Switchgear, generators, transfer switches and switching procedures

In a data center, the act of opening or closing a switching device is never just an electrical task. It changes the configuration of the critical power system, it can drop or transfer the load and it is the means by which equipment is isolated for work. A wrong step can energize equipment someone is working on, connect two sources out of phase or leave thousands of servers without power. Industry outage studies consistently find that human error plays a part in a large share of significant outages: in its 2025 analysis, Uptime Institute reported that close to 40% of organizations had suffered a major outage caused by human error in the previous three years, and that about 85% of those incidents stemmed from staff failing to follow procedures or from flawed procedures. The same errors that cause outages cause injuries. This lesson explains how switching is planned and executed in critical facilities, and the particular hazards of switchgear, generators and transfer equipment.

Switching orders

A switching order is a written, step-by-step list of switching operations, prepared in advance, checked and approved, and executed exactly as written. It is usually part of the MOP for a maintenance window, and it is the operational core of the isolation plan described in Lesson 6. A good switching order has these features.

• Unique identification of every device. Each step names the device by its field label, such as 'Open breaker MOB-A1 in UPS-A switchboard', exactly as it appears on the equipment, so there is no ambiguity.
• The action and the expected result. Each step states the action (open, close, rack out, place in manual, lock) and what should be observed afterwards, such as a breaker indicator, a UPS display mode or a meter reading.
• Preconditions. Steps that are safe only in a certain system state say so: for example, confirm the UPS is in static bypass and synchronized before closing the maintenance bypass breaker.
• Hold points. Places where the crew stops and confirms the system state with the switching authority before continuing, such as after the load has transferred to maintenance bypass.
• Verification. A column for the operator's initials and the peer checker's initials, and the time of each step.
• Reverse sequence. A separate, equally detailed order for restoring the system, and a backout plan for returning to a safe state if something goes wrong part way through.

Switching orders are prepared by a qualified person who knows the system, reviewed by a second qualified person, and approved by the switching authority as part of the MOP approval. Where the switching involves a UPS bypass transfer, the manufacturer's procedure is built into the order rather than referred to separately.

Executing a switching order

On the night, the switching order is executed by a qualified operator, with a peer checker who independently verifies each step. A common discipline uses the following pattern for every step.

• Self-check. The operator reads the step aloud, locates the device and touches or points to its label, confirming it matches the order.
• Peer check. The peer checker independently confirms that the device is the correct one and that the precondition for the step is met.
• Three-way communication. If the switching authority is directing from a control room, the operator repeats the instruction back, the authority confirms it and only then does the operator act.
• Act. The operator performs the action once, deliberately.
• Verify. Both confirm the expected result before initialling the step. If the result is not as expected, they stop.

The most important rule is that the switching order is not improvised. If a device is not where the order says, if a label does not match, if an indicator shows something unexpected or if an interlock prevents a step, the crew stops at a safe state and the switching authority decides what to do. Changing the order on the fly, even with good intentions, is how many serious incidents begin.

Validating a switching order before the night

Many operators now check switching orders against a model of the system before approval, so that steps that would drop the load or connect sources unsafely are found on paper rather than on the night. The program below shows the idea with a very simple model of a main-tie-main switchboard: two mains and a normally open tie, where closing the tie with both mains closed would parallel two transformers, which this invented facility does not allow.

# Illustrative switching order checker for a main-tie-main switchboard (invented rules).
state = {"MAIN-1": "closed", "MAIN-2": "closed", "TIE": "open"}

def bus_energized(s):
    # Bus 1 and bus 2 are energized if fed by their main or through the tie from the other main
    b1 = s["MAIN-1"] == "closed" or (s["TIE"] == "closed" and s["MAIN-2"] == "closed")
    b2 = s["MAIN-2"] == "closed" or (s["TIE"] == "closed" and s["MAIN-1"] == "closed")
    return b1, b2

def check(order):
    s = dict(state)
    for n, (device, action, peer) in enumerate(order, 1):
        s[device] = action
        problems = []
        if not peer:
            problems.append("no peer verification recorded")
        if s["MAIN-1"] == s["MAIN-2"] == s["TIE"] == "closed":
            problems.append("parallels two transformers (not permitted)")
        b1, b2 = bus_energized(s)
        if not (b1 and b2):
            problems.append("a critical bus loses power")
        print(f"Step {n}: {action:6s} {device:6s} -> {'OK' if not problems else '; '.join(problems)}")

print("Draft order (open-transition transfer of bus 1 to MAIN-2):")
check([("MAIN-1", "open", True), ("TIE", "closed", True)])
print("Revised order with planned outage of bus 1 accepted by MOP:")
check([("MAIN-1", "open", True), ("TIE", "closed", False)])

