Prove Critical-Load Protection in the Temporary Power State

What to check before the work begins

Before this live cutover proceeds, show the temporary power state at each consequential step, every affected load group whose redundancy changes, the adequacy of the remaining path and any finite bridge, and rollback executable from that step.

Issue a controlled temporary one-line or step-state matrix
Map each affected load group to its active, unavailable, and remaining paths
Prove complete remaining-path adequacy and any finite-resource duration for work, credible delay, stabilization, and rollback
Prove rollback without resources made unavailable by the work and resolve temporary-equipment, concurrent-work, and deficiency conditions
Reconfirm field state, source availability, load, contingency basis, and responsible personnel immediately before release

Use in the project example

What the sources describe

Nebius reported that its March 10, 2026 us-central1 incident began during provider-led scheduled electrical maintenance while the site was in a temporary power configuration. Some affected loads depended temporarily on a UPS-backed path. The UPS on the redundant feed discharged; later transfer stages did not proceed as planned, several rack ATS units failed, and additional switching failures affected other racks and recovery.

Evidence to confirm

Controlled temporary one-line and step-state matrix
critical load owner · Before the relevant work begins
Each consequential step identifies sources, connections, switching states, affected loads, and the approved field state.
Affected-load and changed-redundancy crosswalk
critical load owner · Before the relevant work begins
Each affected load group has an active path, unavailable path, remaining contingency, and responsible owner.
Remaining-path and finite-resource assessment
critical load owner · Before the relevant work begins
Expected load is reconciled through the complete path and any finite resource supports work, credible delay, stabilization, and rollback.
MOP with hold, stop, release, and rollback states
critical load owner · Before the relevant work begins
Each consequential step defines expected evidence, limits, stop criteria, release authority, and executable rollback.
Immediate pre-switch confirmation
critical load owner · Before the relevant work begins
Field lineup, source availability, load, temporary equipment, contingency, concurrent work, and personnel remain within approved assumptions.
Temporary-state removal and as-left record
critical load owner · Before the relevant work begins
Temporary connections and altered states are restored or controlled through return-to-normal governance.

Conditions to resolve before proceeding

Documentation does not match field state or an affected load/path is unknown
Remaining-path or finite-resource adequacy is unproven
Rollback depends on a resource made unavailable by the work
Temporary equipment, concurrent work, a deficiency, or required personnel remain unresolved
Actual conditions differ materially from the approved basis
An unexpected trip, interruption, transfer, alarm, status conflict, or unexplained behavior occurs

When this applies

Startup
Functional performance testing
Integrated systems testing
Installation turnover

Assess each lesson against your project, equipment, and local requirements with the people responsible for the work.

Limitations and context

Applies when: Consequential loads remain energized while work changes their source or redundancy state
Applies when: A load group relies on a remaining path, temporary connection, bypass, finite UPS bridge, or other contingency
Applies when: Failure could interrupt an owner-designated consequential load
Outside scope: Dead-system work with no dependent consequential load
Outside scope: Work that changes no consequential load state
Outside scope: Permanent redundancy selection, generic electrical safety, emergency response, physical-isolation proof, or post-anomaly continuation
A project's required maintenance state and acceptance criteria must be defined by its own owner, designers, commissioning authority, and operations governance.
Nebius does not disclose the one-lines, redundancy class, exact load groups, UPS rating, condition, autonomy, or discharge cause.
The MOP and prior risk, contingency, and rollback records are not public; no specific missing artifact or personnel error is alleged.
The UPS rating, load, state of charge, battery condition, expected autonomy, elapsed support time, and reason for discharge are not disclosed.
The article does not define universal field-verification or switching requirements for other projects.
The article does not establish that the same measures would have prevented the Nebius event.
The described breaker failure and MOP weakness must not be attributed to Nebius.
The electrical anomaly, incorrect switching sequence, ATS models, ATS failure modes, protection operations, settings, and detailed provider root cause are not disclosed.
The electrical anomaly, switching sequence, ATS models and failure modes, protection behavior, settings, and provider RCA are undisclosed.
The public postmortem does not disclose the normal or temporary electrical one-line, redundancy classification, affected rack assignments, or complete switching procedure.
The source does not establish Nebius's topology, certification, owner requirements, or applicable redundancy objective.
The source does not establish that a temporary-state matrix, MOP, contingency calculation, or rollback plan was absent before the event.

Prove Critical-Load Protection in the Temporary Power State

What to check before the work begins

What the sources describe

Evidence to confirm

Conditions to resolve before proceeding

Sources

Data-Driven Approach to Reduce Failures

Explaining the Uptime Institute's Tier Classification System

U.S. Bank Upgrades Its Data Center Electrical Distribution

Incident post-mortem analysis: us-central1 service disruption on March 10, 2026