Burst data center capacity for very large scale workloads

Abstract

In some aspects, techniques may include monitoring a primary load of a data center and a reserved load of the data center. The primary load and the reserved load may be monitored by the computing device. A primary load of the data center may be configured to be powered by one or more primary generator sets having a primary capacity, and a reserved load of the data center may be configured to be powered by one or more reserved generator sets having a reserved capacity. Moreover, the technique may include detecting that a primary load of the data center exceeds a primary capacity. Further, the technique may include connecting the reserved genset to at least one of the primary genset and the primary load using the computing device switch.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Application No. 17 / 903,924, filed on September 6, 2022, entitled “BURST DATACENTER CAPACITY FOR HYPERSCALE WORKLOADS,” and U.S. Application No. 18 / 074,332, filed on December 2, 2022, entitled “BURST DATACENTER CAPACITY FOR HYPERSCALE WORKLOADS,” the disclosures of which are incorporated herein by reference in their entirety for all purposes. Background Art

[0003] Power generation can be a limiting factor in building a data center or increasing data center capacity. Data centers are built with redundant power systems to ensure high server availability. However, this redundant power capacity is rarely used. Thus, there is unused data center power capacity, and improvements in data center design are desired. Summary of the invention

[0004] A system of one or more computers may be configured to perform specific operations or actions by virtue of having software, firmware, hardware, or a combination thereof installed on the system, which, when operated, causes the system to perform the actions. One or more computer programs may be configured to perform specific operations or actions by virtue of including instructions that, when executed by a data processing device, causes the device to perform the actions.

[0005] In one general aspect, a computer-implemented method may include monitoring a primary load of a data center and a reserved load of the data center. The monitoring may be performed by a computing device. The primary load of the data center may be configured to be powered by one or more primary generator sets and one or more reserved generator sets. The reserved load of the data center may be configured to be powered by the reserved generator sets. The primary generator sets may have a primary capacity, and one or more reserved generator sets may have a reserved capacity. The method may include using a computing device to detect that the primary load of the data center exceeds the primary capacity. The method may include using a switch to connect the reserved generator set to at least one of the primary generator set and the primary load. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0006] Implementations may include one or more of the following features. A method wherein connecting a reserved generator set may further include: disconnecting a reserved load from the reserved generator set. The reserved load may be disconnected by a circuit breaker controlled by a computing device. A method wherein the reserved load is disconnected if the combined load exceeds the combined capacity. The combined load may include a primary load and a reserved load. The combined capacity may include a primary capacity and a reserved capacity. A method wherein power is supplied to the reserved load via one or more reserved generator sets and a utility power connection, wherein the utility power connection provides power to at least half of the reserved load. A method wherein detecting whether a primary load exceeds a primary capacity may include determining whether a primary generator set fails. A method wherein a primary load has 99.999% availability. A method wherein a reserved load has 99.9% availability. Implementations of the described technology may include hardware, methods, or processing or computer tangible media.

[0007] In one general aspect, a system may include a non-transitory computer-readable medium storing computer-executable program instructions. The system may include a processing device communicatively coupled to the non-transitory computer-readable medium to execute the computer-executable program instructions, wherein executing the computer-executable program instructions configures the processing device to perform operations, which may include: monitoring a primary load and a reserved load of a data center. The primary load of the data center may be powered by one or more primary generator sets having a primary capacity. The reserved load of the data center may be configured to be powered by one or more reserved generator sets having a reserved capacity. The instructions may include detecting that the primary load of the data center exceeds the primary capacity. The instructions may include connecting the reserved generator set to at least one of the primary generator set and the primary load. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0008] In one general aspect, a non-transitory computer-readable storage medium storing computer-executable program instructions may include monitoring a primary load and a reserved load of a data center. The primary load of the data center is powered by one or more primary generator sets having a primary capacity, and the reserved load of the data center is powered by one or more reserved generator sets having a reserved capacity. The instructions may include detecting, by a computing device, that the primary load of the data center exceeds the primary capacity. The instructions may include connecting the reserved generator set to at least one of the primary generator set and the primary load using a switch controlled by the computing device. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a schematic diagram of a group redundant power architecture during normal operation according to an embodiment.

[0010] Figure 2 is a schematic diagram of a group redundant power architecture during a failure scenario according to an embodiment.

[0011] Figure 3 is a schematic diagram of a capacity harvesting power architecture during normal operation according to an embodiment.

[0012] Figure 4 is a schematic diagram of a capacity harvesting power architecture during a fault scenario according to an embodiment.

[0013] Figure 5 is a schematic diagram of a method for disconnecting a reserved load from a reservation group according to an embodiment.

[0014] Figure 6 is a block diagram illustrating one mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0015] Figure 7 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0016] Figure 8 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0017] Fig. 9 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0018] Fig.10 is a block diagram illustrating an example computer system in accordance with at least one embodiment. DETAILED DESCRIPTION

[0019] In the following description, various embodiments will be described. For the purpose of explanation, specific configurations and details are set forth in order to provide a thorough understanding of the embodiments. However, it will be clear to those skilled in the art that the embodiments may be practiced without the specific details. In addition, well-known features may be omitted or simplified to avoid obscuring the described embodiments.

[0020] Data centers are designed to minimize interruptions in server availability. Systems within a data center are often designed with redundancy so that failure of a single component does not cause an interruption in service. For example, backup generator sets can supplement the power supplied to the servers in the data center from the connection to the local grid. In addition, a certain percentage of the generator sets are "reserve" or backup generator sets that may not be connected to the load under normal operating conditions. Thus, the reserve generator sets can supply power to the servers even if the grid and the "primary" or non-backup generator sets fail.

[0021] Redundant data center designs are wasteful, and redundant systems often sit idle with capacity not being used. For example, a reserve generator set may only be started in the rare event that the other two power sources are unavailable. Such a reserve generator set may be required to supply power to a load for less than nine hours in a typical year. The accepted industry standard is that the load should be available 99.999% of the time and have less than six minutes of downtime per year.

[0022] Some time-sensitive, high-priority workloads may require this industry standard, known as five-nines availability, but in some situations this standard may be too high. For example, a server that processes a company's payroll, which may need to be completed within a few days, may not require five-nines availability because a delay in availability of a few minutes will not be noticed by customers.

[0023] In addition, five nines (e.g., 99.999%) availability standards are based on assumptions about server downtime using outdated technology. For example, the latest Institute of Electrical and Electronics Engineers (IEEE) five nines standard (e.g., IEEE Standard 3006.7, IEEE Recommended Practice for Determining the Reliability of 7x24 Continuous Power Systems in Industrial and Commercial Facilities) was published in 2013. The calculations in the 3006.7 standard are based on the reliability of power system equipment (such as generators and uninterruptible power supplies (UPS)) from 2013. Improvements in technology since the standard was updated may mean that the time a generator set needs to be reserved may even be less than the approximately nine hours per year recommended by the standard.

[0024] Thus, the data center reserved generator set is an expensive resource that is rarely used. The reserved group can be used to provide backup power for the reserved load under a reduced availability standard (such as three nines or 99.9% availability). This reserved load can be a two-line opportunistic load connected to the utility power and the reserved generator set. If the primary load exceeds the capacity of the primary generator set, the reserved load can be disconnected and the reserved generator set can provide power to the primary load. For example, if a component in the primary generator set fails, the primary load will exceed the capacity of the primary generator set. The reserved load can be disconnected from the reserved generator and will continue to receive power unless the utility power connection fails.

[0025] In an illustrative example, the primary load is connected to five primary generator sets, and the service level agreement stipulates that the availability is five nines. In the event of a failure of a primary generator set, the primary load of the failed group can be transferred to the reserved generator set via a switch. Each generator set includes a utility connection, a generator, and a battery that provides power to the load when the generator is activated (called an uninterruptible power supply (UPS)). The reserved load is connected to the reserved power group through a circuit breaker, and the reserved load is also connected to the local power grid through the utility power connection.

[0026] Continuing with the example, the primary load experiences a drop in power because utility power to the primary generator set is interrupted. The primary generator set attempts to provide backup power to the primary load, but the UPS of the group cannot be activated. The power supplied by the failed generator set begins to drop, and a switch, called a static transfer switch (STS), detects the drop in power from the group. In response, the STS disconnects the primary generator set and connects the reserve generator to the load primary load, and the reserve group UPS provides power until the reserve generator starts.

[0027] The reserve generator set attempts to supply power to both the reserve load and the primary load, but the combined load exceeds the capacity of the reserve generator set. To ensure that the primary load continues to receive power, the circuit breaker opens, disconnecting the reserve load from the reserve generator set so that power from the reserve generator set can be supplied to the primary load.

[0028] Figure 1 1 is a schematic diagram of a group redundant power architecture 100 during normal operation according to an embodiment. The architecture may be part of a group redundant (BR) architecture. Under normal operating conditions, a primary generator set 105 provides power to a load (or loads) 110 using a connection 115 to utility power. Figure 1-Figure 4The switches in the diagram (such as switch 120) are shown in an open position, but this is primarily to illustrate the presence of switches at specific locations and should not be interpreted as showing an open or closed connection. Instead, switch 120 and any other switches shown herein can be opened or closed, and can be controlled to change from open to closed or from closed to open. Normal operating conditions may include an interruption of utility power, and if utility power is interrupted, then in addition to the uninterruptible power supply (UPS) 130, the primary generator set may also use (one or more) generators 125 to provide power to (one or more) loads 110. The load (such as (one or more) loads 110) may be one or more electronic or computing devices. For example, (one or more) loads 110 may include server computers, personal computers, storage devices, networking devices, cooling equipment, fans, environmental monitors, etc. Under normal operating conditions, (one or more) loads 110 should not exceed the capacity of the generator set 105.

