Rear door heat exchanger service on a live rack: what the OEM lets you do with the servers running

It is 14:20 on a Tuesday and the leak detector on the active rear door of rack B12 has tripped. The rack behind that door is carrying 28 kW of live compute, the door holds about nine litres of water, and the nearest person is a network engineer with a badge and no idea whether the door may be opened.

Rear door heat exchanger service on a live rack is allowed for some steps and forbidden by the OEM for others. Swinging the door open on its hinges to reach the servers is a live operation, and on an active door a skilled person can swap a fan while the module runs. Draining the coil, connecting or disconnecting the water hoses, and removing or replacing the door assembly are not live operations: IBM and Lenovo require the rack powered off and three trained persons, and Vertiv requires the chilled-water system drained first. While the door is open or its water is stopped, the whole rack heat load goes into the room and the room cooling has to carry it.

• Open the door: live. Swap a fan on an active door: live, skilled person only. Hoses, drain, fill, door removal: rack power off, by OEM instruction.
• Three trained persons to lift an IBM or Lenovo door, at least two for a Vertiv door of 73 to 106 kg, and a trained service technician for the door assembly itself.
• With the water stopped, one measured door heated its exhaust at about 0.05 °C a second and lost all cooling effect in roughly eight minutes.
• The door's water must stay above the room dew point, which the OEMs put at 18 °C for an A1 room and 22 °C for A2, and building chilled water at 4 to 6 °C is too cold.

What is a rear door heat exchanger, and what counts as servicing one?

A rear door heat exchanger is a water coil built into the rear door of a server rack, so that the exhaust the servers push out passes through it and is cooled before it reaches the room. In a passive door the server fans alone drive the air and the door has no moving parts, and an active door adds its own fans on the outside to overcome the coil's resistance. Either way the door needs water flowing through it, and it needs that water warmer than the room's dew point.

Servicing one is not a single job. The OEM manuals define a fixed set of interventions, and each carries its own conditions: Lenovo's guide covers filling, air-purging, draining, hose connection and door replacement, and IBM's maintenance procedures add refilling after a leak and a maintenance schedule. The question this page answers is which of those can happen with the servers running.

Passive door

A coil, two manifolds, an air-purge valve at the top and a drain valve at the bottom. The IBM and Lenovo V2 door weighs 39 kg empty and 48 kg filled and holds about 9 litres.

Active door

The same coil with a fan tray on the outside. Vertiv's tray adds 125 mm of depth and cuts the door's opening angle from 180 to 135 degrees.

Secondary loop

The closed, conditioned water circuit that feeds the doors. It is never the building's chilled water, which is too cold and too plentiful if it leaks.

Coolant distribution unit

The CDU that separates the secondary loop from the building water, holds the supply above dew point and sets the flow. It is not the door's isolation point.

Quick-connect couplings

The hose fittings at the bottom of the door that let it swing open or come off. Touching them is the step the OEMs put behind a rack power-down.

Which rear door heat exchanger service steps can be done with the rack live?

The table below is assembled from the OEM manuals, step by step. The split is not passive against active, and it is not planned against emergency: it is whether the step touches water that can move.

Read down the third and fourth columns and the qualification for this equipment stops being a skill tag. It is a headcount, a person class, an OEM tier and a rack state, and the manuals write all four down.

The door is designed to open with the rack live. It is not designed to be drained, unplugged or lifted with the rack live, and the manual says so on the same page.

How long does the rack have when the door is open or the water stops?

The OEM answer is a requirement, not a number. IBM's planning guide says that if the door is opened for rack maintenance or its water is stopped, the rack heat load is sent out into the room and must be handled by room air conditioning until the water is restored, and Vertiv says the same for a supply failure. The DOE's case study notes that a room CRAC can compensate for warm door discharge, which is why the failure-time ranking gives the door the room's time rather than its own.

The measured answer comes from one experiment. An ASME InterPACK paper put a rear door on a 15.9 kW IBM cabinet, held the supply water at 12.7 °C, and killed the chiller and then the pump while a temperature mesh watched the exhaust.

Two things in that table transfer to a service plan. Isolating a door at its valves is the pump-failure case, so the trapped water is worth a few minutes and no more, and opening the door is worth nothing at all. Recovery was quicker after the pump failure than after the chiller failure, because the water sitting in the supply hoses had stayed cold.

14:20

Leak detector on the active door of B12 trips. The BMS raises the door's contact alarm and the CDU's supply temperature, which is 19 °C against a room dew point of 16 °C.

14:23

The shift engineer isolates the door at its own supply and return valves, not at the CDU. The other seven doors on the loop keep their flow.

14:26

DCIM shows B12 at 28 kW. The hall's CRAH units have about 60 kW of headroom, so the rack can stay live with its door isolated while someone is found.

14:40

The leak is at a hose coupling, not the coil. Reconnecting the hose is a rack-power-off step by the manual, so the work is scheduled into the change window and the rack stays isolated and air-cooled until then.

Closes when

The hose is remade with the rack down, the loop is refilled and bled, the door is closed with water flowing, the leak detector is clear, and the door's exhaust temperature is back where it sat before 14:20.

Who is allowed to do each step on a live rack?

