Staged Power/Load Ramp, Go-Live & Handover to Operations

Everything upstream in Part 13 proved that subsystems work alone and then together under emulated stress: electrical acceptance (Chapter 13.3), cooling acceptance (Chapter 13.5), Level 5 integrated systems testing (Chapter 13.6), fabric (Chapter 13.7), node burn-in (Chapter 13.8), and the reference workload and acceptance criteria (Chapter 13.9). The last mile turns a commissioned but empty building into a revenue-carrying AI factory without tripping the grid, cooking the cold plates, or handing operations a facility nobody knows how to run. It is the seam between the construction and commissioning world and day-2 operations (Part 14), and two very different failure modes live there.

The first failure mode is physical: energizing capacity and switching on synchronized GPU load faster than the grid, the UPS/BESS buffer and the cooling plant can absorb the transient. An AI training cluster does not draw smoothly. Tens of thousands of GPUs idle between collectives and slam to full power in unison, and at gigawatt scale that swing looks to the grid like a generator trip.

The second failure mode is organizational: declaring go-live before the operating procedures are written, the CMMS is loaded, the spares are on the shelf, and the night-shift technician knows which valve to close. In Uptime Institute's 2025 survey, about 40% of organizations had a major outage caused by human error in the prior three years. Of those human-error outages, 58% involved staff not following an established procedure, and roughly 85% involved either that or a flawed procedure; Uptime reported the 40% and 85% figures in the same terms in 2022. Uptime's remedy is better procedures, staff training and real-time operational support, which is what the readiness gate checks. Defeating both failure modes means ramping power on a curve the physics can absorb, and gating the ramp behind an operational-readiness review with the authority to say not yet.

The naive go-live energizes the whole building, then loads it. The disciplined go-live treats energization as a sequence of blocks brought up one or a few at a time. A block is a self-contained power and cooling unit: a substation feed, a UPS lineup or BESS, a CDU loop, and the racks they serve. Each block is fully accepted, and its redundancy proven, before the next is energized. A fault during energization on a partly built block should never reach a block already carrying load, and block-by-block bring-up keeps that blast radius to the block being brought up.

What catches teams is redundancy during the ramp. A facility commissioned to 2N or to a distributed-redundant topology (such as 3N/2 or 4N/3) carries its design redundancy only where the equipment serving a given load has been energized, accepted and balanced. A completed, protected block can reach that state long before the whole campus does. Mid-ramp, the building is briefly below design redundancy: half the UPS modules are in, one of two utility feeds is live, or a CDU pair runs on one unit pending the second's acceptance. Switch on production load against a block that is still N, and a single component failure takes the load down. You will have built the outage the topology was bought to prevent.

The rule is an invariant: at every stage of the ramp, the block's load must be servable by the power and cooling capacity that survives the maintenance and failure states its design basis names. Read each stage's load ceiling off those states, and raise it only after the equipment and controls that lift it have been energized and accepted. Sequence the ramp so capacity additions never outpace redundancy additions. This is the energization analogue of the concurrent-maintainability principle from Chapter 13.1: the building must be able to lose a component at every point on the ramp, not just at the end of it.

The regulatory ground under go-live moved in 2025 and 2026, and it now shapes the plan directly. On 2025-09-09 NERC issued a Level 2 Industry Recommendation asking planners, transmission owners and operators to tighten interconnection studies, commissioning and operations for large loads, and it named data centers. NERC then opened Project 2026-02 (Computational Loads) to write glossary definitions and near-term reliability standards for large loads on the BPS (NERC, 2025-2026).

FERC's order in RD26-7-000 (2026-07-16) tells NERC to file its first, "Phase I", computational-load Reliability Standards by 2026-12-31 and says it expects registry criteria by the same date. NERC's standards (CLO-001-1 to CLO-003-1) cover how loads are studied and commissioned, what modeling and operating data they provide, how they communicate with operators, and how protection is coordinated and disturbances monitored. They set no minimum ride-through curve; NERC has deferred that to later work. They passed NERC's final ballot (announced 2026-10-15) and await Board adoption and FERC approval (Chapter 4.3). NERC's Board approved the registry criteria for computational loads on 2026-10-08, but they stay a proposal until FERC approves the filing.