[0029] (One or more) UPS130 is an electronic device that can provide emergency power after detecting the interruption of utility power. The primary generator set can have one or more UPS 130 and one or more generators 125. Emergency power can be power supplied by (one or more) UPS 130 in a short time (e.g., 25 milliseconds or less). One or more batteries in (one or more) UPS130 can supply emergency power to (one or more) loads 110 when (one or more) generators 125 are activated. The ready time or the time to activate (one or more) generators 125 can be between ten seconds and fifteen seconds. In addition to providing emergency power, (one or more) UPS130 is also a conduit for power from a utility. Moreover, problems with utility power can be solved by (one or more) UPS 130, and for example, voltage spikes, voltage sags, noise, etc. can be corrected by (one or more) UPS130.

[0030] The BR power architecture may include one or more reserved (R) groups 135. Unless a primary generator set 105 fails, the R group 135 will not be active, and the R group 135 may be connected to a static transfer switch (STS) 140 without providing power to the load (s) 110. The STS 140 may be an electronic device that can transfer power from a primary power source to an alternative power source in a short time (e.g., 4 milliseconds). If the power from the primary power source (e.g., the power source that provides power through the STS) drops below a threshold, the STS 140 may switch to the alternative power source. The load (s) 110 may be connected to the STS 140 via a switchboard (SWB) 145, which may distribute power to the load (s) 110. The primary generator set 105 (such as the A group 150, the B group 155, or the C group 160) may be connected to one or more loads, and the SWB 145 may distribute power to the one or more loads. For example, SWB 145 can be used to disconnect power to a server (e.g., power off the server) in order to perform maintenance on the server. Although architecture 100 shows three primary generator sets 105 and one R set 135, other configurations are contemplated, such as configurations with a ratio of primary generator sets to reserve sets of 3:1, 5:1, 7:1, 12:1.

[0031] Figure 2200 is a schematic diagram of a group redundant power architecture during a failure scenario according to an embodiment. As described above, the primary generator set 205 provides power to the (one or more) loads 210 under normal operating conditions. A utility power failure may be a normal operating condition, and a failure condition may be when a primary generator set in the primary generator set 205 is unable to provide power to the (one or more) loads 210. A failure condition may be when the utility power supplied via the utility power connection 215 is interrupted and the (one or more) generators 225 or the (one or more) UPS 230 are unable to provide emergency power from one or more of the primary generator sets 205. A failure condition occurs if there is a failure of one of the following items for one of the primary groups 205: 1) the utility power connection 215 and the (one or more) generators 225; 2) the utility power connection 215 and the (one or more) UPS 230; 3) (one or more) UPS 230. If the utility power connection 215 fails, but the UPS(s) 230 and the generator(s) 225 are operational, the UPS(s) 230 may obtain its power from the generator(s) 225. If the generator(s) 225 fail, but the UPS(s) 230 and the utility power connection 214 are operational, the UPS(s) 230 may continue to supply power without diverting from the utility power connection 215.

[0032] When a primary generator set 205 fails (e.g., a fault condition occurs), the R set 235 can be activated to ensure that power is maintained to the load(s) 210. The R set 235 can supply emergency power to the load(s) 210 via the utility power connection 215, or the R set 235 can be activated by providing emergency power to the load(s) 210 from the generator(s) 225. If there is a delay in the power supplied by the generator(s) 225, then the emergency power can be supplied to the load(s) 210 by the UPS(s) 230. For example, the generator(s) 225 may be unable to supply power during the startup process.

[0033] The STS(s) 240 may detect that a primary generator set (such as the A set 250, the B set 255, or the C set 260) is no longer supplying power to the load(s) 210. For example, the schematic 200 shows a black "X" indicating that the A set 250 has failed. The STS(s) 240 detects a drop in power supplied by the A set 250, and the STS(s) 240 switches from connection with the A set 250 to connection with the R set 235 (e.g., a dotted line connection). The R set may supply power to the load(s) 210 until the failed set (in this case, the A set 250) returns to service and resumes supplying power to the load(s) 210. The R set 235 may supply power to the load(s) 210 during a fault condition, which may include a component damage or failure that renders the A set 250 inoperable, or scheduled maintenance of the A set 250.

[0034] Figure 3 3 is a schematic diagram of a capacity harvesting power architecture 300 during normal operation according to an embodiment. The architecture 300 may include primary generator groups 305 that supply power to load(s) 310, and a reserved (R) group 315 that may supply power to reserved (R) load(s) 320. Although the architecture 300 shows three primary groups 305 and one R group 315, other configurations are contemplated, such as configurations with a primary group to reserved group ratio of 3:1, 5:1, 7:1, 12:1.

[0035] The primary generator set 305 and the reserved set 315 may supply utility power to the load(s) 310 or the R-load(s) 320 via the UPS(s) 325. If utility power to the primary generator set is interrupted, then during the delay between activating the generator(s) 330 and the generator(s) being able to supply sufficient power to support the load(s), the UPS(s) 325 may supply emergency power to the load(s) 310 or the R-load(s) 320. For example, it may take several seconds for the turbine in the generator(s) 330 to reach sufficient speed to generate electricity.

[0036] During normal operation, the primary generator sets 305 (including the A set 335, the B set 340, and the C set 345) can supply power to the load(s) 310, and the R set 315 can supply power to the R load(s) 320. The load(s) 310 can be a high availability load that, together with the R set 315, provides 99.999% uptime (e.g., "five nines" availability) over a given period of time. The primary generator sets 305 can provide 99.999% availability because if one of the primary generator sets 305 fails, the R set 315 can provide power. A system with an uptime of 99.999% should have an annual downtime of 5.26 minutes or less. Standards for commercial power systems that can provide "five nines" availability are defined, for example, in "IEEE Recommended Practice for the Design of Reliable Industrial and Commercial Power Systems" in IEEE Std 493-2007 (a revision of IEEE Std 493-1997), Vol. 1-383, June 25, 2007, doi: 10.1109 / IEEESTD.2007.380668.

[0037] (One or more) R loads 320 may have lower availability than (one or more) loads 310. For example, (one or more) R loads 320 may have 99.99%, 99.9% or 99% availability. Under normal operation, power is supplied to (one or more) R loads via utility power connection 350 and (e.g., via (one or more) UPS 325) through the utility power connection of R group 315. 50% of (one or more) R loads 320 may be supplied by R group 315, and the remaining 50% may be supplied by utility power connection 350. R group 315 may supply a greater or lesser proportion of power delivered to (one or more) R loads 320 (e.g., 5%, 25%, 45%, 55%, 75%, 95% of the power supplied to (one or more) R loads). During normal operation, if R group 315 fails, utility power connection 350 may supply all power to (one or more) R loads 320. If the utility power connection 350 fails, the R-group 315 may supply all power to the R-load(s) 320 .

[0038] Figure 44 is a schematic diagram of a capacity harvesting power architecture 400 during a failure scenario according to an embodiment. A failure scenario occurs when one of the primary generator sets 405 fails. A primary generator set (such as set A 410, set B 415, or set C 420) may fail when either the UPS(s) 425 or the generator(s) 430 fail and the Tx 417 fails. (Not specified, but perhaps we call it Tx 412, 417, 422 - in this case the failure of Tx 417). In the architecture 400, set B 415 is shown as a black "X" to indicate that the set has failed, but a failure scenario may occur when any of the primary sets fails. A failure scenario occurs when there is a drop in the power supplied by the primary generator set 405 to the load(s) 435, and may occur, for example, when one or more generators in the primary generator set and the Tx or UPS(s) fail.

[0039] If one of the primary generator sets 405 fails and one or more STS 455 switches from primary power to reserve (R) power, the R group 440 can be disconnected from one or more of the (one or more) R loads 445. When one of the primary groups 405 fails, the (one or more) R loads can be disconnected. The primary power can be supplied by one of the primary generator sets 405, and the reserve power can be supplied by the reserve group (440). The (one or more) R loads 445 can be disconnected from the R group 440 by a circuit breaker (e.g., circuit breaker 450). If the sum of the (one or more) loads 435 and the (one or more) R loads 445 on the primary generator set 405 exceeds the capacity of the R group 440, the circuit breaker 450 can disconnect the R group 440 from the (one or more) R loads 445. If one of the primary generator sets 504 fails, then the circuit breaker 450 may disconnect one or more of the R-load(s) 445 if the combined load(s) 435, 445 exceeds the capacity of the available set (e.g., primary generator set 405, R-set 440). If the sum of the load(s) 435 and the R-load(s) 445 of one of the primary generator sets 405 (e.g., A-set 410, B-set 415, or C-set 420) exceeds the capacity of the R-set 445, then the circuit breaker 450 may disconnect the R-set 440 from the R-load(s) 445. If a threshold number of STS(s) 455 switch from primary power to R power (e.g., 2 or more STS switch to reserve power), then the circuit breaker 450 may disconnect the R-set 440 from the R-load(s) 445.

