POINT-BASED RISK SCORE FOR MANAGING ENVIRONMENTAL 5 SYSTEMS CROSS-REFERENCES TO RELATED APPLICATIONS [0001] The present application is a PCT application of and claims priority to U.S. Provisional Application No. 61/988,791, filed on May 5, 2014 (Attorney Docket No.: 91725-001200US -10 907804), the entire contents of which are herien incorporated by reference for all purposes. BACKGROUND [0002] Many modern datacenters use environmental maintenance systems including heating, ventilation, and air conditioning (HVAC) units to control indoor temperature, humidity, and other variables. It is common to have many HVAC units deployed throughout 15 a data center. They are often floor-standing units, but may be wall-mounted, rack-mounted, or ceiling-mounted. The HVAC units often provide cooled air to a raised floor plenum, to a network of air ducts, or to the open air of the data center. The data center itself, or a large section of a large data center, typically has an open-plan construction (i.e., no permanent partitions separating air in one part of the data center from air in another part). Thus, in many 20 cases, these data centers have a common space that is temperature-controlled and humidity controlled by multiple HVAC units. [0003] HVAC units for data centers are typically operated with decentralized, stand-alone controls. It is common for each unit to operate in an attempt to control the temperature and humidity of the air entering the unit from the data center. For example, an HVAC unit may 25 include a sensor that determines the temperature and humidity of the air entering the unit to align with set points for that unit. [0004] For reliability, most data centers are designed with an excess number and capacity of HVAC units. Since the open-plan construction allows free flow of air throughout the data center, the operation of one unit can be coupled to the operation of another unit. The excess 30 units and capacity, and the fact that they deliver air to substantially overlapping areas provides a redundancy, which ensures that if a single unit fails, the data center equipment (servers, routers, etc.) will still have adequate cooling. [0005] However, the level of redundancy is rarely uniformly distributed across a data center. For example, some areas of a data center may have a higher amount of heating load, 5 because there are more servers in those areas of the data center, the servers generate more heat (e.g., because they are often run at high utilization), or some combination thereof. In addition, some areas of a data center may have less effective cooling (e.g., because there are fewer or lower capacity HVAC units nearby). If the reliability of a data center is treated atomically, this may lead to over-representing risk and increasing cooling equipment and 10 energy costs, or under-representing risk and introducing the possibility of a catastrophic failure. [0006] Therefore, it is desirable to provide methods and systems that can quantitatively represent the level of reserve and risk at various locations in a data center or another environmentally controlled space. 15 BRIEF SUMMARY [0007] Embodiments of the invention generally relate to calculating a reserve value or a risk value for various locations in an environmentally-controlled space such as a data center, and using the reserve value or risk value to allocate environmental maintenance modules20 and/or load. [0008] For example, historical and other data can be used to determine an influence model for each of one or more environmental maintenance modules, such as HVAC units, in an environmental maintenance system. An influence model can predict a change in a sensor value at a location for a corresponding change in an operation level of an actuator of one of 25 the environmental maintenance modules. Based on the influence model and an operation level of the actuator, a reserve value can be determined for the location. A risk value for the location can be determined using a risk metric that may use the reserve value, a current sensor value at the location, and a threshold sensor value at the location. [0009] Some embodiments can use a reserve metric and/or a risk metric to allocate environmental maintenance modules. For example, a new environmental maintenance module can be placed at a location with a low reserve value and/or a high risk value. [0010] Some embodiments can use a reserve metric and/or a risk metric to allocate load. 5 For example, in a data center, computational load can be allocated to a location with a high reserve value and/or a low risk value. [0011] Other embodiments are directed to systems, portable consumer devices, and computer readable media associated with methods described herein. [0012] A better understanding of the nature and advantages of embodiments of the present 10 invention may be gained with reference to the following detailed description and the

accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS [0013] FIG. 1 shows a plan view of a data center conditioned by HVAC units. [0014] FIG. 2 shows a plan view of an open-plan building conditioned by unitary rooftop15 units. [0015] FIG. 3 shows a schematic diagram of a computer room air handling unit. [0016] FIG. 4 shows a graph of a temperature time series measured at a location in an example data center. [0017] FIG. 5 shows a graph of box plots summarizing temperature time series measured at20 a plurality of locations in the example data center. [0018] FIG. 6 shows a method for allocating IT load using a risk score calculated for a location according to embodiments of the present invention. [0019] FIG. 7 shows a graph of box plots illustrating reserve metric time series measured at a plurality of locations in the example data center. 25 [0020] FIG. 8 shows a graph of box plots illustrating risk metric time series measured at a plurality of locations in the example data center. [0021] FIG. 9 shows a method for allocating virtual machines to server computers using risk scores according to embodiments of the invention. [0022] FIG. 10 shows a block diagram of an exemplary computer system according to some embodiments of the invention. TERMS [0023] An“environmental maintenance system” may include any system for controlling 5 the environment of a space (an“environmentally-controlled space”). Environmental

