Why permits: lessons from oil and gas incidents

This is the last course in the oil and gas sites track. HSE-330 introduced the hazards of upstream and midstream sites, HSE-331 covered drilling, servicing and completions, and HSE-332 toured batteries, compressor stations, gas plants and pipelines and explained why isolation and line breaking are so dangerous. This course takes the next step: how work on those sites is authorized, how equipment is isolated before anyone opens it, how jobs that happen at the same time are kept from harming each other, and how control is handed back safely when the work is done.

HSE-221 teaches permit-to-work systems in general: what a permit is, the classic accidents behind modern systems, roles, the permit life cycle, simultaneous operations, handover and electronic permits. HSE-210 teaches lockout of machinery and HSE-211 and HSE-216 teach confined space entry and hot work. This course does not repeat those foundations. It applies them to the conditions that make oil and gas work different: sour gas and flammable hydrocarbons inside equipment that is still connected to live wells and pipelines, remote sites that are often unstaffed, crews drawn from many contractors, and wells and pipelines that cannot simply be switched off. If a term is unfamiliar, the HSE-221 lesson on that topic is the place to look.

Throughout the course we return to the invented operator Larchwood Resources and the sites you met in the earlier courses: the Pinecrest pad and battery, the Kettle Creek compressor station and the Spruce Ridge sour gas plant. On the Canadian site they sit in the Montney near Grande Prairie, Alberta; on the US site in the Bakken near Watford City, North Dakota. Raw gas carries about 0.5 percent hydrogen sulphide, and the acid gas inside the plant is far richer.

What makes permits harder in oil and gas

A permit system in a factory usually controls work on machines that can be stopped and locked. Oil and gas work is different in several ways that shape every lesson that follows.

• The hazard is inside the equipment. Vessels, lines and tanks hold flammable and toxic fluids under pressure, and the act of opening them can release the hazard even after they are isolated and drained.
• Sources cannot always be stopped. A producing well, a pipeline or a flare header may stay live while work goes on beside it, so isolation has to hold against a source that is still pushing.
• Sites are remote and often unstaffed. A battery may be visited once a day by a lease operator who covers many sites, so the person who authorizes the work may not be there while it is done.
• Many employers share the site. Drilling, completions, servicing, construction, inspection and maintenance contractors may all be present, each with its own procedures, and the operator or prime contractor must make them work as one system.
• Conditions change. Wind shifts, temperatures drop, wells surge, and a gas test that was clear an hour ago may not be clear now.

Pasadena, 1989: an isolation that did not meet the standard

On 23 October 1989, a release at a polyethylene plant in Pasadena, Texas, formed a flammable vapour cloud that ignited about two minutes later. Twenty-three people died and well over a hundred were injured. A contractor crew had been clearing plugged settling legs on a reactor. The leg being worked on was isolated by a single air-operated ball valve, even though the company's own standard and industry practice called for double block isolation or a blind. Investigators found that the valve's air hoses had been connected the wrong way round, so the air that should have held it closed opened it, and that the site procedure requiring the hoses to be disconnected during maintenance had not been followed. The UK HSE's case summary also notes that the permit system was not effectively enforced for either employees or contractors.

Pasadena is a chemical plant rather than an oilfield, but its lessons transfer directly to gas plants and batteries. The isolation level must match the hazard; an actuated valve is not an isolation unless its power source is removed and locked; and a procedure that differs from the company standard is a warning sign that nobody has checked.

Partridge-Raleigh, 2006: hot work on oilfield tanks without a permit

On 5 June 2006, three contract workers were killed and one was seriously injured at an oilfield production site near Raleigh, Mississippi. They were standing on top of oil production tanks preparing to weld piping between them. The US Chemical Safety Board (CSB) found that an open pipe on an adjacent tank had not been capped or isolated with a closed valve, so flammable vapour vented near the work and was ignited. Fire flashed back into connected tanks and the tops of two tanks blew off. Neither the contractor nor the operator required hot work permits, the contractor had no hot work procedures and did not follow API guidance on safe hot work, the welder had checked for vapour by putting a lit torch into the tank rather than using a gas detector, and a ladder was being used as a work platform between the tanks.

The CSB's report, released in 2007, recommended that OSHA set up an emphasis program to inspect oil and gas production sites, noting how common these practices were in the field. Small production sites are exactly where permits are most often skipped, because the job seems simple and the crew is small.

Williams Geismar, 2013: isolated from relief

On 13 June 2013, a heat exchanger called a reboiler ruptured at an olefins plant in Geismar, Louisiana, causing a boiling liquid expanding vapour explosion and fire. Two workers died and 167 people reported injuries, most of them contractors working on an expansion project. The CSB found that the reboiler was offline and had been isolated from its pressure relief valve by block valves whose positions were controlled only administratively. Non-routine operating activity introduced heat into the offline reboiler, which still held liquid propane mixture, and pressure rose until the shell failed. The installation of the block valves and the administrative controls for them had not been properly reviewed under management of change, and there was no hazard analysis or procedure for the activity under way that day. The CSB's final case study was released in October 2016.

