Emergency response and a capstone: planning a major maintenance shutdown

This final lesson brings the course together in two parts. The first part covers emergency response to electrical incidents in critical facilities: what to do when someone contacts energized equipment, when an arc flash injures a worker or when electrical equipment catches fire. The second part is a capstone: planning a major maintenance shutdown of the A-side electrical system at Cedar Ridge Colocation, using every skill from the previous eleven lessons. HSE-224 Lesson 11 covers electrical emergency response in general, and HSE-320 Lesson 11 covers data center emergencies for all workers; this lesson focuses on the arrangements that qualified persons and their supervisors must make for electrical work in a critical facility.

Part 1: Emergency response

Planning before the work

Emergency response for electrical work is planned before the work starts, not improvised after an incident. For every MOP that involves electrical work, and especially for energized work and large maintenance windows, the plan should answer these questions.

• Who is the safety watch for each energized task, and are they trained in contact release, CPR and AED use, with training current?
• Where is the nearest means of disconnect for the equipment being worked on, and can the safety watch reach it quickly and safely?
• Where are the nearest AED, first aid kit and burn kit, and has someone checked them?
• How will the crew call for help? Data centers often have poor mobile reception in electrical rooms, so radios or fixed phones may be needed, and the security desk must know how to direct emergency services through the access control system.
• Which hospital is nearest, and which has a burn unit? Severe arc flash burns may need transfer to a specialized center.
• Who has authority to make emergency switching decisions, and what can and cannot be switched to free a victim or isolate a fire without endangering others?

Contact with energized equipment

If a worker contacts an energized conductor and cannot let go, the first rule is that rescuers must not become victims. Do not touch the person until the source has been removed or the person has been separated from it safely.

• De-energize if you can. The fastest safe option is usually to open the disconnecting device for the equipment, if the safety watch knows which device it is and can operate it without entering the hazard. This is why the job plan identifies it in advance.
• Think before pressing an EPO. An emergency power off button will remove power from an entire data hall or room, which may be the right action in a life-threatening emergency, but it may not de-energize the equipment the victim is touching, for example if it is fed from upstream switchgear or a battery. Know in advance what the EPO does and does not cover.
• If you cannot de-energize, release the victim safely. Use an insulated rescue hook or another approved non-conductive device, while wearing appropriate PPE, to pull the victim away from the source. Rescue hooks should be kept at electrical rooms where energized work is done.
• Call for help immediately. Activate the site emergency procedure and call emergency services.
• Give first aid. Check breathing, start CPR if the person is not breathing normally and use an AED as soon as it is available. Electric shock can cause cardiac arrest, and early defibrillation saves lives.

Every person who has received an electric shock should be assessed by a medical professional, even if they feel fine. Electrical injuries can cause internal burns, muscle damage and heart rhythm problems that are not visible and may develop hours later.

Arc flash injuries

An arc flash can cause severe burns, eye injuries, hearing damage from the blast, injuries from flying debris and falls. First aid for arc flash burns follows general burn first aid: ensure the scene is safe and the equipment is de-energized or isolated before approaching; call emergency services; stop any burning by smothering flames, removing smoldering clothing and jewelry unless stuck to the skin; cool burns with cool running water for about 20 minutes where possible; cover with clean, non-adhesive dressings or clean plastic film; keep the person warm to prevent hypothermia; and monitor for shock. Do not apply ice, butter or ointments. Arc-rated clothing that has been exposed should be removed carefully because it may still be hot. HSE-224 Lesson 11 covers this in more detail.

Electrical fires

Electrical fires in data centers are most often detected early by very early warning smoke detection and may trigger clean agent or sprinkler systems, which HSE-323 covers. For people on the scene, the rules are: raise the alarm, do not use water on energized equipment, use a suitable extinguisher such as carbon dioxide or a clean agent extinguisher only if trained and if the fire is small and you have a clear escape route, and evacuate if the fire grows or a clean agent pre-discharge alarm sounds. Operations staff may isolate power to the affected equipment as part of the emergency response, following the site's emergency switching procedure.

Reporting and investigation

Serious electrical incidents must be reported to OSHA or the state plan: employers must report a work-related fatality within 8 hours, and an in-patient hospitalization, amputation or loss of an eye within 24 hours. Some state plans have stricter requirements, and the scene should be preserved as far as possible for investigation. Check the requirements of your jurisdiction and record them in the site emergency plan.

Every electrical incident and near miss, including a test that found unexpected voltage, a switching error caught by a peer checker or an interlock that blocked a step, should be investigated to find root causes, not just immediate causes. In critical facilities, root causes often lie in inaccurate drawings, weak MOPs, schedule pressure, unclear authority or gaps in training. HSE-224 Lesson 11 and HSE-403, Incident Investigation and Root Cause Analysis, cover investigation methods.

Part 2: Capstone

The scenario

Cedar Ridge Colocation must carry out major maintenance on its A-side electrical system: three-year testing of the A-side 480 V main switchboard (main and feeder breakers, trip unit testing, torque checks and insulation resistance testing), manufacturer preventive maintenance of the A-side UPS modules A1 and A2 including capacitor replacement in A1, and inspection of the A-side 2,500 kVA transformer. The facility is 2N: each side is rated to carry the full critical load of 2.0 MW. Current critical load is 1.62 MW, split roughly equally between the A and B sides. Hall 1 has 210 racks; Hall 2 has 14 liquid-cooled AI racks. Three customers in Hall 1 have a total of six single-corded network devices fed through rack-mounted automatic transfer switches. The B-side generator has fuel for 36 hours at full load. You are the planning lead.

