Confined Space Entry Permit
A confined space entry permit template for tanks, pits, risers, ducts, sumps and sewers. Section 6 is the one it is built around: most people who die in confined spaces are not the first person in, they are the ones who went in afterwards to help.
- Forty-seven confirmations across hazards, isolation, rescue and equipment
- A rescue section the permit is not valid without
- Gas tests recorded at the top, middle and bottom of the space
- An entry and exit tally, so the count out is as deliberate as the count in
Confined Space Entry Permit
One space, one task, one shift
| # | Confirmation before entry | Confirmed | By whom | Time |
|---|---|---|---|---|
| 1 | Rescue plan written for this specific space and this work | |||
| 2 | Rescue does not depend on the attendant entering | |||
| 3 | Isolating valves locked and tagged, not merely closed |
The document you will get. Download for the full, editable file.
Who this confined space entry permit is for
Four people sign or rely on this permit, and the role that saves lives is the one with the least to do.
The entry supervisor
You issue it, and the signature says conditions are safe now rather than that the paperwork is complete. The two sections worth slowing down on are the isolation list and section 6, because everything else can be fixed while people are still outside.
The attendant at the opening
Your job is to stay out and keep count. The permit states that in writing, and you sign to confirm you understand it, because the pressure to go in and help is the single most predictable thing about a confined space emergency.
The entrant
You are the person the rest of the form is about. What matters to you is that the gas tests were taken at depth rather than at the hatch, that the valves are locked rather than closed, and that somebody can get you out without becoming a casualty.
Facilities or estates, as the duty holder
You own the spaces and the register of them. Risers, lift pits, ductwork, sumps and tanks become confined spaces because of what is in them, which changes, so your question is whether the assessment behind this permit is still current.
Which section matters the most in your sector
The hazards are set by the space rather than by the building, but the spaces themselves vary enormously, and so does who is going into them. If you run one of these, the sector page goes further than the template does.
- FM service providers
The roles table. Where entry is subcontracted, the permit is the only document that names who issued, who supervised, who attended and who was standing by for rescue, and that is the record an investigation reads first.
FM service provider software - Commercial real estate
The space register behind the permit. Tenant fit-outs change what is in a riser or a void, so a space assessed two years ago may now contain something that makes the previous permit wording wrong.
Portfolio maintenance software - Data centers
Isolation and stored energy. Entry into tanks, sumps and plant voids happens around equipment that cannot simply be shut down, so the isolation list and the adjacent work line carry more weight than usual.
Data center maintenance software - Healthcare
Atmospheric testing. Plant spaces in hospitals sit alongside medical gas, drainage and sterilization systems, and the previous contents of a space are often the reason the first reading looks acceptable and the second does not.
Healthcare maintenance software - Education
The case for entering at all. Campus spaces get entered for inspection far more often than for work, and inspection is the category most often done from outside with a camera or a probe instead.
Campus maintenance software - Corporate facilities
Rescue arrangements. Office estates have risers and lift pits but rarely a standing rescue capability, so the honest answer to section 6 is usually that the entry waits until one is on site.
Corporate facilities software
What a confined space entry permit should contain
A confined space entry permit is a written authorization to enter a space that is enclosed enough to create a serious risk from the atmosphere or the conditions inside it. It records the hazards, the gas tests, the isolations, the named roles, the rescue arrangements, who entered and when, and the closure that cancels it.