maintenance systems can include one or more“environmental maintanance modules” such as heating, ventilation, and air conditioning (HVAC) units, computer room air conditioner (CRAC) units, etc. Each of the environmental maintenance modules can include zero, one, or more actuators. In addition, the environmental maintenance system may include one or more10 sensors. [0024] An“actuator” may include any device or process that controls the operation of an environmental maintenance module. An actuator may function mechanically, electrically, electronically, programmatically, or in any other suitable manner. Examples of actuators may include fan speed controllers, heating controllers, etc. 15 [0025] An“operation level” may include any number, percentage, or other quantity that measures the operation of an actuator. For example, if an actuator is a fan speed controller, a corresponding operation level may be a number of revolutions per minute (RPM) of the fan, a percentage of the fan’s maximum RPM, or any other suitable quantity. A“current operation level” may refer to an operation level of an actuator at a specific time. 20 [0026] An“operation threshold value” may include any number, percentage, or other

quantity that measures a threshold for an operation level. For example, the operation threshold value may measure a maximum and/or minimum operation level for an actuator. In the case of a fan, a maximum operation threshold value may be the maximum RPM of the fan, or 100% (if the operation level is a percentage). Similarly, the minimum operation 25 threshold value may be 0 RPM, or the slowest speed at which the fan can be driven. [0027] A“sensor” may include any device that measures a quantity at a location. For example, a sensor may be a thermometer, a hygrometer, a barometer, etc. In some cases, a sensor may be a part of an environmental maintenance module. In other cases, a sensor may be standalone; for example, it may not be associated with an environmental maintenance 30 module. [0028] A“sensor value” may include any measurement or other value of a physical condition of a location determined from a sensor. For example, if a sensor is a thermometer, the sensor value may be a temperature measured by the thermometer. Similarly, if the sensor is a hygrometer, the sensor value may be a humidity measured by the hygrometer. 5 [0029] A“sensor threshold value” may include any sensor value beyond which is

undesirable. For example, a sensor value below a minimum sensor threshold value may be undesirable, and a sensor value above a maximum sensor threshold value may similarly be undesirable. In the case of a thermometer in a data center, for example, a maximum sensor threshold value may be a value above which overheating of a server is likely. A minimum 10 sensor threshold value may be a value below which condensation is likely to form on a

server. [0030] An“influence function” or“influence model” may include any function, formula, model, or other method for predicting the extent to which an actuator’s operation level affects a sensor value. For example, if an actuator is a fan speed controller, and a sensor is a

15 thermometer, an influence function may indicate a temperature decrease that can be achieved as a function of increasing fan speed. [0031] Typically, an influence function is specific to a location (i.e., the location of the sensor); the same actuator may be associated with different influence functions at different locations in an environmentally-controlled space. For instance, the influence function for a 20 fan speed controller may be significantly different at a location several meters from the fan when compared to a location directly adjacent to the fan. [0032] A“reserve metric” may include any metric that can be used to quantify a level of operational reserve associated with a location in an environmentally-controlled space.

Typically, a reserve metric is chosen to quantify the extent to which operation levels of 25 actuators can be altered to change a sensor value at the location. For example, a reserve

metric may measure a temperature decrease at a location if all environmental maintenance modules in an environmentally-controlled space were to be run at full capacity. A“reserve value” may include the value of a reserve metric at a location. [0033] A“risk metric” may include any metric that can be used to quantify a level of 30 operational risk associated with a location in an environmentally-controlled space. Typically, a risk metric can take into account the capability of environmental maintenance modules to influence a sensor value at a location, a current sensor value at the location, and a sensor threshold value at the location. In some cases, a risk metric may take into account a reserve value at the location. For example, a risk metric may measure a temperature difference between a maximum acceptable temperature at a location and a current temperature at the location, and subtract a reserve value at the location. 5 DETAILED DESCRIPTION [0034] Embodiments of the invention generally relate to calculating a reserve value or a risk value for various locations in an environmentally-controlled space such as a data center, and using the reserve value or risk value to allocate environmental maintenance modules10 and/or load. [0035] For example, historical and other data can be used to determine an influence model for each of one or more environmental maintenance modules, such as HVAC units, in an environmental maintenance system. An influence model can predict a change in a sensor value at a location for a corresponding change in an operation level of an actuator of one of 15 the environmental maintenance modules. Based on the influence model and an operation level of the actuator a reserve value can be determined for the location. A risk value for the location can be determined using a risk metric that may use the reserve value, a current sensor value at the location, and a threshold sensor value at the location. [0036] Some embodiments can use a reserve metric and/or a risk metric to allocate 20 environmental maintenance modules. For example, a new environmental maintenance

