The article reminds me of when Hurricane Sandy took out a bunch of New York DCs with 3+ feet of water and people were carrying diesel up stairs to keep generators running.
“The superhuman folks at the data center are hauling 55 gallon drums of diesel fuel up 17 flights of stairs. Assuming they're able to sustain a rate of transfer that exceeds the rate of consumption, the data center should run until electricity is restored. The latest estimate from Con Edison for lower Manhattan is 4 days. (The New York Stock Exchange will be open tomorrow, also running on generator power.)”
Yes. And as someone who worked at Fog Creek at the time, that was a completely avoidable situation that should never have happened, and I'm absolutely gobsmacked we nearly had a repeat of it over a decade later.
Context: in 2012, I literally quit Fog Creek, largely over the fact that we had no backup strategy and I was told that a backup strategy was not feasible. I was "convinced" (paid a lot) to stay on for another two years to see if Kiln would succeed. On my way out of that meeting, I commented to a coworker, "I mean, what's the chance a hurricane hits Manhattan in the next 24 months?"
100%. The chance was 100%. And the only reason people had to haul open containers of diesel up 17 flights of stairs was because no one wanted to admit that the chance wasn't 0%.
Anyway, not sure what was going on with Jane Street here, but holding up that Fog Creek/Trello/SquareSpace story as a positive always drives me somewhat nuts. It lionizes a failure.
Your comment brings back the times I've been on teams that worked double the hours a full time job should be, or spent 18 hours in a data center because a migration/data transfer was failing, and, and and.
So many times it's taken herculean effort to make things happen, usually because of poor planning and poor leadership.
Why these are viewed as "successes" or "heroic" baffles me as well.
I was working at a data center in the financial district during Sandy. That was quite the experience. For whatever reason, our building was one of the last to have power turned back on. We never had to move diesel by hand fortunately. We did have a fun moment early on where one of our generators needed to have most of its load reduced for a few minutes. There were a pair of external fuel filters that needed to be changed fairly frequently. They were meant to be redundant so you could change one at a time. By the time we were able to get a tech on site, they were so dirty that when we started switching to just one the generator came very close to stalling out. After some conversation we thought it was thought that if we could drop the load enough we should be able to get away with just one dirty filter for a short period of time. The only chance we had at that was to shut down all of our cooling units. The generator was on the roof, and I was coordinating the timing over radio. You could dedinitely hear the generator wasn’t happy, but it worked. As soon as the second filter was replaced I let everyone know it was time to turn all of the cooling units back on. No one responded, and after a pause I realized that meant that probably no one had heard me and things were getting hot fast. I sprinted back inside. On the way my radio dropped, so once inside I sprinted to all of the units to tell people to turn them back on. For some reason I didn’t think about grabbing someone else’s radio. That may have been a lucky mistake though, as I’m not sure what all of those compressors turning at at the same time would have done.
I had made sure to observe the filter replacement process in case we needed to do it again ourselves. We did, and the next time someone recorded me doing it so everyone could learn and we handled most I’d the rest of the swaps from then on.
There were a lot of memorable experiences that week or so.
Sandy was wild. you couldn't get computers for love or money, everything was jammed up. we ended up with whatever hardware configs had been returned and sitting in a dell warehouse just to have enough machines so for a long time after you'd have a rack of the standard build and then a random machine with a fibre channel card.
shocking how much engineering you can get done when the normal process becomes impossible and waiting isn't an option.
Generators go on the 17th floor so they can vent out exhaust and heat. Pumps need to go in the basement because you can only suck a liquid up by one atmosphere, which is something like 30' for diesel, but you can push a liquid up basically as high as you want. This does, are you're pointing out, kinda stink if the pump itself is flooded, but the design's common and does make sense
Probably on the 17th floor to put the generators closer to the loads and reduce transmission losses. Also reduces street level air and noise emissions (and avoids street level air intake)
With fuel storage on the same floor for a reasonable runtime, larger fuel storage in the basement and a pump (or two) to move fuel, you're well prepared for lots of things. As long as the fuel throughput on the stairs is better than the fuel use rate, then you're ok for as long as you've got people to move it. Which is ok for exceptional incidents.
You put them up there so you get a voltage boost from the gravity pushing the electricity down. Put the generators on the ground floor, and by the time the electricity reached the top, there would be a voltage drop.