[0040] The computing device 460 may control the circuit breaker 450 to disconnect (one or more) R loads 445 from the R group 440, or to connect (one or more) R loads 445 to the R group 440. In some embodiments, the computing device 460 may be an industrial control system implemented in hardware rather than software. For example, the industrial control system may be a hardware-implemented control system that can disconnect the R group at any time when one of the primary generator sets 405 fails. The circuit breaker 450 may be controlled based on a signal from (one or more) STS 455, and, for example, the signal may indicate whether (one or more) STS 455 is connected to primary power or reserved (R) power. If one or more of (one or more) STS 455 or a threshold number of (one or more) STSs have switched to R power (e.g., have switched to receive power from the R group 440), then the computing device 460 may open the circuit breaker 450. Other techniques for determining whether the circuit breaker 450 should be opened are contemplated. For example, the voltage, current, resistance, or inductance between the primary generator set 405 and the load(s) 435 may be measured to determine whether the circuit breaker 450 should be opened (e.g., to determine whether the primary generator set 405 is providing sufficient power to the load(s) 435).

[0041] If the computing device 460 determines that the R group 440 does not need to supply power to the (one or more) loads 435, the computing device may close the circuit breaker 450. For example, the circuit breaker 450 may have been opened by the computing device 460 because the (one or more) UPS 425 in the B group 415 failed, and the circuit breaker 450 was closed by the computing device 460 after the B group 415 returned to service. The computing device 460 may be a programmable logic device, a personal computer, a system on a chip, a single board computer (SBC), a field programmable gate assembly (FPGA), an integrated circuit, a programmable logic circuit (PLC), etc.

[0042] Figure 5 is a schematic diagram of a method for disconnecting a reserved load from a reserved group according to an embodiment. This method is illustrated as a logical flow diagram, each operation of which can be implemented in hardware, computer instructions, or a combination thereof. In the context of computer instructions, an operation may represent a computer-executable instruction stored on one or more computer-readable storage media, which performs the operation when executed by one or more processors. In general, computer-executable instructions include routines, programs, objects, components, data structures, etc. that perform a specific function or implement a specific data type. The order in which the operations are described is not intended to be construed as a limitation, and any number of the described operations may be combined in any order and / or in parallel to implement a process or method.

[0043] Turning to method 500 in more detail, at box 510, the primary load and the reserved load of the data center can be monitored. The primary load can be load(s) 110, 210, 310, 435, and the reserved load can be R-load(s) 320, 445. The primary load and the reserved load can be monitored by a computing device 460. For example, the computing device 460 can receive an output from an STS(s) (such as STS(s) 140, 240, 455) indicating whether the STS(s) are connected to power from a primary group (e.g., 105, 205, 305, 405) or a reserved group (such as reserved group 135, 235, 315, 440). The STS(s) can provide information about the current flowing through the STS(s) to the computing device 460, and the information can be used to monitor the primary load. Generator(s) 125, 225, 330, 430, UPS(s) 130, 230, 325, 425, or circuit breaker 450 may provide information about power provided to a primary load or a reserved load to a computing device, and computing device 460 may use the provided information to monitor the primary load or the reserved load.

[0044] At box 520, it can be determined whether the primary load of the data center exceeds the primary capacity. The primary capacity can be the power generation capacity of one or more of the primary generator sets 105, 205, 305, 405. The primary capacity of the primary group can be the sum of the capacities of (one or more) generators 125, 225, 330, 430 in one of the primary generator sets 102, 205, 305, 405. The reserved capacity of the reserved group can be the sum of the capacities of (one or more) generators 125, 225, 330, 430 in the R group 135, 235, 315, 440. When the power through the STS drops below a threshold, (one or more) STS140, 240, 455 can determine that the primary load has exceeded the primary capacity. The power through the STS can be the power provided by one or more of the primary generator sets.

[0045] At box 530, the reserved generator set can be connected to at least one of the primary load or the primary generator set. The primary load can receive power from both the primary generator set and the reserved generator set. If one or more primary generator sets connected to the primary load cannot supply enough power to the primary load to keep the primary load operational, the reserved set can be connected to the primary load. The primary load or the reserved load may include a server computer, a personal computer, a storage device, a networking device, a cooling device, a fan, an environmental monitor, etc.

[0046] (One or more) STS140, 240, 455 can connect the reserved generator set to the primary load by switching from the connection with the primary generator set to the connection with the reserved generator set. The generator set (such as the primary generator set 105, 205, 305, 405 or the R group 135, 235, 315, 440) can be connected to the load through (one or more) STS. For example, the generator set can contain multiple generators, and each generator in the group can be connected to the load through the STS. Some or all of (one or more) STS can be switched to allow a portion of the load to be transferred from one generator set to a different group.

[0047] Connecting the reserved generator set may include disconnecting the reserved load from the reserved generator set. The reserved load may be disconnected by a circuit breaker (such as circuit breaker 450), which may be controlled by or as part of a computing device 460. After the load is disconnected from the reserved group, the utility power connection 115, 215, 350 may supply power to the reserved load. If the load of the combination of the primary load and the reserved load connected to the reserved group does not exceed the combined generation capacity of the primary generator set and the reserved group connected to the primary load (e.g., if the reserved group has enough spare capacity to support the reserved load), then the computing device 460 may close the circuit breaker 450 and restore the connection between the reserved load and the reserved group. The reserved group may be connected to one or more reserved loads by one or more circuit breakers, and the reserved group may be reconnected to some or all of (one or more) reserved loads. If a primary group that cannot operate due to component failure or maintenance can resume power generation, then the reserved group may be reconnected. The reserved load may have different layers, wherein the lower level layers are disconnected before the higher level layers. The reserved loads may be reconnected to power with higher level tiers being reconnected before lower level tiers. The tiers may be based on priority or a service level agreement (SLA) with lower level tiers having lower priority and higher level tiers having higher priority.

[0048] Infrastructure as a Service (IaaS) is a specific type of cloud computing. IaaS can be configured to provide virtualized computing resources over a public network (e.g., the Internet). In the IaaS model, a cloud computing provider can host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), etc.). In some cases, IaaS providers can also offer various services to accompany those infrastructure components (e.g., billing, monitoring, logging, security, load balancing, and clustering, etc.). Therefore, because these services can be policy-driven, IaaS users can be able to implement policies to drive load balancing to maintain application availability and performance.

[0049] In some cases, IaaS customers can access resources and services over a wide area network (WAN) such as the Internet, and can use the cloud provider's services to install the remaining elements of the application stack. For example, a user can log in to the IaaS platform to create a virtual machine (VM), install an operating system (OS) on each VM, deploy middleware such as a database, create storage buckets for workloads and backups, and even install enterprise software to that virtual machine. The customer can then use the provider's services to perform a variety of functions, including balancing network traffic, troubleshooting application problems, monitoring performance, managing disaster recovery, and so on.

[0050] In most cases, the cloud computing model will require the involvement of a cloud provider. A cloud provider may, but need not, specialize in (e.g., provide, lease, sell) IaaS third-party services. An entity may also choose to deploy a private cloud and become its own infrastructure service provider.

[0051] In some examples, IaaS deployment is the process of placing a new application or a new version of an application onto a prepared application server, etc. It may also include the process of preparing the server (e.g., installing libraries, daemons, etc.). This is typically managed by the cloud provider, below the hypervisor layer (e.g., servers, storage, network hardware, and virtualization). Thus, the customer may be responsible for handling (OS), middleware, and / or application deployment (e.g., on a self-service virtual machine (e.g., that can be started on demand), etc.).

[0052] In some examples, IaaS provisioning can refer to obtaining computers or virtual hosts for use, and even installing required libraries or services on them. In most cases, deployment does not include provisioning, and provisioning may need to be performed first.

[0053] In some cases, there are two different challenges with IaaS provisioning. First, there is the initial challenge of provisioning the initial set of infrastructure before anything is running. Second, after everything has been provisioned, there is the challenge of evolving the existing infrastructure (e.g., adding new services, changing services, removing services, etc.). In some cases, both of these challenges can be addressed by enabling configuration that defines the infrastructure in a declarative manner. In other words, the infrastructure (e.g., which components are required and how they interact) can be defined by one or more configuration files. Therefore, the overall topology of the infrastructure (e.g., which resources depend on which resources, and how they work together) can be described in a declarative manner. In some cases, once the topology is defined, workflows can be generated to create and / or manage the different components described in the configuration files.

[0054] In some examples, the infrastructure can have many interconnected elements. For example, there may be one or more virtual private clouds (VPCs) (e.g., a potential on-demand pool of configurable and / or shared computing resources), also referred to as a core network. In some examples, one or more security group rules can also be provided to define how to set up the security of the network and one or more virtual machines (VMs). Other infrastructure elements, such as load balancers, databases, etc., can also be provided. The infrastructure can evolve gradually as more and more infrastructure elements are desired and / or added.

[0055] In some cases, continuous deployment techniques can be employed to enable deployment of infrastructure code across various virtual computing environments. In addition, the described techniques can enable infrastructure management within these environments. In some examples, a service team can write code that is expected to be deployed to one or more but typically many different production environments (e.g., across various different geographic locations, sometimes across the world). However, in some examples, the infrastructure on which the code will be deployed must first be set up. In some cases, provisioning can be done manually, resources can be provisioned using a provisioning tool, and / or code can be deployed using a deployment tool once the infrastructure is provisioned.

