Permit to Work Example: A Worked UK Job

Most permit-to-work examples online are blank forms. A blank form shows you the fields; it does not show you the decisions, the two-hour gap where the isolation gets proved, or the moment on Thursday afternoon when the job is not finished and someone has to decide what happens to the permit overnight.

This is one job followed end to end: replacing a corroded section of pipework on a mezzanine, requiring both a cold work permit and an isolation certificate, running across two shifts. The plant is invented; the sequence and the failure points are the ones that recur.

This guide covers UK practice and references HSE guidance. Legislation and standards may differ in other jurisdictions.

The job

A 3-metre section of process pipework on a mezzanine has thinned at a weld and needs replacing. The line has carried a mild caustic solution. The work involves breaking containment, mechanical cutting (no hot work — the section is cut cold and the replacement is bolted, not welded), and working at height from a mobile tower.

Four people are involved:

Maintenance supervisor — originator. Wants the job done.
Shift engineer — issuing authority. Competent on this plant, on the authorisation list for cold work and isolation.
Fitter — performing authority, accepting on behalf of himself and a mate.
Second fitter — permit user.

On a small site, HSE's HSG250 notes that several of these roles are often held by one person — but the person doing the work is never the person authorising it. Our guide to who can issue a permit to work covers which roles can safely combine.

Monday 07:40 — the request

The supervisor raises the job. What he writes matters more than it looks:

Replace corroded section, line 4B, mezzanine east, between flange F12 and flange F15. Approx 3m. Cold cut and bolted replacement. Estimated 1.5 shifts.

Two specifics are doing work there. Between F12 and F15 bounds the job — it is the difference between a permit for a defined section and a permit for "the pipework," which is not a permit at all. Cold cut and bolted states the method, which determines that this is a cold work permit rather than a hot work permit. If the method changes to welding on Wednesday, the permit does not stretch to cover it; a hot work permit is raised instead.

Where this goes wrong: the request says "repair pipework on mezzanine." The permit inherits that vagueness, and by Thursday two fitters are working on a section nobody assessed.

Monday 08:15 — assessment and method

The engineer walks the job with the supervisor. HSG250 is clear that the permit is not the risk assessment — it is the evidence that the controls from the assessment are in place. The assessment identifies:

Residual caustic in the line, including in the dead leg below F15
Working at height, 2.4m to the mezzanine deck, tower access
Dropped-object risk to the walkway beneath
A second contractor scheduled to work on the adjacent motor on Wednesday

That last item is the one that gets missed, and HSG250 treats it as a specific duty of the issuing authority: work activities that may interact "are clearly identified and either conflict avoided or precautions included on the permit." The engineer checks the register before writing anything. He finds the motor job, and moves it to Friday.

Monday 09:00 — isolation

The isolating authority closes and locks V12 and V15, drains the section to the recovery point, flushes it, and applies locks and tags with his own name and the date.

Then the part that carries the permit: proving. Draining is not proving. He opens the drain point at the low side and confirms nothing comes out under pressure, and gas-tests the space. He signs the isolation certificate to confirm the isolation is applied and proved, and cross-references it to the cold work permit number.

Where this goes wrong: the isolation is applied at 09:00 and the permit is issued at 14:00, and between those times someone else's job needs V12 open. HSG250 requires the issuing authority to confirm precautions "have in fact been taken and will remain effective while the permit remains in force." Effective while in force — not merely taken once.

Monday 10:20 — issue

The engineer goes to the mezzanine. He does not sign from the office. This is the step the whole control depends on, and HSG250's conditions for electronic permit systems include that "permits cannot be issued remotely without a site visit" — a rule that applies equally to paper.

He checks the tower is tagged and inspected, edge protection is in place, the walkway below is barriered, the locks are on, and the tags carry the isolating authority's name. Then he completes the permit. Following HSG250's Figure 1 elements, it carries:

Permit title and reference number, cross-referenced to the isolation certificate
Job location: mezzanine east, line 4B, F12-F15
Description of work and its limitations — including, explicitly, no hot work under this permit
Hazards, including residual caustic and the dead leg below F15
Precautions: isolation proved, face and eye protection, chemical gloves, tower inspected and tagged, walkway barriered below
Protective equipment required
Duration: 10:30 Monday to 18:00 Monday

The duration is a decision, not a default. HSG250 practice is that permits are time-bounded to a shift or a task. An open-ended permit is one of the most common audit findings.