module can be placed at a location with a low reserve value and/or a high risk value. This allows the modules to be targeted to where they can have the most impact on reducing the likelihood of catastrophic environmental conditions. Reserve and risk metrics in accordance with embodiments are especially preferable to other metrics such as average sensor values 25 (e.g., temperature) over time, since reserve and risk can take into account the unused capacity of environmental maintenance modules. Using reserve and risk values can also allow modules to be placed efficiently, preventing overbuilding and overutilization of capacity beyond what is needed. Thus, embodiments can reduce both setup and ongoing costs of an environmental maintenance system. 30 [0037] Some embodiments can use a reserve metric and/or a risk metric to allocate load.

For example, in a data center, computational load can be allocated to a location with a high reserve value and/or a low risk value. Furthermore, allocating load based on risk and reserve is advantageous over simply allocating resources to locations with desirable current or average sensor values (e.g., temperature), because risk and reserve can take into account the remaining capacity of the environmental maintenance system to maintain environmental 5 conditions. [0038] The above examples highlight only a few of the advantages of calculating and using reserve values and risk values in accordance with embodiments of the inventions. I. EXAMPLE SYSTEMS [0039] Embodiments of the invention relate to environmental maintenance systems that 10 manage conditions in an environmentally-controlled space. FIGs. 1 and 2 describe examples of environmental maintenance systems in a data center and a retail store, respectively. A. Example Data Center [0040] FIG. 1 shows a floor plan of a data center comprising an environmental

maintenance system according to an embodiment of the present invention. Perimeter wall 15 101 may be a perimeter wall of an environmentally-controlled space corresponding to the data center. The data center can include a plurality of environmental maintenance modules 102, a plurality of sensors 103, and a plurality of server racks 104. As shown in FIG. 1, the environmental maintenance modules are computer room air conditioner (CRAC) units. [0041] In one embodiment, environmental maintenance modules 102 are unitary equipment 20 that provide airflow to the data center to cool servers in server racks 104. In one aspect, environmental maintenance modules 102 can cool, heat, humidify, or dehumidify air that passes through them. Sensors 103 are devices that measure environmental parameters, such as temperature or humidity. Sensors 103 can transmit measurements (also called values) by any means, such as by wired or wireless communication means (e.g., Modbus, BACnet, Wi- 25 Fi, WiMAX, ZigBee, or any other applicable protocol). Each environmental maintenance module 102 can include zero, one, or more actuators that change the operation of the environmental maintenance module. The actuators can be controlled by a computer system with one or more processors to provide specified conditions within the data center. B. Example Retail Store [0042] FIG. 2 shows a floor plan of a retail store comprising an environmental maintenance system according to an embodiment of the present invention. In this example, Perimeter wall 201 may be a perimeter wall of an environmentally-controlled space corresponding to the 5 building of the retail store, or may be a space within the store. The environmental

maintenance modules 202 shown in FIG. 2 are roof top units (RTU). As depicted, a wired communication can occur between the environmental maintenance modules 102 and sensors (T) 103 near that particular RTU, but wireless communications may also be used. The environmentally-controlled space can also include merchandise racks 206 and a store10 checkout counter 207. C. Example Computer Room Air Handling Unit [0043] FIG. 3 is a schematic diagram of a computer room air handling unit 300 according to an embodiment of the present invention. Computer room air handling unit 300 is an example of an environmental maintenance module. As shown, computer room air handling 15 unit 300 has a cooling coil 310, which may contain chilled water modulated by a chilled water valve 320. The computer room air handling unit 300 also has a reheat coil 330 (e.g. an electric coil) and a humidifier 340 (e.g., an infrared humidifier). [0044] In one embodiment, fan 350 is a centrifugal fan driven by an A/C induction motor. The induction motor may have a variable speed (frequency) drive VSD 355 for changing its 20 speed. A wireless sensor 360 measures return air temperature, a wireless sensor 370

