Working in a Building That Is Not Allowed to Stop

Why this matters

A facilities director will rarely tell you the work is too hard. They will tell you they cannot have the building in a state they cannot get out of. That is a different constraint from difficulty and shops keep answering the wrong one, arriving with a faster method when what was needed was a recoverable one. In a hospital, a plant, a courthouse or a district office, the question that governs your method is not how long the job takes. It is whether, at every moment between the first tool and the last, the building can be put back into service on short notice with the people and parts already on site.

The gate

State it once and apply it at every stage boundary:

At the end of each work stage, can the affected service be returned to operation within the institution's stated notice period for that system, using only the people and the materials already on site, with every protective device intact?

Four parameters, and all four are load-bearing.

• Unit of analysis is the stage, not the day and not the job. A job restorable at the end of each day but unrestorable for six hours in the middle has failed the gate six times.
• The Boolean is AND, not OR. People on site AND materials on site AND inside the notice period AND protections intact. Three of four is a fail, and a stage you could restore in twenty minutes if a part were on the truck is not restorable.
• The step size when it fails is to split the stage, and to keep splitting until every stage clears the notice period. Splitting has a floor: a weld, an adhesive cure, a long pull or a controls download cannot be half-done. When an indivisible task exceeds the notice period, staging cannot save you and you need a negotiated window. Recognising that early is the whole value of running the gate before mobilization.
• "Protections intact" is not negotiable and it is where shops cheat. A temporary restore never includes jumpering a limit, defeating an interlock, or blocking a protective device to get something running for the afternoon. A system that will not run with its protection working is not restorable. That is a failed gate, not a workaround, and the jumper that was coming out on Friday is the one found in place at the next annual inspection.

Notice periods are tiered, and the tier is theirs to set

Ask the institution for the number rather than guessing it, but expect a structure like this. The tiers are what turn the gate from a philosophy into arithmetic.

Tier follows the load, not the panel or the pipe. One panel routinely carries comfort lighting and egress illumination on adjacent breakers, and one branch serves a comfort zone and a critical one. Tier every circuit and branch you intend to touch, not the enclosure you intend to open.

The bottom row is the one that moves. A comfort system in shoulder season may tolerate a two-day outage with nothing worse than complaints; the same branch at design load in the hottest week is operationally critical, because the space goes out of tolerance in an afternoon instead of over a week. Same pipe, same valve, different tier, because tier is set by consequence and consequence is set by load. Ask what season your number assumes.

Life-safety systems are not just the shortest tier, they are a different kind of item, because taking them down is governed rather than negotiated. Sprinkler impairments run under a formal program with a coordinator and tagging, and NFPA 25's impairment chapter sets a threshold at 10 hours in a 24-hour period, beyond which the coordinator arranges one of a defined set of measures: evacuation of the affected portion, an approved fire watch, a temporary water supply, or an approved program to eliminate ignition sources and limit fuel. Which is on the table is the institution's call and the cheapest is not always the fire watch. Both the threshold and the option list are edition-dependent and bind through the edition the authority having jurisdiction has adopted. Fire alarm impairment under NFPA 72 carries notification and interim-measure duties of its own. Neither is a system you take down to move a sprinkler head out of the way of your duct.

Running the gate: two jobs, one rule, opposite answers

Case one: a chilled water branch valve in a hospital. The branch serves air handling for a surgical suite. The facility's stated notice period for that service is 30 minutes, because that is how long the suite's conditions hold before cases are affected.

The shop's default is to isolate, drain, cut out the failed valve and weld in the replacement. Run the gate at the stage boundary that matters, the moment the pipe is cut: with the pipe open there is no state between cut and welded that holds water, so restoring inside 30 minutes is not possible by any means on site. The stage cannot be split either, since the cut-to-weld sequence is indivisible. The gate fails on the physics rather than on the crew.

So the method changes rather than the schedule. What clears the gate is a hot tap and line stop, a mechanical valve insertion, or a temporary bypass proven flowing before anything is cut, each keeping a restorable state throughout. If none is available, the job is not an occupied-building job at all; it is a negotiated outage, and not with the facility engineer alone, because an outage on a surgical suite's air handling is a clinical scheduling decision made with the suite's leadership on a lead time measured in weeks. Name the interim measure in the same conversation, temporary cooling, cases moved, or the suite closed for the window, with the redundant path demonstrated in service beforehand. It is a different scope with a different price and a different calendar. The failure mode is the shop that answers "we will only be a couple of hours" and misses that the notice period, not the duration, is what it just violated. A two-hour job with a 30-minute notice period is a two-hour breach.

Case two: branch circuit work in a district administration building. A shop is re-terminating and re-labelling circuits in a distribution panel serving open office and corridor lighting during occupied hours. The district's stated notice period for this service is four hours, because the worst outcome is sending staff to another floor.

