Architecture · Data centre
Data centre tiers & fault tolerance
How a data centre keeps power and cooling flowing through maintenance and failures, and what happens to the GPU racks when it cannot. A training job across thousands of GPUs stops when one rack loses power, so this decides how often work is lost, not only how often the building is dark.
Part 1 · Tier classifications
Four tiers, four design principles
The Uptime Institute’s Tier Classification describes how a facility’s power and cooling behave when something is maintained or fails. Each tier builds on the one before.
| Tier III · Concurrently maintainable | Tier IV · Fault tolerant | |
|---|---|---|
| Second path | Alternate: there for maintenance | Active: carrying load all the time |
| Planned maintenance | No interruption: load moved first | No interruption |
| Unplanned single fault | Can interrupt the IT load | Designed not to interrupt it |
| Separation | Paths can share rooms and routes | Systems physically isolated (compartmentalised) |
| Cost and complexity | Lower | Higher: two full systems, built, run and tested |
A tier describes the facility’s infrastructure, not the application. It is not a guaranteed availability percentage, and a Tier IV building does not make the software, the network or the training job on top of it resilient. Principles from Uptime Institute, Tier Classification System (read 2026-11-02). Its certification is a private scheme; other frameworks, such as TIA-942’s rated levels, define their own.
Part 2 · Redundancy
N, N+1, 2N and 2N+1
N is the capacity the load needs. Redundancy is what is installed on top of it, and it is counted separately for power, cooling and the distribution paths.
N+1
The capacity needed, plus one more unit of the same size.
Here the load needs two units (N = 2). Solid: needed. Dashed: redundant.
- Power
- One spare UPS module or generator: any one can fail or be serviced and the rest carry the load.
- Cooling
- One spare cooling unit, the most common way to protect cooling.
- Distribution paths
- Says nothing about paths: N+1 units can still sit on a single path.
Redundancy is not a tier. A redundancy configuration does not decide a tier. N+1 units on one path is still a single path; 2N units that meet on one switchboard still have a single point of failure. A tier is about how the whole system behaves under maintenance and faults, and Uptime Institute sets criteria, not a required N+1 or 2N.
Part 3 · Simulation
Fault tolerance simulator
Choose a tier and a redundancy configuration, then fail something. Power flows left to right, from the utility to eight GPU racks; cooling units sit under the hall.
1. Tier
2. Redundancy
3. Introduce a failure or event
Picking a tier sets the redundancy it is usually built with; change the redundancy to see a mismatch. Failures strike equipment still in service, path A before path B; a second failure of the same kind strikes the other side.
- Power flowing
- Standby or cooling
- No power
- Failed
- Unit available
- Rack running
- Throttled
Service continuity maintained8 of 8 GPU racks running
Power capacity
100%
of the IT load
Cooling capacity
150%
of the heat load
Racks running
8/8
Racks affected
0
What happened
- Everything is running normally. Introduce a failure to see how this design responds.
Remaining redundancy
| Equipment | Available | Needed | Spare |
|---|---|---|---|
| UPS modules | 3 of 3 | 2 | +1 |
| Generators | 3 of 3 | 2 | +1 |
| Cooling units | 3 of 3 | 2 | +1 |
| Distribution paths | 2 of 2 | 1 | +1 |
Only equipment that can still reach the racks is counted: a UPS on a lost path does not help. Where equipment sits matters as much as how much there is, so the check below runs the model again.
Would it survive one more failure?
- A transformer failure: service continues
- A UPS module failure: service continues
- A generator failure: service continues
- A cooling unit failure: service continues
- A power distribution path failure: service is interrupted
Single points of failure in this designSingle point of failure: A component or dependency whose failure can interrupt the service because no effective alternative path or capacity exists.
power distribution path
How the simulator decides: the model and its assumptions
- The IT load needs two units of each kind (N = 2): UPS modules, generators and cooling units. Each unit covers half the load.
- Each distribution path (transformer, switchgear, UPS output, power distribution units) is rated for the whole load.
- Tier I and II have one path. Tier III has an alternate path that carries no load until the load is moved to it. Tier IV has two active paths and dual-corded racks.
- A UPS set that cannot carry its load trips its path. Many real UPS systems transfer to bypass instead, putting the load on unprotected power; the simulator counts it as an interruption.
- UPS batteries carry the load while generators start; generators are sized for the IT load and the cooling plant together.
- Cooling units are powered from the path carrying the load (alternating between the two sides in Tier IV); a cooling shortfall means racks must be throttled or shut down in proportion.
- A simplified teaching model, not Uptime Institute’s assessment method.
Part 4 · Three terms
The words that decide a design review
- Concurrent maintainability
- A component can be taken out of service for planned maintenance without interrupting IT operations.
- Fault tolerance
- A properly designed infrastructure can sustain a defined single equipment failure or distribution-path event without interrupting IT operations.
- Single point of failure
- A component or dependency whose failure can interrupt the service because no effective alternative path or capacity exists.