[0056] Figure 6 6 is a block diagram 600 illustrating an example mode of an IaaS architecture according to at least one embodiment. A service operator 602 can be communicatively coupled to a secure host lease 604 that can include a virtual cloud network (VCN) 606 and a secure host subnet 608. In some examples, the service operator 602 can use one or more client computing devices, which can be portable handheld devices (e.g., Cellular phone, computing tablets, personal digital assistants (PDAs), or wearable devices (e.g. head mounted display), running software (such as Microsoft Windows ) and / or various mobile operating systems (such as iOS, Windows Phone, Android, BlackBerry8, Palm OS, etc.), and supports Internet, email, short message service (SMS), or other communication protocols. Alternatively, the client computing device may be a general-purpose personal computer, including, for example, a computer running various versions of Microsoft Apple The client computing device may be a personal computer and / or laptop computer running various commercially available The client computing device may be a workstation computer running any of a variety of GNU / Linux operating systems (such as, for example, Google Chrome OS). Alternatively or additionally, the client computing device may be any other electronic device, such as a thin client computer, an Internet-enabled gaming system (e.g., with or without gesture input device), and / or a personal messaging device capable of communicating over a network that can access VCN 606 and / or the Internet.

[0057] VCN 606 may include a local peer gateway (LPG) 610, which may be communicatively coupled to a secure shell (SSH) VCN 612 via LPG 610 contained in SSH VCN 612. SSH VCN 612 may include an SSH subnet 614, and SSH VCN 612 may be communicatively coupled to a control plane VCN 616 via LPG 610 contained in control plane VCN 616. Also, SSH VCN 612 may be communicatively coupled to a data plane VCN 618 via LPG 610. Control plane VCN 616 and data plane VCN 618 may be contained in a service lease 619, which may be owned and / or operated by an IaaS provider.

[0058] The control plane VCN 616 may include a control plane demilitarized zone (DMZ) layer 620, which acts as a perimeter network (e.g., a portion of a company network between a company intranet and an external network). DMZ-based servers may have limited liability and help control security vulnerabilities. In addition, the DMZ layer 620 may include one or more load balancer (LB) subnets 622, a control plane application layer 624 that may include (one or more) application subnets 626, and a control plane data layer 628 that may include (one or more) database (DB) subnets 630 (e.g., (one or more) front-end DB subnets and / or (one or more) back-end DB subnets). The LB subnet(s) 622 included in the control plane DMZ layer 620 may be communicatively coupled to the application subnet(s) 626 included in the control plane application layer 624 and the internet gateway 634 that may be included in the control plane VCN 616, and the app subnet(s) 626 may be communicatively coupled to the DB subnet(s) 630 included in the control plane data layer 628 as well as the service gateway 636 and the network address translation (NAT) gateway 638. The control plane VCN 616 may include the service gateway 636 and the NAT gateway 638.

[0059] The control plane VCN 616 may include a data plane mirror application layer 640, which may include application subnet(s) 626. The application subnet(s) 626 included in the data plane mirror application layer 640 may include a virtual network interface controller (VNIC) 642 that may execute a compute instance 644. The compute instance 644 may communicatively couple the application subnet(s) 626 of the data plane mirror application layer 640 to the application subnet(s) 626 that may be included in the data plane application layer 646.

[0060] The data plane VCN 618 may include a data plane application layer 646, a data plane DMZ layer 648, and a data plane data layer 650. The data plane DMZ layer 648 may include (one or more) LB subnets 622, which may be communicatively coupled to the (one or more) application subnets 626 of the data plane application layer 646 and the Internet gateway 634 of the data plane VCN 618. The (one or more) application subnets 626 may be communicatively coupled to the service gateway 636 of the data plane VCN 618 and the NAT gateway 638 of the data plane VCN 618. The data plane data layer 650 may also include (one or more) DB subnets 630, which may be communicatively coupled to the (one or more) application subnets 626 of the data plane application layer 646.

[0061] The internet gateway 634 of the control plane VCN 616 and the data plane VCN 618 may be communicatively coupled to a metadata management service 652, which may be communicatively coupled to a public Internet 654. The public Internet 654 may be communicatively coupled to a NAT gateway 638 of the control plane VCN 616 and the data plane VCN 618. The service gateway 636 of the control plane VCN 616 and the data plane VCN 618 may be communicatively coupled to a cloud service 656.

[0062] In some examples, service gateway 636 of control plane VCN 616 or data plane VCN 618 can make application programming interface (API) calls to cloud services 656 without traversing public Internet 654. API calls from service gateway 636 to cloud services 656 can be one-way: service gateway 636 can make API calls to cloud services 656, and cloud services 656 can send requested data to service gateway 636. However, cloud services 656 may not initiate API calls to service gateway 636.

[0063] In some examples, secure host lease 604 can be directly connected to service lease 619, otherwise the service lease can be isolated. Secure host subnet 608 can communicate with SSH subnet 614 through LPG 610, which can enable two-way communication through otherwise isolated systems. Connecting secure host subnet 608 to SSH subnet 614 can enable secure host subnet 608 to access other entities within service lease 619.

[0064] The control plane VCN 616 may allow a user of a service lease 619 to set up or otherwise provision desired resources. The desired resources provisioned in the control plane VCN 616 may be deployed or otherwise used in the data plane VCN 618. In some examples, the control plane VCN 616 may be isolated from the data plane VCN 618, and the data plane mirror application layer 640 of the control plane VCN 616 may communicate with the data plane application layer 646 of the data plane VCN 618 via a VNIC 642 that may be included in the data plane mirror application layer 640 and the data plane application layer 646.

[0065] In some examples, a user or customer of the system may issue a request, such as a create, read, update, or delete (CRUD) operation, over the public internet 654, which may transmit the request to the metadata management service 652. The metadata management service 652 may transmit the request to the control plane VCN 616 via the internet gateway 634. The request may be received by the LB subnet(s) 622 contained in the control plane DMZ layer 620. The LB subnet(s) 622 may determine that the request is valid, and in response to this determination, the LB subnet(s) 622 may transmit the request to the application subnet(s) 626 contained in the control plane application layer 624. If the request is validated and requires a call to the public internet 654, the call to the public internet 654 may be transmitted to the NAT gateway 638, which may make the call to the public internet 654. The storage that the request may desire to be stored may be stored in the DB subnet(s) 630.

[0066] In some examples, data plane mirror application layer 640 may facilitate direct communications between control plane VCN 616 and data plane VCN 618. For example, it may be desired that changes, updates, or other suitable modifications to a configuration be applied to resources contained in data plane VCN 618. Control plane VCN 616, via VNIC 642, may communicate directly with resources contained in data plane VCN 618 and may thereby perform changes, updates, or other suitable modifications to the configuration on the resources.

[0067] In some embodiments, control plane VCN 616 and data plane VCN 618 may be included in service lease 619. In this case, a user or customer of the system may not own or operate control plane VCN 616 or data plane VCN 618. Instead, an IaaS provider may own or operate control plane VCN 616 and data plane VCN 618, both of which may be included in service lease 619. This embodiment may enable isolation of networks, which may prevent a user or customer from interacting with the resources of other users or other customers. Furthermore, this embodiment may allow a user or customer of the system to store a database privately without relying on the public Internet 654, which may not have the desired level of security, for storage.

[0068] In other embodiments, the LB subnet(s) 622 contained in the control plane VCN 616 can be configured to receive signals from the service gateway 636. In this embodiment, the control plane VCN 616 and the data plane VCN 618 can be configured to be called by customers of the IaaS provider without calling the public Internet 654. Customers of the IaaS provider may desire this embodiment because the database(s) used by the customer can be controlled by the IaaS provider and can be stored on the service lease 619, which can be isolated from the public Internet 654.

[0069] Figure 7 700 is a block diagram illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 702 (e.g., Figure 6 The service operator 602) can be communicatively coupled to the secure host lease 704 (e.g., Figure 6 A secure host lease 604 of the embodiment of the present invention may include a virtual cloud network (VCN) 706 (e.g., Figure 6 VCN 606) and secure host subnet 708 (e.g., Figure 6 The VCN 706 may include a local peer gateway (LPG) 710 (e.g., Figure 6 610), which may be communicatively coupled to a secure shell (SSH) VCN 712 via an LPG 610 contained in an SSH VCN 712 (e.g., Figure 6 SSH VCN 712 may include SSH subnet 714 (e.g., Figure 6 SSH subnet 614), and SSH VCN 712 can be communicatively coupled to control plane VCN 716 via LPG 710 included in control plane VCN 716 (e.g., Figure 6The control plane VCN 616 of FIG. 714 ). The control plane VCN 716 may be included in a service lease 719 (e.g., Figure 6 service lease 619), and the data plane VCN 718 (e.g., Figure 6 The data plane VCN 618) may be contained in a customer lease 721 which may be owned or operated by a user or customer of the system.

[0070] The control plane VCN 716 may include a control plane DMZ layer 720 (e.g., Figure 6 The control plane DMZ layer 620 may include (one or more) LB subnets 722 (e.g., Figure 6 (one or more) LB subnets 622); control plane application layer 724 (e.g., Figure 6 , which may include (one or more) application subnets 726 (e.g., Figure 6 (one or more) application subnets 626); control plane data layer 728 (e.g., Figure 6 The control plane data layer 628 of the embodiment of the present invention may include (one or more) database (DB) subnets 730 (e.g., similar to Figure 6 The LB subnet(s) 722 contained in the control plane DMZ layer 720 may be communicatively coupled to the application subnet(s) 726 contained in the control plane application layer 724 and the Internet gateway 734 (e.g., Figure 6 634), and the application subnet(s) 726 may be communicatively coupled to the DB subnet(s) 730 and service gateway 736 (e.g., Figure 6 ) and a network address translation (NAT) gateway 738 (e.g., Figure 6 The control plane VCN 716 may include a service gateway 736 and a NAT gateway 738.

