Electrical isolation permit
lock-out, tag-out and the test that carries the signature

Switching, cable work, motor and drive maintenance, panel entry, anything where a conductor is touched. In a permit to work system the electrical isolation permit exists for one reason: a switch labelled off, a breaker racked out and a drawing marked isolated are all claims, and the only thing that turns a claim into a fact is a test at the point of work.

What the permit covers

Electrical isolation appears in permit to work systems under several names — electrical work permit, isolation certificate, lock-out permit, and in some systems a switching programme attached to the permit. The scope is the same: any work where a person can contact a conductor that is normally energised, or can be exposed to the energy released when one fails.

The last two carry the surprises. An overhead line does not need to be touched to kill — the arc crosses to the crane or the scaffold pole first. And a battery room, an uninterruptible supply or a solar array remains live after every breaker in the building is open, which is why isolating the incoming supply and calling the site dead is the classic error.

The five safety rules

EN 50110-1 sets five safety rules for electrical work, in this order: disconnect completely, secure against re-connection, verify the installation is dead, earth and short-circuit where required, and protect against adjacent live parts. The sequence matters more than the wording, and most operator systems anywhere in the world use the same five steps under their own names.

1. Disconnect completely. Every source, not the obvious one. A drawing shows the design; the plant shows the modifications. Backfeeds through control transformers, standby generators, second supplies to the same board and the interlock that was defeated years ago are all found by tracing the circuit rather than reading the schematic.
2. Secure against re-connection. Rack out, lock, tag. The lock stops the operation; the tag says who and why. Where a device cannot be locked, the isolation must be physical — a fuse withdrawn and retained, a link removed, a cable disconnected and made safe.
3. Verify the installation is dead. At the point of work, on every conductor, with an instrument that is proved immediately before and immediately after the test. This is the step that carries the permit.
4. Earth and short-circuit where required. Mandatory at high voltage, and required at low voltage wherever a circuit can be re-energised from elsewhere or can pick up induced voltage from a parallel circuit running alongside it.
5. Protect against adjacent live parts. The work is dead; the busbar next to it may not be. Screening, insulating barriers and a defined working space are part of the isolation, not extras.

How is a circuit proved dead?

A circuit is proved dead by testing every conductor at the point of work with an instrument that is itself proved immediately before and after the test — never by trusting a switch position, a drawing or a rack-out. Everything else on the permit is control; this test is proof, and it only answers for the moment and the point where the probe touched.

1. Choose a test instrument suited to the job. A two-pole voltage detector or a proving unit and detector combination, rated for the circuit’s category and voltage, with probes and leads that limit exposed metal. British guidance GS38 sets out what suitable test equipment looks like for this work; instruments carry their measurement category rating under IEC 61010.
2. Prove the instrument on a known live source — a live circuit or a proving unit — before it touches the circuit under test.
3. Test every conductor at the point of work, not at the isolator or the panel front but where the hands will be: phase to phase, phase to neutral, phase to earth. A single check between two phases will not find one live conductor that is still connected.
4. Prove the instrument again on the known source, immediately after. Skipping this second check means an instrument that died in between produces a confident dead reading on a live circuit — a documented cause of fatalities and the reason the rule exists.
5. Record the result with a name and a time. The signature belongs to the person who held the probes. A reading without a time cannot be judged stale, which means it must be treated as stale.

North American systems arrive at the same place through the process of establishing an electrically safe work condition in NFPA 70E:

1. Identify all sources.
2. Open the disconnecting devices.
3. Verify the opening visually, where the design permits it.
4. Release stored energy.
5. Apply lock-out tag-out.
6. Test for absence of voltage with an adequately rated instrument.

Stored energy: what stays dangerous after isolation

Isolation removes the supply. It does not empty the equipment.

