Availability Tiers and Redundancy

Two reasons for redundancy

Every piece of infrastructure in a data center (a UPS, a chiller, a transformer, a cable) will at some point be unavailable. There are two very different reasons:

• Planned maintenance: batteries are replaced, breakers are tested, firmware is updated, filters are changed. This happens on a schedule, every year, for every component.
• Unplanned failure: a component breaks, a breaker trips, someone makes a mistake.

A design can survive the first without surviving the second. If you can switch a UPS off for maintenance without the servers noticing, but a sudden fault in the one switchboard behind it still takes everything down, you are protected against planned work only. Both questions, "can we maintain it?" and "can we survive a failure?", appear in every classification on this page. The idea behind both is to remove each single point of failure.

N, N+1 and 2N

Redundancy is written relative to N: the number of units needed to carry the load. If the IT load needs 400 kW of UPS capacity and each UPS module delivers 200 kW, then N = 2.

• N: exactly the units needed, no spare. Any failure or maintenance reduces capacity below the load.
• N+1 redundancy: one unit more than needed, so any single unit can fail or be maintained. With N = 2, that is three modules of 200 kW for a 400 kW load. Larger systems sometimes use N+2.
• 2N redundancy: two complete, independent systems (usually called A and B), each able to carry the whole load alone. With N = 2, that is two systems of two modules each, on separate distribution paths. Losing a whole system, not just a unit, still leaves the load running.
• 2N+1: two complete systems, plus a spare unit, so one system can be in maintenance while the other can still lose a unit.

Redundancy in numbers

The example below calculates how often there is not enough capacity for three designs, if every UPS module is available 99.9% of the time and modules fail independently. It is component arithmetic, not a prediction for a real site.

# Probability that enough units are working, assuming every unit
# fails independently and is available a fraction `a` of the time.
from math import comb

HOURS_PER_YEAR = 8760


def k_of_n(k, n, a):
    """At least k of n identical units must be up."""
    return sum(comb(n, i) * a**i * (1 - a) ** (n - i) for i in range(k, n + 1))


a = 0.999  # one UPS module: down about 8.8 hours per year
need = 2   # the load needs two modules

designs = {
    "N   (2 modules)": k_of_n(need, need, a),
    "N+1 (3 modules)": k_of_n(need, need + 1, a),
    "2N  (2 x 2 modules)": 1 - (1 - k_of_n(need, need, a)) ** 2,
}
for name, avail in designs.items():
    down = (1 - avail) * HOURS_PER_YEAR
    print(f"{name:20} {avail:.6%}  {down:7.3f} h/yr not enough capacity")

N   (2 modules)      99.800100%   17.511 h/yr not enough capacity
N+1 (3 modules)      99.999700%    0.026 h/yr not enough capacity
2N  (2 x 2 modules)  99.999600%    0.035 h/yr not enough capacity

Two things stand out. With N, the system is short of capacity twice as often as one module is down, because either module failing is enough. And by this narrow arithmetic N+1 even looks slightly better than 2N. The difference is everything the formula leaves out: the N+1 modules share one output switchboard, one set of cables and one control system, any of which can stop all three at once. 2N splits those too. Real failures are also not independent: a heat wave, a bad firmware update or the same mistake made twice hits identical units together. That reasoning is the same as in components in series and in parallel.

Components and distribution paths

Data center standards separate two kinds of infrastructure. Capacity components produce or convert power and cooling: UPS modules, generators, chillers, pumps. Distribution paths carry it to the IT: switchgear, busbars, cables, panels and pipes. A design with N+1 components on a single path still has a single point of failure in that path, and the path itself cannot be maintained while the load runs on it. A second path is what makes "switch it off and work on it" possible, which is the next section.

The Uptime Institute Tiers

The best-known classification comes from the Uptime Institute. An Uptime Institute Tier is one of four levels in its Tier Standard: Topology, which rates the design of a data center's power and cooling infrastructure by what it can survive. The Tiers are written with Roman numerals.

The names are Uptime's; the "typical design" column is the common summary of what each Tier usually needs, not the standard's text. The standard describes required outcomes, so a design can reach a Tier in more than one way.

Tier III: concurrent maintainability

Concurrent maintainability means that every capacity component and every distribution path can be taken out of service for planned maintenance, one at a time, while the IT keeps running. That requires redundant components and a second path, so the load can be moved off whatever is being worked on. It is the level most commercial colocation facilities aim for. What it does not promise: while one path is in maintenance, the site runs without redundancy, and an unplanned failure or a mistake at that moment can still cause an outage.

The check below takes each item out in turn and tests whether the remaining capacity still covers a 400 kW load. A single path fails the test, however many spare modules it has.