[0071] The control plane VCN 716 may include a data plane mirror application layer 740 (e.g., Figure 6 The data plane image application layer 640 may include (one or more) application subnets 726. The (one or more) application subnets 726 included in the data plane image application layer 740 may include a computing instance 744 (e.g., similar to Figure 6The compute instance 744 may facilitate the application subnet(s) 726 of the data plane mirroring application layer 740 and the application subnets 726 that may be included in the data plane application layer 746 (e.g., Figure 6 Communication between (one or more) application subnets 726 in the data plane application layer 646) via the VNIC 742 contained in the data plane mirror application layer 740 and the VNIC 742 contained in the data plan application layer 746.

[0072] The Internet gateway 734 included in the control plane VCN 716 can be communicatively coupled to the metadata management service 752 (e.g., Figure 6 652), which can be communicatively coupled to the public Internet 754 (e.g., Figure 6 The public Internet 754 can be communicatively coupled to a NAT gateway 738 included in the control plane VCN 716. The service gateway 736 included in the control plane VCN 716 can be communicatively coupled to cloud services 756 (e.g., Figure 6 Cloud service 656).

[0073] In some examples, the data plane VCN 718 may be contained in a customer lease 721. In this case, the IaaS provider may provide a control plane VCN 716 for each customer, and the IaaS provider may provision each customer with a unique compute instance 744 contained in a service lease 719. Each compute instance 744 may allow communication between the control plane VCN 716 contained in the service lease 719 and the data plane VCN 718 contained in the customer lease 721. The compute instance 744 may allow resources provisioned in the control plane VCN 716 contained in the service lease 719 to be deployed or otherwise used in the data plane VCN 718 contained in the customer lease 721.

[0074] In other examples, a customer of the IaaS provider may have a database that exists in the customer tenancy 721. In this example, the control plane VCN 716 may include a data plane mirror application layer 740, which may include (one or more) application subnets 726. The data plane mirror application layer 740 may reside in the data plane VCN 718, but the data plane mirror application layer 740 may not exist in the data plane VCN 718. That is, the data plane mirror application layer 740 may access the customer tenancy 721, but the data plane mirror application layer 740 may not exist in the data plane VCN 718 or be owned or operated by the customer of the IaaS provider. The data plane mirror application layer 740 may be configured to make calls to the data plane VCN 718, but may not be configured to make calls to any entity contained in the control plane VCN 716. A customer may desire to deploy or otherwise use resources in data plane VCN 718 provisioned in control plane VCN 716, and data plane mirror application layer 740 may facilitate the customer's desired deployment or other use of resources.

[0075] In some embodiments, a customer of the IaaS provider may apply filters to the data plane VCN 718. In this embodiment, the customer may determine what the data plane VCN 718 may access, and the customer may restrict access to the public Internet 754 from the data plane VCN 718. The IaaS provider may not apply filters or otherwise control access to any external network or database by the data plane VCN 718. Applying filters and controls by the customer to the data plane VCN 718 contained in the customer lease 721 may help isolate the data plane VCN 718 from other customers and the public Internet 754.

[0076] In some embodiments, cloud services 756 may be called by service gateway 736 to access services that may not exist on the public Internet 754, control plane VCN 716, or data plane VCN 718. The connection between cloud services 756 and control plane VCN 716 or data plane VCN 718 may not be real-time or continuous. Cloud services 756 may exist on different networks owned or operated by IaaS providers. Cloud services 756 may be configured to receive calls from service gateway 736 and may be configured not to receive calls from the public Internet 754. Some cloud services 756 may be isolated from other cloud services 756, and control plane VCN 716 may be isolated from cloud services 756 that may not be in the same region as control plane VCN 716. For example, control plane VCN 716 may be located in "Region 1", and cloud service "Deployment 6" may be located in Region 1 and "Region 2". If a service gateway 736 contained in a control plane VCN 716 located in region 1 makes a call to deployment 6, the call may be transmitted to deployment 6 in region 1. In this example, control plane VCN 716 or deployment 6 in region 1 may not be communicatively coupled or otherwise in communication with deployment 6 in region 2.

[0077] Figure 8 8 is a block diagram 800 illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 802 (e.g., Figure 6 The service operator 602) can be communicatively coupled to the secure host lease 804 (e.g., Figure 6 A secure host lease 604 of the embodiment of the present invention may include a virtual cloud network (VCN) 806 (e.g., Figure 6 VCN 606) and secure host subnet 808 (e.g., Figure 6 VCN 806 may include LPG 810 (e.g., Figure 6 810 ), which may be communicatively coupled to the SSH VCN 812 via the LPG 810 contained in the SSH VCN 812 (e.g., Figure 6 SSH VCN 812). SSH VCN 812 may include SSH subnet 814 (e.g., Figure 6 SSH subnet 614), and SSH VCN 812 may be communicatively coupled to control plane VCN 816 via LPG 810 contained in control plane VCN 816 (e.g., Figure 6 The control plane VCN 616 of FIG. 814 is coupled to the data plane VCN 818 (eg, the control plane VCN 616 of FIG. 814 ) via the LPG 810 included in the data plane VCN 818. Figure 6The control plane VCN 816 and the data plane VCN 818 may be included in a service lease 819 (e.g., Figure 6 of service lease 619).

[0078] The control plane VCN 816 may include a control plane DMZ layer 820 (e.g., Figure 6 The control plane DMZ layer 620 of the present invention may include (one or more) load balancer (LB) subnets 822 (e.g., Figure 6 (one or more) LB subnets 622); control plane application layer 824 (e.g., Figure 6 ), which may include (one or more) application subnets 826 (e.g., similar to Figure 6 (one or more) application subnets 626); control plane data layer 828 (e.g., Figure 6 The control plane data layer 628 of the control plane data layer may include (one or more) DB subnets 830. The (one or more) LB subnets 822 included in the control plane DMZ layer 820 may be communicatively coupled to (one or more) application subnets 826 included in the control plane application layer 824 and an Internet gateway 834 (e.g., Figure 6 824), and the application subnet(s) 826 may be communicatively coupled to the DB subnet(s) 830 and the service gateway 836 (e.g., Figure 6 ) and a network address translation (NAT) gateway 838 (e.g., Figure 6 The control plane VCN 816 may include a service gateway 836 and a NAT gateway 838.

[0079] The data plane VCN 818 may include a data plane application layer 846 (e.g., Figure 6 Data plane application layer 646), data plane DMZ layer 848 (e.g., Figure 6 The data plane DMZ layer 648), and the data plane data layer 850 (e.g., Figure 6The data plane DMZ layer 848 may include (one or more) LB subnets 822 that may be communicatively coupled to the (one or more) trusted application subnets 860 and (one or more) untrusted application subnets 862 of the data plane application layer 846 and the Internet gateway 834 included in the data plane VCN 818. The (one or more) trusted application subnets 860 may be communicatively coupled to the service gateway 836 included in the data plane VCN 818, the NAT gateway 838 included in the data plane VCN 818, and the (one or more) DB subnets 830 included in the data plane data layer 850. The (one or more) untrusted application subnets 862 may be communicatively coupled to the service gateway 836 included in the data plane VCN 818 and the (one or more) DB subnets 830 included in the data plane data layer 850. Data plane data layer 850 may include (one or more) DB subnets 830, which may be communicatively coupled to a service gateway 836 included in the data plane VCN 818.

[0080] The untrusted application subnet(s) 862 may include one or more primary VNICs 864(1)-(N) that may be communicatively coupled to tenant virtual machines (VMs) 866(1)-(N). Each tenant VM 866(1)-(N) may be communicatively coupled to a respective application subnet 867(1)-(N) that may be contained in a respective container egress VCN 868(1)-(N), which may be contained in a respective customer tenancy 870(1)-(N). A respective secondary VNIC 872(1)-(N) may facilitate communications between the untrusted application subnet(s) 862 contained in the data plane VCN 818 and the application subnets contained in the container egress VCN 868(1)-(N). Each container egress VCN 868(1)-(N) may include a NAT gateway 838 that may be communicatively coupled to the public Internet 854 (e.g., Figure 6 of the public Internet 654).

[0081] The Internet gateway 834 included in the control plane VCN 816 and included in the data plane VCN 818 can be communicatively coupled to the metadata management service 852 (e.g., Figure 6 The metadata management system 652 of the embodiment of the present invention can be communicatively coupled to the public Internet 854. The public Internet 854 can be communicatively coupled to the NAT gateway 838 included in the control plane VCN 816 and included in the data plane VCN 818. The service gateway 836 included in the control plane VCN 816 and included in the data plane VCN 818 can be communicatively coupled to the cloud service 856.

[0082] In some embodiments, the data plane VCN 818 can be integrated with the customer lease 870. In some cases, such integration may be useful or desirable for the customers of the IaaS provider, such as where support may be desired when executing code. A customer may provide code to run that may be destructive, may communicate with other customer resources, or may otherwise cause undesirable effects. In response to this, the IaaS provider may determine whether to run the code given to the IaaS provider by the customer.

