Article 120 — the only way to make the hazard go away.
Every other article in this standard is about managing a hazard that still exists. Article 120 is the one that removes it. In a facility engineered so that nothing ever has to go down, it is also the hardest article to actually execute.
An electrically safe work condition exists when the conductors have been disconnected from all sources, all stored energy is released, and the absence of voltage has been verified — and it is maintained by lockout/tagout for the duration of the work. Hanging a lock does not create an ESWC. Verifying does.
§ Why this matters more here than anywhere else
The design promise of a data center is that load never drops. That promise is delivered by redundancy — two utility feeds, multiple generators, N+1 or 2N UPS, dual-corded IT loads. Every one of those redundant paths is a source of energy that has to be found, isolated, and verified before the work starts.
The single most dangerous assumption in critical facilities work is that opening the upstream breaker de-energizes the equipment. On a 2N load it does not. On a dual-fed PDU it does not. On a busway with tap boxes on both ends it does not. On a UPS output it emphatically does not — the battery is still there and the static bypass may still be live.
The isolation boundary is a topology question before it is a procedure question. Get the one-line out before you get the locks out.
§ Section map
Scope.
Lockout/tagout program — 2027 requires it to be established, documented and implemented.
Principles — including 120.3(C), control of energy to eliminate or minimize exposure.
Equipment — locks, tags, and what a tagout device has to be made of.
Procedures — the step-by-step process, including verification and temporary protective grounding.
Process for establishing and verifying an electrically safe work condition.
§ The process
Determine all possible sources. Drawings, one-lines, tags — and then verify the drawings against the field, because in a data center the as-builts are usually one change order behind.
Interrupt the load current, then open the disconnecting devices for each source.
Visually verify that all blades or drawout elements are fully open or fully withdrawn, where the design permits.
Release stored electrical energy — capacitors, and the DC bus behind any power electronic equipment.
Release or block stored mechanical energy — charged breaker springs, and anything that can move.
Apply lockout/tagout devices in accordance with a documented procedure.
Test before touch. Verify the test instrument on a known source, test each phase-to-phase and phase-to-ground, then re-verify the instrument. Where absence-of-voltage testing alone is not conclusive, additional testing is required — see below.
Apply temporary protective grounding where induced voltage or stored energy could raise the conductors above ground.
§ What changed in the 2027 edition
| Section | Change | What to do |
|---|---|---|
| 120.2(A) | LOTO program must be established, documented and implemented. Documentation was implied before; it is explicit now. | If your LOTO program is tribal knowledge, write it down. |
| 120.3(C) | "Eliminate or minimize" replaces "minimize." The hierarchy of controls is now written into the control-of-energy requirement. | Energized work is the exception, not a scheduling preference. |
| 120.4(D)(3) | The nylon cable tie specification for tagout device material was deleted. Material must be suitable for the environment where used. | Update spec sheets that say "nylon cable tie." Outdoor generator yards and battery rooms can now use something appropriate. |
| 120.5(B)(6) | New: where absence-of-voltage testing alone does not indicate the conductors are de-energized, additional testing is required. Absence-of-current testing is given as an example. | Add the step to CT secondary and series-circuit procedures. |
| 120.5(B)(7) | Retitled from "Grounding" to "Temporary Protective Grounding." | Removes a genuine field ambiguity — "grounding" means four different things to four different trades. |
Some circuits carry near-zero voltage and lethal current. A current transformer secondary reads almost nothing across open terminals — and will arc violently if you open it under load. Series airfield lighting behaves the same way. Testing for voltage alone on those circuits produces a confident, wrong answer.
§ Locking out a 2N load
Work from the load backwards, not from the breaker forwards. Identify the equipment. Identify every path that can deliver energy to it. Isolate each path. Verify at the point of work — not at any of the disconnects.
- Utility. Both services, if the gear can be tied.
- Generator. Including the possibility of a black-start or an automatic transfer during your work. Defeat the auto-start.
- UPS. Output, static bypass, and maintenance bypass. A UPS in maintenance bypass still has an energized input.
- Battery. The DC bus is a source. Article 360 applies to the string itself.
- Backfeed. Dual-corded IT loads, tie breakers, and control power transformers fed from the far side.
A lock on the "A" side and an assumption about the "B" side. In an incident review this shows up as: the technician verified at the disconnect, not at the point of work, and the B-side feed was never in the procedure because the procedure was written before the second feed was installed. Procedures get audited annually for exactly this reason — 110.3(L)(4).
§ Where 70E and OSHA 1910.147 differ
| OSHA 1910.147 | NFPA 70E Art. 120 | |
|---|---|---|
| Scope | All hazardous energy — electrical, mechanical, hydraulic, pneumatic, thermal, chemical | Electrical energy |
| Electrical exemption | Does not cover work on cord-and-plug equipment under exclusive control, or exposure to electrical hazards from work on utilization equipment (1910.333 governs) | Covers establishing the ESWC before electrical work |
| Verification | Verify isolation | Explicit test-before-touch, with instrument verification before and after, plus additional testing where voltage alone is inconclusive |
| Audit | Annual inspection of energy control procedures | Program 3 yr, procedures 1 yr |
In practice you comply with both. Most data center programs run one energy control program with an electrical annex that meets the 70E requirements. See the full crosswalk →
Isolating a load with four sources
The 8- and 16-hour classes work the ESWC process against real critical-facilities topology — dual feeds, UPS output, static and maintenance bypass, and the battery that stays live regardless.
See the schedule Bring it onsite