A. Fields specific to a confined space entry permit
| Field | What goes in it | Why it earns its place |
|---|---|---|
| Why entry is necessary | And what was considered to avoid entering at all | The most useful question on the form. A great many entries are made to do something that could have been done from outside with a camera, a probe or a long tool, and the safest entry is the one that does not happen. |
| Space type and description | Tank, vessel, pit, sump, riser, duct, sewer, chamber, void or silo | The type drives everything else. A vertical entry needs a tripod and a winch that a horizontal one does not, and a sewer carries hazards a dry riser never will. |
| Previous contents | What was in the space before it was emptied | Residue in the bottom of a tank generates the atmosphere the first entrant breathes. A space that tests clear at the hatch can be lethal at the floor purely because of what used to be in it. |
| Hazards identified | Thirteen categories, including hazards introduced by the work | The last of those is the one people forget. Welding, solvents and cutting change the atmosphere of a space that was safe when it was tested, which is why testing continues during entry. |
| Atmospheric testing | Seven measures, before entry and during it, with times | Readings go at the top, middle and bottom of the space rather than at the opening, because gases stratify by density and the air by the hatch is not the air somebody is working in. |
| Isolation and preparation | Twelve lines, including valves locked rather than closed | A closed valve with no lock is one person’s assumption away from being opened by somebody who has no idea anyone is inside. This section is the difference between a system that is off and a system that cannot be turned on. |
| Roles for this entry | Supervisor, attendant, each entrant, rescue team and gas tester | Named, with competence recorded and a signature each. A role that is understood but not written down is a role somebody will cover informally at the moment it matters. |
| Rescue arrangements | Twelve lines, and the permit is not valid without them | The section the whole document is built around. It asks whether rescue is possible in the time available with the people and equipment on site, and the answer determines whether anyone enters. |
| Equipment and communication | Ten lines, including the tested communication method | Communication has to be tested from inside the space rather than at the hatch, because the thing that stops it working is usually the space itself: the noise, the geometry or the metal around the entrant. |
| Entry and exit log | Each person, each time in, each time out, with a gas check | Count people out as carefully as you count them in. This tally is what tells you, in the first ten seconds of an emergency, whether anybody is still inside. |
| Conditions that cancel the permit | Alarm, atmosphere change, loss of ventilation or communication, injury | Written in advance so nobody has to decide under pressure. A permit with no stated cancellation conditions gets stretched by exactly the circumstances it should have ended for. |
| Closure | Everybody accounted for, before any isolation is removed | The order matters. Returning a system to service with somebody still inside is the sequence behind a recognizable share of confined space deaths, which is why the headcount comes first on the form. |
If you cut this down, keep section 6 and the entry tally. Every other control on the permit reduces the chance of something going wrong inside the space. Those two decide what happens once it already has. Rescue arrangements are what stop a single casualty becoming several, because the alternative is an attendant making the only decision a human being naturally makes at that moment, and the tally is what tells the people outside whether anybody is still in there before they start guessing. A permit that is thorough on hazards and vague on rescue has been written for the inspection rather than for the emergency.
B. What it looks like filled in
Gas readings from one morning on a tank sump, taken at the hatch and then at the floor of the same space.
| Time | Where | Oxygen | Flammable | Decision |
|---|---|---|---|---|
| 08:20 | At the hatch | 20.9% | 0% LEL | Within range |
| 08:40 | Mid depth | 20.4% | 3% LEL | Within range |
| 08:42 | At the floor | 18.6% | 11% LEL | Entry stopped |
| 09:35 | At the floor | 20.7% | 1% LEL | After ventilation |
| 09:40 | At the floor | 20.8% | 0% LEL | Within range |
| 10:15 | During entry | 20.8% | 0% LEL | Monitored |
The reading at depth is why this entry stopped. The hatch reading at 08:20 was entirely normal, and on a permit that asked for one test at the opening this entry would have gone ahead. The reading taken at the floor of the same space twenty-two minutes later was not, because residue from the previous contents was still generating an atmosphere at the bottom that had not reached the top. The second set of rows is the useful part: ventilation ran for the best part of an hour, the space was retested at depth, and only then did anybody go in. Nothing about the space changed. What changed was where the detector was.
Word to adapt the hazard list and the wording to your own procedure, Excel for the gas test table, the entry tally and the Permit Log tab that doubles as the register of permits issued, PDF for the copy that stays at the opening. Free, and yours to rebrand.
How do you issue a confined space entry permit?
One permit per space, per task, per shift. Work it in order, because each section assumes the one before it was answered honestly rather than optimistically. Six steps.
Describe the space, the work, and why anyone is going in
Permit number, site, the exact location and description of the space, its type, the work to be carried out, the validity window with both times, and who is issuing and accepting it. Then the question that can end the process early: what was considered to avoid entering at all.
Identify the hazards, including the previous contents
Thirteen categories, from oxygen deficiency and flammable atmospheres through residues, engulfment, mechanical and electrical hazards, temperature, noise and restricted egress, to the hazards introduced by the work itself. Record what the space used to contain, because residue generates the atmosphere the first entrant breathes.
Test the atmosphere at depth, not at the opening
Oxygen, flammable gas, carbon monoxide, hydrogen sulfide, any other toxic gas, temperature, and a further reading at depth. Record the acceptable range, the reading, and the time. Gases stratify by density, so test the top, the middle and the bottom, and keep testing during the entry.