[0083] In some examples, a customer of an IaaS provider may grant temporary network access to the IaaS provider and request functionality to be attached to a data plane layer application 846. Code running the functionality may be executed in a VM 866(1)-(N), and the code may not be configured to run anywhere else on the data plane VCN 818. Each VM 866(1)-(N) may be connected to one customer tenancy 870. The corresponding container 871(1)-(N) contained in the VM 866(1)-(N) may be configured to run the code. In this case, there may be double isolation (e.g., the container 871(1)-(N) runs the code, where the container 871(1)-(N) may be contained at least in a VM 866(1)-(N) contained in (one or more) untrusted application subnets 862), which may help prevent incorrect or unintended code from damaging the IaaS provider's network or damaging the network of a different customer. Containers 871(1)-(N) may be communicatively coupled to customer lease 870 and may be configured to transmit or receive data from customer lease 870. Containers 871(1)-(N) may not be configured to transmit or receive data from any other entity in data plane VCN 818. After running code is complete, the IaaS provider may kill or otherwise dispose of containers 871(1)-(N).

[0084] In some embodiments, the trusted application subnet(s) 860 may run code that may be owned or operated by the IaaS provider. In this embodiment, the trusted application subnet(s) 860 may be communicatively coupled to the DB subnet(s) 830 and configured to perform CRUD operations in the DB subnet(s) 830. The untrusted application subnet(s) 862 may be communicatively coupled to the DB subnet(s) 830, but in this embodiment, the untrusted application subnet(s) may be configured to perform read operations in the DB subnet(s) 830. The containers 871(s) (1)-(N) that may be included in each customer's VM 866(1)-(N) and that may run code from the customer may not be communicatively coupled to the DB subnet(s) 830.

[0085] In other embodiments, the control plane VCN 816 and the data plane VCN 818 may not be directly communicatively coupled. In this embodiment, there may be no direct communication between the control plane VCN 816 and the data plane VCN 818. However, communication may occur indirectly through at least one method. The LPG 810 may be established by an IaaS provider, which may facilitate communication between the control plane VCN 816 and the data plane VCN 818. In another example, the control plane VCN 816 or the data plane VCN 818 may call the cloud service 856 via the service gateway 836. For example, the call from the control plane VCN 816 to the cloud service 856 may include a request for a service that may communicate with the data plane VCN 818.

[0086] Fig. 9 900 is a block diagram illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 902 (e.g., Figure 6 The service operator 602) can be communicatively coupled to the secure host lease 904 (e.g., Figure 6 A secure host lease 604 of the embodiment of the present invention may include a virtual cloud network (VCN) 906 (e.g., Figure 6 VCN 606) and secure host subnet 908 (e.g., Figure 6 The VCN 906 may include a secure host subnet 608 that is communicatively coupled to an SSH VCN 912 via an LPG 910 included in the SSH VCN 912 (e.g., Figure 6 SSH VCN 612) of LPG 910 (for example, Figure 6 SSH VCN 912 may include SSH subnet 914 (e.g., Figure 6SSH subnet 614), and SSHVCN 912 may be communicatively coupled to control plane VCN 916 via LPG 910 included in control plane VCN 916 (e.g., Figure 6 The control plane VCN 616 of the embodiment of the present invention is coupled to the data plane VCN 918 (e.g., the control plane VCN 616 of the embodiment of the present invention) and is coupled to the data plane VCN 918 (e.g., the control plane VCN 616 of the embodiment of the present invention) via the LPG 910 contained in the data plane VCN 918 Figure 6 The control plane VCN 916 and the data plane VCN 918 may be included in a service lease 919 (e.g., Figure 6 of service lease 619).

[0087] The control plane VCN 916 may include a control plane DMZ layer 920 (e.g., Figure 6 The control plane DMZ layer 620 may include (one or more) LB subnets 922 (e.g., Figure 6 (one or more) LB subnets 622); control plane application layer 924 (e.g., Figure 6 , which may include (one or more) application subnets 926 (e.g., Figure 6 (one or more) application subnets 626); control plane data layer 928 (e.g., Figure 6 The control plane data layer 628 may include (one or more) DB subnets 930 (e.g., Figure 8 The LB subnet(s) 922 included in the control plane DMZ layer 920 may be communicatively coupled to the application subnet(s) 926 included in the control plane application layer 924 and the internet gateway 934 (e.g., Figure 6 634), and the application subnet(s) 926 may be communicatively coupled to the DB subnet(s) 930 and service gateway 936 (e.g., Figure 6 Serving gateway) and network address translation (NAT) gateway 938 (e.g., Figure 6 The control plane VCN 916 may include a service gateway 936 and a NAT gateway 938.

[0088] The data plane VCN 918 may include a data plane application layer 946 (e.g., Figure 6 Data plane application layer 646), data plane DMZ layer 948 (e.g., Figure 6 Data plane DMZ layer 648)) and data plane data layer 950 (e.g., Figure 6 The data plane DMZ layer 948 may include (one or more) LB subnets 922, which may be communicatively coupled to (one or more) trusted application subnets 960 (e.g., Figure 8 (one or more) trusted application subnets 860) and (one or more) trusted application subnets 962 (e.g., Figure 8 The trusted application subnet(s) 960 may be communicatively coupled to the service gateway 936 contained in the data plane VCN 918, the NAT gateway 938 contained in the data plane VCN 918, and the DB subnet(s) 930 contained in the data plane data layer 950. The untrusted application subnet(s) 962 may be communicatively coupled to the service gateway 936 contained in the data plane VCN 918 and the DB subnet(s) 930 contained in the data plane data layer 950. The data plane data layer 950 may include the DB subnet(s) 930 that may be communicatively coupled to the service gateway 936 contained in the data plane VCN 918.

[0089] Untrusted application subnet(s) 962 may include primary VNICs 964(1)-(N) that may be communicatively coupled to tenant virtual machines (VMs) 966(1)-(N) 962 residing within the untrusted application subnet(s). Each tenant VM 966(1)-(N) may run code in a corresponding container 967(1)-(N) and may be communicatively coupled to application subnet 926 that may be contained in a data plane application layer 946 that may be contained in a container egress VCN 968. Corresponding secondary VNICs 972(1)-(N) may facilitate communications between untrusted application subnet(s) 962 contained in a data plane VCN 918 and application subnets contained in a container egress VCN 968. The container egress VCN may include a NAT gateway 938 that may be communicatively coupled to a public Internet 954 (e.g., Figure 6 of the public Internet 654).

[0090] The Internet gateways 934 included in the control plane VCN 916 and included in the data plane VCN 918 may be communicatively coupled to a metadata management service 952 (e.g., Figure 6The metadata management system 652 of the embodiment of the present invention can be communicatively coupled to the public Internet 954. The public Internet 954 can be communicatively coupled to the NAT gateway 938 included in the control plane VCN 916 and included in the data plane VCN 918. The service gateway 936 included in the control plane VCN 916 and included in the data plane VCN 918 can be communicatively coupled to the cloud service 956.

[0091] In some examples, the Fig. 9 The architecture illustrated in block diagram 900 may be considered as Figure 8 800, and may be desirable for customers of an IaaS provider if the IaaS provider is unable to communicate directly with the customer (e.g., a disconnected region). The customer may access in real time a corresponding container 967(1)-(N) contained in each customer's VM 966(1)-(N). The container 967(1)-(N) may be configured to call a corresponding secondary VNIC 972(1)-(N) contained in an application subnet(s) 926 of a data plane application layer 946, which may be contained in a container egress VCN 968. The secondary VNIC 972(1)-(N) may transmit the call to a NAT gateway 938, which may transmit the call to the public Internet 954. In this example, the containers 967(1)-(N) that may be accessed in real time by the customer may be isolated from the control plane VCN 916 and may be isolated from other entities contained in the data plane VCN 918. Containers 967(1)-(N) may also be isolated from resources of other clients.

[0092] In other examples, a customer may use containers 967(1)-(N) to call cloud service 956. In this example, a customer may run code in container 967(1)-(N) to request a service from cloud service 956. Container 967(1)-(N) may transmit this request to secondary VNIC 972(1)-(N), which may transmit the request to a NAT gateway, which may transmit the request to public Internet 954. Public Internet 954 may transmit the request to LB subnet(s) 922 contained in control plane VCN 916 via Internet gateway 934. In response to determining that the request is valid, LB subnet(s) may transmit the request to application subnet(s) 926, which may transmit the request to cloud service 956 via service gateway 936.

[0093] It should be appreciated that the IaaS architectures 600, 700, 800, 900 depicted in the figures may have other components than those depicted. In addition, the embodiments shown in the figures are merely some examples of cloud infrastructure systems that may be combined with embodiments of the present disclosure. In some other embodiments, the IaaS system may have more or fewer components than shown in the figures, may combine two or more components, or may have a different configuration or arrangement of components.

[0094] In certain embodiments, the IaaS system described herein may include application suites, middleware, and database service offerings delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. An example of such an IaaS system is Oracle Cloud Infrastructure (OCI) provided by the assignee.

