COLUMN  ENGINEER’S NOTEBOOK

This article was published in ASHRAE Journal, January 2019. Copyright 2019 ASHRAE. Posted at www.ashrae.org. This article may not be
copied and/or distributed electronically or in paper form without permission of ASHRAE. For more information about ASHRAE Journal, visit
www.ashrae.org.
Stephen W. Duda

When N+1 Just Isn’t Enough

BY STEPHEN W. DUDA, P.E., BEAP, HBDP, HFDP, FELLOW ASHRAE

Two recent columns of mine1,2 have dealt with an N+1 level of redundancy for criti-
cal facilities, data centers, and the like. Sometime after the first of these two was
published, I received a telephone call from an ASHRAE friend of mine, James M.
Calm, a self-employed engineering consultant and ASHRAE Fellow working in Great
Falls, Va. In a cordial but pointed discussion, he challenged me to revisit the topic
of N+1 redundancy lest I leave our readers with the impression that N+1 is sufficient
in even the most critical of facilities. So, inspired by Jim, this column explores those
facilities where N+1 just isn’t good enough.
As a brief review, the term N+1 refers to a level of parallel piping, electrical, and control systems.
equipment or system redundancy in which one addi- The obvious benefit of N+1 is the fact that a single
tional component of each type is provided—shorthand equipment failure does not disrupt normal operation
for Need-plus-One. If two chillers are required for the of the facility. In a given facility, if four chilled water
load, three are provided; if three boilers are necessary, pumps are needed to meet the load and five are avail-
four are provided, and so forth. able, then a single failure does not immediately hamper
The building that was the subject of my May 2017 col- facility operation. However, consider the case where
umn is a large data center occupied by an agency of the a chilled water pump is intentionally removed from
U.S. government and is considered highly critical for service for maintenance purposes, perhaps a bearing
national defense. So critical, in fact, that they have “N+1 replacement or rebuild of the seals requiring significant
Buildings”—in other words, they maintain two distinct pump disassembly and which cannot be reassembled in
parallel data center facilities in two locations geographi- haste. If a second chilled water pump then fails unex-
cally remote from each other, such that either surviving pectedly, the ability to meet load is in jeopardy. This
building can carry the full function after a loss of the leads some business owners to request N+2 redundancy
other due to fire, terrorist attack, tornado, earthquake, in critical facilities.
or other disaster. Some readers may read the previous paragraph and
think the maintenance staff would not undertake a
Beyond N+1 chilled water pump overhaul during peak summer
Having an entirely redundant facility may be appro- months, instead waiting for winter when fewer chilled
priate for exceptionally critical functions, but there are water pumps will be needed. However, data centers
many privately owned or publicly traded companies for often have a round-the-clock and year-round cooling
whom an entirely redundant facility is not practical. For load of nearly constant magnitude, with chilled water
those whose business case justifies redundancy beyond pumps needed year-round for water-side economizer if
N+1 in a single facility, N+2, 2N, 2N+1, and 2(N+1) are
Stephen W. Duda, P.E., is senior mechanical engineer at Ross & Baruzzini, Inc.,
other options. These higher levels of redundancy may in St. Louis. He is a member and research subcommittee chair of TC 9.1, Large
also require some degree of duplicate pathways such as Building Air-Conditioning Systems.

44 A S H R A E J O U R N A L   a s h r a e . o r g   J A N U A R Y 2 0 19
ThisfileislicensedtoKautukDikshit(aseaind@gmail.com).ThisdownloadwasmadeavailablewithsupportfromRittal.CopyrightASHRAE2019.

