Permit-to-Work vs LOTO vs Line Break Permit: Which Control Owns the Job?

Many sites ask one permit to do three different jobs. Permit-to-work authorizes the job, Lockout/Tagout removes hazardous energy, and a line break permit controls the opening of piping or process lines that may still hold pressure, product, heat, or vapor. When leaders mix those decisions together, they create delays, weak verification, and false confidence.

The practical thesis is simple. The team should choose the control that owns the risk the job actually carries. If the task is authorization, use permit-to-work. If the task is hazardous-energy isolation, use LOTO. If the task is opening piping or process equipment with residual contents, use the line break permit. The wrong tool can still produce a signature, but it will not produce a safer job.

Across 25+ years leading EHS at multinationals, Andreza Araujo has seen the same failure pattern repeat. The organization names a form, not a control. In Safety Culture: From Theory to Practice, she argues that culture is visible in repeated decisions under pressure, and the permit choice is one of those decisions. If the leader does not separate authority from isolation from exposure control, the field inherits confusion.

This article is for maintenance supervisors, operations managers, and EHS leaders who need a clean decision rule before the next high-risk job starts. It also connects to permit-to-work handover between shifts, because a control that changes owners at shift change must still be clear enough for the next supervisor to defend.

Why one control cannot do three jobs

Permit-to-work, LOTO, and line break control are related, but they do not own the same decision. HSE guidance on permit-to-work systems treats PTW as a formal system for controlling hazardous work. OSHA 29 CFR 1910.147 treats LOTO as hazardous-energy control for servicing and maintenance. OSHA 29 CFR 1910.119 treats process safety work as a different operating discipline, which is why opening process equipment or piping cannot be treated as a generic maintenance approval.

As Andreza Araujo argues in A Ilusão da Conformidade, a complete file can hide a weak field reality. The problem appears when the organization says, "the permit was signed," as if that sentence proved the job was safe. A signature only proves that somebody approved something. It does not prove that the right barrier was chosen, that the field was checked, or that the exposure point was actually controlled.

James Reason is useful here because latent failures often sit inside apparently normal routines. A supervisor can accept a permit, the operator can trust the paper, and the contractor can keep moving because nobody wants to challenge the schedule. The job is then exposed to the hazard hierarchy from the wrong layer. The control exists on paper, but the risk remains live in the field.

Evaluation criteria for the decision

Before choosing a control, the supervisor should answer three questions. First, what is the job trying to authorize? Second, what energy or substance could injure the worker? Third, what physical boundary changes when the work starts? Those questions separate a paperwork decision from a real risk-control decision.

If the work is only about allowing entry, assigning responsibility, or making the job visible, permit-to-work is the main layer. If the work is about de-energizing a machine or equipment train before maintenance, LOTO is the main layer. If the work is about cracking open piping, a vessel connection, a hose, or any line that may still hold residual contents, the line break permit is the main layer. One control can support the others, but it should not replace them.

In more than 250 cultural-transformation projects supported by Andreza Araujo's team, the same pattern appears again and again. Sites do better when they define the job by the hazard they need to neutralize, not by the form they already have in the filing system. That is the practical difference between an operating system and a paper stack.

Permit-to-Work

Permit-to-work owns the authorization decision. It tells the organization who may start the job, under what conditions, in which area, and with which boundaries in place. It is a management control, not an energy-control method by itself. A PTW system can organize hot work, confined space entry, work at height, or other controlled tasks, but it still depends on the other controls being real.

The PTW question is not, "Have we signed the form?" The stronger question is, "Has the supervisor confirmed that the work is authorized, the boundaries are clear, and the other controls are ready?" If the answer is no, the permit is premature. The form may be complete, but the job is not yet controlled.

That is why the article on permit-to-work handover matters. A permit can be correct at 8 a.m. and weak at 4 p.m. if the next shift inherits a changed site, a changed crew, or a changed interface. PTW becomes weak when leaders treat it as proof of safety rather than proof of authorization.

Lockout/Tagout

LOTO owns hazardous-energy isolation. OSHA 29 CFR 1910.147 requires procedures for controlling unexpected energization, startup, or release of stored energy during servicing and maintenance. That means LOTO is the right control when the danger comes from electrical, mechanical, hydraulic, pneumatic, thermal, gravitational, or other stored energy that could reach the worker during maintenance.