measures discharge air temperature, and a wireless control 380 to control the VSD 355. In some embodiments, the VSD 355 and/or the wireless control 380 can be included in an actuator that controls fan 350. The discharge air temperature sensor 370 and return air temperature sensors 360 may be probes tethered to the wireless control 380 rather than25 separate wireless sensors. [0045] In one embodiment of operation, the wireless sensors 360 and 370 send readings over the radio to a wireless network gateway, which passes the signals to a control computer of an environmental maintenance system. The control computer can send actuation commands to the wireless gateway, which relays the commands to the wireless control 380,30 which changes the operation level (e.g., speed) of the variable speed drive 355. II. MAINTAINING TEMPERATURE [0046] It is often useful to measure the performance of an environmental maintenance system. For example, it may be important to ensure that conditions (e.g., temperature) in the corresponding environmentally-controlled space always remain within sensor threshold 5 values (e.g., a minimum and maximum temperature). A. Temperature Time Series [0047] FIG. 4 shows a graph 400 of a temperature time series measured by a sensor at a location 1 in a data center over a selected period of time. More precisely, graph 400 shows the difference, DeltaT, between the measured temperature value and a maximum temperature 10 threshold value. The threshold value may have been selected for different reasons, for

example for triggering a high temperature alarm, or as an indicator of elevated risk to IT equipment, or any other suitable reason. [0048] In this example, the graph 400 indicates that location 1 had large temperature variations in the past but stayed well below the temperature threshold all the time. Without 15 context, i.e., without comparing this information to that at other locations and to other

environmental data, it can be difficult, if not impossible, for a data center operator to assess if location 1 is a good place to add additional IT load. The time series in the example expresses little more than“it was cold most of the time.” [0049] A graph like graph 400 is a good tool for an operator to quickly assess the current 20 and past environmental conditions (not limited to temperature) at one or few locations.

However, due to crowding, time series graphs lose their usefulness if too many time series are shown together in one graph. B. Temperature Box Plots [0050] FIG. 5 shows a graph 500 including box plots of the DeltaT time series of all 25 environmentally monitored location in the data center. A box plot is a visualization of

summary statistics of a set of data. In this case, each box spans the second and third quartiles of the associated time series data. The attached vertical‘whiskers’ indicate the total range of data in the associated time series. The line at the notch in each box indicates the median of the associated time series data. [0051] Each box represents one location in the data center. The boxes are spread out horizontally in the graph and an associated location label is listed below each box. The horizontal ordering of the boxes can be changed to better express a sorting or ranking. For example, the boxes could be sorted by any one of the features of a box plot to express 5 different views and needs of a user. Alternatively, the boxes could be ordered by the

endpoint of the upper whisker in decreasing order, or by the lower edge of the box, or by any other features. [0052] Other types of environmental time series data can be compared in the same manner, including operational data of cooling equipment. For example, cooling equipment cooling10 capacity time series and associated box plots can help to compare equipment usage over time. [0053] A graph such as graph 500 allows a data center operator to better assess a location. For example, it is clear that location 1 is variable in temperature compared to most other locations but is also mostly much colder than most. In this example, a data center operator could be inclined to think of location 1 as a comparably (environmentally) safe location. 15 [0054] However, relying on temperature alone may not always be advantageous, at least because the temperature at a location over time does not indicate whether the environmental maintenance system is significantly underutilized or overburdened when maintaining the measured temperature. An overburdened system can lead to situations where a small change in heating load can cause significant swings in temperature, and even catastrophic

20 overheating. An underutilized system can lead to increased costs due to unnecessary

infrastructure and energy expenditures. [0055] Embodiments can address these issues by providing methods for calculating and using reserve and risk values for various locations in an environmentally-controlled space. III. RESERVE AND RISK UTILIZATION METHODS 25 [0056] FIG. 6 shows a method 600 for managing an environmental maintenance system using reserve and risk values calculated for locations in an environmentally-controlled space. [0057] At step 601, an influence model for each actuator of one or more environmental maintenance models in the environmental maintenance system is obtained. The influence model, which may also be referred to as a influence function, transfer function, transfer 30 matrix, may indicate the extent to which changing an operation level of an environmental maintenance module’s actuator affects a sensor value at the location. For example, if an actuator is a fan speed controller, and a sensor is a thermometer, an influence model may indicate a temperature decrease that can be achieved as a function of increasing fan speed. [0058] The influence model for an actuator may be determined in any suitable manner. For example, in some embodiments, an influence function can be derived from historical data, 5 such as operation levels and sensor values measured in an environmentally-controlled space over time. For example, a regression analysis can be performed to determine a function that correlates the operation level of an actuator to a sensor value at a location. In some embodiments, an influence function can be derived from experimental data. For example, sensor values at a location may be measured while the operation level of a single actuator is 10 varied (and all other actuator operation levels remain fixed). A regression analysis may again be performed to determine an influence function. In some embodiments, a combination of experimental, historical, and/or other data may be used to determine an influence model. [0059] At step 602, a current operation level for each actuator is determined. A current operation level may include any number, percentage, or other quantity that measures the 15 operation of an actuator at a specific time. For example, if an actuator is a fan speed

