What is a work permit?
A work permit is a written or digital authorisation, issued by a competent person before work starts, that records which hazardous work may be carried out on which installation, by whom, when and under which precautions. The work permit is part of a permit-to-work system that coordinates maintenance, inspections and modifications with production, so that everyone knows which parts of the plant are released, isolated or under maintenance. In industrial automation this covers work on a control cabinet, MCC, PLC or safety system, but increasingly also digital interventions in the OT network.
🧠 What does a work permit control?
The UK regulator HSE describes a permit-to-work system in its guidance HSG250 (first edition 2005) as a formal recorded process used to control work identified as potentially hazardous, and at the same time as a means of communication between site management, operators and the people carrying out the work. A good permit records:
- What and where - the exact task, the plant item and the boundaries of the work
- Hazards - electrical, mechanical, chemical, thermal, explosion or asphyxiation hazards and falls when working at height, taken from the risk assessment or task risk analysis
- Precautions - isolation and Lock-out Tag-out, gas testing, barriers, PPE, a fire watch or confined space attendant
- Who and when - requester, performer, issuer, period of validity and any extension
- Dependencies - cross-references to other permits and isolation certificates for the same plant item
A work permit is needed for non-routine work, for jobs where several groups must coordinate, and for work where responsibility for an installation temporarily passes from production to maintenance. For routine tasks in non-hazardous areas a permit adds little: a system that puts everything under permit loses its value.
🔧 How does a work permit work step by step?
- Request and job preparation - the performer or contractor describes the location, activity, time window, systems involved and tools.
- Risk assessment - issuer and performer jointly identify hazards and precautions, including interaction with other work in the same area.
- Isolation and release - production makes the plant item safe: de-energised, depressurised, drained, purged and locked. Gas testing follows where needed.
- Issue and toolbox talk - the competent person signs, the performers countersign and carry out an LMRA on site. A copy is displayed visibly at the worksite.
- Execution and supervision - work stays within the permitted boundaries; the work supervisor or a safety advisor carries out on-site checks. If the situation changes, work stops and is reassessed.
- Suspension and shift handover - if the work spans several shifts, the plant is left in a safe state and the outgoing issuer formally hands the permit over.
- Sign-off and hand-back - the performer reports the job complete, production checks the plant, removes isolations and returns it to service. The permit is archived.
Issuing a permit does not by itself make a job safe. Only the precautions it lists, and checking that they are in place, reduce the risk.
🔍 What types of work permit are there?
Many sites use a general work permit plus supplementary permits or certificates for specific hazards:
| Permit type | Application | Typical additional requirements |
|---|---|---|
| General work permit | Maintenance, inspection and modification outside normal operation | Risk assessment, barriers, PPE |
| Electrical permit | Work on or near electrical installations under NEN 3140 | Designated installation manager and work supervisor, isolating and proving dead |
| Hot work | Welding, cutting, grinding and other fire-hazard work | Fire watch, extinguishers, post-work fire check |
| Confined space entry | Tanks, pits, silos, pipes (see Confined Space) | Gas testing, attendant at the manhole, rescue plan |
| ATEX work permit | Work in an Ex-zone with explosion risk (ATEX) | Gas-free test, non-sparking tools, explosion protection document |
| Isolation certificate | Mechanical, electrical or process isolation as the basis for other permits | Isolation list, locks, zero-energy verification |
For hot work, Dutch insurers often require a completed hot work form, a fire watch and a post-work check that in practice can last up to an hour after the job ends. Hot work and confined space permits are usually valid for one shift at most.
🏭 Why is a work permit so important in industry?
The history of process safety shows what goes wrong without a sound permit system. HSG250 cites, among others:
| Incident | Year | Role of the permit system |
|---|---|---|
| Piper Alpha (North Sea) | 1988 | No cross-referencing between permits; a pump whose safety valve had been removed was restarted. 167 deaths |
| Phillips, Pasadena (US) | 1989 | No effective permit system that also covered contractors; work on unisolated plant. 23 deaths |
| Hickson & Welch (UK) | 1992 | Permits for preparatory steps, but none for the actual job on a batch still. 5 deaths |
On Piper Alpha the performer’s copy was often kept in a pocket rather than displayed at the job site, and suspended permits were filed separately in the safety office. The lessons from Lord Cullen’s inquiry still shape modern systems: display permits visibly, link them to one another and hand them over formally at every shift change.