> “They had their brigade of people carrying five-gallon buckets up 18 flights of stairs or whatever it was to get to their auxiliary generator. Quite a task by those guys,” Orchard said.
5 gallons of fuel at a time (hopefully not in a literal bucket) is a lot easier than managing a big drum on stairs. Unless you have a powered stair dolly, but powering your stair dolly up 17 flights of stairs seems like a challenge too.
5 gallons is a standard size of literal buckets, they can have lids but I might prefer carrying a bucket of diesel up 18 flights of stairs with no lid over trying to get one of those goddamn lids off.
Apparently it was a 30-person 5 gallon bucket brigade of customers, contractors, and volunteers all lining up to help fill tanks because of interconnection issues between the supplier they got and where they needed to fuel the tanks up with.
"... neither we nor the fuel company had the proper coupling to tie into that existing infrastructure."
Sometimes "DR" in your plans stands for "didn't realize".
As a bonus though? They were able to in fact get ahead of the fuel burn, and the crew managed an eight hours' head back up on the tanks.
In the article he talks about living within a few minutes walk to work and telling too many people so they made him the emergency office guy. Same thing happened to me, foolishly told everyone hey I can see my apartment from here so I would get panicked calls to run in and shut down servers because the information security guy got a tip of an impending exploit about to be released on a holiday weekend with no way to do it remotely. Everyone else lived a ferry ride or commuter train away.
Not the person you asked, but I've learned that if you're not careful about what you tell your employers and/or coworkers that it will almost invariably come back to haunt you in the form of unpaid labor.
It took me an embarrassingly long time to realize that (my 30's), and now I keep my conversations with my coworkers very utilitarian and divulge minimal information about myself. I try not to be a dick or anything, I'm polite enough, but pretty much everything I talk about is either directly relevant to work and/or so surface level as to border on "vapid".
ETA:
Just as an example, I used to have really bad sleep issues in my 20's that would make it so I wouldn't be able to get to sleep until around 4am, if at all. I made the mistake of bringing that up at work to my manager. Two weeks later I got a phone call at 3am because there was something he wanted to look at and "he knew I would be up". I was up, but I didn't really have much desire to get my laptop out and do work. I liked that job at the time and I liked my manager, so I did it anyway, and it wasn't until years later did I think about that incident and how utterly weird it was that I was sort of being punished for my insomnia.
My sleep issues have gotten a lot better now, so if someone calls me at 3am I probably won't hear it because I'll be asleep, but I remember that incident now and have it constantly spinning in my brain when I chat with coworkers.
I've learned that life is what you make of it. If you let yourself be used - others will use you. But if you showed your worth, but also showed others that you know your worth - things are different.
(otherwise where I work, I also avoid talking about politics for instance, but this is a different theme)
I don't really talk about politics at work either, but that's broadly because I live in a very progressive area where pretty much everyone has the same opinions that I do so it would be a pretty boring echo chamber.
Interesting. The Sequence of Operations we write for the data halls I work on specifically do not shut down the CRACs on smoke alarm for this reason. The International Mechanical Code (IMC) specifically allows this where a air handler over 2000 cfm serves only one space because it's recognized that it will not spread smoke around a building. 2000 cfm is the threshold where you typically have to install smoke detectors, and typically they do shut down on smoke detection.
The CRAC won't feed a fire oxygen as it's just recirculating the same oxygen depleted air.
> every minute, ask every server in each location directly for the temperature from its onboard sensors, take the average, and if it’s elevated, blast an alert out to everyone on the systems team to check for datacenter overheat.
I've once done the opposite: the office "server room" (a small room with three racks, two of them for the patch panels, one for the servers and switches) was cooled by a mini-split which was prone to locking up with the compressor enabled (the relay which controls the compressor got stuck) and freezing, which then stopped the air from circulating due to all the ice. I wrote a script which ran on one of the servers which read the ambient temperature through IPMI to detect when the room was too cold, email a warning, and power off (using ssh) the neighboring servers and then itself.
Odd that they didn't have at minimum 1) a physical Emergency Power Off (EPO) button inside the datacenter, such that one button could de-energize everything -- usually required as part of building a datacenter due to code variance for the "low voltage" (<4000V in this context...) wiring. 2) EPO interlink to the smoke alarms, such that it would de-energize equipment automatically (maybe with delay) if smoke detected.
