Switching orders and clearance tags: making the operator's authorization survive the log
A clearance is the promise that a line is dead and a crew can touch it. It is the single most consequential piece of authority a system operator holds, and it is recorded the same way a preference change is recorded: a workflow state, attributed to whoever was logged into the console.
What does a switching order record actually name?
A console session. Clearances protect human life — they are what stops a line being energised while someone is working on it — and they are issued, held and released through an energy management system whose record names a session rather than a verified person who read and understood the order.
- Control room consoles are shared and sessions are long. Shift handover is procedural, so the EMS principal and the human in the chair diverge routinely and legitimately.
- Clearance release is the moment where attribution matters most: a line becomes live with crews possibly still in proximity.
- Two independent assertions over the identical switching sequence, from distinct authenticators within a bounded window, make issue and release attributable without changing control-room tempo.
Part of Grid, water and OT identity
The two moments that carry the weight
Switching is a long procedure with many steps, and most of them are recoverable. Two are not.
The first is issue: the operator confirms that the sequence has been executed and the section is isolated and grounded. A crew relies on that confirmation to put hands on conductors.
The second is release: the operator confirms that all clearances on the section have been surrendered and the line may be re-energised. If a clearance is released while a crew remains on the section, the consequence is not an outage.
What the record says today
Both moments are workflow state transitions in an energy management or outage management system. The record contains a clearance number, a timestamp, a state, and the user identifier associated with the console session.
Control rooms operate on twelve-hour shifts with consoles that remain logged in across them. Handover is a verbal and written procedure, conducted at the console, without necessarily terminating and re-establishing the application session. That is an entirely reasonable operational design and it means the user identifier in the record is a statement about session history, not about who was present.
| Question after an event | What the EMS record supports |
|---|---|
| Which clearance covered this section? | Fully |
| When was it issued and released? | Fully |
| What was the switching sequence? | Fully |
| Which named operator issued it? | Only by inference from shift roster and session history |
| Did that operator read this specific sequence before confirming? | Not at all |
Why voice logging is not the answer people assume
Control rooms record voice, and event analysis leans on those recordings heavily. They are genuinely valuable for reconstructing intent and communication quality.
They are a poor substitute for attribution at the moment of confirmation. Voice establishes that a conversation occurred; it does not establish which keystroke followed it, and in a room with several operators and overlapping conversations the correlation is an interpretive exercise performed months later by people who were not there.
The Clearance Authorization Receipt
Two assertions over one canonical object. The design constraint that governs everything is tempo: a control room under storm conditions will route around anything that adds meaningful delay.
{
"type": "manav-stmt/1",
"action": "clearance_issue",
"render": [
"Clearance: [number] Section: [from] to [to]",
"Switching sequence: [hash] — [n] steps, verified complete",
"Grounds applied: [locations]",
"Crew: [identifier] Requested by: [name]"
],
"constraints": { "distinct_credential": true, "window_seconds": 600 }
}The sequence hash matters more than it looks. It means the operator confirms a specific sequence, and a later dispute about whether the executed sequence matched the planned one resolves against the hash rather than against recollection.
Measuring the tempo cost before proposing it
Do not take this to an operations director as a security improvement. Take it with a measured number.
- Instrument the gesture on a training simulator with operators who do this daily, not with engineers.
- Measure elapsed time from confirmation prompt to completed assertion, twenty trials, reported as median and p95.
- Repeat under simulated high-load conditions with interruptions, which is the condition that matters.
- Present both figures. A control that costs a median of 1.2 seconds and a p95 of 4 seconds is a different proposition from one that occasionally blocks for thirty.
If the p95 is unacceptable, the answer is to fix the implementation, not to argue that operators should tolerate it.
The secondary benefit operations will notice first
Attribution is the compliance argument. The operational argument is different and lands better: a receipt carrying the sequence hash makes the reconciliation between planned and executed switching automatic rather than manual.
Misoperation investigations currently spend substantial effort establishing what was actually done versus what was planned. A signed sequence removes that step entirely, which is time returned to the people who conduct those investigations.
Honest limits
This does not prevent a qualified operator from issuing a clearance in error. It does not verify field conditions — the grounds are applied by a crew, and the operator confirms a report. And it does not help at all if the failure occurred in the field rather than in the control room, which is where a meaningful share of clearance incidents originate.
It answers one question: which named operator confirmed this exact sequence at this moment. Today that question is answered by a roster.
Why this record has to outlast the incident
| Party | When | Asks |
|---|---|---|
| Operations | Immediately | Was the clearance held? |
| Safety investigation | Days | Who issued and released it? |
| Regulator | Months | What was the operator shown? |
| Litigation | Years | All of the above, testably |
Objections and honest limits
“Clearance procedures are already rigorous.” They are, which is exactly why the record should match. A strong procedure evidenced by a session identifier is a strong procedure that cannot be demonstrated years later.
“Operators work at shared consoles under pressure.” They do, which is why the signature should attach to the clearance act rather than to the console session. One gesture at issue and one at release.
Binding a clearance
- Sign at issue and at release. Two acts, two signatures, one gesture each.
- Render the equipment and the limits. What is cleared, what is not, and the conditions.
- Bind to the switching order. So a changed order invalidates the clearance.
- Retain to the litigation horizon. Years, not the EMS retention period.
Terms used here
- Clearance
- An authorisation that equipment is isolated and safe to work on, and the control preventing re-energisation.
- Switching order
- The sequence of operations to achieve an isolation, prepared and reviewed before execution.
- Energy management system
- The control system through which switching and clearances are executed and recorded.
Frequently asked questions
Does this slow down emergency switching? The gesture adds roughly a second. Under emergency conditions, use the documented override, which records an exception rather than blocking the operation — a control that delays restoration has failed on its own terms.
Our operators are already under pressure. Is this another burden? It replaces a confirmation click with a confirmation gesture. Nothing is added to the procedure; the same confirmation produces a stronger record.
Is this required by NERC? No. Operating standards address operator authority and certification, not the evidentiary form of clearance records.
What about clearances held across shift change? The handover becomes a signed transfer, which is the point at which attribution currently breaks down entirely.
Why does a clearance record need more than a session? Because it is a life-safety control, and the questions asked about it arrive years later from investigators and courts.
Does this slow switching? One gesture at issue and one at release. The procedure and the review are unchanged.
What should the signature cover? The equipment, the limits, the conditions and the switching order it derives from.
Where this fits in Manav
Manav binds the operator to the exact command or clearance, verifiable at the device or the console without a live identity provider — which is the condition OT actually runs in.
Sources and further reading
- NERC Reliability Standards
- Published utility switching and tagging practice standards.
- FCC — protecting consumers from SIM swap and port-out fraud
- 29 CFR 1910.333 — Selection and use of work practices
- NERC — CIP reliability standards
- CISA — cybersecurity advisories