Fire protection in data centres

A data centre is full of things that can burn and things that must not get wet. Cables with plastic jackets run for kilometres through trays and under floors, servers hold circuit boards, plastic fans and lithium-ion batteries, and UPS rooms and battery rooms hold enough stored energy to start and feed a fire. At the same time, the owner and every customer in the building expect the computing load to keep running through almost anything. Fire protection in a data centre therefore has to do something harder than in an ordinary office: protect the people in the building, protect equipment worth hundreds of millions of dollars, and keep the services running, all without the protection itself becoming a hazard.

This is the fourth and final course in the data centre sites track. HSE-320, Data Centre Safety Essentials, introduced the special spaces of a data centre and the emergency features found in them, such as emergency power off buttons, clean agent warning signs and pre-action sprinklers. HSE-321, Electrical Safety in Critical Facilities, dealt with the power chain, and HSE-322, Battery Rooms and Lithium-Ion Hazards, dealt with batteries, including the limits of suppression on battery fires. HSE-323 now looks at two groups of systems that bring their own hazards into the building: the fire protection systems themselves, especially gaseous clean agent and carbon dioxide systems and water-based sprinklers, and the liquid cooling systems that have arrived with high-density AI computing.

The engineering design of these systems belongs to other courses. DCE-440, Fire Protection, Life Safety and Physical Security, covers fire dynamics, detection design, sprinkler hydraulics and clean agent system design, and DCE-330, Data Centre Cooling and Heat Rejection, covers chilled-water plants, pumps and piping, and direct-to-chip and immersion cooling. General fire safety and evacuation are covered in HSE-105, Fire Safety and Emergency Preparedness, and HSE-222, Fire Warden and Evacuation Leader, and oxygen-deficient atmospheres in HSE-211, Confined Space Awareness. This course takes the view of the people who work in protected spaces and around cooling systems every day: technicians, electricians, fire protection contractors, mechanical contractors, security officers, customer staff and the managers who make decisions about impairments, maintenance and emergencies.

Three goals that sometimes pull against each other

Fire protection in any building starts with life safety: detecting a fire early, warning people and giving them time and routes to get out, and helping firefighters do their work. Building and fire codes are written mainly around that goal. In a data centre, two more goals sit on top of it. Asset protection aims to limit damage to equipment, cabling and the building. Business continuity aims to keep services running, or at least to restore them quickly, which means limiting the area affected by a fire, by smoke, by suppression agent and by water.

These goals usually support each other, but they can conflict. A sprinkler system that floods a data hall is excellent for life safety and for the building, but the water can destroy equipment that the fire never touched. A gaseous agent that leaves no residue protects equipment, but some agents lower the oxygen in a room or are toxic at high concentrations, so they introduce a hazard to the people the system is supposed to protect. An emergency power off that de-energizes a whole hall removes an ignition source but stops every service in that hall at once. Many of the safety rules in this course exist because a choice made for asset protection or continuity has created a hazard for people, and that hazard has to be managed.

What burns in a data centre

Data centre fires are usually small at the start, and most of them never become large. The common causes are electrical: overheated connections, failed power supplies, arcing faults in switchgear and busway, failed capacitors in UPS modules and, increasingly, lithium-ion battery failures. The fuels are mostly plastics, especially cable jackets and insulation, circuit boards and equipment housings. These materials often burn slowly at first and produce a great deal of smoke before there is much flame. That smoke is corrosive: burning PVC and other halogenated plastics release hydrogen chloride and other acid gases, which can damage electronics far from the fire. For a data centre, the smoke from a smouldering power supply can do more harm to the business than the heat.

Other fuels are concentrated in particular spaces. Battery rooms hold electrolyte and plastic cases; HSE-322 covered their hazards. Generator rooms and yards hold diesel fuel and lubricating oil. Loading docks and staging areas hold cardboard, foam and wooden pallets, which are some of the most combustible materials in the building and are often present in large amounts when new equipment arrives. Office areas and the network operations centre have ordinary office fuels. Liquid cooling has added a new possible fuel: some immersion cooling fluids are combustible oils, as Lesson 10 explains.

Layers of fire protection

Fire protection works in layers, and no single layer is expected to work every time. The same idea appeared in HSE-322 for battery rooms. For the building as a whole, the layers are usually described as follows.

• Prevention removes ignition sources and fuel: good electrical maintenance, thermography, housekeeping, control of cardboard and packaging, hot work permits and rules for chargers and personal devices.
• Detection finds a fire as early as possible: spot smoke detectors, aspirating smoke detection that samples air through pipes, heat detectors in some spaces, and monitoring of equipment temperatures and battery management data.
• Notification and egress warn people and get them out: alarm signals, voice messages in some buildings, emergency lighting, exit signs and clear exit routes.
• Suppression controls or extinguishes a fire: sprinklers, water mist, gaseous clean agents, and portable extinguishers used by trained staff.
• Compartmentation limits the spread of fire and smoke: fire-rated walls and floors, fire doors, fire-stopped penetrations and fire dampers.
• Response deals with what is left: the site emergency plan, trained staff, the fire service and recovery after the event.

This course spends most of its time on two of these layers. Suppression systems are designed to act automatically, sometimes with very little warning, and some of them can injure or kill people who are in the space when they discharge. Detection and release sequences decide when and how they act, and people working in protected spaces need to understand those sequences. The other layers matter too, and the lessons refer to them where they affect how suppression systems are used.