Step 1: Decide that the work will be de-energized

All of the planned tasks are maintenance and repair. None is infeasible de-energized, and Cedar Ridge is designed to be concurrently maintainable. The plan therefore isolates the entire A side, from the 13.8 kV switchgear feeding the A transformer down to the A-side critical bus, while the full critical load runs on the B side. The only energized exposures in the plan are the switching operations themselves and the absence-of-voltage tests that establish the electrically safe work condition, plus the commissioning tests on restoration, all of which are planned with the risk assessments, boundaries and PPE described in Lessons 4, 5 and 10.

Step 2: Check that the B side can carry the load

Before any switching, the plan must show that the B side can carry the full critical load with margin, and that the facility can live with the reduced redundancy for the duration of the window. The program below performs the core checks with the scenario values.

# Capstone capacity and readiness checks for running the full critical load on side B.
side_rating_mw = 2.0
critical_load_mw = 1.62
ups_b_modules_kw = [1000, 1000]          # two 1,000 kW modules on side B
battery_autonomy_min_at_full = 8          # B-side battery at full rated load (illustrative)
gen_b_fuel_hours = 36
window_hours = 14

ups_capacity_kw = sum(ups_b_modules_kw)
load_kw = critical_load_mw * 1000
print(f"Side B load during window: {load_kw:.0f} kW of {ups_capacity_kw} kW UPS capacity "
      f"({100*load_kw/ups_capacity_kw:.0f}%)")
print(f"Side B rating margin: {100*(1 - critical_load_mw/side_rating_mw):.0f}%")
# Battery runtime grows roughly in inverse proportion to load (simplified)
runtime = battery_autonomy_min_at_full * ups_capacity_kw / load_kw
print(f"Estimated B-side battery ride-through at this load: about {runtime:.0f} min")
print(f"Generator fuel covers the window {gen_b_fuel_hours/window_hours:.1f} times over")
single_module_ok = load_kw <= max(ups_b_modules_kw)
print("Can one B module carry the load if the other fails?", "yes" if single_module_ok else
      "no: a B module failure during the window would put the load on static bypass")

Side B load during window: 1620 kW of 2000 kW UPS capacity (81%)
Side B rating margin: 19%
Estimated B-side battery ride-through at this load: about 10 min
Generator fuel covers the window 2.6 times over
Can one B module carry the load if the other fails? no: a B module failure during the window would put the load on static bypass

The B side carries the load at 81% of its UPS capacity, with a 19% margin on its rating. The battery would ride through about ten minutes of a utility failure, and the generator fuel covers the window more than twice. But the last line reveals a real risk: if one of the two B-side UPS modules failed during the window, the other could not carry the load, and the B UPS would transfer to static bypass, leaving the critical load on raw utility or generator power with no battery protection. The plan must address this with a backout criterion, described below, and by scheduling the window when the utility and weather risk is lowest.

Step 3: Prepare customers and loads

• Notify all customers of the window, the reduced redundancy and the contact arrangements, in line with their contracts.
• Confirm, rack by rack, that every rack in both halls is genuinely dual-corded with its B cord connected and its B power supply healthy, using the power monitoring system to show current on every B feed.
• Confirm that the six single-corded devices are behind working rack transfer switches with their alternate inputs on the B side, and test the transfer switches before the window if the customers agree.
• Confirm that the cooling systems in Hall 2, including coolant distribution units and pumps, have B-side or dual feeds, so that the AI racks keep their cooling.

Step 4: Build the MOP

The MOP is the central document. For this window it would include the following sections:

Backout criteria deserve particular care. For this window they might include: any alarm on a B-side UPS module, any loss of a utility feed to side B, a severe weather warning, or any unexpected voltage found during testing. The backout plan must say how quickly side A can be restored from each stage of the work. Early in the window, restoration may take an hour; once breakers have been removed for testing, it may take much longer. That timeline should be known in advance and agreed with the switching authority.

Step 5: Plan the timeline

A realistic timeline gives every step its full time, including the capacitor waiting time in the UPS, the time needed to rack breakers out with remote racking devices and the time to verify absence of voltage at every work location. It schedules tasks in parallel where they do not interfere, with clear boundaries between crews. And it leaves contingency, because maintenance windows that run late are where fatigue, shortcuts and errors concentrate. If the work cannot be finished safely within the window, the MOP should say how to restore side A with the remaining work deferred, rather than pushing on.

Step 6: Brief, execute and close out

On the night, the job briefing covers the scope, roles, hazards, boundaries, PPE, sources table, switching order, hold points, backout criteria and emergency arrangements, and every participant confirms they understand their part. The switching order is executed step by step with peer checks. The lockout coordinator holds the group lockout. Work is done only after the electrically safe work condition is verified at each location. At restoration, the coordinator confirms all work is complete, all personnel are clear and every personal lock is removed before the first device closes, and the operations team confirms that both sides are back in service and redundancy is restored before the window closes.

Afterwards, the team reviews the window: what went well, what took longer than planned, any surprises such as drawing errors or unexpected readings, and any near misses. Drawings, arc flash labels, MOP templates and training are updated with what was learned. This review is how a critical facility gets safer with each window.

Closing thoughts

Critical facilities are built so that the load never stops. This course has argued that the same design, used well, means the people who work on them should never have to work on energized equipment except where the task truly requires it. Redundancy lets one path be isolated completely. Engineering controls reduce incident energy when switching is necessary. Accurate drawings, sources tables and disciplined switching make isolation reliable. Independent approval keeps energized work rare. Maintenance keeps the protective devices and the labels honest. And good emergency planning makes sure that, if something does go wrong, the response is fast and effective. HSE-322, Battery Rooms and Lithium-Ion Hazards, and HSE-323, Fire Suppression and Liquid Cooling Hazards, complete the data center sites track.