not for chiller service, meaning there is no suitable off-
peak time for scheduled or routine maintenance. N+2
allows the owner the opportunity to have one compo-
nent out of service intentionally for scheduled or routine
maintenance while also allowing for the possibility of an
unplanned failure.
Even more redundancy can be achieved with a 2N
approach, with every component having an equivalent
backup. For smaller values of N, there would not appear
to be a significant difference between N+2 or 2N (in fact,
the values are identical for N=2). As N becomes much
larger, the difference is significant and requires some
engineering judgement. As an example, consider a very
large data center with 30 computer-room air-handling
units (CRAHs). N+1 would yield 31 CRAHs but 2N would
yield 60. Does your data center really require 60 CRAHs
when 30 would cover the load? Are CRAHs really that
failure-prone? Most likely, no. On the other hand, are
31 CRAHs enough when 30 cover the load? Again, most
likely no. Some value in between, perhaps N+5 or 1.2N,
would give the owner adequate flexibility to ride out a
few equipment failures or planned overhauls where the
value of N is larger. This needs to be discussed with the
owner and/or end user in the light of their tolerance for
failure, business model, and potential cost avoidance.
2N is sometimes called for in central plants serving
critical facilities, such as two identical chiller plants each
with N chillers, N chilled water pumps, N condenser
water pumps, N cooling towers, and so forth. True 2N
means that each of these central plants would be config-
ured for the full peak load and could operate completely
independent of the other, with separate piping systems,
separate sources of power, separate makeup water, etc.
Service could be shifted between the plants to allow
even wear while allowing scheduled or even unplanned
maintenance to occur in one while the other carries the
load.
Even 2N chiller plants may not satisfy the most criti-
cal of facilities, if the operator needs the flexibility to
perform significant maintenance (requiring equipment
disassembly) on one plant when suddenly a failure
occurs in the other. Having one additional piece of each
type of equipment available in each of the two plants
would constitute 2(N+1) while having a total of one addi-
tional piece of each type of equipment available on a
swing basis to either plant would constitute 2N+1. Either
setup would allow scheduled maintenance to occur in
ThisfileislicensedtoKautukDikshit(aseaind@gmail.com).ThisdownloadwasmadeavailablewithsupportfromRittal.CopyrightASHRAE2019.
COLUMN  ENGINEER’S NOTEBOOK
one central plant while the other central plant carries
the load, and still allow for a failure in the operating
plant.
Two completely independent central plants offer a
better chance of riding through a major calamity in
one plant (e.g., fire, explosion, flood, roof collapse).
Even that seemingly extreme level of redundancy is not
calamity-proof, however; a major tornado or earthquake
severe enough to destroy one central plant is likely to
impact the other central plant as well, if located on the
same property. Hence, the agency mentioned in my
opening paragraphs critical to national defense con-
structed “N+1 Buildings” in two geographically remote
locations. For a more detailed system of classifying levels
of redundancy and their associated levels of reliability
(sometimes called tier levels), see ANSI/TIA Standard
942A.3
How does one decide? One method is the “single point
of failure” analysis or network analysis, to identify where
single points of failure might exist. At the same time,
one would also identify points that have single redun-
dant capability, but that the components or systems
involved have the need for periodic maintenance, or
have a short mean time to failure that would take them
off-line for some period of time, leaving the system with
a temporary single point of failure. The final selection
might in some sections be N+1, other places 2N, others
N+2, and so forth, for different components and connec-
tions, depending upon their vulnerability, failure rate
and need for periodic downtime for maintenance. In
some cases, N+2 can be reduced back to N+1 by stocking
critical replacement parts on-site.
Dual-Path Piping, Controls, and Power Systems
For a very critical facility, it may not be sufficient to
have redundant pieces of mechanical equipment if they
all feed into a common piping loop. Even a 2N chiller
plant will not protect a customer from a potential service
outage if each chiller plant feeds into a single chilled
water supply and chilled water return header. Although
we tend to think of only equipment with moving parts as
being subject to a failure, even a static piping system can
require a shutdown to repair a leak, rupture, or testing.
While runs of pipe rarely fail, valves do, so the chilled
water pathway to each CRAH should be examined for
single points of failure. Perhaps the likelihood of a pip-
ing system failure seems lesser than the likelihood of
J A N U A R Y 2 0 19   a s h r a e . o r g   A S H R A E J O U R N A L 45
COLUMN  ENGINEER’S NOTEBOOK
a pump or fan failure, but nonetheless a truly critical
facility may require redundant piping, power, and con-
trols as well.
For an example of a dual-path piping system serving
a data center, see Figure 1.4 In the diagram, one can see
dual supply and return chilled water piping connections
into a bi-directional 360-degree loop, and the loop itself
is compartmentalized into several sections with shutoff
valves allowing for a segment to be isolated if repairs are
needed. In this example, a loss of a single segment of
loop piping between service valves is survivable if there
is sufficient redundancy in the quantity of connected
decentralized equipment components. No single point
of failure would be ensured by making sure that the
number of redundant CRAHs was equal to the largest
number of CRAHs connected to a single section of the