The Geismar lesson for permit and isolation planning is that isolating equipment can create a new hazard. A closed valve that separates equipment from its relief device turns the equipment into a sealed container, and any heat or pressure that reaches it has nowhere to go. Isolation plans must ask not only what the isolation keeps out but what it traps in.

Near Grande Prairie, 2018: pressure where nobody expected it

In October 2018, a contractor servicing a low-producing well near Grande Prairie, Alberta, was killed and a labourer was injured when a separator vessel ruptured inside its building. According to the Alberta OHS fatality report, workers were building up pressure in the wellhead line to an emergency shutdown valve while the contractor was inside the separator building. The shutdown valve released, high-pressure gas flowed to a separator rated for about 860 kPa (125 psi), and the vessel exploded. The wellhead gauge had read zero on arrival, but the pressure switch and shutdown valve had not been tested or checked, and the gauge needle was later found wrapped around its face, past its 300 psi limit. The report does not say whether isolation procedures or permits were in place.

The incident shows several themes of this course in one small job: a zero gauge is not proof of zero pressure, equipment downstream of a high-pressure source must be protected from it, and people should not be inside a building or enclosure while a system is being pressured.

Regulators keep finding the same gaps

The Canada Energy Regulator issued a safety advisory on the control of hazardous energy in May 2022 after reviewing incidents and enforcement actions on federally regulated pipelines. It described a compressor taken out of service into which pressurized gas flowed back because key isolation points were missed, so that a cover blew off; a line that was isolated but not locked, which opened during an unexpected power outage and vented gas; and inspection findings of valves and electrical devices that were unlabelled or labelled differently from their drawings. The advisory reminded companies that the CER requires energy isolation systems that identify all hazards and controls, and it pointed to CSA Z460, the CSA standard on control of hazardous energy.

A permit system as a set of barriers

One helpful way to see a permit system is as a set of independent checks that each catch a different error. Planning catches hazards before the job reaches the site. Isolation keeps energy and fluid away from the work. Gas testing confirms the atmosphere is safe. The joint site visit confirms that what is on paper is what is in the field. Handover keeps the next shift from undoing the protection. Close-out confirms everything is back in a safe state. In the incidents above, more than one of these checks failed at once. The program below shows why: if each check is fairly reliable on its own, the chance that all of them fail together is small, but the chance rises sharply when checks are skipped or when they share a common weakness, such as a crew that has stopped taking them seriously.

# How skipping checks changes the chance that a hazardous error reaches the work.
# Each value is the invented chance that one check misses an error that is present.
checks = {
    "planning": 0.20,      # job planning and risk assessment
    "isolation": 0.10,     # isolation selected and verified
    "gas test": 0.10,      # gas test before and during work
    "site visit": 0.25,    # joint site visit by issuer and receiver
    "toolbox talk": 0.30,  # toolbox talk at the worksite
}

def chance_all_miss(names):
    p = 1.0
    for n in names:
        p *= checks[n]
    return p

full = list(checks)
print(f"All five checks used:            1 in {1 / chance_all_miss(full):>7,.0f}")
for skipped in ("gas test", "site visit"):
    used = [n for n in full if n != skipped]
    print(f"Skip the {skipped:<10}:            1 in {1 / chance_all_miss(used):>7,.0f}")
used = ["planning", "toolbox talk"]
print(f"Paperwork and a talk only:       1 in {1 / chance_all_miss(used):>7,.0f}")
# A shared weakness: a hurried crew makes every check twice as likely to miss.
hurried = 1.0
for n in full:
    hurried *= min(1.0, 2 * checks[n])
print(f"All five, but done in a hurry:   1 in {1 / hurried:>7,.0f}")

All five checks used:            1 in   6,667
Skip the gas test  :            1 in     667
Skip the site visit:            1 in   1,667
Paperwork and a talk only:       1 in      17
All five, but done in a hurry:   1 in     208

The numbers are invented, but the pattern is real. Dropping one check makes the chance of an error getting through four to ten times higher, and relying on paperwork and a talk alone makes it nearly 400 times higher. A crew that does every step in a rush, making each check twice as likely to miss, ends up about 30 times worse off than a careful crew, even while appearing to follow the system. This is why the lessons that follow keep returning to verification in the field rather than signatures on paper.

How this course is organized

Lessons 2 and 3 cover the legal map for permits and isolation in oil and gas and the people who run the system on remote, multi-employer sites. Lessons 4 to 6 cover the permit types used on oil and gas sites, with extra attention to hot work and gas testing in hydrocarbon and sour service and to line opening and vessel entry. Lesson 7 covers planning the job and preparing the plant. Lessons 8 and 9 cover isolation planning: choosing the isolation standard, then building the isolation certificate, locking it and proving it works. Lesson 10 covers simultaneous operations on pads, plants and pipelines. Lesson 11 covers handover, suspension, revalidation, de-isolation and closing permits. Lesson 12 brings everything together in a turnaround task at Spruce Ridge, with human factors, electronic permits and audits.