controller, a corresponding operation level may be a number of revolutions per minute (RPM) of the fan, a percentage of the fan’s maximum RPM, or any other suitable quantity. [0060] At step 603, an operation threshold value for each actuator is determined. An operation threshold value may include any number, percentage, or other quantity that 20 measures a threshold for an operation level. For example, the operation threshold value may measure a maximum and/or minimum operation level for an actuator. In the case of a fan, a maximum operation threshold value may be the maximum RPM of the fan, or 100% (if the operation level is a percentage). Similarly, the minimum operation threshold value may be 0 RPM, or the slowest speed at which the fan can be driven. 25 [0061] At step 604, a value of a reserve value at the location is calculated using a reserve metric. A reserve metric may include any metric that can be used to quantify a level of operational reserve associated with a location in an environmentally-controlled space.

Typically, a reserve metric is chosen to quantify the extent to which operation levels of actuators can be altered to change a sensor value at the location. 30 [0062] In some embodiments, the reserve metric can use the current operation level of an actuator, the operation threshold value of the actuator, and the influence model of the actuator. For example, in the case of a data center, a reserve metric may measure a temperature decrease at a location if all environmental maintenance modules in an environmentally-controlled space were to be run at full capacity. Further discussion of reserve metrics may be found in subsection A. [0063] The reserve metric is a time series that is derived, in part, from other time series. As 5 such it can be plotted or summarized in the same way, for example by a box plot, as is shown in FIG. 7. [0064] At step 605, a current sensor value at the location is determined. A sensor value may include any measurement or other value determined from a sensor. For example, if a sensor is a thermometer, the sensor value may be a temperature measured by the

10 thermometer. Similarly, if the sensor is a hygrometer, the sensor value may be a humidity measured by the hygrometer. [0065] At step 606, a sensor threshold value at the location is determined. A sensor threshold value may include any sensor value beyond which is undesirable. For example, a sensor value below a minimum sensor threshold value may be undesirable, and a sensor value 15 above a maximum sensor threshold value may similarly be undesirable. In the case of a

thermometer in a data center, for example, a maximum sensor threshold value may be a value above which overheating of a server is likely. A minimum sensor threshold value may be a value below which condensation is likely to form on a server. [0066] At step 607, a risk value is calculated for the location. The risk metric used to 20 calculate the risk value may include any metric that can be used to quantify a level of

operational risk associated with a location in an environmentally-controlled space. Typically, a risk metric can take into account the capability of environmental maintenance modules to influence a sensor value at a location, a current sensor value at the location, and a sensor threshold value at the location. In some cases, a risk metric may take into account a reserve 25 value at the location. For example, a risk metric may measure a temperature difference

