HIRA, PTW, LOTO & TBT: How the Electrical Safety Workflow Works

HIRA identifies the hazards and required controls. LOTO establishes and verifies hazardous-energy isolation. PTW authorizes and coordinates a defined job under stated conditions. TBT makes sure the work party understands the task, controls, roles and stop-work triggers before work begins. They are connected controls, not four names for the same paperwork.

The exact sequence, job titles and forms vary by country, industry and site. Some sites complete isolation before issuing the permit; others issue a permit that references a separate isolation certificate and requires verification at the worksite. In either model, the scope, risk assessment, isolation status, permit conditions and team briefing must agree.

Safety boundary: This article explains a control-of-work model. It is not an electrical isolation procedure or authority to perform electrical work. Only competent and authorized people should plan, isolate, prove dead, issue or accept permits, and restore equipment under the applicable law and approved site procedure.

HIRA, PTW, LOTO and TBT at a Glance

Control	Primary question	Main output or evidence	What it does not replace
HIRA — Hazard Identification and Risk Assessment	What can cause harm, who may be exposed, and which controls are required?	Hazard register/JSA, selected controls, residual-risk decision and assigned actions	Isolation, permit authorization or worker briefing
LOTO — Lockout/Tagout	Which energy sources must be isolated, secured, dissipated and verified?	Isolation points, locks/tags, stored-energy controls and verification record	Risk assessment or authorization of the work scope
PTW — Permit to Work	Is this defined work authorized under these conditions, people, boundaries and time limits?	Issued and accepted permit linked to precautions and certificates	The precautions themselves or continuous supervision
TBT — Toolbox Talk	Does the work party understand today’s job, controls, roles, interfaces and stop conditions?	Focused briefing and confirmation of participation/understanding	Competence, engineering controls, isolation or permit validity

The UK Health and Safety Executive describes a permit-to-work system as a formal communication and coordination system for hazardous work and explicitly warns that a permit does not, by itself, make a job safe or replace risk assessment. Its value is that it brings the authorized scope, precautions and responsible people into one controlled transaction. See the HSE permit-to-work overview.

The Workflow Is an Evidence Chain, Not a Paper Sequence

A strong electrical safety workflow passes verified information from one decision gate to the next:

1. The job scope defines the boundary. The team identifies the exact equipment, location, task, interfaces, expected condition and operational effect.
2. HIRA selects the controls. Hazards are identified, risk is evaluated and controls are assigned before authorization.
3. LOTO converts an isolation plan into a verified safe energy state. Every relevant energy source is addressed, including stored or secondary energy.
4. PTW authorizes the bounded work. The issuer and receiver confirm that the scope, competence, precautions, isolations and linked certificates are suitable and current.
5. TBT translates the control package to the work party. The crew confirms the sequence, roles, limits, communications and stop-work triggers at the point of work.
6. Supervision and change control keep the package valid. If reality no longer matches the approved conditions, work stops and the controls are revalidated.
7. Handback closes the control loop. People, tools, guards, work status, permits and isolations are accounted for before restoration.

This is why “the permit is signed” is not a useful definition of readiness. Readiness exists only when the documents and the physical worksite describe the same job and the same equipment state.

Step 1: Define the Job and Its Boundaries

Before assessing risk, make the work specific enough to assess. A statement such as “service the switchboard” is too broad. A useful scope identifies the assembly or feeder, the work activity, the limits of approach, affected loads, adjacent live equipment, access constraints, simultaneous operations and the condition in which the equipment will be handed back.

The scope should also establish who may be affected beyond the work crew: operations staff, contractors, production personnel, building occupants or another team working on a connected system. A change in equipment, location or work method is a change in scope—not a minor wording issue.

Step 2: Use HIRA to Select Controls

HIRA is the planning layer. Organizations may use names such as HIRA, JSA, JHA or task risk assessment, but the core logic is similar. The ILO five-step risk assessment guide frames the work as identifying hazards and exposed people, evaluating risk and controls, assigning and recording actions, then reviewing and updating the assessment.

For electrical maintenance, the assessment may need to consider:

• electric shock and arc-flash exposure, including study and labeling inputs covered separately in the arc-flash incident energy workflow and arc-flash label guide;
• unexpected energization, backfeed or induced voltage;
• stored electrical, mechanical, hydraulic, pneumatic, thermal or gravitational energy;
• control power, UPS systems, generators, capacitors and multiple supplies;
• adjacent live parts and restricted access;
• dropped objects, sharp edges, heat, noise, chemicals or confined spaces;
• test instruments, temporary earths, lifting operations and simultaneous work.