# Concurrent maintainability check: take each item out in turn (one UPS
# module or a whole distribution path) and see if the rest still carries
# the load. A path delivers at most its own rating.
LOAD_KW = 400


def capacity(paths, removed):
    total = 0
    for path, (rating, modules) in paths.items():
        if path == removed:
            continue
        ups = sum(kw for name, kw in modules if name != removed)
        total += min(rating, ups)
    return total


designs = {
    "N+1, one path": {
        "path A": (600, [("UPS-1", 200), ("UPS-2", 200), ("UPS-3", 200)]),
    },
    "2N, two paths": {
        "path A": (400, [("UPS-A1", 200), ("UPS-A2", 200)]),
        "path B": (400, [("UPS-B1", 200), ("UPS-B2", 200)]),
    },
}
for name, paths in designs.items():
    items = [p for p in paths] + [m for _, mods in paths.values() for m, _ in mods]
    failures = [i for i in items if capacity(paths, i) < LOAD_KW]
    print(f"{name}: {len(items)} items, load {LOAD_KW} kW")
    for item in items:
        left = capacity(paths, item)
        status = "ok" if left >= LOAD_KW else "LOAD AT RISK"
        print(f"  without {item:7} {left:4} kW  {status}")
    verdict = "yes" if not failures else "no"
    print(f"  concurrently maintainable: {verdict}")

N+1, one path: 4 items, load 400 kW
  without path A     0 kW  LOAD AT RISK
  without UPS-1    400 kW  ok
  without UPS-2    400 kW  ok
  without UPS-3    400 kW  ok
  concurrently maintainable: no
2N, two paths: 6 items, load 400 kW
  without path A   400 kW  ok
  without path B   400 kW  ok
  without UPS-A1   600 kW  ok
  without UPS-A2   600 kW  ok
  without UPS-B1   600 kW  ok
  without UPS-B2   600 kW  ok
  concurrently maintainable: yes

The model is deliberately small. A real assessment walks through every breaker, valve, control system and fuel line, and the IT equipment must be able to use the second path: a server with one power cord gains nothing from a B feed, as the power page explains.

Tier IV: fault tolerance

Tier IV adds fault tolerance at facility level: any single failure of a component or path, at any moment, is absorbed automatically without affecting the IT. Two paths are active at the same time, so there is nothing to switch over manually. Tier IV also requires compartmentalization (the two systems are physically separated, so a fire or flood in one room cannot take out both) and continuous cooling (cooling keeps running through a power transfer, because dense equipment heats up within minutes). The price is roughly doubled infrastructure, much of it idle most of the time.

Design, construction and operation

Uptime awards Tier Certification to specific facilities in steps: of the design documents, of the constructed facility (a site visit with tests), and optionally of operational sustainability (how the site is staffed, maintained and run). "Designed to Tier III" in a brochure is a claim, not a certification. Ask which certificate a site holds and for which building.

Why Tiers come without percentages

Older material often pairs each Tier with an availability figure and a number of minutes of downtime per year. Uptime removed all such predictions from its Tier Standard in 2009; the current standard does not assign availability percentages to Tiers. The reason is in Uptime's own data: operations cause more than 70% of downtime. A Tier IV design run by a careless team can fail more often than a Tier II site run with discipline.

EN 50600 availability classes

EN 50600 is the European standard series for data center facilities and infrastructures. It covers the building, power, environmental control, cabling, security and energy efficiency, and is adopted internationally as ISO/IEC 22237. In European tenders and contracts it is the usual reference, and its classes can be audited by certification bodies.

For resilience, EN 50600 uses an availability class: one of four levels, Class 1 to Class 4, that state how much redundancy the power supply and environmental control must have.

The four classes resemble the four Tiers, but the criteria and the assessment are different. A site can be Class 3 without any Uptime certification, and the other way around.

TIA-942 Rated levels

ANSI/TIA-942 is the American telecommunications infrastructure standard for data centers, best known for its cabling topology and spaces (covered on the racks and cabling page). It also has four resilience levels. Since 2014 (a re-issue of TIA-942-A, agreed with Uptime) TIA calls them Rated-1 to Rated-4, to avoid confusion with Uptime's Tiers. The current edition, TIA-942-C, was published in May 2024; it adds edge data centers and requires distributor cabinets to be at least 800 mm wide.

Three schemes side by side

How much resilience is enough?

Each step up costs a lot more: more equipment, more space, more energy lost in idle units, and more complex operations. The right level follows from the business, not from prestige:

• What does an hour of outage cost, and what do customers and regulators require? A business impact analysis answers that.
• Is the application itself redundant? Running the same service actively in two sites, or across cloud availability zones, can make two Tier II-like sites more resilient than one Tier IV site, because it also survives a fire, a flood or a regional power failure. The disaster recovery and site resilience page covers that.
• Who operates it? The best design needs trained staff, written procedures and tested maintenance plans.

Kestrel Energy is a typical mix. Its small data center at head office has one UPS and two cooling units: N for power, N+1 for cooling, a single path, and planned work happens in a maintenance window: adequate for office systems and a DR site, not for production. Its billing platform runs in a colocation facility whose design holds a Tier III certificate, with dual-corded servers on A and B feeds; the customer portal runs at a public cloud provider. The billing database replicates between the two sites, so even a complete loss of one site is survivable.