🧱 When is a work permit mandatory in the Netherlands?
The Dutch Working Conditions Act (Arbowet) does not impose a general permit duty, but it does require employers to identify and control risks. The Working Conditions Decree (Arbobesluit) becomes specific in a few places:
- Article 2.42a (extractive industries) - a permit-to-work system for hazardous work and for work that creates serious risks in combination with other work, issued by a responsible person before work starts.
- Article 3.5f (explosive atmospheres) - where the assessment requires it: written instructions and authorisation by a competent person before hazardous work. This is the Dutch transposition of ATEX Directive 1999/92/EC.
- Article 3.5g - a space where asphyxiation, poisoning, fire or explosion may occur may only be entered if testing, such as a gas measurement, shows the hazard is absent.
Further obligations come from standards and agreements: NEN 3140 (based on EN 50110) requires written designation of whoever leads electrical work, VCA audits contractors on work permits and LMRAs, and Seveso establishments must secure safe maintenance in their safety management system (see Seveso and Cybersecurity). The permit system therefore belongs in the organisation’s safety policy.
🔐 What does a work permit mean for OT security?
Work on control systems is also a cyber risk. A technician changing a PLC program from their own laptop, a supplier logging in for remote maintenance or a temporary bypass of the safety instrumented system are all interventions that deserve a permit. Good practice is to link the permit system to:
- Change management - every change to PLC logic or configuration gets a change number that appears on the permit.
- Remote access - the session only opens within the permitted time window, for the right system and the right IEC 62443 zone.
- Bypasses - IEC 61511 requires written procedures and compensating measures for as long as a safety function is bypassed; record the bypass and its maximum duration on the permit.
- Media and laptops - scan USB sticks and laptops before connecting them and note this on the permit.
- Logging - keep permits, session logs and changes together, so that after an incident you can trace who did what and when.
IEC 62443-2-4 also asks service providers to protect the SIS against unauthorised changes and to run demonstrable change management. More and more sites use an electronic permit system linked to their CMMS for this.
❓ Frequently asked questions
Who may issue a work permit?
A work permit may only be issued by a person who has been designated in writing and knows the installation, usually an operator or shift supervisor from production. For electrical work under NEN 3140 the installation manager grants permission, and the work supervisor takes over the installation and leads the work. The performer countersigns the permit but never authorises their own work.
How long is a work permit valid?
A work permit is valid for the period stated on it, often one shift or a maximum of twelve hours. If the job takes longer, the permit must be formally handed over or extended at the shift change. After a suspension the situation is checked again before work resumes.
What is the difference between a work permit and an LMRA?
A work permit is a formal authorisation from the plant owner, prepared and signed in advance. An LMRA (last minute risk analysis) is a short personal check by the performer just before starting, to confirm that the situation still matches the permit. The LMRA complements the work permit but never replaces it.
Is a work permit a legal requirement?
In the Dutch Working Conditions Decree a work permit is explicitly required in the extractive industries and, where the risk assessment calls for it, for work in explosive atmospheres. In other situations the duty follows from the employer’s general duty of care, the risk inventory, NEN 3140, VCA requirements or agreements with the client and insurer. In the process industry a permit-to-work system is therefore standard practice almost everywhere.
Why is a work permit relevant to IT/OT?
A work permit controls not only physical hazards but also changes to control software, networks and safety systems. By tying remote access and PLC changes to a permit, production knows when a system is being modified. That prevents unexpected plant behaviour and makes incidents traceable.
What is an electronic permit-to-work system?
An electronic permit-to-work system (ePTW) replaces the paper permit with a digital workflow containing signatures, isolation lists and an overview of all active permits. It often integrates with the CMMS and highlights conflicts between simultaneous jobs. When moving from paper to digital, HSE advises a separate risk assessment and training in the process itself, not just in the software.
📌 In summary
A work permit is the formal authorisation that lets hazardous work on an installation start only once hazards have been assessed, energy has been isolated and responsibilities have been recorded.
A sound permit-to-work system links permits to each other, manages shift handover and ends with a controlled hand-back to production. In the Netherlands the duty stems from the Working Conditions Decree, NEN 3140, VCA and Seveso rules. In automated plants digital work belongs in it too: PLC changes, remote access and bypasses of the safety system.