Energized work: justification and permits

Every critical facility will, sooner or later, receive a request to work on equipment while it is energized. It may come from a customer who does not want a maintenance window, from a project manager whose schedule is slipping, from an operations manager who would rather not run the load on a single path overnight, or from a technician who has done the task live many times before at other sites. HSE-224 Lesson 1 explains why energized work is the last resort, and Lesson 6 of that course explains energized electrical work permits. This lesson applies both to the specific pressures of data centres, where the business case for energized work is often presented strongly and where the ability to say no, and to offer a better alternative, is a core skill for anyone with authority over electrical work.

The rule

Both CSA Z462 and NFPA 70E start from the same rule: energized electrical conductors and circuit parts must be put into an electrically safe work condition before a worker performs work inside the limited approach boundary or interacts with equipment where there is an increased likelihood of an arc flash. Energized work is permitted only in two circumstances.

• Additional hazards or increased risk. De-energizing would introduce additional hazards or increased risk, for example by interrupting life support equipment, deactivating emergency alarm systems or shutting down ventilation for hazardous locations.
• Infeasibility. The task is infeasible in a de-energized state because of equipment design or operational limitations, for example diagnostics and testing that require the circuit to be energized, such as voltage measurement, troubleshooting or commissioning tests that need power.

Both standards add that energized work may also be done where the circuit operates at less than 50 V and the risk assessment shows no increased exposure to electrical burns or explosion from arcs. And both are explicit that the employer's convenience, the cost of a shutdown or a production schedule do not by themselves make de-energizing infeasible.

Infeasible or inconvenient?

The hardest part of applying the rule in a data centre is separating tasks that are genuinely infeasible to do de-energized from those that are merely inconvenient. A useful question is: could this task be done with the equipment de-energized if the facility accepted the cost, effort and planning that would require? If the answer is yes, the task is not infeasible.

The pattern is clear. Diagnostic and testing tasks often genuinely require energy, although they can usually be done without opening equipment, by using IR windows, monitoring systems, permanently installed meters or absence-of-voltage testers. Installation, repair and modification tasks almost never require energy. They require planning.

The single-corded load argument

One argument comes up more than any other in data centres: 'This equipment is single-corded and cannot go down, so the panel feeding it must be worked on energized.' The argument deserves a careful answer.

First, it is a statement about the business risk of an outage, not about the feasibility of de-energizing. The equipment can be de-energized; the owner does not want it to be. Second, there are usually ways to protect the load without exposing a worker: a static transfer switch or rack-mounted automatic transfer switch to give the load two sources, a temporary feed from another panel installed under a separate isolation, migrating the workload to other equipment, or a short, planned outage agreed with the customer. Third, if none of those is possible, the facility should ask why critical equipment was installed with a single point of failure, and fix that, rather than transferring the risk to the electrician.

Weighing the risk honestly also helps. An arc flash during energized work can kill or disable the worker and destroy the equipment, causing exactly the outage that the energized work was meant to avoid, plus a much longer recovery. A planned, short outage under a MOP is a known, controlled event.

Energized work on busway tap-offs

Plug-in busway is designed so that tap-off units can be installed and removed while the busway is energized. Manufacturers provide procedures for this, and the tap-off units include features such as interlocks that keep the unit's switch open while it is being plugged in and grounding contacts that engage first. Because the system is designed for it, many operators treat live tap-off installation as acceptable. It is still energized work inside the limited approach boundary, often from a ladder or lift, with some arc flash risk if the unit is misaligned, damaged or plugged in with its switch closed. Sites take different positions:

• Some require the busway section to be de-energized for every tap-off installation, using the facility's redundancy to keep the loads on their other feed.
• Some allow live installation of tap-offs under a standing risk assessment and a specific procedure, by trained and qualified persons, with the tap-off switch verified open, arc-rated PPE appropriate to the busway label and the area below closed.
• Most require de-energizing for any tap-off that is damaged, that shows signs of overheating or that must be removed after a fault.

Whatever the site decides, the decision should be made by the electrical safety program, in writing, with a risk assessment, not left to the person on the ladder. Where the decision is to allow live installation, both standards still require the shock and arc flash risk assessments and appropriate PPE, and the site program should say whether a permit is required for each instance or whether the standing assessment covers it.