I specifically remember a TV commercial many years ago (15-20 maybe) that was trying to show the sophistication of the company with an anecdote of how when looking at some other company as a potential investment, considered if they used sprinklers in their data centers and determined that they did not. I could have sworn the company advertising was Jane Street.
I wonder why the answer was to turn off the servers instead of turn their cooling back on. Would it not be able to stabilize the temperature fast enough?
The real answer is probably lost in the sands of time but even at 200 people we still had different teams with overlapping responsibilities. It's possible I was the only person reachable and close enough after hours, and while I didn't know where the CRAC unit controls were I did know how to rip power cords out.
That's how the server room at my school worked. They said to get out of there if the alarm went off because the room would fill with some inert gas and you'd suffocate.
Nitpick, but the headline is not confusing at all, even though a couple of people are apparently confused. I suspect that is the fault of a hasty read through, not the headline itself.
There's tons of substitutes, the ban on Halon wouldn't be why Jane St is using water.
Many people (like me) use "halon" when they are talking about general inert gas based fire suppression as there's not really a good short word for them otherwise.
Realizing that I'm spoiling some of it... but we're here, so some of it is inherently spoiled...
The fire alarm klaxon went off and the siren warning
of imminent halon gas release was screaming. We
started to panic but the data center manager shouted
over the din, "Don't worry, the halon system failed
its acceptance test last week. It's disabled and
nothing will happen."
He was half right, the primary halon system indeed
failed to discharge. But the secondary halon system
observed that the primary had conked and instantly
did its duty, which was to deal with Dire Disasters.
It had twice the capacity and six times the discharge
rate.
They don't have to blow that fast. It can be regulated.
But yes, I've seen low-O2 installations also. These have other issues though, like no protection when humans need to be in there for maintenance. And the need to be very very careful when reducing it again, making sure everyone is out. It happened to my colleague once that this went wrong and while it's not low enough that you'll die, he wasn't exactly feeling great for the next few hours.
We had it at work at a datacenter right beside offices and reception.
You just have to reinforce the ceiling panels and the windows so they don't get blown out, but it's not really an issue otherwise. It was all certified and regularly checked. Water is indeed a bit counterproductive as it's not really much better than fire for the equipment in there.
PS: Halon itself is of course gone but it's other less harmful gases these days.
What also happens is low-oxygen environments (they only raise the O2 when maintenance is being done).
“The superhuman folks at the data center are hauling 55 gallon drums of diesel fuel up 17 flights of stairs. Assuming they're able to sustain a rate of transfer that exceeds the rate of consumption, the data center should run until electricity is restored. The latest estimate from Con Edison for lower Manhattan is 4 days. (The New York Stock Exchange will be open tomorrow, also running on generator power.)”
https://news.ycombinator.com/item?id=4720388 (https://web.archive.org/web/20121101194314/http://status.fog...)
https://arstechnica.com/information-technology/2012/11/how-o...
Context: in 2012, I literally quit Fog Creek, largely over the fact that we had no backup strategy and I was told that a backup strategy was not feasible. I was "convinced" (paid a lot) to stay on for another two years to see if Kiln would succeed. On my way out of that meeting, I commented to a coworker, "I mean, what's the chance a hurricane hits Manhattan in the next 24 months?"
100%. The chance was 100%. And the only reason people had to haul open containers of diesel up 17 flights of stairs was because no one wanted to admit that the chance wasn't 0%.
Anyway, not sure what was going on with Jane Street here, but holding up that Fog Creek/Trello/SquareSpace story as a positive always drives me somewhat nuts. It lionizes a failure.
So many times it's taken herculean effort to make things happen, usually because of poor planning and poor leadership.
Why these are viewed as "successes" or "heroic" baffles me as well.
I had made sure to observe the filter replacement process in case we needed to do it again ourselves. We did, and the next time someone recorded me doing it so everyone could learn and we handled most I’d the rest of the swaps from then on.
There were a lot of memorable experiences that week or so.
https://x.com/BrettHarrison/status/2117636364304892206
shocking how much engineering you can get done when the normal process becomes impossible and waiting isn't an option.