• Capacitors and DC links. Power factor capacitors and the DC bus of a variable speed drive hold a lethal charge after the supply is opened. The drive’s own label states the waiting time before the enclosure may be opened; that time is a minimum, and the verification is still a voltage test.
• Batteries, UPS and solar. These are sources, not loads. A solar array is live whenever there is light on it, and cannot be switched off at the panel.
• Induced voltage. A dead circuit running parallel to an energised high-voltage circuit picks up voltage along its length. Earthing and short-circuiting at the workface is what makes it safe to touch.
• Mechanical energy released by electrical means. Springs in switchgear mechanisms, a raised load on a hoist, a valve actuator with air still on it, a rotating machine still turning. The isolation list has to cover the energy the equipment holds, not only the energy it consumes.

Locks, keys and the group

Each worker exposed to the risk fits a personal lock to the isolation point and keeps the only key to it, or the group’s keys go into a lock box that is opened only when every personal lock is removed from it. The mechanics look trivial, and they decide whether the isolation is real.

• One person, one lock, one key. Each worker fits their own lock to the isolation point or to the hasp, and keeps their own key. Nobody else can remove it.
• Group isolation with a lock box. The isolating officer locks the points, puts the keys in a box, and every worker locks the box. The box opens only when the last personal lock comes off.
• Tags carry information, not protection. Name, date, what is isolated, who to contact. A tag without a lock stops only the people who read it.
• Removal has a procedure. A lock left on by someone who went home is removed under a written procedure with a named authority and a documented attempt to contact the owner — never by cutting it because the shift needs to run.

Return to service follows a fixed order, and it is a separate step from the work finishing:

1. Prove nobody is on the equipment.
2. Remove the earths.
3. Remove the locks, in reverse order to how they were applied.
4. Restore the supply.
5. Record it.

The permit is closed by the person who raised it, not by the passage of time.

Arc flash: the hazard the permit must name

Shock is not the only exposure. An arc fault releases heat and pressure in milliseconds, and the protection is chosen in advance rather than at the panel door. Where any part of the work is done with the equipment energised — testing, fault finding, or opening a panel that cannot be proved dead first — the permit states the boundaries around the exposed conductors, the protective clothing required for the incident energy, and who else must be clear. NFPA 70E is the reference used across North America and by many international operators; the protective clothing itself is tested to IEC 61482 in the international scheme.

How the requirement is written in different countries

The five-rule sequence above is the same everywhere; what differs by country is which document makes it mandatory, and the exact standard number an auditor expects to see on the isolation record.

Where do electrical isolation permits fail?

Electrical isolation permits fail in the same five places on almost every site, and none of them is the form itself: a source that was never traced, a switch trusted instead of tested, stored energy forgotten, keys held by the wrong person, and a permit closed while someone is still on the equipment.

• one source is isolated and a second one is not, because the drawing was trusted instead of the circuit;
• the circuit is switched off but never proved dead, or proved with an instrument that was not proved itself;
• stored energy is forgotten: the drive is opened inside its stated waiting time, or the capacitors are assumed discharged;
• the keys are held by a supervisor, so the people at risk cannot control their own isolation;
• the permit is closed and the equipment restored while someone is still working on it, because nobody physically checked before switching in.

Each of these is visible in the permit record afterwards. That is the reason the record exists: on an electrical job the difference between safe and fatal is a check that leaves no trace unless it is written down. How that record is kept — a pad in the substation, or a system that stamps each isolation as it happens — decides whether the check can still be read a year later, when an investigator asks for it.

Standards cited

• 29 CFR 1910.147 — OSHA, United States · The control of hazardous energy (lockout/tagout) · Energy isolation and lockout before servicing equipment · In force
• NFPA 70E — NFPA, United States · Standard for Electrical Safety in the Workplace · Electrical safety work practices, including the energised work permit · In force
• NOM-029-STPS-2011 — STPS, Mexico · Mantenimiento de las instalaciones eléctricas en los centros de trabajo — Condiciones de seguridad · Safety conditions for maintaining electrical installations · In force
• GB 30871-2022 — SAMR / SAC, China · 危险化学品企业特殊作业安全规范 · Eight special operations in hazardous chemical enterprises; a permit is mandatory for each · In force

Frequently asked questions