The energized electrical work permit

When energized work is justified, both standards require an energized electrical work permit, with limited exemptions. The permit must include at least:

• A description of the circuit and equipment to be worked on and its location.
• A description of the work to be done.
• The justification for why the work must be done energized.
• A description of the safe work practices to be used.
• The results of the shock risk assessment, including the voltage, the limited and restricted approach boundaries and the necessary shock protection.
• The results of the arc flash risk assessment, including the available incident energy or PPE category, the arc flash boundary and the necessary PPE.
• The means used to restrict access of unqualified persons to the work area.
• Evidence that the job briefing has been completed, including a discussion of any job-specific hazards.
• Energized work approval by the responsible management or safety officer or owner.

Permits are not required for certain tasks performed by qualified persons, such as testing, troubleshooting and voltage measuring; thermography and visual inspections that do not cross the restricted approach boundary; access to and egress from an area with energized equipment when no electrical work is done and the restricted approach boundary is not crossed; and general housekeeping and miscellaneous non-electrical tasks that do not cross the restricted approach boundary. These tasks still require the risk assessments, boundaries and PPE that apply; they are exempt only from the permit.

Who approves

The approval signature is the key control in the permit, and in a critical facility it must belong to someone who has both the authority and the independence to refuse. Common practice is to require approval by a senior facility or operations manager, and in many organizations also by a safety professional or the electrical safety program owner. The person requesting the work, and the person doing it, should not be the approver.

The approver should test the justification, not just sign it. Useful questions include: Why can this not be done de-energized? What would it take to de-energize, and what would that cost? Can the task be redesigned to avoid opening the equipment? What is the incident energy, and is it within the site's PPE limit? Is the equipment in good condition? Who will be the safety watch, and can they de-energize the equipment quickly if needed? What will we do if an arc flash occurs?

A permit risk check

Many operators use a simple scoring tool alongside the permit, to help approvers see at a glance whether a request needs more scrutiny. The program below shows an illustrative version that flags weak justifications and high-risk conditions. It is a prompt for discussion, not a substitute for the risk assessments the standards require.

# Illustrative energized work request screening (not a substitute for the risk assessments).
WEAK = ("customer", "schedule", "downtime", "overtime", "avoid outage", "convenien", "single path")
STRONG = ("measure", "troubleshoot", "diagnos", "test", "commission")

def screen(req):
    flags, score = [], 0
    j = req["justification"].lower()
    if any(w in j for w in WEAK) and not any(s in j for s in STRONG):
        flags.append("justification reads as convenience: send back to plan an ESWC")
        score += 5
    if req["incident_energy"] > req["site_ppe_limit"]:
        flags.append("incident energy exceeds site PPE limit: energized work not permitted")
        score += 10
    if not req["equipment_good"]:
        flags.append("equipment condition doubtful")
        score += 4
    if req["approver"] in (req["requester"], req["worker"]):
        flags.append("approver is not independent")
        score += 3
    if not req["safety_watch"]:
        flags.append("no safety watch assigned")
        score += 2
    return score, flags

requests = [
    {"id": "EW-101", "justification": "Customer refuses downtime for tap-off replacement",
     "incident_energy": 3.1, "site_ppe_limit": 40, "equipment_good": True,
     "requester": "Lee", "worker": "Dana", "approver": "Emeka", "safety_watch": "Farah"},
    {"id": "EW-102", "justification": "Measure voltage to troubleshoot RPP alarm",
     "incident_energy": 1.8, "site_ppe_limit": 40, "equipment_good": True,
     "requester": "Dana", "worker": "Dana", "approver": "Emeka", "safety_watch": "Farah"},
    {"id": "EW-103", "justification": "Add feeder in main switchboard to avoid outage",
     "incident_energy": 58.0, "site_ppe_limit": 40, "equipment_good": False,
     "requester": "Lee", "worker": "Dana", "approver": "Lee", "safety_watch": ""},
]
for r in requests:
    score, flags = screen(r)
    print(f"{r['id']} score {score:2d}: " + ("; ".join(flags) if flags else "no screening flags"))

EW-101 score  5: justification reads as convenience: send back to plan an ESWC
EW-102 score  0: no screening flags
EW-103 score 24: justification reads as convenience: send back to plan an ESWC; incident energy exceeds site PPE limit: energized work not permitted; equipment condition doubtful; approver is not independent; no safety watch assigned

Request EW-101 is sent back because its reason is the customer's wish to avoid downtime. EW-102 is a measurement task that genuinely needs energy and is exempt from a permit, although the risk assessments and PPE still apply. EW-103 fails on almost every count, above all because the incident energy is beyond any PPE the site provides. A tool like this cannot judge a justification, but it makes the common failure patterns hard to overlook.