Installation guide

How the switch actually gets fitted.

The same severance doctrine, installed three ways. Every step below is what a SEARIN-certified installer is assessed against — and every install ends with a live cut, not a checklist.

Hardware

Sentinel Mk.II rack interlock (N+1)

Typical duration

1–2 days per hall

Crew

Certified installer + facility electrician + network engineer

The Mk.II sits between the PDU feed and the AI racks, with a parallel path on the top-of-rack uplink. Nothing shares a circuit with life-safety, cooling or fire systems.

Diagram · Data centre severance path

Utility / UPS feedA-side + B-sideSentinel Mk.IIContactors · N+1Tamper loop · key panelAI racksAccelerators · schedulersExcluded circuitsFire · cooling · life-safetyTop-of-rack uplinkInline severance moduleCredential brokerToken revocationTwo-key panelAt hall exitpowergoverned loadnetworkidentity
01

Survey and map the lifeforce

Walk the hall and record every feed that keeps the AI workload alive: PDU circuits, accelerator racks, top-of-rack uplinks, storage fabric, credential brokers. Mark shared circuits and anything touching life-safety, cooling or fire suppression for exclusion.

Sign-off: Signed Lifeforce Map with exclusions listed before any hardware is unboxed.

02

Stage the interlock outside the load path

Rack the Mk.II in the A-side and B-side positions, power the control board from the facility management feed — never from the circuits it governs — and confirm it boots on its own supply with the contactors still closed.

Sign-off: Interlock reachable out-of-band while the AI workload runs undisturbed.

03

Cut in the power path

Under a scheduled maintenance window with lockout/tagout applied, land the governed PDU circuits through the interlock contactors. Torque to spec, label both ends of every conductor, and leave excluded circuits physically outside the enclosure.

Sign-off: Phase, polarity and torque verified and recorded per circuit.

04

Land the network and identity paths

Place the network severance module inline on the AI uplink and bind the identity module to the credential broker so tokens can be revoked in the same action. Both must fail open for excluded systems.

Sign-off: Uplink passes traffic normally; revocation call returns a dry-run success.

05

Install the two-key panel

Mount the key panel at the hall exit, beside the existing emergency disconnect, so an authorised person can reach it without entering the floor. Wire both key positions and the tamper loop back to the interlock.

Sign-off: Panel reachable from the exit; tamper loop alarms when the cover is lifted.

06

Commission in shadow mode

Arm and cut with the contactors inhibited. The control plane logs the full sequence and measures latency per channel without dropping a single watt.

Sign-off: Shadow record in the custody ledger showing every channel reporting open.

07

Live cut and staged restore

In an agreed window, run the real severance, verify each channel open, then restore in the documented order: power, fabric, compute, identity, workload.

Sign-off: Signed custody record with measured cut latency and clean restore.

After handover

An install is only finished when it has been proved.

Every site enters the drill calendar: shadow cuts monthly, a supervised live cut annually, and a custody record for each one.

Monthly

Shadow cut with latency measured on every channel, no load dropped.

Quarterly

Key-holder drill — arm, cut, verify, restore, signed by two people.

Annually

Live severance and recertification of the hardware and the crew.