drawing.
The output from this step should be: An event matrix covering normal, maintenance, failure and restoration conditions.
The key decision from this lesson
Read the single-line and timing sequence together. A continuity claim is credible only when the actual supply path, converter capability, stored energy and load interruption limit all agree.
Sources and scope
Reviewed 25 October 2026. Primary sources provide background; numbered references in the text identify the relevant documents below. Cases, calculations and action suggestions are original teaching derivations. They do not replace site specifications, network permissions or contract review.
[1] U.S. DOE FEMP · Best Practices Guide for Energy-Efficient Data Center Design · 2024 ↗
Further reading · DOE SEAB · Powering AI and Data Center Infrastructure · July 2024 ↗