Run the same gate, and run it on the loads rather than on the panel. Before anything is opened, identify every circuit and what it actually serves, because a panel labelled for office and corridor lighting routinely also carries egress illumination, a fire alarm panel, card access or a mechanical control circuit, and the label is not evidence. Corridor lighting in an occupied building is means-of-egress illumination: taking it down is not a comfort outage and the four-hour notice period does not reach it. Confirm with the facility which circuits are egress or life safety, exclude them from the de-energized scope or arrange temporary illumination and notification to the occupants of that route before the breaker moves, and get authorization for each.

On the remaining office lighting circuits the work is de-energized: locked and tagged under 29 CFR 1910.333(b)(2), or 29 CFR 1926.417 under construction rules, each conductor proved dead with an adequately rated tester checked on a known live source before and after, per NFPA 70E-2021, 120.5. At any stage boundary the crew can re-land what is loose and re-energize in well under an hour with the people and materials in the room, and no protective device is defeated. Those stages clear the four-hour notice period with margin and run during occupied hours. The egress and life safety circuits do not clear it at all, and they are a separate, notified piece of work.

The two cases differ in notice period by roughly an order of magnitude and in restore time by more than that, and one sentence decided both. You do not need a separate policy for hospitals and schools; you need the institution's number and an honest estimate of your own restore time.

The reversibility inventory

A stage is restorable only if the means to restore it is physically present. Before mobilization, list what has to be on site, and treat the list as part of the material order rather than as spares.

• The removed part, kept serviceable, until the replacement is running. The old pump, valve or board goes back in the truck at the end of the job, not in the skip at the start.
• Blanks, caps, plugs and blind flanges sized for every opening the job creates, so an open system can be closed even if it cannot be completed.
• Whatever refills, vents and proves the system: fill hose, vents, a gauge, glycol if the loop carries it. A drained loop you cannot refill and vent is not restored.
• The label, tag and record for any temporary condition, with the name of who authorised it and when it is due to come out. Temporary conditions in institutional buildings become permanent through anonymity.
• The number of whoever authorises a restore, and of whoever authorises an abort, frequently two people on different shifts.

What you put into their space, and where it lands

Reversibility covers the systems. The second constraint is everything your work emits into space other people are using, where the consequence lands on somebody who did not choose it.

• Water. Draining a line above an occupied corridor puts water where it has never been. Route the drain to a floor drain or a container sized for the full volume, and post the path before opening the valve.
• Stagnant water going back into service. A branch isolated for days or a fixture left dead-legged has been sitting warm and still, and restoring it pushes that water into a building where people drink and shower. Coordinate the return with the facility's water management program and flush the branch to drain before it reaches fixtures, minimising aerosol at the discharge. In healthcare or long-term care this is not courtesy; it is the mechanism behind the whole water safety plan, and ASHRAE Standard 188 is the framework it is written under.
• Dust and airborne products. Cutting concrete or masonry releases respirable crystalline silica, controlled with water-fed or on-tool extraction and, where that does not reach the exposure limit, respiratory protection under a written program per 29 CFR 1910.134, with the construction duty at 29 CFR 1926.1153 and general industry at 29 CFR 1910.1053. In a building constructed before 1981, thermal system insulation and surfacing material is presumed to contain asbestos under 29 CFR 1926.1101 until sampling says otherwise, so insulation on that pipe is not something to strip back to get a wrench in.
• Egress. A cart, cord, tile stack and ladder in a corridor is an obstructed exit route, and 29 CFR 1910.37(a)(3) requires exit routes to be kept free of obstruction. In an occupied institution that corridor is the evacuation route for people moving fast and not looking down.

How to verify you got this right

• Write the notice period for each affected system on the job plan, with the name of who gave it to you.
• List your stage boundaries and, for each, write the honest restore time and what it depends on. If a restore time depends on a part not on site, it is not a restore time.
• Identify any indivisible task longer than the notice period. That is your window request, and it should be raised before you mobilize rather than discovered at the cut.
• Confirm no stage's restore depends on defeating a protection. If one does, redesign the stage.
• Walk the drain path, the dust path and the egress path physically, not on the drawing.

References

• NFPA 25, Chapter 15 (impairments to water-based fire protection systems, including the 10-hour in 24-hour threshold) and NFPA 72 (fire alarm system impairment and interim measures)
• 29 CFR 1910.333(b)(2) and NFPA 70E-2021, 120.5 (de-energizing and verifying an electrically safe work condition)
• 29 CFR 1926.1153 and 29 CFR 1910.1053 (respirable crystalline silica); 29 CFR 1910.134 (respiratory protection program); 29 CFR 1926.1101 (asbestos, presumed asbestos-containing material in buildings constructed no later than 1980)
• ASHRAE Standard 188, Legionellosis: Risk Management for Building Water Systems
• See related: What an Outage Window Really Costs Both Sides; Executing Work Inside a Fixed Outage Window