**Data Center Over-Temperature Shutdown System Project Requirements**

17 November 2008

Richard Kwarciany

Document ID: **CD-doc- 3018**

*Draft Document*

Introduction
============

This document describes the functional requirements for the Fermilab
Data Center Over-Temperature Shutdown System (OTSS). This system
provides a safety net to protect equipment in the data centers from a
premature activation of fire sprinklers due to high temperature caused
by insufficient cooling conditions. When triggered by such conditions,
the Over-Temperature Shutdown System will cause a main power disconnect
for all non-safety related systems in the data centers. Emergency
lighting, fire, and security systems are not connected to the
Over-Temperature Shutdown System.

Requirements 
============

This section describes OTSS requirements necessary to achieve the goal
of protecting equipment in the data centers from water damage in the
event of an insufficient cooling condition.

Function
--------

The OTSS must turn off all major power consumers in the data center when
the temperature in the room reaches a preset limit. This limit is to be
adjustable within the range of 30°C and 70°C. The OTSS must generate a
power off trip within 15 seconds of the measured room temperature
exceeding the trip set point. The system must be designed to minimize
nuisance trips to every extent possible.

Reliability
-----------

### Redundancy

Due to the critical nature of the system, the OTSS will consist of three
independent sub-systems, consisting of a primary system and two backup
systems. Each system is capable of providing the same over-temperature
shutdown functionality, but will be set to trip at progressively higher
temperatures. Each of the three systems will be designed and implemented
such that they share as few components and design elements as possible
to minimize the chance of a design flaw or a component failure causing a
catastrophic over-temperature failure. Each of the three sub-systems
will be powered by a dedicated independent electrical circuit. These
circuits will power no other devices, and will be fed by an
Uninterruptable Power Supply (UPS).

The primary OTSS sub-system will be set to trip at the lowest
temperature of the three sub-systems. It will use an array of
temperature sensors placed on a grid with a grid spacing of no more than
10 feet in distance. Additional sensors may be used to monitor
additional areas as deemed necessary. An over-temperature trip condition
may only be generated if two or more sensors exceed the trip set point.

The secondary and tertiary sub-systems will be set to sequentially
higher trip temperatures, with the secondary sub-system set to a lower
temperature than the tertiary, and a higher temperature than the
primary. Both secondary and tertiary sub-systems must use at least three
temperature sensors spaced widely, and near high heat areas in the
computer room. An over-temperature trip condition may only be generated
if two or more sensors exceed the trip set point.

### Low-Stress Design

System design and implementation practices must be employed to minimize
component stress that would adversely affect reliability.

### High Reliability Components

High Reliability components will be used for all components considered
critical to the reliable operation of the shutdown system.

### System Simplicity

Excess complication in the critical areas of the design will be avoided
wherever possible.

Fail-Safe Design
----------------

Each of the three OTSS sub-systems will be designed to fail in the power
on mode to minimize data center down time. This failure mode can be
tolerated in this case due to the two backup systems in place. Regular
system testing will reveal system failures that require repair.

Testability
-----------

Each of the three independent OTSS sub-systems must be testable without
actually disconnecting power from the data center. A system test
procedure will be developed and documented. The system design and test
procedure will stress avoidance of accidental data center shutdown
during system testing.

Monitoring
----------

Measured temperatures and other system status information generated by
the OTSS system must be monitorable remotely through Sitescan, and
locally through a display in each data center room. OTSS will flag
errors if sensors report a temperature below 10°C. Sitescan will be
programmed to set an overtemp alarm if any OTSS sensor reports an
overtemp condition.

Power Requirements
------------------

Each sub-system of the OTSS will be powered by a dedicated 110VAC 60Hz
circuit that is supplied by a UPS. No other loads will be allowed on
these circuits.

Connectivity Requirements
-------------------------

### Emergency Power Off System

Each OTSS sub-system must independently interface with the Emergency
Power Off system in each computer room in order to disable computer room
power when an over-temperature condition exists. These connections and
the OTSS must not interfere with the normal operation of the Emergency
Power Off system.

### Remote Monitoring System

Each OTSS sub-system must interface with the SiteScan monitoring system.
The OTSS will provide temperature readings and other status information
to SiteScan.

Displays
--------

The OTSS will provide a system display panel in each computer room.
Sensor temperatures and related status information will be clearly
displayed.

Maintainability
---------------

The OTSS will be designed with a minimum design life of 10 years.
Commercially available components will be used wherever possible, and
sufficient spare parts will be procured at installation time. System
components will each be analyzed for criticality to the functioning of
the system, and high reliability components will be used where needed.

A system testing procedure will be developed by the system designers and
executed on a regular schedule by data center operations personnel.

 Safety
------

For 110 VAC (and higher) circuits, the safety requirements for high
voltage power distribution systems must be followed. These are detailed
in the Fermilab ES&H Manual, Occupational Safety And Health section on
Electrical Safety which can be accessed at:

www-esh.fnal.gov/FESHM/5000/5046.html

A hazard analysis sheet must be completed and signed by any person who
will be working with any high-voltage system, circuit board, or other
electronic device. The internal wiring of a commercially manufactured
piece of equipment is exempt as detailed in the FESHM section reference
above. The reference provides guidance on load connections, ribbon
cables, multiple conductors and mechanical components.

Dependence
----------

The purpose of the OTSS is limited to the prevention of material and
financial losses due to temperature related property damage. The safety
of personnel cannot rely on the OTSS. Fire detection/protection,
emergency lighting, security systems, and all other personal safety
systems are not controlled by or connected to the OTSS.