[0095] Fig.10 An example computer system 1000 is illustrated in which various embodiments may be implemented. System 1000 may be used to implement any of the computer systems described above. As shown, computer system 1000 includes a processing unit 1004 that communicates with a plurality of peripheral subsystems via a bus subsystem 1002. These peripheral subsystems may include a processing acceleration unit 1006, an I / O subsystem 1008, a storage subsystem 1018, and a communication subsystem 1024. Storage subsystem 1018 includes a tangible computer-readable storage medium 1022 and a system memory 1010.

[0096] The bus subsystem 1002 provides a mechanism for allowing the various components and subsystems of the computer system 1000 to communicate with each other as expected. Although the bus subsystem 1002 is schematically shown as a single bus, an alternative embodiment of the bus subsystem can utilize multiple buses. The bus subsystem 1002 can be any of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, and a local bus using any various bus architectures. For example, this architecture can include an industrial standard architecture (ISA) bus, a microchannel architecture (MCA) bus, an enhanced ISA (EISA) bus, a video electronics standard association (VESA) local bus, and a peripheral component interconnect (PCI) bus, which can be implemented as a Mezzanine bus manufactured by the IEEE P1386.1 standard.

[0097] The processing unit 1004, which may be implemented as one or more integrated circuits (e.g., conventional microprocessors or microcontrollers), controls the operation of the computer system 1000. One or more processors may be included in the processing unit 1004. These processors may include single-core or multi-core processors. In certain embodiments, the processing unit 1004 may be implemented as one or more independent processing units 1032 and / or 1034, each of which includes a single-core or multi-core processor. In other embodiments, the processing unit 1004 may also be implemented as a quad-core processing unit formed by integrating two dual-core processors into a single chip.

[0098] In various embodiments, the processing unit 1004 can execute various programs in response to program code and can maintain multiple concurrently executed programs or processes. At any given time, some or all of the program code to be executed may reside in (one or more) processors 1004 and / or storage subsystem 1018. Through appropriate programming, (one or more) processors 1004 can provide the various functionalities described above. The computer system 1000 may additionally include a processing acceleration unit 1006, which may include a digital signal processor (DSP), a special processor, and / or the like.

[0099] I / O subsystem 1008 may include user interface input devices and user interface output devices. User interface input devices may include keyboards, pointing devices such as a mouse or trackball, touch pads or touch screens incorporated into displays, scroll wheels, click wheels, dials, buttons, switches, keypads, audio input devices with voice command recognition systems, microphones, and other types of input devices. User interface input devices may include, for example, motion sensing and / or gesture recognition devices such as Motion sensors that enable users to control devices such as 360 game controller. The user interface input device may also include an eye gesture recognition device, such as detecting eye activity from the user (e.g., a "wink" when taking a picture and / or making a menu selection) and translating eye gestures to the input device (e.g., Google ) in Google In addition, the user interface input device may include a method for enabling the user to communicate with the voice recognition system (e.g., Navigator) interactive voice recognition sensing device.

[0100] The user interface input device may also include, but is not limited to, a three-dimensional (3D) mouse, a joystick or pointing stick, a game panel and a drawing board, and audio / video equipment such as a speaker, a digital camera, a digital video camera, a portable media player, a webcam, an image scanner, a fingerprint scanner, a barcode reader 3D scanner, a 3D printer, a laser rangefinder, and a sight tracking device. In addition, the user interface input device may include, for example, a medical imaging input device such as a computer tomography, a magnetic resonance imaging, a positron emission tomography, a medical ultrasound device. The user interface input device may also include, for example, an audio input device such as a MIDI keyboard, a digital musical instrument, etc.

[0101] The user interface output devices may include a display subsystem, indicator lights, or non-visual displays such as audio output devices, etc. The display subsystem may be a cathode ray tube (CRT), a flat panel device such as using a liquid crystal display (LCD) or plasma display, a projection device, a touch screen, etc. In general, the use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computer system 1000 to a user or other computers. For example, the user interface output devices may include, but are not limited to, various display devices that visually convey text, graphics, and audio / video information, such as monitors, printers, speakers, headphones, car navigation systems, plotters, voice output devices, and modems.

[0102] Computer system 1000 may include a storage subsystem 1018 that provides a tangible, non-transitory computer-readable storage medium for storing software and data constructs that provide the functionality of the embodiments described in the present disclosure. Software may include programs, code modules, instructions, scripts, etc. that provide the above-described functionality when executed by one or more cores or processors of processing unit 1004. Storage subsystem 1018 may also provide a repository for storing data used in accordance with the present disclosure.

[0103] like Fig.10 As depicted in the example of , storage subsystem 1018 may include various components, including system memory 1010, computer-readable storage media 1022, and computer-readable storage media reader 1020. System memory 1010 may store program instructions that may be loaded and executed by processing unit 1004. System memory 1010 may also store data used during the execution of instructions and / or data generated during the execution of program instructions. Various different kinds of programs may be loaded into system memory 1010, including but not limited to client applications, web browsers, middle-tier applications, relational database management systems (RDBMS), virtual machines, containers, and the like.

[0104] System memory 1010 may also store an operating system 1016. Examples of operating system 1016 may include various versions of Microsoft Apple and / or Linux operating systems, various commercially available or UNIX-like operating systems (including but not limited to various GNU / Linux operating systems, Google OS, etc.) and / or mobile operating systems (such as iOS, Phone, OS, OS and In some embodiments where the computer system 1000 executes one or more virtual machines, the virtual machines and their guest operating systems (GOS) may be loaded into the system memory 1010 and executed by one or more processors or cores of the processing unit 1004.

[0105] The system memory 1010 can be configured in different ways, depending on the type of computer system 1000. For example, the system memory 1010 can be volatile memory, such as random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM), flash memory, etc. Different types of RAM configurations can be provided, including static random access memory (SRAM), dynamic random access memory (DRAM), etc. In some implementations, the system memory 1010 can include a basic input / output system (BIOS), which contains the basic routines that help to transfer information between elements within the computer system 1000, such as during startup.

[0106] Computer-readable storage media 1022 may represent remote, local, fixed and / or removable storage devices plus storage media for temporarily and / or more permanently containing and storing computer-readable information for use by computer system 1000 (including instructions executable by processing unit 1004 of computer system 1000).

[0107] Computer readable storage media 1022 may include any suitable media known or used in the art, including storage media and communication media, such as, but not limited to, volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage and / or transmission of information. This may include tangible computer readable storage media, such as RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or other tangible computer readable media.

[0108] By way of example, computer-readable storage media 1022 may include hard disk drives that read from or write to non-removable, nonvolatile magnetic media, magnetic disk drives that read from or write to removable, nonvolatile disks, and removable, nonvolatile optical disks such as CD ROMs, DVDs, and Blu-ray discs. Computer readable storage media 1022 may include, but is not limited to, The computer readable storage medium 1022 may include a solid-state drive (SSD) based on non-volatile memory (such as a flash-based SSD, an enterprise flash drive, a solid-state ROM, etc.), a volatile memory-based SSD such as a solid-state RAM, a dynamic RAM, a static RAM, a DRAM-based SSD, a magnetoresistive RAM (MRAM) SSD, and a hybrid SSD that combines DRAM and a flash-based SSD. The disk drive and its associated computer-readable media may provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer system 1000.

[0109] Machine-readable instructions executable by one or more processors or cores of processing unit 1004 may be stored on a non-transitory computer-readable storage medium. A non-transitory computer-readable storage medium may include a physically tangible memory or storage device, including a volatile memory storage device and / or a non-volatile storage device. Examples of non-transitory computer-readable storage media include magnetic storage media (e.g., disks or tapes), optical storage media (e.g., DVDs, CDs), various types of RAM, ROM, or flash memory, a hard drive, a floppy disk drive, a detachable memory drive (e.g., a USB drive), or other types of storage devices.

[0110] The communication subsystem 1024 provides an interface to other computer systems and networks. The communication subsystem 1024 is used as an interface for receiving data from other systems from the computer system 1000 and transmitting data thereto. For example, the communication subsystem 1024 can enable the computer system 1000 to be connected to one or more devices via the Internet. In some embodiments, the communication subsystem 1024 may include a radio frequency (RF) transceiver component for accessing a wireless voice and / or data network (e.g., using cellular phone technology, advanced data network technology such as 3G, 4G or EDGE (Enhanced Data Rates for Global Evolution), WiFi (IEEE 802.11 series standards), or other mobile communication technologies, or any combination thereof), a global positioning system (GPS) receiver component and / or other components. In some embodiments, as an addition or replacement of a wireless interface, the communication subsystem 1024 may provide wired network connectivity (e.g., Ethernet).

[0111] In some embodiments, the communication subsystem 1024 may also receive input communications 1000 in the form of structured and / or unstructured data feeds 1026, event streams 1028, event updates 1030, etc. on behalf of one or more users who may use the computer system.

[0112] For example, the communication subsystem 1024 may be configured to receive data feeds 1026 in real time from users of a social network and / or other communication service, such as feed, Updates, web feeds (such as RichSite Summary (RSS) feeds), and / or real-time updates from one or more third-party information sources.

[0113] In addition, the communication subsystem 1024 can also be configured to receive data in the form of a continuous data stream, which can include an event stream 1028 of real-time events and / or event updates 1030, which can be continuous or unbounded in nature, without a clear end. Examples of applications that generate continuous data can include, for example, sensor data applications, financial quote machines, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, automobile traffic monitoring, etc.