Many sites express risk as likelihood × severity in a risk assessment matrix (RAM). That matrix helps prioritize decisions, but the number is not a universal truth. Use the site’s approved definitions, control hierarchy and acceptance criteria. Record the initial risk, the selected controls and the residual risk after those controls are applied.

Where the term ALARP is used, it means reducing risk “as low as reasonably practicable” by weighing the risk against the sacrifice needed for further control. It is prominent in Great Britain and major-hazard practice; it should not be presented as a universal extra certificate or a substitute for local legal requirements. The HSE explanation of reasonably practicable and ALARP provides the jurisdictional context.

Step 3: Plan, Apply and Verify LOTO

LOTO is the hazardous-energy control layer. It should begin with a validated isolation plan or equivalent method that identifies every energy source and the points required to isolate the equipment. The plan must address normal supply, alternate supplies, control circuits, stored energy and any path that can re-energize or move the equipment.

At a high level, a controlled isolation includes shutdown, isolation, securing the isolating devices with locks and tags, releasing or restraining stored energy, and verifying the result before work. OSHA’s lockout/tagout guidance includes shutdown, isolation, placement and removal of devices, transfer of devices and verification in the required energy-control procedure. HSE electrical guidance likewise emphasizes identifying all sources, isolating them, securing the isolation against reconnection and proving dead where required; see Electrical safety at work: frequently asked questions.

Verification is a decision gate, not a signature added later. The authorized person must use the site’s approved method and suitable test equipment to confirm that the equipment is in the required energy state. Where proving dead is required, the test process and instrument checks must follow the applicable procedure. A tag alone is a warning; it does not physically establish isolation.

An isolator’s visible handle or open indication is not universal proof of safe isolation. Its switching function, contact design, utilization category and installation duty still need to match the system; the isolator switch guide explains that equipment boundary.

For a device-level example, see the separate MCB Lockout Tagout Procedures guide. That procedure does not replace the site-specific isolation plan for a switchboard, motor circuit or multi-source system.

Step 4: Issue and Accept the Permit to Work

PTW is the authorization and coordination layer. A permit should describe the equipment and job, define its limits, identify hazards and precautions, reference required isolations or certificates, set validity conditions, and name the responsible issuing and receiving roles. The issue and acceptance process is a two-way check: both parties need a common understanding of what is safe to do—and what is not authorized.

For electrical work, supporting information may include:

• an approved single-line diagram or equipment identification;
• isolation and earthing details where applicable;
• lock or key records and a separate isolation certificate;
• test-for-dead or discharge confirmation;
• arc-flash, approach-boundary or PPE requirements based on the site’s program;
• access controls, barriers, adjacent live equipment and emergency arrangements;
• linked permits for confined space, hot work, lifting or line breaking.

HSE’s HSG250 permit-to-work guidance treats planning, issue, acceptance, suspension, shift handover, handback, monitoring and audit as parts of the permit system. That lifecycle matters: a permit left open without controlled handover or handback is not merely unfinished administration; it creates uncertainty about the equipment and authority state.

Step 5: Conduct the TBT at the Point of Work

A toolbox talk is a short, focused briefing on the actual job. HSE describes toolbox talks as brief presentations on a specific safety aspect; see its toolbox-talk guidance. For permitted electrical work, the TBT should connect the approved controls to the conditions the crew can see.

The discussion should confirm:

• the exact equipment, boundaries and work sequence;
• the isolation status and areas that remain live;
• individual roles, competence limits and supervision;
• the tools, test equipment and protective measures required;
• simultaneous operations and interfaces with other teams;
• communications, emergency response and rescue arrangements;
• the conditions that require an immediate stop and reassessment.

A list of signatures proves attendance, not understanding. The supervisor should invite questions and use an effective confirmation method—for example, asking team members to explain their task, limits and stop conditions. If the work party cannot reconcile the permit with the worksite, work should not start.

Step 6: Execute, Monitor and Control Change

The approved package remains valid only while the job and conditions remain within its boundaries. Supervision should verify that barriers, isolations, housekeeping, tools and work methods remain effective. The work party should retain a clear stop-work route when doubt arises.