between a maximum acceptable temperature at a location and a current temperature at the location, and subtract a reserve value at the location. [0067] In some embodiments, the risk metric can combine: (1) the current state of the data center; (2) modeling information by way of predictions, e.g., using a reserve metric; and (3)30 configuration data, specifically predetermined temperature threshold determined at step 606 to trigger alarms, cause concerns, or do damage to IT equipment. _{[0068] A point-based risk metric could be, for example, risk (n,t) = ΔT - reserve (n, t),} where ΔT is the difference between the current sensor value and the sensor threshold value at the location n at the time t, and where reserve(n, t) is the reserve metric at the location at the time t. This metric has units of temperature. The risk of overheating at a selected 5 location can be considered lower if the risk value is more negative, which is the result of more reserve and more distance from the selected temperature threshold. Very negative risk values are thus considered good in this definition and provide for a more natural ordering as shown in FIG. 8. [0069] At step 608, the calculated reserve value and the risk value are provided to manage 10 the environmental maintenance system. For example, in some embodiments, the risk value can be provided to allocate IT load, such as the locations of equipment and the amount of computational load placed on the equipment. The risk value can be converted into a risk score by grouping locations of similar risk profile together. It is sometimes difficult to define absolute risk thresholds to decide if a risk is unacceptable, or if the risk is so low that 15 additional IT load can be deployed at that location. It may then be useful to group locations relative to each other. Specifically, one could consider only the 5 (or some other number) locations with the most negative risk value as relatively risk free, or one could use a percentile function to determine the tails of the risk distribution and so select unusually risky or risk-free locations and consider those for IT configuration changes. 20 [0070] These graphs can preferably also be used to decide where not to put new IT load, but use some other selection criteria to select among the remaining locations to new IT load. [0071] It may be preferable for a risk averse operator to distribute the IT load and configure the cooling equipment in the data center in such a way that the risk profile is about the same at each monitored location so that there are no unusually good or unusually bad (with respect25 to risk or other metric) locations anymore. [0072] Box plots acknowledge the fact that a data center is dynamic and that environmental variables change continuously. Since the boxes are summary representation of the underlying time series data, the boxes qualitatively do not change as fast or often as the time series data. It may therefore be advantageous for an operator to monitor such a box plot over 30 longer period of time for qualitative changes and assess the change in risk through how the box plot characteristic changes. For example, the box plot may indicate at one time that a data center has many potential locations where new IT load could be placed. If the operator does not need to place new IT load, this information is not useful at first. However, if the number of suitable locations is shrinking over time, it could be an indication of some form of deterioration in the data center that warrants further investigation. [0073] If there is a location that has been determined to be more suitable (by being less 5 risky) for additional IT Load or IT equipment, it may be preferable to not change the level of IT load at that location, but to change what computational processes constitute the IT load at that location. Specifically, if given the option of running a mission critical computational process on one of two servers that are located at two different locations in the data center, a process scheduler may advantageously execute the process on the server that is located at the10 lower RISK location of the two. [0074] In addition, a risk or reserve metric may be used in conjunction with emergency shutdown procedures to manage heat in the catastrophic absence of cooling. These procedures define, for example in what order and how quickly to shut down less essential software and hardware. Risk assessments (e.g., using a risk metric) can help develop these 15 procedures, make them more relevant for the actual data center configuration (rather some assumed configuration), and extend the operational time of mission critical processes during emergency situations. These processes can redeveloped for different states of the system. For example, the optimal emergency shutdown sequence may be different if a particular CRAC is on or off when the emergency happens. Examples of emergencies may include 20 power outages on the cooling equipment, or half of that equipment if each half is on different electric circuits. [0075] It should be noted that although the risk and reserve metrics described with reference to FIG. 7 discuss the use of computer room air handlers (CRAHs) to cool a data center, such description is used for illustrative purposes, and not intended to be limiting. For 25 example, in some embodiments of the invention, environmental maintenance modules may be primarily used to heat a space, such as a retail store during a cold winter. In such embodiments, the reserve value may measure an amount of heating reserve (i.e., remaining heating capacity of the environmental maintenance units). Similarly, the reserve value may measure an amount of heating risk, wherein the sensor threshold value determined at step 606 30 may be a minimum threshold temperature (e.g., beyond which customers in a store would be too cold). * A. Reserve Metric Calculation Methods [0076] A reserve function often combines: (1) the current utilization of the environmental maintenance modules; (2) the limitations of the environmental maintenance modules; and (3) the influence the environmental maintenance modules on a sensor value at a location in an 5 environmentally-controlled space. The first feature in the above list expresses actuals while the second and third features express predictions or what-if calculations. Embodiments of the invention can employ the mathematical‘influence’ model determined in step 601 to correlate historic changes in equipment cooling to subsequent changes of monitored environmental variables in the data center. The specific reserve metric that is defined next is one example of10 such a combination of features. [0077] In some embodiments, a reserve value at a selected location is defined as the largest achievable temperature drop at that location that could be caused by modifying operation levels of any or all actuators in an environmental maintenance system. [0078] For example, assume an environmental maintenance module, k, is a Computer 15 Room Air Handler (CRAH) with controllably variable fan speed. The sensors in the

environmental maintenance system measure a temperature at various locations within the space. At step 601, an influence model was determined that expresses how changing this fan speed impacts the temperature at a selected location, n, in the environmentally-controlled space. In some embodiments, the predicted temperature change, dT(n, k), at that selected20 location, n, due to a change, dF(k), of the fan CRAH’s fan speed can be expressed as

dT(n, k) = I(n, k) * dF(k) where I(n, k) is an influence coefficient. Typically, dT(n, k) will have a negative slope, since an increase in fan speed dF(k) typically results in a decrease in temperature dT(n, k). However, it should be noted that other embodiments can use other models for determining dT(n, k)., 25 [0079] The fan speed at a selected point in time, t, can be expressed as F(k, t). In some embodiments, the fan may have hard or configured limits Fmin(k) and Fmax(k) . In such embodiments, the maximal temperature drop that this CRAH is expected to be able to effect on the selected location is: dT(n, k, t) = I(n, k) ( Fmax(k) - F(k,t)) if I < 0, or dT(n, k, t) = I(n, k) (-Fmax(k)- F(k,t)) if I > 0. [0080] The first of these equations would be used if the CRAH had a cooling influence on the selected location when its fan speed is increased (which would typically be the case). The second of these equations would be used if the CRAH had a heating influence on the selected location when its fan speed is increased. The latter is known to happen in real data centers 5 due to airflow patterns. [0081] In some embodiments, the total temperature change, dT(n, t), that is deemed achievable by appropriate operation level changes to all actuators (e.g., fan speed) at the selected time, t, is calculated to be the total sum of the above calculated dT(n, k, t) from each environmental maintenance module, k. More formally,

