Environment, Health & Safety (EHS) Across Build & Operate

Every preceding chapter in Part 6 designed a hazard into the building. Chapter 6.2 put 3,000–5,000 lb wet racks on the slab; Chapter 6.5 specified clean-agent suppression around lithium BESS; Chapter 6.7 set the rigging paths those racks travel; Chapter 6.8 wrapped acoustic enclosures around gensets running on stored fuel. This chapter is where those hazards stop being lines on a drawing and become things that can kill or maim a human being — and where the discipline shifts from engineering a margin to operating a program. An arc-flash study is a deliverable; an arc-flash program is a labeled equipment register, an energized-work permit system, a PPE-to-incident-energy mapping, and a re-study trigger that fires every time someone changes a breaker setting. The first protects you on the day it is signed. Only the second protects the worker who opens a switchgear door three years later.

The reason EHS earns a full chapter in 2026 — rather than a paragraph in a code-compliance appendix — is that the AI build changed the hazard profile faster than the safety programs around it adapted. The move to 800 VDC distribution (Chapter 4.2) makes a shock hazard lethal where 48 VDC was survivable. The move to direct-to-chip liquid (Chapter 5.4) puts pressurized glycol and dielectric fluids inside the same enclosure as energized electronics. The move to on-site gas generation (Chapter 4.8/4.9) drops a small power plant — with its own combustible-gas and process-safety regime — onto a data-center campus whose EHS staff were trained for IT, not for turbines. And the move to concurrently-maintainable, never-de-energized facilities (Chapter 12.1) means the workforce now performs maintenance on a live building as the steady state, not the exception. Each of those is a goodput or density decision elsewhere in this guide; each lands here as a named, managed hazard.

The most common and most dangerous EHS failure in a data center is treating the arc-flash study as a one-and-done engineering artifact. The study computes, at every piece of equipment, the incident energy (in cal/cm²) a worker would absorb in an arcing fault, the resulting arc-flash boundary (the distance at which incident energy falls to 1.2 cal/cm² — the onset of a second-degree burn), and the arc-rated PPE required inside it. That study is valid only for the protective-device settings, fault currents, and one-line topology that existed the day it was run. The instant someone re-coordinates a relay, swaps a transformer, adds a UPS module, or energizes a new feeder, the incident energy at downstream gear can move — and the label on the door, the PPE in the cabinet, and the worker's mental model are now wrong. NFPA 70E requires the study be reviewed at least every five years and whenever the system changes; the program turns that requirement into a trigger wired to your management-of-change process, so no power-chain modification closes out until the arc-flash impact is re-evaluated.

The 2026 wrinkle is that AC arc-flash intuition does not transfer to the 800 VDC world the dense racks are driving toward. A DC arc has no current zero-crossing — in a 60 Hz AC system the current passes through zero 120 times a second, which helps a breaker extinguish the arc; a DC arc, once struck, sustains itself until the energy is exhausted or the circuit physically opens. That makes DC arcs harder to clear and DC arc-flash energies harder to bound with the AC-derived IEEE 1584 model that most studies still lean on. The shock side is starker still. Using a 1,000 Ω body-resistance baseline, contact across a 48 VDC bus drives roughly 48 mA — painful, near the ventricular-fibrillation threshold but often survivable. The same contact across an 800 VDC bus drives roughly 800 mA — an order of magnitude past the lethal limit. The voltage step that Chapter 4.2 justified on efficiency grounds is, on the EHS ledger, the step from 'shock' to 'electrocution.'

The rightmost column carries the chapter's argument: at every voltage class the thing that protects the worker is not the PPE in the cabinet but the program control that keeps the study, the labels, and the human's training synchronized with the as-built power chain. The hardest gap is the highlighted-by-omission first row — the 48 V bus that everyone treats as safe — because that is precisely where the habits form that will get someone killed at 800 V if the program does not force a re-baseline. → the voltage architecture itself is set in Chapter 4.2; the resilience model that demands live work is Chapter 12.1.