[0114] The communication subsystem 1024 may also be configured to output structured and / or unstructured data feeds 1026 , event streams 1028 , event updates 1030 , etc. to one or more databases that may be in computer communication with one or more streaming data source computers coupled to the computer system 1000 .

[0115] Computer system 1000 may be one of various types, including a handheld portable device (e.g., Cellular phone, computing tablets, PDAs), wearable devices (e.g. Glass head mounted display), PC, workstation, mainframe, kiosk, server rack, or any other data processing system.

[0116] Due to the ever-changing nature of computers and networks, the description of the computer system 1000 depicted in the figure is intended only as a specific example. Many other configurations with more or less components than the system depicted in the figure are possible. For example, customized hardware and / or specific elements can be realized in hardware, firmware, software (including small applications) or combination. In addition, the connection with other computing devices (such as network input / output devices) can be adopted. Based on the disclosure and teaching provided herein, those of ordinary skill in the art will recognize that other modes and / or methods for realizing various embodiments.

[0117] Although specific embodiments have been described, various modifications, variations, alternative constructions, and equivalents are also included within the scope of this disclosure. Embodiments are not limited to operating within certain specific data processing environments, but can be freely operated within multiple data processing environments. In addition, although embodiments have been described using a specific series of transactions and steps, it should be clear to those skilled in the art that the scope of this disclosure is not limited to the described series of transactions and steps. The various features and aspects of the above-described embodiments may be used alone or in combination.

[0118] In addition, although embodiments have been described using specific combinations of hardware and software, it should be appreciated that other combinations of hardware and software are also within the scope of the present disclosure. Embodiments may be implemented using only hardware, or only software, or using a combination thereof. The various processes described herein may be implemented in any combination on the same processor or on different processors. Accordingly, where a component or module is described as being configured to perform certain operations, such configuration may be accomplished by, for example, designing an electronic circuit to perform the operation, by programming a programmable electronic circuit (such as a microprocessor) to perform the operation, or any combination thereof. Processes may communicate using a variety of techniques, including but not limited to conventional techniques for inter-process communication, and different pairs of processes may use different techniques, or the same pair of processes may use different techniques at different times.

[0119] Accordingly, the description and drawings are to be regarded as illustrative rather than restrictive. However, additions, subtractions, deletions and other modifications and changes may be made thereto without departing from the broader spirit and scope set forth in the claims. Therefore, although specific disclosed embodiments have been described, these are not intended to be limiting. Various modifications and equivalent forms are within the scope of the following claims.

[0120] The use of the terms "one" and "an" and "the" and similar references in the context of describing the disclosed embodiments (especially in the context of the following claims) is to be interpreted as covering the singular and the plural, unless otherwise indicated herein or clearly contradicted by the context. Unless otherwise stated, the terms "include", "have", "include (including)" and "include (containing)" are to be interpreted as open terms (i.e., meaning "including but not limited to"). The term "connected" should be interpreted as being partially or completely contained in, attached to or connected together, even if there is something in the middle. Unless otherwise indicated herein, the enumeration of the value range herein is intended only to be used as a shorthand method of individually referencing each individual value falling within the range, and each individual value is incorporated into the specification as if it were individually listed herein. Unless otherwise indicated herein or clearly contradicted by the context, all methods described herein can be performed in any suitable order. The use of any and all examples or exemplary language (e.g., "such as") provided herein is intended only to better illustrate the embodiments and is not intended to limit the scope of the present disclosure, unless otherwise stated. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the disclosure.

[0121] Disjunctive language, such as the phrase "at least one of X, Y, or Z," is intended to be understood in the context generally used to indicate that an item, term, or the like, can be X, Y, or Z, or any combination thereof (e.g., X, Y, and / or Z), unless expressly stated otherwise. Thus, such disjunctive language is generally not intended to, and should not, imply that certain embodiments require that at least one of X, at least one of Y, or at least one of Z each be present.

[0122] Preferred embodiments of the present disclosure are described herein, including the best mode known for implementing the present disclosure. Variations of those preferred embodiments will become clear to those of ordinary skill in the art after reading the above description. Those of ordinary skill should be able to appropriately adopt such variations and can practice the present disclosure in a manner different from that specifically described herein. Accordingly, the present disclosure includes all modifications and equivalent forms of the subject matter recorded in the appended claims where permitted by applicable law. In addition, unless otherwise indicated herein, the present disclosure includes any combination of the above-mentioned elements in all possible variations thereof.

[0123] All references, including publications, patent applications, and patents, cited herein are hereby incorporated by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and were set forth in its entirety herein.

[0124] In the foregoing description, various aspects of the present disclosure are described with reference to their specific embodiments, but those skilled in the art will appreciate that the present disclosure is not limited thereto. Each feature and aspect disclosed above can be used alone or in combination. In addition, without departing from the broader spirit and scope of this specification, the embodiment can be used in any number of environments and applications other than those described herein. Thus, this specification and the accompanying drawings should be considered illustrative rather than restrictive.

Claims

1. A computer-implemented method comprising: monitoring, by a computing device, a primary load of a data center and a reserved load of the data center, the primary load being powered by one or more primary generator sets having primary capacity, and the reserved load being powered by one or more reserved generator sets having reserved capacity; Determining by a computing device whether a primary load exceeds a primary capacity; as well as Based on determining that the primary load exceeds the primary capacity: The reserve generator set is connected to at least one of the primary generator set or the primary load via a switch controllable by the computing device.

2. The method of claim 1, wherein power is supplied to the reserve loads by the one or more reserve generator sets and a utility power connection, wherein the utility power connection provides power to at least half of the reserve loads.

3. The method of claim 1 or 2, wherein the reserved load is powered by the utility power connection after the reserved load is disconnected.

4. The method of any one of claims 1 to 3, wherein detecting that the primary load exceeds the primary capacity further comprises: It is determined that power supplied to the reserved load is below a threshold.

5. The method of any one of claims 1 to 4, wherein detecting that the primary load exceeds the primary capacity further comprises: It is determined that a primary generator set of the one or more primary generator sets has failed.

6. The method of any one of claims 1 to 5, wherein the computing device is an industrial control system.

7. The method according to any one of claims 1 to 6, further comprising: Based on determining that the combined load including the primary load and the reserved load exceeds the combined capacity including the primary capacity and the reserved capacity: disconnecting the reserved load from the reserved generator set via a switch controllable by the computing device.

8. The method according to any one of claims 1 to 7, further comprising: Based on a determination that the combined capacity exceeds the combined load, the reserve load is reconnected to the one or more reserve generator sets.

9. A computing system comprising: a memory storing computer executable program instructions; as well as A processing device communicatively coupled to the memory to execute computer-executable program instructions, wherein executing the computer-executable program instructions configures the processing device to perform operations comprising: monitoring a primary load and a reserved load by a computing system, the primary load being powered by one or more primary generator sets having primary capacity, and the reserved load being powered by one or more reserved generator sets having reserved capacity; A calculation system determines whether the primary load exceeds the primary capacity; as well as Based on determining that the primary load exceeds the primary capacity: The reserve generator set is connected to at least one of the primary generator set or the primary load via a switch controllable by the computing system.

10. The system of claim 9, wherein power is supplied to the reserve loads by the one or more reserve generator sets and a utility power connection, wherein the utility power connection provides power to at least half of the reserve loads.

11. The system of claim 9 or 10, wherein the reserved load is powered by the utility power connection after the reserved load is disconnected.

12. The system of any one of claims 9 to 11, wherein detecting that the primary load exceeds the primary capacity further comprises: It is determined that power supplied to the reserved load is below a threshold.

13. The system of any one of claims 9 to 12, wherein detecting that the primary load exceeds the primary capacity further comprises determining that a primary generator set of the one or more primary generator sets has failed.

14. The system of any one of claims 9 to 13, further comprising: Based on determining that the combined load including the primary load and the reserve load exceeds the combined capacity including the primary capacity and the reserve capacity: disconnecting the reserve load from the reserve generator set via a switch controllable by the computing system.

15. The system of any one of claims 9 to 14, wherein the computing system is an industrial control system.

16. One or more non-transitory computer-readable media storing computer-executable program instructions that, when executed by a computing system, cause the computing system to perform operations comprising: monitoring, by a computing system, a primary load of a data center and a reserved load of the data center, the primary load being powered by one or more primary generator sets having primary capacity, and the reserved load being powered by one or more reserved generator sets having reserved capacity; A calculation system determines whether the primary load exceeds the primary capacity; as well as Based on determining that the primary load exceeds the primary capacity: The reserve generator set is connected to at least one of the primary generator set or the primary load via a switch controllable by the computing system.

17. The one or more non-transitory computer-readable media of claim 16, wherein power is supplied to the reserve loads by the one or more reserve generator sets and a utility power connection, wherein the utility power connection provides power to at least half of the reserve loads.

18. The one or more non-transitory computer readable media of claim 16 or 17, wherein the reserved load is powered by the utility power connection after the reserved load is disconnected.

19. The one or more non-transitory computer-readable media of any one of claims 16 to 18, wherein detecting that the primary load exceeds the primary capacity further comprises determining that a primary generator set of the one or more primary generator sets has failed.

20. The one or more non-transitory computer readable media of any one of claims 16 to 19, further comprising: Based on determining that the combined load including the primary load and the reserve load exceeds the combined capacity including the primary capacity and the reserve capacity: disconnecting the reserve load from the reserve generator set via a switch controllable by the computing system.

Images