Data Center LOTO Procedures: 29 CFR 1910.147 Applied to Critical Facilities

Lockout/tagout is the highest-impact compliance risk in data-center facilities operations. OSHA's 29 CFR 1910.147 has appeared on the Top 10 Most Frequently Cited Standards every year since the rule took effect in 1990, and for FY2025 it ranked fourth on the list. The reason data centers cluster on the citation list is structural: the equipment that keeps the data hall up (UPS, switchgear, ATS, CRAH/CRAC, generators) is maintenance-intensive, runs in a 24/7 environment, and concentrates multiple energy types in a single cabinet.

This guide is the data-center application companion to the regulatory anchor page at OSHA 1910.147. The standards page covers the six-step application of energy control, the program elements under (c)(1) through (c)(8), and the lockout-versus-tagout decision. This guide assumes you already know those mechanics and walks through the scenarios where the standard is most often cited in DC ops: UPS battery work, switchgear rack-out, ATS service, CRAH/CRAC dual-energy isolation, generator PM, and group lockout for contractor crews.

Three structural reasons LOTO citations cluster in this sector:

• 24/7 maintenance windows and rolling shift transfers mean 1910.147(f)(4) shift-change continuity is in play on almost every PM. Gaps in lock transfer are easy for an inspector to identify on the procedure or in interviews with technicians.
• Outside contractors (UPS field-service vendors, generator OEMs, electrical contractors, suppression-system technicians) trigger 1910.147(f)(2) host/contractor procedure-exchange obligations on every visit. Both the data-center operator and the contractor have written-procedure exchange duties.
• Multi-energy-source equipment (UPS, ATS, CRAH/CRAC, generator) means single-source isolation is the most common procedural deficiency. 1910.147(c)(4)(ii)(B) requires the procedure to address all isolation steps for all energy sources, and a procedure that lists only the electrical disconnect on a chilled-water CRAH is non-compliant on its face.

A note on the relationship between 1910.147 and 1910.333. Most DC maintenance involves both electrical energy and at least one other type (chilled water, refrigerant, compressed air, fuel oil, stored battery DC). Per OSHA's 2015 letter of interpretation and Note 2 to 1910.333(b)(2), a LOTO program built on 1910.147(c) through (f) can satisfy both standards as long as it incorporates the two electrical-specific requirements at 1910.333(b)(2)(iii)(D) (testing requirements) and (b)(2)(iv)(B) (live-dead-live verification). For arc-flash boundary, PPE category, and the rest of the electrical-safety frame around energized work, see NFPA 70E. LOTO governs the deenergization workflow; NFPA 70E governs everything that happens before the equipment is locked out.

A static double-conversion UPS with a VRLA or wet-cell battery string presents five energy sources that have to be addressed in the written procedure: utility AC at the rectifier input, output AC to the critical load, DC bus capacitance after rectifier deenergization, the battery string itself (which cannot be deenergized in the conventional sense), and any control or auxiliary power if separately fed. Treating the maintenance bypass breaker as the only isolation point is the most common procedural error and the most common citation pattern.

Typical isolation point list for a static UPS in PM:

• Maintenance bypass breaker (CB-MB): open and lock. The bypass keeps the load up while the rectifier and inverter are isolated for service.
• Rectifier input breaker (CB-IN): open and lock. Removes utility AC from the rectifier stage.
• Inverter output breaker (CB-OUT): open and lock. Removes the inverter from the critical bus.
• DC battery breaker or battery-string disconnect: open and lock. Some installations require pulling the battery-string fuse as the additional means under 1910.147(c)(3) when the disconnect is not lockable.
• Static switch isolation if separately accessible.
• Any auxiliary control-power feeds (24 VDC, 120 VAC controller power) per the OEM service manual.

Stored-energy considerations are where DC bus work goes wrong. After the rectifier is deenergized, the DC bus capacitors retain charge. Most OEM procedures require a 5 to 15 minute wait followed by voltmeter verification against the bus terminals before any work begins. Per 1910.147(d)(5), all potentially hazardous stored or residual energy must be relieved, disconnected, restrained, or otherwise rendered safe after the lockout devices are applied and before work starts.

The battery string is a separate problem. A string of jars cannot be turned off; it can only be physically opened at a designated cell or string disconnect, with the open point covered or insulated to prevent accidental re-bridging. Per 1910.147(d)(6), zero-energy verification on a UPS DC bus is a live-dead-live voltmeter check against a known live source first (proof of meter), then against the deenergized circuit, then back to the known live source. This is also the verification method required by 1910.333(b)(2)(iv)(B), which is one of the two electrical-specific additions when running a 1910.147 program for electrical work.

Drawout circuit breakers in medium-voltage and low-voltage switchgear cells are racked out to the disconnected position before maintenance. Once racked out, the breaker is physically isolated from the bus stabs by an air gap, and the cell shutters drop into place over the bus openings. That is the engineering-design isolation; LOTO is the layered procedural protection on top of it.

