Permit to work and isolation: the stages of a permit, isolating and proving dead, and the link to the work order
How permit to work systems are usually structured: the stages of a permit and who signs at each, the permit types a site holds, the steps of isolation and proving dead, how the permit and the work order fit together so the permit lead time is in the schedule, and handover, suspension and close. A description of common practice, not a substitute for a site procedure.
Key takeaways
- A permit to work is a written system for controlling hazardous work: it says what work is allowed, where, by whom, for how long, and what has to be in place before it starts. It does not make work safe by itself. It records that the controls have been put in place and checked.
- Every permit runs through the same stages: request, plan, isolate and prove, issue, work, suspend or hand back, and close. Each stage has a person who signs for it, and the signatures mean something only if the person has checked what they sign.
- Isolation is the step the rest rely on. Every energy source is isolated, locked, tagged, dissipated and proved dead, with a lock for every person working.
- The permit controls the hazards of the work. The work order controls the work. When the two are linked, the permit's lead time is in the schedule and every isolation traces to a job.
- The site's own procedure and the work health and safety laws of its jurisdiction govern. This guide describes how permit systems are usually structured, not what any one site must do.
A maintenance crew arrives at 7 am to change a conveyor pulley. The job was scheduled a week ago, the parts are kitted and the crane is booked. The permit has not been raised, because the planner did not know the job needed a confined space entry certificate for the transfer chute, and the issuing authority is in a shutdown meeting until ten. The crew waits three hours. On another site the same job starts on time, because the work order carried the permit type and the isolation standard, and the permit was prepared the day before.
This guide sets out how permit to work systems are usually structured: the stages of a permit and who signs at each, the types of permit a site holds, the steps of isolation and proving dead, and how the permit and the work order fit together so the permit is part of the plan rather than a surprise on the day. It is a description of common practice, drawn from the UK HSE's guidance and the Australian model codes, and it is not a substitute for a site's own procedure or the laws of its jurisdiction.
The life of a permit
Every permit system, whatever its forms look like, runs through the same stages. The work is requested and described. It is planned and its hazards assessed, and the isolations and controls are set. The isolations are made and proved. The permit is issued at the job, with the controls checked in place and the work party signed on. The work is done inside the permit's scope and time. At a shift change or a pause the permit is suspended or handed over. And when the work is finished the work party signs off, the equipment is checked fit to return, the isolations are removed and the permit is closed.
Each stage has a person who signs for it. The names vary between sites, but the roles are usually an issuing authority who controls the area and issues the permit, an isolating authority who makes and removes isolations, and a performing authority who is in charge of the work party. A signature means the person has checked what they are signing for. A permit signed in an office for a job nobody has looked at is paperwork, not control.
1Request
The work is described, with its location, equipment and the work order it belongs to
Signs
Performing authority
2Plan and assess
The hazards of the job and the area are identified, the controls set and the isolations listed
Signs
Issuing authority
3Isolate and prove
Every energy source is isolated, locked, tagged and proved dead or depressurised
Signs
Isolating authority
4Issue
The permit is explained at the job, the controls checked in place and the work party signed on
Signs
Issuing and performing authorities
5Work
The work is done within the permit's scope and time, with the permit displayed at the job
Signs
Work party
6Suspend or hand back
At shift change or a pause the permit is suspended or handed over, with the state of the job written down
Signs
Both authorities
7Restore and close
The work party signs off, the equipment is checked fit to return, isolations are removed and the permit is closed
Signs
Issuing authority
↓ One permit, one job, one work order. The closed permit goes to the work order history
Permit types
Most sites hold a general work permit and specific permits or certificates for the higher hazards. A specific permit adds its own controls on top of the general one, and a job can need more than one: changing a pulley inside a transfer chute might need a general permit, an electrical isolation, a confined space entry certificate and a hot work permit if the lagging has to be cut. The table lists the common types and what each typically adds. The site's procedure sets which it uses and what each requires.
