A permit to work is the formal, written gate that stands between a hazardous or non-routine task and the crew about to do it. Rather than trusting that everyone remembers the hazards and isolations, a permit puts them on paper - what work is being done, what has been isolated, what the hazards are, and for what window of time the job is authorized - and requires named people to sign that it is safe to proceed. It is one of the oldest and most reliable ideas in industrial safety, and on an oil and gas facility it governs almost everything a maintenance or construction crew touches.
Permit to Work in one line: A permit to work (PTW) is a documented authorization that must be issued and signed before non-routine or hazardous field work can begin. It ties together the specific task, the isolations in place, the identified hazards and controls, and a defined time window, and it names an issuer who authorizes the work and a receiver who accepts responsibility for carrying it out safely.
A permit to work is not paperwork for its own sake; it forces a specific set of questions to be answered before a job starts. The document names the exact task and its location, so there is no ambiguity about what is authorized. It lists the isolations that make the job safe - which valves are shut, which energy sources are locked out, which lines are drained - so the crew knows the equipment has been made safe and the issuer has confirmed it. It records the hazards the task exposes and the controls that manage them, from gas testing to fire watch to protective equipment. And it fixes a time window, so the authorization is bounded rather than open-ended.
Binding all of those elements into one signed document is the whole point. Individually, an isolation, a risk assessment, and a job plan are useful; together, cross-referenced on a single permit, they become a check that nothing was skipped. A permit that authorizes hot work but shows no gas test, or that describes breaking into a line but references no isolation, is visibly incomplete before anyone strikes a match or cracks a flange. The permit is the place where the pieces are assembled and inspected as a whole.
Because the permit is a live record, it also governs what happens if conditions change. If the scope grows, the hazards shift, or an isolation is disturbed, the permit no longer describes reality and the work must stop until it is reissued or amended. This is what stops a job that started as a simple valve replacement from quietly expanding into cutting and welding without anyone re-examining whether the original controls still fit. The permit is meant to be suspended and revisited whenever the situation moves away from what it describes.
A permit to work turns on two distinct roles that must never collapse into one person. The issuer, usually the authority responsible for the plant or area, confirms that the isolations are in place, that the hazards have been assessed, and that it is safe to authorize the work, then signs the permit over. The receiver, typically the person leading the crew doing the job, accepts the permit, confirms they understand the controls and limits, and takes responsibility for carrying out the work within them. Keeping issuer and receiver separate means one person cannot both authorize and execute a job unchecked, which is a deliberate safeguard against a single point of failure.
Permits come in types matched to the hazard, because a coffee-break isolation and a confined-space entry are not the same risk. A cold work permit covers non-spark-producing tasks with no ignition source. A hot work permit governs anything that can ignite a flammable atmosphere - welding, grinding, cutting, open flame - and always carries a gas test and usually a fire watch. A confined space entry permit adds controls for atmosphere, rescue provision, and continuous monitoring wherever a worker must enter a tank, vessel, or pit. Many facilities layer these, so a single job that involves entering a vessel to weld requires both a confined space permit and a hot work permit, each with its own checks.
The permit lifecycle does not end when the crew starts work. A permit has to be validated at issue, monitored while the work proceeds, and formally closed when the task is done and the area handed back - only then can isolations be removed and the equipment returned to service. Critically, permits are commonly revalidated at each shift handover, because a permit issued on the day shift is authorizing work that continues into the night with a different crew and a different control room. Reconfirming that the isolations still hold and the hazards have not changed at handover is what keeps a multi-shift job from drifting out from under the conditions it was approved on.
The control room sits at the center of the permit system because it is where the plant's real state is known. When a permit calls for a particular isolation, the control room desk is often the party that confirms the isolation exists on the live system - that the valve position, the tripped drive, or the depressured line the permit relies on is actually what the SCADA display shows. A cloud SCADA platform such as Merobix gives that desk a live view of valve states, pressures, and equipment status across the site, so the person validating a permit is checking it against current field readings rather than against a plan that may be hours out of date.
That live view matters most at the moments a permit changes hands. At shift handover, the incoming operator needs to know every permit that is live, what each has isolated, and whether anything has moved since the permit was issued. A control room that can see the current state of the equipment named on each permit can revalidate quickly and catch the case where a pressure has crept back or an isolation has been disturbed, rather than accepting on trust that the conditions from twelve hours ago still hold. The permit tells the operator what should be true; the SCADA screen tells them what is true.
The control room is also the gatekeeper against conflicting activity. When one permit has isolated a section for maintenance, the operator responsible for the plant needs to ensure no operational action - starting a pump, opening a valve, re-energizing a feeder - undoes that isolation while the crew is exposed. Having the live process picture and the register of active permits in view together lets the control room hold the line between the work in progress and the running plant around it, which is exactly the kind of cross-check a purely paper-based permit book cannot provide on its own.
The issuer is the authority responsible for the plant or area, who confirms the isolations and hazard controls are in place and authorizes the work by signing the permit. The receiver is the person leading the crew doing the job, who accepts the permit, confirms they understand the controls and limits, and takes responsibility for working within them. Keeping the two roles separate ensures no single person both authorizes and carries out hazardous work unchecked.
The common categories are cold work permits for non-spark tasks with no ignition source, hot work permits for anything that can ignite a flammable atmosphere such as welding or grinding, and confined space entry permits for work inside tanks, vessels, or pits. Hot work permits require gas testing and usually a fire watch, and confined space permits add atmosphere monitoring and rescue provision. A single job can require more than one permit at once, such as entering a vessel to weld.
A permit issued on one shift often authorizes work that continues into the next, with a different crew and control room operator taking over. Conditions can change during that time - a pressure creeps back, an isolation is disturbed, the scope shifts. Revalidating the permit at handover reconfirms that the isolations still hold and the hazards have not changed, so the work does not drift out from under the conditions it was originally approved on.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.