Data Center Chiller Plant Controls: Controller Redundancy, Monitoring and Building System Signals
Why whole-plant controls deserve their own design basis
A data center chiller plant is only as resilient as the controls that sequence it. Duplicating chillers and pumps does not deliver N+1 or 2N cooling if a single controller, power supply, network switch or sensor can stop the whole plant. The control panel design basis should state the redundancy target for controls separately from the mechanical redundancy, and the two should be reviewed together by the mechanical consultant, controls integrator and panel builder.
This guide covers the control layer above individual chiller and pump MCCs: the plant controller architecture, power to the controls, field I/O allocation, monitoring integration and the signals exchanged with building and data center systems. For motor feeders and restart sequencing, read data center cooling MCC recovery.
Controller architecture options
| Architecture | How it works | Typical consideration |
|---|---|---|
| Single plant PLC | One CPU sequences all chillers and pumps | Single point of failure; needs a defined fallback mode |
| Hot-standby redundant CPUs | Primary and standby CPUs with synchronised program and data | Switchover behaviour and time must be confirmed with the PLC manufacturer |
| Distributed controllers per chiller/pump train | Each train has its own controller; a supervisory layer coordinates | Loss of the supervisor should leave trains running in a safe local mode |
| OEM chiller controls plus plant sequencer | Chillers keep internal protections; sequencer issues enable and setpoints | Interface limits and OEM warranty conditions must be agreed |
No architecture is correct for every site. The choice depends on the Tier objective, operating philosophy and the owner's maintenance capability. Whatever is chosen, document what happens when each controller fails, before FAT.
Fail-safe behaviour and fallback modes
Define the state of every output on loss of controller, loss of communication and loss of control power. Common approaches include:
- Chillers and pumps continue in their last running state, or run in a defined "fail-to-run" mode, rather than stopping on controller failure.
- Valves fail to a position agreed with the mechanical designer, using spring-return actuators where required.
- Local hand/off/auto selectors and hardwired run circuits allow equipment to be kept running during controller maintenance.
- Watchdog contacts from each controller annunciate failure to the BMS and to a local alarm.
Fail-to-run strategies must not bypass chiller OEM safety protections such as low-flow, high-pressure or freeze protection. Those remain inside the OEM controls.
Splitting I/O so one failure does not stop the plant
Distribute I/O so that a single I/O module, rack or field bus segment serves only one chiller train or one pump of a duty/standby pair. Avoid placing all chilled-water pump run commands on one card. Redundant sensors such as supply temperature and differential pressure can be wired to different modules, with the program selecting a valid reading and alarming on disagreement.
Power supply to the controls
Controls need their own resilient supply. Typical measures:
- Dual 24 V DC power supplies with redundancy modules, fed from A and B sources where both are available.
- UPS or DC battery backup sized so controllers, network switches and critical instruments ride through generator start and transfer.
- Separate protection for each controller, I/O rack and network switch so a single fault clears locally.
Confirm ride-through times with the electrical designer; they depend on the site's transfer scheme and generator start time. See STS vs ATS transfer for upstream transfer behaviour.
Network design for the control system
Plant controllers, HMIs and gateways are usually connected by industrial Ethernet. Ring topologies with managed switches, or dual networks, reduce the impact of a single cable or switch failure. Keep the control network segregated from the IT and corporate networks, with defined, documented gateways to BMS and DCIM. Network security requirements should follow the owner's policy; IEC 62443 is a common reference for industrial control systems.
Monitoring integration: BMS, EPMS and DCIM
| System | Typical information from the chiller plant | Typical protocol |
|---|---|---|
| BMS | Status, alarms, setpoints, run hours, temperatures, flows | BACnet/IP or Modbus |
| EPMS | Energy and power quality at MCC incomers and VFDs | Modbus TCP or IEC 61850 where specified |
| DCIM | Cooling capacity, alarms, plant efficiency metrics | BACnet, Modbus or SNMP via gateway |
Agree a points list early. For each point, record name, type, units, range, alarm limits, read or write access and the owning system. Restrict writes from supervisory systems: in most data centers the BMS or DCIM should not be able to stop a running chiller unless that action is specified and protected. Related reading: branch circuit monitoring and DCIM integration.
Hardwired signals to building and data center systems
Network integration is useful for monitoring, but critical interlocks are usually hardwired so they work when networks fail:
- Fire alarm shutdown or fan control signals, as required by the fire strategy and local code.
- Generator running and load-shed or staged pickup permissives from the power system.
- Common critical alarm and controller watchdog to the BMS and security control room.
- Emergency stop circuits, where specified, designed to the agreed safety standard.
- Chiller "available" and "running" status to upstream source transfer or load management logic where used.
Each hardwired signal should have a defined normally-open or normally-closed state, voltage, and failure response, recorded in the interface schedule.
Testing controls redundancy at FAT and site
Factory testing should include simulated failure of each controller, power supply, I/O module and network link, with the observed response compared to the written fallback description. Points-list checks should confirm each BMS, EPMS and DCIM value end to end where simulators are available. Integrated systems testing at site then confirms behaviour with real equipment, sensors and building systems. See factory acceptance testing practices for the panel side.
Information to send for a quotation
- Chiller plant schematic and sequence of operation
- Redundancy target for mechanical plant and for controls
- PLC or controller make preference and redundancy requirement
- I/O schedule and points list for BMS, EPMS and DCIM
- Interface schedule for hardwired signals
- Control power philosophy and UPS availability
- Network and cybersecurity requirements
Send these for data center chiller plant control panels. Related guidance: Tier III vs Tier IV distribution, chiller pump sequencing and HVAC control panels.
Technical references
- Schneider Electric White Paper 179: data center cooling during power outages
- ISA/IEC 62443 series overview
Controller switchover times, protocol support and fallback behaviour depend on the selected products; confirm with current manufacturer documentation.
Request a quotation · Submit your SLD / BOQ · +91-9654745703 · powerpaneltech@gmail.com