piping loop, so that if that segment failed and was iso-
lated, sufficient additional CRAHs would remain online
to achieve full capacity.
Another sometimes-overlooked feature of a truly-
redundant HVAC system is makeup water for cool-
ing towers, if water-cooled equipment is used. When
considering both condenser water evaporation and
blowdown, open-cell cooling towers cannot operate for
extended periods of time without makeup water. Having
only one connection to domestic water will not be suf-
ficient in critical facilities. Either two separate sources of
domestic water supply to the facility, or one source plus
significant onsite domestic water storage tanks, will be
necessary. And in either case, two separate and remote
connections of makeup water to the condenser water
system must be provided.
For true redundancy, one or more backup sources of
electrical power are also required for the critical HVAC
equipment. This brings up a somewhat philosophi-
cal question: Does a single onsite engine generator
constitute N+1? If standard utility-provided electricity
is “N,” then it is possible to argue that a single genera-
tor by itself constitutes the “+1” of electric power. But
most truly critical facilities that this author has been
exposed to have redundant utility power sources and
redundant generators. These facilities also frequently
feature UPS (uninterruptible power supply), i.e.,
batteries; and some redundant electrical pathways
with dual-ended substations, automatic power trans-
fer switches, and a “checkerboard” arrangement of
equipment power feeds. Since this is a mechanical
46 A S H R A E J O U R N A L   a s h r a e . o r g   J A N U A R Y 2 0 19
ThisfileislicensedtoKautukDikshit(aseaind@gmail.com).ThisdownloadwasmadeavailablewithsupportfromRittal.CopyrightASHRAE2019.
FIGURE 1   Example of chilled-water distribution piping system.
Redundant Return Loop Redundant Supply Loop
Connections to Chiller Plant Connections From Chiller Plant
Supply Loop Header
Return Loop
Header
Valved Branch Connections to
Decentralized Air/Water-Cooled
Equipment (Typical)
Header Sectional Valves
(Typical)
Return Loop
Header
Supply Loop Header
Valved Mains for Cross Connection or
External Emergency Connection
engineering magazine, detailed discussions of critical
or backup power are best left to our friends in the elec-
trical engineering field.5
Control reliability and redundancy is often missed or
ignored, yet controls failures may be more likely to bring
down a data center than are mechanical failures. Good
practice for mission-critical facilities is to ensure the
control system has the following capabilities:
1. Supplied by emergency power, which may seem
obvious but some facilities miss this.
2. Have an alarm on critical points alerting personnel
who move into action with manual overrides, such as
placing motor controller switches in the “hand” position.
3. Stocking and quickly replacing control boards or
devices in the event of failure.
4. Have secondary backup controllers which upon fail-
ure, are used to control devices resuming functionality.
This is accomplished through programming the build-
ing automation system with event sequences triggered
from alarms or flags noting the failure.
5. Specification of redundant sensors may be very
inexpensive insurance for critical applications to avoid
an unanticipated defeat of all the expensive redundant
equipment being purchased.
For an in-depth exploration of data center controls
reliability, Stein/Gill6 is recommended further reading.
COLUMN  ENGINEER’S NOTEBOOK
Operating a 2N Plant
An interesting corollary topic arises for a plant opera-
tor furnished with a 2N central chiller plant. Assuming
there are no equipment failures and all components are
therefore available for service, what is the most energy-
efficient way to operate that plant? Imagine a four-
chiller chilled water plant where any two chillers can
carry the peak load. Should the operator run two chill-
ers at 100% capacity each? Three chillers at two-thirds
capacity each? All four chillers at half capacity each?
(The energy issue aside, in a mission-critical facility it is
generally not a good idea to operate two chillers at 100%
load because if one fails suddenly, there is a time delay
before another can stage online and pick up the load;
it is generally safer to run three at 66.7% so losing one
machine poses a smaller risk.)
Actual loads in data centers are seldom as high as design
loads due to very conservative Watts-per-rack values
that often do not materialize. This is one reason why
VFDs are so cost effective in data centers. When there
are redundant CRAHs, VFDs can make the plant more
Advertisement formerly in this space.
48 A S H R A E J O U R N A L   a s h r a e . o r g   J A N U A R Y 2 0 19
ThisfileislicensedtoKautukDikshit(aseaind@gmail.com).ThisdownloadwasmadeavailablewithsupportfromRittal.CopyrightASHRAE2019.
energy efficient. For instance, if 30 CRAHs are needed
and 35 are running at part speed, the energy use will be
about 25% lower than if 30 CRAHs were running at full
speed. Another example: If two of three cooling towers
are needed, running three cooling towers at part speed
reduces tower fan energy by more than 50%. Even dual-
path piping saves energy. If piping is sized to handle the
design flow all in one direction but normally has dual
paths, the water flow split reduces pumping energy.
Proper operation for lowest energy use is a compli-
cated question, one that is far too detailed for this col-
umn. Adding to the complexity is that resultant pump-
ing energy, cooling tower fan energy, the use of con-
stant-speed versus variable-speed chillers and pumps
versus a hybrid of those, all come into play. Fortunately,
one of my Engineer’s Notebook colleagues has written
extensively on that topic, and his work is recommended
reading for those exploring that issue.7
Another approach is that the plant, if properly instru-
mented and metered, can be operated according to
ASHRAE Guideline 22.8 This Guideline provides, among