| Permit | Covers | Typically adds |
|---|---|---|
| General work | Work on plant that is not covered by a specific permit | The base hazards, isolations and controls |
| Hot work | Welding, cutting, grinding or any open flame or spark | Fire watch, gas test where needed, removal of combustibles, a time limit |
| Confined space entry | Entry into a space with restricted access and a risk from its atmosphere or contents | Atmosphere testing, a standby person, rescue arrangements, entry log |
| Electrical work | Work on or near electrical equipment | Electrical isolation by an authorised person, test before touch, the site's electrical rules |
| Working at height | Work where a fall could cause injury | Fall protection, exclusion zones, rescue plan |
| Excavation | Digging or penetrating ground or floors | Services located and marked, shoring, barriers |
| Lifting | Critical or non-routine lifts | A lift plan, competent crane crew, exclusion zone |
Isolation and proving dead
Isolation is the step the rest of the permit relies on, and it follows the same sequence everywhere. Identify every energy source, which means reading the P&ID and the single line diagram, not relying on memory. Plan the isolation points and the order. Shut the equipment down by its normal controls. Operate each isolation point. Lock and tag each point, with a lock for every person working, directly or through a lock box. Dissipate stored energy. And prove the equipment is dead.
Two parts are most often skipped. Stored energy is easy to forget: a spring-applied brake, a hydraulic accumulator, a capacitor bank, a counterweight, a belt under tension. And proving dead is easy to assume. The electrical test is done with a tester that has itself been proved on a known live source before and after, and the mechanical proof is a try of the start and a read of the gauges. Standard isolations for repeat jobs save time and reduce error, as long as they are checked against the current drawings each time they are used.
| Step | What is done | What to watch |
|---|---|---|
| Identify | Every energy source: electrical, mechanical, hydraulic, pneumatic, stored, gravity, process and thermal | The P&ID and the single line, not memory |
| Plan | The isolation points and the order, written on an isolation list against the permit | A standard isolation for repeat jobs, checked each time |
| Shut down | Stop the equipment by its normal controls | So the isolation is not breaking load |
| Isolate | Operate each isolation point to the isolated position | An isolator, not a stop button or a control circuit |
| Lock and tag | A personal lock and tag on each point for every person working, or a lock box | One person, one lock, one key |
| Dissipate | Release stored energy: discharge, vent, drain, block, lower | Springs, accumulators, capacitors and suspended loads |
| Prove | Test that the equipment is dead: try the start, test for voltage, read the gauge | Test the tester before and after on a known live source |
An isolation is only as good as the proof that it worked. Test the tester, then test the equipment, then test the tester again.
The permit and the work order
The permit and the work order are two records of the same job, and on many sites they live in separate systems that do not talk to each other. The work order is in the CMMS and controls the work: what is to be done, why, when, by whom and with what parts. The permit is in the permit system, often paper, and controls the hazards of doing it. When they are not linked, permits get raised for work nobody scheduled, isolations cannot be traced to a job, and jobs are scheduled with no allowance for the time the permit takes.
The link does not need to be elaborate. The work order carries the permit types the job needs and the isolation standard, so the planner can see the lead time when building the schedule and the job pack can include the isolation list. The permit carries the work order number. The closed permit is attached to the work order history. With that, the schedule for tomorrow tells the permit office which permits to prepare today.
| Permit to work | Work order | |
|---|---|---|
| What it controls | The hazards of doing the work | The work itself: what, why, when, who and with what |
| Lives in | The permit system, often paper or a separate application | The CMMS |
| Raised from | The work order, at planning or on the day | A work request, a PM schedule or an inspection |
| Shared fields | Work order number, equipment, location, description, scheduled date | Permit number, isolation list reference |
| Closed when | The work party signs off and the equipment is handed back | The work is done, the history recorded and the costs settled |
| Gap if they are not linked | Permits raised for work nobody scheduled, and isolations nobody can trace to a job | Jobs scheduled with no permit lead time, and the crew waiting at the gate |
Handover, suspension and close
Most permit failures in incident reports happen at a boundary: a shift change, a job paused overnight, two jobs on the same equipment, or the return to service. At a shift change the outgoing and incoming authorities meet at the job, the state of the work and the isolations are written on the permit, and the incoming authority signs to accept it. A suspended permit leaves the isolations in place and the equipment tagged as not fit to start. Two permits on the same equipment each hold their own locks on the shared isolations, so finishing one job cannot de-isolate the other.