Lockout/tagout is the bedrock control for working on equipment that could energize or move unexpectedly: isolate the energy source, lock it in the safe state, tag it, and verify zero-energy before a hand goes near it. In a conventional plant you can often de-energize a whole system to work on it. In a concurrently-maintainable AI data center you structurally cannot — the entire commercial premise of a Tier-III/IV-class facility is that any single component can be taken out for maintenance while the IT load keeps running (Chapter 12.1). That is a feature for uptime and a trap for LOTO, because the worker is now isolating one leg of a system whose other legs are deliberately, continuously live. The boundaries that LOTO must draw — back-feed from a parallel UPS or genset, stored energy in capacitor banks and DC buses, the closed-transition path that could re-energize an 'isolated' bus during an automatic transfer — are exactly the boundaries that concurrent maintainability is engineered to keep hot.

The program consequence is that generic LOTO procedures are not safe here; the facility needs equipment-specific energy-control procedures for every maintainable boundary, written against the actual one-line and the actual transfer logic, naming every isolation point and every stored-energy source. The fork is organizational: individual LOTO (each worker applies their own lock) is unambiguous but does not scale to multi-trade work on a large lineup; group LOTO (a lockbox holds the isolation, each worker adds a personal lock to the box) scales but introduces a single authorized-person accountability that, done loosely, becomes the failure mode in the incident report. And because the IT load cannot drop, the highest-consequence question — who owns the permit, and who has the authority to refuse the work when isolating a component would violate concurrent maintainability — has to be answered in writing before the first live job, not negotiated on the floor at 2 a.m.

The mechanical hazards of the build and the operate phases are not exotic, which is exactly why they kill people — the program fails through familiarity, not novelty. Falls remain the single leading cause of death in construction: of 1,034 construction fatalities in 2024, 389 were fatal falls to a lower level, and fall protection has been OSHA's most-cited violation for fourteen consecutive years (6,307 citations in 2024). A data-center build is a fall-rich environment — open structural steel, elevated pipe racks for the facility water loop, rooftop heat-rejection plant, mezzanines for electrical gear — and the controls (guardrails, personal fall-arrest, controlled-access zones, a competent-person inspection regime) are well understood and routinely skipped under schedule pressure. The EHS program's job is not to invent new controls; it is to make the known controls non-negotiable on a critical-path schedule that is screaming for speed-to-power.

Confined spaces proliferate in the AI build in ways the IT-trained operator may not anticipate: large CDU and tank interiors, the inside of thermal-storage and chilled-water reservoirs, deep electrical vaults and cable trenches, and the let-down/scrubbing vessels on a gas-conditioning skid (Chapter 4.9). These are permit-required confined spaces — atmospheric testing for oxygen deficiency, flammable gas, and toxics before and during entry; an attendant; a rescue plan that does not rely on calling 911 and waiting. The grim statistic that should anchor the program: a large share of confined-space deaths are would-be rescuers who entered an untested space to save a downed coworker. The rescue plan is the deliverable that prevents one fatality from becoming two or three. Heavy rigging closes the set — multi-tonne transformers, chillers, prefab power/cooling modules (Chapter 6.4), and the 3,000–5,000 lb wet racks of Chapter 6.7 — where the controls are engineered lift plans, certified rigging gear, exclusion zones under suspended loads, and qualified signal/rigger roles. The rigging path defined for civil reasons in Chapter 6.7 is, on this ledger, a struck-by and crush-hazard corridor that the EHS plan has to own.

Liquid cooling did not just change the thermal design — it introduced a chemical-handling program where air-cooled halls had none. The coolant chemistry you select in Chapter 5.4–5.5 carries its EHS envelope with it, and that envelope — exposure controls, spill response, disposal, and regulatory liability — is a consequence of the cooling fork, not a separable add-on. Three families dominate, and they sit at very different points on the hazard map.

