A/B is only redundant when each side carries the load alone

A server room with two power rails, A and B. In every rack two power strips, one per rail, and every server has two power supplies. On the plan, that is redundant, and in normal operation it looks that way too: both strips show around 60 per cent load.

Then rail A is switched off for maintenance. The servers switch over to their second power supply as intended, and rail B now carries the entire load: 120 per cent of its rated capacity. The strip's circuit breaker trips. The rack goes dark, although everything was duplicated.

What IT-Grundschutz requires

Module INF.2 (data centre and server room) describes the dual supply in two requirements for increased protection needs. INF.2.A23 states where it should begin: for IT hardware with two power supplies, a dual A-B supply should be built for the IT operating areas from the low-voltage main distribution onwards. And immediately afterwards: lines that provide redundancy for each other should be routed along separate cable routes. INF.2.A25 adds the second half: where an A-B supply exists, each of the two power paths should have its own independent UPS system.

The basic requirement INF.2.A3 says what happens to sizing when something changes. In German:

„Bei relevanten Änderungen an den Verbrauchern MUSS überprüft werden, ob die vorhandenen USV-Systeme noch ausreichend dimensioniert sind.“

In short: after relevant changes to the loads, it must be checked whether the existing UPS systems are still sufficiently sized.

What the requirements do not state as a number follows from them: an A-B supply is only one if each side can carry the full load alone. DIN EN 50600 covers availability classes of power supply in detail; its text is protected by copyright and is only drawn on in substance here.

Where it breaks in practice

• The load on each side. With evenly distributed load, each side may carry at most half its rated capacity in normal operation, with a margin for inrush currents. 60 per cent on both sides sounds healthy and is not. And because every new device loads both sides, the limit moves closer with every installation, exactly the case of INF.2.A3.
• Where A and B join. Two strips in the rack do not mean two paths. If both outlets hang off the same sub-distribution board or the same UPS, or if their lines run in the same cable route, the redundancy is only duplicated inside the rack. The requirement names the low-voltage main distribution as the starting point for a reason.
• The second power supply on the same strip. During an installation under time pressure, both power supplies go into the strip that is closer. Or one power supply has been faulty for months, the server keeps running, and nobody notices that it is standing on one leg.

All three faults have in common that nothing happens day to day. They only show at the moment the redundancy was built for.

How isidaten handles this

In the DCIM module, the power path is traced per power supply: from the device via strip and outlet to the distribution board and the source, so it becomes visible whether A and B really stay separate. The rack view warns about devices whose power connections lead to only a single strip or UPS, and when an entire rack is fed from only one source. If measurements per power supply are available, isidaten compares the current load distribution with the previous week's average every 15 minutes and reports when a power supply suddenly carries nothing or one permanently carries almost everything; the alert runs through the normal alerting up to an incident.

The test question

Take the rack with the highest load: what percentage of its rated capacity does strip B carry if strip A fails, and up to which distribution board can the two paths be traced separately?

If the first answer is above 100 or the second is "in the rack", the supply is duplicated, but not redundant.

Sources

BSI IT-Grundschutz Kompendium, 2023 edition, module INF.2 Rechenzentrum sowie Serverraum, requirements A3, A23 and A25 (German). DIN EN 50600 in substance, text of the standard protected by copyright.

In the next part: ghost servers that occupy power and rack units without having a task. The previous part: A data centre for the BSI, not for the Energy Efficiency Act.