An electronic permit to work system that blocks any permit relying on an isolation another crew still holds
No permit goes live over a held or missing isolation, and every signature is on record.
See one case, screen by screen ↓Every hazardous job at a power station, substation or water plant runs under a permit to work: the work is described, the energy sources are isolated and locked, an authorised person issues the permit, the crew signs on, and nobody restores the plant until every permit that relies on those isolations is cleared. On paper, the permit and the isolation certificate are separate sheets in separate offices. A second permit that needs an isolation removed — a motor run test, a valve stroke — can be raised against equipment another crew is still inside.
Under time pressure the sign-off order slips: a permit is issued before the isolator has proved the isolation, or a contractor signs on without a current authorisation. The plant is modified and the drawing revision changes, but the standard isolation plan does not. The incoming shift assumes work is finished or an isolation is still in. HSE guidance HSG250 recalls that failures in the permit-to-work system were part of the events that led to Piper Alpha. Lord Cullen found that a night shift restarted a pump without knowing its relief valve had been removed under another permit.
Estimated split for one mechanical permit on a large site, in minutes, by hand and with the solution: three signatures in three places, 10–20 minutes' walk each, plus waiting. Proving each isolation in the field still takes the isolator's time on top.
Six specialist agents check every request against the drawing, the live permits and the crew; isolators prove each lock and the issuer signs.
Kestrel Point Power & Water Station runs three combined-cycle units and four desalination trains for Lumina Utilities. Tuesday 13 October 2026, day shift B, 09:14. Here is what happens next, screen by screen, in the working solution.
Callum issues and clears every permit on day shift B. His board is the station mimic — Unit 1, Unit 2 feedwater, Unit 3, the 6.6 kV board 2BA, the 33 kV switchroom, desalination, cooling-water intake and chlorination — with every isolation point drawn as a lock and every live permit as a pin. The strip above reads 11 live permits, 28 people at work, 27 points locked, 4 requests and 1 held back.
Legend: “Held by a permit · Shared · common certificate · Proposed by a request · Free” · drawing KP-SLD-001 rev K
PTW-26-04817 is the mechanical seal replacement on BFP-2B. Isolation certificate IC-26-1193 holds five points, each proved by Priya Nair before issue — suction, discharge and recirculation valves locked shut, the casing drain locked open, and IP-17, 6.6 kV breaker 2BA-07, racked out, locked and earthed. The job is at step 7 of 9: laser alignment, coupling refitted, hands on the shaft.
Hazards listed: “Stored pressure and hot water · Rotating shaft and coupling · 6.6 kV motor supply · Manual handling of the seal cartridge (38 kg)”
Femi raises PTW-26-04822, a sanction for test: an insulation-resistance test of the BFP-2B motor, then a 2-minute uncoupled run. Callum runs the checks on the board. The isolation planner builds the test plan from standard plan SFT-6.6-MTR rev C: remove IP-17 so the breaker can be racked to service. The conflict checker finds IP-17 held by 04817, draws the conflict on the diagram and blocks the request.
“A run would turn the shaft they are working on.” · No override on the board
The request shows why: the work order assumes the motor is uncoupled, but under 04817 the coupling was refitted at step 6. Callum can re-plan the test after 04817 clears, or ask Femi to change the method — an insulation test only, from the switchboard, with the motor cable disconnected. Override is shown, and not available. Callum re-plans the test for 15:45, linked to 04817, so IP-17 stays in until both are closed, and Femi is told.
“Override · Not available · conflict rule 1, set by the HSE manager”
Sharing is not always a conflict. IP-33, the Train C high-pressure feed valve C-V108, is held by PTW-26-04811 (HPP-C2 bearing change, 3 on) and PTW-26-04812 (CIP tank C internal inspection, 2 on). Both sit under common isolation certificate IC-26-1188, so the board shows the point as shared, and it cannot be removed until both permits are cleared.
“Common isolation certificate IC-26-1188 · cannot be removed until both permits are cleared”
PTW-26-04824 is the BCP-3A impeller inspection on Unit 3 after a vibration alarm. The planner compares standard plan BCP-ISO-01 rev C with drawing KP-PID-310 rev F, issued 11 Sep 2026, which added bypass valve 3-V218. The plan lacked it, so the planner adds it as IP-65 and holds the request until an authorised isolator walks it down.
Limit: the isolation planner never marks a point as isolated — only an authorised isolator, in the field, proves it.