Monday 10:30 — acceptance

The fitter signs to accept. His signature is not a formality — it confirms he understands the work, the hazards and the precautions, and that he has explained them to the second fitter.

The engineer asks him to say back what the hazards are. He does. This takes forty seconds and is the difference between a briefing and a signature.

The permit copy goes up at the job. The register is updated: permit live, location, expiry.

Monday 17:45 — the job is not finished

The replacement section does not seat correctly. The fitters need another half shift.

This is the decision point that blank-form examples never show, and there are three wrong answers and one right one.

❌ Extend the permit verbally. No record, no re-check.
❌ Leave the permit live overnight. The site is unattended, the isolation is unverified for fourteen hours, and nobody is accountable for the state of the plant.
❌ Cross out 18:00 and write 12:00 Tuesday. An altered permit that nobody re-checked.
✅ Suspend the permit properly.

The fitters make the area safe, leave the isolation in place, and hand back. The engineer examines the work site — HSG250 requires the site to be examined "at any time when work is suspended and before it is restarted." He confirms the isolation is still applied and the area is safe, records the suspension on the permit, and the permit stays on the register as suspended rather than closed.

Tuesday 06:00 — shift handover

A different engineer comes on. HSG250 places a specific duty here: "sufficient information is given to oncoming shifts about work for which there is a permit and which has not been completed."

The handover covers the suspended permit, the live isolation on V12 and V15, and the fact that the work is incomplete. The oncoming engineer walks the mezzanine before restarting anything, re-checks the isolation and tower, and signs the extension section with a new expiry.

Where this goes wrong: the handover is a verbal mention in a busy ten minutes, the oncoming engineer never sees the mezzanine, and a permit is running under someone who has not inspected the conditions they are accountable for. Multi-site and multi-shift oversight is where paper registers fail hardest — our permit to work register guide covers what the register has to show for this to work.

Tuesday 11:15 — hand-back and cancellation

The section is in, bolted and torqued. The fitter signs hand-back: work complete, area clear, tools removed.

The engineer inspects, confirms the plant is ready for testing and recommissioning, and signs. Only then are the locks removed, the line refilled and pressure-tested, and the permit cancelled — HSG250 separates hand-back from cancellation deliberately, because "work finished" and "plant back in service" are different states with different risks in between.

The permit is closed on the register with the actual close time. It is retained on site; HSG250 says permits "should be retained at site by the issuing authority for at least 30 days after completion, and then archived for a specified period."

Where this goes wrong: the work finishes, everyone moves on, and the permit is never formally closed. It sits open in the register or, more often, in a pile. This is one of the most common failings in UK permit systems, and it is invisible until an audit counts it.

What this example is for

Four things worth taking from it, none of which appear on a blank form:

The scope is written at request time. Vague requests produce vague permits.
Interacting work is checked before the permit is written, not discovered on site.
Suspension is a defined state, not an informal overnight.
Hand-back and cancellation are separate signatures, because the plant is not safe simply because the work stopped.

If you want the field-by-field structure rather than the narrative, the permit to work checklist covers pre-start, during-work and close-out checks for every permit type, and the general permit to work template sets out the standard sections. For this job specifically, the cold work permit template and electrical isolation permit template cover the two documents involved.

PermitPad is building a permit-to-work system that enforces this sequence — scope bounded at request, interacting permits flagged before issue, suspension as a real state, and a close-out that cannot be skipped. Join the waitlist to see it when it launches.

Key references

HSG250: Guidance on permit-to-work systems — HSE, first edition 2005. Figure 1 (essential elements of a permit form), paragraphs 34 and 37 (interacting permits, shift handover, site examination), paragraph 58 (retention). Guidance, not law
Health and Safety at Work etc. Act 1974, section 2 — the duty to provide and maintain safe systems of work

Disclaimer

This worked example is illustrative and for general information only. The plant, people and sequence are invented to show how a permit runs in practice; they are not a template for any specific job. Your permit requirements depend on your own risk assessment, plant and sector. Always consult a competent H&S professional and the applicable legislation and sector guidance for your circumstances.