Capstone: a fire protection and liquid cooling safety review

This capstone brings together the course and the data center sites track. You will carry out two tasks that safety professionals, operations leads and experienced technicians do regularly. First, you will review the findings of a walk-through of Cedar Ridge Hall 2 and its network room, focusing on fire protection and liquid cooling, and rank them by risk. Second, you will review a draft method of procedure for expanding the Hall 2 immersion pilot and recommend changes. Model answers follow each task, but you will learn far more if you attempt each task before reading them. The lesson ends with a look back over the four courses of the track.

Cedar Ridge and everyone in it are invented. The values in this lesson are illustrative and chosen to make the exercise realistic, not to describe any real site, product or standard requirement.

The site

Cedar Ridge Hall 2, completed in 2025, is a slab-on-grade hall built for AI racks of 40 to 130 kW. It has overhead busway, hot aisle containment and single interlock pre-action sprinklers, with aspirating smoke detection sampling the hall and the hot aisles. Two rows, A and B, are direct-to-chip liquid-cooled racks served by four coolant distribution units along the east wall, with PG25 coolant in the technology cooling loop and propylene glycol in the facility water loop, which runs to dry coolers and a chiller with an A2L refrigerant on the roof. Rows C and D are newer liquid-cooled rows served by a fifth CDU. A single-phase immersion pilot pod of four tanks, each holding about 240 gallons of synthetic hydrocarbon fluid, sits at the north end. The Hall 2 network room, about 9,200 ft³ in volume, is protected by an IG-541 inert gas system with a pressure relief vent to the corridor. The meet-me room nearby has an FK-5-1-12 system.

Task 1: review the walk-through findings

A safety advisor and the operations lead walked through Hall 2, the network room and the adjoining corridor. They recorded the following findings. For each finding, decide what hazard it creates, how likely and how severe the consequences could be, and what should be done. Then rank the findings.

Before reading on, write down a hazard, a likelihood and consequence estimate on a scale of 1 to 5, and an action for each finding.

Model answer to Task 1

There is room for judgment in scoring, and teams often disagree on the exact numbers. What matters is the reasoning. The program below records one reasonable set of scores and actions and sorts the findings by risk score, likelihood multiplied by consequence.

# One reasonable risk ranking of the Cedar Ridge Hall 2 findings (teaching example).
findings = [
 # (no, short title, likelihood 1-5, consequence 1-5, action)
 (10, "Meet-me room agent left in manual, no permit", 4, 5,
      "Confirm reason; restore to automatic or raise permit with fire watch today"),
 (7,  "Sprinkler heads bagged in hot aisle", 4, 4,
      "Remove bags now; add head covers to permit close-out checklist"),
 (2,  "Network room door wedged, closer disconnected", 4, 4,
      "Close door, reconnect closer; impairment permit if work needs door open"),
 (5,  "Leak detection not connected, row C live", 3, 5,
      "Connect and test before more load; interim rounds every 2 h"),
 (3,  "Locked cage in protected room, new partition", 3, 5,
      "Quick-release gate from inside; engineering review and integrity retest"),
 (6,  "Oil film, dripping server on cardboard, hoist down", 4, 3,
      "Clean floor, drip tray, remove cardboard; no immersion service until hoist fixed"),
 (9,  "Repeated top-ups on CDU 2 without leak search", 3, 4,
      "Stop topping up blind; leak search and pressure test"),
 (4,  "Unmarked inhibitor concentrate, no eyewash", 3, 3,
      "Label or remove; portable eyewash station at CDU area"),
 (1,  "Storage blocking pressure relief vent outlet", 2, 4,
      "Clear corridor; mark vent zone on floor"),
 (8,  "Riser valve chain lock missing", 2, 4,
      "Replace lock; check all valves for locks and supervision"),
]
ranked = sorted(findings, key=lambda f: (-(f[2] * f[3]), -f[3], f[0]))
for no, title, L, C_, action in ranked:
    score = L * C_
    band = "HIGH" if score >= 15 else ("MEDIUM" if score >= 8 else "LOW")
    print(f"{score:2} {band:6} #{no:2} {title}")
    print(f"           -> {action}")

20 HIGH   #10 Meet-me room agent left in manual, no permit
           -> Confirm reason; restore to automatic or raise permit with fire watch today
16 HIGH   # 2 Network room door wedged, closer disconnected
           -> Close door, reconnect closer; impairment permit if work needs door open
16 HIGH   # 7 Sprinkler heads bagged in hot aisle
           -> Remove bags now; add head covers to permit close-out checklist
15 HIGH   # 3 Locked cage in protected room, new partition
           -> Quick-release gate from inside; engineering review and integrity retest
15 HIGH   # 5 Leak detection not connected, row C live
           -> Connect and test before more load; interim rounds every 2 h
12 MEDIUM # 9 Repeated top-ups on CDU 2 without leak search
           -> Stop topping up blind; leak search and pressure test
12 MEDIUM # 6 Oil film, dripping server on cardboard, hoist down
           -> Clean floor, drip tray, remove cardboard; no immersion service until hoist fixed
 9 MEDIUM # 4 Unmarked inhibitor concentrate, no eyewash
           -> Label or remove; portable eyewash station at CDU area
 8 MEDIUM # 1 Storage blocking pressure relief vent outlet
           -> Clear corridor; mark vent zone on floor
 8 MEDIUM # 8 Riser valve chain lock missing
           -> Replace lock; check all valves for locks and supervision

The highest-ranked finding is the meet-me room clean agent system left in manual for a week with no permit. The room has effectively had no automatic suppression, no one knows why, and no alternative protection has been provided. It is exactly the pattern Lesson 8 warned about. The immediate action is to find out whether there is a reason, such as ongoing work, and either restore the system to automatic after checking it or raise a proper impairment with a fire watch. The longer-term action is to make open impairments part of every shift handover and to configure supervisory signals so that a system left in manual for more than a shift generates an escalating alert.