PTW-26-04825 is the roof fall-arrest anchor inspection by Brightmast Access. The competency checker checks every named person against the permit type and today's date: Dev Malik's working-at-height authorisation expired on 30 Sep 2026. The request is held until another technician is named or the authorisation is renewed.
“Dev Malik's working-at-height authorisation expired on 30 Sep 2026 · held by the competency checker at 08:33”
PTW-26-04823, the Strainer D1 basket clean on Train D, passed every check: no live permit holds IP-36 or IP-37, and the crew and isolator are authorised. Ravi locks shut D-V201 and D-V204 and proves each one — lock L-3121, zero pressure at PI-D-201; lock L-3122, zero pressure at PI-D-204. Only then does the decision read “Isolations proved · ready to issue”.
“Both points are locked and tested. Your signature issues the permit; Joel Mensah then accepts it and signs his crew on.”
The issue screen shows the work, the area and isolation certificate IC-26-1198 with both points proved by Ravi Menon. The permit is valid to 19:00, then revalidated at handover. Callum signs with his badge and PIN; Joel Mensah accepts on his device and signs his 2 people on, and the permit goes live on the board at Train D.
Agents check and block; only people isolate, issue, accept and clear.
The permit chain keeper drafts the handover from day shift B to Aisha Rahman on night shift C: what continues and must be revalidated, what clears before 19:00, the suspended HRSG-1 permit with its isolations in, the two confined spaces that need a gas re-test before re-entry, and the shared point at Train C. Aisha acknowledges each permit, and the acknowledgements are due by 19:15.
“BFP-2B: PTW-26-04817 holds IP-13 to IP-17. The motor test, PTW-26-04822, is blocked on IP-17 until 04817 clears.”
The same shift, seen by the five people who issue, isolate, test, perform and audit the work — what their day looked like, and what it looks like now.
Six specialist agents check every request against the drawing, the live permits and the crew; isolators prove each lock and the issuer signs.
Reads the maintenance work order and job plan: the equipment tag, its energy sources and every step that changes the plant's state — run, stroke, energise or test — and any assumption the work order makes, such as “motor uncoupled”.
Builds the isolation plan from the standard isolation library and the current drawing revision, compares it device by device, and adds any isolating device the drawing has that the plan lacks, marked for walk-down. For a sanction for test, it lists the isolations to be removed.
Checks every new permit and every isolation removal against every live and suspended permit: shared points, points to be removed and work in the same plant area. A conflict names the permit, its crew, its job step and the safe routes.
Checks the issuer, the isolator, the performing authority and every crew member against the permit type and today's date — authorisation, expiry, contractor induction and required training — and says who is not current.
Enforces the sign-off order — no issue before isolations are proved, no work before acceptance and crew sign-on — watches gas-test validity, expiry and revalidation, and drafts the shift handover.
Assembles the full chain of a permit, or a period, for an inspection or an inquiry: the permit, the isolation certificate with its proving tests, the crew sign-on and sign-off, every agent check, linked requests and the rules in force.
Issues and clears; the isolator proves every lock. The agents propose; a named person decides.
Ask about any permit, isolation point, person or the handover — or say what to prepare. Every answer points to its record.
Why is PTW-26-04822 blocked?
The motor test needs IP-17, breaker 2BA-07, racked back to service for a 2-minute run. IP-17 is one of the five isolations holding PTW-26-04817: Voltaro's crew of 4 on BFP-2B. They are at step 7, laser alignment, with the coupling refitted, so the run would turn the shaft they are working on. Conflict rule 1 allows no override. The earliest safe time is after 04817 clears, planned 15:30.
Which isolation points are shared by two permits?
One: IP-33, Train C high-pressure feed valve C-V108. It is held by PTW-26-04811 (HPP-C2 bearing change, 3 on) and PTW-26-04812 (CIP tank C entry, 2 on) under common certificate IC-26-1188. It cannot be removed until both are cleared.
What does the night shift need to know at 19:00?
12 permits are active. 6 continue past 19:00 and need Aisha Rahman to revalidate them, 5 are planned to clear before then, and 1 stays suspended with its isolations in. Both confined spaces, HP heater 6 and CIP tank C, need a gas re-test before re-entry. BFP-2B: 04817 holds IP-13 to IP-17, and the motor test stays blocked until it clears.
Build the inspection pack for PTW-26-04817
Building it now: the permit, isolation certificate IC-26-1193 with its 5 proving tests, the crew sign-on and every agent check, each cited to its record. It includes the linked motor test and conflict rules version 14.