Isolate, prepare, and lock rather than close
Twelve lines: energy sources isolated and locked off with the certificate reference recorded, equipment immobilized and stored energy released, lines blanked or disconnected, valves locked and tagged, the space emptied, cleaned, purged and ventilated with ventilation continuing, the opening secured and large enough for a rescue with equipment, lighting and tools suitable for the atmosphere, and adjacent work controlled.
Name the roles, then complete the rescue section
Supervisor, attendant, each entrant, the rescue team lead, the gas tester and the standby rescuers, each with competence recorded and a signature. Then twelve rescue lines, including a plan written for this space and this work, rescue that does not depend on the attendant entering, equipment rigged and checked, retrieval lines attached, and a rescue time that is acceptable against the hazards present.
Issue it, keep the tally, then close it in order
Issue once every section is verified, with the attendant signing to confirm they do not enter, and the cancellation conditions written down. Log every entry and exit with times and a gas check. At the end, account for everybody first, then remove tools, secure the space, remove isolations, cancel the permit and file it.
A confined space permit versus a general permit to work
A confined space permit is often treated as a general permit with extra boxes. It is a different document, and the difference is not thoroughness, it is what the controls are protecting against.
| Aspect | General permit to work | Confined space entry permit |
|---|---|---|
| What it controls | A task with a known hazard, done in an open place | A place whose conditions are themselves the hazard |
| The main risk | The work goes wrong and injures the person doing it | The space goes wrong and the person cannot get out of it |
| Who stands outside | Usually nobody, or a fire watch for hot work | An attendant whose only job is to stay out and keep count |
| Atmosphere | Rarely tested, and rarely changing | Tested before and during, at several depths |
| Rescue | Normal first aid and emergency response | A written plan, equipment rigged, people standing by |
| If the controls fail | An injury, with help able to reach the casualty | A second and third casualty, usually the people helping |
The honest test of which document you need is who is standing outside. If the answer is nobody, it is a general permit to work and that template covers it, including hot work. If the answer is a named person whose only function is to stay out of the space and keep a count of who is in it, then the controls on a general permit are the wrong shape, because they are written to protect a worker from a task rather than to get a worker out of a place. Confined space work frequently needs both, with the general permit covering the hot work or the electrical isolation and this permit covering the entry itself, and the two referencing each other by number. What does not work is one permit stretched to cover both, because the rescue section is the first thing to be flattened into a line that says the emergency services will be called, and that line is the single most common failure in this entire category of work.
When the template starts to feel limiting
A paper permit handles one entry well. It handles a site, and a year of entries, badly, and always in the same four ways.
Expiry is a time written on a page
A permit valid until noon stops being valid at noon whether or not anybody notices, and the document that says so is at the opening with the attendant. Nothing outside the barrier knows the window has closed.
Nobody outside knows a space is open
While an entry is live, the only record of it is the sheet at the hatch and the tally in the attendant’s hand. A control room, a duty manager or an incoming shift has no way to see that anybody is inside anything.
The space is not a register anywhere
The tank, the riser and the lift pit exist as descriptions typed onto permits. Their previous contents, their assessments, the entries made into them and the alarms that happened inside them live across a filing cabinet of separate forms.
Closure cannot be proved in bulk
An inspector asks whether permits are being closed properly or simply left to expire. Answering that from paper means reading every permit issued, and the ones that were never closed are precisely the ones least likely to have been filed.
What running this in Facilio looks like
The template is the paper version of this permit. The controls are the same ones; the difference is that the space becomes a record with a history, the permit has a state rather than a date, and the people inside it are visible to somebody who is not standing at the opening.
Work Completion Validator
A permit cannot close with anybody unaccounted for
On paper the closure depends on somebody completing the tally correctly at the end of a long shift. Held as a record, the permit cannot reach a closed state while an entry has no matching exit, so the headcount is enforced rather than remembered.
Ops Performance Intelligence
Expiry is something the system raises
The validity window becomes a live state rather than a time written on a page, so a permit approaching expiry surfaces to the supervisor and to anybody responsible for the area, instead of only to the person holding the document.
Audit Report Intelligence
The register answers the closure question directly
Because every permit carries its space, its dates and its closure, the question an inspector actually asks becomes a report: how many permits were issued, how many were closed, how many expired without closure, and which spaces they were for.
Reactive Maintenance Agent
An alarm during entry becomes recorded work
A gas alarm or an atmosphere change is the reason a permit is canceled, and it is also a fault in the space. Recorded against the space rather than only on the canceled permit, it becomes work to investigate before the next entry is planned.