10 [0082] In some embodiments, he reserve metric can be expressed as reserve(n,t) = – dT(n, t), A large (in absolute terms) reserve implies that the combined environmental maintenance modules have the potential to be highly influential on the selected location. Combining all of the above expressions, the reserve metric can also be expressed as:

[0083] Where I(n, k) is the value of the influence model for an environmental maintenance 15 module k at the location n, and wherein dF(n, k, t) is a difference between an operation threshold value and a current operation level for an actuator associated with the

environmental maintenance module k. [0084] Clearly, if each environmental maintenance module was already at its respective limit for the selected location, the reserve is zero, which means that any change to operation20 levels is predicted to increase the temperature at that location. [0085] This reserve metric is point-based since it takes into account the impact of operation level change at one selected location (or point in space) at a time. However, maximizing the cooling impact on one location could have a detrimental impact on another location. In some embodiments, a reserve metric can determine as the reserve the maximal achievable

25 temperature change at a selected location that does not also raise the temperature at another location above a selected threshold. Such a reserve metric will be generally smaller than the metric presented above. [0086] A further improvement to the reserve metric takes into account the possibility that one, two, or more of the environmental maintenance modules in the data center could fail at any time. The reserve metric could be reduced to the value that is the smallest reserve under all selected failure scenarios. This could be called a worst-case reserve metric. It may then also be useful to record for each location the one, two, or more environmental maintenance modules whose potential failures are the cause of the worst-case reserve metric value at that 5 location. Then, if a module is associated with the worst-case reserve of many locations one could deduce that that piece of equipment is mission-critical and potentially in need of redundant backup. [0087] As an example of the value of the worst-case reserve metric improvement, consider the case where several CRAHs provide cooling to a selected location. Assume that all have a 10 cooling influence on that location but all but one are maxed out. For simplicity, assume that the remaining CRAH is currently not providing any cooling. The reserve at that location is therefore good because this remaining CRAH could increase its cooling output if necessary. However, the worst-case reserve metric would be zero because after a failure of this CRAH there is no additional cooling source left. Failure of another CRAH could be balanced by 15 said remaining CRAH but that also leaves no reserve. Finally, the worst-case reserve in this case could even be negative if said remaining CRAH has less absolute influence on the selected location than one of the other CRAHs. [0088] Despite being point-based, the reserve metric implicitly captures some aspects of the other locations by referring to the current operation levels of environmental maintenance 20 modules. Specifically, if other locations are particularly hot, or if heating load is generally high compared to the total design cooling capacity of the environmental maintenance modules, the environmental maintenance modules should be already running closer to their respective limits thus reducing the available reserve at a location, even if that location would be considered cool judging by its temperature alone. 25 B. Reserve Box Plot [0089] FIG. 7 shows a graph 700 of box plots illustrating the reserve time series

corresponding to the data shown in graphs 400 and 500. The location labels on the horizontal axis are the same as in the previous examples. [0090] In this example, some locations exhibit large variations in reserve and occasionally 30 had no reserve at all in the past. When there was no reserve, an IT load spike could have increased temperatures without the cooling equipment having the ability to suppress the resulting temperature spike. However, if the expected spike had been comparably small, the spike may not have been enough to raise the temperature above an alarming threshold or other threshold. So despite being, in a sense, uncontrollable when there is no cooling reserve, at a selected location there may be little risk to the data center if that location happens to be 5 quite cool at that time anyway. C. Risk Box Plot [0091] FIG. 8 shows a graph 800 of box plots illustrating risk metric time series measured at a plurality of locations in the example data center. The boxes are sorted from left to right by increasing value of the upper box edge to express increasing risk. 10 [0092] In this example data center the DeltaT box plot (graph 500) and the risk box plot (graph 800) correlate so that high temperatures mostly also imply more risk. There are, however, non-obvious surprises. For example, location 22 had high temperatures (graph 500) compared to most other locations in the data center but it also had unusually high reserves, so that it ends up with about medium risk. Depending on data center configurations one can 15 easily expect to find high-risk points that have been historically cool while lacking good