Lenovo's current guide says the equipment must be installed or serviced by trained personnel as defined by IEC 62368-1, and that access to it is controlled by the authority responsible for the location. That standard defines three classes of person, ordinary, instructed and skilled, and a skilled person is one with the training or experience to recognise the energy sources that could injure them.

The OEM adds a second gate on top of the person class. IBM's guide lists the door assembly as a field replaceable unit that must be replaced only by a trained service technician, and says that a leak in the coil means calling for a replacement door rather than repairing it. The hinges, latch, baffles and purge tool are customer replaceable, and the coil is not.

• Equipment expertise on this door. A skilled person for an energised fan module, trained personnel for anything with water in it, and a trained service technician for the assembly.
• OEM authorisation. The coil is a field replaceable unit, so the person who replaces it is the OEM's, or is authorised by the OEM, or the warranty is at risk.
• Headcount. Three trained persons for an IBM or Lenovo door, at least two for a Vertiv door, and a platform ladder for the top hinge.
• Site clearance for the hot aisle, plus eye protection for fill, drain and purge, and boots on Vertiv's list.
• A procedure that includes the rack power-down for any hose, drain, fill or removal step, and the lockout that goes with it.

One more constraint belongs on the list, and no glossary page carries it. The person servicing the door stands in the exhaust the door was cooling, and ASHRAE's liquid-cooling white paper summarises OSHA heat-stress guidance for exactly that aisle: at a 27 °C inlet and a 15 °C rack rise, moderate work such as cabling needs a 30-minute break every hour, and at a 32 °C inlet no hot-aisle work meets the guideline without localised cooling.

Why does the water have to stay above the dew point during service?

Because the coil and its hoses are not insulated. IBM and Lenovo require the water inside the door to stay above the room dew point, and where the supply cannot track dew point they set a floor of 18 ±1 °C for an A1 room and 22 ±1 °C for A2, which the manuals still call Class 1 and Class 2. Those floors sit one degree above the ASHRAE allowable dew-point maxima of 17 °C for A1 and 21 °C for A2.

That is why building chilled water, which the manuals put at 4 to 6 °C, must never reach the door directly. The CDU exists to hold the secondary loop above dew point and to limit a leak to the secondary volume, which is the same demarcation ASHRAE's cold-plate resiliency bulletin asks for between facility water and the technology loop.

The service implication is the one nobody states. Opening the hall up for a door job changes the room's dew point, and a supply that was comfortably above it at 09:00 can be below it by the time the door is reconnected, so the check belongs at the end of the step as well as the start.

What do the BMS, DCIM and CMMS already know about the door?

Each system in the building holds one of the inputs a door service needs, and none of them holds the decision. That is not a gap in any of them, because none was asked whether this rack may stay live.

The join is what gets made in the interval between the alarm and the dispatch, from memory, against a clock. For a rear door it has a short and checkable form: the step class from the table above, the rack's load from DCIM, the room's headroom from the BMS, and the person's class and OEM tier from the CMMS.

How to plan a rear door service on a live rack this week

The procedure below is the OEM manuals reordered as a decision, and it can be written as a one-page MOP for each door type on site. It produces a yes or a no on the rack staying live before anyone touches the door.

• Classify the step against the service table. If it involves a hose, the drain valve, filling, or the door assembly, it is a rack power-down by OEM instruction and the rest of this list is about scheduling it, not doing it live.
• Read the rack's load from DCIM and the hall's cooling headroom from the BMS. IBM's requirement is that room air conditioning can carry the rack's full load while the door is open or dry, so if the headroom is smaller than the rack, the door service is a hall change.
• Isolate at the door's own supply and return valves, never at the CDU. If a door has no valves of its own, the loop has no way to service one door without losing all of them, and fitting them is the first job.
• Check the supply temperature against the current room dew point, and check it again before the door is reconnected. The floors are 18 °C for A1 and 22 °C for A2 when the supply cannot track dew point.
• Assign by class, not by proximity. A skilled person for an energised fan module, trained personnel for water, a trained service technician for the assembly, and the OEM's own engineer if the coil itself is the fault.
• Count the people and the kit. Three for an IBM or Lenovo door, two for a Vertiv door, a platform ladder for the top hinge, eye protection, absorbent cloth under the door, a 2 litre container to purge and a 6 litre container to drain.
• For any power-down step, write the rack outage into the change window with the lockout that governs the loop, migrate the load, and only then drain. Vertiv says to let the system drain before any work on the chilled-water side.
• After the door is back and the water is flowing, bleed air at the top valve after a few minutes, and put a second bleed on the calendar at one month, which is IBM's schedule.

What closes the job is physical, not administrative. The door is shut with water flowing, the air bleed is done, the leak detector is clear, and the door's exhaust temperature is back to where it sat before the alarm, and until all four are true the rack is still an air-cooled rack living on the room's headroom.

What this cannot do

A service table is not a ride-through figure for your door. The rates above are one experiment on one 15.9 kW rack with 12.7 °C water, and the door-open case has no published time at all, so your number depends on your rack's load, your room's headroom and how much water sits in your loop.

Nothing here takes control authority over any of it. A decision layer that reads the door's contacts and the room's state can say which class of step this is and who may perform it, and it does not close a valve, stop a pump, spin a fan or move a setpoint. A named person isolates the door, a named person approves the rack power-down, and the layer records what they decided and whether the exhaust temperature agreed.

Answered