Permit to work
Permit to Work During Shutdown: Isolations and Hot Work
A permit to work is the written control that names the job, its hazards and precautions, and is issued only after the site is checked and isolations are in place. A shutdown multiplies the number of live permits, so it also needs isolation certificates, registers, a handover mechanism and enough trained issuers.
Sources are UK HSE guidance and US OSHA standards; check the law where your plant is located.
How MaintWiz helps: Paper permits slow jobs and hide open isolations. The MaintWiz shutdown module shows permits and isolations from ePTW on each work order and blocks closing a package while a permit or isolation is open. See the module · Get the permit register
By Jai Balachandran · Published · Last reviewed
What MaintWiz adds:Permits and isolations from ePTWShown on each work orderPackage cannot close with an open permitApprovals by signed-in user
The cycle
How does a permit to work operate during a shutdown?
A permit to work is a written control that names the job, the hazards and the precautions, is issued only after the site has been checked and isolations are in place, and is closed only when the work is finished and the plant is safe. The UK HSE guidance for the petroleum, chemical and allied industries sets out this system, including that a person should not issue a permit to themselves. 1
See OSHA PSM turnaround rules for the US rule map. Scaffold tags and permits work together; see turnaround scaffolding planning.
Isolation certificates support the permit by documenting the status of specified isolations, and permits and certificates should be cross-referenced. 2
- 1
Define the job and its hazards
The permit names the work, the equipment, the hazards and the precautions before anyone starts.
Output: job and hazard description - 2
Isolate and certify
Isolations are made, proven and recorded on a certificate that is cross-referenced to the permit.
Output: isolation certificate - 3
Authorize and issue
The issuer checks the site, a second person authorizes higher-hazard work, and nobody issues a permit to themselves.
Output: signed permit - 4
Work, suspend, hand over
Work stays within the permit. If it runs past the shift, a handover mechanism passes the permit on.
Output: handover signatures - 5
Close and reinstate
Work is signed off, isolations are removed in a planned order and the unit is checked before it is released.
Output: closed permit, reinstatement check
Documents
Which permits and certificates does a shutdown need?
A shutdown typically needs a general permit to work, isolation certificates, hot work permits, confined space entry permits and lockout records, each tied to the same job.
Hot work, lockout, tagout and entry permit are defined in the shutdown turnaround glossary. For the UK pressure systems rules see PSSR pressure systems safety regulations in the UK.
| Document | Where public guidance requires it | What it records | Source |
|---|---|---|---|
| Permit to work (general, high-hazard maintenance) | HSE guidance for the petroleum, chemical and allied industries | Job, hazards, precautions, authorization, handover and close-out | HSE HSG250 |
| Isolation certificate | HSE guidance on safe isolation | The status of specified isolations, cross-referenced to the permit | HSE HSG253 |
| Hot work permit | OSHA process safety standard, for hot work on or near a covered process | That fire prevention and protection requirements are in place, the authorized dates and the object worked on; kept on file until the work is complete | OSHA 1910.119 |
| Confined space entry permit | OSHA permit-required confined spaces standard | Completion of the required measures, documented before entry is authorized | OSHA 1910.146 |
| Lockout or group lockout record | OSHA control of hazardous energy standard | Who holds personal locks on a group lock, with one authorized employee coordinating | OSHA 1910.147 |
Software
Can software manage shutdown permits?
Software can hold permits, isolation certificates and registers in one place and show which jobs have live permits, but the checks and sign-offs still depend on competent people.
Permit and isolation features are in the shutdown management software overview and the shutdown module data sheet.
About MaintWiz. MaintWiz is an industrial AI platform with IoT, SAP integration and predictive maintenance (PdM) capabilities. Its shutdown and turnaround module helps plants plan, schedule, execute and close out shutdown work.
Also: product data sheet.
What the shutdown module covers
As described on the MaintWiz shutdown maintenance product page.
- Shutdown calendar and critical-path scheduling, with work order sequencing and dependencies
- Asset prioritization, so the most critical equipment is scoped first
- Resource planning for people, spares, heavy equipment such as cranes, and outsourced vendors
- Electronic permits to work, risk management and contingency plans
- Real-time progress monitoring: schedule adherence, cost variance, quality metrics and risk factors
- Step-by-step checklists, pre-restart testing protocols and post-shutdown analysis
Proof
What MaintWiz customers report
Figures as published in MaintWiz case studies on maintwiz.com. They come from maintenance management projects, not shutdowns.
Permit load
How many permits can one issuer handle?
No public number exists, but HSE says supervision of the permit system can be diluted when one person controls a large number of permits, and that issuers need time to check site conditions at the start and completion of tasks and at intermediate points. 1
The permit issuer calculator is listed on the shutdown calculator tools page.
HSE names shutdowns as an example of very active periods and says site management should either limit the number of active permits or provide extra resource for supervision and coordination. High-hazard or complex tasks need more monitoring, which restricts how many permits one issuer can manage. 1 The calculator turns your own expected volumes into a roster.