Stop, make the area safe and follow the site’s suspension or revalidation process when any of these occur:

Trigger	Why the original controls may no longer be valid	Typical control response
Scope or method changes	New hazards or energy paths may be introduced	Stop; revise HIRA and permit before continuing
Different equipment or isolation point is found	The authorized boundary may be wrong	Stop; verify identity, drawings and isolation plan
Alarm, voltage indication, movement or unexpected energy appears	The assumed energy state is contradicted	Withdraw; secure the area and investigate under authority
Crew, supervisor or shift changes	Competence, roles and shared understanding change	Use formal handover/re-briefing and permit controls
Nearby work or plant conditions change	Interfaces and simultaneous-operation risk change	Re-coordinate, reassess and revalidate
Permit expires or is suspended	Authorization is no longer current	Do not continue until formally reissued or revalidated
Emergency or evacuation occurs	Worksite and equipment status may be uncertain	Follow emergency controls; reassess before re-entry

The correct response is not always “update the TBT.” A new hazard may require a revised risk assessment, different isolation, additional engineering control, new permit or cancellation of the job. Communication cannot repair a missing physical control.

Step 7: Close, Hand Back and Restore Under Control

Completion of the physical task is not the end of the safety workflow. Before handback, the responsible people should confirm the work status, account for the work party and tools, remove temporary connections as authorized, restore guards and enclosures, clear waste and verify that the equipment is ready for the agreed state.

For tasks involving miniature circuit breakers, the technical inspection and replacement decision remains a separate maintenance question; see the MCB Maintenance Guide. The permit closeout should record the actual equipment condition rather than assume that completing the planned task proves serviceability.

The permit receiver then hands the equipment or area back through the defined process. The issuing authority confirms the permit and linked certificates can be closed. Locks and tags are removed only under the approved ownership and removal rules. Re-energization follows the operational authorization, with affected people notified and the equipment observed as required.

If the work is incomplete, record the actual condition and preserve the necessary controls. Never close a permit or remove an isolation merely to make the paperwork look complete.

PTW and LOTO Are Different Controls

Confusing PTW with LOTO is one of the most important conceptual errors to avoid.

PTW	LOTO
Authorizes and coordinates a defined hazardous job	Controls the hazardous energy associated with equipment
Defines scope, people, time, limits and linked precautions	Identifies, secures, dissipates and verifies energy sources
Can reference multiple certificates and control systems	Can exist as a separate procedure or certificate linked to the permit
Requires issue, acceptance, suspension and handback controls	Requires authorized control of locks/tags and verified isolation

A valid permit can reference a defective isolation, and a correct isolation can exist without authorizing a person to perform a particular job. The workflow must verify both.

Where RAM, ICC and ALARP Fit

These terms often appear beside HIRA, PTW, LOTO and TBT, but they are not universal additional stages:

• RAM — Risk Assessment Matrix: a scoring tool within the risk assessment. Its categories and acceptance thresholds are organization-specific.
• ICC — Isolation Confirmation Certificate: a site- or industry-specific record used by some organizations to document an isolation and its transfer or status. Other sites use an isolation certificate, lockbox record or another name.
• ALARP — As Low As Reasonably Practicable: a risk-reduction principle with a specific legal context in Great Britain and related major-hazard practice. It is not a replacement for the hierarchy of controls or local compliance criteria.

The name of the form matters less than the controlled evidence: the equipment is correctly identified, hazards are assessed, the energy state is verified, authority is clear, the crew understands the controls, changes are managed and the equipment is formally handed back.

A Practical Readiness Test

Before work begins, the person in charge should be able to answer all of the following without guessing:

1. What exact equipment and work are inside the authorized boundary?
2. Which hazards and energy sources were identified, including backfeed and stored energy?
3. Which controls reduced the risk, and who owns each action?
4. Which isolation points are applied, secured and verified?
5. Which permit and linked certificates are active, and when do they expire or require revalidation?
6. What remains live or operational nearby?
7. Does every team member understand the sequence, role, limits and stop conditions?
8. What events require suspension, reassessment or a new permit?
9. Who controls handback, de-isolation and re-energization?

If any answer is unclear, the workflow has not reached a defensible start-work condition.

Sources and Further Reading

• UK HSE — Permit-to-work systems
• UK HSE HSG250 — Guidance on permit-to-work systems
• UK HSE HSG85 — Electricity at work: safe working practices
• ILO — A 5 Step Guide for Employers, Workers and Their Representatives on Conducting Workplace Risk Assessments
• OSHA 3120 — Control of Hazardous Energy: Lockout/Tagout