6.3Facility management

However redundant a system is, it stops if power fails, air conditioning halts, or an earthquake topples the equipment. The facility is the physical foundation of service availability, and a service manager must judge how to choose the redundancy of power, cooling, seismic protection, and access control neither too much nor too little, trading off against cost, to meet the availability target implied by business impact. Making everything top-tier is safe but sends costs soaring—choosing a level that matches the target is the practice.

6.3.1Power: UPS, on-site generator, distribution

• UPS (uninterruptible power supply) supplies power from a built-in battery without interruption at the instant of an outage or a momentary voltage dip, keeping equipment running. But its battery runtime is short—minutes to a dozen or so minutes—and it alone cannot cover a long outage. The UPS's role is "to fill the momentary gap of an outage and bridge until the on-site generator starts, or until a safe shutdown completes."
• On-site generator generates power from fuel (such as diesel) and, during a long outage, takes over from the UPS to keep supplying the facility. It takes a dozen to several dozen seconds to start, and the UPS fills that gap. Combining a UPS and a generator with a division of roles (UPS for the momentary gap, generator for the long haul) is the standard practice; either alone is insufficient as outage protection. Fuel stock determines the continuous run time.
• Power distribution (distribution board / power feeds) distributes received power to racks and equipment. Dual feeds (A-side / B-side) supplying each device via separate paths keep operation going even if one feed or breaker fails. With a single feed, the distribution board or breaker becomes a single point of failure, and no matter how redundant the servers are, they all go down together.

6.3.2Air conditioning, seismic/isolation, access control

• Air conditioning exhausts the heat equipment generates and keeps room temperature and humidity within the equipment's tolerances. If cooling stops, equipment overheats within minutes to tens of minutes and reaches thermal runaway or failure, so cooling too needs redundancy. Since cooling depends on power, whether the UPS/generator can also feed the air conditioning during an outage (a power design that includes cooling) affects availability.
• Seismic reinforcement / base isolation protects equipment from earthquakes. Seismic reinforcement strengthens the building/rack structure to withstand shaking (equipment still shakes to some degree). Base isolation inserts isolators (such as laminated rubber) between building and ground to keep the shaking itself from reaching the equipment—a more advanced, higher-cost approach. The higher the seismic risk and the stricter the continuity requirement of a site, the more base isolation is considered.
• Access control prevents physical intrusion and insider wrongdoing at the data center. It comprises authentication by IC card and biometrics, anti-passback and mantraps (double doors) that prevent tailgating, recording and monitoring of entry/exit logs, and privilege separation by zone. Physical security, like logical access management, underpins availability and confidentiality.

6.3.3Data-center Tier and choosing the degree of redundancy

Suppose a service manager, placing a 24/7/365 online service in a newly built data-center site, must choose the redundancy of facilities to match business impact, trading off against cost. First, power. A proposal to place only a UPS for outage protection arises, but the UPS battery lasts only minutes to a dozen or so and cannot cover a long outage, so a UPS alone is insufficient; the manager chooses a configuration where the UPS fills the momentary gap and an on-site generator that starts in the meantime takes over for the long haul. In addition, no matter how redundant the servers are, if the distribution board or breaker is a single feed it becomes a single point of failure, so the power feeds are doubled into A-side / B-side, supplying each device via separate paths. Cooling likewise, since it overheats equipment within tens of minutes if it stops, is made redundant, and the power design lets the UPS/generator feed the air conditioning during an outage too (because if only the servers live but cooling stops, everything halts anyway). Next, seismic protection. This site has high earthquake risk and a strict continuity requirement, so rather than seismic reinforcement that "withstands" shaking, the manager adopts base isolation that keeps the shaking itself from reaching the equipment—the cost rises, but it is a reasonable investment where business impact is high and continuity is paramount. As physical security, access control (biometrics, anti-tailgating, entry-log monitoring) is applied to guard against insider wrongdoing and physical intrusion. Building up the facility level this way, the site reaches an availability level equivalent to an upper data-center Tier, with redundant power, cooling, and paths, operable without downtime even during maintenance. Conversely, for an internal verification site with lax availability requirements, base isolation and full duplication would be over-spending, and a lower-Tier-equivalent level of UPS plus seismic reinforcement suffices—choosing redundancy neither too much nor too little by trading off the availability target against cost is the judgment of facility management.

6.3.4Section summary

• A UPS is a short bridge (minutes to a dozen or so) filling the momentary gap; an on-site generator takes over for a long outage—combine the two by division of roles
• A single power/cooling feed is a single point of failure, so duplicate it; choose seismic reinforcement (withstand) vs. base isolation (do not transmit shaking, higher cost) by seismic risk
• Data-center Tier stages the availability level—choose redundancy to match business impact, trading off against cost, neither too much nor too little (and prevent physical intrusion with access control)