Energized Work Permit Process
Purpose
The permit exists to make one decision survive contact with a customer who wants the power left on. That decision is whether de-energizing is genuinely not an option, and it is a narrow test with two doors: 29 CFR 1910.333(a)(1) requires live parts to be de-energized before an employee works on or near them unless the employer can demonstrate that de-energizing introduces additional or increased hazards, or is infeasible due to equipment design or operational limitations. NFPA 70E-2021 states the same two conditions in 130.2 and adds the permit in 130.2(B).
Neither instrument lists cost, schedule, production loss or customer inconvenience among the conditions, so a request grounded in any of those fails on its face. That is why a shop needs a form and a named approver. Without them the test gets applied by a tech standing in front of an unhappy facility manager at 4 p.m., and it gets applied differently every time. The second reason is reconstruction: if something happens inside the boundary, the only defensible answer to why it was energized is a document written beforehand, signed by someone with authority.
Scope
Covers any work inside the restricted approach boundary on exposed energized parts at 50 V AC or more, in general industry under 29 CFR 1910 Subpart S and in construction under 29 CFR 1926 Subpart K, where 1926.416(a)(1) states the parallel requirement. Say which Part the site falls under on the permit; a field-service shop moves between them and the reader months later cannot tell from the address.
Does not cover PPE selection or boundary measurement, which the arc flash SOP owns and which this permit imports as values. Does not cover the isolation sequence, which is what you do instead when the permit is denied.
Roles and responsibilities
| Role | Owns | Hands off |
|---|---|---|
| Requesting technician | The verbatim request, the stop, the equipment data | Hands over a complete draft, never a verbal summary |
| Supervising master | The justification test, approval or denial, shop signature | Returns a denial with the re-scope option already named |
| Customer authorized signatory | Shutdown authority and the customer signature | Names in writing the shutdown window the shop is being denied |
| Second qualified person | Attendance inside the boundary or the safety watch | Confirms qualification basis before the briefing, not during it |
Procedure
Stop the work and write the request down in the customer's own words. Acceptance: the log names who asked, what they want kept energized, and their stated reason, quoted rather than paraphrased. Wrong looks like a note reading "customer wants it hot." Stop rule: nothing resumes on that equipment until the permit resolves either way, and if the deadfront is already off, refit every fastener. Hazard: a panel left open while a permit is debated has nobody assigned to it, and whoever wanders past is not wearing anything.
Identify which of the two conditions is claimed and write it as one sentence. Acceptance: the sentence names either an additional or increased hazard created by the shutdown, or an equipment design or operational limitation making shutdown infeasible. OSHA's own examples of the first are interruption of life support, deactivation of emergency alarm systems, shutdown of hazardous location ventilation, or removal of illumination from an area. Wrong looks like a sentence about stock, downtime or a lease clause. Stop rule: if you cannot write the condition without a money or schedule word, the test has failed; go to step 10. Hazard: none yet, which is the point of doing this before anyone is near the equipment.
Test the claim against the alternatives that would make shutdown feasible, and show the arithmetic. Acceptance: each alternative, such as a temporary feed, a rental bypass, a load transfer or an after-hours window, is implemented or ruled out with a number written on the permit. Wrong looks like "no alternative available" with no working shown, which is the shape a claim takes when nobody looked. Stop rule: an alternative that works de-energized wins and the permit is denied. Hazard: skipping this is how a shop ends up doing energized work it did not have to do, repeatedly, at one site.
Check whether a permit is required at all before spending an hour on one. Acceptance: the task is compared against the exemption list in NFPA 70E-2021 130.2(B), which excludes testing, troubleshooting and voltage measuring by qualified persons in appropriate PPE, plus certain inspection tasks that do not cross the restricted approach boundary. Wrong looks like a shop writing permits for every meter reading, which trains everyone to sign without reading. Stop rule: exempt tasks still require the assessment and the PPE; the exemption is from paperwork, not protection. Hazard: a task that starts as troubleshooting and becomes a repair has left the exemption, and the tech stops at that boundary.
Import the shock and arc flash values onto the permit face. Acceptance: nominal voltage, limited and restricted approach boundaries, arc flash boundary, incident energy with its working distance, and the selected arc rating all appear as numbers taken from the pre-entry record. Wrong looks like a permit that says "PPE per 70E." Stop rule: any blank sends the job back to the arc flash procedure before signature. Hazard: a permit signed with unknown incident energy authorizes work nobody has assessed, which is worse than no permit because it looks like an assessment.
Name everyone who will be inside the boundary and state each one's qualification basis. Acceptance: for each name, a training date and one line saying what makes them qualified for this equipment class and this task, not a role title. Wrong looks like a second name added at the truck because the job needs two hands. Stop rule: a person whose qualification basis you cannot write does not cross the limited approach boundary; they work outside it or the crew waits. Hazard: an unqualified second person takes the full incident energy and is least likely to recognize the cue that the work should stop.
