1910.38 — a building engineered to stop entry still has to allow exit.
Data centers are the only occupancy where the security design and the life safety design are in direct tension on every door. That tension is where the findings live.
Under 1910.37(b)(2), an exit door must be unlocked from the inside and openable without keys, tools or special knowledge. Badge-out readers, mantraps, anti-tailgate turnstiles and interlocked doors all have to fail safe in the egress direction. “Security requires it” is not a defense.
§ 1910.38 — what the plan must contain
Reporting procedures for a fire or other emergency.
Evacuation procedures and exit route assignments.
Procedures for employees who stay to operate critical plant before they evacuate — this is the one data centers actually need and rarely write. Who stays to transfer load? Under what conditions do they stop?
Accounting for employees after evacuation — and in a data center, for customers, vendors and remote-hands contractors who badged in.
Rescue and medical duties for those assigned to perform them.
Names or job titles to contact for more information.
Written and kept in the workplace if you have more than 10 employees; may be communicated orally at or below that. An alarm system under 1910.165 is required, and it has to be distinctive and recognizable.
§ 1910.37 — the exit route requirements
- Exits must be free of obstruction — including temporarily. Staged pallets of gear during a build-out is the classic violation.
- Adequate lighting for employees with normal vision, and exit signs marked with plainly legible letters.
- Doors that could be mistaken for an exit must be marked “Not an Exit” or by their use.
- Exit routes must be permanent and lead outside or to a refuge area.
- Side-hinged, swinging in the direction of travel where serving high-hazard areas or more than 50 occupants.
The obstruction finding in a live data center is almost never furniture — it is the build. Cage material, crated PDUs, cable reels and packing waste staged in a corridor during a deployment, in a facility where the corridor is also the exit route for the hall.
The second one is the mantrap. A two-door interlocked vestibule that requires a successful badge read to release the inner door is an egress failure the moment the reader loses power or the head-end goes offline — unless it fails unlocked, and unless somebody actually tested that.
§ Where security and egress collide
| Control | The security intent | What egress requires |
|---|---|---|
| Badge-out reader | Log who leaves, prevent tailgating | Must release on power loss and on alarm; no special knowledge to exit |
| Mantrap / interlocked vestibule | One person at a time | Inner door must fail unlocked; test it, do not assume |
| Turnstile / optical lane | Anti-passback | Free-wheel or drop-arm on alarm; a manual gate adjacent |
| Cage door with keyed lock | Customer asset protection | Openable from inside without the key — always |
| Delayed-egress hardware | Slow an unauthorized exit | Only where the fire code permits it; signage and alarm release |
Fail-safe behaviour is a commissioning claim that decays. Access control head-ends get replaced, door controllers get swapped, someone changes a relay from fail-safe to fail-secure to stop a nuisance alarm. Put egress release on the same periodic test schedule as the fire alarm, and document it.
§ The events this plan is really for
Data center emergency planning tends to be written around fire. The two events most likely to require an evacuation in an electrical room are not fire:
Arc flash incident. A burned worker inside a switchgear room, doors that may be latched, and a rescuer problem. Your EAP has to name who enters, what they wear, and how the equipment gets de-energized before they do. This connects directly to 130.2(A)(2) — the additional person is your first responder.
Battery event. Thermal runaway in a lithium cabinet or a flooded-cell spill is a chemical and atmospheric emergency, not an electrical one. Evacuation triggers, ventilation status and re-entry criteria belong in the plan. See Article 360 and battery rooms.
An emergency action plan that accounts for badged employees and has no mechanism at all for the colocation customer’s two technicians who badged into a cage forty minutes earlier. Nobody knows they are in the building.
Who comes for the injured worker
The 2027 additional-person requirement exists because solo energized work leaves nobody to respond. We teach the whole chain — the permit, the standby person, the emergency response training under 110.4(C)(1).
See the schedule Bring it onsite