Four points get missed regularly during switchgear PM:

• Cell shutter verification. After rack-out, walk the cell with a flashlight and confirm both line-side and load-side shutters are fully closed over the bus stabs. A stuck shutter is a citation under 1910.147(d)(3) machine-equipment isolation if the procedure does not require visual confirmation.
• Breaker stored mechanical energy. The closing spring may still be charged. Discharge per the OEM procedure (typically a manual close-then-trip cycle with the breaker out of the cell) before any further servicing.
• Control power to the breaker. Most modern breakers run on 125 VDC station battery or 120 VAC control power. The control-power source is a separate isolation point and is not removed by racking out the main breaker.
• Lockable rack-out interlocks. Many switchgear designs have a key interlock or a rack-out lockout device that prevents the breaker from being racked back to connected position. These are 1910.147(c)(5) devices when used in addition to padlocks; they do not replace the padlock requirement on the energy-isolating device upstream.

For work inside a cell that cannot be racked out (fixed-mounted breakers, bus work, cable terminations on the line side of the breaker), the upstream feeder is the energy-isolating device and must be opened and locked. Per 1910.147(c)(2)(i), if the upstream device is not capable of being locked out (an older switchgear lineup with a non-lockable disconnect), tagout plus the additional means under (c)(3)(ii) are required. The acceptable additional means listed in the regulation are removal of an isolating circuit element, blocking of a controlling switch, opening of an extra disconnecting device, or removal of a valve handle.

An automatic transfer switch sits between two energized sources by definition. Source 1 (utility) is live until proven otherwise; Source 2 (generator) is live whenever the genset is running, and on most installations it can be cranked to running by the ATS controller itself if the unit is not isolated. Treating an ATS as a single-source piece of equipment is one of the highest citation risks in DC ops, second only to single-source UPS isolation.

Typical ATS isolation sequence:

• Open the Source 1 upstream breaker and lock. This is usually the utility-feed breaker in the main switchgear lineup or a dedicated transformer-secondary breaker.
• Open the Source 2 upstream breaker and lock. This is the generator main breaker or the gen-set distribution panel breaker feeding the ATS.
• Open the load-side breaker downstream of the ATS or whatever isolation is provided to the served bus.
• Disable generator auto-start before any work begins. The standard methods are battery disconnect, pulling the start-circuit fuse, or putting the generator controller in OFF or LOCAL mode and locking the controller switch. Until auto-start is disabled, the generator can crank to Source 2 while the ATS is open and re-energize the work area.
• Verify zero energy at all three terminals (Source 1, Source 2, Load) using the live-dead-live method per 1910.333(b)(2)(iv)(B).
• Discharge any control-power capacitors per the OEM service manual.

Closed-transition transfer switches deserve a separate note. The dual-source mechanical interlock built into a CTTS is an OEM safety feature that prevents paralleling beyond the design dwell time. It is not an OSHA-recognized substitute for LOTO and does not satisfy 1910.147(c). The interlock keeps the switch from energizing both contactors during a transfer; it does not deenergize the cabinet for maintenance.

CRAH (computer-room air handler) and CRAC (computer-room air conditioner) units are where 1910.147(c)(4)(ii)(B) bites hardest. The procedure has to address all energy sources, and these units have at minimum five: electrical (compressor motor circuit, fan motor circuit, control circuit), mechanical (rotating fan and compressor inertia), pneumatic (compressed-air controls in some legacy units), chemical (refrigerant for CRACs, glycol for some CRAHs), and either hydraulic (chilled-water supply and return on a CRAH) or thermal (refrigerant high-side pressure on a CRAC).

The frequent citation pattern reads like this: the technician opens and locks the unit electrical disconnect, applies a personal padlock, signs the LOTO log, and starts work. The chilled-water valves are still open. A leak during coil work then produces a 60 PSIG flush of glycol or chilled water across the floor, and the inspector has a (c)(4) finding waiting in the file: the procedure addressed only one of the energy sources required to be isolated.

Typical isolation list for a chilled-water CRAH:

• Unit electrical disconnect: open and lock. Verify zero energy at the unit terminals.
• Chilled-water supply valve: close and lock with a valve lockout sized for the handle type (gate, ball, or butterfly).
• Chilled-water return valve: close and lock.
• Condensate-line isolation if pumped (some CRAHs use a condensate pump with its own circuit).
• Control-circuit isolation if separately fed from BMS or building control transformer.

For DX-cycle CRACs, refrigerant isolation is a regulated additional workflow. Any service that opens the refrigerant circuit requires recovery per EPA Section 608 by a certified technician; the LOTO procedure addresses isolation of the electrical and chilled-water components, while EPA 608 governs refrigerant handling. The two regimes overlap on the same job; neither substitutes for the other.

Standby generators (Cummins, Caterpillar, Kohler, Generac, MTU, and others) are the highest-isolation-point-count piece of equipment in the typical data center. A complete LOTO for a generator PM commonly addresses six to nine isolation points across electrical, mechanical, fluid, and pneumatic energy sources. The high count is why generator PM is the most frequent group-LOTO scenario in the sector and why (f)(3) group-lockout procedures show up almost every time a generator is opened up.