Propylene-glycol/water (PG25 and relatives) is the workhorse single-phase direct-to-chip coolant. Its acute toxicity is low (propylene glycol is far less toxic than ethylene glycol, which is why the industry standardized on it), so the dominant hazards are physical: it is conductive enough that a leak onto energized 800 VDC electronics is a fault and shock risk, it is slip and slick on the floor, and at scale a spill is an environmental-reporting event and a disposal stream. Single-phase dielectric fluids (synthetic or hydrocarbon) trade the conductivity problem away — a leak onto live electronics does not short — but reintroduce flammability/combustibility classification, vapor and dermal-exposure considerations, and a heavier disposal burden. Two-phase fluorinated fluids (the PFAS family) were, until recently, the high-performance immersion answer — and they are the cautionary tale of this entire section.

Whatever the chemistry, the operate-phase program is the same skeleton: a maintained SDS library and chemical inventory; exposure controls and PPE matched to the fluid; secondary containment and spill kits staged at the loops; a spill-response procedure that NFPA 75 (8.2.2) now contemplates for liquid-cooled halls — including the de-energization sequence for a conductive-coolant leak onto live gear; and a disposal/recycling stream with the manifesting and reporting the local regime demands. The decision the chapter forces is to recognize that you are choosing this program when you choose the coolant — and to price the spill, exposure, and end-of-life liability into the cooling fork rather than discovering it on the floor.

When a campus owns its substation and HV yard (Chapter 4.3), it inherits a hazard class most data-center EHS staff have never managed: medium- and high-voltage work governed by OSHA 29 CFR 1910.269, utility-grade clearances, induced-voltage and step-and-touch-potential risk across the ground grid, and switching operations where a wrong move flashes over at energies no PPE survives. The control here is not better PPE — it is the qualified-worker program: a documented, demonstrated competency for each person allowed inside the HV boundary, refreshed on a cadence, with switching performed under a written switching order and, wherever possible, remotely (remote racking, remote operation) to keep humans outside the arc-flash boundary entirely.

The fork is make-vs-buy on the qualified workforce. In-house HV qualification gives operational control and faster response but demands a sustained training, tooling, and competency-audit program that is hard to keep current at a single site. Contracting the utility or an HV specialist for substation work outsources the competency but introduces interface and response-time risk, and it relocates the question of where the qualified-worker boundary sits — which is the same line as the ownership boundary negotiated in Chapter 4.3. Get that line wrong and you have either workers operating beyond their qualification or a campus that cannot perform routine switching without waiting on a third party. The EHS program and the 4.3 ownership model have to draw the same boundary, or the gap between them becomes the incident. → the substation ownership and NERC-compliance framing is Chapter 4.3.

The behind-the-meter generation strategies of Chapter 3.5 and the fuel-supply engineering of Chapter 4.9 drop a process-industry hazard onto the campus: combustible gas, pressurized vessels, fuel storage, and rotating prime movers. If the on-site inventory of a highly hazardous chemical crosses the OSHA Process Safety Management threshold (29 CFR 1910.119) — and large flammable-gas or fuel inventories can — the facility is subject to the 14 PSM elements, a regime that data-center operators rarely arrive prepared for. PSM is not a checklist; it is process-hazard analyses (HAZOP/LOPA), mechanical-integrity programs, management-of-change discipline, operating procedures, contractor-safety management, pre-startup safety reviews, and incident investigation — the full apparatus of running a small process plant.

The decision is binary and early: determine PSM applicability before first fuel, by inventory and chemistry, and if you are in, stand up the program ahead of commissioning rather than discovering the obligation during an inspection or — worse — an incident. Even below the PSM threshold, on-site gas brings combustible-gas detection, relief and venting, hot-work permitting, and the process-safety interlocks of Chapter 4.9 into the EHS program. This is the cleanest example in the chapter of a goodput/availability decision made elsewhere (firming the power with on-site generation) cascading into an EHS obligation that has to be owned here. → the energy-supply strategy is Chapter 3.5; the gas-process and fuel engineering is Chapter 4.9; commissioning the generation and microgrid controls is Chapter 13.4.