13 screens from the working solution, on its sample data. Pick one to see it large.
Conflict rules, clocks, approval chains and competency rules are settings, owned by the station HSE manager and saved as a new version with every change.
| Setting | Default | Choose from |
|---|---|---|
| Block a permit that would remove an isolation another permit holds | Always on | Locked on — no override from the board; changing it needs the HSE manager and the station manager |
| Shared isolation points only under a common isolation certificate | On | On · Off — both permits are cross-referenced and the point cannot be removed until both are cleared |
| Flag work in the same plant area | On | On · Off — simultaneous jobs in one area are shown to the issuer before issue |
| Isolation plan must match the current drawing revision | On | On · Off — a device on the drawing that is missing from the plan holds the request |
| Permit valid to | 12 h | Set in hours — revalidated by the incoming engineer at each handover |
| Gas test valid for (confined space) | 2 h | 1 h · 2 h · 4 h — a re-test is required before re-entry when it lapses |
| Handover acknowledgement due | 15 min | 10 min · 15 min · 30 min after the start of the incoming shift |
| Contractor site induction valid for | 12 months | 6 months · 12 months · 24 months — checked for every contractor signing on |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample station data · “target” = the design goal, measured in the live solution · “estimated” = our estimate (the minute split, from three signatures in three places and a 10–20 minute walk each) · “typical” = published figures: OSHA most frequently cited standards FY2025 — lockout/tagout (29 CFR 1910.147) 4th, 2,562 citations; maximum penalty $165,514 per wilful or repeat violation (2025 amounts); DEKRA study of 1,060 recordable incidents at 11 utilities — 32 % with serious-injury-or-fatality potential, against 25 % across all industry. Context: UK HSE HSG250, Guidance on permit-to-work systems, and Lord Cullen's Piper Alpha findings; OSHA 29 CFR 1910.269(d) and (m). Lumina Utilities, Kestrel Point Power & Water Station, the contractors and the people named on this page are fictional — characters and sample data in the working solution.
An electronic permit to work system (ePTW) replaces paper permits and isolation certificates with one record: the work, its isolations, the approval chain and every signature. Electronic Permit to Work puts every live permit on a board drawn over the plant diagram, checks each request against the drawing, every live permit and every person on the crew, and keeps the full trail.
The conflict checker runs on every new permit and every isolation removal, against every live and suspended permit. A request that would remove an isolation another permit holds is blocked and drawn on the diagram, with the crew at risk and the safe routes. A point may be shared only under a common isolation certificate, and it stays in until both permits are cleared.
No. The permit chain keeper enforces the order set for each permit type: requested, plan checked, isolations proved by an authorised isolator, issued, accepted, crew signed on. Each point records its lock number and proving test, and the issue button only appears once every point is proved.
The permit chain keeper drafts the handover: which permits continue and must be revalidated, which clear before the change of shift, suspended permits with their isolations in, and gas re-tests due for confined spaces. The incoming shift charge engineer acknowledges every permit, within 15 minutes of the start of the shift by default.
Yes. The competency checker checks the issuer, the isolator, the performing authority and every crew member against the permit type and the date, including contractor site inductions. An expired authorisation always holds the request; the checker never grants or extends one.
Yes. It is built for generation, networks and water: the working solution runs a combined-cycle station with desalination trains, a 6.6 kV unit board, a 33 kV switchroom, cooling-water intake and chlorination. Approval chains cover general and mechanical, confined space, high voltage, sanction for test, hot work and work at height, and remote-end isolations confirmed by network control.
Yes. Agents check, block and draft; they never isolate, issue, sign or clear. The authorised isolator proves every lock, the shift charge engineer issues and clears, and the performing authority accepts and signs the crew on. The conflict block has no override on the board, and changing the rule needs the HSE manager and the station manager.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your permit procedures, approval chains, standard isolation plans, drawings and authorisation records — and it goes live once every quality gate has passed. We will walk you through it on your own permits first.
High-potential incidents found the hour they are reported, not at the monthly review.
1-min demoSerious Injury and Fatality PreventionEvery high-energy job checked for its critical controls before the crew leaves the yard.
1-min demoNear Miss ReportingRising near-miss trends caught by site and work type, weeks before someone is hurt.
1-min demoWe'll run Electronic Permit to Work on a sample of your own work orders, isolation plans and drawings.