reserves. One should avoid directing IT load to such a location. [0093] It can be useful to visualize risk by superimposing a value-colored map of location- interpolated risk values onto a floor plan of the data center in order to more easily find clusters of risky or less risky locations. 20 IV. VIRTUAL MACHINE ALLOCATION METHODS [0094] In some embodiments, it may be preferable to communicate reserve and risk values or a selection of least risky locations to a virtualization or virtual machine manager so that that virtual machine manager can move mission-critical IT load or computational processes preferably to those locations. 25 [0095] FIG. 9 shows a method 900 for allocating virtual machines to server computers using risk values. Allocating a virtual machine may happen periodically (e.g., at regular intervals), upon an event (e.g., when the virtual machine is started), or at another time. In some embodiments, method 900 may be performed by a virtual machine manager. [0096] At step 901, the risk values at one or more locations in a data center are determined. The risk scores may be determined using any suitable method, such as method 600 as shown in FIG. 6. [0097] At step 902, a risk value of one or more server computers is determined using the 5 risk values of the one or more locations. In some embodiments, risk values for servers may be determined using an average of the risk values of locations near the server computer, wherein the average is weighted in proportion to the proximity of the risk values. [0098] At step 903, a criticality of the virtual machine is determined. The criticality of the virtual machine may indicate how essential the task performed by the virtual machine is. For 10 example, a virtual machine running a production web server or database may be highly

critical, whereas a virtual machine performing a routine backup operation may be less critical. [0099] At step 904, the virtual machine is allocated onto a server computer based on the risk values determined at step 902 and the criticality of the virtual machine determined at step 15 903. For example, in some embodiments, a virtual machine manager could use the risk

value, and the associated metrics that it is composed of, to determine which storage device and which cores (servers) among several should be used to run a virtual machine. High- priority VMs could be run on cores and storage arrays that have large reserve. This is related to, but not exactly the same as, deciding where to add IT load. Rather the question is more 20 one of IT Load distribution to produce the lowest computational application risk to the data center operator. [0100] Adding or subtracting IT Load can change the configuration in a way that makes the model predictions initially less reliable after the configuration change, especially if hardware changes are involved (such as adding a server to an available server rack slot). 25 However, moving computational processes around without changing the IT load much locally has benefits to the consumer of these processes (better guarantee of high availability) but also benefits to the data center operator (fewer actual configuration changes that make model- based predictions less reliable, at least until the model is updated to reflect the configuration changes). V. COMPUTER SYSTEM [0101] FIG. 10 is a high level block diagram of a computer system that may be used to implement any of the entities or components described above. The subsystems shown in FIG. 10 are interconnected via a system bus 1075. Additional subsystems include a printer 5 1003, keyboard 1006, fixed disk 1007, and monitor 1009, which is coupled to display adapter 1004. Peripherals and input/output (I/O) devices, which couple to I/O controller 1000, can be connected to the computer system by any number of means known in the art, such as a serial port. For example, serial port 1005 or external interface 1005 can be used to connect the computer apparatus to a wide area network such as the Internet, a mouse input device, or a 10 scanner. The interconnection via system bus 1075 allows the central processor 1002 to

communicate with each subsystem and to control the execution of instructions from system memory 1001 or the fixed disk 1007, as well as the exchange of information between subsystems. The system memory 1001 and/or the fixed disk may embody a computer- readable medium. 15 [0102] Storage media and computer-readable media for containing code, or portions of code, can include any appropriate media known or used in the art, including storage media and communication media, such as but not limited to volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage and/or transmission of information such as computer-readable instructions, data structures, program 20 modules, or other data, including RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, data signals, data transmissions, or any other medium which can be used to store or transmit the desired information and which can be accessed by the computer. Based on the disclosure and 25 teachings provided herein, a person of ordinary skill in the art will appreciate other ways and/or methods to implement the various embodiments. [0103] The above description is illustrative and is not restrictive. Many variations of the invention may become apparent to those skilled in the art upon review of the disclosure. The scope of the invention may, therefore, be determined not with reference to the above

30 description, but instead may be determined with reference to the pending claims along with their full scope or equivalents. [0104] It may be understood that the present invention as described above can be implemented in the form of control logic using computer software in a modular or integrated manner. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art may know and appreciate other ways and/or methods to implement the present 5 invention using hardware and a combination of hardware and software. [0105] Any of the software components or functions described in this application, may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C++ or Perl using, for example, conventional or object- oriented techniques. The software code may be stored as a series of instructions, or

10 commands on a computer readable medium, such as a random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a CD-ROM. Any such computer readable medium may reside on or within a single computational apparatus, and may be present on or within different computational apparatuses within a system or network. 15 [0106] One or more features from any embodiment may be combined with one or more features of any other embodiment without departing from the scope of the invention. [0107] A recitation of "a", "an" or "the" is intended to mean "one or more" unless specifically indicated to the contrary.