Findings 7 and 2 are close behind. Bagged sprinkler heads in a hot aisle mean that a fire in row B would not get water from those heads, and they show that the close-out of the earlier dusty work missed a step. The wedged door and disconnected closer in the network room mean that an IG-541 discharge would pour agent out of the room and probably fail to reach extinguishing concentration, while also sending reduced-oxygen air into the corridor; doing it without an impairment permit means nobody has weighed or mitigated that.

Finding 5, leak detection installed but not connected under live racks, and finding 3, a locked cage inside a protected room, both have severe possible consequences. Without monitoring, a leak in row C could run for hours. The cage both changes the protected volume, which may raise the agent concentration or change the distribution, and creates an egress trap: a person inside the cage at the pre-discharge alarm must find a key to get out. Lesson 5 showed how little margin the time delay leaves in that situation. Lessons 4 and 6 explain why the cage needs engineering review and why the enclosure integrity test should be repeated.

Finding 6 combines slip hazards, a fuel load of oil-soaked cardboard and a manual handling problem caused by the out-of-service hoist. Finding 9 is a slow leak that has been hidden by repeated top-ups and could become a large one; topping up blind also wastes coolant chemistry and masks trends. Finding 4 is a chemical exposure hazard that is quick to fix. Findings 1 and 8 are lower in likelihood but worth fixing at once because they are cheap: a blocked vent outlet could cause structural damage during a discharge, and a missing valve lock removes one of the barriers against a closed sprinkler valve going unnoticed, even though the supervisory switch still provides an alarm.

Looking across the findings, two patterns stand out. Several of them, numbers 2, 7 and 10, are impairments that were started informally or not closed properly, which points to weaknesses in the impairment process and handover rather than in individual behavior. And several, numbers 3, 5 and 9, are changes that outpaced the safety systems: a new cage, a new row and a degrading CDU. A good report would recommend fixing the individual findings and strengthening those two systems, the impairment and handover process and the management of change process.

Task 2: review a draft method of procedure

The customer using the immersion pilot wants to add four more tanks to the pod. The cooling contractor has written a draft method of procedure. Read it and list what is missing or wrong before reading the model answer.

Model answer to Task 2

The draft describes the mechanics of the job but leaves out most of the hazards and controls this course has covered. A revised method of procedure would include at least the following.

• Approvals and change management. Adding 950 gal (about 3,600 L) of combustible fluid to the hall changes the fire load. The fire protection engineer, the insurer and, where required, the authority having jurisdiction must review the expansion, including spacing, any protection required over the tanks, spill containment and fluid quantities. Floor loading for nearly two metric tons per tank must be confirmed by the structural engineer.
• Spacing. The 300 mm spacing was chosen to save space, not from any requirement; spacing between tanks affects service access, hoist operation, egress and fire spread and must follow the manufacturer's requirements and the fire protection review.
• Moving the tanks. Pallet jacks may not be suitable for tanks of this size and weight; a lifting and moving plan, route survey and floor protection are needed, as HSE-320 Lesson 8 described.
• Hot work on a live main. Brazing into an overhead facility water main requires isolation and draining of the section, a hot work permit, a fire watch and a planned impairment of the aspirating detection near the work so that it does not trigger a pre-action valve opening. The isolation will affect other cooling equipment and must be coordinated with operations and customers. Mechanical connections that avoid hot work should be considered.
• Pressure testing and commissioning of the new branches before they are put into service, with an exclusion zone if a pneumatic test is used.
• Fluid handling. A hose running along the hall floor from the dock is a trip and leak hazard and a long, unsupervised transfer route. Fluid should be brought to the pod in suitable sealed containers or by a short, protected transfer, with spill containment, absorbents, slip control, safety data sheets, gloves and eye protection, and a person watching each fill.
• Fire protection during and after the work. Confirm the pre-action sprinkler and detection coverage over the new tanks, keep packaging out of the hall, and remove cardboard and drums promptly, not at the end.
• Leak detection and monitoring. Install and connect leak and level monitoring for the new tanks before servers are installed, and test the alarms.
• Service equipment. The service hoist must be working and suitable for the new tanks before servers are installed, and drip trays provided.
• Emergency information. Update the pre-incident plan and the site emergency plan with the new fluid quantity and locations, and update the spill kit inventory.
• Rollback and communication. Define what happens if a step fails, who is notified of impairments and isolations, and who signs off each stage.

Looking back over the track

The four courses of the data center sites track have followed the same invented facility from different directions. HSE-320 introduced the special nature of live mission-critical facilities: dense equipment, constant change, many employers, strict change control and special spaces. HSE-321 dealt with the critical power chain and the discipline of establishing electrically safe work conditions in redundant systems. HSE-322 dealt with batteries, which cannot be switched off and can fail violently. HSE-323 has dealt with the systems that protect the building from fire and the systems that keep the AI computing cool, both of which can hurt people if they are misunderstood.

Across all four, the same ideas recur. Hazards in data centers are often stored energy waiting to be released: electrical energy, chemical energy, pressurized gas and liquid. Many of the worst outcomes come not from the hazards themselves but from changes and impairments that are not managed: a system left in manual, a room partitioned without review, a loop topped up without a search for the leak. And the controls that work are mostly organizational: clear ownership, methods of procedure, permits, impairment management, honest handovers and a culture in which people stop and ask. HSE-401, Safety Leadership and Culture, HSE-403, Incident Investigation and Root Cause Analysis, HSE-404, Safety Management Systems, and HSE-406, Contractor Safety Management, take those organizational ideas further.