With fuel storage on the same floor for a reasonable runtime, larger fuel storage in the basement and a pump (or two) to move fuel, you're well prepared for lots of things. As long as the fuel throughput on the stairs is better than the fuel use rate, then you're ok for as long as you've got people to move it. Which is ok for exceptional incidents.
> “They had their brigade of people carrying five-gallon buckets up 18 flights of stairs or whatever it was to get to their auxiliary generator. Quite a task by those guys,” Orchard said.
5 gallons of fuel at a time (hopefully not in a literal bucket) is a lot easier than managing a big drum on stairs. Unless you have a powered stair dolly, but powering your stair dolly up 17 flights of stairs seems like a challenge too.
Apparently it was a 30-person 5 gallon bucket brigade of customers, contractors, and volunteers all lining up to help fill tanks because of interconnection issues between the supplier they got and where they needed to fuel the tanks up with.
"... neither we nor the fuel company had the proper coupling to tie into that existing infrastructure."
Sometimes "DR" in your plans stands for "didn't realize".
As a bonus though? They were able to in fact get ahead of the fuel burn, and the crew managed an eight hours' head back up on the tanks.
It took me an embarrassingly long time to realize that (my 30's), and now I keep my conversations with my coworkers very utilitarian and divulge minimal information about myself. I try not to be a dick or anything, I'm polite enough, but pretty much everything I talk about is either directly relevant to work and/or so surface level as to border on "vapid".
ETA:
Just as an example, I used to have really bad sleep issues in my 20's that would make it so I wouldn't be able to get to sleep until around 4am, if at all. I made the mistake of bringing that up at work to my manager. Two weeks later I got a phone call at 3am because there was something he wanted to look at and "he knew I would be up". I was up, but I didn't really have much desire to get my laptop out and do work. I liked that job at the time and I liked my manager, so I did it anyway, and it wasn't until years later did I think about that incident and how utterly weird it was that I was sort of being punished for my insomnia.
My sleep issues have gotten a lot better now, so if someone calls me at 3am I probably won't hear it because I'll be asleep, but I remember that incident now and have it constantly spinning in my brain when I chat with coworkers.
(otherwise where I work, I also avoid talking about politics for instance, but this is a different theme)
The CRAC won't feed a fire oxygen as it's just recirculating the same oxygen depleted air.
I've once done the opposite: the office "server room" (a small room with three racks, two of them for the patch panels, one for the servers and switches) was cooled by a mini-split which was prone to locking up with the compressor enabled (the relay which controls the compressor got stuck) and freezing, which then stopped the air from circulating due to all the ice. I wrote a script which ran on one of the servers which read the ambient temperature through IPMI to detect when the room was too cold, email a warning, and power off (using ssh) the neighboring servers and then itself.
https://signalsandthreads.com/the-thermodynamics-of-trading/
I smell AI
33 Thomas St is basically one huge datacenter, that's why it doesn't have any windows. https://en.wikipedia.org/wiki/33_Thomas_Street
Nitpick, but the headline is not confusing at all, even though a couple of people are apparently confused. I suspect that is the fault of a hasty read through, not the headline itself.
[1] - https://en.wikipedia.org/wiki/Bromotrifluoromethane
Many people (like me) use "halon" when they are talking about general inert gas based fire suppression as there's not really a good short word for them otherwise.
So fire suppression and data centers don't mix too well
https://www.hack.org/~mc/texts/vaxen-joke.txt
Realizing that I'm spoiling some of it... but we're here, so some of it is inherently spoiled...
But yes, I've seen low-O2 installations also. These have other issues though, like no protection when humans need to be in there for maintenance. And the need to be very very careful when reducing it again, making sure everyone is out. It happened to my colleague once that this went wrong and while it's not low enough that you'll die, he wasn't exactly feeling great for the next few hours.
But it's only used in military and aviation these days anyway.
You just have to reinforce the ceiling panels and the windows so they don't get blown out, but it's not really an issue otherwise. It was all certified and regularly checked. Water is indeed a bit counterproductive as it's not really much better than fire for the equipment in there.
PS: Halon itself is of course gone but it's other less harmful gases these days.
What also happens is low-oxygen environments (they only raise the O2 when maintenance is being done).