Typical isolation list for a diesel standby genset:

Stored-energy considerations on a genset include residual fuel pressure in the supply line (relieve at the test port per OEM), pneumatic pressure in the starting air receiver, and rotating inertia in the flywheel and turbocharger if the unit was running before isolation. Per 1910.147(d)(5), each of these has to be relieved, restrained, or otherwise rendered safe before work begins.

Outside-personnel coordination is operative for almost every generator PM. The OEM field service technician and the on-site EHS or facilities lead have to exchange written procedures per 1910.147(f)(2). The host has to confirm that the contractor's written procedure addresses the specific make and model of generator on site; the contractor has to confirm that they understand the host's site-wide LOTO program.

A generator PM with the OEM field service team, an electrical contractor on the ATS, and the host facility's mechanical lead is a textbook group lockout scenario under 1910.147(f)(3). The standard requires a procedure that affords each individual employee a level of protection equivalent to a personal lockout device, even when the actual energy isolation is performed by a single primary authorized employee.

The standard implementation in DC ops is a group lockbox. The primary authorized employee applies all the isolation locks at the energy-isolating devices, places the keys inside the box, and locks the box. Each individual worker on the crew then puts a personal padlock on the lockbox hasp before starting work. No one can open the box (and re-energize the equipment) until every personal lock is removed. When a worker stops working on the equipment, they remove their personal lock; the box stays locked while any personal lock remains.

1910.147(f)(3)(ii) lists the four required elements:

• Primary responsibility is vested in an authorized employee for a set number of employees working under the protection of the group lockout device.
• The authorized employee ascertains the exposure status of individual group members with regard to the lockout or tagout of the machine or equipment.
• When more than one crew, craft, or department is involved, overall job-associated control is assigned to a single authorized employee designated to coordinate the affected work forces and ensure continuity of protection.
• Each authorized employee affixes a personal lockout or tagout device to the group lockbox or comparable mechanism when beginning work, and removes that device when stopping work.

Shift changes layered on top of group lockout are governed by 1910.147(f)(4), which requires a specific procedure for the orderly transfer of devices between off-going and oncoming employees with no gap in protection. The standard does not prescribe a specific lock-transfer method, but it does require the procedure to be written. For a 24/7 maintenance window that spans a shift change, the most common implementation is an overlap window where oncoming personnel apply their personal locks before off-going personnel remove theirs, with the primary authorized employee or a designated coordinator confirming the transfer.

1910.147(c)(2) sets the order of preference. Lockout is the default. Tagout is acceptable only when the energy-isolating device cannot accept a lock, OR when the employer demonstrates that tagout will provide protection equivalent to lockout under (c)(3). Any equipment installed, replaced, or significantly modified after January 2, 1990 must be designed to accept a lockout device per (c)(2)(iii); a non-lockable disconnect on a 1995 air handler is a finding against the equipment design, not a justification for tagout-only.

The legacy DC scenarios that still produce tagout-only situations:

• Older switchgear lineups (1970s and 1980s installations in retrofitted commercial real-estate conversions) with non-lockable disconnects upstream of the data hall feeders.
• Legacy CRAC units installed before 1990 with non-lockable unit disconnects.
• Some older fuel-system valves on standby gensets where the handle is welded or non-removable.
• Control-circuit isolations on legacy BMS or EPMS where the isolation point is a removable wire termination or a non-lockable selector switch.

For all of these, 1910.147(c)(3)(ii) requires additional means as part of the tagout program. The verbatim list in the regulation is removal of an isolating circuit element, blocking of a controlling switch, opening of an extra disconnecting device, or removal of a valve handle. A tag alone is a warning device, not a physical restraint, and the (c)(7)(ii) training requirement explicitly addresses the limitations of tags. Hanging an out-of-service tag on a lockable breaker is not a substitute for a lockout device when the breaker is capable of being locked out.

OSHA has explicitly declined to recognize ANSI Z244.1-2016 (R2020) alternative methods (control-reliable circuits, trapped-key schemes, and other risk-assessment-based approaches) as a compliance path under 1910.147. The October 2024 letter of interpretation reaffirmed the position OSHA first took in 2004: only national consensus standards adopted as OSHA standards provide a means of compliance, and Z244.1 has not been adopted. The only OSHA-recognized exception to a full lockout sequence is the testing or positioning sequence at 1910.147(f)(1), which requires clearing tools and personnel, removing the LOTO devices per (e)(3), energizing for the test, then reapplying energy control measures per (d) before continuing the maintenance.

Lockout/Tagout devices we stock

Brady 4-Legged Ball Valve Lockout

$28.00

Brady DANGER Do Not Operate Energy Source Lockout Tagout Tags

$70.00

Brady DANGER Do Not Operate Energy Source Lockout Tagout Tags

$49.00