Contractors, construction and work in live facilities

Data centers are rarely finished. Campuses are built in phases, with new halls going up beside halls that are already full of customer equipment. Existing halls are retrofitted for denser equipment, with new busway, larger power distribution and liquid cooling piped into the white space. Generators, chillers and switchgear are replaced at the end of their lives. Each of these projects brings construction workers, specialist trades and equipment vendors into a live mission-critical facility, often in large numbers. On a big campus, contractors may outnumber the operator's own staff many times over.

This lesson covers how contractors are managed, how permits to work are used, how construction zones are separated from live areas, the interfaces where construction work touches live systems, and the handover of new systems to operations. It builds on the roles described in Lesson 2 and the change control described in Lesson 9. HSE-221, Permit-to-Work Systems, covers permit systems in general, and DCE-470 covers project delivery and contracts.

The contractor management cycle

Good contractor management follows a cycle that starts long before the contractor arrives and ends after it leaves.

Prequalification screens out contractors who cannot work safely, but it does not guarantee that a good contractor's workers know how this particular site works. That is the job of orientation, which should cover the site rules, access and escort rules, the hazards of the specific areas where the work will happen, the emergency procedures, the permit system, the reporting of incidents and near misses, and the stop-work authority that every worker has.

Supervision is the stage that most often fails. The operator cannot watch every contractor all the time, and contractors working at night in a quiet corner of a large campus may not see anyone from the operator for hours. Clear responsibility for supervision, regular walk-throughs, and a culture in which contractors feel able to raise problems with the operator are all needed.

Permits to work

A permit to work is a written authorization for a specific job in a specific place for a specific time, issued after the hazards have been assessed and controls put in place. In data centers, permits are commonly used for the following kinds of work.

• Hot work, such as welding, brazing, soldering, grinding and cutting, which can start fires and set off detection and suppression systems.
• Energized electrical work, which requires a justified energized electrical work permit under CSA Z462 or NFPA 70E.
• Lockout and isolation of electrical and mechanical systems.
• Confined space entry, for example into tanks, vaults or some underfloor spaces.
• Work at heights, roof access and the use of aerial work platforms.
• Excavation and ground disturbance near buried duct banks and utilities.
• Fire protection impairments, when detection or suppression must be taken out of service.
• Lifts with cranes over or near live buildings.

Fire protection impairments deserve special attention in data centers. Construction dust, welding fume and even heavy cutting can set off the very sensitive aspirating smoke detection used in data halls, and in some designs detection can trigger pre-action sprinklers to charge with water or start the countdown to a clean agent discharge. To prevent false alarms, detection zones near the work are sometimes isolated. That creates a real hazard: a fire in an area with isolated detection may not be detected in time. Impairments must therefore be authorized under a formal procedure, kept as small and as short as possible, notified to the fire alarm monitoring service and often the insurer, and covered by compensating measures such as a fire watch. NFPA 75 and the fire protection inspection, testing and maintenance standards deal with impairments, and DCE-440 covers them in more detail. HSE-323 covers the hazards of the suppression systems themselves.

Permits must also be coordinated with each other. Two permits that are each safe on their own can be unsafe together: hot work in an area where detection has been isolated without a fire watch, a crane lift over a roof where another crew is working, or a lockout on one system while a MOP on another assumes it is running. The permit issuer should check for conflicts before issuing each permit.

# Check a day's permits for dangerous combinations in the same zone and time
permits = [
    {"id": "HW-17", "type": "hot work", "zone": "Hall 3", "start": 8, "end": 12, "fire_watch": True},
    {"id": "IMP-04", "type": "detection impairment", "zone": "Hall 3", "start": 7, "end": 16},
    {"id": "HW-18", "type": "hot work", "zone": "Hall 3", "start": 13, "end": 15, "fire_watch": False},
    {"id": "LIFT-2", "type": "crane lift", "zone": "Roof B", "start": 9, "end": 11},
    {"id": "RF-09", "type": "roof work", "zone": "Roof B", "start": 10, "end": 14},
]