Try it: how many permit issuers do the peak days need?
Enter the permits you expect on a peak day and the time each takes. The starting numbers are made up. Nothing is sent or stored; the sums run in your browser.
Permits bunch at the start of a shift. Size the roster for the peak hour, not the daily average.
Registers
What belongs in an isolation register and a blind list?
An isolation register records every isolation and its certificate, and a blank or blind register records every blank fitted, so that each can be removed in a planned order and none is left in the plant. HSE lists a blank and blind register among the controls that assure full reinstatement. 2
A permit register and isolation list template is available in the free shutdown templates. For HSE isolation categories and proving, see HSG253 safe isolation for shutdowns. HSE isolation categories are explained in HSG253 safe isolation for shutdowns.
HSE also says records of work documents, including permits and isolation certificates, should be kept on site for a specified time and then archived, to allow monitoring, audit and review. 2
| Register | Fields to keep |
|---|---|
| Isolation register | System and equipment; isolation method and points; certificate number; permit it supports; who fitted and who checked; date and time; who removed; reinstatement check |
| Blank or blind register | Tag number; location and size; fitted for isolation, purging or testing; permit reference; date fitted; date removed and by whom; final check |
The fields are a working template based on the HSE guidance; the guidance does not prescribe a form.
Shift change
How are permits handed over between shifts?
The permit should carry a handover mechanism for work that runs past the shift, and the handover itself is part of the permit system or the shift logbook. 1,2
For food lines, equipment must also be released clean; see food and beverage plant shutdowns.
HSE describes effective handover as preparation, an exchange between outgoing and incoming staff, and a cross-check, and notes that most accidents linked to handover failures involved planned maintenance. 6 OSHA requires lockout continuity at shift changes. 5 See the handover log in shutdown execution.
Measures
How do you know the permit system is working?
Sample permits for adequate hazard description and check whether work follows the permit conditions, which HSE's indicator guide gives as examples of leading indicators for permit-to-work. 7
| Indicator | Type | Note |
|---|---|---|
| Share of permits issued where hazards, risks and controls were adequately specified | Leading | HSG254 example; likely to be measured on a sample basis |
| Share of work carried out in line with permit conditions | Leading | HSG254 example; likely to be measured on a sample basis |
| Incidents where plant could be damaged through failure to control high-risk maintenance | Lagging | HSG254 example |
A people-related lesson from the CSB: in the Kuraray startup the welding by nonessential contractors likely ignited the release, so permits and exclusion zones need to agree on who may be where. 8
No public benchmark exists for permits per day. Earlier versions of this page quoted a work-density multiplier with no source; it was removed.
Visuals
Save the permit charts
Two charts for the permit desk wall. Click either for the full-size image.
FAQ
Frequently asked questions
What is a permit to work?
A written control that names the job, the hazards and the precautions, issued after the site is checked and closed when the work is complete and the plant is safe. 1
What is the difference between a permit and an isolation certificate?
The isolation certificate documents the status of specified isolations and supports the permit; the two should be cross-referenced. 2
Does OSHA require a hot work permit?
For hot work on or near a covered process under 1910.119, yes: the permit documents that fire prevention and protection requirements are in place and is kept on file until the work is complete. 3
Is a permit required for confined space entry?
Under OSHA 1910.146, entry to a permit-required confined space is authorized by an entry permit documenting the required measures. 4
How many permits can one issuer handle?
No public number exists. HSE says supervision thins when one person controls many permits and that shutdowns need extra resource or fewer active permits. 1
Can the same person issue and receive a permit?
HSE says a person should not issue a permit to themselves, and that higher-hazard work should be seen by a second person before issue. 1
What goes in a blank or blind register?
Each blank: tag, location, why fitted, permit, date fitted, date removed and who checked. HSE lists the register among the controls assuring full reinstatement. 2
Sources
Sources
- UK Health and Safety Executive, Guidance on permit-to-work systems: a guide for the petroleum, chemical and allied industries (HSG250, 2005)
- UK Health and Safety Executive, The safe isolation of plant and equipment (HSG253, 2006)
- OSHA, 29 CFR 1910.119, Process safety management of highly hazardous chemicals
- OSHA, 29 CFR 1910.146, Permit-required confined spaces
- OSHA, 29 CFR 1910.147, The control of hazardous energy (lockout/tagout)
- UK Health and Safety Executive, Human factors: Shift handover
- UK Health and Safety Executive, Developing process safety indicators: a step-by-step guide for chemical and major hazard industries (HSG254, 2006)
- US Chemical Safety and Hazard Investigation Board, Ethylene Release and Fire at Kuraray America, Inc. EVAL Plant, Pasadena, Texas (No. 2018-03-I-TX, 16 December 2022)
Keep permits and isolations tied to the work
Book a demo and bring your permit process. We will show how ePTW permits and isolations appear on each work order.