Hallucination-free by design. Atom AI answers from the records in your tenant rather than generating plausible text, so an empty field reads as empty rather than filled in for you.
Frequently asked questions
What is a confined space entry permit?
A confined space entry permit is a written authorization to enter a space that is enclosed enough for the conditions inside it to be a serious risk. It records the hazards, the atmospheric tests, the isolations, the people in each role, the rescue arrangements, who entered and when, and the closure.
It is specific to one space, one task and one shift. The point of it is not the paperwork but the sequence: each section has to be answered before the next one makes sense, and the entry does not happen until the last of them is complete.
What counts as a confined space?
Any space that is substantially enclosed where the risk comes from the conditions inside rather than from the work being done. In buildings that usually means tanks, vessels, pits, sumps, risers, ductwork, sewers, chambers and voids, including spaces people walk past daily without thinking of them that way.
Size is not the test and a space does not have to be small or hard to get into. A large tank with an open hatch is a confined space if its atmosphere can become dangerous, and a lift pit is one even though people step into it routinely.
Why is the rescue section so important?
Because most people who die in confined spaces are not the first person in. They are the ones who went in afterwards to help, usually within a minute or two, usually without equipment, and usually because nobody had written down what they should do instead.
That is why the permit is treated as invalid until section 6 is complete. Rescue arrangements are the only controls on the document that address what happens once something has already gone wrong, and every other control on the page assumes they exist.
Is calling the emergency services a rescue plan?
No, and the permit asks the question explicitly for that reason. By the time a crew is called, arrives, locates the space, assesses it and rigs its own equipment, an unconscious entrant in an oxygen deficient atmosphere has been without breathable air for far longer than is survivable.
The emergency services have a place in the plan, which is why there is a line for informing them where the plan relies on them. What they cannot be is the whole plan, because the usable window for a rescue is measured in minutes and the response is not.
Can the attendant enter the space to help?
No. Not to help, not for a moment, not if something appears to be going wrong. The attendant stays outside, keeps the count, maintains communication and raises the alarm, and the permit has them sign to confirm they understand that before entry begins.
It is written down because it is the rule broken in almost every multiple fatality. The instinct to go in is entirely human, which is precisely why the control is a signature made calmly in advance rather than a decision made at the opening.
How should the atmosphere be tested?
Before entry and continuously during it, at the top, the middle and the bottom of the space. Gases stratify by density, so a reading taken by leaning through the hatch tells you about the air by the hatch and nothing about the air at the floor where somebody will be working.
Record the acceptable range alongside each reading and the time it was taken. The detector also needs to be calibrated, bump tested and in date, and carried by the entrant rather than left at the opening, since the atmosphere can change while the work is going on.
Does this replace a permit to work?
Not usually. A general permit to work covers a task with a known hazard, including hot work, and that template covers it. This permit covers entry into a place whose conditions are themselves the hazard, which needs an attendant, atmospheric testing and a rescue plan.
In practice confined space work often needs both, with the general permit covering the hot work or the isolation and this one covering the entry, cross referenced by number. What does not work is stretching one permit to do both, because the rescue section is always the part that gets flattened.
Can I edit and rebrand this template?
Yes. It is free to use, edit, rename and put your own logo on, internally or for clients. No attribution required.
The Word version is the one to edit if you want to match the hazard list and the wording to your own procedure. The Excel version is the one to use if you want the gas test table, the entry tally and the Permit Log tab, which doubles as the register of permits issued and shows whether they are being closed or simply left to expire.
In one paragraph
A confined space entry permit is a sequence rather than a form, and the order is the safety control. Start with whether anyone needs to go in at all, because a great many entries exist to do something that could have been done from outside. List the hazards including the previous contents of the space, since residue generates the atmosphere the first entrant breathes. Test at the top, the middle and the bottom, because the air by the hatch is not the air at the floor. Lock the isolating valves rather than closing them. Name every role and have the attendant sign to confirm they do not enter, because that rule is broken in almost every multiple fatality. Then complete the rescue section, which is the one the permit is not valid without, and keep the tally, counting people out as carefully as you counted them in, before any isolation comes off.
The template is the floor, not the ceiling
Take the permit; it will run one entry properly and give an inspector something to read. When a drawer of permits stops being enough, a connected CMMS runs the regime: every space a record with its assessment and its entry history, permits with a live state rather than a time written on a page, open entries visible to somebody who is not standing at the opening, and closure provable across a year rather than reconstructed from a filing cabinet.