def overlap(a, b):
    return a["zone"] == b["zone"] and a["start"] < b["end"] and b["start"] < a["end"]

for i, a in enumerate(permits):
    for b in permits[i + 1:]:
        if not overlap(a, b):
            continue
        kinds = {a["type"], b["type"]}
        if kinds == {"hot work", "detection impairment"}:
            hw = a if a["type"] == "hot work" else b
            status = "OK, fire watch assigned" if hw.get("fire_watch") else "CONFLICT: no fire watch"
            print(f"{a['id']} + {b['id']} in {a['zone']}: {status}")
        elif kinds == {"crane lift", "roof work"}:
            print(f"{a['id']} + {b['id']} in {a['zone']}: CONFLICT: clear roof under lift")

HW-17 + IMP-04 in Hall 3: OK, fire watch assigned
IMP-04 + HW-18 in Hall 3: CONFLICT: no fire watch
LIFT-2 + RF-09 in Roof B: CONFLICT: clear roof under lift

A simple check like this catches the two classic conflicts: hot work in an impaired detection zone without a fire watch, and people working under a crane lift. Real permit systems hold far more detail, but the principle of checking each new permit against those already open is the same.

Separating construction from live areas

When a new hall is built beside or inside a live facility, the construction zone and the live facility need to be separated physically and administratively. Physically, that usually means solid temporary walls, often called hoarding, sealed against dust; separate entrances for construction workers where possible; sticky mats and negative pressure at openings between the two areas; and protection for live systems that pass through the construction zone, such as conduits, duct banks or chilled water piping. Administratively, it means a clear agreement about who controls each area. In the construction zone, the general contractor usually acts as the prime contractor or constructor under provincial law, or as the controlling employer under OSHA's multi-employer policy, and runs its own safety program. In the live facility, the operator remains in control, and construction workers who cross into it follow the operator's rules, access controls and change process.

Interfaces with live systems

The most dangerous moments in a construction project in a live facility are the interfaces, where new work connects to systems that are already serving customers. Examples include electrical tie-ins of new switchgear or busway to live distribution; chilled water tie-ins, sometimes made with line stops or hot taps so that the live loop does not have to be drained; connections of new fire alarm devices to the live fire alarm system; and the first energization of new equipment. Each interface should be treated as a change in the live facility, with an approved MOP, permits, the operator's involvement and, usually, a maintenance window. Keep a register of interfaces so that none is missed.

Other construction activities can harm the live facility or the people in it even without a formal tie-in. Core drilling or cutting into slabs and walls can strike embedded conduits carrying live cables, so locations should be scanned with ground-penetrating radar or similar methods and checked against drawings before drilling. Vibration from drilling and heavy equipment can disturb sensitive equipment. Hydrostatic testing of new piping can release water. Excavation outside can strike buried duct banks feeding the facility; utility locates and hand digging near marked lines are essential. Cranes lifting equipment onto roofs may swing loads over occupied areas or live equipment; lift plans and exclusion zones are needed, as HSE-219 explains.

Commissioning and handover

New systems are commissioned before they carry the live load: equipment is tested individually, then systems are tested together, often with load banks that simulate the IT load by turning electricity into heat. DCE-450 covers commissioning. Load banks bring their own hazards: high-power cables and connections, hot exhaust air and noise. Integrated systems testing may involve deliberately failing utility power, generators or UPS modules to prove that the system responds correctly, and these tests must be planned as carefully as any MOP.

Handover is the moment when control of a new system passes from the construction team to operations. It must be clear and documented, because the hazards change at that point. Once new switchgear or busway is energized, it is live equipment under the operator's electrical safety program, and construction workers who were used to working on it de-energized may no longer touch it without the operator's authorization, lockout and permits. Many serious incidents in new facilities happen around energization, when not everyone has understood that a system that was dead yesterday is live today. Clear signs, communication to every crew, and changes to access and lockout control at energization help prevent them.