Essential Action 4 in the Level 3 alert (2026-05-04) asks transmission owners, where possible, to commission a computational load after its computing equipment is in place. The tests include full load, no load and a ±10% voltage step. No NERC standard yet sets load ride-through. PRC-029-1, in effect since 2026-10-01, covers inverter-based generators, not loads. Regional rules already apply: ERCOT's NOGRR282 requires new large computational loads (75 MW and up) to ride through, effective 2026-08-01, and SPP's HILL rules cover interconnection requests made on or after 2026-01-15. In those regions, ride-through evidence is already a compliance item and not only an owner acceptance test. Commissioning has to prove two different behaviors. Outside the ride-through envelope, the site transfers cleanly to backup; inside it, the site stays connected through a normally cleared sag (Chapter 13.6 has the integrated test; Chapter 4.10 owns regulatory status).

Separately, on 2026-06-18 FERC issued §206 show-cause orders on the large-load interconnection tariffs of all six RTOs/ISOs. The PJM order proposes defining a large load as 50 MW or more of peak load connected above 69 kV. The orders were held in abeyance in August, and PJM's responses are now due 2026-11-16. The utility-coordination rules your staged ramp lives inside are not yet settled. Utilities are already writing fault-ride-through and ramp-rate obligations into interconnection agreements, so your energization and load-ramp plan is increasingly a contractual deliverable to the utility, not an internal schedule. The ramp curve you submit (MW per step, maximum swing, dwell time at each step) becomes part of how you keep your interconnection. → grid-coupling physics in Chapter 4.5; speed-to-power economics in Chapter 3.2.

This borrows software-deployment vocabulary on purpose. You do not go from commissioned to full production in one step: you canary. The ramp is a sequence of increasingly demanding workloads, each with quantitative acceptance gates, and each promotes only when the prior step holds. The canary finds the integration failures no subsystem test can surface, because they appear only when real load, heat, fabric traffic and power transients are present at once.

A representative profile has three steps. (1) Single-node or single-rack canary: a handful of nodes run a known workload to confirm the rack is plumbed, powered, cooled and networked end to end, and that telemetry reaches the DCIM and the cluster monitoring stack. (2) Partial-fleet proxy run: a fraction of the cluster (10–25% is illustrative; cover each power and cooling path, placement domain and image cohort) runs the reference training job from Chapter 13.9. It exercises the back-end fabric, storage and scheduler under real collective traffic, and it produces the first real synchronized power swing the facility has seen. (3) Full-fleet synchronous load: the entire cluster runs the proxy job. Verify that the cooling plant holds delta-T at the worst-case branch under full heat flux and that the power-smoothing stack flattens the full-amplitude swing. Once those promotion gates are green, start the goodput clock against the contractual SLA.

Each step is gated by acceptance criteria: thermal (cold-plate inlet/outlet and GPU clock and power limits), electrical (tested swing and surviving duty), workload (ML Productivity Goodput or inference correctness and latency), restoration, and ORR. You promote on green and hold or roll back on red.

R-01 trace. Convert each accepted surviving duty to the same IT-load boundary: electrical 1.20 MW; liquid 0.90 MW / 0.80 = 1.125 MW; air 0.16 MW / 0.20 = 0.80 MW. Take the minimum without intermediate rounding: 0.80 MW. The proposed 0.90 MW fails the air path: it needs 0.90 × 0.20 = 0.18 MW air duty, which exceeds 0.16 MW. Its 0.30 MW step also exceeds the independently tested 0.25 MW step. Two failures cannot be averaged into spare electrical capacity.

