Tier IV: Fault Tolerant

All IT equipment must connect to at least two independent power distribution units (PDUs) fed from separate UPS systems and separate utility feeds, with both connections simultaneously active and load-sharing.

This requirement eliminates the concept of a 'primary' and 'backup' power source; instead, equipment receives power from multiple sources concurrently, ensuring that loss of any single path does not interrupt service.

The dual-cording must extend through physically separated distribution pathways with independent mechanical protection, circuit breakers, and monitoring systems.

Tier IV facilities must implement at least two completely independent and physically separated cooling systems capable of handling 100% of the facility's thermal load independently.

These systems cannot share critical components such as chillers, cooling towers, or primary supply/return piping, and each must have dedicated water treatment systems, independent control systems, and separate utility connections.

Failure or maintenance of one cooling system must not compromise the thermal environment in the data center, requiring careful compartmentalization and hot aisle/cold aisle containment strategies.

The facility must receive electrical power from at least two separate utility substations or distribution points, with physical feeds routed through different conduits and underground pathways that are geographically diverse to prevent common-cause failures from construction accidents, flooding, or other environmental incidents.

Each feed must enter the facility at different locations and connect to separate main distribution boards, and the facility must be designed such that loss of either entire feed does not degrade operational capacity.

Beyond basic redundancy, Tier IV requires a 2N+1 configuration where N equals the capacity needed to support the entire IT load.

This means the facility must maintain three complete independent sets of critical infrastructure (power conditioning, distribution, cooling capacity) sized such that any two can support full operations while one undergoes maintenance or repair.

This architecture is fundamentally different from N+1 (where one component fails) and requires sophisticated design allowing load balancing and graceful degradation across multiple independent systems.

The facility must be architected to permit planned maintenance on any single infrastructure component—whether a chiller, UPS module, electrical distribution section, or power conduit—while maintaining full IT capacity without requiring load transfers, failover procedures, or any interruption to services.

This requirement demands extensive infrastructure over-provisioning and sophisticated control systems that can isolate maintenance zones while preserving service delivery across alternative paths.

Tier IV requires physical compartmentalization where critical infrastructure zones are separated such that failure or compromise of one zone does not affect others, with independent access control systems, security monitoring, and physical barriers between compartments.

Each compartment must have independent UPS, cooling, and network connectivity, creating security domains that can be isolated without affecting facility operations—a requirement that balances fault tolerance with security needs.

All building management systems, power monitoring systems, cooling controls, and security systems must themselves be redundant with active-active operation across multiple independent platforms.

The monitoring infrastructure cannot be a single point of failure; if primary monitoring systems fail, secondary systems must automatically assume full responsibility with zero latency.

This includes redundant sensors, independent data collection paths, and isolated control logic preventing cascading failures.

Facilities must maintain comprehensive documentation proving fault tolerance design and capability, including single-line diagrams with explicit identification of all independent paths, maintenance procedures that explicitly verify no single failure can impact IT load, and annual verification testing demonstrating that simulated component failures do not degrade service.

This documentation must be available during certification audits and updated whenever infrastructure changes occur.