Draft order (open-transition transfer of bus 1 to MAIN-2):
Step 1: open   MAIN-1 -> a critical bus loses power
Step 2: closed TIE    -> OK
Revised order with planned outage of bus 1 accepted by MOP:
Step 1: open   MAIN-1 -> a critical bus loses power
Step 2: closed TIE    -> no peer verification recorded

Both drafts fail in this simple model, for different reasons. The first briefly drops bus 1 between opening the main and closing the tie, which is acceptable only if the loads on bus 1 are dual-corded or the MOP accepts a planned interruption. The second records a step without peer verification. A real checker would know which loads ride through, which transitions the equipment allows and which sources may be paralleled, but even a simple check catches errors that tired people miss at three in the morning.

Medium-voltage switchgear

Medium-voltage switching is specialized work. It requires qualification on the specific equipment, MV-rated PPE and tools, and procedures that account for hazards that low-voltage work does not have, including induced voltage on isolated cables, the need to verify absence of voltage with MV-rated detectors and the application of temporary protective grounds before work. Many data centers contract MV switching to specialists or to the utility, and some campuses have switching that the utility controls under its own rules. Where the utility is involved, the switching order must show which steps the utility performs, how control is handed over and how the utility confirms its isolation, often with its own locks and tags.

Operating MV switchgear also carries arc flash risk, particularly when closing a breaker onto a cable or transformer that may be faulted. Remote operation, from a control panel or a portable remote control outside the arc flash boundary, is increasingly standard for MV switching in critical facilities, and many sites require it.

Low-voltage switchgear and racking

Low-voltage switchboards in data centers are where many switching steps happen and where, as Lesson 4 explained, incident energy is often highest. Hazards include racking breakers in or out (onto or off a live bus), operating breakers whose condition is uncertain and working in cubicles adjacent to live sections. Controls include remote racking and remote operation, energy-reducing maintenance switching, maintenance of breaker mechanisms so they operate reliably, and a rule that a breaker that does not operate as expected is not forced but reported.

Automatic transfer switches

An automatic transfer switch moves a load between two sources, usually utility and generator, when the preferred source fails or returns. Transfer can be open transition (break before make, with a brief interruption), closed transition (make before break, momentarily paralleling the sources) or delayed transition. Many data center ATSs are bypass-isolation designs: a bypass switch carries the load while the transfer mechanism is withdrawn for maintenance.

From a safety point of view, an ATS is a meeting point of two independent sources, and it acts on its own. When an ATS or anything downstream of it is to be worked on, the switching order must place the ATS controls in a mode that prevents automatic operation, isolate both sources and follow the manufacturer's procedure for bypass and isolation. A transfer switch that operates unexpectedly can energize equipment or close onto people's hands if the mechanism is exposed.

Generators and paralleling gear

Standby generators bring both electrical and mechanical hazards. Electrically, a generator is an independent source that can start and connect automatically on loss of utility, on a test signal or on a fault in the control system. Generator breakers, paralleling switchgear and the cables between them are energized whenever the generator runs, and the generator's own terminals are energized whenever the engine turns, even before the breaker closes. Paralleling switchgear synchronizes several generators and connects them to a common bus, and like any switching that connects sources it depends on synchronizing checks and interlocks that must never be defeated.

Generator testing is routine in data centers, often monthly under load and annually with a load bank. Load bank testing frequently involves temporary connections: portable load banks connected by flexible cables to a permanently installed load bank connection cabinet or tap box. Temporary connections are a common source of incidents. They should be made only with the generator stopped, locked out and verified dead, using equipment rated for the current, with connections checked and covers in place before the generator is started. Mechanical hazards, hot exhausts, fuel and noise round out the picture, and DCE-340 Lesson 5 covers generators more broadly.

Restoring power

Restoring a system after maintenance is as hazardous as isolating it, and in some ways more so, because people may be tired, the work is finished and the pressure to return to redundancy is high. The restoration order should be as carefully written and executed as the isolation order. Before any device is closed, the lockout coordinator confirms that all work is complete, all tools and temporary grounds have been removed, all covers are in place, all personnel are clear and every personal lock is off the lockbox. Then the operations locks are removed and the restoration order is executed step by step, with peer verification and hold points, until the system is back in its normal configuration and the operations team confirms redundancy has been restored.