Action. Hold the requested release. A 0.20 MW addition would reach exactly 0.80 MW and demand 0.64 MW liquid and 0.16 MW air, which puts the air path on its limit with zero margin. Add the 2% uncertainty and air demand becomes about 0.163 MW, an overlap that the evidence rule makes a HOLD. The exact ceiling is an addition of about 0.184 MW. Rounded down to 0.18 MW, the release reaches 0.78 MW total, with 0.624 MW liquid and 0.156 MW air, or about 0.159 MW once uncertainty is added. That keeps air inside its 0.16 MW duty and the step inside the 0.25 MW already tested. Even that is only a candidate for the real instrumented canary and partial-fleet gate. Before authorization, require the actual waveform, all-branch thermal records, source and restoration state, workload outcome and ORR witness package. Stop or return to the last accepted load on a missed limit, failed interlock, unexpected trip, incorrect result or lost critical telemetry, and confirm storage reserve and cooling balance recover before repeating. The night-shift drill must locate the asset it names, retrieve its spare, execute escalation and complete a usable configuration or checkpoint restore.

Flip. With the same 80/20 profile, accepting the requested 0.90 MW needs about 0.184 MW of surviving air duty once the 2% uncertainty is added, and a tested 0.30 MW step. If both pass and every binary gate stays green, the liquid and electrical capacities permit promotion; changing only one still leaves HOLD. Price the added air path or revised staging against the deferred load, then make the owner choose from those tested options. The methods are acceptance at rated conditions in OCP's CDU test methodology and the capacity and transition handoffs from 13.3–13.6. No generic commissioning duration can replace these gates.

Handover transfers everything operations needs to keep the facility alive from the project and commissioning team to the operations team. It is a defined package with named owners, not an email and a key. A thin handover is a slow-motion outage: the building runs until the first abnormal event, then the on-shift team improvises because the procedure for that event was never written or never delivered. The package has six load-bearing components:

• As-built documentation. Drawings, schematics and the digital twin reconciled to what was actually built: the as-installed reality, not the design intent. This is the substrate for every future MOP and every troubleshooting session, and the seed for the operational twin (Chapter 14.2).
• SOPs, EOPs, and MOPs. Standard, emergency and maintenance operating procedures, written, reviewed and rehearsed for the required response states before go-live. The EOPs (utility loss, generator-start sequence, cooling-loss response, leak response) stand between a fault and an outage. The Uptime human-error results cited above repeatedly implicate procedures, which makes these the highest-leverage deliverable in the package.
• The baseline 'fingerprint'. The signature of every subsystem operating normally, captured at commissioning: power draws, temperatures, flows, delta-Ts, fabric BER, NCCL bandwidth, GPU power behavior. Day-2 monitoring detects drift against this baseline, and without it operations has no reference for 'normal.' Baseline capture is specified in Chapter 13.2. Also hand over the configuration the acceptance results were produced on: pinned driver, firmware, NCCL and orchestration versions, along with the per-node results and the owner's pass thresholds. NVIDIA publishes open tooling for this (AI Cluster Runtime recipes and the Cluster Readiness Engine), but the owner still supplies the thresholds. Any later configuration change should trigger a scoped re-qualification against that record (Chapter 13.8).
• CMMS / spares / maintenance plan. The computerized maintenance management system loaded with assets and PM schedules, the spares forecast turned into stocked shelves, and the maintenance program (run-to-failure, time-based or condition-based, per asset) defined. An empty CMMS at go-live is a classic ORR failure. → Chapter 14.5, Chapter 14.6.
• Deficiency / punch list and its closure plan. The open-items register, with severity, owner and target date, and a clear rule for which open items block go-live (anything affecting life safety or design redundancy) and which are accepted as residual with a closure commitment. Punch-list management is defined in Chapter 13.2.
• Utility-facing obligations. Hand over four things: the commissioning record the transmission owner holds on the load, the protection and ride-through settings as accepted, the disturbance recorders' configuration and data path, and an owner for the transmission operator's instructions and communications. If NERC's standards (CLO-001-1 to CLO-003-1, which passed final ballot in October 2026) and its CLO/CLOP registration criteria (Board-approved on 8 October 2026, now awaiting FERC approval) take effect, these become duties of the registered operator. Both apply to Computational Load Sites with 50 MW or more of connected load at 100 kV or above (registration detail in Chapter 4.3). Each standard takes effect on the first day of the first calendar quarter after FERC approves it. Under CLO-003-1, a site already in service then has 36 months to meet the disturbance-monitoring requirements, and a site entering service later has 15 months or until its in-service date, whichever comes later. NERC's own example assumes an effective date of 1 April 2027; a site entering service after 1 July 2028 then has to comply on its in-service date. The protection-coordination requirements come due sooner, nine months after the effective date. A campus going live from 2027 should install and test its disturbance recorders during commissioning rather than retrofit them, and name who inherits these duties before go-live.