Closing a permit is the step that returns the equipment to operations, and it is done in order. The work party signs off and removes their locks. The equipment is checked: guards back on, tools and people clear, the job left as the permit said. Only then are the isolations removed and the equipment handed back. If the work found something that needs a follow-up, the follow-up is a new work request, not an open permit left hanging.
Where permit systems go wrong
- Permits signed in the office for jobs nobody has visited.
- Isolations planned from memory or from drawings that are not current.
- Stored energy left out of the isolation: springs, accumulators, capacitors, suspended loads.
- Proving dead skipped, or done with a tester that was not itself proved.
- One lock for the whole crew instead of one per person.
- Shift handovers done at the crib room table rather than at the job.
- Permits with no link to the work order, so the schedule has no permit lead time and the crew waits at the gate.
- Too many permit types and forms, so people use the one they know rather than the one the job needs.
Common questions
What is a permit to work?
A formal written system used to control work that is hazardous or non-routine. The permit sets out the work, the equipment and location, the hazards, the precautions and isolations required, the people authorised to do the work and the time it is valid for. It is issued by an authorised person after the precautions are confirmed in place, accepted by the person in charge of the work, and closed when the work is finished and the plant is fit to return. The UK HSE's HSG250 is the most widely used guidance on how permit systems work.
What are the types of permit to work?
Most sites hold a general work permit and specific permits or certificates for higher hazards: hot work, confined space entry, electrical work, working at height, excavation and critical lifts. A specific permit adds controls to the general one, such as gas testing and a fire watch for hot work, or atmosphere testing and a standby person for confined space entry. Which permits a site uses, and what each requires, is set by its own procedure.
What is the difference between a permit to work and an isolation?
An isolation is the act of separating equipment from every source of energy and securing it so it cannot be re-energised, usually with locks and tags. A permit to work is the system that controls the job, of which the isolation is one part. A permit lists the isolations it relies on, and the work does not start until they are in place and proved. The isolation is removed only when the permit is closed or the work party has signed off.
What is lockout tagout?
The practice of placing a lock on an isolation point so it cannot be operated, and a tag that identifies who placed it and why. Each person working on the isolated equipment applies a personal lock, either directly or to a lock box holding the isolation keys, and removes it only when they have finished. In the United States it is required by OSHA 1910.147. In Australia the duty to manage the risk of hazardous energy sits in the work health and safety laws and codes of practice of each jurisdiction.
What does prove dead mean?
Confirming, after isolation, that the equipment is actually de-energised before anyone touches it. For electrical equipment it means testing for the absence of voltage with a tester that has itself been proved on a known live source before and after. For mechanical equipment it means trying the start, checking that pressure gauges read zero, and that moving parts are blocked or lowered. The isolation is only as good as the proof that it worked.
How does a permit to work link to a work order?
The work order describes the job and lives in the CMMS. The permit controls the hazards of doing it and lives in the permit system. They share the work order number, the equipment, the location and the scheduled date. When they are linked, the planner knows a permit is needed and builds its lead time into the schedule, the issuer can see what job each permit is for, and the closed permit becomes part of the work order history.
Key terms
Plain-language definitions from our glossary for the concepts this article leans on.
Standards and further reading
- HSG250 Guidance on permit-to-work systems (UK Health and Safety Executive)
- HSG253 The safe isolation of plant and equipment (UK Health and Safety Executive)
- Model Code of Practice: Managing electrical risks in the workplace (Safe Work Australia)
- Managing electrical risks in the workplace: code of practice (WorkSafe WA)
- 29 CFR 1910.147 The control of hazardous energy (lockout/tagout) (US Occupational Safety and Health Administration)
Related reading
Working through something like this?
See how we approach these initiatives, or tell us what you are dealing with.