other things, a type of trial-and-error path to deter-
mining the best combination of equipment to operate
for best energy performance. Operating two chillers at
100% but wondering what would happen to energy con-
sumption if you ran three chillers at two-thirds capacity
each? Try it and see what happens. Over time, a properly
instrumented chiller plant in conjunction with digital
controls and computer server with sufficient memory
can learn the best combination of equipment to operate
under an expansive array of load conditions, weather
conditions, time-of-day bracketed or tiered electrical
utility rate structures, and so forth.
Conclusions
In case my May 2017 column left readers thinking that
N+1 is sufficient in even the most critical facilities, this
column is intended to correct that impression. Where
the need is justified, greater redundancy may be appro-
priate. N+2, 2N, 2N+1, and 2(N+1) levels of redundancy
must be considered for facilities critical to national
defense, disaster recovery or emergency response,
Advertisement formerly in this space.
ThisfileislicensedtoKautukDikshit(aseaind@gmail.com).ThisdownloadwasmadeavailablewithsupportfromRittal.CopyrightASHRAE2019.
COLUMN  ENGINEER’S NOTEBOOK
higher-level hospitals or trauma centers, or private-
sector data centers handling millions of dollars in trans-
actions every few minutes. And it is not just pieces of
equipment that require redundant backup; even piping
paths, controls, and often-overlooked things like dual
sources of HVAC makeup water may be required.
References
1. Duda, S. 2017. “Waterside economizer retrofit for data center.”
ASHRAE Journal (5).
2. Duda, S. 2018. “N+1 HVAC for IT closets and server rooms.”
ASHRAE Journal (5).
3. ANSI/TIA Standard 942-A Telecommunications Infrastructure
Standard for Data Centers. 2014. Telecommunications Industry
Association, Arlington, VA.
4. ASHRAE. 2012. Datacom Equipment Power Trends and Cooling
Applications. 2nd ed.
5. As one example, see Lippold, B. and C. Bruck. 2018.
“Acceptance/Maintenance Testing for Data Center Electrical
Reliability.” Mission Critical (5). BNP Media, Inc., Troy, Mich.
6. Stein, J., B. Gill. 2018. “Data center controls reliability.”
ASHRAE Journal (10).
7. Taylor, S. 2012. “Optimizing design & control of chilled water
plants, Part 5.” ASHRAE Journal (6).
8. ASHRAE Guideline 22-2012, Instrumentation for Monitoring
Central Chilled-Water Plant Efficiency.
J A N U A R Y 2 0 19   a s h r a e . o r g   A S H R A E J O U R N A L 49