Environmental controls: temperature, humidity and fire

Why this matters

Servers can be destroyed without anyone breaking in. Heat, moisture, fire, water and unstable power damage more equipment than intruders do, and they can take out every server in a room at once, including all the redundant ones. Redundant power supplies and RAID arrays do not help when the air conditioning fails on a hot afternoon or a pipe bursts above the rack.

This lesson covers the environmental conditions servers need, how cooling is made redundant, how server rooms fight fire without destroying the equipment they protect, how water is detected, and how power is kept clean and running. The cooling and airflow lesson in the hardware domain covered how air moves through racks; this lesson covers the room and the building around them.

The lesson

Temperature and humidity ranges, and the sensors that watch them

Servers produce heat and are designed to run within a range of temperatures. The most widely used guidance comes from ASHRAE, the American heating and air-conditioning engineering society, which recommends server inlet temperatures of roughly 18 to 27 °C (64 to 81 °F). Running too hot shortens component life and, beyond a point, makes servers throttle their processors or shut themselves down to avoid damage. Running much colder than necessary wastes energy without much benefit.

What matters is the temperature of the air entering the servers, at the cold aisle, not the average temperature of the room. So sensors are placed at server inlets, at several heights in the rack, since the top of a rack is often warmest.

Humidity matters in both directions:

• Too high, and moisture can condense on cool surfaces, causing corrosion and short circuits.
• Too low, and static electricity builds up, raising the risk of electrostatic discharge damaging components.

A relative humidity of about 40 to 60 per cent is a commonly cited target, and current guidance also sets limits by dew point.

Environmental monitoring sensors measure temperature and humidity continuously and feed the monitoring system, with alerts when readings move outside the agreed range. Servers' own management controllers also report inlet and component temperatures, which gives a reading from inside every machine.

HVAC, and redundant cooling

HVAC (heating, ventilation and air conditioning) keeps server rooms within range. Server rooms use dedicated units designed for continuous operation and precise control, known as CRAC (computer room air conditioner) or CRAH (computer room air handler) units, rather than office air conditioning, which is built for people, may switch off at night, and is not designed to remove heat around the clock.

Cooling is as critical as power: if it fails, temperatures in a busy server room can climb to dangerous levels within minutes. So cooling needs redundancy:

• N+1 cooling provides one more unit than the load requires, so any single unit can fail or be serviced without the room overheating. Larger sites use 2N, a complete second set of cooling.
• Cooling units should be powered from circuits that stay up during an outage, since servers kept running on backup power will overheat if the cooling stops.
• Temperature alerts should be set so staff are warned early enough to act, whether by fixing a unit, opening doors, or shutting down less important servers to reduce the heat load.

Fire suppression: clean agents against sprinklers

Fire in a server room needs detecting early and putting out without destroying everything the room exists to protect.

Detection comes first. Server rooms use sensitive smoke detectors, often aspirating systems that continuously draw air through pipes to a detector and can sense smoke long before a fire is visible.

Suppression comes in two broad kinds:

• Water sprinklers are effective and cheap, but water damages electronics. Standard wet-pipe systems hold water in the pipes at all times. Dry-pipe systems hold pressurised air until activated. Pre-action systems, usually preferred for data centres, fill with water only after a detector confirms a fire, and then release it only when an individual sprinkler head's heat trigger activates, reducing the risk of accidental discharge.
• Clean agent systems flood the room with a gas that puts out the fire without leaving residue or damaging equipment. Examples include chemical agents such as FM-200 and Novec 1230, and inert gases such as Inergen, which reduce the oxygen available to the fire. The room must be sealed well enough to hold the gas, and staff must leave before discharge, so these systems have alarms and a delay before release.

Many sites combine the two: a clean agent system for the room, with sprinklers as required by building codes. Portable extinguishers suitable for electrical fires, such as CO2 extinguishers, should be near the doors. Never use water on live electrical equipment.

Water and leak detection

Water reaches server rooms from more places than fire sprinklers: leaking or condensing cooling units, burst pipes, roof leaks, floods, and plumbing on the floor above.

Leak detection uses sensing cables laid on the floor or under a raised floor, around cooling units and along pipes, and spot sensors at likely points. When water touches a sensor, it raises an alert through the monitoring system, often before it reaches any equipment. Under raised floors this matters most, because water can collect there unseen.

Prevention matters as much as detection:

• avoid placing server rooms under kitchens, bathrooms or other water sources, or in basements prone to flooding;
• keep water pipes from running above racks;
• raise equipment off the floor, and give cooling units drip trays and drains.

Power conditioning and generator backup

Power problems come in more forms than a complete outage. Surges and spikes are brief overvoltages; sags or brownouts are drops in voltage; and noise disturbs the waveform. All of them can damage equipment or cause crashes.

Power conditioning smooths these out. Surge protectors handle spikes, and line conditioners regulate voltage. Most importantly, a UPS (uninterruptible power supply) supplies clean power from batteries when the mains fails. The most protective type, the online or double-conversion UPS, runs the load from its inverter at all times, so equipment never sees mains problems at all. The earlier power lesson covered UPS types and sizing in detail.

A UPS runs for minutes, not hours. For longer outages, sites use a generator, usually diesel. When the mains fails, the UPS carries the load while the generator starts, typically within seconds, and an automatic transfer switch (ATS) moves the load to the generator. When mains power returns, it switches back.

Generators need the same care as any other redundancy: regular testing under load, fuel kept topped up and in good condition, and a fuel supply contract for long outages. A generator that has never been started in anger is as untrustworthy as a failover cluster that has never failed over.