LOTO should not be used as a generic permit substitute. A lock on a switch does not prove that a line is drained, that a valve does not leak by, or that a vessel is safe to open. The control works only when the team identifies every energy source, isolates it, releases residual energy, and verifies zero energy at the point of exposure.

The article on LOTO verification before maintenance starts is the right companion here because it shows the difference between a lock and proof. In Sorte ou Capacidade, Andreza Araujo frames weak outcomes as system outcomes, not luck. LOTO is one of the clearest examples. If the verification step is skipped, the hazard is still present even when the board looks orderly.

Line Break Permit

The line break permit owns the opening of piping, hoses, vessels, valves, or process connections that may still hold product, pressure, vapor, heat, or chemical residue. It is more specific than PTW and different from LOTO, because the risk is not only whether the machine can start. The risk is also what comes out when the crew opens the line.

A strong line break permit names the exact break point, the isolation method, the drain or purge method, the verification point, the emergency controls, and the first-bolt or first-opening sequence. If the permit does not show how the crew will prove the line is dead at the exposure point, the document is describing intent instead of control.

The article on opening piping safely with a line break permit shows why this control deserves its own logic. It is also where Safety Culture Diagnosis becomes useful, because the real issue is whether leaders can see the gap between a controlled line and a signed line. A system that cannot distinguish those two conditions will eventually ask a mechanic to discover the difference with a wrench.

Decision Matrix

The table below turns the comparison into a field rule. It is not meant to add bureaucracy. It is meant to stop the team from using the same document for three different hazards.

The matrix works because it forces one decision at a time. If the job needs authorization and energy isolation, PTW and LOTO both matter. If the job involves opening piping, the line break permit also matters. The point is not to choose only one form. The point is to make sure each form owns the risk it was built to control.

Recommendation by context

For a maintenance supervisor, the first question is simple. Are we about to service equipment, or are we about to open a line? If the answer is servicing equipment, LOTO must be proven before anyone starts. If the answer is opening piping, the line break permit must define the release path before the first opening. PTW then sits above both as the authorization layer.

For a process safety engineer, the important task is interface control. MOC or other change control may trigger the work, but the field decision still needs the correct operational layer. That is why the article on Management of Change before startup fits this discussion. When a change alters the system, the control choice must change with it.

For an operations manager, the test is whether the incoming shift can explain the control in plain language. If the team cannot tell the difference between permission, de-energization, and line opening, then the system is too abstract for the field. Across 25+ years in executive EHS, Andreza Araujo has found that clarity beats ceremony whenever the schedule starts to press.

Common traps that blur the controls

The first trap is using PTW as if it were proof of isolation. The permit may say the job is approved, but approval does not make the machine safe. A supervisor who confuses those two ideas is asking the form to do the work of the barrier.

The second trap is using LOTO for a line that still contains trapped product. A lock can stop startup, but it does not drain residue, cool hot surfaces, or purge vapors. That is why the line break permit exists. It handles the opening event that LOTO alone does not explain.

The third trap is turning the line break permit into a broad maintenance approval. The document becomes too wide, the field proof gets vague, and nobody owns the exact break point anymore. That is how a precise control turns into a generic signature.

As Andreza Araujo writes in A Ilusão da Conformidade, paper can look better than practice. This is the kind of paper-truth that later produces real exposure. The safest sites resist that drift by assigning each control to one job and one job only.

FAQ

Can permit-to-work replace LOTO?

No. Permit-to-work authorizes the job, but it does not remove hazardous energy by itself. If the task can expose workers to unexpected energization, startup, or stored energy, LOTO is still required.

Can LOTO replace a line break permit?

No. LOTO controls hazardous energy, but a line break permit controls the opening of piping or process lines that may still hold pressure, product, vapor, or residue. The line break decision needs its own field proof.

When does PTW come first?

PTW comes first when the site needs an authorization layer before work starts. It helps define scope, boundaries, supervision, and stop conditions, but it should then hand the job to the correct technical control.

What is the biggest mistake leaders make with these controls?

The biggest mistake is treating them as interchangeable paperwork. Each control exists because a different failure mode needs a different proof. When leaders collapse them into one form, they lose precision and increase the chance of a weak decision.

Which Andreza Araujo book fits this topic best?

Safety Culture: From Theory to Practice is the best starting point because it connects repeated decisions, field verification, and leadership behavior. A Ilusão da Conformidade and Sorte ou Capacidade strengthen the argument that paperwork alone does not prove control.