The suppression systems found in data centres

Most modern data centres use a combination of systems, chosen space by space. Data halls are usually protected by sprinklers, and in most data centres those sprinklers are pre-action systems, whose pipes are filled with air or nitrogen until detection confirms a fire. Rooms with especially valuable or critical equipment, such as meet-me rooms, network rooms, tape libraries and some UPS and electrical rooms, often have a gaseous clean agent system as well as, or instead of, sprinklers, subject to the code and the authority having jurisdiction. Water mist is used in some facilities. Carbon dioxide total flooding systems are now rare in occupiable data centre spaces because of their danger to people, but they remain in some older facilities and in some unoccupied enclosures, such as generator or turbine enclosures. Portable extinguishers, usually carbon dioxide or clean agent units for electrical equipment and water or foam units for ordinary materials, are found throughout.

Liquid cooling: a new set of hazards in the white space

For most of the history of data centres, the rule was simple: keep water out of the data hall, or at least below the raised floor. Chilled water stayed in the cooling units at the edge of the room or outside it. High-density AI computing has changed that. Racks of 40 to more than 100 kW cannot be cooled by air alone, so water, water and glycol mixtures and specialized dielectric fluids now run through manifolds in the racks, into cold plates on the processors and through tanks in which whole servers are submerged. HSE-320 introduced liquid cooling as one of the reasons modern data halls are changing; this course examines its hazards in detail in Lessons 9 to 11.

Liquid cooling brings several kinds of hazard into the white space at once: liquid near energized equipment, pressurized piping and quick disconnect couplings, chemicals in the coolant, slippery floors after leaks, heavy and awkward lifts when servers come out of immersion tanks, and, for some fluids, combustibility or vapour exposure. It also changes fire protection. A leak can trigger water sensors and alarms that look like a fire system problem, immersion tanks add a possible fuel in the hall, and the people who respond to an alarm must now consider both systems.

Cedar Ridge Colocation

As in the earlier courses in this track, the lessons use an invented site, Cedar Ridge Colocation, to make the discussion concrete. The site and everything in it are invented, and the values given are illustrative. The table summarizes the fire protection and cooling features relevant to this course.

Cedar Ridge has no carbon dioxide total flooding systems; its fire protection policy forbids them in any space a person can enter, which is common practice for data centres. Lesson 5 still covers carbon dioxide in detail, because technicians and contractors may meet it at older sites, in generator or turbine enclosures, and in portable extinguishers.

How fire grows, and why early detection matters

Fire engineers often describe the early growth of a fire with a simple model in which the heat release rate grows with the square of time. The constant in the model depends on the fuel: a slowly smouldering cable bundle might take many minutes to reach a given size, while a stack of foam packaging could get there in a few minutes or less. The model is a simplification, but it shows why detection time matters so much. Because growth is quadratic, a fire detected twice as early is detected at a quarter of the size. The program below compares when an illustrative fire would be detected by different kinds of detection. All the values are for teaching only; real detection performance depends on the fire, the airflow and the system design, which DCE-440 covers.

import math
# Teaching model: heat release rate Q = alpha * t^2 (t-squared fire).
# Growth constants (kW/s^2) from the common "slow / medium / fast" classes.
alpha = {"slow": 0.00293, "medium": 0.01172, "fast": 0.0469}
# ILLUSTRATIVE fire size (kW) at which each detection method responds
# in a high-airflow data hall. Real values depend on design and airflow.
detect_kw = {"aspirating, very early warning": 5,
             "spot smoke detector": 50,
             "sprinkler head (heat)": 500}
for growth, a in alpha.items():
    row = []
    for method, q in detect_kw.items():
        t = math.sqrt(q / a)
        row.append(f"{method}: {t/60:5.1f} min")
    print(f"{growth:>6} fire -> " + " | ".join(row))
print("A fire detected at 5 kW is one hundredth the size of one detected at 500 kW.")

  slow fire -> aspirating, very early warning:   0.7 min | spot smoke detector:   2.2 min | sprinkler head (heat):   6.9 min
medium fire -> aspirating, very early warning:   0.3 min | spot smoke detector:   1.1 min | sprinkler head (heat):   3.4 min
  fast fire -> aspirating, very early warning:   0.2 min | spot smoke detector:   0.5 min | sprinkler head (heat):   1.7 min
A fire detected at 5 kW is one hundredth the size of one detected at 500 kW.

Even with illustrative numbers, the pattern is clear. Very early warning detection, which samples air continuously and can sense smoke at concentrations far below what a spot detector needs, can give staff many minutes to find and deal with a smouldering fault before it becomes a fire. A sprinkler head responds only when the fire is large enough to heat it, by which time smoke damage may already be extensive. This is why data centres use layered detection: very early warning to alert staff, standard smoke detection to start alarms and release sequences, and heat-activated sprinkler heads as the final water discharge trigger. Lesson 3 explains how these signals combine.

People in protected spaces

Every system in this course is designed on the assumption that people will be in or near the protected space. Data halls are busy. Technicians install and remove equipment, contractors work on cooling and power, security officers patrol and customers visit their racks. Meet-me rooms have frequent cross-connect work. Some of the hazards of the systems are present only when they discharge, such as low oxygen, pressure, noise and cold, while others are present during routine work, such as the risk of accidentally triggering a release, the stored pressure in cylinders and pipes, and the liquid in cooling systems. Each lesson asks the same questions: what can the system do to a person, when, and what keeps the person safe?