Write the job-specific work plan, including sequence, tools and abort condition. Acceptance: steps listed in order, the insulated tools and the rated barriers or blankets covering adjacent live parts named, and a stated observation that stops the work: a smell, a sound, a rising temperature, an unexpected reading. Wrong looks like a plan describing the outcome instead of the sequence. Stop rule: no written abort condition, no signature. Hazard: adjacent phases and the enclosure are the usual second contact, so covering them with rated barriers is part of the plan rather than a refinement.
Obtain customer-side approval from a person with authority to authorize energized work there. Acceptance: the signer's role gives them authority over the equipment and the shutdown decision, confirmed against the facility contact list, and the signature is dated. Wrong looks like a site foreman signing because the plant manager is off site. Stop rule: no authorized signatory, no start; the shop takes no substitute and no verbal. Hazard: an unauthorized signature is discovered after an event, not before, and at that point the shop is the only party holding a document.
Hold the pre-job briefing at the equipment with everyone present, and record it. Acceptance: hazards, plan, PPE, the boundaries as marked on the floor, and emergency response including who calls and from where, with every attendee initialling. Wrong looks like a briefing given in the van. Stop rule: anyone who cannot repeat back the abort condition and the upstream disconnect location does not enter. Hazard: an arc flash victim cannot self-rescue, so the person outside the boundary must know not to make contact while the source is live.
Close the permit at completion or at abort, the same day. Acceptance: a completion time, the condition the equipment was left in, and either the work performed or the reason it did not proceed. Wrong looks like a denied request leaving no paper, which is how the same request returns next quarter and gets answered differently. Stop rule: an aborted permit is filed with its reason, not discarded. Hazard: equipment left partly reassembled needs its own tag and a note on the permit, because the next person through the door has no way to know.
The record this produces
One permit per task per day, scanned to the customer job file. Fields: site and Part scope, equipment ID, task, condition claimed with its justification sentence, alternatives with the numbers that ruled them out, all shock and arc flash values, the named crew with qualification bases, the work plan and abort condition, both signatures with dates, briefing initials, and the close-out line.
Three readers. The supervising master reads denials in aggregate, because a customer generating repeated denials needs a maintenance shutdown window negotiated into the service agreement rather than a fight every visit. The estimator reads the approvals, because energized work carries a second qualified person and a longer setup, and a bid that priced it as ordinary work loses labor every time. After an incident, an investigator reads the justification sentence first, which is why it is written before the work and never after.
Worked pass: 480 V pump control panel at a wastewater lift station
Request: replace a failed pump starter contactor in a 480 V control panel serving a two-pump lift station under an occupied plant floor. The operator asks that the panel stay energized because a shutdown stops both pumps.
Step 2 records the claim as an additional hazard: with both pumps down the wet well fills and overflows into an occupied space, which is a hazard created by the shutdown rather than a production loss.
Step 3 tests it. Measured inflow during the requested window is 210 gallons per minute. The bypass pump available same day from the rental yard moves 150 gallons per minute, leaving a net fill of 60 gallons per minute. Working volume between the lead-on level and the overflow lip is 900 gallons, so the well overflows in 900 divided by 60, which is 15 minutes. The contactor change is estimated at 90 minutes. Fifteen minutes of cover against a 90-minute task is not an alternative, and that number goes on the permit in place of the phrase "no bypass available." The justification stands.
Step 5 imports the values from the pre-entry record: 480 V nominal, arc flash boundary and incident energy from a study inside its review interval, arc rating selected above the incident energy at the printed working distance.
Step 6 fails. The second tech has current 70E training but has never been assessed on 480 V motor control, and the supervising master cannot write a qualification basis for him on this equipment class. The stop rule fires: he does not cross the limited approach boundary. He takes the safety watch outside it, which is real work and is written on the permit as such, and a second qualified person is pulled from another job, moving the start by roughly half a shift.
That delay is the visible cost of the step, and it is why the step sits at 6 rather than at 9. Discovered at the briefing, the same failure leaves a crew at an open panel making the decision under pressure, and the answer given there is not usually the one written here.
The permit closed at completion, contactor replaced and panel restored, with one line noting that this site should carry a pre-arranged de-energized window at its next agreement renewal, since the same wet well arithmetic will produce the same claim on the next failure.
References
- 29 CFR 1910.333(a)(1), which requires de-energizing unless the employer demonstrates additional or increased hazards or infeasibility due to equipment design or operational limitations, for general industry
- 29 CFR 1926.416(a)(1), the construction-scope counterpart under Subpart K
- NFPA 70E-2021, 130.2 for the justification conditions and 130.2(B) for the permit and its exemption list, in the edition your electrical safety program has adopted
- 29 CFR 1910.332 and 1910.333(c), for the qualified person requirement applied at step 6
- See related: the arc flash boundary and PPE selection SOP, which produces the values imported at step 5