Hot work is one of the highest-consequence tasks on any site. A permit gets signed, a welder starts cutting, and everyone downstream assumes the equipment behind the job is dead. The risk sits in the space between what the permit says and what is actually true at the isolation point.
That space is where people get hurt. This piece is about closing it, so the energy isolation behind a hot work permit is applied, verified, and still holding at the moment the first spark lands.
The gap between a signed permit and energy that's actually isolated
A hot work permit authorises the ignition hazard. It does not, on its own, prove the equipment's hazardous energy is isolated. On most sites those are two separate records, handled by two different people, at two different times.
The issuer often signs on the strength of a tag hung earlier in the shift or a quick radio confirmation. Between "isolation applied" and "first spark" a shift can hand over, a second crew can arrive, or a test can quietly re-energise a circuit. None of that shows up on the permit.
This is the LOTO evidence gap in its sharpest form. It is the distance between having a lockout procedure and being able to prove the right isolation was applied, verified, and current when work began. For hot work, that gap is measured in seconds and consequences.
Why hot work and energy isolation can't be run as separate paperwork
The two controls are separate but they are not independent. A hot work permit manages the source of ignition, and a digital permit to work system can carry that permit cleanly, but the isolation behind it is a different control with its own evidence.
Energy isolation manages the machine. Where hot work happens on, in, or near equipment that is being serviced, or that could start or become energised, both controls have to hold at the same time. The permit should not clear until the isolation behind it is confirmed, not merely claimed.
What OSHA 1910.147 expects you to verify before work starts
29 CFR 1910.147 requires that all hazardous energy is isolated and that the isolation is verified as effective before servicing begins. That verification step is the one that gets assumed rather than done. Hanging a lock is not the same as confirming zero energy.
Before work starts, the authorised employee has to confirm the equipment cannot start and that stored energy has been released or restrained. That means electrical, mechanical, hydraulic, pneumatic and thermal sources, not just the obvious isolator. A machine-specific lockout/tagout procedure is what makes that repeatable rather than a matter of memory.
Verifying a zero-energy state, and re-verifying it when conditions change
Zero-energy verification is not a one-time tick. It means operating the controls to confirm the machine will not start, testing for absence of voltage on electrical sources, and bleeding or venting stored energy. For electrical work, a qualified person establishes an electrically safe work condition by testing before touch.
Here is the trap for hot work. Verification carried out at 8am does not cover a torch lit at 11am if the state was disturbed in between. Any test, adjustment, or partial re-energisation resets the clock. The question the issuer should be able to answer is not "was it isolated?" but "is it isolated now, and can I see that?"
Where paper permits and manual isolation break down
Four patterns show up again and again. They are execution-control and evidence failures, not missing padlocks.
The issuer can't confirm isolation from where they are
The permit issuer is usually in an office or a control room, and the isolation points are on the floor, sometimes spread across a large site. With paper, the issuer's only signal is a tag hung earlier or a voice on the radio. They are signing on trust rather than sight.
No live view of who's signed on or which points are claimed
Group lockout multiplies the exposure. When several people work under one plan, a sign-on sheet at the lock-box cannot tell the issuer, in real time, who is currently protected and which isolation points are claimed and verified. If the sheet is a step behind, the issuer's picture of the job is wrong.
Isolation gets applied and verified by the same person
Single-person verification is a known weak point. If one authorised employee both applies the lock and confirms zero energy, with nobody checking independently, a missed source or a misread meter goes uncaught. High-energy hot work is exactly where a second, independent check earns its place.
Nothing ties the permit to current evidence at the point
When the job is done, and an auditor or an incident investigator asks what was isolated and when it was verified, the record is scattered. A permit in one place, a sign-on sheet in another, a tag already in the bin. Reconstructing whether isolation was current when the torch was lit becomes guesswork.
What remote, verified isolation actually looks like
A digital lockout system closes those four gaps by making isolation status live, shared, and recorded. Here is what to look for, and how Zentri handles each.
Live plan status you can see without leaving your desk
A digital plan moves through defined states, from draft and approved through to active and closed. The issuer should see that state change as it happens rather than inferring it from a tag. Zentri runs each lockout plan through a full lifecycle with live status updates, so the person signing the permit watches the plan go active the moment isolation is executed. That live state is the backbone of any digital lockout/tagout programme.
Group sign-on and isolation-point claiming, in real time
The system should show who is signed on and which isolation points are claimed, updated live. Zentri manages group lockout through plan sign-on and isolation-point claiming, so the list of who is protected under the plan is always current rather than a sheet waiting to be updated.
Two-person verification, enforced in the right order
For high-energy work, verification should require a second, independent check, and the system should enforce the sequence rather than rely on people to follow it. Zentri applies two-person verification on isolation points, with a strict primary-then-second-verifier order enforced in the system, so no point can be marked verified by one person acting alone.
Point-of-work verification, written straight to the log
A scan at the isolation point should confirm the correct point and record who checked it and when. Zentri generates QR codes on equipment and isolation points, and a scan-based check writes straight to the audit log. "Verified" then means verified at the point, with a name and a timestamp against it, which is also what answers the currency question. The record shows the check happened, not that it happened at some earlier hour.
Hot work is usually contractor work, so the multi-site view matters
Most hot work is carried out by contractors, and oversight is often central. That creates two needs at once. Contractors need scoped access to the plan without the run of the system, and the safety lead needs a single view across sites.
A digital system with a contractor role, single sign-on, and site-level structure lets a central EHS function see isolation status wherever the work is, while keeping contractor access controlled. Zentri provides a restricted contractor role, SSO and MFA for access, and site-level segmentation, which matters most for heavy industry and maintenance operations where hot work travels between sites. A permit issued at one site can then be backed by isolation evidence the accountable people can actually see.
A go/no-go isolation check to run before hot work starts
This is a short list an issuer can run, on paper or in the system, before the permit clears.
- Isolation applied to every energy source on the equipment: electrical, mechanical, hydraulic, pneumatic, thermal and chemical, as relevant.
- Zero energy verified by try-out and, for electrical sources, a test for absence of voltage.
- Verification independently checked, not applied and confirmed by the same person.
- Everyone working under the plan signed on and visible.
- The isolation state current as of now, not verified earlier and left through a handover or a test.
- The permit linked to the isolation record, so there is one place to show what was isolated and when.
If any line can't be answered with evidence rather than assurance, the torch should not be lit.
From assurance to evidence: closing the gap
The distance between a paper permit-and-tag routine and a digital lockout system is the distance between static and controlled LOTO. Static LOTO leans on binders, generic templates, manual sign-off, and informal handover. Controlled LOTO connects the procedure, the people, the isolation points, and the closeout record, and keeps the state visible while work is live.
For hot work, that is what turns "the permit says it's isolated" into "here is the current, verified proof." It is the shift Zentri is built around, and the reason the business case for moving off paper-based LOTO keeps coming back to evidence rather than convenience. LOTO compliance is no longer just about having procedures. It is about controlling the full lifecycle, from isolation and verification through to the evidence you can produce afterwards.
If you want a structured way to check whether your programme can prove all of that, our LOTO audit checklist walks through the evidence an auditor, or an incident investigation, will look for. If it helps to see remote isolation status working in practice, you can book a demo and follow a live plan end to end.
Matthew Nugent is a chemical engineer with a decade of industrial process operations experience and co-founder of Zentri. He writes on lockout/tagout execution, energy isolation, and audit-ready digital compliance.