The monitoring handoff is where commissioning telemetry becomes operations telemetry. During commissioning, instrumentation is configured to prove acceptance; for day-2 it must be reconfigured to detect degradation. The facility-layer DCIM and the IT and cluster observability stack (DCGM/NVML, XID/SXID decoding, fabric health, storage and scheduler metrics) get wired into the operations team's alerting, with thresholds set against the baseline fingerprint. IT/facility correlation matters too: it lets an operator see that a GPU throttle and a CDU delta-T excursion are the same event. A go-live that hands over green dashboards but no alerting, or alerting with no runbook attached to each alert, has handed over a monitoring system that watches the building fail in real time without anyone being paged.

Go-live also seeds the reliability program rather than completing it. Once the cluster carries production load, it starts generating the failure stream operations will manage for its whole life. SemiAnalysis reported about seven days of MTBF for one 512-H100 cluster at a top-tier operator in October 2024. That is not a per-GPU rate, and operations must measure its own fleet's event distribution rather than scale it by accelerator count. The reference run from Chapter 13.9 set the goodput baseline; day-2 operations now defends it against this failure stream with lemon-node ejection, automated remediation and checkpoint-tuned restart. Handover is the formal moment responsibility for goodput passes from 'did we build it right' to 'are we running it right.' The failure environment operations inherits, and the goodput economics that govern it, are the subject of Chapter 14.1. The telemetry stack is built out in Chapter 14.2, the failure-mode catalog is in Chapter 14.3, and operational reliability for training is in Chapter 14.4.

Go-live starts a clock with real money attached. The contract defines what starts each warranty / defects-liability period (shipment, installation, substantial acceptance or another named milestone) and who remains responsible for defects that surface in operation. The decision that matters is what constitutes acceptance, because a contractual acceptance milestone can start a clock and shift risk. Accepting a facility with a fat punch list can start a warranty clock on items you have not yet proven, and leave you arguing later about whether a failure is a warranty defect or an operations error. Do not grant substantial acceptance until the punch items that affect design redundancy and life safety are closed, and structure the agreement so the defects-liability period runs from a clean, documented baseline. Hold a meaningful retention against final closure.

Project close arrives when the open-items register is driven to zero (or to a documented, accepted residual), the warranty terms are anchored to a clean baseline, and the operations team formally signs that it has received and accepts the full handover package. The cluster's first job, by itself, closes nothing. After that point it is all day-2: the facility's value comes not from how well it was built but from how well it is run, which is the entire subject of Part 14. The cleanest go-lives are the ones where the seam is barely visible. Operations was embedded in commissioning, wrote the procedures against the as-builts as they were produced, watched the canary and proxy ramps from the chairs they would occupy on day one, and inherited a building they already knew how to run.

Release only the load that the accepted surviving paths and the measured transition envelope can carry, with an operations team that has demonstrated restoration. More installed megawatts do not raise a failed air-side ceiling, and a signed turnover package does not substitute for a failed drill. Waiting keeps the unresolved fault inside commissioning; proceeding turns it into an operating incident.